Question: Cross-regional event driven architecture

We use EventBridge to trigger a number of applications. The event rule's pattern is always time-based or S3-based. The setup looks like this:               Pattern                     Target               -------                     ------Event Rule 1   9pm daily                   ECS Cluster 1Event Rule 2   File dropped to S3 bucket   ECS Cluster 2The event rules and targets all live in the same AWS region. How can I make this cross-regional? The events should be produced and processed if one region is unavailable. Events can be produced in one region and consumed in another. The ECS clusters are already available in both Primary and Secondary regions.FollowComment

Answer: "1Hi,You can have an introductory read on this: https://aws.amazon.com/blogs/compute/introducing-cross-region-event-routing-with-amazon-eventbridge/It provides some good practices and limitations on the approach.Hope it helps ;)CommentShareEXPERTalatechanswered 16 days agoCode Different 16 days agoYes, I did read that guide. The event producers reside in a single region, which is problematic for our DR plan. If we lose that region, there will be no event for the consumers to process.Share1Duplicate Your Event Sources & Targets in the Secondary RegionIt appears that your event sources (daily 9pm trigger and file drop to S3 bucket) and targets (ECS Clusters) are already in both regions. If not, you'll need to duplicate your setup in the secondary region.Cross-Region EventBridge SetupAWS EventBridge does not support cross-region event delivery natively.However, you can work around this by leveraging SNS, SQS, or Lambda. Here's an example with SNS:Create an SNS Topic in your secondary region.Create an EventBridge rule in your primary region that targets the SNS Topic in the secondary region.Create an EventBridge rule in the secondary region that triggers based on messages published to the SNS Topic.This setup allows events triggered in your primary region to be sent to your secondary region.Consider Implementing Cross-Region Replication for S3If you want to make sure the S3 bucket event is also triggered in the secondary region if the primary region is down, consider implementing cross-region replication (CRR) for your S3 buckets. CRR automatically copies new objects across buckets in different AWS regions.Implement Failover StrategyIn case of failure in the primary region, you'll want a mechanism to failover to the secondary region. You can do this with Route53's DNS failover feature. You can set up health checks and if a check fails, Route53 can reroute traffic to your resources in your secondary region.CommentShareEXPERTsedat_salmananswered 16 days ago"


Question: How do I make an ECS cluster spawn GPU instances with more root volume than default?

"I need to deploy an ML app that needs GPU access for its response times to be acceptable (since it uses some heavy networks that run too slowly on CPU). The app is containerized and uses an nvidia/cuda base image, so that it can make use of its host machine's GPU. The image alone weighs ~10GB, and during startup it pulls several ML models and data which takes up about another ~10GB of disk.We were previously running this app on Elastic Beanstalk, but we realized it doesn't support GPU usage, even if specifying a Deep Learning AMI, so we migrated to ECS, which provides more configurability that the former. However, we soon ran into a new problem: selecting a g4dn instance type when creating a cluster, which defaults the AMI to an ECS GPU one, turns the Root EBS Volume Size field into a Data EBS Volume Size field.This causes the instance's 22GB root volume (which is the only one that comes formatted and mounted) to be too small for pulling our image and downloading the data it needs during startup. The other volume (of whatever size I specify during creation in the new Data EBS Volume Size field) is not mounted and therefore not accessible by the container. Additionally, the g4dn instances come with a 125GB SSD, that is not mounted either. If either of these were usable or it was possible to enlarge the root volume (which it is if using the default non-GPU AMI) ECS would be the perfect solution for us at this time.At the moment, we worked around this issue by creating an empty cluster in ECS, and the manually creating and attaching an Auto Scaling group to it, since when using a Launch configuration or template the root volume's size can be correctly specified, even if using the same exact ECS GPU AMI as ECS does. However, this is a tiresome process, and makes us lose valuable ECS functionality such as automatically spawning a new instance during a rolling update to maintain capacity.Am I missing something here? Is this a bug that will be fixed at some point?If its not, is there a simpler way to achieve what I need? Maybe by specifying a custom launch configuration to the ECS cluster or by automatically mounting the SSD on instance launch?Any help is more than appreciated. Thanks in advance!FollowComment"


Question: Athena Error- HIVE_BAD_DATA: Not valid Parquet file: s3://deng-utube-raw-us-east-1-dev/youtube/raw_stats_reference_data/FR_category_id.json expected magic number: PAR1 got: ] }

"I  have written a lambda function to convert json file in raw s3 bucket  into parquet file and gets uploaded directly it to the cleansed s3 bucket. I cannot delete json files since i want to convert it parquet . So while testing the lambda function, parquet format is shown in the bucket and destination table is also in parquet format . but don't know why athena is showing off this error. please help me with this one.FollowComment"

Answer: "0Accepted AnswerBased on the error , it looks like the table is pointing to a location which has a json files3://deng-utube-raw-us-east-1-dev/youtube/raw_stats_reference_data/FR_category_id.jsonCan you verify the following ?1- What is the Athena Table DDL showing up as LOCATION ?2- If the location is pointing to raw bucket , then it's a valid error .3- Verify the LOCATION of your table and point it to destination bucket /location which has only parquet file.CommentShareEXPERTDipankar_Ganswered 3 months agorePost-User-2028403 3 months agoI have figured it out...the problem lied in the location of destination bucket. Thankyou for the response.Share0I guess the S3 prefix you've told Athena to use contains json files somewhere?  It would be best to have separate prefixes for your json and parquet files, and configure Athena to just use the parquet files' prefix.CommentShareEXPERTskinsmananswered 3 months agorePost-User-2028403 3 months agoI have figured it out...the problem lied in the location of destination bucket. Thankyou for the response.Share"


Question: Registration of ip6.arpa DNS zones

"I have created a reverse IPv6 DNS zone for an Amazon provided IPv6 adress, following this knowledge article: https://aws.amazon.com/premiumsupport/knowledge-center/route-53-reverse-dns/This works fine when lookups are directed to the NS servers specified for the zone but it does not work for other DNS servers.For a normal DNS zones I would supply the NS records to the registrar for the domain so that all DNS servers becomes aware of the zones presence, but how does this work for ip6.arpa zones when the IPv6 network used is owned by Amazon?FollowComment"

Answer: "0Not at all.In order for you to publicly provide DNS data, you have to OWN the zone, officially. So the same way you have to buy a domain from a registrar for forward lookups, which then means that all the way from the root DNS servers to your zone every participant at each level knows where the next authoritative server is. The root servers know which servers are repsonsible for com, those know who's responsible for mycompany.com etc. etc. because you have registered that domain and all the necessary information has been provided to the superior organizations.It works roughly the same way for reverse DNS. If somebody has registered a block of IP addresses, somebody else cannot just go and serve PTR records for IP addresses in that range. Or more properly, you can serve them, but clients won't ask you for them, because all the way from the root servers, the clients won't be directed to your DNS server but in this case Amazon's because it's their registered IP range.So, either you have your own IPv6 addresses and configure everything to use those (and then have your own public DNS server with the reverse zone) or maybe you can upvote over here:https://repost.aws/questions/QUgROEsvrGTPKPAXFVCf8xwA/please-allow-reverse-dns-for-ec-2-i-pv-6CommentSharecharly4711answered 6 months ago"


Question: Best way to deploy to EKS

"is it best way to push image to ECR in build phase and runs kubectl command to deploy in test EKS cluster in test account, once testing completes and can we add another build phase that use the same image and run the kubectl command on the production cluster in production account.FollowComment"

Answer: "2Accepted AnswerBest approach is to implement Continuous Deployment on Amazon EKS using GitOps approach. Then CodeBuild would be restricted to the Continuous Integration phase (tests, scans, builds and pushes). There are many GitOps controllers out there, but Flux and ArgoCD are the most used.https://aws.amazon.com/blogs/containers/automating-amazon-eks-with-gitops/CommentShareRam_AWSanswered 2 months ago0Hi,I see no issues with the approach you have mentioned. It's convenient to manage a single repository and allow cross account read access to it since you need to build and upload to ECR just once.Another alternative is to setup cross account replication if you want maintain separation between test and production account. But in this case lifecycle rules and IAM policies are not replicated. You can also upload to each account separately. For me it just comes down to preference--SydCommentShareSydanswered 2 months ago"


Question: TGW-VPN with 2 Customers having overlapping on-prem CIDRs and Firewall in Inspection-VPC

"Hi,I have two clients and both are using 172.22.0.0/16 in their on-prem network.I have established IPSec VPN with both (using static routing) and have terminated the VPN on TGW in eu-west-1 for both. Both customers connect to their respective VPC (no overlapping CIDRs in VPCs). Customer-A connects to VPC-A. Customer-B connects to VPC-B.I'm making use of separate routing tables for each of them. There are total of 4 routing tables.Customer-A traffic gets routed to VPC-A using VPN-A-RT. Return traffic gets back to Customer-A using VPC-A-RT.Customer-B traffic gets routed to VPC-B using VPN-B-RT. Return traffic gets back to Customer-B using VPC-B-RT.Now, I need to put a AWS Network Firewall (AWNF) in an Inspection-VPC and filter both VPNs traffic.What I can do is that I can route traffic for each VPN using its respective route table to Inspection VPC.Using an Firewall-RT, I can then forward traffic to their respective VPC.Issue/Problem:When I get the (response) traffic back from VPCs (VPC-A and VPC-B) to the Inspection-VPC, how do I make sure that the response traffic eventually gets back to each customer properly, given then both use 172.22.0.0/16 on prem. Using the Firewall-RT, I can route the return traffic to only one customer's VPN, either Customer-A or Customer-B VPN.Can this issue be fixed by using policies in CloudWAN? Can I make use of CloudWAN for single TGW (or completely replace TGW with Core Network in Global Network) and use segments, policies and/or tags to make sure that I can do more of a policy based routing in this scenario? At this time, I'm trying to find a solution which does not involve private NAT sort of thing to managed overlapping on-prem CIDRs.FollowComment"

Answer: "1Because your clients are using the same IP range your options are limited.Network Firewall doesn't support different networks with overlapping IP addresses. But what you can do is create a separate VPC for each client and put Network Firewall endpoints in each VPC. You're essentially creating separate infrastructure for each client. This is necessary because (as you point out): How will the network know which 172.22.0.0/16 network to send the traffic back to? It doesn't - so separate VPCs and endpoints are the way to go.In the larger scheme of things, if you're able to use PrivateLink to present your application(s) to your client it will make everything much simpler. More options are discussed in this blog post.CommentShareEXPERTBrettski-AWSanswered 4 months agoShiraz Malik 4 months agoThanks, Brettski. I'll take a detailed look at the blog which I skimmed through just yesterday when I was searching for some relevant solution to my problem.I've also been going through the available docs on CloudWAN. I think even if I use segments in the core network, my issue will still persists. Segment's routing will still not be able to handle the forwarding of traffic for 172.22/16 to the customers' VPNs. What's your take on it?Thanks again for the response.ShareBrettski-AWS EXPERT4 months agoCloud WAN doesn't bring any solution for overlapping IP addresses: It's great for setting up policies and ensuring that different groups of applications can/can't communicate. So it might be helpful here; but not in solving the overlap issue.Share"


Question: "Metrics on health checks, data throughput, etc?"

"Hi!I was wondering if there are plans to get metrics on throughput or health checks for my GA listeners and endpoints.I'm currently using EC2 instances as the targets of my GA Endpoints, but I want health check and other data to know how things are going. Yes, I can use canaries and the like to verify my service is running, but I'd love to know if, for example, only 1 of my 5 instances is serving traffic - canaries couldn't detect this.I know I can use NLBs/ELBs as the Endpoint, and put my instances behind that, but it seems that I would just add to my cost. Thanks!!FollowComment"

Answer: "0Hello,Thanks for your question! Please see the following blog post for more information on how to use Flow Logs to get more metrics on you accelerator: https://aws.amazon.com/blogs/networking-and-content-delivery/analyzing-and-visualizing-aws-global-accelerator-flow-logs-using-amazon-athena-and-amazon-quicksight/It uses a combination of Lambda and Athena to build a dashboard using Amazon QuickSight to visualize the flow log data, such as top talkers using client IP addresses and traffic distribution across Global Accelerator endpoints.Thanks,SashaCommentShareAWS-Sashaanswered 3 years ago0You can now view and monitor CloudWatch metrics for Global Accelerator. https://aws.amazon.com/about-aws/whats-new/2019/12/aws-global-accelerator-supports-amazon-cloudwatch-metrics/CommentShareAWS-User-5708333answered 3 years ago"


Question: Sagemaker endpoint does not use latest approved model version

"I'm trying to troubleshoot why the sagemaker staging endpoint is not using the latest model version. I did the following steps:I started a new Sagemaker project and used the build, train, deploy and monitor model template.The pipeline automatically executes upon creating the project and I approved that model. The endpoint was successfully created using this model version 1.I cloned the repo, made a inconsequential change (just changed some training hyper params) and pushed the changes. Pipeline executes again successfully creating model version 2.I approved the version 2 and deploy script also runs successfully it seems based on the deploy logs but the endpoint keeps using version 1 of the model. (Also for some reason version 1 of the model appears as "Model-xxxxxxx" in the Models list while version 2 appears as "Pipeline-xxxxxx-xxxxxx"Would appreciate any help. Thank you!FollowCommentAWS-User-0823707 a year agoDid you approve the transition to "production" in CodeBuild for the first model? In the deploy script, in the function that retrieves the latest approved model, can you print which model it finds and verify that it's finding version 2? Additionally, the deployment script prints out cloudformation templates, did you verify that it shows version 2? If you can paste the deploy logs here that would be helpful.Share"


Question: IOT Core: UpdateThingShadowRequest returning InvalidArgumentsError when using a JSON structure that is complex than the standard examples.

"Hi,I am implementing a python based greengrassv2 script that is updating a Named Shadow on the IOT thing. My script is able to update the device shadow as expected with a basic json based string from the examples. However, when I try to update the device shadow with a slight more complex json structure the follow code throws an InvalidArgumentsError. If I manually paste in the jsons thing into the AWS console it updates fine.        # retrieve the UpdateThingShadow response after sending the request to the IPC server        op = ipc_client.new_update_thing_shadow()        op.activate(update_thing_shadow_request)Here is the slightly more complex json structure that causes the update_thing_shadow_request to throw the InvalidArgumentsError.Any ideas what could be the issue? I dont have much flexibility with the structure as it comes from the CSA standard for matter. I am trying to implement named shadows to hold device state information for devices that use the matter smart home standard. The json data structure is set by the connectivity standard alliance CSA{   "state": {     "reported": {       "0": {         "GeneralDiagnostics": {           "GeneralDiagnostics.DataVersion": 2765750396,           "NetworkInterfaces": [             {               "name": "docker0",               "isOperational": false,               "offPremiseServicesReachableIPv4": {},               "offPremiseServicesReachableIPv6": {},               "hardwareAddress": "02428a9277b4",               "IPv4Addresses": [                 "ac110001"               ],               "IPv6Addresses": [                 ""               ],               "type": 0             },             {               "name": "wlo1",               "isOperational": true,               "offPremiseServicesReachableIPv4": {},               "offPremiseServicesReachableIPv6": {},               "hardwareAddress": "142d27de389b",               "IPv4Addresses": [                 "c0a80088"               ],               "IPv6Addresses": [                 "2a02808481a2b900464020a0eb11f9d7",                 "2a02808481a2b900afa9aa386c61107e",                 "fe80000000000000cbd7a0f35f43e4fa"               ],               "type": 1             },             {               "name": "eno1",               "isOperational": false,               "offPremiseServicesReachableIPv4": {},               "offPremiseServicesReachableIPv6": {},               "hardwareAddress": "6cc217716cb7",               "IPv4Addresses": [],               "IPv6Addresses": [],               "type": 2             },             {               "name": "lo",               "isOperational": true,               "offPremiseServicesReachableIPv4": {},               "offPremiseServicesReachableIPv6": {},               "hardwareAddress": "000000000000",               "IPv4Addresses": [                 "7f000001"               ],               "IPv6Addresses": [                 "00000000000000000000000000000001"               ],               "type": 0             }           ],           "RebootCount": 1,           "UpTime": 101,           "TotalOperationalHours": 0,           "BootReason": 0,           "ActiveHardwareFaults": [],           "ActiveRadioFaults": [],           "ActiveNetworkFaults": [],           "TestEventTriggersEnabled": false,           "FeatureMap": 0,           "ClusterRevision": 1,           "GeneratedCommandList": [],           "AcceptedCommandList": [             0           ],           "EventList": [             0,             1,             2,             3           ],           "AttributeList": [             0,             1,             2,             3,             4,             5,             6,             7,             8,             65528,             65529,             65530,             65531,             65532,             65533           ]         }       }     }   } }Any advice or help would be greatly appreciatedFollowComment"

Answer: "0I tried to reproduce your operation on my device and everything works fine using the following code:from awsiot.greengrasscoreipc.clientv2 import GreengrassCoreIPCClientV2import osimport jsonclient = GreengrassCoreIPCClientV2()shadow = {...} # the large CSA shadowclient.update_thing_shadow(thing_name=os.environ['AWS_IOT_THING_NAME'], payload=bytes(json.dumps(shadow), 'utf8'), shadow_name='')Note: if you want to quickly experiment and test code for Greengrass, have a look at the following component: https://github.com/awslabs/aws-greengrass-labs-jupyterlab.CommentShareEXPERTMassimilianoAWSanswered 4 months agoOide Brett 4 months agoThanks Massimiliano,I appreciate your quick reply. I have noticed that my implementation usesclient = awsiot.greengrasscoreipc.connect()While your implementation example usesclient = GreengrassCoreIPCClientV2()I went ahead and changed the client to the V2 client but I still get the issue. I got my implementation working by reducing the depth of the shadow document by changing some of the deepest fields to strings. For exampleChanging"IPv6Addresses": [ "2a02808481a2b900464020a0eb11f9d7", "2a02808481a2b900afa9aa386c61107e", "fe80000000000000cbd7a0f35f43e4fa" ]To"IPv6Addresses": "[ 2a02808481a2b900464020a0eb11f9d7, 2a02808481a2b900afa9aa386c61107e, fe80000000000000cbd7a0f35f43e4fa ]"But I dont want to alter the underlying structure too much as its the defined structure as per the Matter CSA specification v1.0.When I get the error, here are the logs that show what happening.2023-02-14T07:33:30.965Z [WARN] (Copier) MCCDev-mcc-daemon: stderr. return self.__get_result(). {scriptName=services.MCCDev-mcc-daemon.lifecycle.Run.script, serviceName=MCCDev-mcc-daemon, currentState=RUNNING}2023-02-14T07:33:30.965Z [WARN] (Copier) MCCDev-mcc-daemon: stderr. File "/usr/lib/python3.10/concurrent/futures/_base.py", line 403, in __get_result. {scriptName=services.MCCDev-mcc-daemon.lifecycle.Run.script, serviceName=MCCDev-mcc-daemon, currentState=RUNNING}2023-02-14T07:33:30.966Z [WARN] (Copier) MCCDev-mcc-daemon: stderr. raise self._exception. {scriptName=services.MCCDeShare"


Question: IMDSv2 in yum (Amazon Linux 2)

"Hi,We're trying to track down and eliminate usage of the old instance metadata service (IMDSv1) on our instances so that we can set the metadata options to require HTTP tokens going forward. Using newer AMIs or updating packages like cloud-init takes care of most of it, but there was still one stubborn case coming from yum.We have installed yum-3.4.3-158.amzn2.0.4.noarch which seems to be the latest available.In /usr/lib/python2.7/site-packages/yum/yumRepo.py, in function _get_instance_info it is requesting the INSTANCE_IDENTITY_URI without first generating a token and providing the X-aws-ec2-metadata-token header.Does anyone know if there is an updated version that supports IMDSv2? Or somewhere I could contribute a patch? Or any other workaround?Thanks!-cwFollowComment"

Answer: "0Accepted AnswerHi chadawagner, thanks for the report.Switching your instances to IMDSv2-only will not break yum, since this is an optional code path that has a fallback.If you want, you can disable this code by settingreport_instanceid=noin /etc/yum.repos.d/amzn2-core.repo, which should cause yum to avoid making requests without tokens. We'll work on an update to yum to fix this.Thanks for using Amazon Linux!CommentShareAWS-User-1707783answered 3 years ago0Thanks! I won't worry about it then, good to know. I'll turn off the instance reporting so that I can continue to monitor the MetadataNoToken metric in CloudWatch.CommentSharechadawagneranswered 3 years ago0Hi,Unfortunately the "report_instanceid=no" setting doesn't seem to be disabling it. I'll go ahead and patch my local yumRepo.py file to disable the tokenless queries.Edit: oops, I had missed the amzn2-graphics.repo config file on GPU instance. That ought to do it...Edited by: chadawagner on Aug 12, 2020 10:05 PMCommentSharechadawagneranswered 3 years ago"


Question: Blocked IP Addresses

"We have 3 IPv4 blocks that appear to be partially blocked by some service with Amazon Hosting (third-party services/sites).  Not all destinations are in AWS, but traces do go to amazon.com sub-domains.Is there any service to look up why the IP would be blocked or how to re-validate and have the blocks removed from whatever blacklist is being used?FollowCommentJonTheNiceGuy 6 months agoHi! This is a bit tricky, as you've not described how you know it's being blocked by a particular AWS service. People can run their own deny and permit lists, using combinations of Network Access Control Lists, Security Groups aligned to particular network interfaces, AWS WAF and AWS Network Firewall. On top of that, if their device lives in a VPC network which doesn't have a route back to the source address (which some don't depending on how they've been built), this can also look like a traffic block too. Can you provide any more details?Share"


Question: Can Sagemaker RStudio mount an NFS share?

"Our existing Python code currently accesses data files residing on a file system. It navigates through folders to reach individual files and reads them.We would now like to migrate the code to notebooks hosted in Sagemaker Studio. The data files will be hosted in S3 buckets.However, we do not want to modify the code to use S3 API to access files. Instead, we would like to continue using a filesystem view of the files. What is the best way to make the S3 objects visible to the Sagemaker Studio as a filesystem?Please note that we would like to mount in Sagemaker studio and not on Sagemaker notebook.FollowComment"

Answer: "0SageMaker Studio uses EFS for storage. So you could potentially do an aws s3 sync and sync your S3 files/folders to EFS and use them as a filesystem. I'd also recommend to be cautious of the file sizes since EFS is more expensive.Studio now supports JupyterLab3 and you can now install popular extensions. So if you're just looking at viewing the S3 files from Studio, you can use the S3 file browser extension.CommentShareDurga_Sanswered 8 months ago"


Question: VPC Resource Map and Interface Endpoint

"On the Resource Map tool on VPC I see the gateway endpoints mapped correctly. However I also have an Interface Endpoint on the same VPC, but it does not appear on the Resource Map.Is this a missing feature of Resource Map? Or is my VPC configured incorrectly?Resource Map.2 Gateway Endpoints + 1 Interface EndpointFollowComment"

Answer: "0VPC endpoints are not included In the resource map as it only displays network related resources such as   (subnets, routes, gateways).VPC endpoints are more like a host objects IP addresses and not network related.What you are seeing is normal.CommentShareGary Mcleananswered a month agoEXPERTskinsmanreviewed a month ago"


Question: Getting many invoice emails from all member accounts

"We have one main AWS account in which we have provisioned many member accounts. As the number of our accounts has increased lately, we have this situation where the root email address gets separate invoice emails from AWS for every invoice issued for the accounts, which causes a lot of noise for the user of that email address.We were curious if there is a better approach for handling this problem, and if possible, we would like to know how companies with a large number of accounts (Netflix) would address this problem?FollowCommentawsOwenC a year agoWhy does this have the AWS Budgets tag? Is this related to budgets in some way?Share"

Answer: "1Hello DataC,For customers with multiple accounts we recommend AWS Organization's feature of Consolidated billing.   You can read more about this feature here.CommentSharegrelon-AWSanswered a year ago1I would suggest opening a billing support case from your "main" account - which I assume is the Management Payer account of your Organization, so the support team could investigate your particular account setup, because there might be several reasons why this is happening. For example:In AWS Organizations, only the Payer account gets one consolidated invoice per month.However, linked accounts may be purchasing subscription services, for example Reserved Instances, Savings Plans, registering Route53 domains, buying products through AWS Marketplaces... In this case, a separate invoice will be created for each subscription (you can check with Support team if this can be consolidated)It's likely you didn't update tax / VAT settings on your accounts (you can update them from the Payer account on all your linked accounts in the tax settings page of the billing console), this might be impacting the amount of tax invoices you receiveI recommend contacting support (open a billing case) with this question to clarify what you can do. Most likely scenario (from my experience) - it's because of your tax settings.CommentShareEXPERTNataliya_Ganswered a year ago"


Question: AWS IoT - NodeJS

"Hi, I'm starting as a developer and I have to use nodeJS as a way to send messages to connected devices in AWS IoT. I saw that the examples require that the nodejs code has device certificates such as: KeyPath, CertPath and CaPath. I put the data in the code and it worked normally, but in this case I am going to connect more than 1000 devices to AWS IoT and there will be no way to keep adding the certificates to the code, as there will be many devices. I wanted to know if there's anything I can do to get around this dilemma. Thank you!example:`var device = awsIot.device({keyPath: ''***********************************-private.pem.key',certPath: '***********************************-certificate.pem.crt',caPath: 'AmazonRootCA1.pem',clientId: 'esp32-device',region: 'sa-east-1',host: '************-ats.iot.sa-east-1.amazonaws.com',qos: 0})`FollowComment"

Answer: "0Hi,you can provide keyPath, certPath and other settings as command line parameters. So you would run your device with a command such as:mydevice.js /path/to/key /path/to/certKR,PhilippCommentSharePhilipp Sanswered a year ago0Good morning AWS-User-9708397,Thanks for raising your concern.If I understand correctly, you'd like to build a NodeJS app to remotely Command/Control your IoT devices; but the code samples you came across appear so tightly coupled to the devices (certificates) themselves that you are afraid it might not be scalable. Is that accurate?If so, then you are probably right. One of the recommended approach for this use case would be to decouple your NodeJS App from your devices (by using AWS Amplify for example).With AWS Amplify, you can build your desired NodeJS App, add App user identities to it and use those same identities in the cloud to connect to AWS IoT Core. Then using standard MQTT Publish/Subscribe/Connect functions, you can communicate with any (subset) of your devices via AWS IoT Core.Here is a very detailed example for reference.Let us know if that was helpful!CommentShareCharlyscott237answered 2 months ago"


Question: Amazon Inspector v2 Supporting Windows Targets

"We are assessing Inspector as a replacement for our current vulnerability scanning solution, and would like to know if there is a timeline for Inspector v2 to support scanning Windows based hosts.  Based on comments from a similar question from 5 or 6 months ago, it is on the roadmap, but is there a potential timeline for availability?Thanks in advance for your time and helpful input.FollowComment"

Answer: "0Hi Dataexception,I believe you would like to know if there’s an Amazon Inspector v2 that supports Windows based hosts. Currently Amazon Inspector does not support Windows based host [1] and there is no specific timeline for an update. I advise you to regularly check “What’s New with AWS?”[ 2] to see if there’s an update on new AWS updates.See References:[1] https://docs.aws.amazon.com/inspector/latest/user/supported.html[2] https://aws.amazon.com/new/CommentShareLwazianswered a year ago0It is now supported https://aws.amazon.com/about-aws/whats-new/2022/09/amazon-inspector-windows-os-continual-software-vulnerability-scanning-ec2-workloads/CommentShareJeremy_Sanswered 9 months ago"


Question: ALB Routing to Public IP

"Base QuestionI have an Application Load Balancer that needs to be able to forward a subset of requests out of AWS to a public IP hosted elsewhere.  The research I've done has pointed me towards needing to create a VPN to do this.  Is this really needed to route to an external IP?  What do I connect the VPN to?  Is a VPN the right solution, or is there an alternative solution that I'm overlooking?DetailsI support a few different products and due to differences in technology and product age, some need to be hosted outside of AWS.  However, there are integration points between products that are inside AWS and outside AWS, and we want users in the latest generation of the newest products to have a streamlined solution where it all fits under the umbrella of one root URL with product specific subdirectories, as in https://cust.somewhere.com/product where product could be one of four options.Our DNS is hosted in AWS and points at our ALB, where we have rules based on the subdirectory to direct 2 of the product options on to EC2 instances hosted in AWS, while the other 2 product options need to get sent back out of AWS to another hosting provider.  Because this routing is based on the subdirectory, DNS isn't helpful as far as I know, and I have to do it from the ALB.These non-AWS products already are externally accessible on another domain.  So, to me I just need to target the public IP used by that other domain's DNS.  That other system is already configured and tested ad-hoc to be able to route the domain coming from AWS.  But in order to get things routed for real from AWS to an IP outside of my VPC, I have to setup a VPN.  Is that valid, or is there a better way?FollowComment"

Answer: "1You can not route to Public IPs from ALB. Only below listed targets are supported as of today:Target typeWhen the target type is ip, you can specify IP addresses from one of the following CIDR blocks:The subnets of the VPC for the target group10.0.0.0/8 (RFC 1918)100.64.0.0/10 (RFC 6598)172.16.0.0/12 (RFC 1918)192.168.0.0/16 (RFC 1918)Reference: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html#target-group-ip-address-typeCommentShareEXPERTTushar_Janswered 5 months agoEXPERTBrettski-AWSreviewed 5 months agoTina 5 months agoIs a VPN the right solution then, or am I overlooking some other networking magic or target type?ShareTushar_J EXPERT5 months agoTargets can be located outside the load balancer’s VPC (this includes Peered VPC, and on-premises targets reachable over Direct Connect or VPN).Share0ALB allows you to redirect to another URL based on paths. You can evaluate that since you mentioned that the other products are accessible on another domainCommentShareSydanswered 5 months ago"


Question: Route 53 configuration issue

I purchased a domain in .click. I configured an EC2 instance with a html page and started httpd.I am able to access the html using the public ip of EC2 instance.I created A record in Route 53 for my .click domain under pubic hosted zone and pointed it to EC2 instance. But the html page is not accessible using the domain name.I tested the nslookup and dig using cloudshell. But getting error like "server cant find domain.click: NXDOMAIN"What I'm doing wrong. Kindly assist.FollowComment

Answer: "0HelloOnce registered a Domain in R53 you need to check the status of the domain if it is active or nor, Please check docs to check the Domain status , Once you see the Domain Is ACTIVE, test again.Also check this Knowledge center article for additional troubleshooting steps.CommentShareEXPERTTushar_Janswered 8 months ago"


Question: Streaming Replication in postgres between EC2 and Amazon RDS

Hello! I would like to know if it is possible to have my EC2 managed as Principal in postgres and have a read replica in Amazon RDS?FollowComment

Answer: "0Streaming replication between an EC2-based PostgreSQL database and an Amazon RDS instance is not directly supported. Amazon RDS provides built-in read replica support for databases within the RDS ecosystem only. You cannot create an RDS read replica directly from a PostgreSQL instance running on EC2.You can use third-party tools like Bucardo or pglogical to set up replication between your PostgreSQL instance on EC2 and an RDS instance.These tools can help you replicate data between the two instances, but please note that this approach may require more manual configurationand maintenance compared to using RDS read replicas.CommentShareEXPERTsedat_salmananswered a month agoSrihari a month agoCan I have any reference documentation which can explain in detail for bucardo or pglogicalShare"


Question: 404 not found ////// nginx 1.2.2

"Sesle çeviri198 / 5.000Çeviri sonuçlarıHelloI uploaded a laravel project to the server with Elastic Beanstalk. The homepage appears, but it gives 404 not found error for APIs, and it says nginx 1.2.2 under it. how can i solve this problemFollowComment"


Question: Cross-Account // Cross Org costs

"Hello,Does anyone know if this is a factor in a cost model? We are going to setup our own org within AWS to build Control Tower, but we are also taking services from our ISP in another account. The traffic will mainly be between the 2 organizations within the same region, over transit GW.Is there an added cost for cross-organization traffic?Kr,JTFollowComment"

Answer: "0Hello,I assume you are talking about TGW 'Intra-region' peering as you mentioned both Organizations are in the same region - This is charged to owners of each TGW. So there are two hourly charges. TGW1 per hour charge and TGW2 per hour charge.For more info, see this link that has following included: "For peering attachments, each Transit Gateway owner is billed hourly for the peering attachment with the other Transit Gateway."In addition to above there are data processing charges per GB of data processed.CommentShareEXPERTTushar_Janswered a year agoJTM a year agoHi, the question really was: When the traffic is between Organizations in AWS (in the same region), does that influence the cost in any way. I guess not, since at the moment I cannot really see anything stating it otherwise.So if we were to send traffic from one AWS org to another AWS org (Cross Account), there is no factor that would increase that cost?ShareTushar_J EXPERTa year agoHi,Your understanding is correct, there is no additional cost because the traffic is between Organizations.Share0If you are referring to Data Transfer charges, then if this is sent via TGW between different organizations but in the same AWS Region, then there are no additional charges for that networking data transfer usage.CommentShareEXPERTNataliya_Ganswered a year ago"


Question: "To allow access from the server behind alb, which address should I enter, alb or server?"

"I created a server behind alb.You are trying to connect from that server to another server that is not connected to alb.I am not sure whether to put the alb ip or the server ip to set the security group of the server not connected to alb, so I put both.In the case of alb, I know that all server communication is done through alb, so I think alb alone is fine, but I think I need to write the destination, so I think I need to put the server ip as well.I wonder if it is enough to set the security group with only one alb address or both.FollowComment"

Answer: "0Accepted AnswerIf the traffic is initiated from the server then it will come from the server IP address and it won't go through the ALB. Traffic that comes from the server but is in response to a session that was initiated from the ALB (in turn, which came from something external) will return through the ALB.CommentShareEXPERTBrettski-AWSanswered 10 months ago"


Question: Cant remove ressources

"Hi, i had for testing purposes a Workspace instance running. Now i tried to remove the directory . When i want to delete the directory i need to delete first the networkcards. When i try to detach the card it says "Error detaching network interfaceeni-abcdefg: You do not have permission to access the specified resource.".When i try to delete the security group it says:"Note that the following security groups cannot be deleted:These security groups are associated with one or more network interfaces. Delete the network interfaces, or associate them with different security groups. View your network interfaces.sg-1234- d-abcfeg_controllers"So what can i do?Best wishes,RobertFollowComment"

Answer: "0Accepted AnswerHi Robert,In order to delete the ENIs and security groups used by the directory, you need to delete the directory first. If you receive an error deleting a directory then please make sure that no AWS applications are enabled for the directory by following the steps in this link:https://docs.aws.amazon.com/directoryservice/latest/admin-guide/simple_ad_delete.htmlAfter deleting the directory, you should be able to delete the ENIs and security groups belonging to the directory.Thanks,AbdallahCommentShareAWS-User-3262046answered 3 years ago"


Question: Boto3 Dynamodb not able to connect from Other country but work from country its created

"I have this code        self.db_client = self.db_session.client("dynamodb", region_name="ap-southeast-2")        self.db_resource = self.db_session.resource("dynamodb", region_name="ap-southeast-2")        table = self.db_resource.Table(table_name)I want to read item in dynamodbIf i execute this code in  VPS in sydney , then it works.If i execute this  code in VPS in US , then its timing outIs there automatic restriction in AWS not to connect from outside region ?FollowComment"

Answer: "1I do not know what VPS is, but DynamoDB is a Web Service and you can connect to it from anywhere so long as you have a path to the internet or a DynamoDB VPC Endpoint.Ensure you can connect to the DynamoDB endpoint: curl dynamodb.ap-southeast-2.amazonaws.comEnsure you have a role attached to the instance you are connecting from, be it Instance Profile or Credentials.CommentShareEXPERTLeeroy Hannigananswered a year agoMirage a year agoI am running my code from Google cloud instance. I have 2 servers , one in US region and other in sydney in GCP . Same code i sync across 2 servers and i use KEY / SECRET inside script.   One in sydney run fine while US one timeout and when i click cancel , look like its stuck at   File "/usr/lib/python3.8/ssl.py", line 1241, in recv_into     return self.read(nbytes, buffer)   File "/usr/lib/python3.8/ssl.py", line 1099, in read     return self._sslobj.read(len, buffer) lineShareLeeroy Hannigan EXPERTa year agoYou did not curl like I suggested. I would suggest ensuring simple networking troubleshooting is complete before continuing.Share"


Question: Modifying column compression of existing table - Any impact to querying or inserting while compression is being modified?

"My team is hoping to convert many of our numeric and date/time based columns to az64 encoding.What I am wondering is if there is any impact to querying or inserting to these tables while the compression for various columns is being modified? This AWS post makes it seem that querying is not affected, where it says the following:With the new ALTER TABLE <tbl> ALTER COLUMN <col> ENCODE <enc> command, users can dynamically change Redshift table compression encodings. Redshift will take care of adjusting data compression behind the scenes and the table remains available for users to query.However, it doesn't mention any impact to inserts on the table, or any other considerations that need to be had. My team has some critical pipelines which depend on the availability of these tables, so I want to be sure that modifying the compression will not result in delays for us.FollowComment"


Question: Deepracer Student League - What is happening when model training is "Evaluating"

"Hello everyone,I was wondering what is happening during the "Evaluating" phase during training for deepracer student. I see through the simulation video that across evaluation runs, there are still big differences in deepracer performance, so I was wondering if it is comparing different policies that it formed during training. I am using the PPO algorithm. Thanks in advance!FollowComment"

Answer: "1Here is documentation regarding the reward graph and how to interpret it.In AWS DeepRacer, training happens in iterations. Each iteration is collection of <n> episodes, n is 20 by default for PPO, and is configurable and 1 for SAC, and is fixed. At the end of every iteration, latest model is saved as checkpoint for evaluation. Evaluation runs for 5 episodes (called Trials) and evaluation metrics (average completion percentage, average reward value) are saved. The current selection for criteria best model is at the maximum average completion percentage.Hope this information is helpful for you.CommentShareIoananswered 5 months ago"


Question: Query errors during refresh of Redshift Materialized Views

"When refreshing some materialized views, we get momentary errors like this:Underlying table with oid 1119447 of view <view-name> does not exist. Is this expected, and if so, is there some documentation around this? For reference, we do not use auto refresh, we refresh them each hour and do a full refresh each time.FollowComment"

Answer: "0Hello,I understand that while trying to refresh materialized views, you intermittently get the below error. You do manual refresh every hour of this materialized view."Underlying table with oid 1119447 of view <view-name> does not exist."I would like to inform you that "ERROR: Underlying table with oid 1119447 of view <view-name> does not exist"  might be caused due to concurrent transaction that happen at the same time as when the materialized views gets refreshed to incur the changes and doing select operation at same time causes conflict in transaction and results in the error. This is expected behavior in Redshift.To avoid this, I would suggest to Ideally apply explicit LOCKs[1] on the base tables when they are updating before triggering the refresh which would make the refresh query of the materialized view wait until the acquired LOCKs are released on the base table (auto or manual). So you can directly use the explicit LOCKs on your base tables to avoid the issue.Also, when you use the LOCK command, please make be sure that you do the following :Lock all tables affected by the transaction, including those affected by read-only SELECT statements inside the transaction.Lock tables in the same order, regardless of the order that operations are performed in.Lock all tables at the beginning of the transaction, before performing any operations.The LOCK command obtains a table-level lock in "ACCESS EXCLUSIVE" mode, waiting if necessary for any conflicting locks to be released. Explicitly locking a table in this way causes reads and writes on the table to wait when they are attempted from other transactions or sessions. An explicit table lock created by one user temporarily prevents another user from selecting data from that table or loading data into it. The lock is released when the transaction that contains the LOCK command completes.Below is the Syntax for LockLOCK [ TABLE ] table_name [, ...]Here table_name is the name of the table to lock. You can lock more than one table by using a comma-delimited list of table names. If possible please try to schedule refresh in non-business hours so that it doesn't conflict with users based queries.Please note, if the above solution doesn't work please feel free to raise a support case with AWS so that resource based troubleshooting can be done and the issue be mitigated.Thank you!References:[1] LOCKS: https://docs.aws.amazon.com/redshift/latest/dg/r_LOCK.html[2] Refreshing a materialized view: https://docs.aws.amazon.com/redshift/latest/dg/materialized-view-refresh.html[3] Serializable isolation: https://docs.aws.amazon.com/redshift/latest/dg/c_serial_isolation.html[4] Concurrent write examples: https://docs.aws.amazon.com/redshift/latest/dg/r_Serializable_isolation_example.htmlCommentSharerePost-User-3301913answered 23 days agoEXPERTFabrizio@AWSreviewed 23 days ago"


Question: Status 2/2 failed from amazon side.

"Hi team,One of our servers was down yesterday with a 2/2 status failed caused by Amazone. Due to which we are also unable to log in, I have tried multiple troubleshooting steps, such as starting, stopping, rebooting, enabling details monitoring, and collecting system logs, but it appears that we are unable to recover the instance at this time. I have also tried to increase server resources for a time being, but this did not solve the problem. Please help me to recover this issue also please follow the below logs for more details ( Instance type: m5.4xlrage, with 1000GB of gp2)[    0.000000] Linux version 5.8.0-1038-aws (buildd@lcy01-amd64-016) (gcc (Ubuntu 9.3.0-17ubuntu120.04) 9.3.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #4020.04.1-Ubuntu SMP Thu Jun 17 13:25:28 UTC 2021 (Ubuntu 5.8.0-1038.40~20.04.1-aws 5.8.18)[    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-5.8.0-1038-aws root=PARTUUID=5198cbc0-01 ro console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 panic=-1[    0.000000] KERNEL supported cpus:[    0.000000]   Intel GenuineIntel[    0.000000]   AMD AuthenticAMD[    0.000000]   Hygon HygonGenuine[    0.000000]   Centaur CentaurHauls[    0.000000]   zhaoxin   Shanghai[    0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'[    0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'[    0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'[    0.000000] x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256[    0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'standard' format.[    0.000000] BIOS-provided physical RAM map:[    0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable[    0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved[    0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved[    0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000bffe8fff] usable[    0.000000] BIOS-e820: [mem 0x00000000bffe9000-0x00000000bfffffff] reserved[    0.000000] BIOS-e820: [mem 0x00000000e0000000-0x00000000e03fffff] reserved[    0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved[    0.000000] BIOS-e820: [mem 0x0000000100000000-0x0000000ff7ffffff] usable[    0.000000] BIOS-e820: [mem 0x0000000ff8000000-0x000000103fffffff] reserved[    0.000000] NX (Execute Disable) protection: active[    0.000000] SMBIOS 2.7 present.[    0.000000] DMI: Amazon EC2 m5a.4xlarge/, BIOS 1.0 10/16/2017[    0.000000] Hypervisor detected: KVM[    0.000000] kvm-clock: Using msrs 4b564d01 and 4b564d00[    0.000000] kvm-clock: cpu 0, msr 124a01001, primary cpu clock[    0.000000] kvm-clock: using sched offset of 11809202197 cycles[    0.000003] clocksource: kvm-clock: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns[    0.000005] tsc: Detected 2199.474 MHz processor[    0.000602] last_pfn = 0xff8000 max_arch_pfn = 0x400000000[    0.000709] x86/PAT: Configuration [0-7]: WB  WC  UC- UC  WB  WP  UC- WT[    0.000736] last_pfn = 0xbffe9 max_arch_pfn = 0x400000000[    0.006651] check: Scanning 1 areas for low memory corruption[    0.006703] Using GB pages for direct mapping[    0.006927] RAMDISK: [mem 0x37715000-0x37b81fff][    0.006938] ACPI: Early table checksum verification disabled[    0.006945] ACPI: RSDP 0x00000000000F8F40 000014 (v00 AMAZON)[    0.006952] ACPI: RSDT 0x00000000BFFEDCB0 000044 (v01 AMAZON AMZNRSDT 00000001 AMZN 00000001)[    0.006958] ACPI: FACP 0x00000000BFFEFF80 000074 (v01 AMAZON AMZNFACP 00000001 AMZN 00000001)[    0.006964] ACPI: DSDT 0x00000000BFFEDD00 0010E9 (v01 AMAZON AMZNDSDT 00000001 AMZN 00000001)[    0.006968] ACPI: FACS 0x00000000BFFEFF40 000040[    0.006971] ACPI: SSDT 0x00000000BFFEF170 000DC8 (v01 AMAZON AMZNSSDT 00000001 AMZN 00000001)[    0.006975] ACPI: APIC 0x00000000BFFEF010 0000E6 (v01 AMAZON AMZNAPIC 00000001 AMZN 00000001)[    0.006978] ACPI: SRAT 0x00000000BFFEEE90 000180 (v01 AMAZON AMZNSRAT 00000001 AMZN 00000001)[    0.006981] ACPI: SLIT 0x00000000BFFEEE20 00006C (v01 AMAZON AMZNSLIT 00000001 AMZN 00000001)[    0.006985] ACPI: WAET 0x00000000BFFEEDF0 000028 (v01 AMAZON AMZNWAET 00000001 AMZN 00000001)[    0.006991] ACPI: HPET 0x00000000000C9000 000038 (v01 AMAZON AMZNHPET 00000001 AMZN 00000001)[    0.006994] ACPI: SSDT 0x00000000000C9040 00007B (v01 AMAZON AMZNSSDT 00000001 AMZN 00000001)[    0.006997] ACPI: Reserving FACP table memory at [mem 0xbffeff80-0xbffefff3][    0.006999] ACPI: Reserving DSDT table memory at [mem 0xbffedd00-0xbffeede8][    0.007000] ACPI: Reserving FACS table memory at [mem 0xbffeff40-0xbffeff7f][    0.007001] ACPI: Reserving SSDT table memory at [mem 0xbffef170-0xbffeff37][    0.007002] ACPI: Reserving APIC table memory at [mem 0xbffef010-0xbffef0f5][    0.007003] ACPI: Reserving SRAT table memory at [mem 0xbffeee90-0xbffef00f][    0.007004] ACPI: Reserving SLIT table memory at [mem 0xbffeee20-0xbffeee8b][    0.007005] ACPI: Reserving WAET table memory at [mem 0xbffeedf0-0xbffeee17][    0.007007] ACPI: Reserving HPET table memory at [mem 0xc9000-0xc9037][    0.007008] ACPI: Reserving SSDT table memory at [mem 0xc9040-0xc90ba][    0.007080] SRAT: PXM 0 -> APIC 0x00 -> Node 0[    0.007082] SRAT: PXM 0 -> APIC 0x01 -> Node 0[    0.007083] SRAT: PXM 0 -> APIC 0x02 -> Node 0[    0.007084] SRAT: PXM 0 -> APIC 0x03 -> Node 0[    0.007085] SRAT: PXM 0 -> APIC 0x04 -> Node 0[    0.007086] SRAT: PXM 0 -> APIC 0x05 -> Node 0[    0.007087] SRAT: PXM 0 -> APIC 0x06 -> Node 0[    0.007088] SRAT: PXM 0 -> APIC 0x07 -> Node 0[    0.007088] SRAT: PXM 0 -> APIC 0x08 -> Node 0[    0.007089] SRAT: PXM 0 -> APIC 0x09 -> Node 0[    0.007090] SRAT: PXM 0 -> APIC 0x0a -> Node 0[    0.007091] SRAT: PXM 0 -> APIC 0x0b -> Node 0[    0.007092] SRAT: PXM 0 -> APIC 0x0c -> Node 0[    0.007093] SRAT: PXM 0 -> APIC 0x0d -> Node 0[    0.007094] SRAT: PXM 0 -> APIC 0x0e -> Node 0[    0.007095] SRAT: PXM 0 -> APIC 0x0f -> Node 0[    0.007098] ACPI: SRAT: Node 0 PXM 0 [mem 0x00000000-0xbfffffff][    0.007099] ACPI: SRAT: Node 0 PXM 0 [mem 0x100000000-0x103fffffff][    0.007112] NUMA: Node 0 [mem 0x00000000-0xbfffffff] + [mem 0x100000000-0xff7ffffff] -> [mem 0x00000000-0xff7ffffff][    0.007121] NODE_DATA(0) allocated [mem 0xff7fd5000-0xff7ffefff][    0.007503] Zone ranges:[    0.007504]   DMA      [mem 0x0000000000001000-0x0000000000ffffff][    0.007505]   DMA32    [mem 0x0000000001000000-0x00000000ffffffff][    0.007507]   Normal   [mem 0x0000000100000000-0x0000000ff7ffffff][    0.007508]   Device   empty[    0.007509] Movable zone start for each node[    0.007513] Early memory node ranges[    0.007514]   node   0: [mem 0x0000000000001000-0x000000000009efff][    0.007515]   node   0: [mem 0x0000000000100000-0x00000000bffe8fff][    0.007516]   node   0: [mem 0x0000000100000000-0x0000000ff7ffffff][    0.007522] Initmem setup node 0 [mem 0x0000000000001000-0x0000000ff7ffffff][    0.007827]   DMA zone: 28770 pages in unavailable ranges[    0.013325]   DMA32 zone: 23 pages in unavailable ranges[    0.128485] ACPI: PM-Timer IO Port: 0xb008[    0.128498] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1])[    0.128538] IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23[    0.128541] ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level)[    0.128543] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)[    0.128545] ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level)[    0.128546] ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level)[    0.128551] Using ACPI (MADT) for SMP configuration information[    0.128553] ACPI: HPET id: 0x8086a201 base: 0xfed00000[    0.128562] smpboot: Allowing 16 CPUs, 0 hotplug CPUs[    0.128591] PM: hibernation: Registered nosave memory: [mem 0x00000000-0x00000fff][    0.128593] PM: hibernation: Registered nosave memory: [mem 0x0009f000-0x0009ffff][    0.128594] PM: hibernation: Registered nosave memory: [mem 0x000a0000-0x000effff][    0.128595] PM: hibernation: Registered nosave memory: [mem 0x000f0000-0x000fffff][    0.128597] PM: hibernation: Registered nosave memory: [mem 0xbffe9000-0xbfffffff][    0.128598] PM: hibernation: Registered nosave memory: [mem 0xc0000000-0xdfffffff][    0.128598] PM: hibernation: Registered nosave memory: [mem 0xe0000000-0xe03fffff][    0.128599] PM: hibernation: Registered nosave memory: [mem 0xe0400000-0xfffbffff][    0.128600] PM: hibernation: Registered nosave memory: [mem 0xfffc0000-0xffffffff][    0.128602] [mem 0xc0000000-0xdfffffff] available for PCI devices[    0.128604] Booting paravirtualized kernel on KVM[    0.128607] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645519600211568 ns[    0.128615] setup_percpu: NR_CPUS:8192 nr_cpumask_bits:16 nr_cpu_ids:16 nr_node_ids:1[    0.129248] percpu: Embedded 56 pages/cpu s192512 r8192 d28672 u262144[    0.129287] setup async PF for cpu 0[    0.129294] kvm-stealtime: cpu 0, msr fb8c2e080[    0.129301] Built 1 zonelists, mobility grouping on.  Total pages: 16224626[    0.129302] Policy zone: Normal[    0.129304] Kernel command line: BOOT_IMAGE=/boot/vmlinuz-5.8.0-1038-aws root=PARTUUID=5198cbc0-01 ro console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 panic=-1[    0.135405] Dentry cache hash table entries: 8388608 (order: 14, 67108864 bytes, linear)[    0.138445] Inode-cache hash table entries: 4194304 (order: 13, 33554432 bytes, linear)[    0.138515] mem auto-init: stack:off, heap alloc:on, heap free:off[    0.267053] Memory: 64693096K/65928732K available (14339K kernel code, 2545K rwdata, 5476K rodata, 2648K init, 4904K bss, 1235636K reserved, 0K cma-reserved)[    0.267061] random: get_random_u64 called from kmem_cache_open+0x2d/0x410 with crng_init=0[    0.267205] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=16, Nodes=1[    0.267222] ftrace: allocating 46691 entries in 183 pages[    0.284648] ftrace: allocated 183 pages with 6 groups[    0.284772] rcu: Hierarchical RCU implementation.[    0.284773] rcu: RCU restricting CPUs from NR_CPUS=8192 to nr_cpu_ids=16.[    0.284775] Trampoline variant of Tasks RCU enabled.[    0.284775] Rude variant of Tasks RCU enabled.[    0.284776] Tracing variant of Tasks RCU enabled.[    0.284777] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.[    0.284778] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=16[    0.287928] NR_IRQS: 524544, nr_irqs: 552, preallocated irqs: 16[    0.288408] random: crng done (trusting CPU's manufacturer)[    0.433686] Console: colour VGA+ 80x25[    0.949504] printk: console [tty1] enabled[    1.196291] printk: console [ttyS0] enabled[    1.200429] ACPI: Core revision 20200528[    1.204793] clocksource: hpet: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 30580167144 ns[    1.213129] APIC: Switch to symmetric I/O mode setup[    1.217629] Switched APIC routing to physical flat.[    1.223344] ..TIMER: vector=0x30 apic1=0 pin1=0 apic2=-1 pin2=-1[    1.228384] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x1fb441f3908, max_idle_ns: 440795250092 ns[    1.237533] Calibrating delay loop (skipped) preset value.. 4398.94 BogoMIPS (lpj=8797896)[    1.241533] pid_max: default: 32768 minimum: 301[    1.245565] LSM: Security Framework initializing[    1.249543] Yama: becoming mindful.[    1.253557] AppArmor: AppArmor initialized[    1.257659] Mount-cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)[    1.261614] Mountpoint-cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)[    1.266288] Last level iTLB entries: 4KB 1024, 2MB 1024, 4MB 512[    1.269534] Last level dTLB entries: 4KB 1536, 2MB 1536, 4MB 768, 1GB 0[    1.273534] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization[    1.277533] Spectre V2 : Mitigation: Full AMD retpoline[    1.281532] Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch[    1.285533] Speculative Store Bypass: Vulnerable[    1.289807] Freeing SMP alternatives memory: 40K[    1.406501] smpboot: CPU0: AMD EPYC 7571 (family: 0x17, model: 0x1, stepping: 0x2)[    1.409675] Performance Events: Fam17h+ core perfctr, AMD PMU driver.[    1.413537] ... version:                0[    1.417532] ... bit width:              48[    1.421532] ... generic registers:      6[    1.425532] ... value mask:             0000ffffffffffff[    1.429532] ... max period:             00007fffffffffff[    1.433532] ... fixed-purpose events:   0[    1.437532] ... event mask:             000000000000003f[    1.441596] rcu: Hierarchical SRCU implementation.[    1.446253] smp: Bringing up secondary CPUs ...[    1.449663] x86: Booting SMP configuration:[    1.453539] .... node  #0, CPUs:        #1[    0.937207] kvm-clock: cpu 1, msr 124a01041, secondary cpu clock[    1.455817] setup async PF for cpu 1[    1.457530] kvm-stealtime: cpu 1, msr fb8c6e080[    1.469534]   #2[    0.937207] kvm-clock: cpu 2, msr 124a01081, secondary cpu clock[    1.471039] setup async PF for cpu 2[    1.473530] kvm-stealtime: cpu 2, msr fb8cae080[    1.481657]   #3[    0.937207] kvm-clock: cpu 3, msr 124a010c1, secondary cpu clock[    1.485679] setup async PF for cpu 3[    1.489530] kvm-stealtime: cpu 3, msr fb8cee080[    1.497656]   #4[    0.937207] kvm-clock: cpu 4, msr 124a01101, secondary cpu clock[    1.499437] setup async PF for cpu 4[    1.501530] kvm-stealtime: cpu 4, msr fb8d2e080[    1.513649]   #5[    0.937207] kvm-clock: cpu 5, msr 124a01141, secondary cpu clock[    1.515060] setup async PF for cpu 5[    1.517530] kvm-stealtime: cpu 5, msr fb8d6e080[    1.525659]   #6[    0.937207] kvm-clock: cpu 6, msr 124a01181, secondary cpu clock[    1.529602] setup async PF for cpu 6[    1.533530] kvm-stealtime: cpu 6, msr fb8dae080[    1.541658]   #7[    0.937207] kvm-clock: cpu 7, msr 124a011c1, secondary cpu clock[    1.543028] setup async PF for cpu 7[    1.545530] kvm-stealtime: cpu 7, msr fb8dee080[    1.553662]   #8[    0.937207] kvm-clock: cpu 8, msr 124a01201, secondary cpu clock[    1.558560] setup async PF for cpu 8[    1.561530] kvm-stealtime: cpu 8, msr fb8e2e080[    1.569799]   #9[    0.937207] kvm-clock: cpu 9, msr 124a01241, secondary cpu clock[    1.573726] setup async PF for cpu 9[    1.577530] kvm-stealtime: cpu 9, msr fb8e6e080[    1.585658]  #10[    0.937207] kvm-clock: cpu 10, msr 124a01281, secondary cpu clock[    1.587067] setup async PF for cpu 10[    1.589530] kvm-stealtime: cpu 10, msr fb8eae080[    1.597671]  #11[    0.937207] kvm-clock: cpu 11, msr 124a012c1, secondary cpu clock[    1.602918] setup async PF for cpu 11[    1.605530] kvm-stealtime: cpu 11, msr fb8eee080[    1.613655]  #12[    0.937207] kvm-clock: cpu 12, msr 124a01301, secondary cpu clock[    1.617734] setup async PF foFollowComment"

Answer: 0Please try the procedures outlined here: How do I use EC2Rescue for Linux to troubleshoot operating system-level issues?.CommentShareEXPERTkentradanswered a year ago


Question: Configure Private registry in k8s 1.24

"Hi All. Does anyone know how to configure private registry in EKS(1.24) which uses containerd? we previously used to set this up using a node template which would add the private registry into the daemon.json file during creation, is the a similar way we could achieve this?FollowComment"

Answer: "0You might add settings to /etc/containerd/config.toml as follows.       [plugins."io.containerd.grpc.v1.cri".registry.configs]+        [plugins."io.containerd.grpc.v1.cri".registry.configs."<your_private_regsitry>".tls]+          insecure_skip_verify = true        [plugins."io.containerd.grpc.v1.cri".registry.headers]        [plugins."io.containerd.grpc.v1.cri".registry.mirrors]+        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."<your_private_regsitry>"]+          endpoint = ["http://<your_private_regsitry>"]CommentSharehayao-kanswered 5 months agorePost-User-8428534 5 months agoHi, thanks for your response. we have tried adding this to our launch template but it seems like EKS overrides the changes we make to this file. Are you aware of how we could overcome this?Share"


Question: Can two servers connect to the same AWS CodeCommit repository?

Can two servers connect to the same AWS CodeCommit repository?Is there any possibility of error or conflict?FollowComment

Answer: "1Yes, any number of servers or computers can clone a AWS CodeCommit repo. Since CodeCommit uses Git and Git is a distributed revision control system, it means that each clone is a complete copy of the Git database. If you and your team are trying to commit conflicting changes to a file in the same branch on CodeCommit, whoever is trying to make the last commit will need to reconcile those conflicts before Git will allow the commit to happen.Here are our docs on connecting to a Git repo in AWS CodeCommit https://docs.aws.amazon.com/codecommit/latest/userguide/how-to-connect.htmlHere are the basics of how merging works in Git - https://git-scm.com/book/en/v2/Git-Branching-Basic-Branching-and-MergingCommentSharemicahanswered a year agotanpreet19 a year agoI would like to clarify more on this query.Two servers are Gitlab servers and we want to mirror repositories from these server to same AWS codecommit respository. Will there be any conflict?Share"


Question: Codebuild Action Configurator 1000 Character limit

Is there a best practice workaround for the Codebuild Action Configurator 1000 Character limit?Ref: https://docs.aws.amazon.com/codepipeline/latest/userguide/reference-variables.html.The customer has hit an obscure error with CodeBuild Action Configuration blocks for defining environment variables.FollowComment

Answer: "0Hi Kawhik,Do you have some sample of such configuration?In general CodePipeline actions are only meant to transport dynamic values from pipeline runtime. You can off-load as much static configuration as possible to CodeBuild project setup itself and just specify overrides in CodePipeline action (eg. define most environment variables in buildspec/project definition and then only pass extra values via pipeline).Another way is (as usual in case of passing large chunks between AWS services) to upload some big results into S3 and then load them in CodeBuild project at run-time.Also, if the limit is hit by just some margin you have to remember that it's literally about characters count - dropping whitespace characters can help you pack more.But still - would be good to see example.CommentShareRafal Wrzeszczanswered a year ago"


Question: Is it possible to call rest API from AWS glue job

"I have rest API, which I need to call from AWS glue job and read some data from it for my transformation. Is it possible to handle that from AWS glue job.FollowComment"

Answer: "0Currently Glue does not have any in built connectors which can query a REST API directly. However if you can create your own custom code either in python or scala that can read from your REST API then you can use it in Glue job.Case1 : If you do not have any connection attached to job then by default job can read data from internet exposed Rest API directly.Case2: If you have glue connection attached to job, then make sure you have route of NAT gw in private subnet so that job can read data from Rest API.CommentShareShubham_Panswered a year ago"


Question: Why kubernetes secret needs to be encrypted?

"Based on this article (link), Implementing envelope encryption is considered a security best practice for applications that store sensitive data and is part of a defense in depth security strategy.But from what I know, etcd (where kubernetes secret stored) is part of control plane and control plane is managed by AWS (link). Should it be secure already ? Why do we need to encrypt it?FollowComment"

Answer: "2Everything in the cloud follows shared responsibility model.Nothing should be assumed secure "already".etcd is indeed managed by AWS, but AWS does not implement by default additional encryption on top of whatever Kubernetes has.Secrets is one of the worst names in my opinion in K8s. By default secrets are stored in a base64 encoded format in etcd. It's not safe as it can be decoded very easily.If it indeed is secret, you should encrypt it before it's being stored in etcd.Maybe the official document explains this very well -Kubernetes Secrets are, by default, stored unencrypted in the API server's underlying data store (etcd). Anyone with API access can retrieve or modify a Secret, and so can anyone with access to etcd. Additionally, anyone who is authorized to create a Pod in a namespace can use that access to read any Secret in that namespace; this includes indirect access such as the ability to create a Deployment.CommentShareJason_Sanswered a year agoapriliopajri a year agohi @Jason_S. thank you for your answer. so person who can exploit this is anyone who is authorized to create a Pod in a namespace.I have more question. You mention that "Anyone with API access can retrieve or modify a Secret". What API do you refer to ? Is it API call between pod or something else ?ShareJason_S a year agoHi - that would be get GET operation for secrets. It's an API call made to the control plane. You can restrict access through RBAC / ABAC. Of course, you should ALWAYS encrypt secrets regardless of your access policies. https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/secret-v1/ShareJatin Mehrotra 7 months agoI think this answer is misleading because in the documentation it is clearly mentioned All of the data stored by the etcd nodes and associated Amazon EBS volumes is encrypted using AWS KMS.which means  encryption of etcd nodes is managed by AWS managed keys and Kubernetes stores data in etcd encrypted but EKS encrypts it.Share0I would suggest (if your use-case applies of course) to consider storing your EKS secrets in AWS Parameter store or AWS Secrets Manager. In both cases, they are the official place for such purpose, as well as the ability to encrypt those secrets with a KMS key (including a CMK key). You can then provide your users or systems access to the secret via access to the KMS key (in order to decrypt the secret) as needed.More info here: https://docs.aws.amazon.com/eks/latest/userguide/manage-secrets.htmland here: https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_csi_driver.htmlLastly a tutorial as well: https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_csi_driver_tutorial.htmlAs to why secrets need to be encrypted - Well, from either physical theft of the storage at AWS itself (EKS runs on some disk storage, and if the secrets are not encrypted, they can be potentially retrieved if stolen), or, from the components within EKS (such as etcd, pods, config files, etc) if the access control mechanisms are not done properly. Storing secrets in Parameter Store or Secrets Manager as well as using a KMS key ensures that those secrets are protected from both physical theft and security misconfigurations such as the case with etcd. This is a requirement for many security compliance purposes.Hope this helps.CommentShareZadusPlaceanswered a year ago0Kubernetes does not encrypt data by default by storing in etcd volume, however when using EKS it will encrypt data by default for all etcd volumes using EBS encryption. Secrets encryption is an additional encryption which means underlying data and secrets are already encrypted.CommentShareJatin Mehrotraanswered 7 months ago"


Question: Is there a way to pass through specific optional input parameters

"Let's say I define a task state that invokes a Lambda. I'm wondering if there's a way I can pass through or default a specific optional input parameter in the Parameters property."someState": {  "Type": "Task",  "Resource": "arn:aws:states:::lambda:invoke",  "Parameters": {    "FunctionName": "someFunction",    "InvocationType": "RequestResponse",    "Qualifier.$": "$.environmentId",    "Payload": {      "environmentId.$": "$.environmentId",      "someParameter.$": "$.someParameter",    }  }}If someParameter is included in the input I want it to be passed through. Else I'd want one of:• Omit it.• Be able to configure a default for it.• Or if it even defaulted to null automatically, that'd be workable for me.Is there a way to do that?What actually happens is an error like:{  "error": "States.Runtime",  "cause": "An error occurred while executing the state 'someState' (entered at the event id #7). The JSONPath '$.someParameter' specified for the field 'someParameter.$' could not be found in the input"}Consider this scenario: I have application environments staging and production that execute the step function. someFunction has aliases with those names.I want someFunction to utilize a new request parameter that will be passed in the input to the step function.The first thing that will happen is the Lambda code deployed to the staging alias will be updated to utilize the new parameter and the application running in the staging environment will pass it to the step function.At this point the application running in the production environment will not have been updated to pass the new parameter to the step function.So if I can just optionally pass through the new parameter, all would be well. But in reality it would break the production environment.So far the best solution I can think of is to change to..."Payload": "$"...to pass everything through and pick out the parameters I'm interested in in the Lambda, but it means passing unnecessary data and the state configuration no longer documents the expected parameters.Edited by: Jesse12345 on Nov 12, 2019 1:26 PMEdited by: Jesse12345 on Nov 13, 2019 6:22 AMFollowCommentBrettRyan-Telstra 8 months agoThis is not presently possible and is my most wanted feature for step functions. You can do tricks with the Pass state and the transient function States.JsonMerge but it's terribly inconvenient.Share"

Answer: "0Hi @Jesse12345Could you find an answer to the question?Also, your suggestion of"Payload": "$"might not work.It will work if you change it to:"Payload.$": "$"Best,Taha.CommentSharetaha4dataanswered 3 years ago0I am facing the same issue. from my research it seems there is no good way to do this currently.The only workaround I found was to use a "Choice" task:See the article here:https://medium.com/analytics-vidhya/aws-step-function-tricks-ffe7eef81a5eCommentSharealxdanswered 3 years ago"


Question: tryin to get ec2volume mounted ec2instances

I am trying to get the volumes mounted on my ec2instanceget-ec2volume -filter @{name='attachment.instance-id'; values="*"} |? {$_.Attachments.InstanceId -eq 'i-xxxxxxxxxxxx'}but I also want to get the Tag with Name as well.any idea?FollowComment

Answer: "0What is the expected output you are looking for? Tags are returned as part of Get-EC2Volume command output. If you are trying to specifically return a list of tags for a particular EBS volume based on an EC2 instance ID, then you can try something like this:# Print Instance ID and Tags for a particular EC2 instance's EBS volume$tagKeyValue = ""get-ec2volume -filter @{name = 'attachment.instance-id'; values = "*" } | % {     if ($_.Attachments.InstanceId -eq '<instance id>') {        # Concatenate tags in a string (key:value;key2:value2...)        if ($_.Tags.Count -gt 0) {            $counter = 0            while ($counter -lt $_.Tags.Count) {                $tagKeyValue += ("{0}:{1};" -f $_.Tags[$counter].Key, $_.Tags[$counter].Value)                write-host $counter                $counter++            }        }         @{            InstanceId = $_.Attachments.InstanceId            Tags       = $tagKeyValue        }    }}Sample outputName                           Value----                           -----Tags                           Name:test.local;test:test;InstanceId                     i-xxxxxxxxxxxxxxxxxxxxxxxCommentShareTaka_Manswered 7 months ago"


Question: STM32L4 discovary board AWS IoT Tera Term Error

"So I went through all the steps to connect the STM32L4 to the AWS Cloud although the error I am receiving on Tera Term is shown in the image below, how do I rectify this issue?FollowComment"

Answer: "0Hi Obinex. The invalid packet error is unexpected. You have established a TLS connection, but failed to get an MQTT connection. Can you please check, and perhaps share, the IoT policy attached to the certificate? You would fail at this same stage if the policy did not allow connection or there was no policy attached. Although in that case I would expect MQTTRecvFailed not MQTTBadResponse.CommentShareEXPERTGreg_Banswered 8 months agoObinex 8 months agoHey Greg_B thank you for the reply I have attached a screenshot of the policy of my device below:Share0CommentShareObinexanswered 8 months ago"


Question: When will be MariaDB 10.7+ for RDS available? What are plans about short support periods of MariaDB releases?

"Hello,we are waiting and looking forward to MariaDB 10.7+ for RDS. I know that nobody can provide exact date but still. Can we expect it in reasonable time span?Version 10.7 was released on 14th Feb 2022 and it is still not available for RDS. (after 9 months)Version 10.6 was released on 6th Jul 2021 and it was available for RDS on 3rd Feb 2022. (after 7 months)So it is about time for 10.7 :) . Do we have some gossip?Plus MariaDB seems to have stopped LTS or significantly shortened its length. What are plans regarding this fact?FollowComment"


Question: How i can cancel subscription?

My kids press something on AWS and this is take my money ! but i don't use it! please help meFollowComment

Answer: 0I assume. you have a AWS account ..if so you can go in cost explore and check  what is cosy towards and if its not used by you you can stop those services.https://docs.aws.amazon.com/cost-management/latest/userguide/ce-what-is.htmlCommentShareAWS-User-3429271answered a month ago


Question: Amazon Redshift

"Hi Amazon Redshift cluster is erroring out "ERROR: Query (2842874) cancelled on user's request".  We are using Redshift query editor v2. Is there any script or query we can check or logs which will tell us why this is happening. If there is any setting which we need to change please let know, Thanks in advance.FollowComment"

Answer: "3Please note that the query in Amazon Redshift can abort for the following reasons:Due to Amazon Redshift workload management (WLM) query monitoring rules implemented on cluster.Timeout settingsABORT, CANCEL, or TERMINATE requests by user/ admin.Network issues.Cluster maintenance upgrades.Internal processing errors.ASSERT errors.You can prevent the query from being aborted, by some of the approaches mentioned belowIncrease your timeout parameter.Update your WLM QMR rules [ If you have found out which rule is aborting your query]Schedule long-running operations outside of maintenance windows.CommentShareSrikant Dasanswered 7 months ago0This could be anywhere from user actually cancelling query to firewall rules disconnecting web sockets. Best recourse is to log a support ticket and have it investigated.CommentShareMilindOkeanswered 7 months ago"


Question: Glue ETL converts NULL values of Snowflake columns to 0

Answer: "0Can you please check the data preview of the "Data source" components, they probably come already as "0.0" from the connector in which case you would need to update a support ticket with the connector provider on the marketplace.CommentShareGonzalo Herrerosanswered 3 months ago"


Question: AWS Security Hub analytic pipeline Cloud formation

"Hi,Whilst I am able to run and complete a sample app in AWS CDK, When trying to follow the blog post on Security Hub pipeline I am consistently getting module errors for aws_cdk.Is there any ability to be provided cloudformation for what the cdk script is trying to establish?Thanks,FollowCommentDavid Hessler a year agoHi User!  I'm the author of this blog post and I'm happy to help.Can you provide more information as to the issues/error you are experiencing?  You can provide more details either here or in an issue via Github. While we've had multiple customer deploy this successfully across multiple regions, I love to learn how I can improve your experience.Unfortunately, in this case, because CDK code deploys both containers and lambda functions as part of the cdk deploy, I cannot simply turn over generated cloudformation.ShareAWS-User-5410463 a year agoHi David,Thanks for the prompt reply. Appreciate you taking the time to reach out regarding this issue. Thank you for the informaiton regarding containers and lambda's, I understand how a cloudformation would not suffice in this case.I thought that the problem is on my side. I first followed an example, checking my installation of CDK with sample-app as this was my first time using it. I confirmed that I was able to bootstrap the CDK and deploy it to ap-southeast-2 my default region and I had required permissions.I then moved onto the blog post after I had finished with sample-app but after setting up the .venv, activating it, and installing the requirements I am only able to get a traceback error."Traceback (most recent call last):File "app.py", line 3, in <module>from aws_cdk import core as cdkModuleNotFoundError: No module named 'aws_cdk'"I'm on Windows so, I have removed python and reinstalled, downgraded python to 3.8, tried to run the venv from both command promp and powershell, have tried to include system site packages in my pyvenv.cfg but nothing so far has worked the way it worked for me in the sample app.Share"

Answer: "0Accepted AnswerHi there, AWS Support Engineer here. Another way to quickly test out the blog solution is to spin up a Cloud9 environment, this way you can have a clean CDK IDE with all requirements installed in just a few minutes.CommentShareSUPPORT ENGINEERZhiyuan_Lanswered a year agoAWS-User-5410463 a year agoThanks Zhiyuan, this suggested fixed my initial problem!Share0Based upon your traceback, it appears as though your pip install -r requirements.txt command is not installing the dependencies correct.  You can troubleshooting this using the pip freeze command.  The result of a pip freeze should look something like the following.attrs==21.4.0aws-cdk.assets==1.149.0aws-cdk.aws-acmpca==1.149.0aws-cdk.aws-apigateway==1.149.0aws-cdk.aws-applicationautoscaling==1.149.0aws-cdk.aws-autoscaling==1.149.0aws-cdk.aws-autoscaling-common==1.149.0aws-cdk.aws-autoscaling-hooktargets==1.149.0aws-cdk.aws-certificatemanager==1.149.0aws-cdk.aws-cloudformation==1.149.0aws-cdk.aws-cloudfront==1.149.0aws-cdk.aws-cloudwatch==1.149.0aws-cdk.aws-codebuild==1.149.0aws-cdk.aws-codecommit==1.149.0aws-cdk.aws-codeguruprofiler==1.149.0aws-cdk.aws-codepipeline==1.149.0aws-cdk.aws-codestarnotifications==1.149.0aws-cdk.aws-cognito==1.149.0aws-cdk.aws-ec2==1.149.0aws-cdk.aws-ecr==1.149.0aws-cdk.aws-ecr-assets==1.149.0aws-cdk.aws-ecs==1.149.0aws-cdk.aws-efs==1.149.0aws-cdk.aws-elasticloadbalancing==1.149.0aws-cdk.aws-elasticloadbalancingv2==1.149.0aws-cdk.aws-events==1.149.0aws-cdk.aws-events-targets==1.149.0aws-cdk.aws-globalaccelerator==1.149.0aws-cdk.aws-glue==1.149.0aws-cdk.aws-iam==1.149.0aws-cdk.aws-kinesis==1.149.0aws-cdk.aws-kinesisfirehose==1.149.0aws-cdk.aws-kms==1.149.0aws-cdk.aws-lambda==1.149.0aws-cdk.aws-lambda-python==1.149.0aws-cdk.aws-logs==1.149.0aws-cdk.aws-route53==1.149.0aws-cdk.aws-route53-targets==1.149.0aws-cdk.aws-s3==1.149.0aws-cdk.aws-s3-assets==1.149.0aws-cdk.aws-s3-notifications==1.149.0aws-cdk.aws-sam==1.149.0aws-cdk.aws-secretsmanager==1.149.0aws-cdk.aws-securityhub==1.149.0aws-cdk.aws-servicediscovery==1.149.0aws-cdk.aws-signer==1.149.0aws-cdk.aws-sns==1.149.0aws-cdk.aws-sns-subscriptions==1.149.0aws-cdk.aws-sqs==1.149.0aws-cdk.aws-ssm==1.149.0aws-cdk.aws-stepfunctions==1.149.0aws-cdk.cloud-assembly-schema==1.149.0aws-cdk.core==1.149.0aws-cdk.custom-resources==1.149.0aws-cdk.cx-api==1.149.0aws-cdk.region-info==1.149.0boto3==1.21.21botocore==1.24.21cattrs==1.10.0constructs==3.3.245jmespath==1.0.0jsii==1.55.1publication==0.0.3python-dateutil==2.8.2s3transfer==0.5.2six==1.16.0typing_extensions==4.1.1urllib3==1.26.9You mentioned you are on windows. Are you running via Powershell Command Line or cmd?  The virtual env command (% .venv/Scripts/activate.bat) is a bat file which runs via the cmd prompt.  It looks like Powershell users can use .venv/bin/Activate.ps1 to activate the virtual environment.CommentShareDavid Hessleranswered a year agoAWS-User-5410463 a year agoHi David,Although I was getting the correct pip freeze and was utilising the correct activate script I was still unable to get my local environment working.I did take Zhiyuan_L's suggestion though and was able to get much further using Cloud9.I changed the app.py to only include ap-southeast-2 as that is the primary region and where we already monitor the organizations SecurityHub findings from.I have been able to get 2/3 stacks deployed, however the aggregator stack failed as we were already using ap-southeast-2 as our aggregation point for all other regions.The following image is what i ran into - https://i.postimg.cc/tTSXtP9z/stackfail.pngIs there a way to remove this step and use our existing set up aggregation?I presume this stack contains other important components that required and not just configuring the SecurityHub aggregator.Any insight would be much appreciated.ThanksShare"


Question: "Solution for Transferring huge data from one S3 to another S3 in a different AWS account, securely and without VPC Peering."

"Hi Team, I'm looking for a solution to transfer huge data from one S3 to other S3 bucket, in different AWS account i.e. cross accounts, having NO VPC Peering connection allowed. Solution should be cost highly secured and cost effective. They are two different enterprise units and no connections like VPC-Peering allowed between their networks. I thought of DataSync but not sure how secure we can make it. Pls suggest the best way to design it.ThanksFollowComment"

Answer: "1Accepted AnswerPlease take a look at Amazon S3 Batch Replication.CommentShareEXPERTkentradanswered 3 months agoAWS101Architect 3 months agoThanks. I found this one  - https://aws.amazon.com/blogs/storage/cross-account-bulk-transfer-of-files-using-amazon-s3-batch-operations/And to add encrypted objects to this solution, I found another one i.e.https://repost.aws/knowledge-center/cross-account-access-denied-error-s3Hope I'm running in right direction.Share1Please refer following article.https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/copy-data-from-an-s3-bucket-in-one-account-and-region-to-another-account-and-region.htmlHere are additional options.https://www.ais.com/methods-to-transfer-data-between-amazon-aws-s3-buckets/Hope this helps.CommentSharevCISOUSAanswered 3 months agoAWS101Architect 3 months agoI proposed first option and included encryption keys with the valid policies on Source and Destination buckets and IAM roles tagged to Lambda moving the data cross-accounts. However the security is still a concern as I suggested to use AWS Key Management Service (KMS) to manage the encryption keys.Share0Not answering the question but a clarification:VPC peering is not relevant in this situation. S3 doesn't "live" within a VPC so to access S3 buckets in different accounts you don't need to access a VPC in a different account.If you wish to use S3 in a VPC without an Internet Gateway then you should most likely use a Gateway Endpoint - that endpoint will allow you to access S3 buckets in different accounts in the region where your VPC is. You can restrict access using an endpoint policy.CommentShareEXPERTBrettski-AWSanswered 3 months ago"


Question: Redirection http to https is getting terminated while deploying the php application to Elastic Beanstalk

"we have php application running on apache server useing Elastic beanstalk environment. While we are trying to install https certificate using Let's Encrypt with Certbot on Amazon Linux 2 (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/SSL-on-amazon-linux-2.html), after deploying the code to Elastic beanstalk the https is getting terminated and auto redirect to http. Tutorial: Configure SSL/TLS on Amazon Linux 2 - Amazon Elastic Compute Cloud Install and configure SSL/TLS on a single EC2 instance running Amazon Linux 2 and Apache web server.<VirtualHost *:80> DocumentRoot "/var/www/html" ServerName "example.com" ServerAlias "www.example.com"this line is getting deleted from httpd.conf after post deployment.FollowComment"