Question: .Net AWS SDK Caching Profile Credentials When Assuming Role

"I recently changed the credentials in my default profile to a different AWS account. When I attempt to assume a role, I'm getting this error:System.AggregateException: 'One or more errors occurred. (User: arn:aws:iam::[OLD ACCOUNT NUMBER]:user/[OLD USER NAME] is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::[CORRECT ACCOUNT NUMBER]:role/[CORRECT ROLE NAME] )When I run this code, I get the exception from above on the line indicated with // errorpublic static string GetFromAwsSecretsManager(IConfiguration config){    var stsClient = new AmazonSecurityTokenServiceClient();    var accountId = stsClient.GetCallerIdentityAsync(new GetCallerIdentityRequest()).Result.Account;    var roleArn = $"arn:aws:iam::{accountId}:role/{config["RoleToAssume"]}";    var assumeRoleRequest = new AssumeRoleRequest    {        RoleArn = roleArn,        RoleSessionName = "MySession",    };    var assumeRoleResponse = stsClient.AssumeRoleAsync(assumeRoleRequest).Result; // error    // Extract the temporary credentials from the response    var credentials = assumeRoleResponse.Credentials;    // Use the temporary credentials to create a new instance of the AmazonSecretsManagerClient    var secretsManagerClient =        new AmazonSecretsManagerClient(credentials, RegionEndpoint.USWest2); // Replace USWest2 with the region you're using    var secretValueResponse = GetSecretAsync(secretsManagerClient, config["SecretName"]).Result;    return DecodeString(secretValueResponse);}If someone could offer assistance I would appreciate it.FollowComment"

Answer: "0Hello,Error: (User: arn:aws:iam::[OLD ACCOUNT NUMBER]:user/[OLD USER NAME] is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::[CORRECT ACCOUNT NUMBER]:role/[CORRECT ROLE NAME] )This error occurs when the user in the OLD Account is not having the required permissions to assume role in CORRECT Account. Please ensure that you have below required permissions to perform Assume role action in cross account.Whenever an IAM role has to be assumed, two sets of permissions are required. In your case, the user from account A needs to assume the role in account B. So the required permissions for this are:Permission on role in account B: The role that is being assumed should have a trust relationship that specifies which entity can assume it. In your case, the trust relationship of the role in account B should be configured to trust the user in account A.And here's the example of the trust policy for roleB in account B:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": "arn:aws:iam::ACCOUNT_A:user/userA”      },      "Action": "sts:AssumeRole"    }  ]}Permission on the assuming entity's side (user in account A) which is assuming the said role should also have an attached permission policy that grants permission to assume the required role.Here's the example of the permissions required for userA in account A:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "PermissionToAssumeroleB”,      "Effect": "Allow",      "Action": "sts:AssumeRole",      "Resource": "arn:aws:iam::Account_B:role/roleB”    }  ]}You can also refer this article for more information: https://repost.aws/knowledge-center/iam-assume-role-error#Note: We require details that are non-public information for resource specific troubleshooting. Please open a support case with AWS using the following link:https://console.aws.amazon.com/support/home#/case/createCommentSharerePost-User-2643702answered 2 months agorePost-User-0236176 2 months agoPlease see my wordy response in the next "answer"Share0My comment to the previous answer got cut off because apparently I type too much. I'll respond here.Thank you for your detailed response. I understand how the security works and I have had things set as you suggested. I can see that my question was not detailed enough so it might have been confusing. Maybe I can explain a little better. I have a Dev account for AWS and I set my creds for it and can assume the role just fine from both the CLR and from .NET by using the AWS SDK. I changed my credentials to my Test AWS account and this is not working in .NET but it works just fine in the CLR. I don't want my Dev account to assume a role belonging to my Test account.I want this:1 - Account on DEV - Dev user assumes Dev role.OR2 - Account on TEST - Test account assumes Test roleI got part 1 above to work - Dev user assumes Dev role. When I changed my credentials to use part 2, it worked just fine in the CLR. Test account assumed Test role and retrieved Test credentials from secrets manager. However, when I ran the code from .Net, I got an error similar to this:"Dev User cannot assume Test role."My credentials are set correctly, as proven by the AWS CLR. In .NET, it is appearing to be CACHING the DEV USER. Otherwise, why would it give that error message?  Again, I don't want my Dev user to assume the Test role. I want the Test user to assume the Test role.By the way, my work around here is to never change from the DEV account and just accept the fact that I can't change it. Once it is set, at least on my machine, will cache the user forever.CommentSharerePost-User-0236176answered 2 months ago"


Question: AWS LiveStream to Facebook Live

"Hello,i've been trying to setup a RTMP(s) Push to Facebook live using the default stack setup for MediaLive.Found here https://aws.amazon.com/solutions/implementations/live-streaming-on-aws/(I used the one without MediaStore)Started everything up, and connected OBS to send a live stream to AWS, that works, as i can see the stream on the provided demo page.I've added a new output for RTMP and added the Facebook rtmps url + server key as url for output 1, and a the backup stream as url 2.When I connect OBS directly to Facebook live, the preview stream starts almost immediately, but via AWS there is no preview or eventlogs made.I also tried setting the output settings to match FB Live info (720p etc) but still no avail.Anyone a idea what i'm doing wrong?Thanks in advance!FollowComment"

Answer: "0renejaspersWe will need a bit more information to be able to troubleshoot this issue. Either file a ticket via the Support Center (Top right corner of the MediaLive console - Support - Support Center), or direct mail me the MediaLive Channel ARN where you tested this out. Any errors being reported on the Facebook would also be appreciated.As for how to configure a MediaLive to output to Facebook: Take a look at the RTMP Push template available from the MediaLive Console when you create a new channel.  Channel and Input Details - Channel template - RTMP Push.  One of the output groups in this template is for Facebook. You can delete the other output groups and use this as a template to create a new channel.CommentShareAWS-User-5437070answered 3 years ago0For al others, that find themselves on this post, after searching the rest of the internet why the Facebook Live stream will not start, I've found my answer:After the idea of @fxeataws I started a new Channel with that Facebook template, but still no stream came live. Then I, for me randomly, changed the URL of the output to:URL:rtmps://live-api.facebook.com:443/rtmp/Stream Name:12345?s_bl=1&s_sc=12345&s_sw=0&s_vt=api-sSo, the Facebook Live "Streaming Key" is what you put in the Channel output "Stream name".Hope this helps others with the same problem as me.CommentSharerenejaspersanswered 3 years ago"


Question: IP whitelist limit

Is there a limit to the IP addresses that can be whitelisted for a RDS MySQL db?FollowComment

Answer: "0Are you referring to RDS Security Groups?If yes, here are the limits (some are adjustable on request) -https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.htmlYou could also look at using prefix lists -https://docs.aws.amazon.com/vpc/latest/userguide/managed-prefix-lists.htmlAlso, refer to prefix list quotas on the above shared VPC limits documentation.CommentShareRajesh Sanswered 10 months ago"


Question: Aurora PostgreSQL: Database Object creations using AWS CLI/SAM CLI/Cloud formation

We looking way to deploy the Database objects on the PostgreSQL Database without using the external tool like pgadmin4.I know two commonly used method to deploy the database objectsConnect to PostgreSQL cluster using third part tool and create the objectsLambda which execute the sql qurty on PostgreSQL DatabaseI'm wondering if there a way we can create objects via CLI or other way so we don't need to enable the Public Access for Database Cluster or Expose Port 5432 over the Internet.FollowComment

Answer: "0As you say, you can use a Lambda to connect to the DB and execute SQL.  If it's a VPC Lambda then you don't need your DB to be public or expose a port over the Internet.You can integrate the Lambda tightly with CloudFormation as a Custom Resource or Resource Type.For Custom Resources implemented in Python Lambdas, crhelper makes it really easy.CommentShareEXPERTskinsmananswered 2 months agoAlpesh Dhori eGain 2 months agoHi,Thanks for your response.I'm looking options other then lambda as we do have very large functions, tables etc. which will be very difficult to manage in the code file.AWS document suggest we do have such API on earlier Serverless 1 Instance Type but this only support older version of PostgreSQL.Share"


Question: CloudFront Authenticated Origin Pulls

"A customer is looking to replicate the mTLS functionality of CloudFlare Authenticated Origin Pulls (https://support.cloudflare.com/hc/en-us/articles/204899617-Authenticated-Origin-Pulls) using CloudFront.This is in the context of Kubernetes and nginx ingress. They have considered using security groups here, but they don't feel that security groups fit the bill.Do we have any recommendations or workarounds to implement this mTLS functionality?Do we have any references for customers who have done this?FollowComment"

Answer: "0Accepted Answerunfortunately that's not available in CloudFront. The customer origin cannot authenticate requests coming from CloudFront using TLS layer (specifcally mTLS). However, CloudFront authentication can be implemented at application layer using Lambda@Edge. Here's an example: https://aws.amazon.com/blogs/networking-and-content-delivery/serving-private-content-using-amazon-cloudfront-aws-lambdaedge/CommentShareEXPERTachrafanswered 3 years ago"


Question: i have 1 instances and i am using application load balancer

"so should i need to use network load balancer or not , or its useless because i have only 1 instances right nowFollowComment"

Answer: "0Hello,If you are connecting to a single instance from clients it is a SPOF (Single Point of Failure) design, if you use a load balancer you can scale your Web/App fleet and achieve high availability.As for which one to choose (ALB Vs NLB) see below link for the key differences between the two.https://aws.amazon.com/elasticloadbalancing/features/CommentShareEXPERTTushar_Janswered 8 months ago0Hello,is there any specific reason you are using application running on only one instance ?I would recommend you to have Load balancer (ALB or NLB) based on your use case and have two ec2 instance in different Availability zone.Also launch the instances using AWS Autoscaling (ASG) .In the Autoscaling, have the health check as Load balancer, so that when loadbalancer marks any instance as unhealthy, ASG terminates the instance and launch instance  new instance , also it attach the new instance back to the load balancer .Web Application Hosting in the AWS Cloud.AWS Serverless Multi-Tier Architectures with Amazon API Gateway and AWS LambdaCommentShareAWS-User-7653869answered 7 months ago"


Question: Not authorized to perform: sts:AssumeRole

"Hello guy's,Try to build application with usage custom library:https://sp-api-docs.saleweaver.com/And receive:ClientError: An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::*** is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::***In the AWS console -> IAM -> UsersAdd to Permissions policies:{"Version": "2012-10-17","Statement": [{"Sid": "AssumeRole","Effect": "Allow","Action": "sts:AssumeRole","Resource": "*"}]}In the AWS console -> IAM -> RolesAdd Trust relationships:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"AWS": "arn:aws:iam::***"},"Action": "sts:AssumeRole"}]}Can you show me the correct way to authorize AssumeRole for arn:iam user ?FollowComment"

Answer: "0Accepted AnswerAlso one other thing to check ishttps://repost.aws/knowledge-center/iam-assume-role-cliTry working this out on the command line first often helps me understand if the policy is setup correctly.Let me know if you have any issues with this, or if it helps you then please accept my answer after you've tried it out - it would be much appreciated! Good luck :)CommentShareD Ganswered 5 days ago0you can follow these articles at firsthttps://stackoverflow.com/questions/41337079/how-enable-access-to-aws-sts-assumeroleCreate a policy to allow the action AssumeRole:Open the IAM console at https://console.aws.amazon.com/iam/.In the navigation pane, choose Policies. then Create PolicyOn the Visual editor tab, choose Choose a service, find and choose STS.For Actions, find and choose AssumeRole.Choose Resources, then choose Any.Choose Review policy.For Name, enter a name for your policy, such as AllowAssumeRole, and then choose Create policy.You've now created a policy that allows the sts:AssumeRole action on any resource.Attach the policy to your IAM user:In the navigation pane of the IAM console, choose Users.Find and choose your user.Choose the Permissions tab, and then choose Add permissions.Choose Attach existing policies directly.Find the AllowAssumeRole policy that you created in the previous step, select its check box, and then choose Next: Review.Choose Add permissions.You've now attached the policy that allows the sts:AssumeRole action to your user.Update the trust policy for the role to include your IAM user:In the navigation pane of the IAM console, choose Roles.Find and choose your role.Choose the Trust relationships tab, and then choose Edit trust relationship.In the policy document, add a statement that allows your user to assume the role. The statement should look like this:{  "Effect": "Allow",  "Principal": {    "AWS": "arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:user/YOUR-USER-NAME"  },  "Action": "sts:AssumeRole"}Choose Update Trust Policy.The IAM user should now be able to assume the role. If you're still having trouble, there might be a permissions boundary or SCP (Service Control Policy) that is preventing the action. You might also want to check if there is any conditional policy that might be preventing the action.Also, keep in mind that the role's trust policy must grant the sts:AssumeRole permission to the entity that is assuming the role, and the entity that is assuming the role must also have the sts:AssumeRole permission to assume the role. This is a two-way permission requirement.CommentShareEXPERTsedat_salmananswered 10 days agoProgramist 9 days agoAdd user. Policies to user. Add Role. Policies to role.And for this get sts credentials [ AccessKeyId, SecretAccessKey, SessionToken ]:Then go to oauth to receive [ access token ]Then get raport model for postman:https://github.com/amzn/selling-partner-api-modelsAdd access token from o-auth. Im not shure then access token key must be named "x-amz-access-token"Find this in tutorial: https://m.media-amazon.com/images/G/01/spapi/Call_SPAPI_Endpoint.mp4Fill credentials [ AccessKeyId, SecretAccessKey, SessionToken ] :And finaly receive:        {            "code": "Unauthorized",            "message": "Access to requested resource is denied.",            "details": ""        }Is any other service to rule access the selling partner reports ?Share"


Question: EKS Anywhere Vcenter setup config error

Resource pool not found.Create simple Yaml config. Setup is being validated up to Resource pool validation. after setup displays error resource pool not found. I used official guid https://anywhere.eks.amazonaws.com/docs/reference/clusterspec/vsphere/even I picked: If there is no resource pool: /<datacenter>/host/<cluster-name>/ResourcesSetup displays same error (resource pool no found)FollowComment


Question: Can I change the password policy for the SSO identity store?

"We just had a pen test completed and one of the items was our password policy. I was looking at changing it, and I found this page: https://docs.aws.amazon.com/singlesignon/latest/userguide/password-requirements.html. It describes the password policy for the SSO identity store (which we are using), but not how to change the policy. Is it possible to change a password policy for the SSO identity store?Thanks!FollowComment"

Answer: "0Currently there is no way to change the password policy when using AWS SSO as your identity source. This limitation applies only to users created in the AWS SSO identity store. If you have configured an identity source other than AWS SSO for authentication, such as Active Directory or an external identity provider, the password policies for your users are defined and enforced in those systems, not in AWS SSO and can be customized within those systems.The product team is aware of the feature request. If you happen to work with an account manager at AWS you can have them or the solutions architect add your customer influence to the existing request. Features are added and worked based on the amount of customer influence a feature has.CommentShareAWSJoeanswered a year ago"


Question: What is a thingId?

"Hi,I noticed that if I query the Thing registry through the Java SDK (describeThing() function), the return value, DescribeThingResponse, has a "thingId" property. I don't see this value when I examine the thing in the AWS console. What is its purpose?Is it safe to ignore the thingId in my application and just use the thingName as the unique identifier?Thanks,FrankFollowCommentclogwog a year agojust out of interest, what does the thingId look like ? Is it a guid ?ShareGreg_B EXPERTa year agoYes it's a UUID.Share"

Answer: "1Accepted AnswerIs it safe to ignore the thingId in my application and just use the thingName as the unique identifier?Yes. The thingName is effectively the primary key in that the APIs use that as the input to identify the Thing. The thingId is only returned in the response. Although you can use it for searching if you have fleet indexing enabled.CommentShareEXPERTGreg_Banswered a year agoFrank a year agoGreat, thanks again for your help.Share"


Question: Lex V2 RecognizeText issue

"Hi,Does anyone know when this error occurs? and how can we fix this?Sometimes it happens when we use "RecognizeText" API.Error: "Encountered resource conflict while saving session data"FollowComment"

Answer: "0Hi,While it is difficult to exactly point the issue without enough details, you will typically face this error when trying to update the same session concurrently! For example two threads are trying to update the same session at the same time or two users trying to update the same session at the same time! So, to fix this please make sure there are no concurrent updates on the session.CommentShareSatishanswered 4 months ago0I found the same issue. There were no concurrent access, but I was updating (creating) session using PutSession API call to prepare the lex bot, wait for this API to return and then immediately using RecognizeText API.  Not sure if this is causing any conflict.CommentShareTalkFirstanswered 6 days ago"


Question: AWS Route 53 goes down at same time some days intermittently for a few minutes only

"We have implemented an Elastic Load Balancer for our EC2 instances, and AWS Route 53 is functioning correctly, except for brief periods of downtime occurring around the same time on some  (random) days - usually during Monday-Friday. Despite adjusting the Time to Live (TTL) settings on our domain provider from 60 minutes to 1 minute, the issue persists. This phenomenon affects the US-East-1 region and is not correlated with any reported AWS outages.During these short disruptions, which transpire between 10:00 AM and 2:00 PM Pacific Time, our client users encounter intermittent 404 errors. However, normal functionality is restored within 5-10 minutes. Outside of these periods, the system operates without any issues. A thorough examination of the Elastic Load Balancer settings has not revealed any anomalies.Our infrastructure consists of a Django application running on an Ubuntu OS within the EC2 instances, accompanied by a RabbitMQ cluster comprising three nodes. Although these downtimes coincide with peak usage hours, there is no evidence to suggest that network or traffic congestion is the root cause of the problem.FollowComment"

Answer: "0A 404 error is an indication that the client has reached the application and it has said "the thing you asked for isn't here" - it's a "Not Found" error.What this means is that your application is running and it is responding but what the client is asking for can't be delivered - this could be because the client has asked for the wrong thing; or the server component has some fault where it isn't returning or finding the correct "thing" to respond with.You don't say whether the load balancer is doing anything else - if you're using ALB and (maybe) have WAF enabled then I would check to see that the WAF rules aren't going to deny traffic at particular times; or have dependencies that will cause them to fail. However, in the simplest case (where the load balancer is just being used to distribute traffic) then that won't be the case.I'd also recommend enabling access logs to try and debug the issue.After all this, if you definitely think it is a load balancer fault then please create a support case - the support team can look at the dates and times and see if there was any issue with the load balancer itself.CommentShareEXPERTBrettski-AWSanswered a month ago"


Question: Ability to temporarily stop Airflow planned?

"Similar to RDS, where it is possible to start/stop a database (see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_StopInstance.html), it would be great to have a similar feature for Airflow.Use-Cases:Stop Airflow Development Environment at 6pm and restart it at 8amRun Airflow only during the night and will be idle during the day --> save resources by stopping Airflow during the dayA start-stop feature is currently only possible by re-creating environments, which unfortunately also drops Airflow connections and logs. My question would be therefore if such a feature is in the AWS MWAA roadmap?This feature would help a lot to convince customers to use MWAA instead of hosting Airflow by themselves.Thanks!Edited by: capca5 on Dec 28, 2020 4:16 AMEdited by: capca5 on Dec 28, 2020 4:17 AMFollowComment"

Answer: "0Hi!There are not immediate plans to be able to pause/resume an MWAA environment, however for development environments one option is to use CloudFormation to create an on-demand environment, with connections defined in AWS Secrets Manager.  Logs will be preserved in CloudWatch while the environment is deleted, and if the replacement environment uses the same name as the previous environment then the logs should resume in the same place in CloudWatch.Thanks!CommentShareJohn_Janswered 2 years ago0Hi,I may have an hint and understand why this service cannot be stopped and then started that being a managed service but ...We are considering in adopting the managed service MWAA and what concerns me is what happens to metadata configs.  if the service is gone or stopped on a PROD env. ?There's no access to the metadata db, no full access to the footprint of the service so we cant perform a disaster recovery activity and restore to the previous state.Another question is why cant exec. metadata DB be accessible or explicitly to be able to manage it on a service like RDS safekeeping everything giving more control to operations?thanks for all your work. We hope to be able to adopt this service in our ecosystem too.BRPedro M.Edited by: pedromach on Jan 8, 2021 6:55 AMCommentSharepedromachanswered 2 years ago0Hi Pedro,Meta DB access was restricted both for stability of the service and to enable simpler setup.  Customers have access to the meta DB through their DAGs, demonstrated by the clean up DAG sample here: https://docs.aws.amazon.com/mwaa/latest/userguide/samples-database-cleanup.htmlThe meta DB is a multi-AZ RDS Postgres instance unique to that particular environment and as such disaster recovery should not be required, however you are correct that for production systems we would recommend that the MWAA environment is left running and not recreated on-demand.Thanks!CommentShareJohn_Janswered 2 years ago0Thanks, that answered my question :)CommentSharecapca5answered 2 years ago0Hello,unfortunately, I need to re-open this issue. We tested the start-stop (=create & destroy) mechanism of MWAA and it seems like the meta database is not being recovered. I can see my logs in CloudWatch but all task runs are not displayed in Airflow itself. Is there a way to keep also the Meta-Database entries?CommentSharecapca5answered 2 years ago0Hi,MWAA does not automatically recover the meta database.  Before deleting the environment, you would need to use a DAG to offload the meta data to an external DB, and then use a similar dag to reload meta data on the new environment.Thanks!CommentShareJohn_Janswered 2 years ago0Do you have an example for such a DAG.CommentShareavermaanswered 2 years ago"


Question: change the root/first part on web url

"I host my web app with AWS Amplify Hosting, my question is can i change the first part(root) of my website url?I want to makeit friendlier, for example this is my website url: https://test.b12test3.amplifyapp.com.I would like to overwrite this part: test.b12test3how can I do it?is this possible?FollowCommentkentrad EXPERTa year agoYou can find the instructions here: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/registrar.htmlShare"

Answer: "0Do you have your own domain? If so, you can setup custom domains. Steps to do this are found here, Set up custom domains.CommentShareEXPERTkentradanswered a year agoAWS-User-3959297 a year agoAt first thank you very much for your answer. No I don't have my own domain. should I create one?if yes how can I do it?Share"


Question: How to implement certificate type authentications in lambda function

The windows service I am trying to connect from the lambda function uses a mTLS type certificate authentication. How I can bring that to my lambda function so that the authentication will get passed.FollowComment

Answer: "0You can store the client certificate in a place like Secrets Manager. In your Lambda function, you can make a GetSecret API call outside the main handler function to store the value in memory or save it under /tmp directory for subsequent invocations for the Lambda instance. The rest will depend on how you reference the mTLS certificate from your HTTP client package for your runtime.Securely retrieving secrets with AWS LambdaCommentShareTaka_Manswered 7 months ago"


Question: Object visibility for users - user can see all objects

"HiWhen I create a user by simply runningcreate user my_test_user password 'abc123';this user can see all the objects in all schemas automatically. No other grant commands were issued. By seeing I mean the user can see the table and column names (i.e. metadata). Of course, the user cannot do 'select * from table' for example. There, a message comes saying "permission denied".This behaviour was observed before:https://forums.aws.amazon.com/thread.jspa?messageID=786121https://forums.aws.amazon.com/thread.jspa?messageID=435219without any solution.Is there still no way to restrict the visibility of the objects to specific users? At least I have not seen anything in the documentation.FollowComment"

Answer: "0Accepted AnswerHi MarcelZ,What you see is correct database table visibility is not controlled by GRANT statements.  This is something Redshift inherits from PostgreSQL and is characteristic of all PostgreSQL derived database engines.Here's another more recent forum thread where I commented on the same kind of ask:https://forums.aws.amazon.com/thread.jspa?threadID=298823&tstart=25I hope this helps explain the Redshift behavior you see.Regards,CommentShareklarsonanswered 4 years ago0Hi klarsonThanks for your info. Ok, so this is the expected behaviour inherited from PostgreSQL. I think one of the earlier posts was mentioning this as well. I wanted to check if this is still the default behaviour.Thanks again for your help!Regards, MarcelCommentShareMarcelZanswered 4 years ago"


Question: AWS Workspace lost "CTRL" Key combination function on Windows10 2004 Ver

"Hi, I got a very strange situation, my workspace can not use CTRL key in it.If I want to copy/past or undo something, I press CTRL_C, CTRL_V, CTRL_Z....._A are not working anymore.you only will see "C, Z, A, V....etc" characters on screen (if you use notepad to test).Of course, on browser or other applications are also not working.I use two different input language on my local machine (use "SHIFT" key to change it) and only English input in workspace.Sticky, Toggle and Filter Keys are all closed on both local machine and workspace.Does anyone know a solution to this problem?Thanks for helping me!My ENV:Local Machine:NB: Dell E7480 NB keyboardOS: Windows 10 Pro 2004 VersionAnti-Virus: Kaspersky Free Anti-Virus 20.0.14.1085Workspace Client Version: 3.0.9.1551Workspace:OS: Windows Server 2016 Datacenter 1607Anti-Virus: McAfee Agent 5.6.0.702, MOVE AV 4.7.0 Multi-Platfrom Client 4.7.0.155, McAfee DLP Endpoint 11.2.0.142FollowComment"

Answer: 0I answer my question by myself.Just update your client version to 3.0.10.1602 and the problem solved.Resolves an input method editor (IME) issue  <---I guess is a bug?CommentSharekaikudouanswered 3 years ago


Question: How to get the amazon connect Phone call audio streams(Recordings) from S3 to Local environment

"As we know that Amazon Connect send the call recordings to s3, can we get those recordings in our third party app, as user can play & listen the call same as Contact flow search functionality?Actually the goal is to get the recordings after every call same as we are getting the recordings in Contact Flow Search only the recording..Any Solution or workaround?FollowComment"

Answer: "0You can try S3 event notification. When the call recording is saved in S3, you can setup an event notification and trigger other AWS services such as Lambda or even EventBridge to further process the recordings per your requirements.You may refer to this document:https://docs.aws.amazon.com/AmazonS3/latest/userguide/NotificationHowTo.htmlCommentSharejoahnaanswered a year ago"


Question: Getting access to FastAPI (uvicorn) running in a docker container with Elastic Beanstalk

"I've been trying the whole day to properly set up my application, but alas without success.I've built a FastAPI app that is currently running without problems on DigitalOcean and getting deployed from gitlab.After trying to set everything up for a move to AWS, I'm stuck. I managed to have gitlab build and deploy a container to ECR and get that container up and running in Elastic Beanstalk. I can see in the docker logs that the app properly loads. The problem is that nginx just returns a 502 bad gateway error and I can't seem to figure out how to configure it.I've now updated my custom_proxy file to make it work and I'm seeing if I'm able to get EBS to use it instead of the default one. Here's the file:events {}http {  upstream uvicorn {    server 172.17.0.2:5000;  }  server {    listen 80;    location / {      proxy_pass http://uvicorn;      proxy_set_header Host $host;      proxy_set_header X-Real-IP $remote_addr;      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;      proxy_set_header X-Forwarded-Proto $scheme;    }  }}Using the internal IP of the docker container was part of the breakthrough.FollowCommentJohn Vold 2 months agoAre you using the Docker platform branch or ECS platform branch?ShareJonathan GaussML 2 months agoHi John, I'm using the Docker platform branch.Share"

Answer: "1Sounds like maybe this might help?https://dev.to/devasservice/the-cheap-way-how-to-use-docker-to-deploy-your-fastapi-kmnSpecifically this part:upstream app server, contains the definition of our API endpoint, as you can see if references the url ‘api:8080’ (api is our other docker instance name from the docker-compose file, this allows cross communication between instances)You could try changing server 172.17.0.2:5000; to server api:5000; or whatever that container is called.CommentShareJohn Voldanswered 2 months agoJonathan GaussML 2 months agoI was using docker instead of api before and that should have worked too. I think the important part from the link you shared is adding a line to copy the nginx.conf file within the Dockerfile. I'll try that for the next "release".ShareJohn Vold 2 months agoGlad to hear...please let me know if that fixes it.Share0So, for now I have given up on setting a specific configuration for nginx inside the instance. Instead, I changed the uvicorn command to run the server listening on port 80. That gets picked up by the default nginx config of AWS and now my app is open to the world!CommentShareJonathan GaussMLanswered 2 months ago"


Question: What services does my company have

"I have just taken over as the IT Manager for my company.  They have an AWS account, but nobody seems to know what it is used for, why we have it, or if we should keep it.  I would like to know where to look to see what is being hosted by AWS for my company.  Any help would be greatly appreciated.  Thank you.FollowComment"

Answer: "1Accepted AnswerTo view all the items you are paying for on AWS, follow these steps:Log in to the AWS Management Console with your AWS account credentials at https://aws.amazon.com/console/.In the top navigation bar, click on your account name or the "Services" dropdown menu and select "My Account". On the "My Account" page, scroll down to the "My Billing Dashboard" section and click on the "Go to Billing & Cost Management" button. This will open the AWS Billing and Cost Management console. In the left navigation pane of the Billing and Cost Management console, click on "Bills" or "Billing Dashboard" By default, you should see an overview of your current month's charges and a summary of the costs.To get more detailed information about your costs, click on the "Cost Explorer" link or navigate to the "Cost Explorer" section. In the Cost Explorer, you can explore your costs and usage over time. Adjust the date range and granularity as needed to get a comprehensive view. To see a breakdown of the items you are paying for, go to the "Costs by Service" or "Services" tab (depending on the AWS interface version) in the Cost Explorer. This will show you a list of AWS services you are using and the associated costs for each service.CommentShareFS_AWSanswered 10 days agoEXPERTkentradreviewed 10 days agorePost-User-7324992 10 days agoThank you for the information.  I am looking at it and the only things I see on our account are Amazon Elastic Compute Cloud running Linux/UNIX$0.0376 per On Demand Linux t3a.medium Instance Hour 566 Hrs and $0.10 per GB-month of General Purpose SSD (gp2) provisioned storage 22.46 GB-Mo.  I do not see any data transfer.  It appears to me that we are not using anything, but I am not sure what those two things I listed above are.  ThanksShare1Hi, AWS Config (see https://aws.amazon.com/config/) will inventory for you the resources used in given account across regions.So, you not only have a financial view but a technical view as wellCommentShareDidier_AWSanswered 10 days agoEXPERTsedat_salmanreviewed 10 days agoEXPERTkentradreviewed 10 days ago"


Question: Purchase Saving Plans for EC2

"We realized that we are using the 3 instances 24/7 and we didn't know that there is a Saving Plans and now I would like to ask if we purchase Saving Plans, thus it include the EBS? Currently we have the below billing for EC2.FollowComment"

Answer: "2Savings Plans don't apply to EBS. At the moment, Savings Plans only cover Amazon EC2, AWS Lambda, and AWS Fargate usage: https://aws.amazon.com/savingsplans/pricing/If you are looking to optimize EBS cost, you can consider:Review any unattached EBS volumes that are present in your accounts, unusedMigrate to newest generation of volumes (i.e. gp3 and io2) to improve on performance and costImplement proper backup policies for snapshots and remove old EBS snapshots that may have  been around for a long timeCommentShareEXPERTAWS-User-Nitinanswered 8 months agoEXPERTIndranil Banerjee AWSreviewed 8 months ago"


Question: how to add mutiple domain name to existing AWS certificate

"Hi Team,I requested for AWS certificate where i had mentioned one domain name which is a DNS name for my back end application. Now I want to add another URL to this certificate which is ELB hosted URL so that I can make back end https call using AWS ELB URl. Is it possible to edit the existing certificate?Note: when I used AWS URL for https connection I am getting err_cert_common_name_invalid.FollowComment"

Answer: "0Hello,I think it need to be done when you request a certificate , please see the below from Point no 2 (When you request a wild-card certificate...) https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-request-public.htmlI am not too sure if you can update an existing one with a wild-card domain nameRequest a public certificate using the consoleTo request an ACM public certificate (console)1. Sign in to the AWS Management Console and open the ACM console at https://console.aws.amazon.com/acm/home.Choose Request a certificate.In the Domain names section, type your domain name.2. You can use a fully qualified domain name (FQDN), such as www.example.com, or a bare or apex domain name such as example.com. You can also use an asterisk (*) as a wild card in the leftmost position to protect several site names in the same domain. For example, *.example.com protects corp.example.com, and images.example.com. The wild-card name will appear in the Subject field and in the Subject Alternative Name extension of the ACM certificate.When you request a wild-card certificate, the asterisk (*) must be in the leftmost position of the domain name and can protect only one subdomain level. For example, *.example.com can protect login.example.com, and test.example.com, but it cannot protect test.login.example.com. Also note that *.example.com protects only the subdomains of example.com, it does not protect the bare or apex domain (example.com). To protect both, see the nextCommentShareSrianswered a year ago0SSL certificates are digitally signed so modifications to existing issued certificates are not possible. You can, however, create a new certificate request for the primary domain name and choose Add another name to this certificate to add additional names.You can also request a new certificate for an additional domain and attach that new cert to your load balancer along side the existing certificate. Add certificates to the certificate listNote: You cannot request certificates for Amazon-owned domain names such as my-load-balancer-1234567890abcdef.elb.us-east-2.amazonaws.com, you would need to request a certificate for a CNAME or alias record that points to your load balancer, Routing traffic to an ELB load balancerCommentShareEdward_Sanswered a year ago"


Question: How to know which EC2-ELB I'm paying for

"Hello,with my billing Dashboard, I'm getting 0.5 dollars daily for usage of Ec2-ELB for two days, even without any declared loadbalancer or accessing to my account.  How I can find the source of this consumptionI looked in EC2 load balancer I don't find any ELBCan you please advise ?FollowComment"

Answer: "1Hi RoB,You can get granular resource charge and usage data per hour in the CUR.  Enabling CUR is free, there will be a small charge for storing the data in S3.https://docs.aws.amazon.com/cur/latest/userguide/cur-create.htmlYou can also query your CUR with Athena, but it needs to be setup first (there will be a small charge per query - see Athena pricing)https://docs.aws.amazon.com/cur/latest/userguide/cur-query-athena.htmlAnd finally as an example of queries you can utilize to query CUR with Athena, there are sample queries in the Well Architected  CUR Query Libraryhttps://wellarchitectedlabs.com/cost/300_labs/300_cur_queries/CommentShareamazonchrisanswered a year ago0Accepted AnswerYou can use Cost Explorer (free tool) to dive deeper into your daily charges. Launch and Activate it from the billing console of the account, and use the combination of grouping and filter options.For example, you can *filter *ELB service, and you can *group by *Usage Type or API Operation. This will give you more info regarding usage types that you are charged for.It's possible that you see billing for ELB in one region, but you currently use resources in another region, make sure you check which region the billing is related to.CommentShareEXPERTNataliya_Ganswered a year ago0If you have Config enabled in the region where you are being billed you can select AWS ElasticLoadBalancing LoadBalancerand AWS ElasticLoadBalancingV2 LoadBalancer as the Resource Types and ensure you select Include Deleted Resources. This should then populate the resources associated with your charges which you can then drill into to see when and how they were created.CommentShareRoBanswered a year ago"


Question: Cloud watch metric filter for Failed GLUE jobs

"Hi,How to get a notification in amazon cloud watch for failed Glue jobs in AWS.FollowComment"

Answer: "1To get a notification in Amazon CloudWatch for failed Glue jobs in AWS, you can set up an event rule in CloudWatch Events that is triggered when a Glue job fails. You could set up SES to receive these notification through email or SMS/TEXT or Slack messages.Here are the steps to set up this notification:Open the CloudWatch console and navigate to the "Events" section.Click the "Create rule" button.In the "Event Source" section, select "AWS Glue" as the service and "Job State Change" as the event type.In the "Targets" section, select "SES" as the target type and choose the SNS topic you want to publish into.In the "Configure details" section, give the rule a name and description, and then click the "Create rule" button.The CloudWatch rule will now be triggered whenever a Glue job transitions to the "FAILED" state, and the selected alarm will be activated.For more information on setting up CloudWatch Events rules, you can refer to the CloudWatch Events documentationCommentShareAnanth Tirumanuranswered 5 months ago"


Question: SOC reports from AWS gap

"We have retrieved the SOC reports from AWS Artifacts.  Is there a gap letter for the SOC report in 2022. In other words, the SOC reports provided covered all the way to 9/31/2022.  We need a “gap letter” to cover from 10/1 to 12/31.FollowComment"

Answer: "3Accepted AnswerHi there, the SOC reports are period of time reports. That does mean they look backwards and the auditor gives a statement over this period of time. The next one will be October2022 till March2023 and will come out somewhere in the beginning April/Mid May (this is not predictable as it is the auditor who needs to make his work on the evidence which is collected in audited time frame).We have a bridge letter[also called as Continuous operations] and statement on artifacts where we state that we keep on maintaining (minimum) the controls of the former SOC report.CommentShareSreenathanswered 5 months agoEXPERTBrettski-AWSreviewed 5 months agoEXPERTTushar_Jreviewed 5 months ago1To add, I was able to navigate to https://console.aws.amazon.com/artifact/reports, search by "SOC Continued Operations Letter". You will see a report with reporting period "April 1 2022 to current". Thanks!CommentShareSreenathanswered 5 months ago"


Question: How to properly and completely terminate a multipart upload?

"In our Java app we have what is basically boilerplate S3 V2 code for creating a multipart upload of a file to S3.  We absolutelyneed the ability to cancel the upload, and recover all resources used by the upload process, INCLUDING the CPU and networkbandwidth.  Initially we tried simply cancelling the completionFuture on the FileUpload, but that doesn't work.  I can watch the network traffic continue tosend data to S3, until the entire file is uploaded.  Cancelling the completionFuture seems to stop S3 from reconstructingthe file, but that's not sufficient. In most cases we need to cancel the upload because we need the network bandwidthfor other things, like streaming video.I found the function shutdownNow() in the TransferManager class, and that seemed promising, but it looks like it's notavailable in the V2 SDK (I found it in the V1 sources).I've seen a function getSubTransfers() in the V1 MultipleFileUpload class that returns a list of Uploads, and the Upload classhas an abort() function, but again, we need to use V2 for other reasons.I've also found and implemented code that calls listMultipartUploads, looks for the upload we want to cancel, creates anabortMultipartUploadRequest, issues it and the threads keep on rolling, and rolling, and rolling....Is there a "correct" way of terminating a multipart upload, including the threads processing the upload?FollowComment"


Question: Http API Gateway using stage variables on a private integration

"Hi,I've been trying to use API Gateway (HTTP) to connect it with some ECS microservices.As far as I can see (using the console), I need the following:Gateway -> VPC Link -> ALB -> ECSThat part is working ok, and I can attach a propper integration with no problems.However, I have 3 ECS clusters (dev, uat, prod)In order to connect to those environments, I had to create 3 different HTTP API GATEWAYS.Is there any way to create just 1 API Gateway and connect it to different private ECS using Stage Variables??I managed to do it on REST API GATEWAYS, but using HTTP API GATEWAY seems impossible using the console because it forces me to choose an ALB,  listener and VPC Link.Am I missing something?Thank you.FollowComment"

Answer: "0It should work. Look here for more details.Saying that, I would recommend creating separate APIs for the different stages. Just like you created different backends, create different APIs. This way you reduce the risk that when you change something in dev it will accidentally impact production. I would even recommend creating the different environments in different accounts.CommentShareEXPERTUrianswered a year ago"


Question: Make character walk on any surface

"I'm trying to make a level where my character could walk on any surface for example in a sphere the character would walk around it. I tried using the force volume component to simulate gravity, but nada. Could I get a suggestion or a tip on how I should do this?Follow"

Answer: "0Accepted AnswerUse a point force on the planet and give your movable entity inertia. Note: this doesn't orient the object's down direction to align with gravity, that would be coded.REMOVEDUPLOADSharerePost-User-7039295answered 5 years ago0Thanks it works! quick question tho, does the force volume value need to be -250?SharerePost-User-7722695answered 5 years ago0Cool, Thanks dude/dudette.SharerePost-User-7722695answered 5 years ago0@REDACTEDUSERSharerePost-User-7039295answered 5 years ago"


Question: Redshift unnested json string

"Hi guy,I have a json string like:{    "lastUpdatedBy": "cewu@abc.com",    "clientName": {        "Values": [            {                "Value": "Ce Wu",                "Confidence": 100.0,                "Source": "automation"            }        ],        "Overall": {            "Value": "Ce Wu",            "Confidence": 100.0,            "Source": "automation"        }    },    "employerNumber": {        "Values": [            {                "Value": "abc company",                "Confidence": 90.0,                "Source": "tm1@abc.com",            },            {                "Value": "ABC company llc",                "Confidence": 90.0,                "Source": "tm2@abc.com"            }        ],        "Overall": {            "Value": "ABC company llc",            "Confidence": 90.0,            "Source": "tm2@abc.com"        }    },    "employeeID":{        ...    },    "employeeAddress":{        ...    },    ...   there could be 100+ sub columns nested in the json string}Is there a way in Redshift I could unnested Values data from the json string to:|-------------------+--------------------+-------------------+------------------||lastUpdatedBy      |field               |value              |source            ||-------------------+--------------------+-------------------+------------------||cewu@abc.com       |clientName          |Ce Wu              |automation.       ||cewu@abc.com       |employerName        |abc company        |tm1@abc.com       ||cewu@abc.com       |employerName        |ABC company llc    |tm2@abc.com       ||cewu@abc.com       |employeeID          |...                |...               ||cewu@abc.com       |employeeAddress     |...                |...               ||cewu@abc.com       |...                 |...                |...               ||-------------------+--------------------+-------------------+------------------|I am able to parse the json string to get each sub nested fields. And tryselectj.*from (selectjson_parse(json_string) as jfrom tbl)But it return error that  cannot use wildcard in super column. So I stocked at how to parse all nested json sub fields and cannot unpivot the table to [field, value] format.Any idea how to sole this issue?Thanks,Ce WuFollowComment"

Answer: "0Hello,I understand that you would like to parse the nested JSON objects in your Redshift cluster. You have defined column as super datatype and would like to parse the objects. I would like to inform you that when you store the JSON as SUPER data and try to extract nested columns it is a little difficult. I tried using the following exercise.SET enable_case_sensitive_identifier TO true;create table testparse(super_json super);insert into testparse values(JSON_PARSE('{"lastUpdatedBy": "cewu@abc.com","clientName": {"Values": [{"Value": "Ce Wu","Confidence": 100.0,"Source": "automation"}],"Overall": {"Value": "Ce Wu","Confidence": 100.0,"Source": "automation"}},"employerNumber": {"Values": [{"Value": "abc company","Confidence": 90.0,"Source": "tm1@abc.com"},{"Value": "ABC company llc","Confidence": 90.0,"Source": "tm2@abc.com"}],"Overall": {"Value": "ABC company llc","Confidence": 90.0,"Source": "tm2@abc.com"}}}'));select super_json."lastUpdatedBy", super_json."clientName"."Overall"."Source" from testparse;Output:lastUpdatedBy  | Source---------------------------"cewu@abc.com" | "automation"Please find below the limitation of using SUPER datatype.[+] https://docs.aws.amazon.com/redshift/latest/dg/limitations-super.htmlHowever, a better way to parse nested columns in JSON is with Redshift spectrum. Redshift spectrum supports creating columns of STRUCT, ARRAY datatype which can further be used to flatten out the data. Please find below an example.>> Upload the JSON data in S3>> Create external table with the JSON data stored in S3CREATE EXTERNAL TABLE myspectrum_schema.nest (    lastUpdatedBy VARCHAR(255),    clientName STRUCT<        Values: ARRAY<STRUCT<            Value: VARCHAR(255),            Confidence: FLOAT,            Source: VARCHAR(255)        >>,        Overall: STRUCT<            Value: VARCHAR(255),            Confidence: FLOAT,            Source: VARCHAR(255)        >    >,    employerNumber STRUCT<        Values: ARRAY<STRUCT<            Value: VARCHAR(255),            Confidence: FLOAT,            Source: VARCHAR(255)        >>,        Overall: STRUCT<            Value: VARCHAR(255),            Confidence: FLOAT,            Source: VARCHAR(255)        >    >)ROW FORMAT SERDE 'org.openx.data.jsonserde.JsonSerDe'WITH SERDEPROPERTIES (   'serialization.format' = '1') LOCATION 's3://<bucket-name>/<folder-name>/';>> create manifest file in S3 using AWS CLI aws s3 ls s3://<bucket-name>/<folder-name>aws s3 ls s3://<bucket-name>/<folder-name> >manifest.txt>> select the data using the below query SELECT  nest.lastUpdatedBy,   nest.clientName.Overall.Value,  nest.employerNumber.Overall.Value AS employerNameFROM myspectrum_schema.nest;Output:lastUpdatedBy | Value | employerName-------------------------------------------cewu@abc.com  |Ce Wu | ABC company llcPlease refer the following tutorials to implement Redshift spectrum and nested data quering.[+] https://docs.aws.amazon.com/redshift/latest/dg/tutorial-query-nested-data.html [+] https://aws.amazon.com/blogs/big-data/working-with-nested-data-types-using-amazon-redshift-spectrum/[+] https://docs.aws.amazon.com/redshift/latest/dg/c-getting-started-using-spectrum.html That being said, if you would like resource based troubleshooting, please raise a support case with AWS for further information and we will get back to you with on the support case.Thank you!CommentSharerePost-User-3301913answered 2 months ago"


Question: Is it possible to exclude certain accounts when creating an org-wide CloudTrail?

"Hi,We currently have individual cloudtrails for each of our 80+ accounts but are currently looking to move to one sole org trail.followed this guidance : https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-an-organizational-trail-in-the-console.htmlso far so good, but org structure includes accounts that belong to another department that we don't want to include in the org trail.Is it possible to exclude accounts?Kind Regards,AinsleyFollowComment"

Answer: "0Afraid not, its All or nothing.CommentShareGary Mcleananswered a month ago"


Question: Video On Demand Website on Amazon LightSail

"Hello,Can I build a video on demand website with standard acrchitecture like S3 bucket for video file upload, Amazon Elemental, Lambda, destination bucket... And have my EC2 instance launched on LightSail? Or I should launch the EC2 Instance on a VPC and install Wordpress manually?Thank youFollowComment"

Answer: "0Hi Aman,AWS lightsail is just a high level wrapper round Ec2, If you are going to use more AWS services that aren't supported via Lightsail then I would recommend sticking completely with Ec2 directly.CommentShareOisiananswered a year agoAman a year agoHi Oisian,Thank you for the reply.The services I am going to use are - S3 for video/audio upload, Lambda to invoke Amazon Elemental, Destination bucket for processed video, and may be Cloudwatch. But still not sure if these services are supported with LightSail.ShareAman a year agoHi Oisian,AS I gave it more thought, the LightSail instance will just pull videos/audios from the destination S3 bucket. All the Amazon Elemental, Lambda and everything will work independently from the instance to process the audios and videos.What is your suggestion.Thank you for your time.Share"


Question: how to delete lamda services in cli?

i have installed cli how to select regions and delete the services. it's being so complicatedFollowComment

Answer: "1To delete a lambda function in the CLI on a specific region, you can use the command:aws lambda delete-function \   --function-name <your function> \   --region <your region> For more information, please see: https://docs.aws.amazon.com/cli/latest/reference/lambda/delete-function.htmlCommentShareEXPERTChris_Ganswered a year agoEXPERTBrettski-AWSreviewed a year ago"


Question: How to use the BGP in VPC among the ECs?

"I want to build a topology in the aws, but I'm not sure how to set up route and as path to route the traffic of instances to some specific instances balancedly.expect:192.168.0.100(az1) & 192.168.1.100(az2), announce a cidr 10.0.0.0/24 to 192.168.3.1az1: 192.168.0.1 --> 10.0.0.1 via 192.168.3.1 & 192.168.0.100az2: 192.168.1.1 --> 10.0.0.1 via 192.168.3.1 & 192.168.1.100when the 192.168.1.100 is down, the traffic of az2 can be sent to 192.168.3.1 & 192.168.0.100FollowComment"

Answer: "0Since all the subnets are part of the same vpc, routing will be done automatically without needing BGP. If you need to use BGP, you need to have an ec2 image capable of that and possibly use GRE tunnels.  Also, you can add secondary cidrs blocks in the VPC to allow the network 10 ranges.  But what is the use case for the scenario mentioned?CommentShareattak001answered 4 months ago"


Question: how to block a bot from causing high data downloads

"Hi,I have noticed excessive downloads of our mp3 files which are stored on Amazon s3it seems that a Russian search engine bot Yandex (https://myip.ms/info/whois/141.8.144.47 ) is downloading our mp3 files causing excessive data traffic.Is it possible to block this IP address, while keeping the files public, or how should be prevent Yandex downloading so much?  Is a robots.txt file something to consider? (which I know nothing about!)Many thanksFollowComment"

Answer: "0HelloThe robots.txt file is an agreement which is not mandatory so it may help but it does not stop Yandex from keep doing it.You can create a bucket policy to denie access to an IP address or IP address range.here is an examplehttps://aws.amazon.com/premiumsupport/knowledge-center/block-s3-traffic-vpc-ip/hope this helpsRtCommentSharerttanswered 4 years ago0Thank you so much.However, the example you give is for blocking all access and giving permission to specific IP addresses.  I wish to do the opposite - to give public access, but block specific IP addresses.Is there JSON code you know of which does this please?thanks againCommentShareIrishCManswered 4 years ago0HelloSorry, this link should have a bit more info.https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html#example-bucket-policies-use-case-3a little modification to the other example and you have it.{  "Version": "2012-10-17",  "Id": "S3PolicyId1",  "Statement": [    {      "Sid": "IPAllow",      "Effect": "Deny",      "Principal": "*",      "Action": "s3:*",      "Resource": "arn:aws:s3:::examplebucket/*",      "Condition": {         "IpAddress": {"aws:SourceIp": "54.240.143.24/32"}      }     }   ]}RTCommentSharerttanswered 4 years ago0Thank you so much - have it sorted.  Really appreciate your time.CommentShareIrishCManswered 4 years ago"


Question: Restrict access to Cloudfront from ABL

My customer has an S3 with a Cloudfront in front. It also has their applications on EC2 with an ABL.He is asking me if its possible to restrict the access so only the ABL has access to Cloudfront.Is that possible?Edit: modify EKS for EC2FollowComment

Answer: "0Thanks for the reply and yes, you are correct about ABL, I'm referring to ALB. I also made a mistake about the EKS it was an EC2, my bad.Let me try to explain a little about the infra, sincerely it was already build so I'm working with what already exist.We have an S3 with information push from another application.A Cloudfront was added infront of the S3,  because it securely deliver content with low latency and high transfer speeds.There is a separate EC2 with an application running that needs to consume the information from the S3.Infront of the EC2 there is an ALB.They are not in the same VPC/Account.Is it possible to restrict the access of Cloudfront to only accept the communication from ALB?CommentSharebiancodaanswered a year agoIndranil Banerjee AWS EXPERTa year agoALB cannot be used as an outbound proxy. So in your case, based on what you have described, the ALB is the inbound load balancer for traffic coming to your EC2 servers. The EC2 servers in turn access files stored in S3 over Cloudfront. So the access from EC2 to Cloudfront won't be over the ALB. It will be over a NAT Gateway in your VPC to allow outbound internet access.If you want to allow access to Cloudfront only from the NAT Gateway, in that case you can use AWS WAF in front of Cloudfront because WAF allows IP based filtering - https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-ipset-match.html, using which can either allow or deny traffic from some IP addresses.I would still like to avoid this complexity if possible and access S3 directly from the application running on your EC2 machines. It does not matter if S3 is in a different account. As long as the other account is part of your organization and not a third-party account, it should be possible as mentioned here - https://aws.amazon.com/premiumsupport/knowledge-center/cross-account-access-s3/In that case, you should be able to use the VPC endpoint from your VPC where your EC2 machines are running to S3, to access s3 using the AWS network and not have to go through the internet over Cloudfront.Share0I am assuming you meant ALB (application load balancer) when you say ABL.The flow is not very clear. Can you please elaborate with a detailed description of the flow.Is the idea to allow restricted access to the S3 bucket only to the applications running on EKS? Why is Cloudfront needed in that case? They can use the IAM role for service accounts feature to allow the pods running on EKS to access the S3 bucket - https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html. There is also an example in this Support Knowledge Center article - https://aws.amazon.com/premiumsupport/knowledge-center/eks-restrict-s3-bucket/You can also configure a VPC endpoint on the VPC in which your PODs are running to ensure that the traffic from your PODS to S3 goes over the Amazon network rather than over the Internet - https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.htmlNormally Cloudfront is in front of an ALB as Cloudfront helps lower the latency of access for remote clients either by caching static content or by providing a quicker path to the AWS network backbone from a nearby point of presence.Some details of the application and the flow can help us provide the right guidance.CommentShareEXPERTIndranil Banerjee AWSanswered a year ago"


Question: AWS Aurora Read Replica : Performance Insights are not updating

"I have created AWS Aurora Read Replica from RDS PostgreSQL Primary database.After creating Aurora Read Replica I have enabled Performance Insights for it, once it is enabled I started using Aurora Read Replica connection string in several places of my application.I was able to see that my application got connected to Aurora Read Replica and all the queries are also getting executed successfully, but while navigating to Performance Insights Tab for Aurora Read Replica I am unable to see anything like Top Users, Top SQL Queries etc.P.S. I have disabled and re-enabled Performance Insights several times to check weather it resolves the issue or not, but no luck.FollowCommentBrandon SUPPORT ENGINEER2 months agoHi Aditya,Which region are your instances located in? I've replicated your situation in us-east-1 and was able to view Performance Insights.Have you checked you have the correct permissions, to view the insights as seen here - https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_PerfInsights.access-control.htmlSome other reasons this can happen include:Your DB instance doesn't have enough resources to access the data from Performance InsightsThe data load on your DB instance is below the database load thresholdShare"


Question: AWS IVS: Include preview image before and after live video stream

"Can you tell me how to include a preview image to display before the live video starts and then after the live video is over?I want to embed the video into a website and do the following:Show a static preview image on the page until the live broadcast startsWhen the live broadcast starts, automatically replace the preview image with the live video feedWhen the live broadcast ends, it should automatically display the same preview image as beforeThank you!FollowComment"

Answer: "0The IVS Player SDK does not support this functionality out of the box. To implement a functionality like this, a custom solution will need to be created. See below a recommendation on one avenue for potentially implementing this functionality.Show a static preview image on the page until the live broadcast starts.The HTML video tag can handle this via the "poster" attribute. If the IVS stream has started, the player state is set to play and the player loads the playback url, this static image will transition to the live stream. When the player state has stopped after the livestream ends, the static image will resume.When the live broadcast starts, automatically replace the preview image with the live video feed.It is possible to be able to find out when a stream goes live by setting up watchable events in Amazon EventBridge for IVS (https://docs.aws.amazon.com/ivs/latest/userguide/eventbridge.html). These events can be received by various processes that could be responsible with providing the UI the information it needs to cause the player to load the url.When the live broadcast ends, automatically display the same preview image as before.Following the logic described in point 2, this custom process should also be configured to notify the UI when the stream has ended and potentially use the player.delete() method. This method will return the poster state on the HTML video tag. It is important to note that on player.delete() the playback is stopped and it will not longer emit events or respond to API calls. So if this method is utilized, another player instance will need to be initiated to continue playback.CommentSharechase-awsanswered 8 months ago"


Question: AuroraDB serverless Jakarta region

"Hi fellow AWS users and AWS employees,I would like to migrate our current development database from PostgreSQL RDS to AuroraDB. Also we are planning to migrate our infrastructure to Jakarta region (ap-southeast3).Unfortunately, we can't find an option about AuroraDB serverless in Jakarta region. Is there any plan to provide AuroraDB serverless service in Jakarta region in near future?Or alternatively, is there're any solution that we can use in AWS that handles auto-scaling relational database system?I hope someone can share some informations about this.Thank you in advanceFollowComment"

Answer: "1Accepted AnswerHello,As of now, Jakarta is not a support region for Aurora Serverless (Relevant Documentation).  Please keep a watch on our Whats New feed as new regions are added.In terms of relational databases that can auto scale, instance based Aurora does support auto scaling.  See the Aurora auto scaling documentation here.CommentShareEXPERTChris_Ganswered 10 months ago"


Question: AWS DMS - Migration fails when column in column filter is in camel case

"We are trying to migrate data from AWS Aurora Postgres (v13.4) to another AWS Aurora Postgres database (Serverless v2) but the data migration fails for tables wherein we add a column filter. Our table names and column names are in the upper camel case. I checked the logs it shows the following error:2022-04-27T09:31:12 [TRANSFORMATION  ]E:  Failed to init filter for column CompanyId [20014]  (manipulator.c:605)2022-04-27T09:31:12 [TRANSFORMATION  ]W:  The metadata transformations defined for table 'public.Tenants' were not performed as at least one of the transformation expressions contains an error  (manipulator.c:147)Here is the mapping rule:{    "rules": [        {            "rule-type": "selection",            "rule-id": "046273916",            "rule-name": "046273916",            "object-locator": {                "schema-name": "public",                "table-name": "Tenants"            },            "rule-action": "include",            "filters": [                {                    "filter-type": "source",                    "column-name": "CompanyId",                    "filter-conditions": [                        {                            "filter-operator": "eq",                            "value": "xxxxxx"                        }                    ]                }            ]        },        {            "rule-type": "selection",            "rule-id": "042087387",            "rule-name": "042087387",            "object-locator": {                "schema-name": "public",                "table-name": "Plans"            },            "rule-action": "include",            "filters": []        }    ]}FollowComment"

Answer: "0this seems to be a edge case i would suggest opening aws support case, so that they can work on this and provide any available workaroundCommentShareAWS-User-8174525-subhashanswered a year ago"


Question: IoT Rule SQL with hyphens

"Problem: IoT Core SQL throws an error when accessing columns and defining aliases with hyphens. Putting quotes, double quotes and back quotes does not help the case.Scenario: I have message format with skeleton-casing and need to put payload into DynamoDB. Using DynamoDBv2.Example message:{"header":{...}"payload":{"item-id": ..."timestamp": ..."data": ...}}IoT Core Rule SQL statement:SELECT 'payload.item-id' as 'item-id', payload.timestamp as timestamp, payload.data as dataFROM "my-topic"Is there a way to keep skeleton-casing and put fields from payload into individual columns in DDB from IoT Core (without using Lambda)?Edited by: Cell2749 on Apr 8, 2020 3:57 AMEdited by: Cell2749 on Apr 8, 2020 3:58 AMFollowComment"

Answer: "0Accepted AnswerHi Cell2749,Thanks for reaching out. For your question, I would recommend you to use a standard sql alias, such as "item-id" or "id". Also, you can use AWS IoT DynamoDBv2 Action to write all or part of an MQTT message to a DynamoDB table. Each attribute in the payload is written to a separate column in the DynamoDB database. Reference (https://docs.aws.amazon.com/iot/latest/developerguide/iot-rule-actions.html#dynamodb-v2-rule)I am interested in learning a bit more about your use cases for including hyphen as a requirement as well.Hope this helps!Thanks,NingweiCommentShareAWS-User-4361278answered 3 years ago"


Question: "Cannot delete Compute Environment, CloudFormation rollback stuck"

"Hi,In compute env. details I have a message:"CLIENT_ERROR - User: batch.amazonaws.com is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::269363578156:role/tda-sys-app-BatchAWSBatchServiceRole-17ML9A4DFX43"Thus I cannot delete the compute environment neither Cloudformation rollback can.FollowComment"

Answer: 0It came out that the role comp. env. is complaining about does not exist. I needed to create the role with the same name and 'batch.amazonaws.com' trust. Then my environ could be rolled back.CommentShareMaciomanswered 3 years ago


Question: RDS - Aurora Serverless - is that possible to Migrate from Aurora Serverless to Aurora Provisioned ???

"Say I am running Aurora serverless cluster(MySql).If in case I need to go back to Aurora Provisioned (MySql), is this possible to migrate?FollowComment"

Answer:
"1Hello,Thanks for reaching out to us.Please allow me to inform you that there are 2 methods that can be used to achieve your use-case.Below are the details and the high level steps to perform each:

Using snapshot restore method:—> This method involves the creation of a snapshot of the existing Serverless cluster and then restoring the snapshot into a provisioned cluster.

—> Here are the high level steps that you will need to perform:

i. Stop application activity and traffic accessing the source Serverless database.ii. Take a snapshot of current Aurora Serverless cluster [1]iii. Restore snapshot to a new cluster [2]. Make sure to choose "Capacity type" as "Provisioned" while doing the restore.iv. Use the new provisioned Aurora cluster endpoint(s) to connect to database (or rename the clusters).—> Please note that the above method will require application level changes because you will need to update the application to use the new provisioned cluster endpoint after the restoration is complete.

—> If you wish to keep the cluster endpoint the same as before, then you will need to rename the Serverless cluster to some other name right after Step (i), and while restoring the snapshot to the provisioned cluster in Step (iii), enter the same name that Serverless cluster was using before.

—> In this way, you will be able to migrate to the provisioned cluster without having to change your application code.

2. Using MySQL client utility 'mysqldump
'
—> In this method, you can create a logical dump of your data that resides on the Serverless cluster and then import the dump into a new provisioned cluster.—> Here are the steps that you can follow:

i. Stop application activity and traffic accessing the source Serverless database.

ii. Create a mysqldump file [3] from the existing Serverless cluster
iii. Create a new cluster that is configured with Capacity Type as Provisioned.iv. Import the created dump file into the writer instance of the new provisioned cluster.
—> You may follow the approach mentioned under snapshot restore method, in order to have the same name and endpoint for the new cluster, to avoid application level changes.

In order to avoid data loss between the two clusters, you would need to stop all write activity on the source serverless cluster just before the point of snapshot creation/mysqldump creation until the restoration/migration of the provisioned cluster is completed. This is because, Aurora Serverless v1 clusters do not support binary log replication [4]. So, it is not possible to replicate the changes from the serverless cluster to the provisioned cluster after the creation of snapshot/mysqldump file, unless the changes are replicated manually.Thus, I would suggest you to plan the migration in a quiet period which has less activity on the database. Once migration is done, please resume the traffic on the new target clusterReferences:

[1] Creating a DB cluster snapshot -https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_CreateSnapshotCluster.html[2] Restoring from a DB cluster snapshot - Restoring from a snapshot -https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_RestoreFromSnapshot.html#USER_RestoreFromSnapshot.Restoring[3] mysqldump — A Database Backup Program -https://dev.mysql.com/doc/refman/5.6/en/mysqldump.html[4] Limitations of Aurora Serverless v1 clusters -https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.html#aurora-serverless.LIMITATIONSCommentShareEXPERTNIRUPAM_danswered 9 months ago"


Question: Which foreign tokenizers does OpenSearch support?

"Hello,I'm trying to find documentation/information about foreign tokenizers supported by Opensearch 1.1. I'm aware that Opensearch supports several foreign language tokenizer plugins (such as Japanese, Korean, Chinese, Polish and Ukrainian. ref: https://opensearch.org/docs/1.1/opensearch/install/plugins/) I've came across ElasticSearch documentation of their supported built-in analyzer (https://www.elastic.co/guide/en/elasticsearch/reference/7.10/analysis-lang-analyzer.html) and I'm wondering if there exists such built-in analyzer for Opensearch as well. Or since ElasticSearch ver 7.10 is supported by Opensearch 1.1, is it safe to assume that Opensearch supports all those built-in analyzer mentioned in the above URL?Thank youFollowComment"

Answer: "0Accepted AnswerAs OpenSearch is forked from elasticsearch 7.10.2, so all the built in analyzer and language analyzers supported with elasticsearch will be supported in OpenSearch as well. Other than inbuilt ones, you can refer this link for other language plugins and analyzer.https://docs.aws.amazon.com/opensearch-service/latest/developerguide/supported-plugins.htmlCommentSharePrashant Agrawalanswered a year agoEXPERTFabrizio@AWSreviewed a year ago"


Question: AWS ECS Task Definition Stuck on DELETE_IN_PROGRESS

"I had an ECS cluster, service, task definitions, ECR repo, RDS database, security groups, and other EC2 services, and I managed to delete all except for a single task definition and the associated network and VPC services. I can't delete any network and other VPC services before the task definition is deleted. However, the task definition is stuck on DELETE_IN_PROGRESS.I deleted the stacks in CloudFormation but it didn't help. CloudTrails don't show any errors either. The task definition had a task role and task execution role but both are deleted. It had one container but the ECR repo had been deleted as well. I tried using AWS CLI and some --force commands to delete other associated services but none could be deleted before this task gets deleted.When I try to delete the VPC I get VPC contains one or more in-use network interfaces.When I try to detach the network interface with or without force I get Failed to detach the network interface. API error: "You do not have permission to access the specified resource." even though I am with the root user, it somehow tries to detach it with the IAM.When I try to delete it, I get The network interface can't be deleted. Network interface is currently in use.Here is a list of services I checked:Running services:EC2 Security Groups - 1EC2 VPCs - 1Subnets - 2Route Tables - 1Security Groups - 1Network ACLs - 1No running services:EC2 InstancesEC2 Key PairsEC2 Elastic IPsEC2 InstancesRDS InstancesECS ClustersECS Task DefinitionsECR RepositoriesLambda FunctionsS3 BucketsBasically, I want to delete all services. Any suggestions on how to do it?FollowComment"

Answer: 0Do you have admin rights?CommentSharemyronix88answered 23 days ago


Question: Why would a public Route53 hosted zone not be visible?

I have registered a domain name through Amazon and set up a public hosted zone in Route53.  Was able to query records successfully over the internet but that has stopped.  My zone is still in Route53 and appears to have the correct records.  I followed the diagnostics suggested here and see that the whois records correctly indicate that Amazon is the registrar and there is a match between the whois and Route53 the name server records but when I run a dig +trace privatedataservices.com the connection between the .com nameservers and amazon is absent.I don't believe I've done anything wrong but my Route53 zone isn't queryable.  How should I proceed?FollowComment

Answer: "0It sounds like there may be an issue with the delegation of your domain to the Amazon name servers. A "dig +trace" command is used to trace the path of a DNS query from your local machine to the root DNS servers, and it appears that the connection between the .com nameservers and Amazon is missing in your case.To resolve this issue, you should first verify that the name servers listed in the WHOIS records for your domain match the name servers in your Route53 hosted zone. If they match, the next step would be to check the delegation of your domain by performing a "dig NS yourdomain.com" command. This should return the name servers that are authoritative for your domain. If the name servers returned by this command do not match the name servers in your Route53 hosted zone, then there is a problem with the delegation of your domain.You should contact the registrar of your domain and inquire about the delegation of your domain. You can also check the registrar's documentation to see if there is any guidance on how to fix the delegation issue.CommentSharejayamaheizenberganswered 4 months agosirwobin 4 months agoI did check the NS records match between whois and Amazon (who is the registrar).  How do I contact Amazon to notify them of the error?Share"


Question: EB permission denied Erro 13

"Trying to use ansible on a python web application(Flask), but ansible returns a permission denied error when trying to create a folder. How do you configure it so it has the permission to do so?Error log:https://gyazo.com/69cfc101360884b033ed89f6e1116714Edited by: Savio on Apr 4, 2019 5:40 AMFollowComment"

Answer: 0configuring my instance to have same security group as my eb-env fixed the issue (instance config security group was on default and eb-env's was on a generated group)CommentShareSavioanswered 4 years ago


Question: AWS codebuild failed at DOWNLOAD_SOURCE phase

"I am attempting to create a CICD pipeline using AWS CodePipeline to deploy magento to an EC2 instance and terraform to provision the infrastructure on AWS. After running the script, it fails at DOWNLOAD_SOURCE phase during the build stage. After much enquiry I realised it has to do with VPC settings. In the AWS documentation it says to use private subnet ids and present the arn instead of the just the subnet id. I have done all that but it is still failing. What do I do to resolve this?FollowComment"

Answer: "0Hi.If you are running CodeBuild in VPC, you need to secure an access route to the source repository in one of the following ways.Run in public subnetRun in a private subnet that can be outbounded from NAT GATEWAYConfigure VPC endpointsSee also the following articles.https://dev.classmethod.jp/articles/codepipeline-private-downloadsource/https://dev.classmethod.jp/articles/access-from-private-codebuild/CommentShareEXPERTiwasaanswered 8 months ago"


Question: Is there a way to grab a user's voice utterance from an Amazon Lex V2 bot using Lambda calls?

"I am building an Amazon Lex V2 bot, and I would like to send the user's voice utterances from the Lex V2 bot to a third party application.I have looked through the documentation for Lex V2, and it appears that the API RecognizeUtterance only sends back a text transcription of the user's audio utterance.  I also looked at AudioInputEvent, but it looks like that if for sending audio into Lex, and not retrieving it.Is there a datatype where a user's utterance is saved into session in the Lex V2 bot, and if so, is there an API to access it using a Lambda call in either Java or Python (using Boto3?)FollowComment"

Answer: "0Lex does not support returning voice utterances in API response. It only returns transcripts of the input audio.For data analysis on voice utterances, you can enable Lex conversation logs to access user's voice utterances for data analysis.  https://docs.aws.amazon.com/lexv2/latest/dg/conversation-logs-s3.html. The audio data gets stored in a customer specified S3 bucket, which can later be accessed using a Lambda function.CommentShareswapandeepatawsanswered a year agoJeremy 9 months agoswapandeepataws, would it be possible in the future for the Lex team to please return the S3 URL from the Lex bot CloudWatch logs to the response sent to Lambda via Lex codehook on each turn?You can see in Lex logging output to CloudWatch (if turned on for conversation logs in Lex bot alias settings), those logs from Lex show the S3 utterance path. But that’s not passed from Lex to the Lambda codehook as info that we could use to “tie together” the utterance text transcript from the response JSON to its associated utterance S3 URL recording.We know how to find the utterances in S3, but without the URL that ties to the text, we can’t “match them up” effectively in our custom app (they aren’t necessarily recorded in order to the bucket—they can be written “out of order”). We’d like to show the text utterance, and also hyperlink it to the associated S3 URL for the utterance it was related to. That way, the user could click on an utterance result in our custom app, and play the actual recording that was captured. Would be a great feature.Is anything like that possible today? Or could a feature request be added to Lex to please pass on that S3 URL to the JSON response for use so we could leverage it?Share"


Question: What is Cognito's App Client Secret purpose?

"At the documentations there's an App Client Secret, but I can't find anywhere its purpose.I see the javascript SDK doesn't use it, I also don't know why, probably because many javascript applications run on the users browser, not a place to expose a secret, but that's my wild guess.If this is something like a password for the App Client ID, I can't see how this improves security, since however can steal your App Client ID will be able to steal the App Client Secret as well. Besides, the App Client ID is fairly random and should provide enough security to brute-force attacks.I would like to know what's the purpose of this secret, how cognito uses it and what functionalities does it provides.FollowComment"

Answer: "1The client secret is part of the oauth standard. You are correct in your assumptions.https://www.oauth.com/oauth2-servers/client-registration/client-id-secret/Quoting:"If the developer is creating a “public” app (a mobile or single-page app), then you should not issue a client_secret to the app at all. This is the only way to ensure the developer won’t accidentally include it in their application. If it doesn’t exist, it can’t be leaked!"Also:"The client_secret is a secret known only to the application and the authorization server. It must be sufficiently random to not be guessable, which means you should avoid using common UUID libraries which often take into account the timestamp or MAC address of the server generating it. A great way to generate a secure secret is to use a cryptographically-secure library to generate a 256-bit value and converting it to a hexadecimal representation."CommentShareAWS-User-0691748answered 5 years ago0Accepted AnswerYes, I mean this is part of the standard and it totally depends on the ability to secure the client secret.CommentShareAWS-User-0691748answered 5 years ago0Well, it makes sense then.... But I still don't understand the point or enforcing this, unless you just want to comply with the OATH2 standard, because as far as I can see, there's no downside in leaving a client secret in an open app. The app won't be less secure if the client secret leaks, it will be just the same.CommentSharemfeinsteinanswered 5 years ago"


Question: AWS SSO - Manage Users

"I'm seeing a problem today that I haven't previously encountered.When I navigate to the AWS SSO Users page there is a information message displayed at the top of the screen.Your identity source is currently configured as 'External identity provider'. To add new users or edit their attributes, you must do this using your external identity provider.Along with this message the 'Add user' button has been removed from the UI.The problem is that my External identity provider is G Suite, and as stated in the AWS Docs for setting up SSO with G Suite.AWS SSO supports automatic user provisioning via the System for Cross-Identity Management (SCIM). However, this is not yet officially supported for G Suite custom SAML applications. In the meantime, you can manually create users.I have a new user that I need to create an SSO account for but I'm now completely unable to do this.This has never been a problem before and I successfully added a user in this way on the 23rd May, just 3 days ago.ThanksFollowComment"

Answer: "0Accepted AnswerWhat is the Provisioning method,  "SCIM" or "AWS SSO"?(You can see it at "AWS SSO" Management Console -> "Settings" -> "Identity source" Tab.)If "SCIM", you cannot edit the users and groups on AWS SSO.  Can you disable it with the steps described at below link?https://docs.aws.amazon.com/singlesignon/latest/userguide/provision-automatically.html#disable-provisioningCommentSharesuzukianswered a year ago0Thank you.Yes that was the problem. The provisioning method had been set to SCIM.Disabling automatic provisioning has given me back the Add User Button.CommentShareAWS-User-8518918answered a year ago"


Question: What factors affect Sagemaker endpoint response time?

"I'm using Sagemaker as part of a planned deployment of a XGBoost model to production where it will be called by a customer facing mobile app (via another back end service that we also have hosted in AWS).I would like to understand how to improve response times. I have tested the response time of my model both when it resides locally on my own dev machine, as well as when its running in Sagemaker.The wall time for local atomic predictions takes about 1 ms at 50p and 7 ms at 99p.The wall time for atomic predictions (using the Python client SDK in a sagemaker notebook) takes about 20 ms at 50p and  25 ms at 99p. However, there are outliers that take as long as ~300ms.I am curious to know what factors affect the performance of Sagemaker calls (other than the complexity of the model itself). And I would be very grateful for any tips to get our outliers lower (preferably around 50 ms if possible).FollowComment"

Answer: "0Hi bradmitchell,SageMaker Endpoints are managed hosted solution which has layered routing internally. You could gain some additional insights into the system with the OverheadLatency metric. You will also see the ModelLatency metric which will show what the time taken by customer model itself -- https://docs.aws.amazon.com/sagemaker/latest/dg/monitoring-cloudwatch.html.What kind of TPS are you driving against your Endpoint? (In a low request rate situation, it is possible that the caches on our side are not kept warm and you might observe increased latencies). I believe the above metrics will help you with more details.Thank you,ArunCommentShareAWS-User-1911581answered 4 years ago0Hi Arun,Thank you for suggesting the Cloudwatch metrics. I just checked the Overhead Latency and it lines up pretty closely with the average timings I got in a Sagemaker Jupyter Notebook using the Python client SDK to invoke the endpoint.Currently, I am expecting about 2.5 transactions per second during peak usage and 0.5 TPS during low traffic hours. The peak number will hopefully go up to around 10 TPS later this year.The cache explanation makes a lot of sense. I've experimented with a few different TPS settings. There is pretty consistently some spiking of timings to start off but then it levels off to around 20 ms for higher TPS. In lower TPS experiments I've noticed that the timings remain a little unpredictable.Thank you again for your help!BradCommentSharebradmitchellanswered 4 years ago"


Question: ECS CLI Install

"Following the ECS CLI instructions, when I get to the step where you import the amazon ecs gpg public key, I run into the error:"gpg: key BCE9D9A42D51784F: 1 signature not checked due to a missing keygpg: key BCE9D9A42D51784F: "Amazon ECS ecs-security@amazon.com" not changedgpg: Total number processed: 1gpg:              unchanged: 1"I'm new to gpg so there's probably a very simple step I'm missing here. Any idea's on what I need to do differently to succesfully import the gpg public key?Thanks!Edited by: Andrew2021 on Sep 10, 2021 9:31 AMEdited by: Andrew2021 on Sep 10, 2021 9:32 AMFollowComment"

Answer: 0So despite the above error message the packages actually did install. I was able to continue on through the steps in the tutorialCommentShareAndrew2022answered 2 years ago


Question: Enable security standards

can you enable AwS foundational and other security standards only in security hub or do the conformance packs also need to be enabled in aws config?FollowComment

Answer: "0The AWS Foundational Security Best Practice (FSBP) security standard is only available in Security Hub. Enabling this does not require you to enable any confirmance packs in AWS Config. You do need to enable AWS Config to use Security Hub, but that's it. You can use conformance packs in AWS Config if you wish to do other checks, perhaps specifically for your own internal compliance control requirements. We recently launched a native integration between AWS Config and AWS Security Hub so that everything now can come together in Security Hub: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-internal-providers.html#integration-configCommentShareAlex_AWSanswered 10 months ago"


Question: AWS Lightsail Linux instance public_dns_name

"What's the public_dns_name for my AWS Lightsail instance? I'm running one Debian instance. The static IP is working when connecting via SSH, but I want to know the public_dns_name of the instance.FollowComment"

Answer: 0Accepted Answeryou can go to DNS zones option in light sail and from there you can create the DNS record for domain and get other DNS records values.On light sail dashboard DNS zones is option.CommentShareharshmanvaranswered 4 years ago


Question: Search files via PHP SDK filtering with limit and date

"I need to search files on AWS S3 storage using some filter:range datestorage classnum max itemsI'm using "aws/aws-sdk-php" : "^3.239" library$objects = $this->client->getIterator('ListObjects', ['Bucket' => S3_BUCKET_NAME,'Prefix' => $folder,'MaxKeys' => 10,// NOT WORKS'StorageClass' => "STANDARD"// NOT WORKS]);foreach ($objects as $object) {...}Could you please support me?ThanksLFollowComment"

Answer: "0The Iterator method is for the php V2. If you are using PHP V3, could you try with the paginator. A Paginator is essentially an iterator of results. They are created via the getPaginator() method of the client.Resources for review:[1]: https://docs.aws.amazon.com/zh_cn/aws-sdk-php/guide/latest/guide/paginators.html[2]: https://docs.aws.amazon.com/aws-sdk-php/v3/api/class-Aws.AwsClientInterface.html#_getPaginator[3]: https://docs.aws.amazon.com/aws-sdk-php/v3/api/api-s3-2006-03-01.html#listobjectsCommentShareGanesh_Canswered 6 months ago"


Question: Tracking usage of Cloudformation templates and CDK Constructs across multiple accounts

"HelloIn my team we provide CloudFormation templates and CDK Constructs for other teams in our organization to use. We want to track where and what version of our templates and constructs are used across multiple accounts. We are currently setting tags in our templates and constructs but compiling the information has turned out more difficult. We have looked at AWS Config but the Advanced Queries doesn't allow querying on tags nor does it seem to allow me to query on all resource types, for example I can't seem to query for any types of ECS resources which would be relevant for us.Is there a good way to track this usage?Thank youFollowComment"

Answer: "0Hello,An alternative is to use the AWS Resource Groups and Tags. With this feature you can use the tag editor console or APIs to query tags on supported resources in a single account. Amongst the supported resources are the ECS cluster and ECS task definition.For additional helpful information, see How to Efficiently Extract and Query Tagged Resources Using the AWS Resource Tagging API and S3 Select (SQL)CommentShareUgochukwu_Ianswered 8 months ago"


Question: SFTP - SSH Keys

"Hi all!I've managed to set up an S3 bucket and an SFTP Server. Upon adding users to the server, I am prompted to enter an SSH public key. I have used PuTTY Key Generator on my laptop to generate the keys (both private and public). However, when i try to paste the SSH public key, I receive the message 'Failed to create user (Unsupported or invalid SSH public key format)'. Can anyone please advise what I could be doing wrong? TIAFollowComment"

Answer: "0Hello, could you confirm that the key entered aligns with one of our supported algorithms?For ED25519: ssh-ed25519For RSA:rsa-sha2-256rsa-sha2-512For ECDSA:ecdsa-sha2-nistp256ecdsa-sha2-nistp384ecdsa-sha2-nistp521If it does, and you're still experiencing issues, could you confirm that you're using PuTTYgen on Windows?CommentShareEXPERTAWSTransferFamilyanswered 3 months ago0Thank you, i managed to do it! Thanks so much!CommentSharelyndroseanswered 3 months ago"


Question: I hosted my videos on s3 it is showing media is curropted and videos is not playing

"Hello,I have edited my videos from canva and uploaded into s3 buckets.All the videos were playing initially when I try to access it by object URL (I made my bucket public). All my videos were connected to Moodle LMS and it was working fine on moodle as well.After a month or so when I play video on moodle it is not working, then I went to my bucket and played the video with object URL it shows the thumbnail, duration and a player but the vide is not playing. When I downloaded the video from my bucket and uploaded to another CDN and try to play it, it is not working, also the dnwoloaded vides is not playing and it is showing media corrupt error what should i do?FollowCommentkentrad EXPERT17 days agoDo you have versioning turned on for the bucket?Share"

Answer: "0Check the file integrity: Ensure that the videos you uploaded to your S3 bucket are not corrupted. Try downloading one of the videos from the bucket and play it locally on your computer using a media player. If the downloaded video is also showing a media corrupt error, it indicates that the original file might be corrupted or was not uploaded correctly. In this case, you should obtain a non-corrupted version of the video and upload it again.Verify the file format and encoding: Confirm that the videos you are uploading are in a supported format and codec. Different platforms and players have specific requirements for video formats. Ensure that the videos are encoded using a codec that is compatible with your playback environment, including Moodle LMS. Commonly supported video formats include MP4, AVI, and MKV, among others.CommentShareFS_AWSanswered 10 days ago"


Question: AWS Client VPN - Notification of new client connection to another AWS service (e.g. Lambda)?

"Hi,I'd like a Lambda function to be notified when a new client connects to our AWS Client VPN endpoint so that it can take some action to update our private hosted zone in Route53. Is there any way to send a notification from our AWS Client VPN endpoint to Lambda either via SNS or Eventbridge?Many thanks in advance.FollowComment"

Answer: "0Accepted AnswerI've been able to find my own solution that I think will work:Setup connection logging from Client VPN endpoint to Cloudwatch Log Group. (https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/connection-logging.html)Setup Lambda function that gets triggered when a new connection log event comes into the CW log group with the value for the 'connection-attempt-status' key set to 'successful' (https://aws.amazon.com/blogs/mt/get-notified-specific-lambda-function-error-patterns-using-cloudwatch/)Have the Lambda function do what it needs to do with the connection info (e.g. take the 'Client IP' key and update Route53).So essentially, the flow is:Client VPN Connection Log -> Cloudwatch -> Lambda (via CW log stream subscription) -> Route53.Any better suggestions welcomed!CommentSharecgddrdanswered a year ago"