Question: Packaging Java Lamba using CDK is failing in Code Build

"I am following this blog - https://aws.amazon.com/blogs/opensource/packaging-and-deploying-aws-lambda-functions-written-in-java-with-aws-cloud-development-kit/ to create the java lambda using CDK. But when I pushed the changes and it is failing in code build with the below error. The "cdk synth" worked in my local machine.  Can some one give any insights on this issue ?Bundling asset TestStack/test/LambdaStack/LambdaFunction/Code/Stage...[ERROR] Failed to execute goal org.codehaus.mojo:exec-maven-plugin:3.0.0:java (default-cli) on project test: An exception occured while executing the Java class. Failed to bundle asset TestStack/test/LambdaStack/LambdaFunction/Code/Stage, bundle output is located at /codebuild/output/src940121800/src/cdk.out/asset.593cf75a4cb232e162ae4760eddc8336106322f580119285c2b8f0df0c517874-error: Error: docker exited with status 125FollowComment"

Answer: "0Accepted AnswerI enabled the privileged option in the environment variable in code build and also added "dockerEnabledForSynth(true)" in CodePipeline construct. Then it ran as expected.I think the mvn build script is trying to download the maven libraries, but it got failed resulted in error.The moment I enabled the privileged option, it worked. I think, this is nothing to do with Docker but not sure.CommentShareNavin GVanswered a year ago"


Question: RDS Postgres Logical replication access to essential table denied

"postgres=> \du postgres                        List of roles Role name |          Attributes           |    Member of    -----------+-------------------------------+----------------- postgres  | Create role, Create DB       +| {rds_superuser}           | Password valid until infinity | postgres=> select * from pg_replication_origin_status;ERROR:  permission denied for relation pg_replication_origin_statuspostgres=> This table is essential to tracking progress of logical replication. Without it, there is not clear way to track if the LSN of the local and remote ends of the replication slot are in sync. The user in the example is a member of rds_superuser.https://www.postgresql.org/docs/10/replication-origins.htmlIs there a particular reason that this system table is not accessible or was this just a mistake in the implementation.FollowComment"

Answer: "0Accepted AnswerCan you use the function call instead of the view?postgres=> select * from pg_show_replication_origin_status(); local_id | external_id | remote_lsn | local_lsn ----------+-------------+------------+-----------(0 rows)Thanks.Regards,JigneshCommentShareJigneshShah-AWSanswered 4 years ago"


Question: "I just need processing capabilities for rendering, is that possible?"

"Hello,New to AWS and not a programmer or developer but savy with computers. Is there a quick start guide? I was hoping it would be the same as running a "Remote desktop" with AWS but proving to be far more complicated.I am working on processing a large file of 1TB and wanted to run this on AWS is that possible? can I open the program and use AWS to complete the operation?FollowComment"


Question: "aws elasticbeanstalk list-available-solution-stacks" returns empty arrays

"When trying to figure out a valid solutionStackName for  CfnEnvironment. Running the  aws command ""aws elasticbeanstalk list-available-solution-stacks" returns empty arrays when run locally. When running the same command in AWS cloudshell it works correctly. Tried running it both in powershell and in wsl2 (ubuntu).aws elasticbeanstalk list-available-solution-stacks{    "SolutionStacks": [],    "SolutionStackDetails": []}Running same command in aws cloudshellaws elasticbeanstalk list-available-solution-stacks{    "SolutionStacks": [        "64bit Amazon Linux 2018.03 v2.9.11 running PHP 5.4",        "64bit Amazon Linux 2018.03 v2.9.11 running PHP 5.5",        "64bit Amazon Linux 2018.03 v2.9.11 running PHP 5.6",        "64bit Amazon Linux 2018.03 v2.9.11 running PHP 7.0",        ... + moreWhy is this not working locally? All other aws cli commands I tried worked.Thanks,PatrikFollowComment"

Answer: "0Accepted AnswerIt turned out it was a permissions issue, after updating my aws cli credentials to the correct role I got results back.I would have expected to get a permission denied back instead of a empty result set, but I assume that is by design.CommentSharePatrikbganswered 8 months ago"


Question: How to write an Athena query to output tables to CSV files?

We have an Athena DB that contains 139 tables and as a one time test I need to ingest the data from each table into Splunk. Is there a query that would pull the output from each individual table and write it out as it’s own CSV file (as table name) so that I would have 139 CSV files? We currently save Athena queries to a separate s3 bucket.FollowComment

Answer: 0select * from table_name or https://docs.aws.amazon.com/cli/latest/reference/athena/start-query-execution.htmlCommentSharerePost-User-2606351answered 7 months ago


Question: How do I stop an ECS deployment that does not use CodeDeploy?  The ECS deployment is stuck in "In progress".

How do I stop an ECS deployment that does not use CodeDeploy?  The ECS deployment is stuck in "In progress".FollowComment

Answer: "0If you are not using Circuit Breaker or CloudWatch Alarms to roll back your Deployment on failed ECS Tasks during the deployment you have to deploy a new Deployment with new Task Definition which will pass health checks, or revert the Task Definition version to the last known working version.According to the https://aws.amazon.com/blogs/containers/automate-rollbacks-for-amazon-ecs-rolling-deployments-with-cloudwatch-alarms/ blog post:"By default, when the tasks in a service are unable to reach a healthy state, the scheduler applies the service throttling logic to retry the deployments and it required manual intervention to cancel the deployments after a certain number of failed attempts."ECS Deployment "stuck" in the "In progress" state is expected behavior.CommentShareMarinAEanswered 3 months ago"


Question: Cannot deploy lambda on edge

"Hello,I'm getting the following error when trying to add a deploy@edge trigger to my lambda:You cannot update the specified distribution using this API version because it is associated with a cache policy. (Service: AmazonCloudFront; Status Code: 400; Error Code: IllegalUpdate; Request ID: 43a578a3-65de-4f2f-99a6-31ba325ad78f; Proxy: null)I've tried following the steps in the link below, but cannot go past the deploy@edge part:https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-how-it-works-tutorial.html#lambda-edge-how-it-works-tutorial-cloudfrontCould you pls advise?FollowComment"

Answer: 0Edit the CloudFront Default Cache Behavior Settings in Behavior tab and in "Cache and origin request settings" select "Use legacy cache settings" and change "Cache Based on Selected Request Headers" to None.CommentShareraulbarretoanswered 3 years ago0thank you! best if this detail is added to the tutorial pageCommentSharesagimannyokanswered 3 years ago


Question: AWS LightSail Multi-Wordpress domain redirects to static-IP

"Hello,these are the steps I have completed:I have configured a multi-wordpress.For one of the instances I have configured an static-ip (for instance: 52.51.50.49)I have acquired a domain.In Route 53 I have added an A redirection to the static-ipIn LightSail, under Networking, I have created a DNS Zone with the domain name.I have let some time till all has been distributed and I have tested.Test and resultWhen I enter the domain name in the navigator, for instance: domainname.comthe result is that it redirects it to: http://52.51.50.49.nip.io/wp-signup.php?new=domainname.comthe question is:what I have not completed in the right way ??many thanks in advance,joapenFollowComment"

Answer: "1Accepted AnswerHi, @joapenYou need to follow the steps below to configure the primary domain with configure_app_comain.https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-define-the-primary-domain-for-your-wordpress-multisiteBy default, (yourip) .nip.io is automatically set by the IP address tracking function.The above procedure will stop automatic IP tracking and set the custom domain you specified.CommentShareEXPERTiwasaanswered a year agoShawnaD 6 months agoHi Iwasa, I had the same problem so followed the article you posted. First part of setting as primary domain, no problems. Second part, the command sudo mv bnconfig bnconfig.disabled returned "no such file or directory".  Any insights? Thanks!ShareKwikkSoft 2 months agoThank you so much. This worked and really helped.Share0I followed this step, it still didn't work after I waited for 4 hours.https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-define-the-primary-domain-for-your-wordpress-multisiteCommentSharerandom-repostanswered 2 months ago"


Question: Site redirection not working

"Hello,I have a web site set up in AWS ECS containers using CloudFront and ALB for traffic with URL mydomain.com which is up and running. However, the way another domain www.mydomain.com is currently setup for redirecting to mydomain.com is as an empty S3 bucket to redirect to mydomain.com but when I hit www.mydomain.com  in the browser I get: "Error. Failed to contact origin". Both domains have CloudFront distributions each and in Route 53 each has an A record to direct to its own CloudFront distribution.Can Anyone tell me where the configuration is going wrong?Many thanks in advance.FollowComment"

Answer: "0Hi,Setting up APEX to www and viceversa redirection with Cloudfront may seem a trivial task but it is far from it in AWS!In my experience, rather than creating a hack with an empty S3 bucket which redirects to the target origin, I would rather setup a CloudFront function that handles the redirection: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/example-function-redirect-url.html.The 2 possible approaches are explained here too: https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-redirect-domain/Hope it clarifiesCommentShareEXPERTalatechanswered 4 months ago0Make sure your Security group on your ALB for  www.mydomain.com allows access from cloudfront.Also ensure that the ECS container's SG has access from the same ALB in question also.Ensure your ALB rules are setup and send requests to the containers.If using custom headers for permission, ensure the correct HTTP Headers are on your alb rules alsoCommentShareGary Mcleananswered 2 months ago"


Question: spot instance price boundaries as preflight

How can we make sure what is the spot instance price boundaries as preflight? specifically the min priceFollowComment

Answer: "0You won't be able to easily see this, though you can see historical Spot pricing information: https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-spot-price-history.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances-history.htmlCommentShareEXPERTRob_Hanswered a year ago"


Question: Why would an instance lose it's IP intermittently

"One of our clients reports ec2 instance, configured in private subnet loses it's IP address intermittently after a reboot. I would appreciate some help with identifying the root cause and a possible fix to the issue.FollowCommentChris_G EXPERT8 months agoAre you rebooting the EC2 instance or stop/starting it?  If you are stop/start it, it will get a new IP each time.Share"

Answer: "0The phrases "loses it's IP address" is a little unclear - it'd be good to have some extra detail about how the client is determining this.Otherwise: First, when this happens I'd check in the console to see if the instance has had an IP address allocated by DHCP. If not, then definitely raise a support ticket because all instances should be automatically (and quickly) allocated an IP address.If the instance does have an IP address in the console then there is probably an issue with the operating system somewhere. Look into the logs and see if you can see any messages that relate to this.Again, more detail would help - operating system type; logs; anything at all.CommentShareEXPERTBrettski-AWSanswered 8 months agorePost-User-7430003 8 months agoThanks for the response. I was able to get more details from the client and the issue was not properly reported.Issue:This instance intermittently fails health check. When stopped and restarted, the health check issue is resolved but will occurs again after a while. Was not able to lock down a time line between each occurrence. But was informed it happens quite frequently lately. During such occurrences, client gets a network issue when trying to ssh/connect to the box using a third party tool. I pull the logs for that instance, and will attach in the comment section.Share"


Question: RDP was not accessible for Windows server 2019

"Hi,We are unable to connect to Remote Desktop to the Windows Server 2019  from the last two days. Following is the error we are getting while try login to the server"An authentication error has occurred.The function requested is not supportedRemote computer: <computer name="">This could be due to CredSSP encryption oracle remediation.For more information, see https:/go.microsoft.com/fwlink/?linkid=866660"We also installed latest windows updates using AWS System Manager to check if it resolves the issue, But it did not help.FollowComment"

Answer: "0I'm sure you've moved on from this issue, but I am going to provide a solution for others since I have been messing with this very issue all afternoon while studying for the SAA exam.Assuming you have RDP inbound on port 3389 allowed in the security group, the problem is with the Network Level Authentication setting on the Windows Server.  It is located in Settings - System - Remote Desktop, and then click on advanced settings.  To be able to RDP into server from outside the VPC (as in, my house), I had to uncheck the box.  Then, I could RDP into the system as the AWS documentation says you should.Be aware this is not the recommended setting and may make your machine vulnerable, but there was no other way to get the CredSSP error to go away.To figure this out, I had to create a Linux instance with the MATE GUI in the same VPC just so I could RDP to the Windows instance from the Linux instance using Remmina.I then took the time to figure out how to do it through Powershell.  I installed the Session Manager role and agent on the Windows instance so I could connect to Powershell through the AWS console.First, get the Windows hostname...PS c:> $env:computernameThen, set a new env variable for the computer name...PS c:> $ComputerName = "EC2AMAZ-******" (or whatever the name is)Finally, enter this command...PS c:> (Get-WmiObject -class Win32_TSGeneralSetting -Namespace root\cimv2\terminalservices -ComputerName $ComputerName -Filter "TerminalName='RDP-tcp'").SetUserAuthenticationRequired(0)After all that, you should be able to RDP in.  You might reboot the instance to be sure the new policy takes effect.CommentShareNH14-DFWanswered 2 years ago"


Question: Duplicate ClientId  locating and removal

Hi AllIOT core is showing that i have a duplicate clientId and so disconnects form my devicethe issue is i dont know how to locate the duplicate deviceis there a way to find what the other device is ... as i only know one at this point and as the clinetid is the imei number of the modem... it cannot be changedthere are too many devices to delete and start again... so thats not an optionFollowComment

Answer: "0Hi. The Connect and Disconnect events in CloudWatch contain both the sourceIp detailing the IP address of the device and the principalId detailing the ID of the device certificate. Assuming you have a unique certificate for each Thing, you can use the two certificate IDs to find the Thing names. You can do that on the console or on the command line:aws iot list-principal-things --principal arn:aws:iot:<region>:<accountID>:cert/<principalId>You can use Logs Insights in CloudWatch to search for all Connect and Disconnect events using the particular <clientId>. You can use a filter statement like this:filter clientId = '<clientId>' and (eventType = 'Connect' or eventType = 'Disconnect')CommentShareEXPERTGreg_Banswered a year agoGreg_B EXPERTa year agoYou may also want to consider Thing policy variables to ensure that a device can only connect using a client ID that matches the Thing name.Share0To find dedicated disconnects caused by a duplicate clientId you can use the following filter in CloudWatch Insights:filter disconnectReason = "DUPLICATE_CLIENTID"KR,PhilippCommentSharePhilipp Sanswered a year ago"


Question: Ruby AL2 version 3.2.5 missing /opt/elasticbeanstalk/deployment/env

"All of a sudden on version Ruby 2.6 AL2 version 3.2.5 the file we use to pickup our environment variables, /opt/elasticbeanstalk/deployment/env is missing? it was there in 3.2.4. Was this removed intentionally? This is how our custom scripts get to our configured environment vars.FollowComment"

Answer: 0Looks like that file doesn't get created until later in the deploy stage.Ended up reading them from /opt/elasticbeanstalk/bin/get-config environmentWish this stuff was better documented.CommentShareduckworthanswered 2 years ago


Question: Create procedural texture in c++?

"Hi, i need create procedural texture like IIndexedMesh from IStatObject, the same way but for 2d texture. Any ideas any examples will be nice :)Follow"

Answer: "0Accepted AnswerI have not tested this yet but I think you can do something like this:unsigned int tex_id = gEnv->pRenderer->DownLoadToVideoMemory((byte*)bitmap_data, w, h, eTF_R8G8B8A8, eTF_R8G8B8A8, -1,true,2,0,cache_name);ITexture * tex = gEnv->pRenderer->EF_GetTextureByID(tex_id);SharerePost-User-7779371answered 6 years ago0Hi new_user_987, thank you !!! You gave to me right road to find answer !!!Here the code.int width = 800;    int height = 800;byte* pStorage = new byte[width * height * 4];for (int i = 0; i < height * width * 4; i += 4){pStorage[i] = 0; //RedpStorage[i + 1] = 255; //GreenpStorage[i + 2] = 255; //BluepStorage[i + 3] = 255; //Alpha}gEnv->pRenderer->WriteDDS(pStorage, width, height, (width * height * 4), "textures/test.dds", eTF_R8G8B8A8, 1);delete[] pStorage;SharerePost-User-0150549answered 6 years ago0Thanks for the great post @REDACTEDUSERSharerePost-User-8353690answered 6 years ago"


Question: OLE Automation on SQL Server RDS?

"Is OLE Automation supported in SQL Server RDS?  If not, what are the alternatives?Thanks in advance.FollowComment"

Answer: "0Accepted AnswerThe "Ole Automation Procedures" configuration is currently not supported with RDS SQL server due to RDS being a managed service. This is the default RDS engine security behavior, and not a bug.As a workaround, you may run SQL Server on an EC2 instance as you would have less restrictions and would be able to execute both "sp_configure" and OLE automation procedures without any issues.CommentSharerePost-User-4555259answered 6 months agoKH 6 months agoThanks so much.Share"


Question: Are there synergies between SAP Business Technology Platform and AWS services?*

Are there synergies between SAP Business Technology Platform and AWS services?NOTE: This is a common question asked by AWS customers. The AWS team is posting it to provide an answer that can benefit everyone.FollowComment

Answer: "0SAP BTP offers a portfolio of services that can be used with SAP workloads for integration, extension and data analytics use cases. SAP customers can use SAP Business Technology Platform (SAP BTP) capabilities on AWS to modernize and create new SAP applications and integrate and extend existing SAP and third-party applications and data assets.AWS offers the widest support for SAP BTP services hosted on AWS: the SAP Extension Suite, SAP Integration Suite, the SAP HANA® Cloud database, the SAP Analytics Cloud solution, and the SAP Data Warehouse Cloud solution are widely available in all regions on AWS.AWS Native Services are both complimentary (eg for data extraction and storage (https://aws.amazon.com/blogs/awsforsap/integrating-sap-systems-with-aws-services-using-sap-business-technology-platform/)) and provide unique propositions (eg. IOT Service (https://aws.amazon.com/blogs/awsforsap/predictive-maintenance-using-sap-and-aws-iot-to-reduce-operational-cost/) or Lookout for Vision (https://aws.amazon.com/blogs/awsforsap/proactively-detect-and-prevent-manufacturing-defects-with-sap-on-aws/)) to SAP BTP Services. Please reach out to your local SAP or AWS Specialist teams to understand more around the joint value proposition and use cases for SAP BTP and AWS Native Services.“NOTE: This answer is provided by the SAP on AWS speciality team and is accurate at the time of publish. Please check comments as the answer may have changed/services evolved.“CommentSharedemouzonanswered a year ago"


Question: What could be the cause of low network throughput on my AWS lambda?

"My AWS lambda is fetching files that are a few 100mb and it takes roughly 1s per 1mb which seems incredibly slow. Memory is at 20% (2048mb), CPU is at 30%. Both the source and the lambda are on AWS network. My Lambda is on a VPC, and it has an additional security group to force it to get it's own ENI.On my home WiFi in the same City as the AWS region I'm getting at least 7x faster download down from the source.While this is happening a small putObject to S3 on a 58kb file can take upwards 20s to complete. It's very odd.Where can I find how much bandwidth is to the lambda and what can I do to increase it?FollowComment"

Answer: "0Have you created an Interface VPC endpoint to S3 in your VPC. If you haven't the calls to S3 from the lambda function will be made over the Internet. If you have then the calls will be made over the Amazon network and will therefore be of much lower latency - https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 7 months agoKit - CostCenter 7 months agoThanks that's helpful, but my question isn't actually about the S3 upload, it's just odd to me that it's slow. The actual issue is that I'm fetching a file from a third party over HTTP, and only seeing around 1mb/s down even though my home network is doing 7mb/s down.ShareIndranil Banerjee AWS EXPERT7 months agoHow much memory is allocated to your lambda function? You can try increasing the memory to see if you get better performance.ShareKit - CostCenter 7 months agoAt 1GB I get 1mb/s. At 2GB I get 2mb/s. At max 10GB I get 2mb/s. Also I've confirmed there is a VPC Endpoint Gateway setup for S3 already, and it's mapped to the private subnet and the lambda can reach the gateway endpoint according to the reachability analyser.Share0Hello,Indranil is correct in his comment, you should really set up a private gateway to s3 (https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html). It does not cost you anything, and it will increase network throughput while offloading your NAT.However, the architecture you have should allow for faster traffic than you get, so my best guess would be the client transfer config, this is the python example, but every SDK (and the CLI) has its own version.https://boto3.amazonaws.com/v1/documentation/api/latest/guide/s3.htmlHope it helps!CommentShareCarl Ostrandanswered 7 months agoKit - CostCenter 7 months agoThanks but the issue isn't the S3 upload for the small file, but rather the download over http from a third party seem to choke at 1mb/s. I'm streaming multipart uploads on S3 so that's taken care of.Share"


Question: Addons hourly fee of RI EC2 and RI RDS

"Hi, I have purchased two RI instances, one EC2, and one RDS. After my RI plans are activated. I created related on-demand EC2 and RDS with the same tier of my RI plans. But today, in the billing. It shows two addons hourly fees like the images below. What is it mean?FollowComment"

Answer: "0Have a look at the pricing - https://aws.amazon.com/ec2/pricing/reserved-instances/pricing/.What you see in your billing depends on the options you chose.  If it's no or partial upfront then there will be a monthly payment, or partial payment for a partial month. "For each month, the actual monthly payment will equal the actual number of hours in that month multiplied by the hourly usage rate ...".CommentShareEXPERTskinsmananswered 2 months agoskinsman EXPERT2 months agoBTW especially with RDS reservations it's easy to get it wrong as so many parameters have to match.  It's worth keeping an eye on the reservation usage report in Cost Explorer.Share"


Question: NLB for Instances in Private Subnet

"I am trying to place two instances in private subnets in two different AZs, and put NLB in public subnets and allow NLB to work for private instances. I notice NLB doesn't have SGs tied to them and my instances have an allow all SG on them. The health checks fail on the TGs and I cant seem to figure out why. Is there a trick to this? I also have NAT gateways in each Private subnet with EIPs attached to them.FollowComment"

Answer: "0My SGs on my instances are completely wide open. Do I even need NAT Gateways?CommentSharestevenjwilliams0728answered 7 months agoTushar_J EXPERT7 months agoYou would need NAT gateways only if you need connectivity to the internet from instances in private subnets.Share0Have you checked the NACLs also as mentioned here Also what TCP/UDP port your application is running on? Perhaps check if that application is running, for example if the target is a Linux instance run netstat -an | grep <Port number>CommentShareEXPERTTushar_Janswered 7 months ago0Hi - I think a similar discussions and pointers here may help you. https://repost.aws/questions/QUuueXAi20QuisbkOhinnbzQ/aws-nlb-security-groupCommentShareEXPERTAWS-User-Nitinanswered 7 months ago"


Question: Using Secrets Manager as a Password Vault

"Our Unix/Linux team uses an Open Source password vault to manage our root and other critical passwords.  We're interested in an AWS-based solution.  Requirements in no particular order:Accessible by our team only -- another team has the same general CommonSysAdmin role we do, but we don't want to expose our root password to them.Quickly available from the web given proper credentials and coming from a company laptop.No need for a password to get the password.  Assume we are already fully authenticated opening the Secrets Manager.Transparently encrypt the password using a private key already on the company laptop.Suggestions for additional requirements welcome!FollowCommentrePost-User-8334362 8 months agoAdditional thoughts.  The Secrets Manager generally assumes programmatic interfaces.  Our use case is more interactive -- or perhaps using an application or script to retrieve the password.Share"

Answer: "0You may want to look at Amazon Cognito - https://aws.amazon.com/cognito/Amazon Cognito User Pools is a feature that may meet your requirements - https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 8 months ago0You can definitely build something that meets your requirements using Secrets Manager as a back-end. Command-line and web interfaces are definitely possible. But there's no native complete service that AWS offers that will cover your needs all-in-one.If you don't have the appetite, skills or time to build a solution I'd suggest looking in the AWS Marketplace for solutions or look at other hosted third-party offerings.CommentShareEXPERTBrettski-AWSanswered 8 months ago"


Question: Accessing an event's attributes in Pinpoint template through front-end using Amplify JS

"I have an AWS Pinpoint application.On the web app front-end, I can trigger an event as follows:   await record('my.event', {     attributes: { color: 'red', size: 'large' },     immediate: true   })In Pinpoint, I can create a campaign with an email template to send an email to the user whenever my.event is triggered. I'm able to access the endpoint attributes such as {{User.UserAttributes.GivenName}} or {{Attributes.Preferences.Hats}}.However, I'm not able to access the event attributes (color, size) in the above example in the email template.Is there a way to do this?It seems like you can only filter the events to determine whether the campaign email should be sent (e.g., send only if color==='blue').I suppose that I could temporarily update the endpoint Attributes before triggering the event, but that is not preferred as it requires an additional call.FollowComment"


Question: "NLB creates with private IPs in 3 AZs, but 2 of them disappear during its lifetime"

"The following is the timeline of the events:Private NLB is created across 4 AZs, 3 of them populated with EC2 instances which are part of the NLB's target groups.Over time, the pool of instances shrinks down to occupy a single AZ.Sometime later, we notice that the NLB's DNS record now resolves to a single A record pointing to an IP within the same AZ as the one containing the EC2 instances. This seems unusual, because NLB's private IPs are supposed to remain static after the LBs creation as I've confirmed in this re:Post questionNew EC2 instances are brought up in other AZs and are added to the NLBs target groups. The LB does not adjust to this by adding new IPs in these AZs; it continues to resolve to a single A record.So my questions related to the timeline above are:Is the disappearance of previously attached IPs an expected part of the NLBs lifecycle? How does this square with the statement about NLB's private IPs being static?Should I expect this NLB to remediate and add in private IPs across newly occupied AZs?If all instances in the same AZ as the NLB's last remaining IP are taken down, will this NLB continue to sending traffic to the other instances if I keep cross-zone load balancing turned off?FollowComment"

Answer: "3Accepted AnswerI think you'll find that the IP addresses are still in the VPC and allocated to NLB. What you're seeing is NLB remove the IP addresses from the DNS responses because there are no healthy targets for those NLB nodes.Once new instances replace the unhealthy targets the DNS records will be updated. Note it may take some time for the health checks to pass.CommentShareEXPERTBrettski-AWSanswered 2 months agoEXPERTTushar_Jreviewed 2 months agoThaddeus_W EXPERT2 months agoDefinitely agree with Brett here, but I would add that this is the desired behavior because you have cross-zone load balancing turned off. You wouldn't want an NLB in an AZ without a healthy target to get traffic it can't route. If cross zone load balancing was desirable and enabled the IPs would not be removed from DNS as they would still have healthy targets in the one AZ. I would also call out that if there were no NLBs with healthy targets there is a fail safe back to responding to DNS with all the NLB IP addresses.I think the answers to question 2/3 are implied, but the NLB DNS entry will start responding with the IPs of the addtional AZs of NLB once health checks pass and for 3 assuming cross zone load balancing is disabled the NLBs will not route requests across zones, but DNS will only respond with the IPs of AZs NLB that have healthy targets, so you shouldn't end-up in this situation if you are using the provided DNS.Sharestanbsky-cb 2 months agoThank you, you're right. I managed to find the NLB associated IPs under EC2 -> Network Interfaces.Regarding the DNS record updates, I've had a healthy test instance from a different AZ attached to the NLB for over a week now. The NLB's DNS still reports that single A record as mentioned.ShareBrettski-AWS EXPERT2 months agoPlease raise a support case about that - it's important to find out why that is happening.Sharestanbsky-cb 2 months agoThank you Brettski, you've been very helpful. I'll follow your suggestion and raise this with support.Share"


Question: TCP Protocols In AWS IoT Core

"Hi AWS Team,Our IoT Device is based on TCP/ UDP Protocols. How can we get the data from IoT device to AWS from these protocols.Is there any way by which we can integrate IoT Device with AWS.ThanksYash MittalFollowComment"

Answer: "2Hi Yash,please take a look at the supported device communication protocols. You can find examples how to connect/interact with AWS IoT Core in our IoT Device SDKs.Cheers,PhilippCommentSharePhilipp Sanswered 2 months agoEXPERTAWS-User-Nitinreviewed 2 months ago"


Question: Create User to Use S3 API with Restricted Permissions

"I use AWS S3 API to upload files to some buckets, however, I need to create a new user that only has permission to upload to certain buckets and only through restricted IPs, other IPs should be blocked. Another permission I need is to delete objects, but only from an allowed IP.Regarding the download, anyone on the internet can access this file (if they have the link).The problem is that I think I found some articles that would help me with this issue, but they don't tell me exactly which menu within the AWS Console I should access to be able to perform these actions.For example, this link (https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-policy-language-overview.html) seems to talk about how to restrict the access to a bucket, but it doesn't tell me exactly which location/menu in the console I use to access this setting.TLDR: What is the path/menu in the Console to set Policies and Permissions in Amazon S3 on a bucket in S3?FollowComment"

Answer: "1Accepted AnswerAccess to S3 buckets and their objects is determined, with some simplification, by the S3 bucket policy and the IAM permissions assigned to the user accessing them.You can find the S3 bucket policy it in the permissions tab of your bucket; the deep link for editing the bucket policy is something like:https://s3.console.aws.amazon.com/s3/bucket/<your-bucket-name>/property/policy/edit?region=<your-region>For creating a user and assigning permissions, you should use IAM https://your-region.console.aws.amazon.com/iamv2/homeUsers have their own IAM policies and you should grant explicit access to those actions on the buckets you're referring to.CommentShareEXPERTTasioanswered a year ago"


Question: Cdk deploy in pipeline example?

"I’m looking for examples on how to deploy a CDK stack in a CI/CD pipeline.The pipeline (running in bitbucket) assumes a role via OIDC - and I’m having trouble getting this web-identity role to assume the CDK roles.Any examples you could share would be highly appreciated!FollowCommentkunyp a year agoHi Georg, could you include more information about the errors you're encountering assuming your IAM roles from your Bitbucket pipeline? Errors or Console output?Share"

Answer: "1If you want to deploy CDK stacks to the other account using assume-role, please refer to my repository - https://github.com/aws-samples/aws-cdk-deploy-pipeline-using-aws-codepipeline.Particularly, "createInstallCommands()" method in https://github.com/aws-samples/aws-cdk-project-template-for-devops/blob/main/lib/template/construct/pattern/pipeline-simple-pattern.ts will be useful to you.CommentShareAWS-Kwonyulanswered a year ago"


Question: Combining two accounts that once had consolidated billing

"A long time ago I had two active AWS accounts (A and B). I had consolidated billing so that B account paid for the useage of the A accountr. Then I stopped using the A account and move all operations over to B.Now I have started using A again but saw that the consolidated billing is no longer in operation. Instead we should make use of organisations. I created an organisation in B and invited A. However when I got to accept in A, it says that A is already part of an organisation. How do I remove A from the current organisation so that it can be a part of B's organisation?ThanksFollowComment"

Answer: "0I was told that I had to remove the account from the master org. This seemed unintuitive to me as I had always assumed that the account was the top level and orgs underneath them. By removing the account from the org I had assumed that I was somewhat shutting the account down.Anyway once I had done this I was able to move the account over to the org on the other account.Edited by: zeiddev on Sep 7, 2020 12:57 AMCommentSharezeiddevanswered 3 years ago"


Question: EC2 connection error in particular zones viz. Canada. Ireland and Mumbai

"Getting 'connection timed out' error on connecting ec2 instance by Putty, made in some particular aws zones viz. Canada, Ireland and Mumbai.Even though the same method works while connecting an ec2 made in n virginia or ohio.Edited by: absl on Mar 19, 2019 2:58 AMEdited by: absl on Mar 19, 2019 8:56 PMFollowComment"

Answer: "0I figured it out.Whenever using a previously ever unused key to make an instance, it shall be first kind of activated by running the following command from a mac or linux command line.Go to the path where the '.pem' file for the key is kept and runchmod 400 key_file.pemThen freely use this key and any '.ppk' file generated from it to connect from windows.CommentShareabslanswered 4 years ago"


Question: Insufficient capacity

I am getting insufficient capacity error on starting my instance.Also Why this issue keeps arising?Its plain 1 simple windows machine with 8 G ram. I am not doing anything to troublehsoot it technically. I am rebooting the instance and its not booting up.FollowComment

Answer: "2That error occurs when the AWS infrastructure has insufficient capacity for the resources of the instance type being used.If you encounter this error when starting an instance, you can temporarily work around the error by using one of the following methods.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/troubleshooting-launch.html#troubleshooting-launch-capacityWait a few minutes and then submit your request again; capacity can shift frequently.Submit a new request with a reduced number of instances. For example, if you're making a single request to launch 15 instances, try making 3 requests for 5 instances, or 15 requests for 1 instance instead.If you're launching an instance, submit a new request without specifying an Availability Zone.If you're launching an instance, submit a new request using a different instance type (which you can resize at a later stage). For more information, see Change the instance type.If you are launching instances into a cluster placement group, you can get an insufficient capacity error. For more information, see Working with placement groups.Other workarounds are possible by making on-demand reservations, but since you will be charged for the time you are not using the EC2, we recommend that you use the above method to solve this problem for testing EC2 and the like.https://repost.aws/knowledge-center/ec2-insufficient-capacity-errorsCommentShareEXPERTRiku_Kobayashianswered 6 days ago"


Question: Bring your own IP addresses (BYOIP) in Amazon EC2 and PTR registry

How can I create a PTR (Reverse DNS) for own public IP allocated in AWSFollowComment

Answer: "0Hello,I understand that you want to create a PTR record for Elastic IP allocated in AWS.Since Amazon owns the subnet your Elastic IP was assigned from, they need to create the PTR record for youConsiderations;a). Before you create a reverse DNS record, you must set a corresponding forward DNS record (record type A) that points to your Elastic IP address[1].b). If a reverse DNS record is associated with an Elastic IP address, the Elastic IP address is locked to your account and cannot be released from your account until the record is removed[2]To create  a reverse DNS record, see link, https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html#Using_Elastic_Addressing_Reverse_DNSReference:[1]. https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-creating.html[2]. https://us-east-1.console.aws.amazon.com/support/contacts?region=us-east-1#/rdns-limits.CommentSharerePost-User-9017359answered a year ago"


Question: Access denied when trying to GET objects uploaded to s3 bucket via aws sdk using cloudfront

"Using client-s3 sdk signed URLs, i was able to PUT and DELETE objects in my s3 bucket. But when trying to access those same objects using a GET request via cloudfront, s3 denies me access (Access Denied) to the objects. On the permissions section of the bucket, i set the bucket policy to allow GET requests from my cloudfront distribution. I know it works because when i upload objects via the s3 console, i can use cloudfront signed URLs to GET the objects from s3, that works. But once i programmatically use the client-s3 to upload the object, i am unable to GET it using my cloudfront distributionFollowCommentParnab EXPERTa year agoDuplicate Question to this https://repost.aws/questions/QUtHyfwozYTrq3_5QxXU7Afg/access-denied-when-trying-to-get-objects-uploaded-to-s-3-bucket-via-aws-sdk-using-cloudfrontShareJuanEn_G a year agocan you share your bucket policy and make sure that the OIA for cloudfront is configured? Another thing, is make sure about the configuration of the bucket and that you're not using WEB enabled bucket if using OIA, OIA only works with REST requests.Share"

Answer: "0Could it be the ACL for the objects in the bucket?  For example, was the--acl bucket-owner-full-controlCommentSharedduong-virtcloudanswered a year agoInfinityString a year agoACLs are disabled for my bucket. I am using bucket policies alone to access objects in the bucketShare"


Question: Fleet Provisioning -- Greengrass Core installation Issue

"Hi,I am running into issues with setting up a device using Fleet Provisioning -- I have all of the certification rotations happening as described in the docs, [1] & [2]I have followed these docs all the way through up to installing greengrass with a partial configuration file, the fleet-provisioning component, and as a system-service.I believe the next step is to communicate with AWS IoT core topics and return the appropriate certificates.  I wrote a small program that uses the same approach found in [3]. After using the fleet provisioning topics to grab the newly created "permanent" keys and place them in the correct /greengrass/v2 root folder.... is where my questions begin.Once I have these "permanent" keys -- How to I continue with instantiating the fully configured version of Greengass?These are the things I would expect but I haven't seen (I can't find any explicit documentation on where this happens):Where is the creation of the Greengrass Core device happening in AWS IoT (for me this is not occurring at any point, I have installed greengrass core and used the "permanent" certs to connect. How does this happen -- if I can get this stage to work then I think that I am set)What is the purpose of "https://d2s8p88vqu9w66.cloudfront.net/releases/aws-greengrass-FleetProvisioningByClaim/fleetprovisioningbyclaim-latest.jar" Component? I can't figure out what it is doing since the gathering of the "permanent" certs are occurring through my use of the IoT Topics described in [3]Where does the full configuration of /greengrass/v2/config/effectiveConfig.yaml happen? I am not seeing "aws.greengrass.Nucleus" service item in the effectiveConfig.yaml be configured in any way. ( I have already written a script to populate this config file with items from the "partial config" used in "fleet provisioning". But, I was thinking that this updating of the config file should happen in a more automated fashion. If I am wrong then I will keep my scripts that populate effectiveConfig.yaml values with the correct info[1] https://docs.aws.amazon.com/greengrass/v2/developerguide/fleet-provisioning-setup.html[2] https://docs.aws.amazon.com/greengrass/v2/developerguide/fleet-provisioning.html[3] https://github.com/aws/aws-iot-device-sdk-python-v2/blob/d28543090167d04ea6d4628821e578efb9cc6cff/samples/fleetprovisioning.pyFollowCommentargandas a year agoI am having the exact the same problem... I get an IoT thing registered but no the GGV2 Core Device, which I assume shall be created after the Fleet provision.How do I know provision went well? I have the thingCert.pem in "/greengrass/v2/" folder and the thing is created in IoT Core.I get these errors in "/greengrass/v2/logs/greengrass.log"2022-06-24T05:25:20.883Z [WARN] (pool-2-thread-11) com.aws.greengrass.deployment.IotJobsHelper: No connection available during subscribing to Iot Jobs descriptions topic. Will retry in sometime. {ThingName=rpiZero}2022-06-24T05:26:10.037Z [ERROR] (pool-2-thread-10) com.aws.greengrass.mqttclient.MqttClient: Error subscribing. {topic=$aws/things/rpiZero/shadow/name/AWSManagedGreengrassV2Deployment/update/accepted}2022-06-24T05:26:10.043Z [WARN] (pool-2-thread-10) com.aws.greengrass.deployment.ShadowDeploymentListener: Caught exception while subscribing to shadow topics, will retry shortly. {}Share"

Answer: "0POTENTIAL ANSWER TO #1 & #3:Next steps -- "manual provisioning" --> [1]use the already existing "GreengrassInstaller" installed when the device was initially "provisioned"-->provide a fully configured ~/GreengrassInstaller/config.yaml (using data pulled from the "partial-config" file that was used in "fleet-provisioning"):-->run the installer with necessary args. [2]-->restart greengrass ==> sudo systemctl restart greengrass.service[1] https://docs.aws.amazon.com/greengrass/v2/developerguide/manual-installation.html[2] https://docs.aws.amazon.com/greengrass/v2/developerguide/manual-installation.html#run-greengrass-core-v2-installer-manualPOTENTIAL ANSWER TO #2:  assists in the creation of aws iot resources when using the fleet-provisioning create-keys topics?Although I have attempted to reinitilize the Greengrass installation using an updated config.yaml file (this file includes the updated informatin for file paths to certs, data-endoint, credential-endpoint, etc) for greengrass to work correctly as a fully configured device --- BUT I am still not seeing a "greengrass core" device being created at any point.Should this have happened when the "thing" connected for the first using the "permanent" certificates produced from "fleet-provisioning"?Edited by: awiggins on Oct 26, 2021 6:21 PMCommentShareawigginsanswered 2 years ago0Welp.... it helps to save the credentials that you are receiving back from Fleet Provisioning Topics into their respective .pem & private key file to be used when Greengrass starts back up -->  smhI do hope someone finds this helpful...CommentShareawigginsanswered 2 years ago"


Question: Scaling: Amplify vs Elastic Beanstalk/CloudFormation

"I am learning about Elastic Beanstalk and CloudFormation after having a little bit of experience with Amplify.I have an Amplify website using Next.js, my use case doesn't require data storage yet and i've been able to handle any 'backendish' related needs using lambda+api gateway+s3.I know I dont have any EC2 instances and ASGs set up when running my Amplify site and that makes me doubt that it can handle the same load that true infrastructure or infrastructure as software can.I have never been able to get a good yes or no answer regarding if Amplify can handle huge traffic spikes. I've read and heard from support that you can increase your service limit quota for lambda to help in this area but that seems very static and arbitrary - not at all a dynamic system like ASGs.It feels like ESB/CloudFormation would probably better suited to handle spikey traffic? Can someone with more experience let me know if this is true?Thank you!FollowComment"

Answer: "2Accepted AnswerLambda can scale to handle traffic spikes much faster than EC2 autoscaling.The first time you invoke your function, AWS Lambda creates an instance of the function and runs its handler method to process the event. When the function returns a response, it stays active and waits to process additional events. If you invoke the function again while the first event is being processed, Lambda initializes another instance, and the function processes the two events concurrently. As more events come in, Lambda routes them to available instances and creates new instances as needed.The default regional concurrency quota starts at 1,000 instances. Let's say your function execution time is 10ms, this means you can handle 100,000 executions per second without requesting a quota increase.https://docs.aws.amazon.com/lambda/latest/dg/invocation-scaling.htmlCommentShareEXPERTHernitoanswered a year agooggie a year agoThank you!Share0Amplify will have no problem with huge traffic spikes, it is really just a wrapper around route 53, Cloudfront, and s3 so for static sites it is pretty much bomb proof.CommentSharechroweanswered a month ago"


Question: What is our cross-region DR solution with 0s RPO?

"Do we have a RDBMS solution in combination with other features/products/services that we can offer to our customer, guaranteeing Zero RPO across regions?FollowComment"

Answer: "3Accepted AnswerI don't know if we can "guarantee" a RPO=0, (think 11 9s but not 100%). However, you can layer different approaches together to get close. Starting with standard approaches in RDS such as multi AZ, and read replicas helps get us closer to RPO=0.  After this you can start thinking about the design of the entire workload. A good example is https://aws.amazon.com/blogs/publicsector/a-pragmatic-approach-to-rpo-zero/. You can even add more tools to your pipeline to add redundancy to capture data that is inflight such as SQS for example. You have to be careful, of course, not to over engineer the solution but that depends on the customer's requirements.CommentShareinvaderZYManswered 2 years agoEXPERTJohn_Freviewed a year ago1The speed of light is still a problem. In theory, you could have your system ensure that the replication has been completed before returning success (ACID compliance), but in practice, the performance across distance makes this an impractical solution. Both Amazon Aurora (PostgreSQL)  and Amazon S3 offer the ability to manage an RPO, but they are non-zero.CommentShareRodney Lesteranswered a year agoGovardhanan_R a year agoThanks Rodney!Share0Yes.. We have solution here. Please checkout.https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-multi-master.htmlWe refer to this type of availability as continuous availability, to distinguish it from the high availabilityCommentShareAWS-User-1545586answered 4 months ago"


Question: Tagging of Aurora Auto Scaling Replicas

"We are using AWS Aurora with automatic scaling of read replicas, which are launched with a generated name-tag with the prefix "application-autoscaling-" but no other tags. Is there a way we could overwrite the prefix and define additional tags (like the environment or application-id for which the cluster is used), as we can do for instances launched into EC2 auto-scaling groups?I can imagine doing this with some lambda function, but is there maybe an easier way? And if not, how are the costs for the autoscaled readers reported in the cost-replorer for example? Are they counted towards the readers I've created manually in the cluster?FollowComment"


Question: Issues on upgrading RDS instance from 9.5 to 9.6

"Hi,We have been trying to upgrade RDS (Postgres engine 9.5.18-R1) to 9.6.14. After selecting new engine version, and selecting Apply Immediately  we get this error :Current Option Group (default:postgres-9-5-db-styygdzxjcureomoiuv4tcj5ke-upgrade) is non-default. You need to explicitly specify a new Option Group in this case (default or custom) (Service: AmazonRDS; Status Code: 400; Error Code: InvalidParameterCombination; Request ID: 29161a46-3790-4d20-b584-aff897829562)We dont see any way to create a new postgres option group, neither we can modify the existing groups or change it to default/non-default. We believe that this group (default:postgres-9-5-db-styygdzxjcureomoiuv4tcj5ke-upgrade) was created automatically by RDS when we upgraded RDS to 9.5 from 9.3.Can you some one please help us here? Is there any wayout to attach a different option group to existing rds(postgres)?FollowComment"

Answer: "0Hi,Not sure if this will work, but have you tried upgrading using the CLI command aws rds modify-db-instance? Perhaps, if you set [--option-group-name <value>] set to "default:postgres-9-5-db-styygdzxjcureomoiuv4tcj5ke-upgrade"it might work?aws rds modify-db-instance helpmodify-db-instance^^^^^^^^^^^^^^^^^^Description***********Modifies settings for a DB instance. You can change one or moredatabase configuration parameters by specifying these parameters andthe new values in the request. To learn what modifications you canmake to your DB instance, call "DescribeValidDBInstanceModifications"before you call "ModifyDBInstance" .See also: AWS API DocumentationSee 'aws help' for descriptions of global parameters.Synopsis********     modify-db-instance   --db-instance-identifier <value>   [--allocated-storage <value>]   [--db-instance-class <value>]   [--db-subnet-group-name <value>]   [--db-security-groups <value>]   [--vpc-security-group-ids <value>]   [--apply-immediately | --no-apply-immediately]   [--master-user-password <value>]   [--db-parameter-group-name <value>]   [--backup-retention-period <value>]   [--preferred-backup-window <value>]   [--preferred-maintenance-window <value>]   [--multi-az | --no-multi-az]   [--engine-version <value>]   [--allow-major-version-upgrade | --no-allow-major-version-upgrade]   [--auto-minor-version-upgrade | --no-auto-minor-version-upgrade]   [--license-model <value>]   [--iops <value>]   [--option-group-name <value>]   [--new-db-instance-identifier <value>]   [--storage-type <value>]   [--tde-credential-arn <value>]   [--tde-credential-password <value>]   [--ca-certificate-identifier <value>]   [--domain <value>]   [--copy-tags-to-snapshot | --no-copy-tags-to-snapshot]   [--monitoring-interval <value>]   [--db-port-number <value>]   [--publicly-accessible | --no-publicly-accessible]   [--monitoring-role-arn <value>]   [--domain-iam-role-name <value>]   [--promotion-tier <value>]   [--enable-iam-database-authentication | --no-enable-iam-database-authentication]   [--enable-performance-insights | --no-enable-performance-insights]   [--performance-insights-kms-key-id <value>]   [--performance-insights-retention-period <value>]   [--cloudwatch-logs-export-configuration <value>]   [--processor-features <value>]   [--use-default-processor-features | --no-use-default-processor-features]   [--deletion-protection | --no-deletion-protection]   [--max-allocated-storage <value>]   [--cli-input-json <value>]   [--generate-cli-skeleton <value>]Hope this helps!-randyCommentShareRandyTakeshitaanswered 4 years ago0Thanks a lot Randy :) Your advice worked.aws rds modify-db-instance   --db-instance-identifier rds_identifer_name  --option-group-name "default:postgres-9-5" --profile abcdThis command should have changed the option group name, but UI shows that both options are attached, and was not allowing to upgrade even after that. After adding any useless security group, using Apply Immediately, it deleted the existing option group :)Now i can upgrade to 9.6.CommentSharemangaldevanswered 4 years ago"


Question: Level Layers?

How do we make and export level layers for sharing work between users?Follow

Answer: "0Accepted AnswerGood afternoon!I am a Technical Artist on the Lumberyard Support team and will be glad to help you with your inquiry!Lumberyard uses a system we call Slices. These slices are similar to prefabs in that they are chunks of stored entities/assets that act as one unit and can be saved, shared or stored as such. Essentially, you could build your level as a series of containers, one container is your top level, which could contain hundreds of additional slices. Inside of source control each one of those slices can be worked on individually by separate artists, designers, etc. There are two types of slices in Lumberyard, a normal static slice and a dynamic slice, which can be loaded at run-time, whereas, a normal slice cannot be instantiated at run-time. I have provided links to our documentation that should get you started using this system!Slices: https://docs.aws.amazon.com/lumberyard/latest/userguide/component-slices.htmlDynamic Slices: https://docs.aws.amazon.com/lumberyard/latest/developerguide/dynamic-slices.htmlHope this helps and happy creating!-MajorBlissSharerePost-User-4093265answered 5 years ago0Or has the workflow for sharing levels changed?SharerePost-User-8843326answered 5 years ago0Triple checking with the devs for 1.12 -- hang tight! :DSharerePost-User-5738838answered 5 years ago"


Question: AWS answer to Microsoft Open AI and Google's Deep Mind

"I saw article lately that Google was into DeepMind and Microsoft partnered with OpenAI.  What is the equivalent to AWS where we can solve similar GPT3  type of problems ? Can someone point that out or is this a question that i need to ask PG directly not here.  PS I am new to Amazon.FollowCommentrePost-SoniaA-8678285 10 months agoAs a followup, How about the rest of the Open AI stack for VIsion ( generative images) like DaLLe and Codex -  generative programs. and generative Summarization for text.- These are bnot categories under GPT ... all in all i would like to know if we are planning out a similar packaging/ Messaging hereShare"

Answer: "0Accepted AnswerGPT-J is also a generative pre-trained (GPT) language model. In terms of its architecture, it’s comparable to Open AI’s GPT-3. You can find how GPT-J run on AWS and how it is leveraged by a customer on this article - https://aws.amazon.com/blogs/machine-learning/how-mantium-achieves-low-latency-gpt-j-inference-with-deepspeed-on-amazon-sagemaker/.CommentShareEXPERTShamika-AWSanswered 10 months ago0You can build your own GPT solution on Amazon SageMaker. The benefits of that are:Better cost controlYour data doesn't leave your AWS accountYou can train and finetune the model to fit your needs.You can learn more on how to deploy a GPT in your AWS account in this blog post. And you can learn more on how to use a GPT model for many different NLP tasks in this blog post.CommentShareHeikoanswered 10 months ago"


Question: Certificate Requests Stuck In Pending Validation for days!

"Hi,i'm new so bare with mei tried to use AWS ACM with DNS verification!after made sure Route53 actually set correctly, i can see my website via http://mydomain.com ...but ACM never validated! i thought i did something wrong! so changed the DNS to park mode on Domain side w8 till made sure site check-host.net pointed to park mode then re did Route53and again w8ted till DNS propagated to AWS EC2then re submitted for ACM by DNS verificationand another day passed and still same as before it stuck in Pending validation!so what now should i gave up on AWS ACM and try other methods for setup SSL for my website!?FollowCommentOleksii Bebych 4 months agodid you buy your domain in Route53 or configured domain delegation from 3d party domain provider to Route53 ?ShareCarlosGP-AWS 4 months agoare your public domain NS records pointing to Route53?Have you created the CNAME record that gets generated by ACM under your domain?I suggest setting your TTL to a low number in order for other DNS resolvers to flush the old entries and try again. Usually the DNS verification should only take a few minutes.Share"

Answer: "0When you generate a public certificate in ACM with a DNS valication, ACM provides you with a CNAME key:value. You have to create a CNAME entry in the platform where you are managing your domain. If you bought you domain in the third party provider, you can create the CNAME there or configure a domain delegation to the Route53 and after that create the CNAME in Route53.The domain validaion in ACM usually takes several minutes.CommentShareOleksii Bebychanswered 4 months ago"


Question: The server was down twice for unknown reasons.

"2022/03/07 18:00:00 /2022/03/12 00:00:00In the lightsail console, it says that it is running, but in reality, the server is down and ssh connection is not possible.It's embarrassing that the server was down twice.I looked at the record just before the server down with the monitoring tool, and there was nothing wrong. Please check if there is anything wrong.FollowComment"

Answer: "0Hello @AWS-User-2211745,Thanks for using Lightsail.What is the size of your instance? Is your application consuming lots of resources (CPU, memory, network bandwidth, etc.)? If so, you might need a bigger instance. Here's a general explanation about instance capacity: Viewing instance burst capacity in Amazon Lightsail.RegardsCommentShareRafael-AT-AWSanswered a year agoW van Dam a year agoHi Rafael,About an hour ago the same happend with my WP instance, also for the 2nd time. I migrated to Lightsail only 3 weeks ago...The instance has 4 GB RAM, 2 vCPU. The WP site gets a couple of visitors per hour, so total overkill. Typical cpu usage is below 1%.Status is green, but 2 status checkers reported the website was unreachable from multiple geo locations. My browser says the website is unreachable. A manual reboot fixed the issue in both cases.Once is a fluke. Twice, in such a short timeframe, is starting to look like a pattern. What's going on?Share0Have you checked in Cloudwatch or Cloudtrail? You will likely see more detail there that you can correlate with the times your server was unavailable.CommentShareCameron Todanswered a year ago"


Question: How do I use config.LoadDefaultConfig() for a partiql query for dynamodb in go?

"func main () {ctx := context.TODO()cfg, err := config.LoadDefaultConfig(ctx,config.WithRegion("us-east-1"),config.WithSharedConfigProfile("profile_name"),)if err != nil {log.Fatal(err)}client := sts.NewFromConfig(cfg)identity, err := client.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})if err != nil {log.Fatal(err)}response, err := runner.DynamoDbClient.ExecuteStatement(context.TODO(), &dynamodb.ExecuteStatementInput{Statement: aws.String(fmt.Sprintf("SELECT * FROM \"%v\" WHERE ami_name=? AND environment=?",runner.item)),Parameters: params,})FollowComment"

Answer: "0In the AWS SDK for Go V2, you can configure common settings for service clients, such as the logger, log level, and retry configuration. Most settings are optional. However, for each service client, you must specify an AWS Region and your credentials. The SDK uses these values to send requests to the correct Region and sign requests with the correct credentials. You can specify these values as programmatically in code, or via the execution environment.[1]config.LoadDefaultConfig(context.TODO()) will construct an aws.Config using the AWS shared configuration sources. This includes configuring a credential provider, configuring the AWS Region, and loading service specific configuration. Service clients can be constructed using the loaded aws.Config, providing a consistent pattern for constructing clients.[1]Moving ahead,  ExecuteStatement API operation for Amazon DynamoDB.func (c *DynamoDB) ExecuteStatement(input *ExecuteStatementInput) (*ExecuteStatementOutput, error)This operation allows you to perform reads and singleton writes on data stored in DynamoDB, using PartiQL.For PartiQL reads (SELECT statement), if the total number of processed items exceeds the maximum dataset size limit of 1 MB, the read stops and results are returned to the user as a LastEvaluatedKey value to continue the read in a subsequent operation. If the filter criteria in WHERE clause does not match any data, the read will return an empty result set.[2]A single SELECT statement response can return up to the maximum number of items (if using the Limit parameter) or a maximum of 1 MB of data (and then apply any filtering to the results using WHERE clause). If LastEvaluatedKey is present in the response, you need to paginate the result set.[2]Returns awserr.Error for service API and SDK errors. Use runtime type assertions with awserr.Error's Code and Message methods to get detailed information about the error.[2]See the AWS API reference guide for Amazon DynamoDB's API operation ExecuteStatement for usage and error information.[3]—————————————————————————————————————References:[1] https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/[2] https://docs.aws.amazon.com/sdk-for-go/api/service/dynamodb/#DynamoDB.ExecuteStatement[3]https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.API.htmlCommentShareSUPPORT ENGINEERrePost-User-2584070answered 7 months ago"


Question: Using CDC data - Insert/Update/Delete

"Hello,I have Change Capture Data landing into a S3 bucket. The CDC data is from an AWS RDS. This is my starting point.Now, let's say, I have tables taba, tabb, tabc. I have the 3 folders for each table and all the CDC data is segregated per table in these folders. Now I must create another bucket, that will only hold the latest data.so in taba folder, if I had rows with 10 inserts , 10 updates and 3 deletes. How do I bring it to a state of finalization in the new bucket, meaning I should only have the latest data?FollowComment"

Answer: "1Did you look into DMS for migrating CDC data into AWS S3? In case your RDS source instance is in one of these: PostgresSQL, MySQL, Oracle or SQL Server, the native CDC of the database is supported and can handle ongoing replication between your RDS database and S3.Building your own logic would be tedious and would work differently for different databases. If you use is to really start from insert, update and delete data and it has a timestamp column in common that identifies the order of operations, you could use Glue to build out the logic using Python or Pyspark. Each database has a different CDC process and your Glue program would have to reflect the data available in those datasets.Reference about DMS CDC: https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Task.CDC.htmlCommentShareAnanth Tirumanuranswered 8 months agorePost-User-2429264 8 months agoThanks ananthtm. Let me explain better, that data that has arrived into S3 is from Kafka and the data in S3 looks like CDC data, with I,U and D flags. I want to now convert this data, CDC data, into regular data.So for example, the following is present in S3.I, 100, 'John',1000I,101,'Sam',2000U,100,'John',1500I want to convert this into,100,'John',1500101,'Sam',2000And I want the above in another bucketShare0As far as I know, this needs a custom solution.Let's acknowledge that Amazon S3 is not a database, hence what you are trying to achieve would be not possible with AWS DMS (or any/most of replication tool for that matter). Even if you use AWS S3 as Source with DMS, the eventual data on the target i.e. S3 will still have the DML operation types like I,U,D.I am not sure if the use case, but the core requirement is to NOT have the transactions listed as is and just store the volatile data, then you have to look at any database as target, instead of AWS S3 with AWS DMS.Or, you should look at any custom solution which could read the data from S3 and consolidate on another S3 bucket as per the requirement.CommentShareD-Raoanswered 8 months ago"


Question: "Cloudformation script fails with message SpotFleetRequestConfigData/LaunchSpecifications/0/IamInstanceProfile: expected type: JSONObject, found: String"

"I am trying to launch a spot fleet request via a clouldformation yaml. During this process, I keep getting an error "#/SpotFleetRequestConfigData/LaunchSpecifications/0/IamInstanceProfile: expected type: JSONObject, found: String"For some reason, I am unable to pass the role to the spot instance getting created. the script works fine without this particular line. the failiing line is the first one in LaunchSpecifications. i tried to pipe in the raw json too, but that gives the same error. My guess is this is just a bad error message. How do i resolve this? Is there a way to check if this is a permissions issue? Also, this config works with launching a plain old ec2 instance. Just fails in the case of a SpotFleet request.AWSTemplateFormatVersion: 2010-09-09Description: >-  AWS CloudFormation template for launching a spot ec2-instance Resources:  SpotInstance:    Type: "AWS::EC2::SpotFleet"    Properties:      SpotFleetRequestConfigData:        IamFleetRole: arn:aws:iam::773057xxxxxx:role/aws-ec2-spot-fleet-tagging-role        TargetCapacity: 1        LaunchSpecifications:        - IamInstanceProfile: arn:aws:iam::773057xxxxxx:instance-profile/EC2_Role_R53          KeyName: xxxxxxxxxxxxxx          NetworkInterfaces:            - AssociatePublicIpAddress: true              DeleteOnTermination: true              DeviceIndex: '0'              SubnetId: subnet-e18921ca              Groups:                - sg-cfa4c3ab                - sg-01d9bd3d67ed8a312          ImageId: ami-0574da719dca65348 #generic ubuntu ami 22.04          InstanceType: t2.mediumFollowComment"

Answer: 1Accepted AnswerWould it work if you modify it as follows?BeforeLaunchSpecifications:    - IamInstanceProfile: arn:aws:iam::773057xxxxxx:instance-profile/EC2_Role_R53AfterLaunchSpecifications:    - IamInstanceProfile:          Arn: arn:aws:iam::773057xxxxxx:instance-profile/EC2_Role_R53Check out the following document!https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-spotfleet-iaminstanceprofilespecification.htmlCommentShareimikyanswered 4 months agoEXPERTskinsmanreviewed 4 months agorePost-generalenthu 4 months agoThanks so much. This is what the script wanted!Share


Question: "EBS IOPS, Throughput and EBS bandwidth"

"we need to deploy ec2 with following EBS configuration-random 4k write : 2,00,000 IOPSsequential read-2000Mb/ssequential write-2000Mb/sthis is database server requirement.I have some confusion if I select io2 EBS type with 200000 provision IOPS let say for 24 hours and after that I have modified EBS type to GP3 do AWS charge me for full month or only for 24 hours? if AWS would accrued 24 hours charge what would be charges?what ec2 type I should go for any suggestions?Or am I making any mistake in selecting EBS type please guide me.FollowComment"

Answer: "0Provisioned storage and provisioned IOPS for io2 volumes will be billed in per-second increments, with a 60-second minimum.Example 3 of the EBS pricing documentation should help you understand the pricing calculation - https://aws.amazon.com/ebs/pricing/Maximum IOPS/volume for IO2 is 64000. You may need to look at IO2 Block Express which can support upto maximum of 256,000 IOPS/volume or as an alternate you can go for a RAID 0 array. Here are couple of links to documentationVolume Types and Comparison - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.htmlRAID Config - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/raid-config.htmlYou need to choose right EC2 instance to make use of the entire IOPS supported by the EBS volumes. EC2 instances that support each of the EBS volume types are documented on this page - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html#io2-block-expressAs an alternate you can refer to the below documentation to find the maximum IOPS supported by each of the ec2 instance types -https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-optimized.htmlCommentShareRajesh Sanswered a year ago"


Question: CRITICAL WARNINGS from the AWS SHELL static partition

"Hi,We are seeing some critical warnings from the AWS SHELL region. So far I can see, we are not doing anything to cause them. Can you check and advise whether these are expected in general or something we are doing that is causing them. Also, how to fix them.CRITICAL WARNING: \[Board 49-67] The board_part definition was not found for xilinx.com:f1_cl:part0:1.0. This can happen sometimes when you use custom board part. You can resolve this issue by setting 'board.repoPaths' parameter, pointing to the location of custom board files. Valid board_part values can be retrieved with the 'get_board_parts' Tcl command.CRITICAL WARNING: \[Shape Builder 18-539] Setting IOB or IOB_TRI_REG property to TRUE for instance WRAPPER_INST/SH/SH/AXI_QUAD_SPI/U0/NO_DUAL_QUAD_MODE.QSPI_NORMAL/IO0_I_REG conflicts with its current constrained placement (SLICE_X149Y278). The conflicting constraint will be removed.CRITICAL WARNING: \[Shape Builder 18-539] Setting IOB or IOB_TRI_REG property to TRUE for instance WRAPPER_INST/SH/SH/AXI_QUAD_SPI/U0/NO_DUAL_QUAD_MODE.QSPI_NORMAL/IO1_I_REG conflicts with its current constrained placement (SLICE_X149Y278). The conflicting constraint will be removed.CRITICAL WARNING: \[Shape Builder 18-539] Setting IOB or IOB_TRI_REG property to TRUE for instance WRAPPER_INST/SH/SH/AXI_QUAD_SPI/U0/NO_DUAL_QUAD_MODE.QSPI_NORMAL/IO2_I_REG conflicts with its current constrained placement (SLICE_X151Y293). The conflicting constraint will be removed.CRITICAL WARNING: \[Shape Builder 18-539] Setting IOB or IOB_TRI_REG property to TRUE for instance WRAPPER_INST/SH/SH/AXI_QUAD_SPI/U0/NO_DUAL_QUAD_MODE.QSPI_NORMAL/IO3_I_REG conflicts with its current constrained placement (SLICE_X162Y294). The conflicting constraint will be removed.CRITICAL WARNING: \[Place 30-73] Invalid constraint on register 'WRAPPER_INST/SH/SH/AXI_QUAD_SPI/U0/NO_DUAL_QUAD_MODE.QSPI_NORMAL/IO0_I_REG'. It has the property IOB=TRUE, but it is not driving or driven by any IO element.CRITICAL WARNING: \[Place 30-73]\ Invalid constraint on register 'WRAPPER_INST/SH/SH/AXI_QUAD_SPI/U0/NO_DUAL_QUAD_MODE.QSPI_NORMAL/IO1_I_REG'. It has the property IOB=TRUE, but it is not driving or driven by any IO element.CRITICAL WARNING: \[Place 30-73] Invalid constraint on register 'WRAPPER_INST/SH/SH/AXI_QUAD_SPI/U0/NO_DUAL_QUAD_MODE.QSPI_NORMAL/IO2_I_REG'. It has the property IOB=TRUE, but it is not driving or driven by any IO element.CRITICAL WARNING: \[Place 30-73] Invalid constraint on register 'WRAPPER_INST/SH/SH/AXI_QUAD_SPI/U0/NO_DUAL_QUAD_MODE.QSPI_NORMAL/IO3_I_REG'. It has the property IOB=TRUE, but it is not driving or driven by any IO element.CRITICAL WARNING: \[Place 30-73] Invalid constraint on register 'WRAPPER_INST/SH/SH/AXI_QUAD_SPI/U0/NO_DUAL_QUAD_MODE.QSPI_NORMAL/QSPI_LEGACY_MD_GEN.QSPI_CORE_INTERFACE_I/LOGIC_FOR_MD_12_GEN.SPI_MODE_CONTROL_LOGIC_I/RATIO_NOT_EQUAL_4_GENERATE.SCK_O_NQ_4_NO_STARTUP_USED.SCK_O_NE_4_FDRE_INST'. It has the property IOB=TRUE, but it is not driving or driven by any IO element.CRITICAL WARNING: \[Shape Builder 18-539] Setting IOB or IOB_TRI_REG property to TRUE for instance WRAPPER_INST/SH/SH/AXI_QUAD_SPI/U0/NO_DUAL_QUAD_MODE.QSPI_NORMAL/QSPI_LEGACY_MD_GEN.QSPI_CORE_INTERFACE_I/LOGIC_FOR_MD_12_GEN.SPI_MODE_CONTROL_LOGIC_I/RATIO_NOT_EQUAL_4_GENERATE.SCK_O_NQ_4_NO_STARTUP_USED.SCK_O_NE_4_FDRE_INST conflicts with its current constrained placement (SLICE_X160Y216). The conflicting constraint will be removed.CRITICAL WARNING: \[Shape Builder 18-850] Failed to place register with ASYNC_REG property shape that starts with register WRAPPER_INST/SH/SH/MGT_TOP/SH_ILA_0/inst/ila_core_inst/u_ila_cap_ctrl/u_cap_addrgen/i_intcap.icap_addr_reg[1]. This is likely caused by merging with other shapes due to some register in the chain may belong to other shapes. Reason: Routing contention at pips pin element OUTMUXACRITICAL WARNING: \[Shape Builder 18-850] Failed to place register with ASYNC_REG property shape that starts with register WRAPPER_INST/SH/SH/MGT_TOP/SH_ILA_0/inst/ila_core_inst/u_ila_cap_ctrl/u_cap_addrgen/i_intcap.icap_addr_reg[4]. This is likely caused by merging with other shapes due to some register in the chain may belong to other shapes. Reason: Routing contention at pips pin element OUTMUXACRITICAL WARNING: \[Shape Builder 18-850] Failed to place register with ASYNC_REG property shape that starts with register WRAPPER_INST/SH/SH/MGT_TOP/SH_ILA_0/inst/ila_core_inst/u_ila_cap_ctrl/u_cap_addrgen/i_intcap.icap_addr_reg[1]. This is likely caused by merging with other shapes due to some register in the chain may belong to other shapes. Reason: Routing contention at pips pin element OUTMUXACRITICAL WARNING: \[Shape Builder 18-850] Failed to place register with ASYNC_REG property shape that starts with register WRAPPER_INST/SH/SH/MGT_TOP/SH_ILA_0/inst/ila_core_inst/u_ila_cap_ctrl/u_cap_addrgen/i_intcap.icap_addr_reg[4]. This is likely caused by merging with other shapes due to some register in the chain may belong to other shapes. Reason: Routing contention at pips pin element OUTMUXACRITICAL WARNING: \[Shape Builder 18-850] Failed to place register with ASYNC_REG property shape that starts with register WRAPPER_INST/SH/SH/MGT_TOP/SH_ILA_0/inst/ila_core_inst/u_trig/U_TM/N_DDR_MODE.G_NMU[4].U_M/allx_typeA_match_detection.ltlib_v1_0_0_allx_typeA_inst/DUT/I_WHOLE_SLICE.G_SLICE_IDX[7].U_ALL_SRL_SLICE/I_IS_TERMINATION_SLICE_W_OUTPUT_REG.DOUT_O_reg. This is likely caused by merging with other shapes due to some register in the chain may belong to other shapes. Reason: Routing contention at pips pin element OUTMUXACRITICAL WARNING: \[Shape Builder 18-850] Failed to place register with ASYNC_REG property shape that starts with register WRAPPER_INST/SH/SH/MGT_TOP/SH_ILA_0/inst/ila_core_inst/u_trig/U_TM/N_DDR_MODE.G_NMU[4].U_M/allx_typeA_match_detection.ltlib_v1_0_0_allx_typeA_inst/DUT/I_WHOLE_SLICE.G_SLICE_IDX[7].U_ALL_SRL_SLICE/I_IS_TERMINATION_SLICE_W_OUTPUT_REG.DOUT_O_reg. This is likely caused by merging with other shapes due to some register in the chain may belong to other shapes. Reason: Routing contention at pips pin element OUTMUXACRITICAL WARNING: \[Shape Builder 18-539] Setting IOB or IOB_TRI_REG property to TRUE for instance WRAPPER_INST/SH/SH/AXI_QUAD_SPI/U0/NO_DUAL_QUAD_MODE.QSPI_NORMAL/QSPI_LEGACY_MD_GEN.QSPI_CORE_INTERFACE_I/LOGIC_FOR_MD_12_GEN.SPI_MODE_CONTROL_LOGIC_I/RATIO_NOT_EQUAL_4_GENERATE.SCK_O_NQ_4_NO_STARTUP_USED.SCK_O_NE_4_FDRE_INST conflicts with its current constrained placement (SLICE_X160Y216). The conflicting constraint will be removed.CRITICAL WARNING: \[Shape Builder 18-539] Setting IOB or IOB_TRI_REG property to TRUE for instance WRAPPER_INST/SH/SH/AXI_QUAD_SPI/U0/NO_DUAL_QUAD_MODE.QSPI_NORMAL/IO0_I_REG conflicts with its current constrained placement (SLICE_X149Y278). The conflicting constraint will be removed.CRITICAL WARNING: \[Shape Builder 18-539] Setting IOB or IOB_TRI_REG property to TRUE for instance WRAPPER_INST/SH/SH/AXI_QUAD_SPI/U0/NO_DUAL_QUAD_MODE.QSPI_NORMAL/IO1_I_REG conflicts with its current constrained placement (SLICE_X149Y278). The conflicting constraint will be removed.CRITICAL WARNING: \[Shape Builder 18-539] Setting IOB or IOB_TRI_REG property to TRUE for instance WRAPPER_INST/SH/SH/AXI_QUAD_SPI/U0/NO_DUAL_QUAD_MODE.QSPI_NORMAL/IO2_I_REG conflicts with its current constrained placement (SLICE_X151Y293). The conflicting constraint will be removed.CRITICAL WARNING: \[Shape Builder 18-539] Setting IOB or IOB_TRI_REG property to TRUE for instance WRAPPER_INST/SH/SH/AXI_QUAD_SPI/U0/NO_DUAL_QUAD_MODE.QSPI_NORMAL/IO3_I_REG conflicts with its current constrained placement (SLICE_X162Y294). The conflicting constraint will be removed.Edited by: fpgamagic on Jan 18, 2019 11:47 AMEdited by: fpgamagic on Jan 18, 2019 11:48 AMEdited by: fpgamagic on Jan 18, 2019 11:51 AMFollowComment"

Answer: "0Hi fpgamagic,It is safe to waive the CRITICAL WARNINGS from the SHELL region that you have mentioned in the post.There have beed couple of similar posts related to CRITICAL WARNINGS. You can check them herehttps://forums.aws.amazon.com/thread.jspa?messageID=828801&#828801https://forums.aws.amazon.com/thread.jspa?messageID=867232&#867232Let us know if you face some issues.Thanks,Sunil.CommentShareawssunilanswered 4 years ago"


Question: c6a instance types for Batch compute environments

"Hi, I don't seem to be able to select the new c6a EC2 instance types for AWS Batch compute environments from the console (Ireland region). I haven't tested using the API. The instance type is available to launch as a separate EC2 instance. My workload is largely single threaded so I would prefer the fastest possible single vCPU performance.I'm guessing this is just not configured properly yet, but I'm only on basic support so can't raise a technical support ticket about that. Or can anyone advise if it's a regional or technical limitation instead?FollowComment"

Answer: 0m6a is available for AWS Batch and may be your best option for now. We have a feature request which may allow selection of additional instance types (such as c6a) sooner after they're available in ec2. We don't yet have a timeline when that feature may be released. You can follow What's New for AWS Batch or subscribe to the RSS feed there for this and other announcements in the future.CommentSharePHanswered a year ago


Question: Glue Service error - Denied Access

"When I click button "Create Crawler" in AWS Glue service, I failed. But I set up generated IAM Role with permission policy "AdministratorAccess" for this subcribe account. Please help me solve this issue. Thank you so much.my error: Account xxxxxxxxxxxx denied accessFollowComment"

Answer: "0Verify that your AWS account has sufficient permissions to use the AWS Glue service. Specifically, ensure that the IAM user or role you're using to access AWS Glue has the "glue:*" permissions or specific permissions for the actions you want to perform.CommentSharekishanpokaranswered 2 months ago"


Question: Proper Administrator Procedure in IAM Identity Center?

"Hi, I'm an AWS administrator trying to transfer from the old IAM user approach to the new IAM Identity Center approach.In the past, user Bob was attached to user group 'Developers' and then I gave Developers access to 'S3FullAccess'In the new system, user Bob is attached to group 'Developers' to an account 'Developers' and then attach a permissions set with 'S3FullAccess' to that account.My question is, why is there this abstraction to accounts and why do they need their own email? Am I expected to make a new email per group of users in AWS? This just seems like a redundancy.My exact business case is that I'm trying to create a group of admins (from which there's already the management account we've been using) and then a group of developers (which have a different current UserGroup (without a separate email)) with least-privileged access to a few services for an application we're building, and then also a group for our web developers that maintain our website through AWS. I'd rather corral them in AWS internally without external email accounts as the old IAM currently does, and I don't understand the usefulness of abstracting them to accounts. Am I missing something? Is there another way to do this, or is there usefulness I'm not seeing?To accomplish my current function with IAM Identity Center I need to have a management account (the first user), an application development account (account A), and a website development account (account B) correct?FollowComment"

Answer: "0Hello there,Allow me address these questions individually."Why is there this abstraction to accounts and why do they need their own email?"IAM Identity Center and IAM differ in how user management is configured. For IAM, you are able to create a user and assign them to a group and give the group permissions. For IAM Identity Center, users are created using a username and email [1]. IAM Identity Center utilizes (Secuiruty Assertion Markup Language) SAML [2] to authenticate into an application. Most SAML based applications, use email as an attribute for federation. When you create users in IAM Identity Center, each user should have their own username and email."Am I expected to make a new email per group of users in AWS?"No, an email does not need to be associated with a group, only a user. With IAM Identity Center you are able to manage access to AWS account through provisioning permission sets to a user or group [3]. Permission Sets allow you to manage policies and permission through user/groups within multiple accounts in your organization. Permission sets include AWS IAM managed policies, and you can also be custom made[4].Taking your use case into account, you create a number of users each with their own usernames and emails. Then, you create a group in IAM Identity Center that gives admin permissions. You can then create another user and assign them a permission set directly which offers Developers or Web developers permissions. Alternatively, you assign the create user to a group which has the Developers or Web developers permission set attached to group. For more information, see below.Account assignments for AWS IAM Identity Center are a combination of the AWS account, permission set, and assigned users/groups. Therefore, in order to attach a permission set to an account, you will need to select the users/groups that will be able to access that account via the permission set. To view or modify user/group and permission set combinations follow these steps:Navigate to the AWS accounts page in the AWS Identity Center consoleClick on an account name you wish provision permission sets in.Under the "users and groups" tab, you can see all identities and the permission sets they have access to.Choose can add users or groups from this page using the buttons on the right side.Select permission sets and new users or groups.Save changes to provision permission sets.Repeat steps 1-6 to add additional permission sets for a user or group in an account (or by selecting the user or group in an account and modifying the permission set associations).For more information on this process, see reference [5]."To accomplish my current function with IAM Identity Center I need to have a management account (the first user), an application development account (account A), and a website development account (account B) correct?"Not quite, that is one way you can achieve your goal. If you have multiple accounts set up and attached to an organization, you can create permission sets and assign them to accounts and give your users access to those accounts [6]. Another way you can achieve you use case is by having a group called Admins which have the AdministatorAccess permission set. A group called developers which has a custom permission set which allows S3FullAccess. Then finally a group called Web Developers which has a custom permission set including the needed IAM policies. From there you can add your Identity Center users into those groups or assign permission sets to them individually. Please note that this all can be done within one account. For more information I have provided links below.Feel free to reach back out if you need additional clarification.[1] Emails in Identity Center: https://docs.aws.amazon.com/singlesignon/latest/userguide/users-groups-provisioning.html#username-email-unique[2] SAML Federation: https://docs.aws.amazon.com/singlesignon/latest/userguide/samlfederationconcept.html[3] Permission Sets: https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html[4] Custom Permissions: https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetcustom.html[5] Single sign-on access: https://docs.aws.amazon.com/singlesignon/latest/userguide/useraccess.html[6] Multi-account permissions: https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-accounts.htmlCommentShareLanden_Panswered 3 months ago"


Question: how to config athena spark by use dynamic partition mode when overwrite

I want to save parquet file to s3 by partition mode default is not dynamic and the old data will be erased .How can I config athena spark session setting to dynamic mode?FollowComment

Answer: "0Hello,This could have been addressed by setting "spark.sql.sources.partitionOverwriteMode" to "dynamic".But as of today, Athena Spark does not allow to make any changes to the spark config.CommentShareSachin_Kanswered 2 months ago"


Question: Data wrangler exporting data in parts

I am using AWS Sagemaker data wrangler to transform my data. When data is completely transformed  and exported the data to amazon s3 the data exported is in parts not a complete single file how to solve this issue.FollowComment

Answer: "0Hey Pavan!So in a Data Wrangler flow when you set S3 as a destination node, there is an optional parameter called "Number of Partitions" this setting dictates how many separate files your output will be stored as. You can try to set this to "1" and see if that solves your issue.  The screenshot below shows where you can find this parameter:CommentSharemtahsinanswered 2 days ago"


Question: NEW Amazon Linux AMI - IMDSv2 as default

"Hello Team,In New Amazon Linux AMI AMI ID ami-02f3f602d23f1659d (al2023-ami-2023.0.20230315.0-kernel-6.1-x86_64), which they launched on 15th March,2023 the Instance Metadata Service comes with version 2 by default where HttpTokens is mandatory.Direct curl http://169.254.169.254/latest/meta-data/instance-id command won’t work here.For IMDSv2, we have fetch the data through token authentication right.For referencehttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.htmlMy question isFor the  new AMI, I am seeing that by default it comes up with the Instance Metadata Service version as 2. Could you please confirm me that hereafter the NEW AMI released from Amazon will it be having the IMDS version with default version as 2?FollowComment"

Answer: 0HelloBy default Amazon Linux 2023 uses IMDS-v2. However you can override this setting during launch or modify it later after the instance is launched as described here.Hope this helps.CommentShareSUPPORT ENGINEERVinay_Sanswered 2 months ago


Question: Blend shapes broken in EMotion?  Using FBX from Maya

"Has anyone had any luck getting blend shape animation (v 1.11) to play in the new EMotion Animation Editor? I've exported my character out of Maya 2016 (in T-pose) as an FBX. Attached is a screenshot showing which options I've checked in the FBX exporter.REMOVEDUPLOADfbx-export-screencap2.jpgI've made sure to select the character mesh and the joint hierarchy before exporting.When exporting animations from separate scenes, keyframes are baked onto joints before export, and the Euler filter is applied. Only the joint hierarchy is selected when exporting animation FBX.Inside EMotion joint animation will play, but no blend shape animation. Not sure if this is a Lumberyard bug, or a user error in Maya.Note: I'm still using the same skeleton setup needed for Gepetto (jx_c_root and blendWeightVertex joints)@REDACTEDUSERFollow"

Answer: "0Hi @REDACTEDUSERSharerePost-User-0479726answered 6 years ago0As mentioned the morph target (blend shapes) support is not fully in yet. EMotion FX itself does support it already, but we have to integrate this into the FBX pipeline, so that we actually feed it the morph target geometry and animation data. This is why you might find see that there is Morph Target support inside EMotion FX's interfaces already, but it isn't working yet. This will come very soon though! :)SharerePost-User-8134033answered 6 years ago0Thank you very much. Can't wait to test it out once releasedSharerePost-User-6186531answered 6 years ago"


Question: Route tables for Using Amazon Managed Prometheus with interface VPC endpoints

"Hi guys,My team is looking to setup EKS cluster in private subnet in VPC in US-east-2 region while we need to setup monitoring that EKS Cluster, I used to Amazon Managed Prometheus (AMP) and Amazon Managed Grafana. We have considered two approaches:Option 1: Setup a private subnet in VPC through NAT gateway. This solution is work well.Option 2:  I follow guide https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-and-interface-VPC.html but not working. Interface VPC Endpoint to Amazon Managed Prometheus (AMP). I think I have to config routes table follow picture bellow but I don't see Destination of AMP. Can somebody help me please? ThanksFollowComment"

Answer: "0Interface endpoints for AWS services do not show up as a destination in a route table. Instead, they appear as network interfaces in your VPC. In this case, your VPC has a 10.194.0.0/16 address; the endpoints will have IP addresses in that range.To use the endpoints you must use the appropriate DNS name for the endpoint. This is mentioned in the documentation page you link to above: You need to set up your application to use that name which will be com.amazonaws.region.aps-workspaces or com.amazonaws.region.aps depending on what you're trying to do. The DNS names will resolve to the 10.194.x.x address in your VPC and from there it will work as expected.CommentShareEXPERTBrettski-AWSanswered 10 months agocmctssg-lqvan 10 months agoinvalid Destination. Please see picture below my answer.Share0Hi @Brettski@AWS,I try it but invalid DestinationPlease suggest me Another solution.CommentSharecmctssg-lqvananswered 10 months agoBrettski-AWS EXPERT10 months agoNo, you cannot route to an Interface Endpoint. In your application, put the private DNS name of the endpoint as it is displayed in the console (where you created the endpoint). For example, if you're using Python and boto3 you must specify the endpoint_url as per the documentation.Share"


Question: AWS Free Tier limit alert

how do i delete?AmazonEC21.0 GB-mo for free for 12 months as part of AWS Free Usage Tier (Global-EBS:SnapshotUsage)FollowComment

Answer: "0I have deleted it, you can close it.CommentShareImrananswered 13 days ago"


Question: Error creating Lambda function: Request must be smaller than 69905067 bytes for the CreateFunction operation

"Hello everyone,Trying to launch this https://www.syncfusion.com/kb/13523/how-to-convert-html-to-pdf-in-aws-lambda but get the following errorError creating Lambda function: Request must be smaller than 69905067 bytes for the CreateFunction operationI was able to upload the zip file to an s3 bucket but can not figure out how to create the lambda from thereI am a newbie to .net/aws so take it easy on me pleaseFollowComment"

Answer: "0Accepted AnswerHi, yes there is a 50MB quota (probably approximate) on directly-uploaded zipfile Lambdas.  Behind the scenes this is a result of the Request limit you've seen of 69905067 bytes; by the time AWS API overhead like base64 encoding is taken into account you're left with about 50MB.  Uploading to S3 gets around this, then the only limit is it must be <250MB unzipped.  This is explored in depth at https://adieuadieu.medium.com/exploring-the-aws-lambda-deployment-limits-9a8384b0bec3 if you're interested.  Also note a container Lambda can be used instead which can be up to 10GB.Now you have your Lambda zip file in S3 you can create a Lambda function from the AWS Lambda console.  There you'll be given the option to upload from a zip file or an S3 location.CommentShareEXPERTskinsmananswered 4 months ago"


Question: AWS SSO IDp For OpenSearch

"We are using AWS SSO with Google Workspace to log into AWS.We also have OpenSerch in use. We want to use AWS SSO as an IDP for OpenSearch however we get the following errorOops, something went wrongProvide your administrator with the following info:No accessRequest ID: xxxxHTTP status: 403The 403 call is when a GET is made on https://portal.sso.eu-west-1.amazonaws.com/saml/v2/assertion/xxxxxredactedxxxxx/ HTTP/1.1FollowCommentrePost-User-3884245 5 months agoI was struggling with this problem until i saw a subtle mistake.Hope this could help : in the IAM Identity Center, settings of the application, i was using "dot" instead of "double point" for attribute mappings. Lost so many hours because of my eyes.Share"

Answer: "0HelloNot sure if you ve referred the below links for the same.AWS SSO with G-suite as an External IDP: https://aws.amazon.com/blogs/security/how-to-use-g-suite-as-external-identity-provider-aws-sso/SAML with AWS Open-search: https://docs.aws.amazon.com/opensearch-service/latest/developerguide/saml.htmlThese provide the basic steps for configuration & the right approach. However for a detailed check, I would advise to open up a support case with the AWS SSO/AWS Opensearch team and get it checked, once verified the steps in the above links.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months agoEXPERTFabrizio@AWSreviewed 10 months ago"


Question: Person Tracking AWS Rekognition Video (Flickering Bounding Boxes)

"Hi everyone, I am working with AWS Rekognition for video analysis of person tracking. I have successfully gathered all the bounding box data as well as the facial landmarks data per frame. So what I have done is grab the frame at a given timestamp and apply the bounding boxes and landmarks to the frame. However, when stitching the video back together I noticed the bounding boxes and facial landmarks flicker between frames. I am pretty sure this is due to the fact that not every frame in the video has data populated for bounding boxes and facial landmarks. Is there any solution to make the bounding boxes and landmarks not flicker when stitching the video back together. Any assistance is greatly appreciated.Thanks in advance. I have attached a video of the current issues I am encountering for explanation's sake.Edited by: brussell152 on Nov 13, 2019 10:29 AMEdited by: brussell152 on Nov 13, 2019 10:39 AMFollowComment"

Answer: "0Hi,Yes, detections are generally not output for every frame, so if you are rendering boxes on top of frames, you will need to add some persistence logic. The simplest approach is to render all the boxes for a given output timestamp at once, and leave them drawn until the next timestamp, and then do a full redraw. Another approach is to interpolate (tween) between boxes for upcomming timestamps. You can use the person ID field for this.The Rekognition video console demonstrates examples of these approaches.Hope this helps,JonathanCommentShareAWS-User-5278841answered 4 years ago"


Question: Transfer data to AWS S3

We have 15TB data in on-premises server. We want to backed up the data from on-premises to AWS S3.Can anyone tell me the steps?Thanks in Advance.FollowComment

Answer: "1Hi there!There are several AWS services that can be used as part of your backup and recovery approach.Firstly, consider designing a backup and recovery solution (if you haven’t already) in order to make an informed decision based on your business needs and follow best practices by testing your backup and recovery approach in a non-production environment. It is important to test your processes thoroughly and to validate that your restored workloads are operating as expected.For guidance, please take a look here:https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/design.htmland here:https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/on-premises-to-aws.html.I would also recommend spending a few minutes to read through the chapters of this guide:  https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/welcome.htmlIf you are ready to back up data on Amazon S3 please take a look at the following link on how to create Amazon S3 Backups: https://docs.aws.amazon.com/aws-backup/latest/devguide/s3-backups.htmlHope this helps!CommentShareMarasiliaanswered 5 months ago"