Question: `RequestTimeout`s for S3 put requests from a Lambda in a VPC for larger payloads

"UpdateI added a VPC gateway endpoint for S3 in the same region (US East 1). I selected the route table for it that the lambda uses. But still, the bug persists. Below I've included details regarding my network configuration. The lambda is located in the "api" subnet.Network Configuration1 VPC4 subnets:publicIPv4 CIDR: 10.0.0.0/24route table: publicNetwork ACL: publicprivateIPv4 CIDR: 10.0.1.0/24route table: privateNetwork ACL: privateapiIPv4 CIDR: 10.0.4.0/24route table: apiNetwork ACL: apiprivate2-requiredIPv4 CIDR: 10.0.2.0/24route table: publicNetwork ACL: -3 route tables:publicDestination: 10.0.0.0/16     Target: localDestination: 0.0.0.0/0     Target: igw-xxxxxxxDestination: ::/0      Target: igw-xxxxxxxxprivateDestination: 10.0.0.0/16      Target: localapiDestination: 10.0.0.0/16     Target: localDestination: 0.0.0.0/0     Target: nat-xxxxxxxxDestination: pl-xxxxxxxx      Target: vpce-xxxxxxxx(VPC S3 endpoint)4 network ACLspublicinbound rules:All traffic (allow)outbound rules:All traffic (allow)privateinbound rules:100: PostgreSQL TCP 5432 10.0.0.48/32 (allow)101: PostgreSQL TCP 5432 10.0.4.0/24 (allow)outbound rules:100: Custom TCP TCP 32768-65535 10.0.0.48/32 (allow)101: Custom TCP TCP 1024-65535 10.0.4.0/24 (allow)apiinbound rules:All traffic (allow)outbound rules:All traffic (allow)-inbound rules:All traffic (allow)outbound rules:All traffic (allow)UpdateI increased the timeout of the lambda to 5 minutes, and the timeout of the PUT request to the S3 bucket to 5 minutes as well. Before this the request itself would timeout, but now I'm actually getting a response back from S3. It is a 400 Bad Request response. The error code is RequestTimeout. And the message in the payload of the response is "Your socket connection to the server was not read from or written to within the timeout period."This exact same code works 100% of the time for a small payload (on the order of 1KB), but apparently for payloads on the order of 1MB it starts breaking. There is no logic in my code that does anything differently based on the size of the payload. I've read similar issues that suggest the issue is with the wrong number of bytes being provided in the "content-length" header, but I've never provided a value for that header. Furthermore, the lambda works flawlessly when executed in my local environment. The problem definitely appears to be a networking one. At first glance it might seem like this is just an issue with the lambda being able to interact with services outside of the VPC, but that's not the case because the lambda does work exactly as expected for smaller file sizes (<1KB). So it's not that it flat out can't communicate with S3.Scratching my head here...OriginalI use S3 to host images for an application. In my local testing environment the images upload at an acceptable speed. However, when I run the same exact code from an AWS Lambda (in my VPC), the speeds are untenably slow. I've concluded this because I've tested with smaller images (< 1KB) and they work 100% of the time without making any changes to the code. Then I use 1MB sized payloads and they fail 98% percent of the time. I know the request to S3 is the issue because of logs made from within the Lambda that indicate the execution reaches the upload request, but — almost — never successfully passes it (times out).FollowCommentBrettski-AWS EXPERTa year agoWhat's the networking configuration in the VPC? Also, what memory size and timeout have you configured for Lambda?ShareAWS-User-8949906 a year agoI updated the question. Currently the lambda has a 5 minute timeout and 512MB ram, but I've attempted with the max of 10240MB ram and 5 minute timeout, and still no difference.ShareBrettski-AWS EXPERTa year agoI ask about the networking configuration of the VPC because it might be something there that is affecting the transfer. Try creating a S3 Gateway Endpoint in the VPC - that means that the traffic to S3 from the Lambda function doesn't traverse any NAT or Internet Gateways.ShareAWS-User-8949906 a year agoTried the S3 Gateway Endpoint option, but still facing the issue. I updated the question to include details on my network configuration.Share"

Answer: "0Thanks for all the detail - I can't see anything there that would be a problem but needed to check.You don't say what runtime language you're using in Lambda. I'm going to guess that you're using Node.js. If that's the case, you may be using an asynchronous function to transfer the data to S3. That may be the problem here - for small files, the async function completes before the Lambda function is suspended and therefore it works.But for larger files, the the transfer function may still be running but hasn't returned yet; but the mainline code has completed. The Lambda control plane doesn't know this so will suspend the function. The trick here is to ensure that the transfer has completed before the mainline code exits.Of course, I'm guessing. But it seems to fit the circumstances.CommentShareEXPERTBrettski-AWSanswered a year agoAWS-User-8949906 a year agoThanks for your response. There may be a point there. Unfortunately, it wouldn't be as straightforward though. I'm using Swift for the runtime language. Furthermore, the function that transfers the data is performed via a HTTP request, and the default request processing logic — and perhaps all — provided by the language is asynchronous. However, in my case I faced the problem you mentioned in your answer beforehand so I made the function synchronous by using a semaphore.ShareAWS-User-8949906 a year agoThis appeared to resolve all issues where the Lambda was completing execution before all the endpoint's logic had been executed. I could place a log statement in it, this time specifically looking for it being printed to the console before the log statement that is ran on the lambda's completion. However, I did already litter the Lambda with log statements in the past, particularly in the HTTP request we're talking about here, and suspect I would've noticed if that were the case; but maybe not.ShareAWS-User-8949906 a year agoI may just bite the bullet in this case and use a second Lambda just for dealing with S3. A bit more straightforward than trying to debug this problem when I have very limited access to the hardware experiencing the issue, and the only error I'm getting is a "RequestTimeout: Your socket connection to the server was not read from or written to within the timeout period".Share"


Question: Glue WorkFlow - Max concurrent runs exceeded

"Hi there,We have scheduled a workflow ( Crawler -> Glue job ) using Glue workflow. But every other day workflow stops working and showing "Max concurrent runs exceeded" even if it's not running concurrently.I have to re-create a workflow to fix this issue. Obviously that's not a permanent solution.Thanks!FollowComment"

Answer: "0If the workflow is failing with "Max concurrent runs exceeded" error message even though the job is not running, it could be an issue with workflow not being able to keep track of concurrent job runs of the job. Please reach out to AWS Support with workflow name and failed workflow run id so that we can take a look at your workflow and assist you with this.CommentShareSUPPORT ENGINEERManu_Ganswered a year agoEXPERTFabrizio@AWSreviewed a year ago"


Question: LENGTH() function is not working on a string in a column

"Hello everybody,maybe someone can help me, i am trying to find the number of items described in a string seperated by , (for example "x123A, x5894B, z567D" should resolve into 3 options)So i found a way to do this which is mainly comparing the length of the two strings minus the seperator plus 1.So lets say the column with the string of the options are a column called Options and i want to print the number of these options in "Number of Options"my approach isselect "Options", (LENGTH(Options)-LENGTH(REPLACE(Options, ',',''))+1 as "Number of Options"This is working quite fine in other SQL or Tableau but Athena keeps throwing an error regarding Syntax Issues.The error i am getting is as follows:SYNTAX_ERROR: line 3:123: Unexpected parameters (array(varchar)) for function length. Expected: length(char(x)) , length(varchar(x)) , length(varbinary)which i think means the column is not handled as a single string for each row of the result but as a array of results.The same is true for some REG_EX instructions. I did not find any information regarding this.Any ideas or recommendations would be much appreciated.Kind Reagrds,ThomasFollowComment"

Answer: "0In case someone else is stumbling about this issue i found a solution.I had to first convert the array into a string and this worked perfectly with array_join i thought about casting it to the correct type using cast() before but without any success.I was able to get the length then via length(array_join(Options, ','))select "Options", (LENGTH(array_join(Options,',')-LENGTH(array_join((Options, ''))+1 as "Number of Options"Maybe this helps someone else cause it really took me forever to find a solution to this (Thanks to Guru Stron on Stackoverflow :) ).CommentSharetepepeanswered 2 years ago0you may have to use a combination of "regexp_like" (which evaluates every comma to true) along with "count" to count number of true occurrences. Here is a quick guide to presto regex documentation: https://prestodb.io/docs/0.217/functions/regexp.htmlCommentShareAbhilash_Nanswered a year ago0You can split the string into an array and then return the number of items:select cardinality(split('x123A, x5894B, z567D', ',')) as optionsWhen you run it against a table, you can replace 'x123A, x5894B, z567D' with the column name, but the above query returns '3' for me.CommentShareNickanswered a year ago"


Question: Static IP address for EC2 Instance

How can I get a Static IP address for EC2 Instance??FollowComment

Answer: "0In Launch new instance, step 3: Configure Details, select Enabled in Auto-Assign Public IP.For fixed IP, In EC2 console go to Elastic Ips, select Allocate Elastic IP addres, and later, in actions assign this ip to your EC2 instance.CommentSharejfrubioanswered 3 years ago"


Question: AppSync - Cognito: user/pwd not working in jest test - rejectNoUserPool thrown

"Hello,I have an AppSync app configured with Cognito authentication. All is working fine for the Amplify frontend.I would like to add some jest integration tests and was hoping to be able to also use user/pwd authentication (found examples using API_KEY but that is not really something I want to add)I have tried a lot of things and config options but all of them result in  console.error    [ERROR] 18:24.753 AuthError -                Error: Amplify has not been configured correctly.                The configuration object is missing required auth properties.                This error is typically caused by one of the following scenarios:                1. Did you run `amplify push` after adding auth via `amplify add auth`?                    See https://aws-amplify.github.io/docs/js/authentication#amplify-project-setup for more information                2. This could also be caused by multiple conflicting versions of amplify packages, see (https://docs.amplify.aws/lib/troubleshooting/upgrading/q/platform/js) for help upgrading Amplify packages.      at ConsoleLogger.Object.<anonymous>.ConsoleLogger._log (node_modules/@aws-amplify/core/src/Logger/ConsoleLogger.ts:115:4)      at ConsoleLogger.Object.<anonymous>.ConsoleLogger.error (node_modules/@aws-amplify/core/src/Logger/ConsoleLogger.ts:174:12)      at NoUserPoolError.AuthError [as constructor] (node_modules/@aws-amplify/auth/src/Errors.ts:34:10)      at new NoUserPoolError (node_modules/@aws-amplify/auth/src/Errors.ts:40:3)      at AuthClass.Object.<anonymous>.AuthClass.rejectNoUserPool (node_modules/@aws-amplify/auth/src/Auth.ts:2248:25)      at AuthClass.Object.<anonymous>.AuthClass.signIn (node_modules/@aws-amplify/auth/src/Auth.ts:480:16)      at signIn (test/AnnotationsSpec.ts:44:17)Before sharing any of the config details (which I am sure would be needed to provide detailed help)  is it at all possible to use  Appsync with USER_PWD authentication from a jest test? Any examples 'out there'?Tx!!PeterPS using a bunch of curl commands it does work out to send a query to the AppSync app and get the results backFollowComment"

Answer: "0Eventually got it workingimport Amplify, {Auth, API } from 'aws-amplify';import {GraphQLResult} from '@aws-amplify/api-graphql';...Amplify.configure({  aws_appsync_graphqlEndpoint: process.env.GRAPHQLURL,  Auth: {    region: process.env.AWS_DEFAULT_REGION,    identityPoolRegion: process.env.AWS_DEFAULT_REGION,    userPoolId: process.env.USERPOOLID,    userPoolWebClientId: process.env.CLIENTID,    Credentials: {      authenticationFlowType: 'USER_PASSWORD_AUTH',    }  }});...const token = await Auth.signIn( process.env.USERID || '', process.env.APPSYNCPWD);...const response = (await API.graphql({ query , authMode: 'AMAZON_COGNITO_USER_POOLS', authToken: token} )) as GraphQLResult;...Looks more complicated than I would hope is needed, but for now I am going to stick with itSuggestions to simplify more than welcome!TxPeterCommentShareAWS-User-0477472answered a year ago"


Question: Can't send messages over Amazon SQS

"Using Tomcat server version 8.0.53, JDK 1.8 for the server and to compile the application. Using Amazon SQS to send messages to another application, stopped working after upgrading to JDK 1.8.Tried to simulate the environments with exact versions of the server and JDK, SQS working fine on my local server and working on one of the remote servers as well. But still not working on the server in question, despite simulating the environment exactly.Including the produced exception stack trace:com.amazonaws.SdkClientException: Unable to execute HTTP request: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested targetat com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleRetryableException(AmazonHttpClient.java:1114)at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1064)at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:743)at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:717)at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:699)at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:667)at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:649)at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:513)at com.amazonaws.services.sqs.AmazonSQSClient.doInvoke(AmazonSQSClient.java:2013)at com.amazonaws.services.sqs.AmazonSQSClient.invoke(AmazonSQSClient.java:1989)at com.amazonaws.services.sqs.AmazonSQSClient.executeSendMessageBatch(AmazonSQSClient.java:1698)at com.amazonaws.services.sqs.AmazonSQSClient.sendMessageBatch(AmazonSQSClient.java:1674)at com.syngenta.sqc_is.integration.util.SQSQueue.generateAndSendBatch(SQSQueue.java:178)at com.syngenta.sqc_is.integration.util.SQSQueue.SendMessagesBatch(SQSQueue.java:146)at com.syngenta.sqc_is.web.utils.core.AmsUtils.callSQSService(AmsUtils.java:105)at com.syngenta.sqc_is.service.results.impl.ResultServiceImpl.saveResults(ResultServiceImpl.java:408)at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)at java.lang.reflect.Method.invoke(Method.java:498)at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:317)at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:96)at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:260)at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:94)at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)at com.sun.proxy.$Proxy34.saveResults(Unknown Source)at com.syngenta.sqc_is.web.controller.results.UploadResultsController.saveResults(UploadResultsController.java:287)at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)at java.lang.reflect.Method.invoke(Method.java:498)at org.springframework.web.servlet.mvc.multiaction.MultiActionController.invokeNamedMethod(MultiActionController.java:471)at org.springframework.web.servlet.mvc.multiaction.MultiActionController.handleRequestInternal(MultiActionController.java:408)at org.springframework.web.servlet.mvc.AbstractController.handleRequest(AbstractController.java:153)at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(SimpleControllerHandlerAdapter.java:48)at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:919)at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:851)at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:953)at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:855)at javax.servlet.http.HttpServlet.service(HttpServlet.java:648)at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:829)at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:292)at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240)at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:264)at org.acegisecurity.intercept.web.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:107)at org.acegisecurity.intercept.web.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:72)at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:274)at org.acegisecurity.ui.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:110)at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:274)at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:217)at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:274)at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:191)at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:274)at org.acegisecurity.util.FilterChainProxy.doFilter(FilterChainProxy.java:148)at org.acegisecurity.util.FilterToBeanProxy.doFilter(FilterToBeanProxy.java:90)at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240)at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:212)at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:94)at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:492)at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141)at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80)at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:620)at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:502)at org.apache.coyote.ajp.AbstractAjpProcessor.process(AbstractAjpProcessor.java:870)at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:684)at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1539)at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1495)at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)at java.lang.Thread.run(Thread.java:748)Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested targetat sun.security.ssl.Alerts.getSSLException(Alerts.java:192)at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964)at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:328)at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:322)at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1614)at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397)at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:396)at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:355)at com.amazonaws.http.conn.ssl.SdkTLSSocketFactory.connectSocket(SdkTLSSocketFactory.java:132)at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:359)at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)at java.lang.reflect.Method.invoke(Method.java:498)at com.amazonaws.http.conn.ClientConnectionManagerFactory$Handler.invoke(ClientConnectionManagerFactory.java:76)at com.amazonaws.http.conn.$Proxy31.connect(Unknown Source)at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:381)at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:237)at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:185)at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)at com.amazonaws.http.apache.client.impl.SdkHttpClient.execute(SdkHttpClient.java:72)at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1236)at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1056)... 78 moreCaused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested targetat sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)at sun.security.validator.Validator.validate(Validator.java:262)at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)... 105 moreCaused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested targetat sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)... 111 moreFollowComment"

Answer: 0Accepted AnswerThe error message mentions problems validating the server certificate:com.amazonaws.SdkClientException: Unable to execute HTTP request: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested targetThis is most likely caused by the misconfiguration of Java certificate trust store on your server. It seems there are some ideas on how to troubleshoot this issue here:https://stackoverflow.com/questions/9210514/unable-to-find-valid-certification-path-to-requested-target-error-even-after-cCommentShareKubaanswered 5 years ago


Question: my access key resetting automatically

"while doing project work i found that the access key is wrong while running code build, is there a way to disable the auto change in access keyFollowCommentHarshavardhan_G SUPPORT ENGINEER2 months agoCan you please provide more details about the issue?When does this exactly happen?How are you accessing the credentials?Can you provide steps to replicate?Share"

Answer: 0Currently there's no functionality on AWS IAM to automatically rotate you access keys. Verify your AWS CloudTrail Events to view which entity (User/Service) is rotating your access keys.CommentSharevtjeananswered a month ago


Question: Enable External SSO

"Hello Team,We are trying to enable GSUITE SSO for accessing the account using the below-given doc.https://aws.amazon.com/blogs/security/how-to-use-g-suite-as-external-identity-provider-aws-sso/In the doc, I see that all the users need to be recreated and permissions have to be given again.The major question I have for you is, after we enable SSO via Gsuite, whether our users will be able to continue login via normal username and password?Can someone point me to that exact settings?Our main goal is to enable SSO via Gsuite but not enforce it, slowly we will move all users to sso login and later disable password login.Thanks in advance.FollowComment"

Answer: "0Once you enable SSO via G Suite as described in the article you linked, users will not be able to log in to AWS SSO using a normal username and password. To allow users to continue logging in with their username and password, you will need to set up an additional authentication method, such as IAM users and roles, for AWS SSO. To disable password login for AWS SSO, you will need to remove the password-based authentication method from AWS SSO.CommentShareMuhammad Imrananswered 4 months ago"


Question: ""Unknown parameter in input: "QueriesConfig", must be one of: Document, FeatureTypes, HumanLoopConfig" while using 'QUERIES' feature type in Textract"

"I have followed the boto3 documentation version 1.23.1 and used analyze_document method for synchronous analysis from lambda. I have followed the code snippet given here. I need to pass custom queries to textract via QueriesConfig parameter, but it raises "Unknown parameter" error. I cannot find any reference for this error here.FollowComment"

Answer: "1Ensure that your lambda function is using the latest version of boto3 by packaging it with your code. For example v1.21.1 of boto3 does not contain QueriesConfig argument https://boto3.amazonaws.com/v1/documentation/api/1.21.1/reference/services/textract.html#Textract.Client.analyze_documentCommentShareEXPERTMassimilianoAWSanswered a year agoAWS-User-1629386 a year agoHi, I am using boto3 version 1.23.1. Issue is still there when I tried calling inside a dockerised lambda function. Boto3 version in requirements is 1.23.1, python image public.ecr.aws/lambda/python:3.8. However the issue got resolved when I call it from local environment.ShareMLExpert 10 months agoI have the same issue with boto3 version 1.24.34, and lambda image py3.9, thus, this is not the issue.In my case Forms works, but Queries not.Could you help us to solve this issue?Share1Follow the instructions here to use the most recent version of boto3 by adding a Layer:https://docs.aws.amazon.com/textract/latest/dg/lambda.htmlAnother good reference is here:https://aws.amazon.com/premiumsupport/knowledge-center/lambda-python-runtime-errors/In my case, the boto3 version is updated to 1.24.96.Tip: Use print(boto3.version) and print(botocore.version) in your function code to confirm the version of Boto 3 and Botocore.CommentSharePengfeianswered 7 months ago0I was facing same issue and I am able to solve it by creating a lambda layer for latest boto3 library and adding it to my function.Followed the steps mention in this blog posthttps://aws.amazon.com/premiumsupport/knowledge-center/lambda-python-runtime-errors/1.    Create a lib folder by running the following command:LIB_DIR=boto3-mylayer/pythonmkdir -p $LIB_DIR2.    Install the library to LIB_DIR by running the following command:pip3 install boto3 -t $LIB_DIR3.    Zip all the dependencies to /tmp/boto3-mylayer.zip by running the following command:cd boto3-mylayerzip -r /tmp/boto3-mylayer.zip .4.    Publish the layer by running the following command:aws lambda publish-layer-version --layer-name boto3-mylayer --zip-file fileb:///tmp/boto3-mylayer.zip --compatible-runtimes python3.6 python3.7 python3.8--compatible-architectures "arm64" "x86_64"CommentShareAWS-User-9848858answered 7 months ago"


Question: How to choose specific CPU types in AWS batch

"On AWS batch, the command, cat /proc/cpuinfo | grep 'model name' yields model name: AMD EPYC 7R13 Processor.However, I want to use intel CPU.How to do it?ThanksFollowComment"

Answer: "0This will depend on instance type and AMI. I launched a batch with optimal instance type and here is my output :cat /proc/cpuinfo | grep 'model name'model name: Intel(R) Xeon(R) CPU E5-2686 v4 @ 2.30GHzmodel name: Intel(R) Xeon(R) CPU E5-2686 v4 @ 2.30GHzMay i know the instance type and AMI ( if not custom, with region) you are using ?CommentShareSUPPORT ENGINEERAshish_Tanswered 8 months ago"


Question: Integration of Checkpoint Client VPN with AWS Identity Center SAML

"Hello,I have followed the procedure in the following link to create the application in the Identity Center: https://docs.aws.amazon.com/singlesignon/latest/userguide/samlapps.htmlI have also followed a similar procedure to integrate it with the Checkpoint VPN: https://aws.amazon.com/blogs/security/authenticate-aws-client-vpn-users-with-aws-single-sign-on/Regarding Checkpoint, I have used the following procedure: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_RemoteAccessVPN_AdminGuide/Topics-VPNRG/SAML-Support-for-Remote-Access-VPN.htmSpecifically, I don't understand step 6 mentioned by Checkpoint, which involves Checkpoint accessing the user database in the Identity Center through that connection. The excerpt from step 6 is as follows:Step 6: Configure the Group AuthorizationAuthorization is for these types of groups:Identity Provider groups: The groups sent by the Identity Provider.Internal groups: The groups received from User Directories configured in SmartConsole.To configure the Identity Provider groups:In the Identity Provider interface, configure roles.In the Identity Provider interface, configure a SAML claim on the Identity Provider.In SmartConsole, create an internal User Group object with this name (case-sensitive): EXT_ID_<Name_of_Role>. For example, for a role in the Identity Provider's interface with the name "my_group", create an internal User Group object in SmartConsole with the name "EXT_ID_my_group".Note: Identity Tags are not supported for Remote Access connections.Identity Provider groups and Internal groups (e.g., LDAP) are used for authorization.Authorization types:Remote Access VPN Community: Grants users access to Remote Access VPN.Access Roles (requires the Identity Awareness Software Blade): Grants access to users according to policy rules and user identities.To apply authorization by Remote Access VPN, add the applicable group to the Remote Access VPN.To apply authorization by Access Roles, add the applicable group to an Access Role in the Access Control Policy.The purpose of this configuration is to allow users connecting to the Checkpoint client VPN to log in with users from the Identity Center and use two-factor authentication to connect to the VPN.Could you please assist me with this?Thank you very much.Kind regards.FollowComment"


Question: SSE error occurs with Glue 3.0 but not 2.0

An identical job that is writing a dynamic frame via write_dynamic_frame.from_options is succeeding in Glue 2.0 (as usual) and fails with the below error message when changing the version to Glue 3.0. Anyone run into this and found the cause or workaround?An error occurred while calling o90.pyWriteDynamicFrame. java.io.IOException: Unknown Server Side Encryption algorithm aws:kmsFollowComment

Answer: "0Accepted AnswerI ran into the same issue. For me, the solution was to switch from using the "s3a" URI schema to just "s3" when reading files.I went from thisdf = spark.read.json('s3a://...')to thisdf = spark.read.json('s3://...')Hope this helpsCommentShareCoryMcCanswered 2 years ago"


Question: Some billing questions regarding AWS Lightsail service.

"**Condition one: **So let's assume I created two $5/month aws lightsail instance on 5/1.I will only be able to use them for free for around 15 days, right? Because the free plan only contains 750 hours per month.Moreover, at the end of May, which is 5/30,  I used 4T traffic on those two instances.Under such circumstances, how much will I be billed for May (only this single month) ?**Condition two: **So let's assume I create two $5/month aws lightsail instance at the middle of May, which is around 5/15.I used 4T traffic on those two instances during 15 days, how will I be billed at the end of May?Thank you!FollowComment"

Answer: 0Could you please contact AWS support to cut Lightsail a ticket for further assistant on this billing question?CommentShareAWS-User-2776000answered a year ago


Question: Sizing up/down DBInstanceClass using RDS Custom

"Hi,Can we resize the DBInstanceClass whilst using RDS Custom?ThanksFollowComment"

Answer: "1Accepted AnswerShort answer Yes. Modifying RDS Custom is similar to standard Amazon RDS. You can modify the DB instance class and change its DBInstanceClass. This change can be applied immediately or next scheduled maintenance window.  But be aware that right now very few DBInstance classes are supported for RDS Custom - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-reqs-limits.html#custom-reqs-limits.instances.Check this documentation for details - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-managing.html#custom-managing.modify-sqlserverCommentShareDarshit Voraanswered a year ago1It depends.The general answer is that you can resize the DBInstanceClass. But there are critical caveats depending on the technology.Modifying an Amazon RDS DB instance indicates this:"You can change the settings of a DB instance to accomplish tasks such as adding additional storage or changing the DB instance class."But you should also note in Requirements and limitations for Amazon RDS Custom where it indicates,"RDS Custom for Oracle limitations: You can't change the DB instance class, for example from db.m5.xlarge to db.m5.2xlarge."CommentSharemdahlmananswered a year ago"


Question: Need Some Guidance for listing Security hub findings for "Compliance: Passed" Status

"I am having issue on having 1000's of findings in Security Hub which says "Compliance Status: Passed"usually they close after some period of time, but we generate daily reports and need to list the positive findings from CLI Atleast.Wondering if any one has any knowledge on this please share, I am trying on- Planning to list the findings in CLI which says  "Compliance Status: Passed" and close them from CLIHaving hard time with query in cli with this security hub. If anyone call help really appreciate it.FollowComment"

Answer: "0Accepted AnswerHello RGADA, Thank you for reaching out on RePost!To search based on 'ComplianceStatus = Passed' you may use the following CLI command:aws securityhub get-findings --filters '{"ComplianceStatus": [{"Comparison": "EQUALS", "Value": "PASSED"}]}'Please note that for findings that are >3 - 5 days they will be automatically archived, these findings are viewable using the following CLI command:aws securityhub get-findings --filters '{"RecordState": [{"Comparison": "EQUALS", "Value": "ARCHIVED"}]}'Of course, you may also use both of these at the same time to show both archived AND 'ComplianceStatus = Passed' findings like this:aws securityhub get-findings --filters '{"ComplianceStatus": [{"Comparison": "EQUALS", "Value": "PASSED"}], "RecordState": [{"Comparison": "EQUALS", "Value": "ARCHIVED"}]}'There are some further examples and guidance on using the CLI to return findings which can be found here: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/get-findings.htmlI note that you also mention that you would like to be able to close the findings as well. This is also possible via the CLI using the batch-update-findings CLI command. The documentation linked below has an example for doing exactly this task.https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/batch-update-findings.htmlCommentShareSUPPORT ENGINEERJasper_Ranswered a year agoRGADA a year agoThat worked, thank you lotShare0For what it's worth, you can also query for just the list of Finding IDs which might may it a bit easier:aws securityhub get-findings --filters ComplianceStatus="[{Comparison=EQUALS,Value=PASSED}]" --query 'Findings[].[Id]' --output textIf you want to get the full JSON for just one Finding:aws securityhub get-findings --filters Id="[{Comparison=EQUALS,Value=$FINDING_ARN}]" --query Findings[0] --output json(Adding this comment months later since this is currently the top search result for "aws securityhub get-findings".)CommentShareJoshuaF-AWSanswered 7 months ago"


Question: PostgreSQL RDS minor version upgrade stuck with "Incompatible-parameters"

"Hi AWS Support,During a Production RDS maintenance (minor version upgrade from PostgreSQL 9.4.20 to 9.4.21), the instance has become stuck in "Incompatible-parameters" status.The affected RDS resource ID is db-DZAT6VNZZ3JSXFDU6BQXRQOCJQThe errors in the event log are:-This DB instance was placed into incompatible-parameters status because the huge pages configuration for the instance would exceed 90% of the available instance memory. To fix this issue, modify the associated parameter group to lower the shared memory usage, and then reboot the instance. For more information, please refer to the RDS Postgres documentation-Postgres could not be started due to incompatible parameters. Shared memory segment exceeded available memory or swap space. Please modify shared memory usage parameters to lower values and reboot the instance.The maintenance only included minor version upgrade. Huge pages parameter is already set to OFF and we did not alter any parameters for this maintenance therefore we are unsure why the upgrade failed. To try and resolve the issue, we tried reducing max_connections, restarting the instance, but none of them worked.This is a production instance and we had to urgently restore it using a different name.To try replicate the issue, we created a test instance from the production snapshot with the same settings (instance class, parameters, etc), and tried the same upgrade again (9.4.20 -> 9.4.21) and this time it was successful.Can you please check the cause of the upgrade failure? If upgrade failed, why is it not rolling back automatically? Also can you please allow the instance to be deleted so that it stops incurring further cost?Regards,JamesFollowComment"

Answer: 0We found a solution in another thread.Solution:Use AWS CLI to disable Delete Protectionaws rds modify-db-instance --db-instance-identifier db01 --no-deletion-protectionUse AWS Console UI to delete RDS instance.CommentShareaws-fmanswered 4 years ago0Setting huge_pages to off resolved here. It is surely an RDS bug as just automatic minor upgrade triggered the issueCommentShareBraulio Oliveiraanswered a year ago


Question: Athena GENERIC_INTERNAL_ERROR: java.net.URISyntaxException

"I'm having this error in Athena when I query my dynamodb data.GENERIC_INTERNAL_ERROR: java.net.URISyntaxException: Relative path in absolute URI: arn:aws:dynamodb:af-south-1::table/ This query ran against the "**" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: 786d9b0e-3c49-44f8-82cc-1afda5494e49FollowComment"

Answer: "0I had the wrong datasource and database selected in my query editor. When I changed those to the correct values, my query ran correctly. Hope this helps, cheers!CommentShareJasonMereckiMaxanswered 10 months ago"


Question: Feature request - Increase Throughput and Monitoring actual Troughput

Hi guys we are using FSX from some week and we feel the lack of a monitor where we can see how much Throughput we are using at the moment(such as dynamoDB metrics charts) and based on this the ability to scale it up .Thanks for the answers.FollowComment

Answer: "0Hi Mario,Thank you for the feedback! We're always interested in improving our service, and we'll consider the request to provide metrics on file system throughput and support changing the throughput capacity of an existing file system as we plan our roadmap.Thanks,AndyCommentSharecrudge-awsanswered 4 years ago"


Question: Can't start latest AWS CLI on Windows (malformed path to config file)

"I've just just installed the latest AWS CLI x64 on Windows 10, from file AWSCLI64.msi .  Then I have set the PATH variable as required.When I launch aws, I get the following error:C:\Users\Sergio>aws --versionTraceback (most recent call last):  File "aws", line 27, in <module>  File "aws", line 23, in main  File "awscli\clidriver.pyc", line 55, in main  File "awscli\clidriver.pyc", line 63, in create_clidriver  File "botocore\session.pyc", line 386, in full_config  File "botocore\configloader.pyc", line 152, in raw_config_parsebotocore.exceptions.ConfigParseError: Unable to parse config file: C:\Users\Sergio/.aws/credentialsThe last line clearly suggests the cause, as the path to credentials file is malformed for Windows: C:\Users\Sergio/.aws/credentialsindeed, it should be:  C:\Users\Sergio.aws\credentialsHence, I've set the env variableAWS_CREDENTIAL_FILE=C:\Users\Sergio\.aws\credentials, then opened a new cmd.exe window, but I still get the same error.I've also tried the command:aws configurebut the same error occurs too.   It seems aws.exe cannot start in any way on Windows.What should I do ?(and please, let AWS fix this bug !)Tags: cli windows configparseerrorFollowComment"

Answer: "1I have just discovered that the error is due to an invalid format of .aws\credentials file content.It can be solved by editing the file and placing there proper credentials, following the format shown here:Link: http://docs.aws.amazon.com/cli/latest/userguide/cli-config-files.htmlAnyway, to get a useful tip which addressed me to the resolution, I had to uninstall AWSCLI from its MSI installer package and then reinstall it using pip:pip install awscli --upgrade --userAfter some more troubleshoot of PATHs, I ran aws again and I got a more meaningful error message, which addressed me to the resolution above.CommentSharesarzenanswered 6 years ago0Thank you for your reply really helped me!CommentShareOsianswered 2 years ago"


Question: How to implement propagation algorithms in Neptune

"I need to implement a custom propagation algorithm that starts from a given node and visits its neighbors and update their properties accordingly based on the previous node properties.Example use case is, a quality flag that changed in a given node from good to bad and I need to make all the subsequent nodes become bad.What is the recommend way of implement this efficiently in Neptune? (I'm trying to avoid to have client code to have this graph traversal one hop at a time)FollowComment"

Answer: "1So something like the following?Sample graph:g.addV('Product').property(id,'prod1').property('name','widget').property('quality','good').as('p1').addV('Product').property(id,'prod2').property('name','sproket').property('quality','good').as('p2').addV('Product').property(id,'prod3').property('name','screw').property('quality','good').as('p3').addV('Product').property(id,'prod4').property('name','bolt').property('quality','good').as('p4').addE('connectedTo').from('p1').to('p2').addE('connectedTo').from('p1').to('p3').addE('connectedTo').from('p1').to('p4')Sample query:g.V('prod1').as('p1').property(single,'quality','bad').    out('connectedTo').    property(single,'quality',select('p1').values('quality'))This query would alter the property on the "root" vertex and apply the same property value to the children vertices.UPDATE:  If wanting to propagate this down an entire tree, you could use a repeat() step:g.V('prod1').as('p1').property(single,'quality','bad').    repeat(        out('connectedTo').        property(single,'quality',select('p1').values('quality'))    )CommentShareTaylor-AWSanswered a year agoAWS-User-2625830 a year agointeresting so I can make search query and then basically call property on the traversal to set the value of the property!ShareAWS-User-2625830 a year agoIs this recursing or it will just propagate to direct children of p1, I see you only use out not sure if this will grab all subsequent nodes (i.e. children of children)Share"


Question: MySQL server has gone away - Anyone else seeing this on Aurora Serverless?

"Switched to Serverless Aurora from a cluster over the weekend for availability and scaling.Ran fine for two days. Then for two 10 min periods in the last two days, we get "MySQL server has gone away" errors on about 30% of queries.Have been running same code on Aurora clusters for two years with no issues.No scaling was occurring, there were no RDS events or log entries, no change in metrics during the period.The queries are normally sub-second, and the error returned much earlier then client timeout.There is ongoing traffic (so not a warmup issue) and multiple EC2s accessing DB at the time (so not related to a specific client).Some other posts in the last month indicate similar problems; has anyone else seen this?Any ideas on the cause or a fix?Edited by: Vueocity on Mar 4, 2020 9:33 AMEdited by: Vueocity on Mar 4, 2020 9:35 AMFollowComment"

Answer: "0Serverless connection timeouts appear to be different, so you may need code updates to manage.CommentShareVueocityanswered 3 years ago"


Question: Direct Connect LAG across circuits from different providers

We have an existing 1G dedicated Direct Connect and thinking of using LAG to increase the available bandwidth by adding an additional 1Gig port. Do we have to use the same telco provider for link #2 or will LACP only work if the same provider supplies both circuits.FollowComment

Answer: "0Accepted AnswerIf you are purchasing Direct Connect ports from the same account, then we don't have any specific requirement to use the same service provider. Although, running LAGs across different providers which may have completely different characteristics (relevant if they purchase L2 services) and latency (think about an outage and one provider re-route its traffic via a different physical path) is a poor and risky practice. Also, generally multiple circuits joined using LAG work best when terminated on the same equipment.As an alternative to upgrading to 10Gig port, you can consider using BGP with ECMP (Equal Cost Multipath) with AWS Transit Gateway to take advantage of both circuits from different providers.CommentShareGiorgio@AWSanswered 3 years ago"


Question: Peering connection with ansible: "No route to host"

"Hi,I have an EC2 instance in us-east-1 which would like to communicate with another instance in ** us-west-2**.The CIDRs:VPC-East CIDR: 172.16.0.0/16VPC-West CIDR: 172.17.0.0/16The **used subnets **in these VPCs are 172.(16 or 17).0.0/24 correspondingly.I've created a Peering Connection between the two regions' VPCs and maybe it would help so I allowed these:Allow accepter VPC to resolve DNS of hosts in requester VPC to private IP addressesAllow requester VPC to resolve DNS of hosts in accepter VPC to private IP addressesI also added a new route at the route tables, this is East's.I've created a Reachability Analyzer from both the East and West instance to the Peering Connection and both succeed.But ansible still fails to connect from East to West (From East to East it worked earlier).Failed to connect to the host via ssh: ssh: connect to host 172.17.0.129 port 22: No route to hostMaybe it's not related to my main problem, but:Another instance in the west can be accessed via a public IP by me and by East instance.But it show this:Instance reachability check failedWhile I can SSH, access the website it hosts, etc.Thanks in advance!FollowComment"

Answer: "0Hi Tudvari,It seems you are having trouble establishing communication between your two EC2 instances located in the east(VPC-East) and west region(VPC-West).It looks like your main issue is you only added a route table in the VPC-East and not a route table to your VPC-West. In order to enable the flow of traffic between the VPCs using private IP addresses, you need to manually add one or more route in both VPCs. Here is AWS peering documentation that will help walk you through the steps in creating the route tables for your VPCs[1].Secondly, verify your security group for the EC2 instances and the NACLs for each resource in each VPC is configured to allow traffic to the peered VPCs. Here is documentation on the proper configuration for both the security groups[2] and NACL[3].Let us know if we can be of anymore assistance!References:[1] https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html[2] https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html[3] https://docs.aws.amazon.com/vpc/latest/peering/troubleshoot-vpc-peering-connections.htmlCommentShareJasmine_Hanswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 9 months ago"


Question: when will we be able to use auto-copy feature in redshift for production clusters ?

We have a use case where we can use Redshift auto-copy feature to load data from s3 to redshift automatically. Currently auto-copy feature is in preview as of May 9.How can we use that feature after May 9 ?When will we be able to use the feature for our production clusters?FollowComment

Answer: "0You should be able to use the feature in preview all the way till GA. If you want to retain the data then unload to S3 and save the files before you delete the preview cluster. After GA you can recover the previous data from the unloaded files, and start using the feature on your Production cluster.CommentShareMilindOkeanswered 19 days agoEXPERTFabrizio@AWSreviewed 19 days ago"


Question: Unable to delete snapshot of a terminated instance

I'm unable to delete the snapshot of a terminated instance.The instance is a very old t1.micro for which the Volume has also been deleted.How do I get rid of the snapshot so that this instance incurs no additional charges?FollowComment

Answer: "0Accepted AnswerHi,Please see this Knowledge Center article to resolve such issue.CommentShareEXPERTTushar_Janswered a year ago0Make sure there are no AMI associated with the snapshot. If there is, delete the AMI first.CommentShareEXPERTkentradanswered a year ago0Thank you, Tushar!CommentShareAWS-User-6419781answered a year ago"


Question: Cognito does not call CreateAuthChallenge trigger

"I'd like to configure custom authentication flow with AWS Cognito so I used this and this instructions to do this. Previously, I configured password authentication with a possibility to specify a user email or phone number as a username with sending confirmation codes via custom sender triggers and it worked fine. But then after adding custom authentication triggers I realized, that there is no CreateAuthChallenge call - only DefineAuthChallenge. So what I have now:I call InitiateAuth with the following body:{    "AuthFlow": "CUSTOM_AUTH",    "ClientId": "{{client_id}}",    "AuthParameters": {        "USERNAME": "{{username}}",        "SECRET_HASH": "{{secret_hash}}"    }}The response of this call is:{  "ChallengeName": "MY_AUTH",  "ChallengeParameters": {    "USERNAME": "59edb46e-...-8f74a7084057"  },  "Session": "AYABeC...jA_TyA"}At the same time in the logs I see only one lambda call with the following event as an argument:{    "version": "1",    "region": "me-south-1",    "userPoolId": "me-south-1_...",    "userName": "59edb46e-...-8f74a7084057",    "callerContext": {        "awsSdkVersion": "aws-sdk-unknown-unknown",        "clientId": "44v...bp"    },    "triggerSource": "DefineAuthChallenge_Authentication",    "request": {        "userAttributes": {            "sub": "59edb46e-...-8f74a7084057",            "cognito:email_alias": "devops@example.com",            "cognito:user_status": "CONFIRMED",            "email_verified": "true",            "email": "devops@example.com"        },        "session": [],        "userNotFound": false    },    "response": {        "challengeName": null,        "issueTokens": null,        "failAuthentication": null    }}According to the docs right after this event I should see the event for CreateAuthChallenge trigger but I see nothing.The trigger that is called for those events has the following code:import jsonimport requestsdef handler(event, context):  print('### EVENT ###')  print(json.dumps(event))  source = event.get("triggerSource", "unknown")  sessions = event.get("request", {}).get("session", [])  if source == "DefineAuthChallenge_Authentication":    event["response"]["issueTokens"] = False    event["response"]["failAuthentication"] = True        if len(sessions) == 0:      event["response"]["issueTokens"] = False      event["response"]["challengeName"] = "MY_AUTH"      event["response"]["failAuthentication"] = False      print(json.dumps(event))      return event    if len(sessions) == 1 and sessions[0].get("challengeName", "") == "CUSTOM_CHALLENGE" and sessions[0].get("challengeResult", False) and sessions[0].get("challengeMetadata", "") == "MY_AUTH":      event["response"]["issueTokens"] = True      event["response"]["failAuthentication"] = False      print(json.dumps(event))      return event    print("unexpected sessions sequence: ", sessions)    return event  if source == "VerifyAuthChallengeResponse_Authentication":    event["response"]["answerCorrect"] = False      return event  print("unexpected triggerSource: ", source)  return eventPlease advise what I can do to make Cognito calling CreateAuthChallenge trigger to pass public and private data according to the docs.Thanks!FollowComment"

Answer: 0Accepted AnswerFound an issue with the Lambda code:On the first step it return MY_AUTH as a challengeName which is wrong. After changing it to CUSTOM AUTH as it is described in docs all started working fine.I wonder though why Cognito didn't raised any errors and continued returning CUSTOM_AUTH challenge name event though I specified MY_AUTH.CommentSharevyacheslavanswered 7 months ago


Question: data lake - data ingestion methods

"Hi team,I was wondering if there are any resources that someone may have already worked on or have access to which outlines some of detail information on data ingestion methods that are suitable when the customer is trying to use S3 as a data lake central storageFollowComment"

Answer: "0Accepted AnswerHave a look at the Building Big Data Storage Solutions (Data Lakes) for Maximum Flexibility whitepaper, it might be of help.CommentShareAWS-User-8154085answered 5 years ago"


Question: Connection refused problems of my EC2 instance

"I have problems of connection refused in EC2 instance, my odoo application with docker does not respond, I have changed the group of rules, I have restarted the instance and I cannot start the application, please can you help me with this issue, thanks.FollowComment"

Answer: "0Hi, are you exposing the appropriate ports on the dockerfile?CommentShareJorgeCastilloManswered 10 months ago0Are you able to ssh into this machine? Is this machine on a public subnet or a private subnet? If it is on a public subnet then you should be able to connect as per the security group settings. One more thing to check would be if you have any NACLs on the subnet preventing inbound access on these ports.You may also want to look at this Premium Support Knowledge Center article to see if you can find any pointers - https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-resolve-ssh-connection-errors/Also look at the docker logs to see if you can find anything there.CommentShareEXPERTIndranil Banerjee AWSanswered 10 months ago"


Question: Unable to SSH into newly created EC2 Instances

"instance ID - i-01f1ccc1e76285fb7I have exhausted all troubleshooting steps and still getting connection time out.Edited by: huangmi on Jan 21, 2021 11:28 AMFollowComment"

Answer: "0Ignore....this request...How did you manage to solve this issue? coz I am having a similar issue after hosting it in a private-subnet with an internet gateway!!!Edited by: ahmedyas on Jan 24, 2021 2:02 AMCommentShareahmedyasanswered 2 years ago"


Question: How to list all s3 buckets across all regions for all accounts under Organization

I am trying to find all s3 buckets available under any account which are associated with organization. I will run this command/script from management accountFollowComment

Answer: 0I would start with this: Multi-Account Multi-Region Data Aggregation.CommentShareEXPERTkentradanswered 18 days ago0This shell script (see GitHub repo link at end)  may be what you need to run diverse commands across all accounts in you AWS Organization:https://alestic.com/2019/12/aws-cli-across-organization-accounts/CommentShareDidier_AWSanswered 18 days ago


Question: Faster Processing Speeds

Who do I contact to upgrade to faster processing speeds? Or is there a simple way to do it from the dashboard I'm just not seeing? Thank you.FollowCommentKris a year agoYou'll need to be more specific. Which AWS service are you referencing? We have a few. :)Share

Answer: "0Hello AWS-User-5354725,Do you still need help with your project? Please let us know.Kind Regards,MonicaCommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago"


Question: "EC2 Instance is stuck, can't ssh in and abnormal CPU & network utilisation"

"I have 2 very small applications running in docker containers on a t2micro instance.The CPU usage is minimal but since last month I experienced that the applications were not responding due the ec2 instance being stuck.The Instance reachability check failed and I can't ssh in to the instance, it just hangs.Shutting down & starting the instance solves the problem but the issue happens in the next 3-7 days.Does anybody has any idea?CPU -> https://imgur.com/YXiSemlNetwork -> https://imgur.com/dSZZduUFollowComment"

Answer: "0You mention this is a t2.micro when you run into issues have you checked your CPU credit balance via the monitoring tab for the EC2 instance? This sounds like you are consuming credits faster than they are accruing. The graph you linked shows a spike in CPU utilization which more than likely accounts for the credits being consumed.CommentShareRoBanswered a year agorrp a year agoI checked the logs in cat /var/log/auth.log and everything points that its due an attack.Continuously and several times per second there are authentication attempts from several locations. China, US, Singapur ... They don't apply to the use case of my application since the application does not expect requests from therethe requests try to authenticate with default usernames like "test", "root", "ubuntu", "oracle", "postgres", "ansible"It seems the attack comes in a DoS shape ...Currently my instance is publicly reachable, What would you recommend?Share0How about fail2ban to prevent login attempts?CommentShareYuxianganswered a year ago"


Question: Cannot create AWS Workspace using Amazon Linux 2 (but can create using Windows image)

"Create new workspace using the Amazon Linux 2 bundleWorkspace fails to load with "There was an error creating the WorkSpace. Retry the request. If the problem persists, contact AWS support."We were able to successfully do this same process a couple of months ago when we last tried it.FollowComment"

Answer: "0I'm having this exact same issue. I have a Microsoft Managed AD directory setup with Windows workspaces provisioned just fine. When I try to provision a Linux 2 bundle, it fails instantly with the same error message. The workspace is in pending mode for 25 mins and transitions into Error state without much information other than "contact AWS support or post on AWS forums".I have considered the issue with the EBS KMS key used to encrypt both root and user volumes. I have ensured that 1) My IAM user has all the required permissions to use the KMS key for EBS encryption 2) The resource policy on the EBS KMS key allows my IAM user access to use the key for encryption, decryption, and generating data keys as noted in this AWS support article (https://docs.aws.amazon.com/workspaces/latest/adminguide/encrypt-workspaces.html#kms-workspaces-permissions).I tried provisioning a workspace with unencrypted root and user volumes and got the same result.Looking at CloudTrail's logs for the event name "DescribeWorkspaces" to see the status of the workspaces listed, I see the following:{                "bundleId": "wsb-xxxx",                "workspaceId": "ws-xxx",                "rootVolumeEncryptionKey": "arn:aws:kms:eu-west-1:xxxx:key/xxxxx",                "directoryId": "d-xxxx",                "state": "ERROR",                "errorCode": "Internal.ServerError",                "userName": "xxxx",                "userRealm": "xxxx",                "workspaceProperties": {                    "recycleMode": "DISABLED",                    "userVolumeSizeGib": 10,                    "runningMode": "AUTO_STOP",                    "computeTypeName": "STANDARD",                    "rootVolumeSizeGib": 80,                    "runningModeAutoStopTimeoutInMinutes": 60                },                "userVolumeEncryptionKey": "arn:aws:kms:eu-west-1:xxxx:key/xxxx",                "errorMessage": "There was an error creating the WorkSpace. Retry the request. If the problem persists, contact AWS support.",                "volumeEncryptionKey": "arn:aws:kms:eu-west-1:xxxx:key/xxxx",                "rootVolumeEncryptionEnabled": true,                "modificationStates": [],                "userVolumeEncryptionEnabled": true            },I also considered the workspace quotas. I currently have 8 workspaces in total (including the workspace in error state) with a quota limit of 50.I hope someone from the AWS Workspace team will be able to shed some light on this issue as I do not have AWS premium support.CommentShareAWS-User-3943794answered a year agorePost-User-9846265 3 months agoDid you ever get an answer?Share0Unfortunately there's not a lot of information to go on here; as per the error message please contact AWS support.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: AWSXRayServletFilter with Jakarta EE 10 / SpringBoot 3.x

"We have an existing Java 17 app running SpringBoot 2.7.9 and are upgrading to SpringBoot 3.0.3Spring Boot 3 uses the Jakarta EE 10 - as a result the javax.servlet.Filter is no longer available (instead its jakarta.servlet.Filter)ref: https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-3.0-Migration-Guide#jakarta-eeGiven the above, we can no longer trace incoming requests - https://docs.aws.amazon.com/xray/latest/devguide/xray-sdk-java-filters.htmlAre there alternatives are available to resolve this?  (eg updated AWS SDK, alternative filter suggestions?)-- updated --I see in the github repo that a Jakarta compatible servlet has been merged into the master branch, so I guess this is just pending a  new releaseref : https://github.com/aws/aws-xray-sdk-java/pull/372FollowCommentrePost-User-6886525 3 months agoWould be appreciated and good to know when is the planned release so teams could plan accordingly.Share"

Answer: "0Hello,Thank you for providing your valuable feedback on the service. The service team is aware of the issue regarding AWSXRayServletFilter/javax.servlet.Filter with respect to the new version of Spring and is working on providing a fix.While I am unable to comment on when the support for  jakarta.servlet.Filter may get released, I kindly suggest you to monitor the GitHub issue https://github.com/aws/aws-xray-sdk-java/issues/364  for further updates. Also, I request you to keep an eye on our Whats' New and Blog pages for any new feature announcements. As an alternative, kindly consider migrating to OpenTelemetry.CommentShareSUPPORT ENGINEERSrushti_Kanswered 3 months ago"


Question: AWS cli based incident response playbook

"previously we have linux cli based playbook to identify linux attack, like cat /etc/passwd, netstat -anp, in AWS cloud, do we have a cli based incident response playbook? can anyone share the command list for investigating AWS compromise(EC2, IAM,S3) and AWS kubernetes compromise? thanksFollowComment"

Answer: "1There are sample incident response playbooks on our GitHub: https://github.com/aws-samples/aws-customer-playbook-framework, https://github.com/aws-samples/aws-incident-response-playbooksCommentShareAWS-User-9401600answered 3 months ago0For general AWS Security, I would start here: https://aws.amazon.com/architecture/security-identity-compliance/.  The AWS whitepaper covers a lot of AWS security, including Detection which would be how to investigate/detect strange behavior.AWS has a service called GuardDuty that comes with security checks: https://aws.amazon.com/guardduty/.  For pricing information, check https://aws.amazon.com/guardduty/pricing/.GuardDuty will analyze VPC Flow Logs, AWS CloudTrail management event logs, CloudTrail S3 data event logs, and DNS logs for suspicious events.For Incident Response, here's a start: https://aws.amazon.com/premiumsupport/knowledge-center/potential-account-compromise/This is another guide that AWS publishes: https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/welcome.html.CommentSharejsoncanswered a year ago"


Question: s3 list object versions documentation is wrong

"This documentation says you need read access to the bucket, but you also need the ListBucketVersions permission, too.  Could someone please correct this from AWS?Here's the documentation that's wrong.  https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3.html#S3.Client.list_object_versionsFollowComment"

Answer: "0Accepted AnswerThank you for pointing it out.Not sure if it has been fixed afterwards, but we could see a warning indicating that s3:ListBucketVersions is required for the operation, in accordance with API documentation https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectVersions.html.--CommentShareweidianswered 7 months ago"


Question: How to make proper appsepec.yml file for Django application

I'm facing this issue  anyone  pls helpThis is my appspec.yml file for djangoFollowComment


Question: Сannot access to Query section in AppSync.

"I have a problem accessing to Query section in AppSync API By AWS Console. rest sections like Shema, DataSource, etc  - work.I Just see an error:Unable to load contentThe content for this page could not be loaded. Please refresh this page or return to the AWS AppSync home page. If you continue to see this error or have issues in general, contact AWS supportAlso, I want to mention that it doesn't work only for 1 API(I have another one, a full copy of this stack and it works as expected). How I can solve this problem?FollowComment"

Answer: "1Accepted AnswerIf you are experiencing an error when trying to access the Query section in AppSync API through the AWS Console, there could be several reasons for this. Here are some steps you can take to troubleshoot the issue:A-Check your IAM permissions: Ensure that your AWS Identity and Access Management (IAM) user or role has the necessary permissions to access the Query section of your AppSync API. To do this, check the IAM policy attached to your user or role, and ensure that it has the appropriate permissions for AppSync.B-Verify your AppSync API configuration: Double-check your AppSync API configuration to ensure that it is set up correctly. Ensure that your data source is configured properly, and that your schema is valid and up-to-date.C-Clear your browser cache: Sometimes, cached data in your browser can cause issues with accessing certain parts of the AWS Console. Try clearing your browser cache and refreshing the page to see if that resolves the issue.D-Try a different browser: If clearing your cache doesn't work, try accessing the Query section of your AppSync API from a different browser. This will help you determine if the issue is related to your browser.E-Contact AWS support: If none of the above steps resolves the issue, contact AWS support for further assistance. Provide as much detail as possible about the error you are seeing, and any steps you have taken to try to resolve the issue.Thank you.CommentSharerePost-User-0899580answered 2 months agoEXPERTalatechreviewed 2 months agorePost-User-2202264 2 months agoHi, thanks for your reply. I found that I had an empty type Subscription{} in the Schema. After removing, all works as expectedShare"


Question: How to start using EC2

"I just started using AWS and I didn't know how to start it and use it.I am student, I am not familiar with AWSCan anybody help me and guide me how to start?FollowComment"

Answer: "1Accepted AnswerHi,After creating your account typically you want to:Navigate to EC2.Launch your instance from the provided AMIs.Configure your instance settings (including security settings to allow access)Connect to your instance by selecting your instance on the ec2 dashboard, Clickconnect and follow the instructions.Check out this link to get started. https://aws.amazon.com/ec2/getting-started/Do note that your resources will only be available in the region you select when launched.CommentShareDeekillzanswered 2 months agoDhrupal 2 months agoThanks' to help meShare0Hi,I d recommend this guide: https://repost.aws/knowledge-center/launch-instance-custom-ami, but if you have doubts about it, just let me knowCommentShareEXPERTalatechanswered 2 months agoDhrupal 2 months agoIt is mandatory to use current region, or we can use any location?Sharealatech EXPERT2 months agoHi Dhrupal, yes, ec2 are regional so it matters the region you are in.Share0Take a look at this: AWS Ramp-Up Guide: Cloud Essentials. There are more Ramp Up Guides.CommentShareEXPERTkentradanswered 2 months ago0Hello , Yes it is important be in the region in which your EC2 Instance is launched. EC2 Instance is a region specific resource.CommentShareDamini_Kanswered 2 months ago"


Question: Greengrass v2 | Component Configuration Cached on Device

"I created a new version of a custom Greengrass component and deployed it to my GG core device, which was running the previous version of my custom component.After the deployment is complete, I noticed that the new component's configuration remained the same as the old component, even though the default configuration has changed in this new version of component. This caused Unauthorized Error since the new access control policies did not get updated.Was the component configuration cached by the Nucleus? How can I make sure my updates to my custom component updates both the artifact, recipe, and the configuration?FollowComment"

Answer: "1Accepted AnswerUse "reset": [""] to reset all configuration to the default value in the recipe. See https://docs.aws.amazon.com/greengrass/v2/developerguide/update-component-configurations.html#reset-configuration-update for more.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 3 months agoictwist 3 months agoThanks Michael!Share"


Question: RDS for database size more than 16TB

"As per AWS documentation the max size supported by AWS RDS DB is 16TB.My on-prem MS SQL DB is approx 25TB. So I cant use RDS.-what are different options available as I migrate this DB to AWS?If I install MS SQL on EC2 instance, are there any Pro's and Con'sIs there any AWS recommended document for installing MS SQL on a EC2 RHEL instance?For MS SQL in EC2, how to best design the backup and restore process?FollowComment"

Answer: "0There is a lot of ways to look at the ask, best recommendation is to look at the main SQL page on AWS.The page has information on Migration methods for SQL and host types you should consider among other things. Additional information on SQL on RHEL as well. Blog on Deploying SQL on Linux on AWS will be another resource to us.For backups, you can use AWS Backup in a lot of cases to backup EC2 instances. Depends on how you want to backup and how often. You can also export the backups to a AWS storage offering like EFS, FSx, or even S3 depending on the architecture.RDS running Microsoft SQL is another option to consider.CommentShareAWS-User-EPanswered 2 months ago"


Question: Configuration with high cost of use Gamelift

"Hi guys! I would like to check who can help on a GameLift setup and cost case:A test was put in place with a multiplayer pack, without texture, light simple data traffic, to have a sense of expenses with the Gamelift server. During the 90-minute time on Gamelift and the investment cost came to the cost of $ 20 for 90 minutes of GameLift running the game test. I believe it could be some wrong configuration because it was a high cost in my view. I would like to see who can help us with this situation in knowing how to reduce these costs with the cloud if they are really misconfiguration problems.Thank you all!FollowComment"

Answer: "0Need to know a little more about your setup ie OS, # of instances, how much of this was GameLift EC2 cost, how much was data transit costs etc.Some tips though:Prefer Linux  Servers - much cheaper base costs, Linux is per second billing etc.Prefer Spot as much as you can tolerate. Spot instances are much much cheaper and interruption rate is probably going to be lower than you think (obviously verify this with metrics etc)Use multi-process - can run up to 50 game servers per EC2 instance so optimize your dedicated servers so you can pack them onto the instance.Pay attention to your spare capacity - Carry enough to deal with demand, ensure you scale down capacity you don't need.See https://aws.amazon.com/gamelift/pricing/ for pricing per instance. Sometimes just chosing the right EC2 instance can help (ie it has the memory/cpu to run x instances of your game)CommentSharerePost-User-5332620answered 3 years ago0A lot of factors can come into play here, are they using Windows or Linux ec2 instances to host server processes? This matters because Windows charges per hour, counting partial hours as full hours while Linux charges per minute I believe.Also, which instance type are they using?And lastly, assuming there was only one fleet with one instance running, are you sure it was only 90 minutes being charged? Because if you don't shut down the instance manually or automatically after using it, you will be charged while it is in idle.CommentSharerePost-User-5100160answered 3 years ago0Thanks!I will review the EC2 instances and their settings. Thanks @REDACTEDUSERCommentSharerePost-User-7328120answered 3 years ago"


Question: How to use MQTT retained  messages in custom Greengrass components?

"Hello everyone,I'd like to use MQTT retained messages in the Greengrass component. Is it possible?The next tutorial  says about retained messages. But there is nothing on how to set the retained flag in the documentation about IPC communication.FollowComment"

Answer: "1Accepted AnswerHello,Tim here from Premium Support. Thanks for reaching out to us, we always love to see users of our IoT services and hearing about how they're using them!The Greengrass IPC doesn’t support sending of MQTT retained messages at this time, but I recommend checking out a different solution like Shadow: https://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-local-shadows.htmlCommentShareSUPPORT ENGINEERTim_Panswered a year ago"


Question: Waiting for the 50% discount on the AWS certification voucher. When is it going to be released?

"Hi,As part of the event AWS Empower India event held at Hyderabad 20th Jan 2023, I won the 50% discount on the Certification voucher.Just wanted to know when is the discount code expected to be shared?My ID from the QR code was 689603.ThanksFollowCommentJonathan_D EXPERT4 months agoHave you tried to reach out to the event organizer?ShareAmit 4 months agoI didn't have any contact of the organizer. However, happy to say that I got the voucher in email today. Thanks to the team.Share"

Answer: 0Accepted AnswerReceived the voucher in email today. Thanks to training and certification team of AWS.CommentShareAmitanswered 4 months ago


Question: Identify which alias was used to sign in on cognito lambda trigger

"Hi, I created a userpool with email and phone as aliasAttributes. When the user sign in, can i identify which alias or username he uses?And get that information inside Create Auth Challenge lambda trigger?I always get the same event on that triggers with all user information.UserPool:    Type: "AWS::Cognito::UserPool"    Properties:      UserPoolName: !Ref UserPoolName      Schema:        - Name: phone_number          AttributeDataType: String          Mutable: true        - Name: email          AttributeDataType: String          Mutable: true      Policies:        PasswordPolicy:          MinimumLength: 6          RequireLowercase: false          RequireNumbers: false          RequireSymbols: false          RequireUppercase: false      AliasAttributes:        - email        - phone_number      MfaConfiguration: "OFF"UserPoolClient:    Type: "AWS::Cognito::UserPoolClient"    Properties:      ClientName: sms-auth-client      GenerateSecret: false      UserPoolId: !Ref UserPool      ExplicitAuthFlows:        - CUSTOM_AUTH_FLOW_ONLYFollowComment"

Answer: 0You won't have this information natively.But you can pass this information as Client Metadata as part of the the AdminRespondToAuthChallenge and RespondToAuthChallenge API actions to support your logic behavior.See https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-create-auth-challenge.htmlclientMetadata    One or more key-value pairs that you can provide as custom input to the Lambda function that you specify for the create auth challenge trigger. You can use the ClientMetadata parameter in the AdminRespondToAuthChallenge and RespondToAuthChallenge API actions to pass this data to your Lambda function. The request that invokes the create auth challenge function does not include data passed in the ClientMetadata parameter in AdminInitiateAuth and InitiateAuth API operations.CommentShareJeff Lombardo-AWSanswered 4 months ago


Question: Can AWS DocumentDB have something similar to a hot partitioning issue?

"Can we have custom ObjectIds for DocumentDB?If we can have customer ObjectIds for DocumentDB, do we need to keep in mind any possibility of hot key while choosing the objectId?FollowComment"

Answer: "01/ I assume that the question is about the _id field. Yes, DocumentDB allows setting custom ObjectId values in this field as long as the values are unique for each document in a collection.2/ DocumentDB does not partition data. All writes go through the primary instance in the cluster and any primary key can be read from any of the read replicas. You will not have hot keys in the same sense as other products like DynamoDB and S3.There are other considerations that you should keep in mind to maintain good performance. See https://docs.aws.amazon.com/documentdb/latest/developerguide/best_practices.htmlCommentShareSanjay Aggarwalanswered 7 months ago"


Question: Have security group related config rule at organisation level

"The issue is our accounts are in control tower environment and in control tower there are no options to add config rules other than Predefined ones, in those predefined ones there is non for security groups. How can we enable more config rules at organization level e.g. security group verification rule.I have the option to enable this at per account level but not at aggregator level, but there are hundreds of account and it is not feasible to have this one by one for each account.FollowComment"

Answer: "0Hello,AWS Config is something that you are looking for & you might want to consider. Read through the link below for all the details & necessary information.Link- https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_manage-rules.html -- [1]CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 8 months agoVirender 8 months agoHi Chirag, the issue is our accounts are in control tower environment and in control tower there are no options to add config rules other than Predefined ones, in those predefined ones there is non for security groups. How can we enable more config rules at organisation level e.g. security group verification rules.I have the option to enable this ar per account level but not at aggregator level, but there are hundreds of account and it is not feasible to have this one by one for each account.Share0You can implement custom AWS Config rules to cover use cases that are specific to your organization. However, these controls are not implemented as AWS Control Tower controls. Instead, these controls are implemented as custom AWS Config rules outside of AWS Control Tower. And since you are managing hundreds of account, AWS Config Conformance Pack may work for your case.https://docs.aws.amazon.com/config/latest/developerguide/conformance-packs.htmlhttps://aws.amazon.com/blogs/mt/extend-aws-control-tower-governance-using-aws-config-conformance-packs/CommentShareJED007answered 5 months ago"


Question: Can Redshift authenticate to AWS Managed AD and how?

"If a customer wanted to use AWS Managed AD, how would Redshift be able to use it for authentication?I am guessing that one could install ADFS on Windows-EC2 and connect it to Managed AD.  Then one would setup the Redshift driver to federate to the self-managed ADFS on EC2.  Is this correct?  Has anyone ever done this and tested it?Is there a better way?FollowComment"

Answer: "0Accepted AnswerThere is a walk through blog post on configuring AD FS specifically targeted at Redshift, I would check and see if this workflow meets your requirements - https://aws.amazon.com/blogs/big-data/federate-database-user-authentication-easily-with-iam-and-amazon-redshift/CommentShareAWS-User-6679012answered 3 years ago"


Question: Deploying a .Net Application to AWS Amplify

"I'm attempting to deploy my first application (.Net) to AWS Amplify using the AWS Toolkit. I have previously successfully run through a step-by-step to deploy a test app and it's still there in the AWS Amplify Console, but now I've come to deploying my finished app, I'm unable to deploy it. If I right-click on the project I don't see the Publish to AWS option, only Publish to AWS Elastic Beanstalk. I think this might be because I'm doing it in .Net 4.7.2, not .Net Core. However, if I select that option I get to the option to specify an environment and URL and whatever I put in I'm getting "Error during URL validation; check URL and try again".If I create a .Core app, I do get the Publish to AWS option, but when I select it, I get the following 4 options, none of which are appropriate: ASP.Net Core App to AWS Elastic Beanstalk on Linux, ASP.NET Core App to AWS Elastic Beanstalk on Windows, ASP.NET Core App to Amazon ECS using AWS Fargate and ASP.NET Core App to AWS App Runner. There is no option to deploy to AWS Amplify. If I select the most appropriate, AWS EB on Windows, I get a message saying "Error occurred in the deployment tool"What is the recommended approach? I'm happy to deploy manually, but surely I'd have to package the app up in some way? What options do I have?FollowCommentLungaZ 5 months agoHi Nick. Are you currently trying to deploy an AWS Amplify backend function? Do you have a link for the step-by-step guide you used to deploy the test app?ShareNick 5 months agoHi LungaZ, this is what I'm trying to do: https://www.youtube.com/watch?v=JlJ7PmNIOac.I really wish I could find a decent step-by-step guide to deploy to Amplify, rather than Elastic Beanstalk!Share"

Answer: "0Hi Nick,AWS Amplify currently supports the following languages and frameworks:Frontent:JavaScriptReactReact NativeAngularVueBackend:Node.jsJavaPythonGoNET CoreTo Deploy a .NET frontend application to AWS Amplify, you must first build the application from your local or source-controlled environment, then publish to something like AWS Elastic Beanstalk. You can then use the AWS Amplify Console to create an Amplify App and configure the hosting environment for your app.To learn more about deploying to AWS Amplify, please have a look at https://docs.aws.amazon.com/amplify/latest/userguide/getting-started.htmlTo learn more about how to deploy .NET Core Backends to AWS Amplify, you can have a look at the blog: https://aws.amazon.com/blogs/developer/introducing-net-core-support-for-aws-amplify-backend-functions/CommentShareLungaZanswered 5 months agoNick 5 months agoyou don't know why I'm getting those errors though?ShareLungaZ 5 months agoHi Nick. Can you please share the error you are getting?ShareNick 5 months agoNothing in the front end, but in the AWSToolkit logs when I select Publish to AWS I get:"FailedToFindElasticBeanstalkSolutionStack","Message":"Cannot use Elastic Beanstalk deployments because we cannot find a .NET Core Solution Stack to use. One possible reason could be that Elastic Beanstalk is not enabled in your region if you are using a non-default region."I'm also getting the message "Error during URL validation; check URL and try again" when I select Publish To Elastic Beanstalk and specify the URLShare"


Question: How to close re:Post account?

How to permanently close/delete re:Post account?FollowComment

Answer: "-1To permanently close/delete a re:Post account, you can follow these steps:Log in to your re:Post account.Go to your account settings.Scroll down to the bottom of the page and click on the "Delete Account" button.You will be prompted to confirm that you want to delete your account. If you are sure, click on the "Delete Account" button again.Your account will be deleted permanently, and you will no longer have access to it.Please note that once you delete your account, all of your data, including your posts and messages, will be permanently deleted and cannot be restored. Also, any subscriptions or paid services associated with your account will be cancelled.If you have any issues deleting your re:Post account, you can contact the re:Post support team for further assistance.CommentShareAWS_Guyanswered 3 months agoChernetskyi 3 months agoI don't see the "Delete Account" button under any of the tabs on the Settings page. Can you provide the link to re:Post support? I can only find AWS Support which is not available under Basic plan.ShareTigerSC95 2 months agoI have the same problem as Chernetskyi. I have a second re:Post account that was accidently created when logged into the AWS console for one of my other organization accounts. I need to delete that account so I can link the underlying AWS SSO account to this re:Post account. I am not able to find the "Delete Account" option on the settings page (or any other screen) nor am I able to find a way to contact re:Post Support to request account closure.Share"


Question: Want to create a quicksight dashboard which will allow user to upload a simple csv file to an existing dataset

"Want to create a quicksight dashboard which will allow user to upload a simple csv file to an existing dataset.Suppose, one dataset has one column customer_id. This has 10 entries.I want to enable users to upload a new csv file having new set of 50 customer_ids and append in that existing dataset. Could you please help/suggest how to achive that in quicksight.Thanks.FollowComment"

Answer: "0Yes, it is possible to allow users to upload a CSV file and append it to an existing dataset in Amazon QuickSight. Here are the general steps to achieve this:Create a new dataset in QuickSight by connecting to the data source where you want to store the uploaded CSV file.Next, create a new data source that allows file uploads. Amazon S3 is a popular option for this, as it can be easily configured to allow file uploads.Create an Amazon Lambda function that will be triggered when a file is uploaded to the S3 bucket. This function should be able to process the CSV file and append the data to the existing dataset in QuickSight.Create an Amazon API Gateway to expose the Lambda function as an API endpoint. This will allow users to call the API and upload the CSV file to the S3 bucket.Finally, in QuickSight, create a new dashboard and add the dataset to it. Create a new data set with the same name as the existing data set and map the columns of the uploaded CSV file to the existing dataset columns.Create a button on the dashboard that allows users to upload a CSV file and call the API Gateway endpoint to trigger the Lambda function.This process is a high-level overview and you would need to do more research on how to set up and configure each of these services. But this should give you a good starting point.CommentSharejayamaheizenberganswered 4 months agoAni 4 months agoThank you @jayamaheizenberg for your response.But I am looking for this user upload option in quick sight itself so that user can get some nice interface to upload the file not aws s3 console by going to the bucket/folder and uploading the file there.Any suggestion on that please? Thanks again.Share0Also, "Create a button on the dashboard that allows users to upload a CSV file and call the API Gateway endpoint to trigger the Lambda function."  for this step,   how to create the button in dashboard ?CommentShareAnianswered 4 months ago0Hi, @Ani.You can embed external web pages into your dashboards and analyses, using custom visual content.https://docs.aws.amazon.com/quicksight/latest/user/custom-visual-content.htmlYou can use this to display a user interface for uploading.CommentShareEXPERTiwasaanswered 3 months ago"


Question: gamelift client NetworkReachability cunstructor missing in Unity build

"I get the following exception during runtime on android:MissingMethodException: Default constructor not found for type Amazon.Util.Internal.PlatformServices.NetworkReachabilityThe code below is executed:var client = new AmazonGameLiftClient("<accesskey>","<secret>",new AmazonGameLiftConfig { UseAlternateUserAgentHeader = false, RegionEndpoint = RegionEndpoint.USEast1 });I didn't have any issues running the game client on windows and the server running on linux.FollowComment"

Answer: "0Hi @gabetoth, Have you taken a look at this guide which lists out special considerations for Unity support, when using the AWS SDK? https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/unity-special.htmlCommonly, this seems to be an issue with not adding a link.xml file to the Assets folder, that lists all AWSSDK assemblies being used. Could you try this to see if it solves your problem?CommentShareShashankJ_AWSanswered a year ago"


Question: AWS Lambda Ruby 2.7 end of life (March 2023)

Lambda runtime is limited to Ruby 2.7.x which is EOL soon (March 2023).Will Lambda support Ruby 3 before 2.7's EOL?FollowComment

Answer: "0ruby 3 is not supported at this time, but per [1] you should be able to continue using the (2.7) functions, butit will no longer be supported/updated/etcIf you need to run the ruby 3 run time you can look at using custom lambda runtimes [2]you can also have a look at [3]There are also no supporting documentations that indicate when we will support ruby 3.[1] https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtime-support-policy[2] https://docs.aws.amazon.com/lambda/latest/dg/runtimes-custom.html[3] https://repost.aws/questions/QU1UUAdfPHS5Gvi5UFjsULDQ/does-the-ruby-lambda-runtime-support-ruby-3-0CommentSharerePost-User-9657391answered 4 months ago"


Question: Does 'stopping' the 'EC2 Instance' of my Win 2019 server save on my 750 hours usage when not RDP'ing on

"Hi Members, just a little knowledge pleaseDoes 'stopping' the 'EC2 Instance' (a Windows Server 2019 ) save my 750 hours free usage whenever I don't RDP onto the VM?, does 'Stopping' the machine  mean I will loose my installed software, configurations and/or personal settings?I have also chosen to have an 'Elastic IP', so buy 'Stopping' my EC2 Instance will I lose my static allocated IP address (I understand there is a charge to maintain the Elastic IP allocation when an instance is stopped)Any help or advice would be appreciated.RegardsFollowComment"

Answer: "2Accepted AnswerHey there! Stopping an instance does save on the 750 free hours of free usage. An instance in the stopped state isn't running, so can't be RDPed into. A running instance on the other hand, is using those hours even if it isn't being RDPed into. As long as the Windows instance in question has an EBS volume, stopping the instance will not remove any software, configurations, etc. It's basically like a computer that is turned off.Elastic IPs that are attached to the instance will stay on the instance, even when stopped. It will not be removed from the instance until you explicitly remove it, or the instance is terminated. (Even then the IP remains in your account to be reused until you explicitly release it.)CommentShareJack Hemionanswered 9 months agoPaul Frederiksen 9 months agoJust to add to this, you save on the instance costs, but the EBS volume will still be billable.Share1Thank you to both members for the great help, and for clarifying the effects of a 'stopped' server , also for the link related to stopping an instance and confirming when retaining an Elastic IP in that a charge applies while an instance is stoppedCommentShareLico9182answered 9 months ago0Hello,Read through the below doc for the official information & wording. The public IPv4 address that Amazon EC2 automatically assigned to the instance on launch or start.Since you ve chosen Elastic IP, Note that when the instance is stopped, we start charging you for the associated Elastic IP addresses.Link- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html#what-happens-stop -- [1]CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months agoSUPPORT ENGINEERMonica_Lluisreviewed 9 months ago0Thanks Jack for your additional commented information about EBS storage being billable while an Instance is stopped.I just wanted to say that using the AWS Virtual Machine service is really showing itself to be a great product, and very convenient. The rePost forum and it's members have also been really helpful, thank you all.I am at present using my EC2 Instance within the 'Free Tier' package, and definitely see the value of a paid package.RegardsCommentShareLico9182answered 9 months ago"


Question: Dummy SMTP using SES

"Hi,We have a use-case where we want to use SES SMTP interface for our business applications to send emails. But instead of actually sending emails, would like to write the passed in parameters to S3. Is this doable? I don't see it in the documentation. Something along these lines: https://pypi.org/project/nullsmtp/Thanks,JGPFollowComment"

Answer: "0Hi JGP,I could understand your use-case where you particularly checking if there is any feature in SES to send emails, where you do not actually should send an email but rather should be able to store the information about that email to S3.I would like to tell you SES is just a relay server and it just receives and forwards the messages, without keeping any details or comprehensive logs/parameters at its end. Also, SES do not currently have any feature in place to store parameters of emails to S3/or at its own end(at SES's end), with/without actually sending the emails.However, if you’re sending the emails to recipients and wants to receive notification about the deliveries, bounces, complaints etc, for that I’d suggest you to check Amazon SNS notifications for SES. To know more about how to configure and what all the notifications consists of, Please have a look at the link shared below:https://docs.aws.amazon.com/ses/latest/DeveloperGuide/configure-sns-notifications.html#configure-feedback-notifications-consolehttps://docs.aws.amazon.com/ses/latest/DeveloperGuide/notification-examples.htmlhttps://docs.aws.amazon.com/ses/latest/DeveloperGuide/notification-contents.htmlI hope that helps. If you have any further questions for me, please feel free to reach out.Thanks, and have a great day ahead!CommentShareAWS-User-4590409answered 4 years ago"