Question: AWS Glue Job - Job Bookmark - Read from JDBC RDS Postgres instance and write parquet files into S3 on daily basis

"Hi. I'm building up/developing a pipeline in AWS using AWS Glue.Context:I'm extracting data from RDS AWS Postgres instance. This instance is a productive database of a mobile app (OLTP).Goal:Extract historical and incremental data.Setting up Glue PySpark jobs in order to extract not only the historical data but also the "daily deltas". Write parquet files on S3 bucket daily folders.Up to now:I've already scheduled a Crawler, it updates and map tables and schema, weekly.Most of the RDS tables have this 3 fields:"id""created_at""updated_at"The app's backend inserts new rows in the RDS ("created_at" == "updated_at"), but also updates (not changing the ID) previously inserted rows (so "created_at" < "updated_at")On the first job run with bookmark enabled, it will grab the historical data, on the second run (lets say T+1), will the bookmark catch the updated rows?Besides this, is there any other consideration or advice you see worth sharing?Thank you in advance.FollowComment"

Answer: "2By default it will bookmark on the PK, so it won't detect updates but if you always update the updated_at column with a timestamp when doing changes and you specify updated_at as a jobBookmarkKeys (see the documentation), then it will retrieve those updated rows as well as the new ones in the next run.CommentShareGonzalo Herrerosanswered 20 days ago"


Question: Cannot  remove EB applications nor add environment - _underscore_ issue?

"Hi,I've created two empty (with no environment) EB applications: 'dijx_WWW_1' and 'dijx_WWW_1_prod'. Now, when I try to remove them, I can't.using web console - after retyping app name 'delete' buton is still inactiveusing CLI - nothing happens and --debug is here: https://paste.centos.org/view/9caf667cSimilarly, when I'm trying to add environment for those apps, an error occurs:Invalid Parameter ValueNo Application named 'dijx_WWW_1' found.FollowComment"

Answer: "0Figured it out by myself... that was not an underscore issue, that was heading space issue - it was not visible in app name in console, not visible in CLI aws --debug output and not visible in web console error while adding environment - it was visible however in application ARN.Deffinitely a bug, console is not doing stripping of heading spaces - at least when create empty app (not starting from environment page)CommentSharedijxanswered 3 years ago"


Question: Save / backup Athena view

"From AWS documentation, i can see that one of the main differences between Athena views vs Athena CTAS tables is that views don't actually contain or write any data. If a customer wants to persist / back up a view, is the best practice  to have them create a CTAS so the data is persisted in S3? Or something else? Thanks!FollowComment"

Answer: "0Accepted AnswerHi ,A View in SQL is a logical object and by design is ephemeral.If the customer requirements is to have a persistent copy of the view they should use a CTAS.If their goal is actually to save the query result (running on that view or even on a table) they can follow the instructions in this documents (to backup the full view they could run a Select * from View):https://aws.amazon.com/premiumsupport/knowledge-center/access-download-athena-query-results/https://docs.aws.amazon.com/athena/latest/ug/querying.html#query-results-specify-locationhope this helpsCommentShareEXPERTFabrizio@AWSanswered 3 years ago"


Question: "AWS Sagemaker Notebook Not working ,how can i solve the issue?"

The code failed because of a fatal error: Error sending http request and maximum retry encountered..Some things to try: a) Make sure Spark has enough available resources for Jupyter to create a Spark context. b) Contact your Jupyter administrator to make sure the Spark magics library is configured correctly. c) Restart the kernel.Note: There are no such logs on cloudwatch to figureout the issue.FollowComment

Answer: 0Try using a Python 3 kernel instead of the PySpark kernel. Found that suggestion here: https://stackoverflow.com/a/68663849CommentShareyann_stonemananswered 8 months ago


Question: Working with AWS API{Message Forbidden}

"I have done the following :1.Added invoke Function "Addpermission"API with the following command.aws lambda add-permission --function-name FunctionName --principal iot.amazonaws.com --source-arn AuthorizerARn --statement-id Id-123 --action "lambda:InvokeFunction"2.Verify Authorizer Response with  the commandaws iot test-invoke-authorizer --authorizer-name NAME_OF_AUTHORIZER --token TOKEN_VALUEIn AWS CLI. gives the following error:aws: error: argument operation: Invalid choice, valid choices are:And  Postman API is still giving {message Forbidden}    :(Note:TOKEN_VALUE is up to dateFollowComment"

Answer: "0Make sure of below:The function name must exist in the same region you are running the command in.The function name is correctThe --source-arn parameter is set to AuthorizerARn. Not sure if the typo "ARn", instead of "Arn" is affecting that. Regardless, the ARN must be correctThe Lambda authorizer exists in your account.The lambda function is implemented correctly by returning a valid IAM policy (https://aws.amazon.com/blogs/compute/introducing-iam-and-lambda-authorizers-for-amazon-api-gateway-http-apis/)CommentShareEXPERTalatechanswered 4 months ago"


Question: Crowd HTML Element for NER does not allow for overlapping annotations like the current Ground Truth allows

I am able to make an A2I UI that allows for NER annotation and classification (based off of https://github.com/aws-samples/amazon-sagemaker-ground-truth-task-uis/blob/master/text/named-entity-recognition-with-additional-classification.liquid.html).However the NER interface doesn't allow for overlapping annotations like Sagemaker Ground Truth's NER interface does. Is there a way to get overlapping annotations in A2I for NER?FollowComment

Answer: "0Hi,Currently the crowd-entity-annotation widget does not allow for overlapping. I will create a feature request for this.CommentShareSUPPORT ENGINEERThayin_Manswered 5 months ago"


Question: IoT Core MQTT msg sending frequency difference between QoS0 and QoS1

"Hello, I modified the sample program basicPubSub of aws-iot-device-sdk-python and try to send mqtt msg to Iot Core at 10Hz. Also I use AWS MQTT test client to subscribe and monitor the mqtt msg.I didn't change the AWSIoTMQTTClient connection configuration and only change the QoS by the function myAWSIoTMQTTClient.publish(topic, messageJson, _qos).For _qoS=0, the sending loop time is about 0.1s and MQTT test client update the msg at about 10Hz.However, for _qos=1,   the sending loop time become about 0.4~0.7s and MQTT test client update the msg at about 2Hz.I wonder how to improve the QoS1 sending rate and what is the max frequency for it. Many thanks.Below is my code for the main loop.if args.mode == 'both' or args.mode == 'publish':    message = {}    message['message'] = args.message    message['sequence'] = loopCount    messageJson = json.dumps(message)    myAWSIoTMQTTClient.publish(topic, messageJson, _qos)    # if args.mode == 'publish':    # print('Published topic %s: %s\n' % (topic, messageJson))    loopCount += 1toc = time.time()t_interval = toc -tictic = tocprint('[%f]Published topic %s: %s\n' % (t_interval,topic, messageJson))time.sleep(0.1)FollowComment"

Answer: "1Accepted AnswerHi. In your current code, your QoS sending loop time is almost entirely governed by your time.sleep(0.1) call.That sample is using the publish() method and it's a blocking call for QoS 1. It will wait for the PUBACK from AWS IoT Core before the call returns: https://github.com/aws/aws-iot-device-sdk-python/blob/0b195b82349e2d5b9715d4880da747bfbaaa1437/AWSIoTPythonSDK/core/protocol/mqtt_core.py#L267-L273You would likely instead prefer the publishAsync() method. This will not block, and instead allow you to have multiple QoS 1 transactions in flight at once. Please see this sample: https://github.com/aws/aws-iot-device-sdk-python/blob/master/samples/basicPubSub/basicPubSubAsync.pyIf you aren't already, you should use the AWS IoT Core endpoint that is in the nearest region, to minimize the round trip time. And if you really want to maximize the throughput, you should remove the time.sleep() altogether.Note that IoT Core has a limit of 100 publishes per second per client connection. And a maximum of 100 inbound QoS 1 transactions can be in flight at any one time. https://docs.aws.amazon.com/general/latest/gr/iot-core.html#message-broker-limitsFinally I would recommend you instead use the V2 SDK: https://github.com/aws/aws-iot-device-sdk-python-v2. From the V1 README:A new AWS IoT Device SDK is now available. It is a complete rework, built to improve reliability, performance, and security. We invite your feedback!This SDK will no longer receive feature updates, but will receive security updates.CommentShareEXPERTGreg_Banswered 9 months agorePost-User-1677271 9 months agoThank you for your reply. I haven't tried V2 SDK yet but publishAsync() solved the problem. Really appreicate it!.Share"


Question: Sagemaker instances keep awakening and charge the credit

"I have tried Data Wrangler in Sagemaker last month and close the service. A few weeks later I have noticed the credit was charge $1 every hour and just realized that the Data Wranger auto-save the flow every minute. So, I deleted the unsaved flow and shut down all the services and instances according to advice on these two links :https://docs.aws.amazon.com/sagemaker/latest/dg/studio-lab-use-shutdown.htmlhttps://docs.aws.amazon.com/sagemaker/latest/dg/ex1-cleanup.htmlThen, I left the Sagemaker untouched for the whole month of May, and just got back to the console yesterday. This is what I found out for May's bill:Amazon SageMaker RunInstance $531.74DetailUsageTotal$0.00 for Host:ml.m5.xlarge per hour under monthly free tier125.000 Hrs$0.00$0.00 for Notebk:ml.t2.medium per hour under monthly free tier107.056 Hrs$0.00$0.00 per Data Wrangler Interactive ml.m5.4xlarge hour under monthly free tier25.000 Hrs$0.00$0.23 per Hosting ml.m5.xlarge hour in US East (N. Virginia)88.997 Hrs$20.47$0.922 per Data Wrangler Interactive ml.m5.4xlarge hour in US East (N. Virginia)554.521 Hrs$511.27So, with another attempt, I installed an extension to automatically shut down idle kernels and set the limit to 10 min from advice here:https://aws.amazon.com/blogs/machine-learning/save-costs-by-automatically-shutting-down-idle-resources-within-amazon-sagemaker-studio/Checked the cost in usage report, it turns out that the service was shut down after installing the extension but then it revoked itself after 5 hours later (during my sleep time). There's still cost from Studio although with less charge than previous one.ServiceOperationUsageTypeStartTimeEndTimeUsageValueAmazonSageMakerRunInstanceUSE1-Studio_DW:KernelGateway-ml.m5.4xlarge5/24/2022 23:005/25/2022 0:001AmazonSageMakerRunInstanceUSE1-Studio_DW:KernelGateway-ml.m5.4xlarge5/25/2022 0:005/25/2022 1:001AmazonSageMakerRunInstanceUSE1-Studio_DW:KernelGateway-ml.m5.4xlarge5/25/2022 1:005/25/2022 2:001AmazonSageMakerRunInstanceUSE1-Studio_DW:KernelGateway-ml.m5.4xlarge5/25/2022 2:005/25/2022 3:000.76484417AmazonSageMakerRunInstanceUSE1-Studio_DW:KernelGateway-ml.m5.4xlarge5/25/2022 8:005/25/2022 9:000.36636722AmazonSageMakerRunInstanceUSE1-Studio_DW:KernelGateway-ml.m5.4xlarge5/25/2022 9:005/25/2022 10:000.38959556During this time, I'm sure that there're no running instances, running apps, kernel sessions or terminal sessions. I even deleted the user profile. Last thing I haven't tried is to set up scheduled shutdown coz I think the services should not cause difficulty to our life that much. Any advice for any effective action to completely shutdown the Sagemaker instance?  Thanks.FollowComment"

Answer: "0Hi, you can shut down SageMaker Studio resources per the documentation here - https://docs.aws.amazon.com/sagemaker/latest/dg/notebooks-run-and-manage-shut-down.html (you've linked to Studio Lab documentation, so making sure). In addition, I see you've been charged for hosting and you've since deleted the endpoints, and don't see the hosting charges after deleting them.For data wrangler, once you have the flow saved, you need to shut down the app (closing the window does not automatically shut down the app). Note that if you open the DW flow later, it does start a compute instance, which you'll then have to shut down.If you've deleted the user profile (and associated apps), you shouldn't be seeing any more Studio charges for that user profile. If you still see the DW charges (and there's no other user profile), please cut a ticket to support for further investigation.CommentShareDurga_Sanswered a year ago"


Question: How to commit part of instances to Saving Plan

"Let's say I have 10 instances in a region, can I just commit 6 instances (2 t3-xlarge, 2 t3-small, 2 m5-xlarge) to EC2 Saving Plan 1-y term? How to type the commitment number in the field?FollowComment"

Answer: "3Accepted AnswerYes, you can choose to purchase Savings Plan for a part of your usage. Savings Plan work on hourly commitments (measured in $/hour) so when you purchase a Savings Plan you will be asked for the following: Savings Plan Type - Could be Compute/ EC2/ SageMaker; Term - 1 year/ 3 years; Purchase Commitment - Here you need to enter the hourly commitment in USD; Payment Option - All Upfront/ Partial Upfront/ No Upfront.If you go for EC2 Savings Plan, you will be asked for the Region and Instance Family details as well. This is because EC2 Instance Savings Plans give you the flexibility to change your usage between instances within a family in that region.To understand what could be a baseline for your hourly commitment, you can view the Savings Plans recommendations provided in AWS Cost Explorer. The recommended hourly commitment is based on your historical On Demand usage and your choice of plan type, term length, and payment option. Once you sign up for a Savings Plan, your compute usage will automatically be charged at the discounted Savings Plans prices and any usage beyond your commitment will be charged at regular On Demand rates.In this case, as you have T3 and M5 instance families, you can go for one Compute Savings Plan or two EC2 Savings Plan depending on your requirements. Compute Savings Plan would provide you with the most flexibility while EC2 Savings Plan would provide the lowest prices.CommentShareEXPERTShreya Pathakanswered 9 months agoEXPERTChris_Greviewed 9 months agoAWS-User-8431016 9 months agoIf I would like to commit one instance from same family but leave others unchanged, how to do it? This is for EC2 Instance Savings PlansShare"


Question: [Announcement] Run Your Microsoft SharePoint and SQL Server Always On Availability Groups in the AWS Cloud More Easily by Using AWS Directory Service for Microsoft Active Directory

"Today, we made it easier for you to run Microsoft SharePoint and SQL Server Always On availability groups in the AWS Cloud. With AWS Directory Service for Microsoft Active Directory (Enterprise Edition), also known as AWS Microsoft AD, you can now migrate additional Windows workloads such as SharePoint and SQL Server Always On availability groups without the complexity of building and maintaining your own Active Directory (AD) infrastructure. Using the AD security features announced recently, you can provide single sign-on (SSO) to Microsoft SharePoint by using AWS Microsoft AD, and improve the security of SQL Server Always On availability groups.With AWS Microsoft AD, you can use a single directory to support Microsoft SharePoint and SQL Server Always On availability groups, as well as AWS services such as Amazon WorkSpaces and Amazon QuickSight. You also have the flexibility to use identities from your on-premises directory or managed directory in the AWS Cloud. AWS Microsoft AD uses actual AD running on Windows Server 2012 R2 and does not require you to synchronize or replicate data from your existing AD to the cloud. With just a few clicks, you can create a highly available, managed AD. AWS handles all of the security patching and software updates.Currently, AWS Microsoft AD is available in the US East (N. Virginia), US East (Ohio), US West (Oregon), EU (Ireland), EU (Frankfurt), EU (London), Canada (Central), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), and Asia Pacific (Tokyo) Regions.This feature is now available to all AWS Microsoft AD customers at no additional charge. For existing AWS Microsoft AD customers there is no additional setup in the Directory Service console required.To get started with AWS Microsoft AD, visit the Directory Service console and create your directory.FollowCommentNguyen_M SUPPORT ENGINEERa year agoThis is an announcement migrated from AWS Forums that does not require an answerShare"


Question: "Users can see ALL files and folders in search, regardless of permission"

"In WorkDocs, if a user searches for something in the search box, folders and files will be returned that the user does not have permission to view. The user can view the folder or file, despite not having permission.Is there a setting I'm missing somewhere or is this an issue with the feature?FollowComment"

Answer: 0I figured it out. I had created share links that were set to edit. I deleted the links and it fixed the problem.CommentShareAlex9answered 4 years ago


Question: WebSocket handshake: Unexpected response code: 403

"Hi there!I am having problems connecting to a websockets API created with Terraform.In order to create it I did the following:I used Serverless to create a websockets API. Serverless example Websockets API works perfectly.Then I took the generated Cloudformation and I used the aws_cloudformation_stack resource in Terraform to create the API.Lambda functions are created using Terraform and instead of including the whole cloudformation template copied and adapted from Serverless, I have removed the Cloudformation lambda related resources and I used the ARN generated by Terraform, passed via parameters.The thing is, side by side, both APIs look exactly the same. Navigating the AWS UI all routes are created fine and the lambda functions are integrated correctly (apparently)I can also execute the lambda functions independently and the console.logs are correctly written in the cloudwatch.The problem is that when I try to connect to the Serverless API it works perfectly, but the Terraform API I receive a WebSocket handshake: Unexpected response code: 403Any suggestions?FollowComment"

Answer: "0Ok, I found out terraform / cloudformation template was not creating any deployment stage and therefore $routes were not connecting with the lambdas.Notice that if you had a previous stage with the same name, you won't see the error.I still didn't found how to create them using terraform. cloudformation, but if I create it manually the error disappears.Thanks!Edited by: XaviColomer on Nov 10, 2020 3:22 AMCommentShareXaviColomeranswered 3 years ago"


Question: MariaDB 10.2 and php7.3 not possible at the same time?

Is it not possible to install php7.3 and MariaDB 10.2 at the same time?When I try to I get this error:amazon-linux-extras install lamp-mariadb10.2-php7.2Refusing because lamp-mariadb10.2-php7.2 could cause an invalid combination.Could something else be causing that error?FollowComment

Answer: "0Accepted AnswerThank you for bringing this to our attention.  We created the lamp-mariadb10.2-php7.2 extra as a convenience, to install most of the LAMP stack with a single operation.  At the time we created it, PHP 7.2 was the latest-and-greatest, so it was the obvious choice.The MySQL-related modules we provide for the various PHP versions in our extras are not compiled against any specific client libraries, so they should be able to connect to any MySQL-alike processes, like MariaDB.  All of the PHP versions we provide share this, so there's no technical reason why you can't use PHP 7.3 with our MariaDB packages, other than the fact that we don't make them available in compatible channels.We are evaluating how we should best rearrange our extras, to correct this limitation and provide a future-proofed solution.CommentShareAWS-User-6280256answered 4 years ago0@AWStrinity, did you ever get around to fixing this? We would very much like to upgrade to PHP 7.4, but AFAIK currently cannot without leaving the comfort of Amazon-provided packages, as MariaDB (or any MySQL flavor) only seems to be available through the lamp-mariadb10.2-php7.2 extra.CommentShareDennisDKanswered 3 years ago0PHP 7.2 is about to enter end of security support by end of this year.Is there any forecast of when will AWS update Linux 2 extras to give support to MariaDB and PHP 7.4 ?CommentShareRtraueranswered 3 years ago0Same question, any update on this?Need to be able to install mariadb with php 7.4CommentShareP4bl0answered 2 years ago0I got tired of waiting for them to update amazon-linux-extras and just use the packages from mariadb.org directly.Here's some extract (hopefully all the relevant bits; I'm also configuring PHP & Mariadb some more than just this) from a cloud-init user-data I use for a Wordpress server (though of course the forum is butchering the formatting):yum_repos:    mariadb:      baseurl: https://yum.mariadb.org/10.5/centos7-amd64/      name: MariaDB      enabled: true      gpgkey: https://yum.mariadb.org/RPM-GPG-KEY-MariaDB      gpgcheck: 1  packages:   - php-xml   - php-gd   - php-mbstring   - MariaDB-server  I'm sure some of you would be more comfortable if you could use Amazon's own package repository, but I find if I want updated packages I generally need to get them more directly.CommentSharepetercooperjranswered 2 years ago0I have been looking for a solution to this too (installing PHP 7.4 on EC2 with MariaDB).Can you provide some shell commands to get this going, if the whole LAMP package is not yet available in the amazon-linux-extras repo?CommentSharemunichawsanswered 2 years ago0Also since PHP 8 is out now and stable, would that be the better choice?  Hosting a Wordpress site here.CommentSharemunichawsanswered 2 years ago0The locked versions are ancient by now. Not much of a convenience if you never update to current versions, then it's more like a straitjacket.CommentShareDennisDKanswered 2 years ago"


Question: Spot instances for inference and sagemaker?

"Is it possible to deploy spot inf1 instances on sagemaker? We run an API 24/7, and it's costly to keep it up, considering we only have 2 hours of peak performance a day.We don't shut off those machines because we might have random bursts of traffic during the day that CPU instances can't hold.Alternatively, we could deploy spot EC2 inf machines; however, I'm unsure how I would invoke them from gateway and lambda. Does anybody have a tip or recommendation for our case?Thanks!FollowComment"

Answer: "0You could possibly integrate EC2 Spot instance fleet with Application Auto Scaling service to spin up or down spot instances when you receive traffic. To scale it down to 0 instances, you will need to configure a queue to hold the requests while you spin up from 0 instances to 1 or more. Then your application would insert the requests in the SQS queue and wait for an instance to be available. Take a look at this link for more information on how to configure application autoscaling with Spot instances:https://docs.aws.amazon.com/autoscaling/application/userguide/services-that-can-integrate-ec2.htmlTo configure your policy for the autoscaling, you can look at SQS queue length metric. Here is how you can set a target tracking policy for the application autoscaling:https://docs.aws.amazon.com/autoscaling/application/userguide/create-target-tracking-policy-cli.htmlCommentShareWill_Banswered a year ago"


Question: Configure EC2 instances with workload option

"Hi team,We have a requirement to configure EC2 instance with Daily spike traffic in order to minimize the monthly cost.I would need how to configure the instance with below details. EC2 instance type is r5.xlarge. Windows server with SQL web editionWorkload:Daily spike traffic.Workload days5 days a week.Baseline 0Peak 1Duration of peak (hours, minutes)12 hours daily.Thanks in advance.FollowComment"

Answer: "0Hello,Amazon EC2 Auto Scaling helps you ensure that you have the correct number of Amazon EC2 instances available to handle the load for your application. You create collections of EC2 instances, called Auto Scaling groups. You can specify the minimum number of instances in each Auto Scaling group, and Amazon EC2 Auto Scaling ensures that your group never goes below this size.To create and manage scheduled actions. Please follow the procedure described in the guide:https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-scheduled-scaling.htmlCommentShareFadi Almasrianswered 10 months agorePost-User-8554103 10 months agoI will need to deploy only one EC2 instance, Auto scaling feature does not work.Why i would to configure EC2 with these specifications, to minimize the cost.Daily workload days- 5 days in a week, 2 days instance needs to be shutdown.Baseline value must be set to 0Peak value must be set to 1EC2 instance run 12 hours daily.ShareFadi Almasri 10 months agoHello,You said: "I will need to deploy only one EC2 instance, Auto scaling feature does not work." Can you please elaborate on that?Share"


Question: Polly - Password speech

"Hey guys,I have an automation which is retrieving an auto generated password from client end using lambda. After that, we are using Amazon Connect to transmit the password to the costumer.However, as password it is case-sensitive, I didn't find a way to use the Polly (integrated with Connect) in the available SSMLs to IA to say the upper and lower cases of the password.There is any alternative solution for this?FollowComment"

Answer: "0Accepted AnswerSpeaking only about Amazon Polly you could create a lexicon<?xml version="1.0" encoding="UTF-8"?><lexicon version="1.0"      xmlns="http://www.w3.org/2005/01/pronunciation-lexicon"      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"      xsi:schemaLocation="http://www.w3.org/2005/01/pronunciation-lexicon        http://www.w3.org/TR/2007/CR-pronunciation-lexicon-20071212/pls.xsd"      alphabet="ipa" xml:lang="en-US">  <lexeme>    <grapheme>A</grapheme>    <alias>capital A</alias>    <grapheme>B</grapheme>    <alias>capital B</alias>    <grapheme>C</grapheme>    <alias>capital C</alias>      </lexeme></lexicon>and use the lexicon only for the request that spells out the case - sensitive text, for example with AWS SDK:aws polly synthesize-speech --voice <VoiceId> --text-type ssml --text '<speak>A, B, c</speak>' --lexicon-names 'capitals'  --output-format mp3 --region us-east-1  ./out.mp3I don't know if Amazon Connect allows for using lexicons. If not, you can embed the pronunciation directly in SSML:aws polly synthesize-speech --voice <VoiceId> --text-type ssml --text '<speak>A, B, c</speak>' --output-format mp3 --region us-east-1  ./out.mp3CommentShareszymon-awsanswered 4 months agoThiago Mesquita 4 months agoThanks so much.It may not be very applicable for what I'm doing. So I've followed a different path, doing it directly in the Lambda code, to break the password in different variables and renaming, as you did. Hence, Amazon Connect just needs to read back the variable's value.Share0Doesn't look like Polly supports the interpret-as the same way other vendors do it. I see two options: Change the password generator to not include capital letters. Create a Lambda which takes the password, generates a custom prompt "P4ss" like "Upper case P, the number four, lower case s, lower case s.". Actually neither one of these are very good, can you SMS the password to the caller? Ultimately, that might be the better option. Or maybe email it to their backup email in case they have lost access to their primary email.davidCommentSharedmaciasanswered 4 months agoThiago Mesquita 4 months agoYes, I've followed the Lambda path, breaking the password in different variables with the edited value for each character. Thanks for the help.Share"


Question: Amplify Console - Deployed app not reflecting most recent build artifact

"After successful build and deploy on the branch designated as production, the updates are not visible in browser. Does not matter if I clear cache, incognito, or use a different browser.Downloading the build artifact and serving locally, I can see the most recent changes there, so it is pulling latest, it's just not updating in the deploy... it's an Angular app and I can see in the deploy logs it's skipping deployment for the main js file. Are there settings to specifically invalidate cache or force deploy all files?Also, adding a new deploy branch (duplicate of prod branch), goes through build process, but the end result is an empty page.arn:aws:amplify:us-east-1:982596532987:apps/d3iz4q6jlk6vdaFollowComment"

Answer: "0Hi uievan,This may be related to an issue with our deployment system that we've since fixed. Can you take another look at your app? Please let us know if you are still experiencing this issue or if it has been resolved.Thank you,DanCommentShareDanG_AWSanswered 4 years ago0Seems it was the issue you were referring to, started working again.CommentShareuievananswered 4 years ago0@DanG_AWS,the issue remains. My app arn:aws:amplify:eu-west-2:579766394847:apps/d2ke7lrdbfu802 always show the very first deployment on the generated URL, all later deployments were ignored.CommentSharerePost-User-1900598answered 9 months ago"


Question: copy jar code and call lambda from lacal

"Hi Team,I have a maven project to sync a changesets on my databases in different environments via a lambda function.after I add my DB changeset on the filerun mvn packagecopy the generated .jar on my lambdarun the lambda(for local DB) to reflect new changes on the DB.loclly those steps are manual, so I run the lambda against my local DB to make sure everything is ok before pushing the changes in my repo to reflect the changes automatically in others env.I would like to automate those 3 steps locally so I don't do them manually each time I have to make a change in my DB.In other env those steps are automated via the BuildSpec file.I would like to know if there is a best way to automate them in local (script ? ... buid the project mvn, copy the jar, run the lambda, get response from lambda...)Thank you.FollowComment"

Answer: "0Hi there, yes similar to the BuildSpec file, in local you can create a script or along with a cron job that run these tasks automatically. In your script you can run build commends or invoke another build script, invoke lambda via AWS CLI, and parse the response to do whatever actions needed.CommentShareSUPPORT ENGINEERZhiyuan_Lanswered a year ago"


Question: "Creating, attaching, formatting, mounting, etc. an EBS volume(s) for Ubuntu Linux during CFT stack creation using UserData..."

"I am trying to create a disk/drive during the creation of my Ubuntu system while running my Cloudformation Template. I am using the "UserData" section to initialize the resource. Below is the UserData "bash" commands that I've tried. I seem to be missing something. How can you "map" the "/dev/xvdb" device to the "nvme[n]n1" moniker. How can this be done? Thoughts?I found a number of resources (as well as other posts), but they don't appear to be effective:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-using-volumes.htmlhttps://github.com/binxio/ec2-boot-mount-ebs-volumehttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nvme-ebs-volumes.htmlhttps://serverfault.com/questions/725628/unable-to-mount-ebs-drives-to-an-ubuntu-box-using-aws-cloudformation-userdata-n...UserData section(s):"UserData"       : { "Fn::Base64" : { "Fn::Join" : ["", [    "#!/bin/bash\n",    "mkdir /data\n",    "blkid $(readlink -f /dev/xvdb) || mkfs -t ext4 $(readlink -f /dev/xvdb)",    "e2label $(readlink -f /dev/xvdb) aro-data",    "sed  -e '/^[\/][^ \t]*[ \t]*\/data[ \t]/d' /etc/fstab",    "grep -q ^LABEL=aro-data /etc/fstab || echo 'LABEL=aro-data /data ext4 defaults' >> /etc/fstab",    "grep -q \"^$(readlink -f /dev/xvdb) /data \" /proc/mounts || mount /data",...or"UserData"       : { "Fn::Base64" : { "Fn::Join" : ["", [   "#!/bin/bash\n",   "mkdir /data\n",   "mkfs -t ext4 /dev/nvme1n1\n",      <-- Used "/dev/nvme0n1" too though I know it changes   "echo $(blkid -o export /dev/nvme1n1 | grep ^UUID=)       /data  ext4    defaults,nofail 0       2 >> /etc/fstab\n",   "mount -a\n",...This is what I see once the instance is created:>lsblkNAME        MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTloop0         7:0    0   97M  1 loop /snap/core/9665loop1         7:1    0 28.1M  1 loop /snap/amazon-ssm-agent/2012loop2         7:2    0 55.7M  1 loop /snap/core18/2745loop3         7:3    0 24.4M  1 loop /snap/amazon-ssm-agent/7269nvme0n1     259:0    0  100G  0 disk└─nvme0n1p1 259:1    0  100G  0 part /nvme1n1     259:2    0  500G  0 disk       <-- So the volume appears to have been created and attached. But not mounted?-- These are the sections outlining the volumes:"BlockDeviceMappings" : [    {        "DeviceName" : "/dev/sda1",        "Ebs" : {             "VolumeSize" : {"Ref": "RootVolumeSize"},            "VolumeType" : "gp3"         }     }],"Volumes" : [    { "VolumeId" : { "Ref" : "DataVolume" }, "Device" : "/dev/xvdb" }],"DataVolume" : {    "Type" : "AWS::EC2::Volume",    "Properties" : {        "Size" : {"Ref": "DataVolumeSize"},        "Encrypted" : "true",        "AvailabilityZone" : { "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "az" ]},        "VolumeType" : "gp3"    }},"dataattachment" : {    "Type" : "AWS::EC2::VolumeAttachment",    "Properties" : {       "InstanceId" : { "Ref" : "EC2Instance" },       "VolumeId"  : { "Ref" : "DataVolume" },       "Device" : "/dev/xvdb"    }}FollowComment"

Answer: "0Once the instance has booted can you check that the user data script is created correctly? You can see this via the Console or by logging on to the instance in /var/lib/cloud/instances/i-*.It looks like there are some '/n' missing from the script above.If you find the user-data.txt file in /var, copy to /tmp as user-data.sh, chmod 755, then run it by hand to see if there are errors.CommentShareEXPERTkentradanswered 20 days agomarkwilhelm 19 days agoDidn't solve the issue, but great information. I didn't know about the "copy" of the user-data.txt and that's extremely useful - very helpful for debugging. I did correct the missing '/n's, but that didn't seem to be the issue.Share0If you have only two block devices then the second device is always going to be the last disk device row of the lsblk output. So extract the name by chopping up the output of the command, e.g.$ SECOND_DISK=/dev/`lsblk -l | grep -w disk | tail -1 | awk '{print $1}'`$ echo $SECOND_DISK/dev/sdbThen use this variable in the commands to create and mount the volume, updating the fstab, and so on.CommentShareRWCanswered 20 days agomarkwilhelm 15 days agoThanks, but I have one question:  The "lsblk" output order, per the man pages, doesn't seem to agree on the "order" of output. Why do you say that it will always be the drive I'm looking for?       The default output, as well as the default output from options       like --fs and --topology, is subject to change. So whenever       possible, you should avoid using default outputs in your scripts.       Always explicitly define expected columns by using --output       columns-list and --list in environments where a stable output is       required.I ran this 3 times and it worked, the next 2 times it didn't (the nvme?n1 was already "taken"). So it seems like it isn't always the last drive listed.Any thoughts on this?  I was hoping to map the device setting in the cft to the nvme?n1, but it doesn't seem to be possible. I'll try -o the output and sort it somehow.Share0Well, I'm posting what I went with, though I'm still not happy as there is still no "linkage" between the CFT's Volume Device name ("/dev/xvdb") and the "nvme?n1" disk in the UserData. It's attached so there should be a way to definitively link the two. However, by using the previous two comments, I was able to craft the following UserData bash code to "more often than not" mount the attached EBS volume. Maybe this will help somebody, or get them closer to the actual answer. I left in the "debugging" echo's as they were helpful to show what was being done (as per the first answer). The main problem is that the "lsblk" call is a best guess as to which disk I'll get. And my EBS Root Volume Size "cannot/should not" be the same size as my EBS Data Volume Size:"UserData": { "Fn::Base64" : { "Fn::Join" : ["", [    "#!/bin/bash\n",    "echo Used for debugging - can be deleted at any time >> /build.txt\n",    "mkdir /data\n",    "DATA_DISK=$(lsblk -l | grep -w disk | grep ",    { "Ref" : "DataVolumeSize" },    " | tail -1 | awk '{print $1}')\n",    "echo $(lsblk -l) >> /build.txt\n",    "echo DATA_DISK = $DATA_DISK >> /build.txt\n",    "mkfs -t ext4 /dev/$DATA_DISK\n",    "echo $(blkid -o export /dev/$DATA_DISK | grep ^UUID=)       /data  ext4    defaults,nofail 0       2 >> /etc/fstab\n",    "echo $(blkid -o export /dev/$DATA_DISK | grep ^UUID=)       /data  ext4    defaults,nofail 0       2 >> /build.txt\n",    "echo blkid= $(blkid -o export /dev/$DATA_DISK)  >> /build.txt\n",    "mount -a\n",    "echo $(cat /etc/fstab) >> /build.txt\n",    ...P.S.  I saw (https://github.com/binxio/ec2-boot-mount-ebs-volume) where someone was using:    "mkdir /data\n",    "blkid $(readlink -f /dev/xvdb) || mkfs -t ext4 $(readlink -f /dev/xvdb)\n",    "e2label $(readlink -f /dev/xvdb) xxx-data\n",    "sed  -e '/^[\/][^ \t]*[ \t]*\/data[ \t]/d' /etc/fstab\n",    "grep -q ^LABEL=xxx-data /etc/fstab || echo 'LABEL=xxx-data /data ext4 defaults' >> /etc/fstab\n",    "grep -q \"^$(readlink -f /dev/xvdb) /data \" /proc/mounts || mount /data\n",It never worked for me and seemed to always return a blank.  BTW, I'm on Ubuntu, so maybe that has something to do with it.CommentSharemarkwilhelmanswered 15 days ago"


Question: Deploying and migrating web infrastructure

"I'm new to Cloud/DevOps stuff. I have dockerized a wordpress website where site runs on a one container and mysql db running on a different container. I have the code hosted on github. This I imagine to be a high volume website and I need to be highly available and horizontally scalling. Also I want the application to be in a pipeline so that when I make changes to the code, the updates get automatically pushed to the running website. I want to host the application on AWS. Being a student, I have little idea in setting this up on AWS. Could anyone help me or direct me to the right direction?FollowComment"

Answer: "0Hello -This is my opinionated recommendation, per what you have described, you need a highly available, and scalable wordpress setup, and with minimal DevOps knowledge. Not sure if you also has a budget constraints.The first option I recommend is you look for fully managed WordPress option, for example wordpress.comI do not recommend you to use containers for WordPress. Containers work perfectly fine with WordPress, but because of the ways it works and the networking connectivity required for  MySQL, you need to be very familiar with container networking plus persistence storage most likely in forms of EFS as well as choosing a orchestration tool such as ECS or Kubernetes (and then become familiar with those tools' service discovery and networking).It is a much heavier lift for you as someone new to manage those things correctly.If you do choose to run your own site, I recommend start with things like lightsail, or even EC2 instances behind a load balancer plus maybe a RDS MySQL.In the future if you want to start with containers, I recommend start with ECS first and see if it fits your style. It has great integration with AWS Code suite of tools like CodePipeline and you can do Blue/Green deployments with automatic builds.Lastly we have EKS which is a managed Kubernetes service for open source compatibility. Kubernetes is very powerful but you do need to learn it to be able to manage and scale.CommentShareJason_Sanswered a year agoph4n7om2000 a year agoThank you for your comment Jason. I'm doing this to learn the technologies and this is not a production setup. I would like to know how I can set up the infrastructure I decribed using these technologies.Share0Two resources that you would want to check out. These will guide you through setting up a container orchestration and creating a code pipeline. I would highly recommend setting up a Budget alarm and understanding how to project costs also.ECS WorkshopCI/CD for ECS WorkshopBudget AlarmAWS Pricing CalculatorCommentShareMichael_Kanswered a year ago0We have both a quickstart using Bitnami's distribution and a tutorial that may help as well.CommentShareRodney Lesteranswered a year ago"


Question: [EC2 FPGA] XDMA transfers fail on f1.16xlarge

"Hello,I've been using EC2, FPGAs for about a 15 months now. I've always been using f1.2xlarge instances, with Ubuntu OS installed, and it worked as expected. Now, due to the amount of CPU intensive work I need to do, I've decided to try using a more robust f1.16xlarge. However, I ran into problems here. I've done all the steps: Loaded the AGFI, checked via lspci is it available, and then tried some simple XDMA read/write tests, just to make sure the connection is still there. Sadly, I get no communication with the PCIe FPGA board.Below is the dmesg output, that reports that the "magic" error in the descriptor happened. Again, I'm using the same driver, same AGFI, and the same Python wrappers around C invocation of kernel.[ 1683.589120] xdma:engine_service_final_transfer: engine 0-H2C0-MM, status error 0x80010.[ 1683.589123] xdma:engine_status_dump: SG engine 0-H2C0-MM status: 0x00080010: MAGIC_STOPPED,DESC_ERR:UNSUPP_REQ[ 1683.589126] 0-H2C0-MM, s 0x80010, aborted xfer 0x00000000e19d64e9, cmpl 0/1[ 1683.589136] xdma:xdma_xfer_submit: xfer 0x00000000e19d64e9,1024, failed, ep 0x0.EDIT: I've figured out the problem, after looking more closely at the dmesg output, I figured out that the AGFI was loaded on a different FPGA slot. I've loaded the AGFI as I always do: sudo fpga-load-local-image -S 0 -I $MY_AGFI_ID -H. I don't see how it could end up on Slot 8? When I try to adjust my test and run it on Slot #8, all works as expected!To be honest dmesg shows this pretty straightforward:[  183.021774] xdma:remove_one: pdev 0x00000000999de0ae, xdev 0x0000000076ff6236, 0x00000000ca7f10f1.[  183.021777] xdma:xpdev_free: xpdev 0x0000000076ff6236, destroy_interfaces, xdev 0x00000000ca7f10f1.[  183.024133] xdma:xpdev_free: xpdev 0x0000000076ff6236, xdev 0x00000000ca7f10f1 xdma_device_close.[  186.066065] pci 0000:00:0f.0: [1d0f:f000] type 00 class 0x058000[  186.066817] pci 0000:00:0f.0: reg 0x10: [mem 0x86000000-0x87ffffff][  186.067206] pci 0000:00:0f.0: reg 0x14: [mem 0x85200000-0x853fffff][  186.067855] pci 0000:00:0f.0: reg 0x18: [mem 0x5e000410000-0x5e00041ffff 64bit pref][  186.068493] pci 0000:00:0f.0: reg 0x20: [mem 0x5c000000000-0x5dfffffffff 64bit pref][  186.083784] pci 0000:00:0f.0: BAR 4: assigned [mem 0x5c000000000-0x5dfffffffff 64bit pref][  186.084214] pci 0000:00:0f.0: BAR 0: assigned [mem 0x86000000-0x87ffffff][  186.084317] pci 0000:00:0f.0: BAR 1: assigned [mem 0x85200000-0x853fffff][  186.084421] pci 0000:00:0f.0: BAR 2: assigned [mem 0x5e000410000-0x5e00041ffff 64bit pref][  186.084996] xdma:xdma_device_open: xdma device 0000:00:0f.0, 0x000000006c4610d7.[  186.086074] xdma:map_single_bar: BAR0 at 0x86000000 mapped at 0x00000000f2cc5fa3, length=33554432(/33554432)[  186.086088] xdma:map_single_bar: BAR1 at 0x85200000 mapped at 0x00000000caa22a31, length=2097152(/2097152)[  186.086106] xdma:map_single_bar: BAR2 at 0x5e000410000 mapped at 0x000000003049f8eb, length=65536(/65536)[  186.086109] xdma:map_bars: config bar 2, pos 2.[  186.086110] xdma:map_single_bar: Limit BAR 4 mapping from 137438953472 to 2147483647 bytes[  186.086115] xdma:map_single_bar: BAR4 at 0x5c000000000 mapped at 0x00000000bfd17001, length=2147483647(/137438953472)[  186.086116] xdma:identify_bars: 4 BARs: config 2, user 0, bypass 4.[  186.095983] xdma:pci_keep_intx_enabled: 0000:00:0f.0: clear INTX_DISABLE, 0x406 -> 0x6.[  186.096158] xdma:irq_msix_channel_setup: engine 8-H2C0-MM, irq#572.[  186.096193] xdma:irq_msix_channel_setup: engine 8-H2C1-MM, irq#573.[  186.096225] xdma:irq_msix_channel_setup: engine 8-H2C2-MM, irq#574.[  186.096270] xdma:irq_msix_channel_setup: engine 8-H2C3-MM, irq#575.[  186.096301] xdma:irq_msix_channel_setup: engine 8-C2H0-MM, irq#576.[  186.096334] xdma:irq_msix_channel_setup: engine 8-C2H1-MM, irq#577.[  186.096366] xdma:irq_msix_channel_setup: engine 8-C2H2-MM, irq#578.[  186.096397] xdma:irq_msix_channel_setup: engine 8-C2H3-MM, irq#579.[  186.096431] xdma:irq_msix_user_setup: 8-USR-0, IRQ#580 with 0x000000000932b671[  186.096463] xdma:irq_msix_user_setup: 8-USR-1, IRQ#581 with 0x000000005edcc121[  186.096511] xdma:irq_msix_user_setup: 8-USR-2, IRQ#582 with 0x00000000249674d9[  186.096560] xdma:irq_msix_user_setup: 8-USR-3, IRQ#583 with 0x00000000d26d07c5[  186.096594] xdma:irq_msix_user_setup: 8-USR-4, IRQ#584 with 0x00000000c940ac79[  186.096627] xdma:irq_msix_user_setup: 8-USR-5, IRQ#585 with 0x000000001fccab2f[  186.096666] xdma:irq_msix_user_setup: 8-USR-6, IRQ#586 with 0x0000000009c457eb[  186.096699] xdma:irq_msix_user_setup: 8-USR-7, IRQ#587 with 0x000000002bedefd1[  186.096732] xdma:irq_msix_user_setup: 8-USR-8, IRQ#588 with 0x000000004ca712de[  186.096765] xdma:irq_msix_user_setup: 8-USR-9, IRQ#589 with 0x00000000e191ad7b[  186.096799] xdma:irq_msix_user_setup: 8-USR-10, IRQ#590 with 0x00000000026a9f8b[  186.096833] xdma:irq_msix_user_setup: 8-USR-11, IRQ#591 with 0x00000000a7138ee8[  186.096868] xdma:irq_msix_user_setup: 8-USR-12, IRQ#592 with 0x00000000b0c4b138[  186.096902] xdma:irq_msix_user_setup: 8-USR-13, IRQ#593 with 0x000000007f7aa664[  186.096934] xdma:irq_msix_user_setup: 8-USR-14, IRQ#594 with 0x0000000070f6c0f6[  186.096970] xdma:irq_msix_user_setup: 8-USR-15, IRQ#595 with 0x000000009aed6be9[  186.096978] xdma:probe_one: 0000:00:0f.0 xdma8, pdev 0x000000006c4610d7, xdev 0x0000000044888d47, 0x0000000058d876e9, usr 16, ch 4,4.Is this a bug of some kind? How to protect myself?Thank you in advance.FollowComment"

Answer: "0This seems weird as the slots would go from Slot 0 -> 7 to amount for 8 slots, so the xdma8 that you are pointing to might be a red herring. Have you looked at how we get the slot to xdma mapping in our cl_dram_dma example: https://github.com/aws/aws-fpga/blob/master/hdk/cl/examples/cl_dram_dma/software/runtime/test_dram_dma.c#L185That should basically let you use slots instead of trying to attach to xdma devices directly.To prove that the xdma8 in your dmesg is a red herring, here is what I tried:I started with cleared slots:sudo fpga-describe-local-image-slotsAFIDEVICE    0       0x1d0f      0x1042      0000:00:0f.0AFIDEVICE    1       0x1d0f      0x1042      0000:00:11.0AFIDEVICE    2       0x1d0f      0x1042      0000:00:13.0AFIDEVICE    3       0x1d0f      0x1042      0000:00:15.0AFIDEVICE    4       0x1d0f      0x1042      0000:00:17.0AFIDEVICE    5       0x1d0f      0x1042      0000:00:19.0AFIDEVICE    6       0x1d0f      0x1042      0000:00:1b.0AFIDEVICE    7       0x1d0f      0x1042      0000:00:1d.0Installed XDMALoaded the prebuilt cl_dram_dma AFI on Slot 0:sudo fpga-load-local-image -S0 -I agfi-0b5c35827af676702AFI          0       agfi-0b5c35827af676702  loaded            0        ok               0       0x04261818AFIDEVICE    0       0x1d0f      0xf001      0000:00:0f.0Slot 0 shows the AFI's new device IDsudo fpga-describe-local-image-slotsAFIDEVICE    0       0x1d0f      0xf001      0000:00:0f.0AFIDEVICE    1       0x1d0f      0x1042      0000:00:11.0AFIDEVICE    2       0x1d0f      0x1042      0000:00:13.0AFIDEVICE    3       0x1d0f      0x1042      0000:00:15.0AFIDEVICE    4       0x1d0f      0x1042      0000:00:17.0AFIDEVICE    5       0x1d0f      0x1042      0000:00:19.0AFIDEVICE    6       0x1d0f      0x1042      0000:00:1b.0AFIDEVICE    7       0x1d0f      0x1042      0000:00:1d.0Dmesg shows xdma7:[  532.867229] xdma:probe_one: 0000:00:0f.0 xdma7, pdev 0xffff897295a85000, xdev 0xffff88fafa894000, 0xffff88fafa896000, usr 16, ch 4,4.This will probably show a different slot depending on how xdma sequences through slots, but if you use the method we provide through our library, you won't need to worry about this.Hope this helps, and let us know if you still need help after this.Thanks,DeepCommentShareDeep_Panswered a year ago"


Question: Data already accepted exception unmarshaller

"While pushing logs from app throws a below exception in crashlytics. Mostly occurs in release buildNon fatal exception:com.amazonaws.AmazonClientException: Unable to unmarshall error response (Attempt to invoke virtual method 'boolean java.lang.String.equals(java.lang.Object)' on a null object reference). Response Code: 408, Response Text: Request Timeout, Response Headers: {X-Android-Selected-Protocol=http/1.1, Connection=close, X-Android-Response-Source=NETWORK 408, X-Android-Sent-Millis=1681460888984, Content-Length=0, X-Android-Received-Millis=1681460901247, Date=Fri, 14 Apr 2023 08:28:13 GMTPlatform : AndroidIssue occurred device: Galaxy tab A(2017)OS version: 8.1Dependency added in app build.gradle file :implementation "com.amazonaws:aws-android-sdk-logs:2.59.1"FollowComment"


Question: Unable to receive emails on specific providers

"Hello,Some of the users are reporting an issue related with the email delivery on specific domains like vip.163.com.  But working fine with gmail, hotmail, and similar.User are not able to receive transactional emails and unable to complete the registration process. They tried even the spam but didn't receive the email.It seems like AWS SES blocking the emails for this domain.Can anyone help with this issue?FollowComment"

Answer: "0You may be getting rejected if you have not setup SPF/DKIM/DMARC email verification and security configurations.DNS Blackhole List (DNSBL) FAQshttps://docs.aws.amazon.com/ses/latest/dg/faqs-dnsbls.htmlAuthenticating Email with SPF in Amazon SEShttps://docs.aws.amazon.com/ses/latest/dg/send-email-authentication-spf.htmlComplying with DMARC using Amazon SEShttps://docs.aws.amazon.com/ses/latest/dg/send-email-authentication-dmarc.htmlAuthenticating Email with DKIM in Amazon SEShttps://docs.aws.amazon.com/ses/latest/dg/send-email-authentication-dkim.htmlCommentSharemikeputnamanswered a year agoAWS-User-3448626 a year agoHello,Thanks for the response, I will check the DNS records but this is happening only with some specific email providers, Like we are able to get emails on Gmail, Hotmail, and GSuite accounts as well and these are the reputed email provider.So, Is it possible that some email providers can reject the email due to DNS?Share0I'd suggest you start your analysis by looking at the any bounce feedback received for these undelivered messages.To receive feedback notifications for messages submitted via the API, you need to configure SNS Topics to receive the published feedback.   For messages submitted via SMTP, bounce NDRs are sent to the envelope sender (MAIL FROM:) of the submitted message.See https://docs.aws.amazon.com/ses/latest/dg/monitor-sending-activity-using-notifications-email.html.CommentSharemdibellaanswered a year ago0I am passing a similar issue, I will share here in case it can help.I found that my emails sent from SES to outlook/hotmail were always sent to spam/junk folder, the main reason was that I am using configure set tracking open and clicks, where the email body has the awstrack.me link.I did a test removing the configure set tracking open and clicks, then, when the email doesn't have the awstrack.me, the emails were sent to the other tab in hotmail, not send to spam/junk folder.So, it is not a conclusion yet, but seems that emails that are sent with the track (awstrack.me), they are tagged as spam from outlook/hotmail.In my case, I disabled the track open/click config set when the destination is outlook/hotmail.CommentShareRobanswered a year ago"


Question: Additional Information Required for Elastic Beanstalk Load Balancer Certificate

"Certificate creation failed for my Elastic Beanstalk Environment with the message "Additional verification required to request certificates for one or more domain names in this request. "I've asked for the certificate to be created against the domain name supplied by the Elastic Beanstalk environment.Could someone help me complete this process? Thanks, Mark.FollowComment"

Answer: 0Note it's saying additional verification not information is needed.  Sounds like you'll need to contact AWS Support - https://aws.amazon.com/premiumsupport/knowledge-center/acm-domain-certificate-allow-list/.CommentShareEXPERTskinsmananswered 5 months ago


Question: Files for Signed cookie-based authentication with Amazon CloudFront and AWS Lambda@Edge + Email Logging

"I'm trying to follow the demo in the blog posts:Signed cookie-based authentication with Amazon CloudFront and AWS Lambda@Edge: Part 1 -Authentication andSigned cookie-based authentication with Amazon CloudFront and AWS Lambda@Edge: Part 2 – AuthorizationHowever, there aren't any files provided for login.html, restricted-content.html, and assets/*.My questions are:How could I find these .html files, or how could I create these files on my own?How could I modify the Lambda@Edge function if I wanted to log the email addresses to a file in an S3 bucket?FollowComment"


Question: Snowcone usage question

"I have an inquiry about Snowcone usage. From the user guide, OpsHub must be needed to manage Snowcone, but need an advise if any other simplified method exist, here are the questions:In the interest of making life easy for what may be “semi-technical” end users, I’m curious if they can just hook the device up to their laptop via USB and copy data to it.Q. Does the end user HAVE to use OpsHub to unlock/transfer data/lock the device?Q. Does the device HAVE to be put on a network, or can data be transferred via USB-C directly?From my understanding, answers to above Q. 'Yes need OpsHub and Yes needs to be put on a network',  if you can confirm my understanding as well, would be helpful.Thank you.FollowComment"

Answer: "1Accepted AnswerAWS Snowcone requires being unlocked, either via OpsHub or via the Snowball Edge CLI.  As for transferring data, the Snowcone provides an NFS interface that must be mounted by one or more clients that will transfer data to it over the network.CommentSharephr0stByteanswered 2 years ago"


Question: Why does the WorkspacesClientDiagnosticUploader.exe open so many processes and use so much bandwidth to s3-1-w.amazonmaws.com

"Hi, Why does the WorkspacesClientDiagnosticUploader.exe open so many processes and use so much bandwidth to s3-1-w.amazonmaws.com.Have some users where we had to uncheck the option of Automatic Diagnostic Logging in the Workspaces Settings section or just reboot their PCs to kill the amount of processes that was created by the log uploaderOn some PCs I saw more than 20 Processes running and the amount of connections being made to s3-1-w.amazonmaws.com.Want to know what triggers it happening ?Why does it start so many different processes?Why does it have to use so much bandwidth to upload the logs?![![FollowComment"


Question: Cognito SAML Error - Invalid ProviderName/Username combination

This error is thrown by cognito after a successful SAML login from salesforce.error_description=Invalid+ProviderName/Username+combination.Please+check+again&error=server_errorThis only impacted a single user that already existed in cognito from a previous salesforce saml login.I was able to resolve this by just deleting the user in cognito and the next login worked but trying to get to the root cause to prevent further issues....SAML (Removed some data that didn't seem pertinent):<?xml version="1.0" encoding="UTF-8"?><samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"                Destination=""                ID="" InResponseTo=""                IssueInstant="2022-07-28T00:18:10.644Z" Version="2.0">    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"                 Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">    </saml:Issuer>    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">        <ds:SignedInfo>            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>            <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>            <ds:Reference URI="">                <ds:Transforms>                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">                        <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"                                                PrefixList="ds saml samlp xs xsi"/>                    </ds:Transform>                </ds:Transforms>                <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>                <ds:DigestValue></ds:DigestValue>            </ds:Reference>        </ds:SignedInfo>        <ds:SignatureValue>                  </ds:SignatureValue>        <ds:KeyInfo>            <ds:X509Data>                <ds:X509Certificate>                                    </ds:X509Certificate>            </ds:X509Data>        </ds:KeyInfo>    </ds:Signature>    <samlp:Status>        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>    </samlp:Status>    <saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"                    ID="" IssueInstant="2022-07-28T00:18:10.644Z"                    Version="2.0">        <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">        </saml:Issuer>        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">            <ds:SignedInfo>                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>                <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                <ds:Reference URI="">                    <ds:Transforms>                        <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">                            <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"                                                    PrefixList="ds saml xs xsi"/>                        </ds:Transform>                    </ds:Transforms>                    <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>                    <ds:DigestValue></ds:DigestValue>                </ds:Reference>            </ds:SignedInfo>            <ds:SignatureValue>                           </ds:SignatureValue>            <ds:KeyInfo>                <ds:X509Data>                    <ds:X509Certificate>                                           </ds:X509Certificate>                </ds:X509Data>            </ds:KeyInfo>        </ds:Signature>        <saml:Subject>            <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">%SFID%></saml:NameID>            <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">                <saml:SubjectConfirmationData InResponseTo=""                                              NotOnOrAfter="2022-07-28T00:23:10.645Z"                                              Recipient=".../saml2/idpresponse"/>            </saml:SubjectConfirmation>        </saml:Subject>        <saml:Conditions NotBefore="2022-07-28T00:17:40.645Z" NotOnOrAfter="2022-07-28T00:23:10.645Z">            <saml:AudienceRestriction>                <saml:Audience>urn:amazon:cognito:sp:us-west-2_%poolid%</saml:Audience>            </saml:AudienceRestriction>        </saml:Conditions>        <saml:AuthnStatement AuthnInstant="2022-07-28T00:18:10.644Z" SessionIndex="">            <saml:AuthnContext>                <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified                </saml:AuthnContextClassRef>            </saml:AuthnContext>        </saml:AuthnStatement>        <saml:AttributeStatement>            <saml:Attribute Name="userId" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">                <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"                                     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">                    %SFID%                </saml:AttributeValue>            </saml:Attribute>            <saml:Attribute Name="username" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">                <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"                                     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">%sfusername%</saml:AttributeValue>            </saml:Attribute>            <saml:Attribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">                <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"                                     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">%email%</saml:AttributeValue>            </saml:Attribute>            <saml:Attribute Name="salesforce_id" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">                <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"                                     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">                    %sfid%                </saml:AttributeValue>            </saml:Attribute>            <saml:Attribute Name="first_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">                <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"                                     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">%fname%                </saml:AttributeValue>            </saml:Attribute>            <saml:Attribute Name="last_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">                <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"                                     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">%lname%                </saml:AttributeValue>            </saml:Attribute>        </saml:AttributeStatement>    </saml:Assertion></samlp:Response>FollowComment

Answer: "0Without seeing a HAR file and knowing the specifics of your configuration, getting to the root cause is not possible. But these issues usually happen when the provider name or NameID value doesn't match exactly what is in Cognito. Things must match exactly, including case sensitivity.Given that the user was able to log in after deleting the old user and creating a new one, I suspect the issue was with case sensitivity for the username (NameID on the SAML assertion)CommentShareAWS-User-7083746answered 9 months ago"


Question: Cannot switch one Autoscaling group from launch configuration to launch template

"I have almost finished converting all of my Autoscaling groups from launch configurations to launch templates, but am stuck at one autoscaling group in eu-north-1.When I click the "Switch to launch template" link, I get a message "We encountered an unexpected errorPlease refresh the page and try again." and a JavaScript error in the browser console (both in Firefox and Chromium):"TypeError: this.props.createASGReq.LaunchTemplate is undefined"I have been able to convert all other autoscaling groups, including one that is also in eu-north-1.Is this a known bug and if so, is there way to circumvent this without disrupting my services ?FollowComment"

Answer: "1Accepted AnswerJust confirming, this happens the moment you click the "Switch to launch template" link, not after you've selected one?  I've never seen this error before, but I would guess there's some combination of settings in the ASG and Launch Config that weren't accounted for on the new console causing this.  Could you try using the CLI to update this ASG?  Settings not specified are ignored (aka, keep your current values), so you would just need something like:aws autoscaling update-auto-scaling-group --region eu-north-1 --auto-scaling-group-name <MyASG> --launch-template LaunchTemplateId=<lt-000000000000000>,Version='$Latest'Removing the 2 <> and replacing them with your values.  This will update the ASG with the new launch template (removing the launch config) just like if you had swapped it on the console, so noAlternatively, if you're not comfortable with the CLI or don't have access to make changes with it, could you either:Open a technical support case so we can look at your exact settings (if you have a technical support plan - link to this post in the case)Post the output of the below commands (if you have any CLI access at all) - removing any sensitive information like resource IDs and userdataaws autoscaling describe-auto-scaling-groups --auto-scaling-group-names <MyASG>aws autoscaling describe-launch-configurations --launch-configuration-names <MyLC>As a side note, after this issue is resolved I'd recommend looking into new features available with launch templates, like the ability to have multiple instance types and market options (Spot + OnDemand) in a single ASG: https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-mixed-instances-groups.htmlCommentShareShahad_Canswered 4 months agoMarcolz 4 months agoYes, I confirm that this happens the moment I click the "Switch to launch template" link.And I also find it strange I could use the web interface just fine on 9 other autoscaling groups, spread over 5 regions, including one in eu-north-1.Thank you very much for the cli hint; I falsely assumed that that would not be enough to actually work before I had switched to launch templates, but this has now done the trick.ShareShahad_C 4 months agoGlad to hear that worked!  I find it quite strange too, but without seeing way more details than we can easily share here, I'm not sure exactly what would be going on.  The ASG treats a launch config and launch template largely interchangeably (as long as you aren't trying to use any launch template only features), which is why the CLI worked.ShareShahad_C 3 months agoHi @Marcolz - just wanted to update you (and anybody else who saw this error) that we found the root cause and it has been fixed.  It sounds like you probably are done by now, but wanted to share this update.  Thank you for letting us know and providing your debugging details in the original post!ShareMarcolz 3 months ago@Shahad_C Ah, good to know, thank you for letting us know and of course for fixing the root cause.Share"


Question: Wildcard in Cloudfront Access-Control-Allow-Origin response policy

"Several months back we created a Cloudfront Response Policy with a CORS header setting that included a Access-Control-Allow-Origin of https://*-myorg.vercel.app. The docs state that "The wildcard character () is allowed as the leftmost part of the domain (.example.org).".  While it doesn't give an example of that wildcard being a part of a subdomain, it allowed me to create this policy.Fast forward to today and the user interface and api will not allow me to edit this policy or create a new one with the wildcard in this position.  It does allow it if it's the entire subdomain such as *.example.org but not *-test.example.org or *anything.example.org.The error we receive is "The parameter Access-Control-Allow-Origin contains *a.example.org which is not a valid URL."Is this a purposeful change in behavior? Is there a way to recreate this policy or edit the old one?Note: The policy that is in place DOES work.  When a request is made that matches that wildcard, the response contains the header with the full domain.  This is how AWS has always handled wildcards.  It wildcards on the server side, and returns the full domain.FollowComment"

Answer: "0I have just tested this and I have same result. However, I believe you can only use a wild card to specifcy ALL and not part of a word. You cant use a wild card as as a catch all i.e. *-myhosts.example.com but you can use *.example.comI even tried 4 Subdomains deep with *.level3.level2.level1.example.com and works fine.I suggest you change the Paramter to All Orgins, then save, then update again with the correct values sticking to the correct standard. I am not sure why AWS let you before, however that is not supported I believe in CORS. Wildcards are *. not *something.CommentShareGary Mcleananswered a month agolocuester a month agoIt's not a CORS standard to wildcard anywhere (except entire thing ala "*").  Amazon matches the incoming request and if it is a match then it responds in the allow-origin with the full domain that was requested.  That's part of the problem I have - it's working as desired right now.  Updated question to include this, and provided screenshot of headers.So the functionality works, but I can't enter it as a value (anymore!).Share"


Question: Complementing Cassandra and Open Search

I will like to complement and connect Cassandra with the Open Search Service to permit my users to query their data and have access to their searches.FollowComment


Question: Ssl certificate for my transfered domain between aws accounts  keep pending

i want to collect ssl certificate for my trasnferred domain which was moved from one aws account to another but its just keep pending and the records have been created in my route 53 records. i even choose another validation which is email but no email was sent to my emails. i delete the pending certificate and request another one but still the same. Please you guys should help me out![FollowComment

Answer: "0For DNS validation did you add a CNAME record?For email validation, did you check for mail on one of the email addresses from your domain's WHOIS entry?  e.g.administrator@your_domain_namehostmaster@your_domain_namepostmaster@your_domain_namewebmaster@your_domain_nameadmin@your_domain_nameCommentShareEXPERTskinsmananswered 7 months agoAyDev 7 months agoFor the dns record it has already created automatically by certificate in my route 53. and for the email validation i checked all my email link with this domain but not seeing anything even i check spam. you can check the attactment in the question to see how i follow in the dns recordsShare0If you choose email validation, the console will show you the ID's the email was sent to. If the list is fine, check the Junk/Spam folder in those. I recently noticed that Gmail flagged the emails as spam.CommentShareSanjeev Gopalanswered 7 months agoAyDev 7 months agoi have checked everything nothing is there. i have already collect a certificate with this domain in my first aws account where this domain was bought from and i use email vaiidation and i got the email successfully but when i transfer the domain to my other aws account now i want to collect another certificate and i am gettiing email message even in my spam. if you need any other information kindly let me knowShare"


Question: Vitis hardware kernel statistic report

"I'm learning to use the Vitis tool from AWS-FPGA repo to design hardware kernels with HLS. I started the Hello World example and followed the instructions for Hardware simulation.Where do I find a statistic report that contains information such as hardware utilization, target frequency, latency, etc?ThanksFollowComment"

Answer: "0The easiest way to view all the reports generated by Vitis is to use the Vitis Analyzer tool.You can find more information about Vitis Analyzer in the docs:https://www.xilinx.com/html_docs/xilinx2019_2/vitis_doc/jfn1567005096685.htmlAnd there also tutorials available, for instance here:https://github.com/Xilinx/SDAccel-AWS-F1-Developer-Labs/blob/master/modules/module_01/lab_02_idct_introduction.md#analyzing-the-reportsCommentShareThomasXilinxanswered 3 years ago"


Question: Can't reach the ec2 instance

The error message is connection timed out . I Have checked the acl and security groups but all is setup correctly . I created another instance with that AMI image but still the same can't log in to the server .Can anyone please help ?FollowComment

Answer: "1I'm sorry you're having trouble connecting to your instance.The EC2 User Guide provides a troubleshooting section with troubleshooting information specifically for the "connection timed out" error at this link: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesConnecting.html#TroubleshootingInstancesConnectionTimeoutI hope this helps.Kind regards,MarilynAWS DocumentationCommentShareMarilynAWSanswered 6 months ago0If the security groups/NACLs are fine, check if the route tables allow communication from the internet to the subnet in which the Ec2 is located. Also see if you have a IGWCommentShareRishianswered 6 months ago"


Question: "Databrew Dataset Loading Error (NEW, previously working)"

"Hi,I'm loading a set of files from S3 and filtering the dataset to files from the last hour.See error in the Cloudwatch log below:Processing parameterized path with the following parameters: {    "LastModifiedDateCondition": {        "Expression": "relative_after :date1",        "ValuesMap": {            ":date1": "-1H"        }    },    "Parameters": {        "fileDate": {            "CreateColumn": true,            "DatetimeOptions": {                "Format": "MMddyyyy"            },            "Name": "fileDate",            "Type": "Datetime"        },...ERROR - Failed to load dataset from 's3://<<bucket>/data/<folder>_P{fileDate}_R{fileEndDate}T{fileTime}_{suffixNum}/<filename>.csv'. Exception can't compare offset-naive and offset-aware datetimeThis appears to be new as the jobs were running perfectly a few days ago.  I also tested it by trying to load the project and that fails with the same error.  Removing the filter from the dataset allows me to load the project.Did some new update break this functionality?FollowCommentScreenName 2 months agoMaybe you have some new timezones in the data that aren't valid/recognised.  eg '2023-04-12T00:00:00+20:45'Shareemencee 2 months ago5376 - Thanks for the response.  But does not have to do with data -- this is databrew's dataset filter function to simply pick up files that have modified times in S3 in the prior hour (in my case) from execution time of the job.  Still, nothing in the data/file convention etc. has changed and this was tested by just removing the filter and allowing the job to run -- which it did.SharerePost-User-8956485 a month ago@emencee we have started having this exact same issue too. It started occurring randomly on the 5th April.Shareemencee a month agoAWS Team has identified this as a bug and as per support, they will push out a release this week.Share"


Question: RDS Postgres major upgrade from 12 to 13 fails

"Tried upgrading RDS Postgres from major version 12 to 13. Also tried upgrading related snapshot. These get stuck with an error:(please note that some info has been obfuscated in the error message to not reveal sensitive information)Snapshot test is in a state that cannot be upgraded: patchDb 155947 (engine upgrade): pg_restore: from TOC entry 4889; 1259 763225 INDEX  tablename_columnname_idx database pg_restore: error: could not execute query: ERROR: permission denied for schema public... Command was: -- For binary upgrade, must preserve pg_class oids SELECT pg_catalog.binary_upgrade_set_next_index_pg_class_oid('763225'::pg_catalog.oid); CREATE INDEX "tablename_columnname_idx" ON "public..."."tablename" USING "gin" ("columnname" "public..."."gin_trgm_ops");What might cause this? Master user seems to be owner of public schema, also it has CREATE and USAGE privileges to the schema. Master user also is member of rds_superuser. Not sure this matters though, as it seems from the log that pg_restore is run as a user rdsadmin.From log, it also visible that pg_restore creates succesfully some indexes before the failing one? Is the pg_trgm extension the actual culprit here? weird stuff.Ok, so removing all pg_trgm indexes kind of solved the problem!?! But would be nice to able to restore those indexes too as they are quite large and re-building those from scratch will take forever.FollowComment"

Answer: 0Might be related to a bug in Postgres 13.7:https://www.postgresql.org/message-id/flat/20220531152855.GA2236210%40nathanxps13#cf62ad5183084f9da0f458c446bb995dCommentSharerePost-User-4879440answered 8 months ago0This bug has been fixed in Postgres 14.5CommentSharerePost-User-4879440answered 4 months ago


Question: AWS CodeBuild with GitHub fine-grained personal access tokens

"I have created a CodeBuild project with the source configured to access the repository on GitHub. For that purpose I created a fine-grained personal access token. CodeBuild configuration was successful and a webhook has been created. Upon pushing a commit to the repo, a CodeBuild job is triggered.However, the job hangs for 2 minutes on DOWNLOAD_SOURCE phase, and eventually fails with an error:CLIENT_ERROR: authentication required for primary source and source version mainI kept adding more and more permissions, but didn't help:Does CodeBuild have issues with fine-grained tokens? Any ideas what could be wrong?FollowComment"

Answer: "1I have exactly the same problem, even after granting all permissions it does not work and I get the message CLIENT_ERROR: authentication required for primary source and source version mainIf I select the classic Tokens or oAuth it works. Unfortunately thats not what I would consider as least privilege. Any idea how we get fine-graded tokens to work?CommentSharehrcanswered 6 months ago0OMG... I have spent days trying to figure out why this wasn't working, thinking it was something wrong with my setup. The fine-grained access token works when using a Github source for CodePipeline, but apparently not when configuring it as a source for a plain CodeBuild.CommentSharepapiro_quickaianswered 5 months ago0I cannot get oAuth to show any private GitHub repos, and using the connection is not an option for Codebuild.I've wasted most of the day on this. Codepipeline, but that is not my requirementCommentSharedanielfzanswered 3 months ago"


Question: Is there a Game Launcher service available?

"Hi ,Is there an AWS service that works as a game launcher for the client side so updates/patches etc are done automatically. Similar to gamelaunchercreator.com ?We have created an FPS game with a server and client and rather than have the client available via cloudfront which has to be downloaded completely each time we update the client, we'd like to have a launcher in place which takes care of patches.Thanks,BhavFollowComment"

Answer: "1Hey Bhav,GameLift manages the game hosting and player sessions, not the game client. This question might better be suited for the folks over at GameSparks.Feel free to retag this post under https://repost.aws/tags/TAnbRqV16nRGmfWM4fKfXfQg/amazon-game-sparksCommentShareAlanZ_AWSanswered 9 months ago0Thanks AlanCommentShareND Bhavanswered 9 months ago"


Question: Amplify API subscription failing authorization

"I have a React application that currently uses Amplify GraphQL APIs. I have set those APIs up so that they require using Cognito user pools for authorization. For example the following code is successfully retrieving a list of values from my Projects collection in DynamoDBconst apiData = await API.graphql({ query: listProjects, authMode: "AMAZON_COGNITO_USER_POOLS"  });Recently I have been trying to setup a subscription so that I can receive real time updates from AppSync when new entries are added to my Projects collection. This is the code that I am trying to get to work:const subscription = API.graphql({query: subscriptions.onUpdateProject, authMode: "AMAZON_COGNITO_USER_POOLS"}    ).subscribe({    next: ({ provider, value }) => console.log({ provider, value }),    error: error => console.warn(error)});Unfortunately, this code is failing when executed, it is causing this error to be raised:"Connection failed: {\"errors\":[{\"errorType\":\"Unauthorized\",\"message\":\"Not Authorized to access onUpdateProject on type Project\"}]}"I am not quite sure how to troubleshoot this or resolve it, do subscriptions require a special configuration with respect to authorization? Are Cognito user pools supported with subscriptions? Any help or guidance would be greatly appreciated.FollowComment"


Question: AWS Step Function: no permissions

I have tried to create HelloWorld Step function. But received is not authorized to perform: states:CreateStateMachineUser is not authorized to perform: states:CreateStateMachine because no identity-based policy allows the states:CreateStateMachine actionHow to fix it?FollowComment

Answer: 2HiIt seems that your user does not have permission to create the state machine.You can create a custom policy with the states:CreateStateMachine machine permission and any other required permissions and attach the custom policy to your user or the simpler approach use the AWSStepFunctionsConsoleFullAccess managed policy and attach it to your user. This would grant all the necessary permissions to manage step functions.Managing IAM permissions -> https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.htmlCommentShareBisinaanswered 11 days ago


Question: CDK Fargate deploy adds unwanted SG rules

"I'm setting up a Fargate cluster with AWS CDK v2. On deploy, CDK is adding a "0.0.0.0/0 Allow from anyone on port 80" rule to a pre-made security group. Any idea how to stop this behavior? Here is my service stanza:const service = new ecs.FargateService(this, "SBfargate", {  cluster,  desiredCount: 1,  taskDefinition: fargateTaskDefinition,  assignPublicIp: true,  securityGroups: [sbsg],  serviceName: 'SB-Fargate_service',});FollowComment"

Answer: 1Found https://github.com/aws/aws-cdk/issues/3177 after more digging.  Mutable: false on the SG stanza worked as I wanted.CommentSharesbeckeranswered a year ago


Question: Secure source code/data in client AWS accounts

"Hi Team,We have below requirement appreciate if you could recommend the best approach for the below problem.We have multiple (minimum two) AWS accounts, 1 for each client and one as a service/data provider common for all clients. We have a ML model(That we run on client accounts), and we do not want to expose weight parameters+ml architecture+source code to the client. The most voted approach is to provide an encrypted model to the client, decrypt the model when executing at the client side, use an encryption key is stored in the common account and control access to the key based on IAM and obfuscate the source code.We have below questions:Can someone sniff packets pass through AWS network get access to the encryption key?When the model is loaded into the RAM can we prevent client from accessing kernal resources of the code running(Eg: EC2 instance)?Note:We do not want to expose trade secrets and clients do no intend to share client data outside its trusted network, hence multiple accounts.Any input on this is highly appreciated.Thanks in advance,ImaranFollowComment"

Answer: "1Hello Imaran,I would caution you to really think through this model.The entire ability for you to protect your IP is based on the ability to obfuscate the source and protect your model.  However both of these are going to reside in your clients account, and based on the description above, the model will likely be decrypted in memory of a host somewhere to run.The real way to architect this, would be to run the software and model in your AWS account and provide an API that your customers can use to interact with the model that you host.  You can even use services like PrivateLink to ensure that the customer access to the API is completely private and secure.Please let me know if I can answer any more questions.BestCraigCommentShareCraig Simonanswered 23 days agoImaran 22 days agoHi Craig,Thank you very much for your feedback, we have few questions regarding the approach you suggested.Clients we are dealing with do not wish to share their data. If we expose functionalities as API endpoints, they have to send the data for processing. The approach you suggested breaks this requirement in my opinion, please correct me if I'm wrong? That is the only reason why we decided to run our code in client side. Is there any better way to achieve this in AWS?We found this article, however; we tried to architect the system in FHE (Fully Homomorphic Encryption) manner but the approach is not yet fully developed and current FHE libraries do not support even most popular AI models, yet alone our own models.https://aws.amazon.com/blogs/machine-learning/enable-fully-homomorphic-encryption-with-amazon-sagemaker-endpoints-for-secure-real-time-inferencing/Share0Hi Imaran,Might this, solve your problems? https://aws.amazon.com/clean-rooms/features/BestCraigCommentShareCraig Simonanswered 22 days ago"


Question: Some questions about Migration Hub + Application Discovery Service

"Dears,We are installing the agent for Application Discovery Service on some servers that we want to migrate to the cloud, however we have some questions.Why the size of the disk on the tables on Athena are not the same on Migration Hub? The values are totally different (it is not just a matter of doing a simple conversion from GB to MB)Using the information we have for the server on Migration Hub, how can we recommend a proper EBS configuration regarding the IOPS?Like we have the information of Avg/Max IOPS for read and write, however for the EBS there is just one IOPS number. Should we consider Read + Write = IOPS compared to EBS?Is there a way to know the application tag using Athena and the data we have from the agents there? Until now I was not able to find it. It will make easier for us to execute the proper queries.Thank you in advance for any help you could provide.Cassio.FollowComment"

Answer: "0Dears, there was an issue with my browser while I was creating this topic. We can close this one as I created a new onehttps://forums.aws.amazon.com/thread.jspa?threadID=331346CommentSharecskanswered 3 years ago0Migrating workloads to the cloud demands effort and time. The Jamcracker Cloud Governance and Management Platform helps identify, analyze, plan, and track cloud workload migration. Customers can use any discovery tool available in their data centers, aggregate output and import them into Jamcracker’s Cloud Platform.With the increase in Multi-Cloud adoption, AWS has been one of the primary choices for SMBs and Enterprises to migrate their workload. AWS has also made matured technology and framework available to its users to migrate seamlessly. The latest release of Jamcracker Cloud Management Platform has extended its governance features for automated AWS migration. With the Jamcracker platform, now organizations can seamlessly migrate workloads running in any cloud or virtualized environment to AWS.Source : https://www.jamcracker.com/blogs/migrating-your-existing-cloud-workloads-to-the-aws-cloud-using-jamcracker-cloud-management-platformCommentSharejohnkatrickanswered 2 years ago"


Question: "windows server 2022桌面會顯示系統規格,可以隱藏嗎？"

windows server桌面會顯示系統規格可以不顯示這些資訊嗎?The windows server desktop will display the system specificationsCan this information not be displayed?FollowComment


Question: Billing question about CloudFront requests

"An account is planing to configure CloudFront to house a large number of custom domains and terminate traffic to the CloudFront origin with a single CLB. To be a little more specific, the configuration will be as follows;Before: client -> CLBAfter: client -> CF* -> CLB*CloudFront content caching is disabled in this scenario.In this case, is it correct that the number of requests to be charged for After scenario is roughly twice the total number of GET/HEAD requests recorded in the Before Scenario?("request for client -> CF" + "request for CF -> CLB")FollowComment"

Answer: "0CloudFront acts as a cache, so it really depends on the distribution of your unique requests.  If you get a lot of requests to the same URL with the same parameters then you can set it up so that results in very few origin requests to your CLB.  That could translate to some big savings on autoscaled instances behind your CLB for example.CommentShareEXPERTskinsmananswered a year agoAWS-User-9365821 a year agoSorry for the insufficient explanation, but CloudFront content caching is disabled in this scenario.Share"


Question: Costs for Batch Rekognition OCR

"I have the need to use "text in image" from Amazon Rekognition to process more than 300k images per month.Does Amazon Rekognition provide a way to process images in batch, doing only 1 request to analyze multiple images at once?And the main question: does a batch process is cheaper than a single process? For example, I have 10 images to extract the text using Amazon Rekognition. The cost for 10 requests to Rekognition (one for each image) is the same as the cost for 1 batch request sending 10 images at once?FollowComment"

Answer: "1Accepted AnswerSo whether you batch or process individually its based on the number of images.If you take a look at the billing page where it details which API calls are counted as an image and under which scenarios 2 images count as a single request:https://aws.amazon.com/rekognition/faqs/#BillingFor the speed and accuracy I don't think the costs is too high.CommentShareRobin Fordanswered a year ago1You could try making a video from an image batch first using ffmpeg:ffmpeg -r 1 -i img%01d.png -vcodec mpeg4 -y movie.mp4Then you could process the video using Rekognition, the pricing is $0.10 per minute of video.To be cheaper than per image processing you would have to put more than 125 images per minute though.CommentShareJaccoPKanswered a year ago"


Question: About the allocation of Elastic IP. Firstly it showed me that it could not be allocated "us-east-1c" but now its working

"Hello, Thanks for the response!!,I do not how to reply you back. So I am writing here.Actually I was writing "us-east-1c" and I think therefore it showed me error.when I simply wrote "us-east-1" and clicked on Allocate Elastic Ip it worked.So I little confused upon it why it did not worked with "us-east-1c".Thank you so much!!FollowComment"

Answer: "0The field where you entered "us-east-1c" is namely Network Border Group. A network border group is a unique set of Availability Zones, Local Zones, or Wavelength Zones from which AWS advertises IP addresses.For more information about Availability Zones, Local Zones, and Wavelength Zones, see Regions and zones in the Amazon Elastic Compute Cloud User Guide.You may further refer Elastic IP address concepts and rules. You either allocate an Elastic IP address from either Amazon’s pool of public IPv4 addresses or from a custom IP address pool that you bring to your AWS account.The IP addresses which can be associated to your resource hosted in us-east-1c Availability Zone falls under us-east-1 network border group. Similarly, us-east-1a, us-east-1b, us-east-1d, us-east-1e, us-east-1f  also falls under the same. Hence, the correct option is us-east-1 as a result it worked for you.CommentShareAyushmaan_Banswered 4 days ago"


Question: "componentName" is empty value in resposne of IoT TwinMaker and Grafana integration

"Hello!I'm trying to use IoT TwinMaker and grafana following user guide.I was organized component type, entity and entity-component and I use lambda function.I think my lambda function is normal.But "componentName" is empty value in grafana response.[Component Type]I was register "com.example.timestream-telemetry" and "com.example.cookiefactory.alarm".with my lambda function.[Entity]I add "Mixer_2" and "AlarmComponent"[Grafana]I entered it according to the settings below.[My lambda response]{    "propertyValues": [        {            "entityPropertyReference": {                "entityId": "Mixer_2_06ac63c4-d68d-4723-891a-8e758f8456ef",                "componentName": "AlarmComponent",                "propertyName": "alarm_status"            },            "values": [                {                    "time": "2022-09-28T11:25:00Z",                    "value": {                        "stringValue": "ACTIVE"                    }                }            ]        }    ]}[Grafana]"componentName" is empty value in my grafana response.What the wrong?How can I solve this problem?FollowComment"

Answer: "0Could you please confirm if you still this issue or were you able to figure out the problem?Based on the response from your lambda function, it should be working fine.CommentShareMukesh_Sahay-AWSanswered 4 months ago"


Question: "boto3 upload to s3 not giving errors, but files do not show up in bucket"

"Just as the title says. Initially, I attempted using the sample code given from the docs linked below, with the exception that I passed my access key and secret key when creating the client object.https://boto3.amazonaws.com/v1/documentation/api/latest/guide/s3-uploading-files.htmlI was using driver code that printed the file name and 'success' when the function returned true. All files were being printed with 'success.' But when I checked my bucket, no uploads appeared.On the off chance it was something wrong in the function, I changed my code to just use response = s3_client.upload_file(file_name, bucket, file_name)directly in the driver and without the rest of the function, still the code ran without errors, but no uploads appeared in my bucket.In the shell I logged in with the client and was able to successfully produce a list of my buckets, so I know it's connecting and the access keys are working in that sense.All I can think is maybe I'm missing some formatting thing with my bucket names? I'm just using the plain text name as a string, for example 'mybucket1234.' Do I need to give it the full url?Edited by: lwaxana on Feb 16, 2020 7:46 AMFollowComment"

Answer: 0I was having the same problem with code adapted from  https://boto3.amazonaws.com/v1/documentation/api/latest/guide/s3-uploading-files.htmls3_client.upload_file completed without an exception but the file was not visible in the S3 web console or via "aws s3 ls s3://bucket-name"The issue was with these lines:    if object_name is None:        object_name = file_namefile_name is actually a file path and the upload seems to silently fail if it contains path separators. The workaround is either to always provide an object_name or change it to:    if object_name is None:        object_name = file_name.split(os.path.sep)[-1:][0]CommentSharecaptaincoordinatesanswered 3 years ago


Question: cannot connect to virtual machine using mobile hotspot

"My laptop uses my iphone hotspot and the Internet works fine, but it cannot connect to the AWS virtual machine. I tried to use other people's wifi and it can connect. I am sure it is my hotspot or virtual machine configuration issue but do not know how to fix it.Thanks.FollowComment"

Answer: "0Verify the inbound rules for the security group that is applied to your instance, looking for TCP port 22 (if it's Linux) or TCP port 3389 (if it's Windows). Is the security group allowing inbound connections from anywhere (0.0.0.0/0) or only a specific IP range.If it's a specific IP range (or only an individual IP address) then is your iPhone's IP within this range of allowed address(es) - see https://www.whatismyip.com/When you use somebody else's WiFi is their IP address in the allowed range?CommentShareRWCanswered a month agorePost-User-0555301 a month agoI added TCP and UDP of the inbound rules for the iphone's public ip address but it seems still not work.ShareRWC a month agoDo you have VPC Flowlogs created? This was you can see if traffic from your IP address even gets as far as the VPC, before it has a chance to start worrying about the security groups.This is what to look for https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#flow-log-example-accepted-rejectedHow to setup a flowlog https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html#flow-logs-basicsShare"


Question: MWAA Environment issue with Git

"Hi!I'm trying to install some forks through the requirements.txt file but it's not working. Looking at the logs I'm seeing "git not found", or something similar.Tried to run "(IFS=:; for p in /usr/local/bin:/usr/bin; do ls -1 ; done) | sort -u", results didn't have git.Results: https://www.file.io/download/nhYolB1sKve3It was working before, it stopped working suddenly. I even have another MWAA environment where it works. Not sure what's going on.Thanks,Wes.FollowComment"

Answer: 0Hi!Unfortunately Git is not installed on MWAA worker images.Thanks!CommentShareJohn_Janswered 2 years ago