Question: AWS Transit Gateway through BGP propagation and routing behavior

"When I added the VPN to a transit gateway attachment, the VPN route was automatically propagated through BGP to the routing table on the transit gateway.Is this an expected behavior for routes to propagate automatically when the routes are added to the attachment? This can cause a communication problem. The IP CIDR that is in use by the on-premise server engine might conflict with the VPC CIDR range.Is there a way to disable the route propagation setting for BGP on the routing table of the transit gateway?FollowComment"

Answer: "0Accepted AnswerIf you've enabled the "Default route table propagation" option on your transit gateway (TGW), it will automatically propagate transit gateway attachments (like VPN) using the default route table. Note that this setting is enabled by default. To disable the "Default route table propogation" option, create a new transit gateway with the option disabled. You won't be able to disable this option by editing the TGW configurations.If you've disabled the "Default route table propogation" option when you create your transit gateway, make sure to specify which route tables you want to propagate the routes to or from the VPN attachment.CommentShareEXPERTEvgeny-At-AWSanswered 3 years ago"


Question: How to Stop someone from accessing the lightsail Instance.

someone is able to access lightsail instances using a non-existent username how to resolve this problem? (the username used is "admin-d" ?)I was able to check it through cloudtrail logs.This user name doesn't exist in the aws iam users and I am concerned that there might be leaks within my account. How to resolve any security lapses within my account.FollowComment

Answer: "0Hi,If you have not received any notifications from AWS stating that there has been unintended access to your AWS resources, then you may have resources within your account that have been inadvertently created with LightSail permissions.As you have stated that this may not be the case, best practices state that you may need to Rotate and delete all your AWS access keys, rotate any potentially unauthorized IAM user credentials, delete unrecognized/unauthorized resources, and/or Verify the security of your account information.Create an IAM policy that grants access to LightSail, then create an IAM group and attach the policy to the group. Then you can create IAM user you want to give access and make them members of a group which gives them access to LightSail.You can also refer to these articles for detailed information:https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-managing-access-for-an-iam-userhttps://aws.amazon.com/premiumsupport/knowledge-center/potential-account-compromise/For future reference: If you believe that there has been potentially unwanted activity on your AWS account, you can enable Amazon GuardDuty for monitoring and detecting any unrecognized activity within your AWS account.CommentShareBrensophabanswered a year ago0Hello,Thank you for reaching out to AWS re:Post. I understand that you are having an issue with unauthorized access in your Lightsail instance.I recommend these 3 steps to your Lightsail instance.  Create an IAM policy for Lightsail access -> Create an IAM group for Lightsail access and attach the Lightsail access policy just created -> Create an IAM user and add the user to the Lightsail access group. I have attached a link that goes more in detail regarding practice.[1]There also specific steps you can take regarding safety that depend on the work you are doing in Lightsail. I recommend taking a more in-depth look at this link, which goes over different access management practices you can use with Lightsail.[2]Please contact if you have any further questions, and feel free to reach out to us via a support case to facilitate a discussion on the specifics of your resources.[1] Access management - https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-managing-access-for-an-iam-user[2] IAM management - https://lightsail.aws.amazon.com/ls/docs/en_us/articles/security_iamCommentSharePraneetha_Ganswered 10 months ago"


Question: Updating EventBridge Target in a separate CloudFormation script

Hello!I have two separate serverless.yml projects that have to interact with an EventBridge rule and I'm struggling to figure out how to update the resources section in both to support this. Here's an example of what I mean:EntryPoint Lambda:This lambda gets the request from the front end and then submits a message to the EventBridge rule we have setup. The EventBridge rule is setup in the serverless.yml file like so:resources:  Resources:    RegisterEventBridge:      Type: "AWS::Events::Rule"      Properties:        Name: "RegisterCloseEventBridge"        Description: "Event rule for Closing Register event."        State: "ENABLED"        EventPattern:          source:            - "register.close.${self:provider.stage}"Consumer:This lambda function gets triggered by a SQS message. The SQS is a target for the EventBridge rule so it seems like the queue itself should be created in this service. Below is the resources:resources:  Resources:    ClosingRegisterQueue:      Type: "AWS::SQS::Queue"      Properties:        QueueName: "closing-register-sqs-${self:provider.stage}"    RegisterEventBridge:      Type: "AWS::Events::Rule"      Properties:        Name: "RegisterCloseEventBridge"        EventPattern:          source:            - "register.close.${self:provider.stage}"        Targets:          - Arn: !GetAtt ClosingRegisterQueue.Arn            Id: "SA"But obviously this does not work because the RegisterEventBridge rule already exists in the previous stack. Is there any way I can simply import it into this stack for this purpose?FollowComment

Answer: "1Accepted AnswerYou should think of the rule with all its targets as a single entity. The idea is that the consumer of the event knows what events it is interested in.Even if you have different targets that need the same rule, they should create two different rules. The exception is that if the two targets are part of the same sub system and are defined in the same template . In that case you can create a single rule with multiple targets.So in your case I would create the rule with the SQS queue and the Lambda function in the same template.CommentShareEXPERTUrianswered a year agoKenHarris627 a year agoOkay that makes sense. I was putting it in the Entry Point because that lambda itself submits to the EventBridge rule... So I had assumed that means that the service itself should create it. It makes it way easier to keep EventBridge and SQS inside of the single Consumer lambda. Thank you for your assistance!Share"


Question: Missing (resource) permission in AWSAppRunnerFullAccess causes failure when calling the  CreateVpcConnector operation

"Not really a question, more of a 'bug report'. Solution is provided in this post.arn:aws:iam::aws:policy/AWSAppRunnerFullAccess is missing permission to create AWSServiceRoleForAppRunnerNetworking service role.That makes it impossible to create vpc connector despite using FullAccess policy. Error message doesn't really help, as pointed by it policy is in fact attached.Steps to reproduce:Use user or assume role with AWSAppRunnerFullAccess permissions.Runaws apprunner create-vpc-connector --vpc-connector-name test-vpc-connector --subnets <subnets> --security-groups <security-groups>Command produces following error:"An error occurred (InvalidRequestException) when calling the CreateVpcConnector operation: AccessDenied. Couldn't create a service-linked role for App Runner. When creating the first vpc connector in the account, caller must have the 'iam:CreateServiceLinkedRole' permission. Use the 'AWSAppRunnerFullAccess' managed user policy to ensure users have all required permissions."Temporary solution: add additional policy with Allow iam:CreateServiceLinkedRole on resource arn:aws:iam::*:role/aws-service-role/apprunner.amazonaws.com/AWSServiceRoleForAppRunner.Long term, I believe it should be added to AWSAppRunnerFullAccess.FollowComment"

Answer: 0Accepted AnswerTemporary solution: add additional policy with Allow iam:CreateServiceLinkedRole on resource arn:aws:iam::*:role/aws-service-role/apprunner.amazonaws.com/AWSServiceRoleForAppRunner.Long term - to be fixed by AWS :)CommentSharePszemanswered 7 months ago


Question: My client is unable to access ALB URL but I am able to do so. Why?

"My client is not able to access ALB URL, but I am able to access the same. ALB URL's security group has "All Traffic" rule in both inbound and outbound rules. Also my EC2 instance is windows and I have deactivated its firewall to not block any incoming IP addresses. How to solve this issue.FollowCommentBrettski-AWS EXPERT2 months agoWhat error message is the client getting? There's not enough information here to troubleshoot this further.Share"

Answer: "0That's the issue. No error is flashing on the client side. Not even in the browser console of Google Chrome which they are using. Also, I found that the API request made from my SaaS by the client didn't hit my API Code written in Node JSCommentSharerohan-vishwakarmaanswered 2 months agoBrettski-AWS EXPERT2 months agoWhat about their DNS responses? Are they getting the same response that you are? That might explain why you're not seeing the hits on the API.Share"


Question: When will payments from Russia be available?

When will payments from Russia be available?FollowComment


Question: "Failed health check, what should I do?"

"My instance was giving a 504 error.To my knowledge, nothing was updated about the site.My IP is 52.35.76.129I spun up a new instance from a previous snapshot at 35.166.203.154but am getting a network connection error.I also attached a classical load balancer and now am getting that the health check failed. What are the next steps?FollowComment"

Answer: "1Howdy,I'm sorry to hear that you're experiencing issues with your instance. Here are some steps you can take to troubleshoot and resolve the issues you mentioned:1.504 Error: A 504 error typically indicates a gateway timeout. This could be caused by issues with your application, web server, or backend servers. To identify the root cause, check your instance logs and metrics.Investigate logs: Check your server logs (e.g., Nginx or Apache) for any errors or unusual behavior that could help pinpoint the issue. This might help you find the root cause of the issue.Check server resources: Ensure that your server has enough resources (CPU, memory, disk space) to handle incoming requests. If the resources are maxed out, you may need to upgrade your server or optimize your application.Verify backend services: If your application relies on any external services, check their status and make sure they're working correctly.  Relevant links:Troubleshooting 504 errors:https://repost.aws/knowledge-center/504-error-albhttps://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-troubleshooting.html#http-504-issueshttps://docs.aws.amazon.com/elasticloadbalancing/latest/classic/ts-elb-error-message.html#ts-elb-errorcodes-http504Checking logs on EC2 instance:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-console.html#instance-console-console-output2. Network connection error: A network connection error could be caused by several factors such as security group settings, VPC configurations, or routing issues.Check security groups: Verify that your security groups are configured correctly to allow incoming and outgoing traffic on the required ports (e.g., HTTP: 80, HTTPS: 443).Check VPC settings: Ensure that your VPC and subnets are properly configured, and the instance is associated with the correct VPC.Verify routing tables: Ensure that your routing tables are correctly set up to route traffic between your instances and the internet.  Relevant Links:Working with Security Groupshttps://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html3. Health check failed on the Load Balancer: Health check failures typically occur when the instances behind the load balancer do not respond correctly to the health check requests sent by the load balancer.Review health check settings: Check the health check settings on your load balancer, and make sure they're correctly configured (e.g., correct protocol, port, and path).Verify backend server responses: Ensure that your backend servers are responding to health check requests with the expected HTTP status codes (e.g., 200 OK).Check instance availability: Make sure your instances are running, and their status is "InService" in the load balancer console.  Relevant links:Configure health checkshttps://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-healthchecks.htmlhttps://repost.aws/knowledge-center/troubleshoot-classic-health-checks4. General troubleshootingIf the issue persists, follow the general troubleshooting steps in the AWS documentation.Relevant links:Troubleshoot EC2 Instances:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-troubleshoot.htmlTroubleshooting Classic Load Balancers:https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/introduction.htmlBy following these troubleshooting steps, you should be able to identify and resolve the issues you're experiencing.In case my answer doesn’t address your question or if you have any follow up questions, please let me know.RockyCommentShareAWS-Rockyanswered 2 months ago0Hello,  HTTP 504: Gateway timeout indicates that the load balancer closed a connection because a request did not complete within the idle timeout period. Kindly refer the below links for troubleshooting.https://repost.aws/knowledge-center/504-error-classichttps://docs.aws.amazon.com/elasticloadbalancing/latest/classic/ts-elb-error-message.html#ts-elb-errorcodes-http504CommentShareDamini_Kanswered 2 months ago0If you're connecting directly to your instance (rather than through a load balancer) and you're getting 5xx error message then the network connectivity is all ok. The error message is being generated by your web server software (whatever that is - Apache, IIS) and telling you there is some internal error. It's something on the instance that is going wrong here.Putting a load balancer in front of the instance won't change that - and it will cause the problem you're seeing which is that health checks fail. The load balancer is expecting to see HTTP 200 (an "ok" code) from the website. It's seeing 504 so the health check will fail.CommentShareEXPERTBrettski-AWSanswered 2 months ago"


Question: Cloudtrail S3 bucket objects

"I created a cloudtrail and I chose to create a new S3 bucket. Afer the cloudtrail is logging, I checked my bucket location. There are a lot of objects which contain the cloudtrail history and owner is s3-log-service. I would like to move all these objects to another folder under this bucket. Does anyone have any idea?FollowComment"

Answer: 0If you go back into the CloudTrail console > Click "Trails" on the left hand toolbar > select the Trail you created > Then click the Edit button under General Details you'll be able to update the S3 Bucket and/or the prefix.CommentShareAWSJoeanswered a year ago


Question: Cannot upgrade RDS PostgreSQL 9.5 to 12.5

"As we are forced to upgrade PostgreSQL 9.5 to 12.5, I have activated the maintenance upgrade which has started to work and also took the instance down for a while. After finishing it change status to Available however PostgreSQL version was still 9.5. There's no way for seeing what went wrong.What should we do now?FollowComment"

Answer: "0I would say, starting point would be to check your RDS Events and may be logs as well. Before any upgrade, there is a PreUpgrade checks that happen and may be, those checks have failed for some reason which you can find in RDS Events of that instance.CommentShareD-Raoanswered a year agoD-Rao a year agodid this help?Share"


Question: We lost access to i-037efcb963119d88a and cant reboot it

We lost access to i-037efcb963119d88a and can't reboot if from the AWS reboot option. I can se a screenshot of it and time is updating and it is logged in. I attached another nic that I can ping but cant rdp to it. the original nic I can ping.FollowComment

Answer: "0Did a stop and start and we have access again.CommentShareSSBNanswered 3 years ago0Hi SSBN,Great to hear that the issue has been resolved. Please let us know if you need any further help.Regards,awstomasCommentShareAWS-User-3892169answered 3 years ago"


Question: 504 Gateway Time-Out when launching load balancer?

"Hello, i have 2 ec2 instances. I want to access them through the load balancer. But somehow it tells me 504 Gateway Time-Out in the browser. I go to the target groups and it tells me the 2 instances are unhealthy.Why do I get this error? The aws documentations didnt help meFollowComment"

Answer: "-1HelloA 504 HTTP Bad Gateway refers to a server-side connection issue.As seen here [2]common cause of the error when using an ALB is:-The back-end instance did not respond to the request within the correctly configured idle timeout i.e. the back-end instance took more time to respond than the configured idle timeout of the load balancer.-The load balancer failed to establish a connection to the target before the connection timeout expired (10 seconds).-The target returns a content-length header that is larger than the entity body. The load balancer timed out waiting for the missing bytes.Additionally you have mentioned that healthchecks are failing for the loadbalancer target group.A failed healthcheck indicates a connection issue with backend.This is what is causing the 504 errors being returned(-The load balancer failed to establish a connection to the target before the connection timeout expired (10 seconds)).That said, you need to make the targets healthy first so that you can evaluate any other cause of the 504.To resolve the 504 and healthcheck issue,consider the following when troubleshooting:-Verify that your application is running.Use the service command to check the status of services on Linux targets. For Windows targets, check the Services tab of the Windows Task Manager.If the service is stopped, start the service. If the service isn't recognized, verify that the required service is installed.-Verify that the target is listening for traffic on the health check portRun the [netstat -plnt] command on linux to verify which ports your server is listening to.For Windows targets, you can use the [netstat] command.-Verify that your application responds to the load balancer's health check requests accordingly.-Check the security group of the backend instances if they allow traffic on that port.-Increase health check time out to see if application will respond in that period[1]-Try and increase the capacity of instance type ,it could be that your application is taking longer to respond.I hope this helps!ReferenceModify the health check settings of a target group[1]https://docs.aws.amazon.com/elasticloadbalancing/latest/network/target-group-health-checks.html#modify-health-check-settingsTroubleshooting HTTP 504 Error[2]https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-troubleshooting.html#http-504-issuesHow do I troubleshoot and fix failing health checks for Application Load Balancers?[3]https://aws.amazon.com/premiumsupport/knowledge-center/elb-fix-failing-health-checks-alb/CommentShareEXPERTTshepanganswered 2 years agoHfellah 9 months agoHow I Verify that the targets are listening for traffic on the health check port if the targets are ip addresses of vpc endpoint enis to invoke a lambda with API gateway ?Share-1HelloA 504 HTTP Bad Gateway refers to a server-side connection issue.As seen here [2]common cause of the error when using an ALB is:-The back-end instance did not respond to the request within the correctly configured idle timeout i.e. the back-end instance took more time to respond than the configured idle timeout of the load balancer.-The load balancer failed to establish a connection to the target before the connection timeout expired (10 seconds).-The target returns a content-length header that is larger than the entity body. The load balancer timed out waiting for the missing bytes.Additionally you have mentioned that healthchecks are failing for the loadbalancer target group.A failed healthcheck indicates a connection issue with backend.This is what is causing the 504 errors being returned(-The load balancer failed to establish a connection to the target before the connection timeout expired (10 seconds)).That said, you need to make the targets healthy first so that you can evaluate any other cause of the 504.To resolve the 504 and healthcheck issue,consider the following when troubleshooting:-Verify that your application is running.Use the service command to check the status of services on Linux targets. For Windows targets, check the Services tab of the Windows Task Manager.If the service is stopped, start the service. If the service isn't recognized, verify that the required service is installed.-Verify that the target is listening for traffic on the health check portRun the [netstat -plnt] command on linux to verify which ports your server is listening to.For Windows targets, you can use the [netstat] command.-Verify that your application responds to the load balancer's health check requests accordingly.-Check the security group of the backend instances if they allow traffic on that port.-Increase health check time out to see if application will respond in that period[1]-Try and increase the capacity of instance type ,it could be that your application is taking longer to respond.I hope this helps!ReferenceModify the health check settings of a target group[1]https://docs.aws.amazon.com/elasticloadbalancing/latest/network/target-group-health-checks.html#modify-health-check-settingsTroubleshooting HTTP 504 Error[2]https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-troubleshooting.html#http-504-issuesHow do I troubleshoot and fix failing health checks for Application Load Balancers?[3]https://aws.amazon.com/premiumsupport/knowledge-center/elb-fix-failing-health-checks-alb/CommentShareEXPERTTshepanganswered 2 years ago"


Question: AWS support not responding to SES Production request

"Hello,It has been 2 days since we requested for our account to be taken out of SES Sandbox. We're on the basic Support plan, but since I was able to put the request in, it is my understanding that we don't need another support level for this kind of request, and that it should be actioned within 24 hours. This is now blocking our product go-live.Is my support plan assumption correct? If any AWS support staff read this, the case ID is 12404237881 - please help.Thanks,PhilippFollowComment"

Answer: 0SES limit removal is not handled by technical support and may exceed 24 hourshttps://repost.aws/ja/questions/QUpSqZ-WxAQryqGeTNJXiWNw/did-not-get-response-from-support-even-after-48-hoursCommentShareEXPERTRiku_Kobayashianswered 2 months agoRiku_Kobayashi EXPERT2 months agoDid you solve the problem here?Share


Question: Username of user who executed Glue job

"Assuming a Glue job, is there a way to find out who executed a particular Glue job? May be within script or somewhere else?FollowComment"

Answer: "2HiYou should be able to capture this information in CLoudTrail.  SeeAWS Glue is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in AWS Glue. CloudTrail captures all API calls for AWS Glue as events. The calls captured include calls from the AWS Glue console and code calls to the AWS Glue API operations.https://docs.aws.amazon.com/glue/latest/dg/monitor-cloudtrail.htmlCommentShareEXPERTMatt-Banswered 9 months agoEXPERTFabrizio@AWSreviewed 9 months agoEXPERTChris_Greviewed 9 months ago"


Question: How many hours in a month in terms of AWS?

I'm trying to calculate my monthly price based on a configuration but I don't know what number of hours a month I need to multiply by my hourly price. I'm assuming that AWS uses the 24 * 7 * 4 = 672 model but Googling "how many hours in a month" and some related searches tell me that there is a decimal amount of days in a month resulting in approximately 730 hours a month instead. How am I billed in AWS?It's probably an obvious question but I'm just double checking. :)FollowComment

Answer: "2If the service is priced by the hour, then the actual monthly price is simply multiplied by the actual numbers of hours in given month, ie. there is no "monthly price" that would be the same for each month. The beauty of this is, you could actually stop the service (e.g. EC2) for weekends and non-office hours if there is no use and stop paying for it. This would then effect # of hours you are paying for it. For budgeting purposes of things that are running 24/7 it is typical to use 30 days per month (ie. 24h/day * 30day = 720h) that is typically accurate enough for monthly and yearly budgeting purposes.CommentShareKalluanswered 5 months ago0The previous response is mostly correct, however AWS uses an average of 730hrs per month for estimating cost.This is listed in the AWS Pricing Calculator assumptions: https://aws.amazon.com/calculator/calculator-assumptions/#:~:text=Time%20period%3A%20The%20Calculator%20assumes,%2F%2012%20months%20in%20year).CommentShareGreg_Hanswered 5 months ago"


Question: Can I separate production app entries from email entries?

"I'm on the way migrating from one big "console configured" AWS account to multiple accounts configured with CloudFormation and now I'm learning capabilities for Route 53. I have already learned that I can put new NS records for subdomains and handle staging.example.com and dev.example.com in different hosted zones in different accounts. But I'm asking can I separate production app (zone apex) entries from external entries, which are not related to production app. I mean MX record, DKIMs, SPF, DMARC and so on...We have not separate consistent common subdomain for production app, only api.example.com, app.example.com and so on. Because NS records for main domain can't be changed and NS records doesn't support any wildcards, is there any easy and/or reasonable way to separate those concerns? If not, what is your advice? Is it better to put production app entries to shared services account or "email entries" into production app account?FollowComment"

Answer: "0If I'm understanding the question correctly, then you're asking if your production app atA example.comA api.example.comA www.example.cometc.can be maintained in a different zone than your email related recordsMX example.cometc.then the answer is usually no, the exceptions being weird edge cases such as one set can be in a private zone and one set in a public zone.  But if the world needs to see all of them, no...I'd generally be tempted to put the domain in the production account, so that you can easily utilize all the spiffy AWS automation for load balancers, health checks, etc., etc., on the production instances.   The email entries are more likely to remain relatively static entries.CommentShareJonTRanswered 2 years ago0Yep, that was the thing I was asking and answer was same what I thought. Thank you for suggestions, I will also be using production app account for hosted zone...CommentShareTommiForeanswered 2 years ago"


Question: DNS failure after Ubuntu 14 LTS update to 18 LTS

"I've seen other posts marked as answered and tried all the solutions included there, created a support ticket as well.After the update, I had the issue where any sudo command or network related command would kick back saying unable to resolve hostname (local ip).Added the loop back with the hostname in the hosts file.Resolved that error but still unable to resolve any outside DNS.Added Google's DNS at 8.8.8.8 to the /etc/systemd/resolved.conf as a failover, and primary DNS.Dig's are unable to reach any site, ping can hit any IP address.No rules listed in the IP Table.I've checked my VPC DNS settings Hostname and resolution is enabled.I'm drawing a blank here, any help would be amazing.  Amazon support has been pushing this off for 4 days now.  Actually suggested I just spin up a new one....Edited by: OmegaJstn on Mar 7, 2019 10:45 AMFollowComment"

Answer: "0The Resolvconf service was missing somehow after the update to 18.04.Noticed this and copied the package over sftp, its now able to correctly resolve and all is good again.CommentShareOmegaJstnanswered 4 years ago"


Question: Will AWS ever prevent sending of email from BYOIP IPs?

"I know a process exists to allowlist non-BYOIP EIPs for email sending from EC2, and the BYOIP VPC FAQ says:IP Reputation: Many customers consider the reputation of their IP addresses to be a strategic asset and want to use those IPs on AWS with their resources. For example, customers who maintain services such as outbound e-mail MTA and have high reputation IPs, can now bring over their IP space and successfully maintain their existing sending success rate.However, a customer asks if AWS will ever intervene or block email delivery if e.g. bounce rate or complaints occur for their own IPs. Is it safe to tell them "no"?FollowComment"

Answer: 0Accepted AnswerOur abuse team would take action if there were abuse reported. They would receive a notification. Our public docs specify the process. Note that we throttle SMTP traffic (port 25) to prevent open mail relay on EC2: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-port-25-throttle/. The customer can follow that guide to remove the throttling.CommentShareAWS-James-Devineanswered 4 years ago


Question: AWS Athena Query Error

"Hello,I am receiving an error when trying to run a report. It says:"SYNTAX_ERROR: line 28:6: View 'awsdatacatalog.wfs_accs_yeti_prod_02.recent_connect_ctr' is stale; it must be re-created"Does anyone know what this means?Thank you!FollowComment"

Answer: "0Athena by default reports a stale view under one of or more of the following conditions:The table or database that's specified in the view query doesn't exist.You tried to modify the table definition after you create the view.You tried to update the schema or metadata in a referenced table while recreating or updating the table.For example, your query fails with this error if you create a view and then run an ALTER TABLE ADD COLUMNS statement on the same table.To prevent "stale view" errors, recreate the view whenever you modify the underlying table or databases. You can also replace the view by adding the OR REPLACE clause in the CREATE VIEW statement. This clause lets you update the existing view by replacing it.CommentShareFelix Ganswered 4 months ago"


Question: File Share stuck in "Force Deleting" state

"Hello,I've got a fileshare that has been stuck in "force-deleting" state for about 5 days now.At first it was stuck in "deleting" state so I followed the instructions in  https://t.co/ankuykyApL?amp=1 article to force-delete it but this hasn't helped and now it's stuck in "force-deleting" state.Any help would be appreciated...FollowComment"

Answer: "0Accepted AnswerHello,I'm Mike with the Storage Gateway team.  Let me see if I can assist you.Looking at the storage gateway appliances associated to your AWS account, it shows me that the gateway is in an "offline" state.  The share cannot be deleted (even with force-deleting) if the gateway is unavailable or offline.Often, this offline state can occur if the SGW virtual machine has been deleted before the shares are deleted.  Is this your situation possibly?  If so, you can skip the step of deleting the share and simply delete the storage gateway from the console entirely.If you do have the VM still, you can turn it back on or troubleshoot why it has lost connectivity to AWS.  Once back online, you should be able to delete the share without issue.Please let me know if there is anything else I can do to assist.CommentShareMike-HAWSanswered 2 years ago"


Question: AWS Region selection for client

"I have deploy 3 fargate tasks in 3 different regions and each of them are in different url.Now, if there is a user wanted to connect to the service, I'll need to help user to select the AWS region for them, as latency/geolocation is just one of the criteria. Is there anyway that I can have a latency data for references when I wanted to do the match-making?FollowComment"

Answer: 2With route53 you can use the latency based routing. https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/TutorialTransitionToLBR.htmlCommentShareAlexandre_Panswered a year ago


Question: Importing externally-trained TensorFlow v2 models to SageMaker deployment

"Can anybody suggest nice, reasonably up-to-date example(s) for importing a previously trained TFv2 model to SageMaker? i.e. tarballing the artifact to S3, and configuring the Model & Endpoint (preferably via SageMaker Python SDK).Most of the examples I've come across so far are for TFv1. Thanks!FollowComment"

Answer: "0Hi!Assuming you already have a trained model on an Amazon S3 location in a tar.gz format then you should be able to load that using the TensorFlowModel class and deploy from there (using the SDK) as shown in the documentation here: https://sagemaker.readthedocs.io/en/stable/frameworks/tensorflow/using_tf.html#deploying-directly-from-model-artifactsIn the constructor of TensorFlowModel you may also want to pass the keyword argument "framework_version" (more on this here: https://sagemaker.readthedocs.io/en/stable/frameworks/tensorflow/sagemaker.tensorflow.html)Currently the supported versions of TFv2 are "2.0.4", "2.1.3", "2.2.2",  "2.3.2",  "2.4.3", "2.5.1" and "2.6.0".Let me know if this helped answer your questionCommentSharegeorgios_sanswered a year ago"


Question: SQS interface endpoint for cross region access

"Is it possible to use SQS interface endpoint for cross region access? Use case: service in VPC-A in region A to access SQS queue in region B? If not, what would be next best way to access it? Is it possible over private network or it has to be done over public internet?FollowComment"

Answer: "0Accepted AnswerInterface endpoints are regional. From the docs, "Endpoints are supported within the same Region only. You cannot create an endpoint between a VPC and a service in a different Region. "You could do VPC peering to access the endpoint from another region, using a private hosted zone to map the name.CommentShareJorge_Panswered 2 years ago"


Question: AWS CloudWatch metrics to OpenSearch

I'm working on Centralized Logging of my environnement AWS presented in this guide:https://docs.aws.amazon.com/solutions/latest/centralized-logging/overview.htmlI'm using the same architecture as presented in AWS Doc.I'm searching the possibility to send metrics from CloudWatch of each account to OpenSearch in centralized account. I was thinking of a Lambda function that retrieves each X minutes the data with get_metric_data ? I'm collecting the metrics with CloudWatch AgentIs there an another method to do it ?Thank youFollowComment

Answer: "0CloudWatch Metric Streams is the easiest way to continually get metric data sent out of an account.In your case, the simplest setup for that would be to send from your accounts to a central S3 bucket in your central account. From there you can have a Lambda that triggers whenever S3 files get uploaded to the bucket - read those S3 files and log the content to the Lambda's log output as EMF - a simple JSON format that creates metrics.So pipeline is basically: remote account -> Metric Stream -> central account S3 bucket -> Lambda -> CW Logs as EMF -> CW MetricsCommentShareAmazon-CloudWatch-01answered a year agoAWS-User-4849994 a year ago@Amazon-CloudWatch-01 Thank you for your response ! As far as I know, it isn't possible to make a Metric Stream which streams to a S3 bucket in another account. Isn't it ?Share0There is an opensource projects which sends all CW metrics and logs for your Amazon OpenSearch Service deployment to a centralized opensearch. Have a look at this and see if this helps: https://github.com/aws-samples/amazon-opensearch-service-monitorCommentSharePrashant Agrawalanswered a year ago"


Question: AWS AMIs with extra snapshot attached

We have a build process that creates Amis and in the process we attached aws snapshot with some installation media. The problem is that I have multiple Amis with extra snapshot that I would like to remove/disassociate. I couldn't find anything on the aws cli to do this on the ami itself without deregistering.Found this but don't think I am able to deregister the ami.https://4sysops.com/archives/delete-the-amazon-machine-image-ami-and-its-associated-snapshots/FollowComment

Answer: 1Am I correct in assuming that you are have extra volumes associate to an AMI that you do not want to be associated? Unfortunately you will not be able to modify the existing AMI. Your best option would be to create a new AMI after you have detached that volume from the instance.CommentSharePaul Frederiksenanswered 10 months ago


Question: My healthy tasks at AWS Service Container are being drained

"I configured the environment using Terraform, where I have:1 Load balancer1 Target group2 Availability zones2 Healthy TasksI do requests throw the load balancer to the app and it is giving me 200 status code pointing to the healthcheck endpoint. (So the LB is connecting without any problems to the targetgroup)Then after 15 minutes, the tasks are being drained and the deployment is never finished)When I go to ECS and see the Containers for task X, the Health Status stays as Unknown foreverWhat could it be?FollowComment"

Answer: "0Hi,If I correctly understand your task are healthy before began the deployment. When you do the deployment the existing healthy tasks are been replaced with new ones that might have been some issue on starting the container. If the task are not able to start, the health check will keep display and unknown status as it didn't have time to gather the information on the new tasks.This could be the issue, but please provide more information to better understand the situation before and during the deployment.Please also have a look inside the Service into the "Deployment and Event" tab where you can find all the information related to your deployment and also some error logs with the issue that didn't allow you container to startCommentShareSimone Tallevianswered 2 months ago"


Question: Where can I found the uri of my Bucket to connect my Symfony application with S3 and upload files?

"I need to upload files from my Symfony application to my Bucket, but I need to know the upload url and prefix data:uri_prefix and upload_destinationWhere can I see this data from my Bucket?FollowComment"

Answer: "1The notes in this documentation should helpCommentShareKevinanswered a year agolDeleted a year agoThank you very much Kevin for your comment, I really appreciate it a lot 🙏🏻I had already taken a look at that guide, but I was a bit confused because in that guide they show the url pointing to a key-name (to an already existing object). Ex:"Virtual-hosted–style access:"https://bucket-name.s3.Region.amazonaws.com/key-name...Amazon S3 virtual-hosted-style URLs use the previous format, but I need the format to upload files...Or it can be enough simply with:https://bucket-name.s3.Region.amazonaws.com/ ... Skipping the "key-name" ?Share"


Question: Cache cluster stuck on taking backup and delete

"I initiated a manual delete of my Redis cache cluster with ID inf-ex-ygonyr7hlpjz and ticked the box asking whether to take one last backup.It has now been stuck in the deleting state for more than two hours, and the back up is stuck in the creating state.I would definitely like a backup before deleting. I searched the forum and found people waiting for days. Any advice?I have deleted cache clusters before without a problem.Thanks for your help in advanceEdited by: EmilOJ on Jun 20, 2019 6:11 AMFollowComment"

Answer: 0UPDATE: It was finally deleted after almost 7 hours.CommentShareEmilOJanswered 4 years ago


Question: Task definition - Unknown parameter in input: "runtimePlatform"

"Hi!When I try to register a new task definition with a gravition architecture I receive an errror:aws ecs register-task-definition --cli-input-json file://td_gravinton.jsonParameter validation failed:Unknown parameter in input: "runtimePlatform", must be one of: family, taskRoleArn, executionRoleArn, networkMode, containerDefinitions, volumes, placementConstraints, requiresCompatibilities, cpu, memory, tags, pidMode, ipcMode, proxyConfiguration, inferenceAccelerators, ephemeralStorageI follow the documentation but I don't what's the problem.Thank you!FollowComment"

Answer: "0Could you share the input file (td_graviton.json) and the version of the AWS CLI you're using?Thanks!CommentShareMatsanswered 2 years ago0Thank you Mats.I tried with this json:{"runtimePlatform": {"cpuArchitecture": "ARM64","operatingSystemFamily": "LINUX"},"containerDefinitions": [{"name": "containerName","image": "xxxxxxxxxxxxxxxxxxxxx","cpu": 2048,"memory": 4096,"portMappings": [{"containerPort": 80,"hostPort": 80,"protocol": "tcp"},{"containerPort": 22,"hostPort": 22,"protocol": "tcp"}],"essential": true,"environment": [{"name": "ENV","value": "PRE"}],"mountPoints": [],"volumesFrom": []}],"family": "familyName","taskRoleArn": "xxxxxxxxxxxx","executionRoleArn": "xxxxxxxxxxxxxxxx","networkMode": "awsvpc","volumes": [],"placementConstraints": [],"requiresCompatibilities": ["FARGATE"],"cpu": "2048","memory": "4096"}And I tried with this too (example in documentation):{"family": "bb-arm64","networkMode": "awsvpc","containerDefinitions": [{"name": "sleep","image": "arm64v8/busybox","cpu": 100,"memory": 100,"essential": true,"command": [ "echo hello" ],"entryPoint": [ "sh", "-c" ]}],"requiresCompatibilities": [ "FARGATE" ],"cpu": "1 vCpu","memory": "3 GB","runtimePlatform": { "cpuArchitecture": "ARM64" },"executionRoleArn": "arn:aws:iam::1234567890:role/ecsTaskExecutionRole"}In both cases I get the same error, it does not recognize the parameter "runtimePlatform"My aws client version is:#aws --versionaws-cli/2.2.46 Python/3.9.7 Darwin/19.6.0 source/x86_64 prompt/offThank you!!CommentSharequiqueanswered 2 years ago0Apologies for the delay in responding. I'm unable to repro the issue.For reference, I'm using AWS CLI v2:$ aws --versionaws-cli/2.4.3 Python/3.8.8 Linux/5.4.72-microsoft-standard-WSL2 exe/x86_64.ubuntu.20 prompt/offWith this, and slightly modifying the task definition you provided (specifying busybox as the container and providing a task execution role in my account), I'm able to successfully create the task definition:{"runtimePlatform": {"cpuArchitecture": "ARM64","operatingSystemFamily": "LINUX"},"containerDefinitions": [{"name": "containerName","image": "arm64v8/busybox","cpu": 2048,"memory": 4096,"portMappings": [{"containerPort": 80,"hostPort": 80,"protocol": "tcp"},{"containerPort": 22,"hostPort": 22,"protocol": "tcp"}],"essential": true,"environment": [{"name": "ENV","value": "PRE"}],"mountPoints": [],"volumesFrom": []}],"family": "forum-post-td-1","executionRoleArn": "arn:aws:iam::ACCOUNT-ID-GOES-HERE:role/ecsTaskExecutionRole","networkMode": "awsvpc","volumes": [],"placementConstraints": [],"requiresCompatibilities": ["FARGATE"],"cpu": "2048","memory": "4096"}CommentShareMatsanswered 2 years ago0I had the same issue and was able to solve by updating to the latest version of the awscli here https://aws.amazon.com/cli/. Note that I had to uninstall my version installed by brew which was lagging the latest release.CommentSharelundbirdanswered a year ago"


Question: What should be my "Record Name" and Responds with" if I add a TXT record for my newly added domain from other registrar?

"I just added my domain to my Lightsail instance and I was prompted to enter the "Record Name" and Responds with" when I try add a TXT record. What should I put in those fields? I already read the documentation here: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/lightsail-how-to-create-dns-entry#lightail-change-the-name-servers and still to no avail. Thank you for any help.FollowCommentGK 3 months agosorry can you provide me your question in detailShareVin 3 months agoHi GK,I don't know what to put in "Record Name" and "Responds with" when I try to add my TXT record.Share"

Answer: "0Accepted AnswerHi Vin,With Amazon Lightsail, it will match closely to the instructions you have from hostinger.com.For the Record Type - This would be TXTFor Record Name - Include the @ symbol (this tells DNS to put the record in the apex or origin of the DNS zoneFor Responds With - This would be the value you have from your registrar for domain verificationHope this helps!CommentShareAWS-User-0357409answered 3 months agoVin 3 months agoThank you for taking time to answer my query.Share0Hi Vin,For those records, the record name would be your subdomain, but the responds with is the TXT record that the registrar is most likely querying to verify domain ownership.   Your domain registrar hopefully has some documentation on what that would be.  If not, please let us know so we can look into this deeper.Hope this helps!CommentShareAWS-User-0357409answered 3 months agoVin 3 months agoWhat do I do as I don't have a subdomain? I only have this domain vinzy.art which is I'm trying to add. I got the domain from Hostinger and this is their documentation regarding TXT: https://support.hostinger.com/en/articles/1583664-how-to-manage-txt-records-in-hpanel. It implies I should manage my TXT in Amazon since the nameservers were already pointed to my Ligthsail. Thank you for looking into my issue.Share"


Question: Cloudwatch Log Insights - Line Chart Issues

"Hello :wave:We are trying to use Cloudwatch Logs together with Cloudwatch Log Insights to Query through application's logs and visualise the API usage by different consumers. A single log consists of fields such as:consumer (api user)controller (base endpoint on which the consumer made a request)action (exact action on which someone sent a request)Sample entry could look like this (obviously it truncated for the sake of explaining the problem){  consumer: 'test-app-1',  controller: 'api/test-controller',  action: 'test-action}Now, I would like to find a way in which I can group this in a line chart, for example requests made to different controllers by the consumers over time or exact action requests by consumers over time.I am not sure how to write the query, if I am to be honest, asfilter @logStream = 'someLogStream' | fields @timestamp, @message | stats count() by consumer, controller, actiondoes not generate a line chart over time, and addingfilter @logStream = 'someLogStream' | fields @timestamp, @message | stats count() by consumer, controller, action, bin(15m)does not change the error message on visualisation screen, which states that:The data is not suitable for a line chart.Try a bar chart, or group your result by bin function.Can anyone advise on what should I do? For starters, requests over time per consumer would be a nice metric and I believe that once we get to that point, we will be able to modify it per action / per controller. I think that I lack proficiency in the Insights syntax to achieve what I want.Thanks!FollowComment"

Answer: "1Thank you for this question. You are right about a lot of things here. Below I have explained a few pointers, that can help in writing your queries.The following statement needs to be changed, for proper use of the bin() function:stats count() by consumer, controller, action, bin(15m)In the above statement, you might have observed an error (on hovering your mouse on the underlined red-lines in your query on console) stating that bin() is not valid in this position - because, EOF or other applicable keywords are expected after by in the query. For example stats count(action = 'test-action') by bin(15m) would be valid.count() expects parameters i.e. either count() or count(fieldName: LogField). You can also use * as your parameter like this - count(*). Read more here.Coming to your use case to count number of requests for a specific consumer - for example: to count the number of log events for consumer "test-app-1", change your query to something like the following: filter @logStream = 'someLogStream' and consumer = 'test-app-1' | fields @timestamp, @message | stats count(*) by bin(15m)Notice that I have used the filter statement in order to only fetch the results for a specific consumer, feel free to experiment with such options for other filtering that you might want to perform.I recommend reading the AWS documentation titled "CloudWatch Logs Insights query syntax". Specifically, for this question - the sections "Matches and regular expressions in the filter command" [1] & "Supported operations and functions" [2] can be helpful in getting more clarity & for further learning.I hope this answer helps in starting with your analysis using Log Insights queries. Feel free to comment on any clarification needed.Happy learning!CommentShareSUPPORT ENGINEERShreyas_Manswered 8 months ago"


Question: Is my MTurk task too long?

"I am a first-time requester via MTurk. I have recently created a survey-based HIT that will take 30 minutes to complete. It is limited to US participants aged over 18 years, and the remuneration is $10. I am looking for quality responses, so I followed the guidelines suggested and limited the HIT to workers with a rating over 97% and 10,000 assignments. The task has been open for around 7 hours and I have had 1 response. Is this normal?FollowComment"


Question: Read-only file system AWS Lambda

"I am trying to write to a text file in Lambda but i get an error"errorMessage": "[Errno 30] Read-only file system: 'tmp/Mentions_ID.txt'"Apparently i can read from the same file and others but i can't write. My code is belowdef lambda_handler(event, context):    # TODO implement    file1 = 'tmp/Mentions_ID.txt'    # check for the last saved mention    with open(file1, "r") as textfile:        mention_id = textfile.read()     """Some other code"""    # save the last mentioned    with open(file1, "w") as textfile:        textfile.write(str(IDs[0]))What i've tried:I have seen a lot of solutions addressing this issue, most point to the fact that i need to create a /tmp  folder in the same directory as my lambder python file, i have since done that i still can't write. I have also copied the path by right clicking on the file but then it gives me a path beginning with a "/" '/tmp/Mentions_ID.txt', when i run this it gives me a FileNotFoundError.I do not know what else to try please help, my last option would be to use RDS but i don't want to tow that path, thank you.FollowComment"

Answer: "2If you are trying to persist data between Lambda invocations, you will need to use something external to Lambda. The /tmp folder is temp storage that should only be used during the duration of a single Lambda invocation. However, there are many ways to persist data. Here are a couple common solutions.Store the file on S3. If it is a small enough file that can be easily loaded and written to during the course of your Lambda this might be a good choice.DynamoDB - You could store the data in a DynamoDB table, which is also serverless, very easy to set up, and less expensive than running an RDS instance. This is a very common pattern for persisting data with Lambda.Here is an example of how to build a simple CRUD API with Lambda, DynamoDB and API Gateway.https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-dynamo-db.htmlCommentSharemicahanswered 10 months ago1It should be /tmp/....You missed the leading slashThe only directory you can write within the Lambda environment is /tmp. All other directories are read-onlyCommentShareRichardFananswered 10 months agorePost-User-1663789 10 months agoI addressed that in the question, when i include that slash it doesn't find the file"errorMessage": "[Errno 2] No such file or directory: '/tmp/Mentions_ID.txt'"ShareRichardFan 10 months agoLambda runtime is ephemeralIf you want to persist file, trying using EFS: https://aws.amazon.com/blogs/compute/using-amazon-efs-for-aws-lambda-in-your-serverless-applications/Share1In your code, you are trying to read a file before writing it, thus giving the file not found error. Please, review it. When the Lambda starts, the /tmp folder is empty. You also can't guarantee the file will be available between calls, as the Lambda function may be recycled.CommentShareEduardoanswered 10 months agorePost-User-1663789 10 months agoYeah, i understand you.For my use case i need to read data from a file use that data to execute some code and then write (replace) the result back into the file. So i may need this files to be permanent rather than temporary. So if that won't work i may need to opt for a database solution like RDS. Except you of course have any other optionShare0It is not clear what you are trying to do exactly. Your code first tries to read a file and then write to it. Are you trying to write to a file that you included as part of the Lambda deployment?If this is the case, you should be aware that the only location inside a Lambda runtime you can write to is /tmp (and not tmp as in your code), but you can't place files there during deployment time. So you will need to copy the file to /tmp and edit it there. Saying that, this is probably not what you want as the /tmp is not shares across Lambda runtime environments and different invocations can get to different environments.The recommended solution would be to save the file to some external store which can be: EFS, S3 or some database. All depending on your exact usecase.CommentShareEXPERTUrianswered 10 months ago"


Question: Can someone explain the mismatch between doc and API regarding pricing of EC2 AWS Outbound traffic

"I'm trying to understand how AWS is computing the pricing for AWS EC2 Outbound traffic. From the doc and for example for region Sao Paolo:https://aws.amazon.com/ec2/pricing/on-demand/it says base price is $0 for first 100GB, then $0.15/GB for first 10 TB, then $0.138/GB and so on. Indeed this is what gives the calculator: https://calculator.aws/#/estimate?id=1c7c2b12033911563ef000e40f7a4fc29c5d147cHowever when using the AWS Pricing API, I don't get the same pricing:aws --region us-east-1  pricing get-products --cli-input-json '{"FormatVersion":"aws_v1","ServiceCode":"AmazonEC2","Filters":[{"Type":"TERM_MATCH","Field":"transferType","Value":"AWS Outbound"}]}'|jq '.PriceList[]|fromjson'                  {  "product": {    "productFamily": "Data Transfer",    "attributes": {      "fromLocationType": "AWS Region",      "toRegionCode": "",      "servicecode": "AmazonEC2",      "usagetype": "SAE1-DataTransfer-Out-Bytes",      "fromRegionCode": "sa-east-1",      "transferType": "AWS Outbound",      "servicename": "Amazon Elastic Compute Cloud",      "fromLocation": "South America (Sao Paulo)",      "toLocationType": "Other",      "toLocation": "External",      "operation": ""    },    "sku": "6ZUKMU6RKW7EH89N"  },  "serviceCode": "AmazonEC2",  "terms": {    "OnDemand": {      "6ZUKMU6RKW7EH89N.JRTCKXETXF": {        "priceDimensions": {          "6ZUKMU6RKW7EH89N.JRTCKXETXF.VF6T3GAUKQ": {            "unit": "GB",            "endRange": "51200",            "description": "$0.23 per GB Internet Data Transfer - next 40 TB / month data transfer out of Amazon EC2",            "appliesTo": [],            "rateCode": "6ZUKMU6RKW7EH89N.JRTCKXETXF.VF6T3GAUKQ",            "beginRange": "10240",            "pricePerUnit": {              "USD": "0.2300000000"            }          },          "6ZUKMU6RKW7EH89N.JRTCKXETXF.8EEUB22XNJ": {            "unit": "GB",            "endRange": "1",            "description": "$0.00 per GB Internet Data Transfer - first 1 GB / month data transfer out of Amazon EC2",            "appliesTo": [],            "rateCode": "6ZUKMU6RKW7EH89N.JRTCKXETXF.8EEUB22XNJ",            "beginRange": "0",            "pricePerUnit": {              "USD": "0.0000000000"            }          },          "6ZUKMU6RKW7EH89N.JRTCKXETXF.N9EW5UVVPA": {            "unit": "GB",            "endRange": "153600",            "description": "$0.21 per GB Internet Data Transfer - next 100 TB / month data transfer out of Amazon EC2",            "appliesTo": [],            "rateCode": "6ZUKMU6RKW7EH89N.JRTCKXETXF.N9EW5UVVPA",            "beginRange": "51200",            "pricePerUnit": {              "USD": "0.2100000000"            }          },          "6ZUKMU6RKW7EH89N.JRTCKXETXF.WVV8R9FH29": {            "unit": "GB",            "endRange": "10240",            "description": "$0.25 per GB Internet Data Transfer - remainder of first 10 TB / month data transfer out of Amazon EC2",            "appliesTo": [],            "rateCode": "6ZUKMU6RKW7EH89N.JRTCKXETXF.WVV8R9FH29",            "beginRange": "1",            "pricePerUnit": {              "USD": "0.2500000000"            }          },          "6ZUKMU6RKW7EH89N.JRTCKXETXF.GPHXDESFBB": {            "unit": "GB",            "endRange": "Inf",            "description": "$0.19 per GB Internet Data Transfer - data transfer out of Amazon EC2 / month over 150 TB",            "appliesTo": [],            "rateCode": "6ZUKMU6RKW7EH89N.JRTCKXETXF.GPHXDESFBB",            "beginRange": "153600",            "pricePerUnit": {              "USD": "0.1900000000"            }          }        },        "sku": "6ZUKMU6RKW7EH89N",        "effectiveDate": "2022-12-01T00:00:00Z",        "offerTermCode": "JRTCKXETXF",        "termAttributes": {}      }    }  },  "version": "20221222205132",  "publicationDate": "2022-12-22T20:51:32Z"}Indeed this is way different: $0 up to 1GB (and not 100GB), then $0.25 for first 10TB, $0.21 and so on. What is the correct price?Finally, using the AWS Pricing API I can't get any other pricing for other regions. The request above only gives reply for Sao Paulo.FollowComment"

Answer: "0Hi.You are right. I also tried (AWS CLI v1 & v2 )The amount is incorrect and only the sa-east-1 region is retrieved.This is probably the wrong behavior of the AWS CLI or AWS API.However, I believe Document is correct and API is wrong because the documentation states:The AWS Price List Query API provides pricing details for your information only. If there is a discrepancy between the offer file and a service pricing page, AWS charges the prices that are listed on the service pricing page. For more information about AWS service pricing, see Cloud Services Pricing.https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/using-pelong.htmlCommentShareEXPERTiwasaanswered 5 months ago"


Question: Unable to load trained model in Sagemaker

"I have trained a few models in sagemaker however I am unable to load them for prediction.I am picking model details from: Sagemaker > Inference > Models > Container 1 section:Image_uri = value in imagemodel_data = Value in model data locationthen passing these values into sagemaker Model function.When I deploy this model, it gives error: ping health check failed for AllTraffic production variant. This error doesn't come when I train a new model and deploy it.FollowComment"

Answer: 0The cause for issues like this are due to a mismatch between the base model between the training and inference endpoints. A solution similar to below would help resolve your issue.Github repo : https://github.com/marshmellow77/sm-extend-container/blob/main/02_extend_container.ipynb. talks about how to  extend the existing Hugging Face DLCs by pulling them from the public ECR and running a simple Dockerfile on top of them that will install the latest available version of transformers.CommentSharemarancsanswered 4 months ago


Question: Request for addition of TLD ".realty" to Route 53

"Hi, I would like to transfer a domain from another registrar. But, the TLD ".realty" seems to be not available in the TLD list. Can you consider adding ".realty" to the TLD list ? Thank you.FollowComment"

Answer: "0Hello, thank you for reaching out.I understand that you are requesting to allow transfer of .realty TLD Transfer to Route 53Transferring .realty TLD within Route 53 is on the roadmap with no public ETAs.Having said that, you can create a Hosted Zone for .realty domain in Route53 to use it as your DNS service provider. This means you can point your name servers at your current registrar to Route 53 to manage your DNS.Additionally, Route 53 Domains is currently directly accredited with .com, .net, and .org registries. All other TLDs are provided via third party registrar associates. To improve our level of service and support, we are actively working to become directly accredited with all other TLDs. In addition to improving our existing offering, we will become accredited with other registries to expand our TLD catalog. This work is currently in progress. We do not currently have dates to share for adding new TLDs.I recommend subscribing to https://aws.amazon.com/about-aws/whats-new/2022/ and filtering for "Networking & Content Delivery > Amazon Route 53" for updates specific to Route 53.Thanks!CommentShareSUPPORT ENGINEERshreyasAWSanswered a year ago"


Question: Move Glacier data to Deep Glacier

Is there anyway to move data that I have already backed up into Glacier into Deep Glacier?Or do I have to upload it all again?Thanks.FollowComment

Answer: "0I had objects in a bucket with a lifecycle rule moving to glacier. I just updated the rule to move to deep archive and when I looked later everything, including the previously glacier objects, had been moved to deep archive. Be warned though, it will count that as deleting them from glacier when they are moved. I got hit with some early delete fees because of that.CommentShareJSnideranswered 4 years ago0Thanks for your reply.I uploaded the data directly to Glacier using Fastglacier URL:http://fastglacier.com/I didn't use the S3 console.Can anybody hep with moving it to Deep Glacier?Thanks.CommentSharedhx1answered 4 years ago0S3 Glacier Deep Archive is an S3 storage class, it is not supported by the separate Glacier service where FastGlacier uploads data.CommentShareAWS-User-1169509answered 4 years ago0Thank you for your reply.I would like to move this data from Glacier to S3 so I can then transition it to Deep Glacier.What is the cheapest way to do it?Download it to my PC and reupload it, or is there another way?Ta.Edited by: dhx1 on Apr 3, 2019 10:27 AMCommentSharedhx1answered 4 years ago0There are three pieces to consider here. First, there will be a cost per object and per GB to restore your existing data from Glacier. Bulk retrievals will be the most cost effective option.Second, as your archives are restored you can either download them to your local machine, which will include a per GB data transfer cost, or you can use an EC2 instance, container, or lambda function to move the data to S3 Glacier Deep Archive. Using an EC2 instance, container, or lambda function will save the data transfer cost, but include a cost for the EC2 instance, container, or lambda function.Third, the PUT to Glacier Deep Archive will also include a per object cost.I recommend considering the entire cost of the transition to determine if it's worthwhile to move your objects from the Glacier service to S3 Glacier Deep Archive.CommentShareAWS-User-1169509answered 4 years ago0Could you be more specific concerning the second phase?EC2 instance, container or lambda function are some virtual machines if I get it right. So I should write some code to GET my data from Glacier and PUT them into S3 Glacier ? Some the simplest way to do it ?CommentSharepnowakanswered 2 years ago0Not sure why it's not an AWS built-in but: https://github.com/aws-solutions/amazon-s3-glacier-refreezerCommentShareHoaPhananswered 19 days ago"


Question: Custom Routing setup help

"I am trying to setup a Global Accelerator using Custom Routing, but running into issues. I keep getting the following error:There are not enough accelerator ports remaining to support the requested endpoint.After looking into it, this part of the documentation catches me off guard:Listener port ranges - We recommend that you allocate listener port ranges linearly and make the ranges large enough to support the number of destination ports that you intend to have. That is, the number of ports you should allocate should be at least the subnet size times the number of destination ports and protocols (destination configurations) that you will have in the subnet.This is what strikes me as odd, or possibly I am trying to set it up the wrong way. This is what I hope to achieve:I have a number of game servers running in us-west-2, lets say 2 EC2 instances. Each of these instances will be hosting one or more game sessions. I have configured it so that server1 will use ports 1000-1999, and server2 will user ports 2000-2999.In the client, I want to be able to point to the Global Accelerator IP address, using a port from 1000-2999, and have it end up at either server1 or server2 depending on which port number is used.So I set it up a custom accelerator, and add my first listener.Listener port range: 1000-1999.Endpoint Groups: One entry - us-west-2, Port range 1000-1999, Protocols TCP & UDP.Endpoints: One entry - Subnet <my-subnet-us-west-2a>, Allow traffic to specific destination socket addresses, IP Address <server1 - 172.31.123.123 >, Ports 1000-1999.After clicking save, I get the error:There are not enough accelerator ports remaining to support the requested endpoint.Am I going about this the wrong way entirely? I am a bit confused at the endpoint stage also, since I can just choose the entire subnet and leave it at 'Allow traffic' but what EC2 instance would it go to? Pick a random IP in that range and hope it maps to an active EC2 server?Or is this where the documentation note comes into play - in that it is doing something like port 1000-1999 will be mapped to the first valid IP in the subnet. 2000-2999 would be mapped to the second valid IP, and so on and so forth, therefore needing a huge number of initial listener port ranges.FollowComment"

Answer: "0After further investigation, I found this page - https://docs.aws.amazon.com/global-accelerator/latest/dg/about-custom-routing-how-it-works.html - which has a more clear explanation of how the mappings work. I guess it is set up to map ports to every single IP address within the given subnet.It's not exactly what I was expecting, but I can work with this understanding now and fit within the limitations to adapt to our needs.CommentSharebfskyleanswered 2 years ago"


Question: "I accidentally created RDS and Redis resources other than Free tier, can I be exempted?"

per Memory optimized r6g.large node hour in Asia Pacific (Singapore)78 HrsUSD 28.94per db.r5.large Single-AZ instance hour (or partial hour) running Aurora MySQL77.869 HrsUSD 27.25FollowComment

Answer: "1I would suggest to raise Support ticket towards AWS Support, they may provide some help on it . You can raise support case by going to Support section in AWS Console.CommentShareVikasanswered 2 months ago0The first thing Support will ask you to do is to terminate the resources causing the unwanted charges. You can use your bill to locate which services you've run in which regions that month, to help you locate and stop the charges. Via your Billing Dashboard, navigate to your April bill to see what's been charged for so far:https://us-east-1.console.aws.amazon.com/billing/home?region=us-east-1#/billsOnce there, take note of not only the services running, but the regions in which they're running. You may have to click the service name to expand to show the regions, or click "Expand All" in the top right.If you want one on one help with locating and stopping the source of the charges, you can reach our Support team via a Basic Support case below. There are email, phone, or chat options - I recommend a phone call for the quickest assistance:go.aws/support-center— Chrissy B.CommentShareEXPERTAWS Support - Chrissyanswered a month ago"


Question: Unable to call to claimed number from my Indian number

"Hi Team,I have claimed an NZ phone number and mapped that number to a simple inbound test flow. When I try to call that number from my Indian cellular number, it's not connection. Can anyone help in this to sort it out?FollowComment"

Answer: "0Hi,Can you please ensure that making international calls from your India network is enabled?Best Regards,Ramy HusseinCommentShareRamyHanswered 2 months ago"


Question: Rekognition Custom Labels and Ground Truth integration question

"Hello!I've created a semantic segmentation (SS) job in Ground Truth (GT), and it shows all objects are labeled, and the status is Complete. The manifest file appears to be syntactically correct.Within Custom Labels (CL), I've created a dataset by choosing "Import images labeled by Ground Truth" option and using the manifest file created in GT. It parses correctly. However, when I look at the available dataset in the console, I see that there are zero labeled images. Viewing the images also displays zero labels.I have done the same with bounding box (BB) jobs in GT, and they import into CL correctly.Do CL datasets not support import of SS GT manifest files? I can't find anything in the documentation that states either way.Thanks for your help.FollowComment"

Answer: 0Hey lkoivuThank you for using CustomLabels!Unfortunately we do not support semantic segmentation jobs. Currently we support 2 groundtruth formats - Classification Job Output & Bounding Box Job Output.You can find the formats documented here:(a) Sagemaker GT - https://docs.aws.amazon.com/sagemaker/latest/dg/sms-data-output.html- See section "Classification Job Output" for image level labels- See section "Bounding Box Job Output" for bounding box format(b) Custom Labels- Image level labels - https://docs.aws.amazon.com/rekognition/latest/customlabels-dg/cd-manifest-files-classification.html- Bounding boxes - https://docs.aws.amazon.com/rekognition/latest/customlabels-dg/cd-manifest-files-object-detection.htmlI have passed on feedback to the team to make this more clear in our documentation as well as on our console.We do have roadmap items to expand our support to other ground truth formats.CommentShareawsrakeshanswered 3 years ago


Question: Keep getting network error trying to sign up to AWS DeepRacer student

"Hey there, I keep getting a network error every time I try to sign up to the DeepRacer Student. I tried using my school email, then my was email. I tried logging in with my school email too, and my AWS Educate credentials and so on. I then even set up multi-user access for deep racers but it still didn't work. I keep getting a network error response every time I try to sign up or login in. I don't know what to do and I would be really grateful for some support. Thank you. edit: just saw that it's the same for AWS BugBust, when I try to sign up or login it gives a network error too.FollowCommentAWS-User-0842291 a year agoHello! Please provide the full text of the error message you are receiving. Are you using a virtual private network (VPN)? (If so, try signing up again after disconnecting.) Also, when exactly are you seeing this issue? Are you able to open the website, fill in the sign-up info, and receive the error message when you select the sign-up button, or do you receive it when you are doing something else? It's also helpful to know what internet browser you are using and what country you are signing in from. Thanks!ShareAWS-User-4329769 a year agoThank you for the reply, the problem is solved after I tried going on my phone and using mobile data! That tip helped thank you very much!Share"

Answer: "0Accepted AnswerThere are no specific network requirements for using an AWS DeepRacer student account as it's just a version of the standard AWS DeepRacer console, so can you provide the full error message, along with any other useful / relevant details - thanks.Also as an alternative if your school is signed up to use AWS Academy and  you have an active account provisioned - you should be able to get the details you need from your school / University and they would also be the best people to speak to about your account (if they are unsure what the issue is then they can also raise a support request) you could use that instead.  Good luck with the racing.CommentShareDavidFSmithanswered a year agoAWS-User-4329769 a year agoHey there, thank you for the reply! It only says "Network Error", whether I'm trying to register or log in.Share"


Question: Error enrolling accounts with AFT and Control Tower

"Hello,We have started using AFT to provision our AWS accounts but as of last week we have been receiving an error that I have been unable to troubleshoot myself. We don't have a paid support plan with AWS so we are basically on our own with this one and Im hoping someone here has had a similar issue.The account-request pipeline completes successfully triggering the account creation but after approx one hour the enrolment fails.The provisioned product in Service Catalog shows as tainted and give the error:"AWS Control Tower cannot complete the operation because activation of account 123456798123 is not complete. Try again in one hour. If this error persists, contact AWS Support."The  aft-account-provisioning-framework state machine fails on the aft_account_provisioning_framework_persist_metadata step and has the error:"errorMessage": "An error occurred (SubscriptionRequiredException) when calling the GetParametersByPath operation: The AWS Access Key Id needs a subscription for the service"All other steps above this carry the error:state": "FAILED",  "message": "AWS Control Tower failed to create an enrolled account."even though they appear to have succeeded.We are finding it quite difficult to find the cause of this and wondering does anyone have any ideas on where we can go from here? What to investigate etc. The logs for ControlTower are not exacly verbose. We upgraded from v1.6.6 to v1.9.2 today and the problem persists. Any help appreciated.FollowComment"

Answer: 0It may be possible that your account is new and payment mode is still not verified by Amazon. Please re-check.CommentSharevtjeananswered 2 months ago


Question: Performance Insights for Postgres 12.2 is consuming 100% CPU

"A query forselect datname, pid, usename, application_name, client_addr, client_hostname, wait_event_type, wait_event, query, backend_type from pg_stat_activity where state = 'active'is running permanently under user rdsadmin from 127.0.0.1, consuming 100% CPU on Postgres 12.2 in RDS.FollowComment"

Answer: "0Yes, this is an issue with Performance Insights on Postgres 12.2.The query in questions runs with minimal CPU and the display of 100% CPU is incorrect.A fix has been implemented and will be  rolled out to the fleet.KyleCommentShareAWS-User-1731424answered 3 years ago"


Question: How to create one metrics filter for multiple CloudWatch log groups?

"I have created Lambda function testA and testB with exactly the same source code.lambda_function.pydef lambda_handler(event, context):    print(event)Executing these functions will print the value of the event variable to the log groups "/aws/lambda/testA" and "/aws/lambda/testB".I want to filter the event variable values in these logs and record them in the same metrics.How can I create a metrics filter?FollowComment"

Answer: "1Accepted AnswerCloudWatch metric filters are restricted to a single log group.  There is not a way to set up a single metric filter to cover multiple log groups at present.You can setup one metric filter for each log group. You can then use Metric Insights to combine those component metrics at query time for either an alarms or dashboards.CommentSharetichenmanswered 3 months agoEXPERTkentradreviewed 3 months agorePost-User-1704220 3 months agoOh, I see, so I can only set one metrics filter per log group.You can setup one metric filter for each log group. You can then use Metric Insights to combine those component metrics at query time for either an alarms or dashboards.I will try it that way. Thank you !Share"


Question: I would like an explanation for minor traffic from other zones

Our monthly bill in the Data Transfer section shows traffic in very small amounts from and to many of the worldwide zones outside of our specified zone. Is there a way to find out what this traffic is? We are undergoing a SOC-2 audit and the auditor is asking us for an explanation.FollowComment

Answer: "0Hello,A good first step would be to enable VPC Flow Logs.  This will help you understand the flow of traffic and the sources/destinations of that traffic.It may also help to check Cost Explorer and filter to only show you services that have Data Transfer to the specific regions/locations you're concerned with.CommentShareEXPERTChris_Ganswered 7 months agoEXPERTTushar_Jreviewed 7 months ago"


Question: Build Catalogue Limit

"I am aware of the game build catalogue limits ("The build catalog can store the maximum of 1,000 builds or 100GB of storage.").I am just wondering if someone can provide clarity on what happens after either of those limits are reached? Do old builds need to manually be removed, or is there some options in place to cycle out oldest as new builds come in.Thanks,BryanFollowComment"

Answer: "0Hi @REDACTEDUSERwhat happens after either of those limits are reached?When those limits are reached, you will run into a ConflictException with an error message like Current limit of builds of 1000 have been reached. or Account is currently over limit. Current total size: 100.12GB. Allowed total size: 100.00GB.Ideally, this should be LimitsExceededException, but the service is quite old and we cannot change it anymore to be backwards compatible.Do old builds need to manually be removed, or is there some options in place to cycle out oldest as new builds come in.Nope, GameLift does not offer such mechanism intentionally, because it's very risky to delete something on behalf of the customer (False positives could be costly).It's straightforward to do this by yourself though. You can write a scheduled job (e.g. a cloudwatch scheduled event triggering a lambda function every N days) that does the following:Call ListBuild to get all of your buildIterate through the resulting Builds (you'll likely need to paginate multiple pages), get the Build's Version or CreationTime.Compare the value with your cutoff version or cutoff date, if too stale, call DeleteBuild to delete the build. The cutoff version/date could be set as lambda environment variable to enable easy editing.NOTE:Deletion by CreationTime is not recommended, because some of your build could be old but might still be useful.DeleteBuild has a API rate limit of 4TPS burst and 1TPS sustained, so please add a rate limiter to ensure no more than 1 DeleteBuild is called per second, or you will get throttling exceptions.If needed, you could also setup monitors to alert you when you have more than N builds (e.g. 700, or 70% of your capacity), and manually drive an aggressive cleanup if needed.CommentSharerePost-User-7108006answered 2 years ago0Thank you! This makes sense.BryanCommentSharerePost-User-7357234answered 2 years ago"


Question: RDS login from SSMS is giving error 258

"I had been using my RDS instance for 2 years now via SSMS. Since last couple of days, the RDS instance is giving me error 258.I have attached the error detail as -I have confirmed my security group is set to public and is available anywhere.I tried disabling my windows firewall, but nothing seems to help.Can either of you help me find a resolution to the same?Will re-creating a snapshot and deleting the DB instance. and then rebuilding the DB instance from snapshot help?FollowComment"


Question: "Application side data protection with FIPS 140-2 Level 3 : what to use out of Encryption SDK, KMS or Cloud HSM?"

"Hello there, I do have a requirement in my application to encrypt and decrypt data using a symmetric key algorithm (mostly AES/CBC/PKCS5Padding).CONSTRAINT and Requirements areI need to use FIPS 140-2 Level 3 compliant key storage solutionThis is an existing encrypted data and hence I should be able to import my existing keys (plain keys) to whatever solution I use.Even in the future, keys should be open for EXPORT so that encrypted data with this new solution WILL NOT require another re-encryption with new keys.Keeping the above points in mind, I came across below solutions so far and need guidance and help if someone finds that not a good solution or it will break any of the above requirements I listed.I can use AWS Encryption SDK with AWS KMS using a custom key store where the custom key store would be my own Cloud HSM.I can directly use Cloud HSM by leveraging standard Cloud HSM integration using Cloud HSM JCE provider and client SDK.I can AWS KMS with KMS API with a custom key store where the custom key store would be my own Cloud HSM.I knew #2 will work without breaking any of my requirement and compliance list but I want to see if I can use Encryption SDK and/or KMS for my use case as I can get help of SDK to choose best industry practices to write cryptography code instead of I write whole code (in case of Cloud HSM integration) but below points will stop me.Custom key stores can not work with imported keys so it will break my requirement #2.I can use AWS Encryption SDK with KMS but as import does not work for custom key stores, it's not usable any more. Can I use AWS Encryption SDK somehow to help me with data encryption directly with Cloud HSM?Data enveloper protection (by AWS Encryption SDK) is really more secure for symmetric key encryption. If I use that today and later want to move to Cloud HSM, will it break the decryption flow?Any suggestion/experience learning/insights or architectural direction is greatly appreciated.FollowComment"

Answer: "0From your requirements option 2/CloudHSM would be your best option.It complies with FIPS 140-2 level 3\[1].You import your own existing keys\[2].Exporting key is also possible\[3].The primary roadblock you face with attempting to use a KMS Custom Key Store is you cannot import key material into a KMS key Custom Key Store. KMS will instead generate the key material for the KMS key in the AWS CloudHSM cluster[4].Primarily due to your FIPS 140-2 level 3 requirement, using CloudHSM with one of the Client SDKs[5] would be the best option.Regarding your question about whether you can use the Encryption SDK with CloudHSM, I did come across the following section in our FAQ[6] for the Encryption SDK:"You can use AWS KMS keys as wrapping keys in the AWS Encryption SDK, but it is not required. You can use encryption keys that you generate and those from your key manager or on-premises hardware security module. You can use the AWS Encryption SDK even if you don't have an AWS account."From that line, it may be possible to use the Encryption SDK with CloudHSM but I was not able to find any specific examples of this so it may require some testing on your end.[1] FIPS validation - https://docs.aws.amazon.com/cloudhsm/latest/userguide/fips-validation.html[2] Using the command line to manage keys - Import keys - https://docs.aws.amazon.com/cloudhsm/latest/userguide/using-kmu.html#import-keys[3] Using the command line to manage keys - Export keys - https://docs.aws.amazon.com/cloudhsm/latest/userguide/using-kmu.html#export-keys[4] Managing KMS keys in a custom key store - https://docs.aws.amazon.com/kms/latest/developerguide/manage-cmk-keystore.html[5] AWS CloudHSM Client SDKs - https://docs.aws.amazon.com/cloudhsm/latest/userguide/use-hsm.html[6] Frequently asked questions - https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/faq.html#aws-sdksCommentShareSUPPORT ENGINEERMichael_Hanswered a year agokp a year agoThanks Michael. I like to use AWS Encryption SDK with the keys generated out of the Cloud HSM. Reasons behind are:Envelope Encryption. Each message is encrypted using data key and data key is encrypted using another wrapping key (this would be wrapping key from Cloud HSM).I do have a requirement to have distinct keys for each region (app will be deployed to multi-regions). Though distinct keys, I want to keep supporting DR, Failover. Cloud Backup and generation of new cloud from that is an option but that is a manual route and keys don't sync once backup is done. Solution would be using Multi-keyrings (https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/use-multi-keyring.html). I can have multi keys (one for region) and encryption SDK will encrypt the plain text with multiple wrapping keys and you should be able to decrypt the encrypted message by one region when you copy the same data to another region (as wrapping key (region 2) will be able to decrypt the envelope (encrypted by region 1).Do you think any issues in this approach? I can think of one like how do I know that how many wrapping keys I need in advance? Example: at initial stage, I can have 2 region so I will create two wrapping keys from Cloud HSM and start encrypting the plain text. Later on If I add another region, at that point, I will not have my plain text data encrypted with the wrapping key from that region. How can I handle this scenario if using ESDK?Share"


Question: Download full cloudwatch log via console

Can AWS please add an option to download a full cloudwatch log via the console ?ORCan AWS add an option to do a search for a string and show the results in context to the file AND have the ability to continue scrolling through the logs from a point found by a search.It is odd that we have to revert to external tools like awslogs.This should be part of cloudwatch.Logs are mainly used for finding issues.. without context they are useless.FollowComment

Answer: "0From GPTChat:how can i download a logfile from AWS cloudwatch ?To download a log file from AWS CloudWatch, you can use the AWS Management Console or the CloudWatch API. Here is a brief overview of the steps for each option:Using the AWS Management Console:-Sign in to the AWS Management Console and open the CloudWatch console.-In the left navigation pane, choose Logs.-Select the log group that contains the log stream you want to download.-Select the log stream that contains the log events you want to download.-Choose the log events that you want to download. You can select a time range or use the search box to find specific log events.-Choose Download.-Choose Save File to save the log file to your local computer.Using the CloudWatch API:-Use the GetLogEvents API to retrieve log events from a log stream.-Use the downloadLogFile API to download a log file from a log stream.-For more detailed instructions and information, see the AWS documentation on downloading logs from CloudWatch.CommentShareclogwoganswered 6 months ago"


Question: DataSourceArn error for Athena Quick sight in cfn template

"AWSTemplateFormatVersion: '2010-09-09'Description: 'Creating QuickSight data source'Resources:QuickSightDataSource:Type: AWS::QuickSight::DataSourceProperties:AwsAccountId: !Ref AWS::AccountIdName: Testing Data SourceType: ATHENADataSourceId: testing-data-sourceDataSourceParameters:AthenaParameters:Workgroup: primaryPermissions:- Actions:- quicksight:DescribeDataSource- quicksight:DescribeDataSourcePermissions- quicksight:PassDataSourcePrincipal: !Sub- 'arn:aws:quicksight:us-east-1:${Account}:user/default/my-user-name'- Account: !Ref AWS::AccountIdQSDataSet:DependsOn: QuickSightDataSourceType: AWS::QuickSight::DataSetProperties:AwsAccountId: !Ref 'AWS::AccountId'DataSetId: 'QSDataSet-test'ImportMode: SPICEName: Dataset-testPermissions:- Actions:- 'quicksight:CreateDataSet'- 'quicksight:DeleteDataSet'- 'quicksight:DescribeDataSet'- 'quicksight:DescribeDataSetPermissions'- 'quicksight:PassDataSet'- 'quicksight:UpdateDataSet'- 'quicksight:UpdateDataSetPermissions'Principal: !Sub- 'arn:aws:quicksight:us-east-1:${AWS::AccountId}:user/default/my-user-name'- Account: !Ref 'AWS::AccountId'PhysicalTableMap:downtime_data_json:DataSourceArn: !GetAtt QuickSightDataSource.ArnInputColumns:- Name: downtimeType: INTEGERSchema: XXX???I have data source & data tables in Athena and want to refer that in above template. I am not finding DatasourceArn, the above template throwing error as Model validation failed (#: extraneous key [DataSourceArn] is not permitted)". can anyone please help me out to hash out this.FollowComment"


Question: Affiliation with Activate Provider

I received an organization ID to receive AWS credits from my investor. Will my affiliation with the investor be checked when considering my application for the credits?FollowComment


Question: AWS VPN Client - how does it open a browser for SSO ?

"I would like to get the AWS VPN client working on a non ubuntu/debian based linux. The main issue seems to be opening the default browser for authentication. I would like to know what mechanism is used to open the default browser. Hitting [Connect] on my setup causes an "Unknown error ocurred, Try Again." message. Does it call an external binary like "open" or something else ?FollowComment"

Answer: "0The user opens the AWS-provided VPN client on their device and initiates a connection to the Client VPN endpoint.The Client VPN endpoint sends an IdP URL and authentication request back to the client, based on the information that was provided in the IAM SAML provider.The AWS provided VPN client opens a new browser window on the user’s device. The browser makes a request to the IdP and displays a sign-in page.Reference-  https://aws.amazon.com/blogs/security/authenticate-aws-client-vpn-users-with-aws-single-sign-on/For granular troubleshooting, we require details that are non-public information. Therefore, kindly open a support case with AWS using the following https://console.aws.amazon.com/support/home#/case/createCommentShareSUPPORT ENGINEERNeha_Sanswered a year ago"


Question: code deploy agent duplicate log entries

"I'm experiencing an issue with a deployment to one of several Windows servers - other servers with the same job are deploying correctly.  The issue is that upon extraction of a zip file the following error occurs:Exception calling "ExtractToDirectory" with "2" argument(s): "The file 'C:\Prog....c.yml'  already exists."   (path shortened for brevity)After the deployment failed, I looked in the directory and sure enough the file was there and it was written by the code deployment job.  I noticed something odd though, in the code deploy agent logs there are two sets of every entry, including the above error.  It appears that code deploy is running two instances and they are both trying to perform the same deployment and therefore can't write to the same file.Here is a snippet from the agent log:2022-04-03T00:01:51 DEBUG [codedeploy-agent(13484)]: InstanceAgent::Plugins::CodeDeployPlugin::CommandPoller: PollHostCommand: Host Command =  nil2022-04-03T00:01:51 DEBUG [codedeploy-agent(13484)]: InstanceAgent::Plugins::CodeDeployPlugin::CommandPoller: PollHostCommand: Host Command =  nil2022-04-03T00:01:52 DEBUG [codedeploy-agent(13484)]: InstanceAgent::Plugins::CodeDeployPlugin::CommandPoller: Calling PollHostCommand:2022-04-03T00:01:52 DEBUG [codedeploy-agent(13484)]: InstanceAgent::Plugins::CodeDeployPlugin::CommandPoller: Calling PollHostCommand:2022-04-03T00:01:52 INFO  [codedeploy-agent(13484)]: Version file found in C:/ProgramData/Amazon/CodeDeploy/.version with agent version OFFICIAL_1.3.2.1902_msi.2022-04-03T00:01:52 INFO  [codedeploy-agent(13484)]: Version file found in C:/ProgramData/Amazon/CodeDeploy/.version with agent version OFFICIAL_1.3.2.1902_msi.On servers where the deployment succeeds, I only see one line for each of the above in the log files.  I have restarted the agent service to no avail as well as reinstalled.Any help is appreciated.FollowComment"


Question: EC2 Instance For Bahrain Server No Longer Optimal

"Just a shot in the dark here, I don’t know if anyone can help here, but I’ve tried everything I could think of to fix this issue. I mainly use my EC2 instance to make a VPN for Gaming/low ping purposes. Yesterday morning, suddenly my Bahrain Server Openvpn Connect VPN shot up to 140 ping to Europe and almost everywhere else is much worse than just leaving it off now. It worked flawlessly for the first 7 days, it had 90ms to Europe and it was great for Middle East standards. It hasn’t went down since yesterday, I shut down all my instances after trying to make more with various different settings and it not changing anything. I used other people’s same Bahrain Servers they have open on Mysterium VPN from Amazon so I could test if it’s just mine, and I had the same results from 4 different ones but it worked fine and had low ping a few days prior when I checked those VPNs.FollowComment"

Answer: "0A VPN uses the Internet as the underlying layer.  The Internet is connected through multiple ISPs, and latency is always changing depending on the ISPs and the network conditions on each leg. Using a leased line service like AWS Direct Connect can provide lower and more consistent latency compared to the Internet. Alternatively, you can use TGW to use the accelerated VPN feature that leverages the AWS backbone.CommentShareHyeonanswered 24 days agoPharaoh 24 days agoCould be ignorant but I have one follow up question, thanks for answering as well. The question is, I used a ping spotter to see what the issue is when I connect to the VPN, and I get 16ms to the AWS Bahrain server, but it starts to grow in latency further than it used to when I ping to the usual Europe server IP address I play in. What I’m curious about is will Direct connect help me latency issues after I connect to the VPN, because it seems like connecting to the VPN has 0 issue.ShareHyeon 24 days agoWhen you ping a server in Bahrain and see 16ms, you are probably near the Bahrain region. If you ping Europe after connecting to the VPN, the VPN will again travel across the internet and through multiple ISPs to reach Europe, increasing the latency. For a use case like yours, where you are using a VPN for gaming, it would be difficult to use the AWS direct connect service. This is because AWS direct connect is for connecting your office or data center to the AWS network.Share"


Question: Pinpoint SMS template doesn't work when overriding default attribute values

"We are using the Java SDK to send SMS notifications through pinpoint. I created a simple test template that looks like"Test {{foo}}"In my Java code I add a substitution value for "foo". This all works if I don't specify a default value for "foo" in the template, I get an SMS and "foo" is replaced with whatever real value I specified in the code.It also works if I do specify a default in the template but don't add any substitution in the code. I get an SMS and "foo" is replaced with the default template value.However, if I try both I get an error back from the pinpoint APIDeliveryStatus: PERMANENT_FAILURE,StatusCode: 400,StatusMessage: The request contains substitutions in both the templates and the message.I don't really understand why this is an error condition. My understanding is that I should be able to have a default in the template and it just gets overridden if my message contains a substitution. That's how the docs seem to describe it, and it's how email (but not SMS) templates are behaving for me. What am I missing here?Thanks!FollowComment"

Answer: "0Accepted AnswerHi,Thanks for your patience as we worked with the Pinpoint team regarding your query.  The service team have confirmed that this behavior is expected. It is expected to either have a template substitution or message-level substitution, but not both.  They also mention that email behaves differently due to historical reasonsThe service team also mentions the following:For the part about the documentation regarding overriding default:Substitutions -> (map)The default message variables to use in the notification message. You can override these default variables with individual address variables.It is probably easier to see that in the send-message doc: https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-messages.html.The individual address variables means the address configuration here: https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-messages.html#apps-application-id-messages-prop-messagerequest-addressesOR the endpoint configuration here: https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-messages.html#apps-application-id-messages-prop-messagerequest-endpointsFor the send-user-message, it means the individual endpoint configuration in the user part here: https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-users-messages.html#apps-application-id-users-messages-prop-sendusersmessagerequest-usersCommentShareSUPPORT ENGINEERRyan_Aanswered a year agoEgor a year agoThanks for letting me know. It's unfortunate that SMS works this way, the behavior of email templates is more useful. It lets you specify values when you want, but still have generic default fallbacks in the template for graceful failure. But good to know I'm not doing something wrong, we can perhaps implement defaults in code.Share"


Question: Transfer of .com.au domains failing despite assurances form source registrar that nothing is impeding transfer

I have attempted to transfer two .com.au (giftitnow.com.au and experienceoz.com.au)domains from Crazy Domains to AWS on 4 seperate occasions from 2 different AWS accounts and cannot get the domains to transfer. The current registrar Crazy Domains insists that there is nothing at their end impeding the transfer but WHOIS does not show any signs of an active transfer in progress  and transfer requests just eventually time out. I have transferred other domains from the same Crazy Domains account to the same AWS account and everything has worked as expected but these 2 domains will simply not transfer. Any assistance would be appreciated.FollowComment

Answer: "0Please raise a case with the support team for this. They can interact with the Route 53 service team on your behalf to resolve this issue.CommentShareEXPERTBrettski-AWSanswered a year ago0I had a similar issue in the UK, the Support team was able to help me.CommentShareYawaranswered a year ago"


Question: Where can I find Spot Instance advisor information for the G5 instance?

"At the Spot Instance advisor page we can see information about all instances, G5 instance is missing from here, please can someone advise me where to find the information (particularly Frequency of interruption %) that Spot Instance advisor provides about the G5 instance?Spot Instance advisor link - https://aws.amazon.com/ec2/spot/instance-advisor/FollowComment"

Answer: "0Hi,What AWS Region are looking in? G5 instances might not be available in the Region in which you're looking.Kind regards,MarilynAWSCommentShareMarilynAWSanswered 3 months ago"