Question: Does AWS Security Group Rule Order Matter?

"I want to evaluate the hit count per security group rule, but I'm not sure if the order of the security group rules affects the evaluation or not.In addition, I would like to know how the evaluation order and evaluation status are handled when multiple security groups are applied.According to an answer in the following link, it was written that when multiple security groups are evaluated, they are aggregated into one security group rule set. (I couldn't check the original text because the link of the answer was archived.)https://serverfault.com/questions/483938/multiple-ec2-security-groups-permissive-or-restrictiveThe purpose of measuring hit count is to remove unnecessary items as much as possible by measuring the frequency of use of security groups or security group rules. (I am trying to analyze the vpc flow log.)If the order of the security group rules is important, I will ignore the action (ACCEPT, DENIED) for a specific traffic when defining the hit count and only check whether the evaluation has proceeded.If the order of the security group rules doesn't matter (if all security group rules are evaluated each time), I'm going to define the hit count as the frequency with which a particular security group rule ACCEPTs traffic.If you have any thoughts on the definition of security groups and security group rules hit count would also be greatly appreciated.FollowComment"

Answer: "1In short, the answer is no. If there is one rule in the security group that allows a type access, that rule will take precedence over any rules that deny or limit access, regardless of order. The same is true if you have multiple security groups associated with a resource. The most permissive rule across all the groups is the one that will be applied.If you want rules evaluated in a certain order, consider using a Network Access Control List (NACL) to do so. See more about NACLs in the documentation.You can enable VPC Flow Logs to log traffic going in and out of your VPC to specific resources.CommentShareGrantAWSanswered 4 months agorePost-User-5004268 3 months agoSorry for late comments.I want to know about the case where multiple security group rules allow access.(both inclusive and overlapping)For example, let's say we have security group rules A, B, and C."a" allows ports 1000-2000. (inclusive)"A" allows ports 1000-3000."B" allows ports 1500-9000. (overlapping with A)If I understand "most permissive" in your answer correctly, it seems that only security group rule A will be evaluated for traffic on port 1050, and only security group rule B will be evaluated for traffic on port 1980. Is that correct? Still doesn't the order of security groups or security group rules matter?(As explained in the main text, my ultimate goal is to get numbers for redundant or unnecessary security group rules. Unfortunately NACL is not a concern, as I want to provide a consultant function that optimizes the current user's security groups.)ShareGrantAWS 3 months agoHello. Can you clarify the intent of the rules? SG rules only allow, they don't deny so 3 different rules that allow HTTP to different port ranges cover the ports across all rules even if the same range is covered more than once. The order doesn't matter. If there is one rule or many allowing a certain type of traffic via port 1980, that traffic will be allowed. Order does not matter since there are no denies, only allows. Think of it in binary terms, something is either allowed or it is not. If you say it's allowed 3 times it's still allowed. Ordering matters for something like a NACL, because it can deny traffic so if there is an allow and a deny the system needs to know which one has precedence. That isn't the case when rules only allow.SharerePost-User-5004268 3 months agoHello. I have a client group of multiple developers with permission to edit security group rules. They have no regard for the security group rules used by each other. Some security groups overlap with each other, and some security rules are created for testing purposes and then left unused. So their administrators want to periodically remove unnecessary security group rules. I have access to their VPC Flow Logs, and since my mission is to provide a service that optimizes their security groups, consulting such as suggesting the use of NACL is beyond my scope.I've assumed that there are two security group rules where the port range is inclusive of either one and traffic is included in the port range of both rules. I would have expected that if the security group rules were evaluated one by one, the first rule would produce an ACCEPT result in traffic, and the next rule would not be used at all, even though it could also produce an ACCEPT result. ("Used" here means making an ACCEPT or DENY roll. Not being used does not make a DENY roll.)In other words, what I'm interested in is not how the order of security group rules affects whether traffic is allowed or not, but whether certain group rules are evaluated and groups not yet evaluated when traffic is allowed. I sincerely apologize if my first question was vague.Share"


Question: SageMaker can't access S3 when creating a labeling job

"I have an IAM role with the following permissions:AmazonSageMaker-ExecutionPolicy-20221112T214872AmazonS3FullAccessAmazonSageMakerFullAccessAmazonSageMakerCanvasFullAccessHowever when I try to create a labeling job in SageMaker and I click Create Labeling Job with:Manual data setupCopy-paste the IAM ARNClick browse S3I don't see the files in the bucket. When I enter the s3:// path to the .jsonl file, I get this:NetworkingError: Network Failure - The S3 bucket 'cvat.mouseover.ai' you entered in Input dataset location cannot be reached. Either the bucket does not exist, or you do not have permission to access it. If the bucket does not exist, update Input dataset location with a new S3 URI. If the bucket exists, give the IAM entity you are using to create this labeling job permission to read and write to this S3 bucket, and try your request again.I also have CORS enabled for the bucket and full public read access, just in case. Policy simulator confirms full access of the role to S3.FollowComment"

Answer: "0Hello,Thank you for using AWS SageMaker.From the error, I understand that the labeling job is not able to establish a network with S3 bucket that you have mentioned manually for Input dataset location. I was able to successfully replicate the same error under my account, the reason behind this type of error was that the my labeling job and S3 bucket were in 2 different region. Once the I provided S3 bucket from similar region my issue was resolved. So I'd recommend you to provide S3 bucket from the same the region were you are trying to create a labeling job or vice versa. At this moment SageMaker labeling job doesn't support cross region S3 bucket, so you need to have both the resource in same region to create labeling job successfully.After following the above recommendation, if you still observe same error message, I'd recommend you to reach out to AWS Support along with all the resource details and error that you observe for further investigation. To open a support case with AWS using the link: https://console.aws.amazon.com/support/home?#/case/createCommentShareSUPPORT ENGINEERKartik_Ranswered 2 months ago"


Question: Delete Wickr network

"Hi there.I tested a Wickr application. I activated the standard plan.  Now, I want delete my network.How could I do it?FollowComment"

Answer: "0Accepted AnswerThe AWS charged me for an account, even without an account activated, in a Wickr network enabled.I contacted the support through the billing option requesting a refund. AWS refunded me and removed the Wickr network.CommentShareSamuelanswered 4 months ago0I do not see an option to delete the network profile in wickr for now.  you can change the plan from standard to free tier.you can change the plan to free tier,  wickr Admin portal --> Manage plans-->myplan ---> select free trails .Meanwhile, i explore options to delete the network profile.CommentShareAWS-User-7653869answered 6 months ago"


Question: Cognito Access Tokens and SAML Attributes

"We are using OKTA SAML as an iDP along with Cognito as a SP.We have groups that are assigned to the users, and these attributes are mapped are part of the Okta SAML config.The issue is the following - on the Cognito side, we get 2 tokens - id_token and access_token.These groups appear as part of the decoded id_token as "custom:groups": "[Group1, Group2, Everyone, Group3]", - which is what we want.Is it possible instead of these groups to appear in the id_token, to be on the access_token?If that is not possible is there a workaround with some other kind of attributes to appear as part of the claims in access_token?I am asking this because as per best practices - it is not good to have custom logic for Authorization and use the id_token to call API's.Best RegardsFollowComment"


Question: Select "amazonaws.com" or "api.aws" endpoint?

"What benefits, if any, exist for selecting * service-region.* amazonaws.com versus service-region. api.aws for connecting programmatically to an AWS service?If possible, it seems best to use amazonaws.com when you can leverage the fips-enabled endpoint (service-fips.region.amazonaws.com) but that seems to be the only difference found.FollowComment"

Answer: 0I've never seen "api.aws" used. Where is that documented on the AWS site?Use the endpoints defined here: Service endpoints and quotasCommentShareEXPERTkentradanswered a year agodarian a year agoCheck out Lambda endpoints:  https://docs.aws.amazon.com/general/latest/gr/lambda-service.html(lambda.us-east-1.api.aws)Share


Question: Is Free Tier applied to new account but with the same credit card ?

"Hello all,I have created a new AWS account with an old credit card I used with another AWS account. That old account is no longer in Free Tier and the credit card is still there (I used some AWS services on that account and let AWS charge me as usual). If in the new account I use the same credit card, is my new AWS account eligible for Free Tier ?Thank you.FollowComment"

Answer: "0Hi,As long as you create the new account with a different email, I believe you can still use same credit card and have the Free Tier applied, unless AWS has changed policy.Hope it helps ;)CommentShareEXPERTalatechanswered 20 days ago"


Question: Concurrency control in Memcached

"Hi,I am planning to us Memcached as an in-memory datastore. I am wondering if ElastiCache does any concurrency control when multiple threads are writing and reading the same data. Or do I have to take care concurrency myself?Thanks,LuFollowComment"

Answer: 0I figured it out myself. The answer is to use the cas command of memcached.CommentShareioscoderanswered 4 years ago


Question: Can I freely configure AWSEBSecurityGroups created by ElasticBeanstalk in ebxtensions?

"The following "01-security-group.config" was create under the .ebxtensions directory.I then ran eb create using PHP sample application (php.zip).The VPC is a custom VPC, not a default VPC.EC2 and ELB are located on public subnets.KeyPair also sets.Resources:    AWSEBSecurityGroup:        Type: AWS::EC2::SecurityGroup        Properties:            GroupDescription: EC2 SecurityGroup for ElasticBeanstalk environment.            SecurityGroupIngress:                - ToPort: 80                  FromPort: 80                  IpProtocol: tcp                  SourceSecurityGroupId: { "Fn::GetAtt" : [ "AWSEBLoadBalancerSecurityGroup", "GroupId" ]}                - ToPort: 22                  FromPort: 22                  IpProtocol: tcp                  CidrIp: xx.xx.xx.xx/32The expectation is that the AWSEBSecurityGroup description field and inbound rules will be as specified.However, the results are as follows, with a different description and an unnecessary rule (SSH, 0.0.0.0/0).ID：sg-058b4d99a88ea5c75Description: VPC Security GroupInbound RuleTypeProtocolPortSourceSSHTCP220.0.0.0/0HTTPTCP80awseb-e-kbmrvrb9qk-stack-AWSEBLoadBalancerSecurityGroup-DXLN25QVL0F9SSHTCP22xx.xx.xx.xx/32Next, eb deploy was run with the following changes.Resources:    AWSEBSecurityGroup:        Type: AWS::EC2::SecurityGroup        Properties:            GroupDescription: EC2 SecurityGroup for ElasticBeanstalk environment.            SecurityGroupIngress:                - ToPort: 80                  FromPort: 80                  IpProtocol: tcp                  SourceSecurityGroupId: { "Fn::GetAtt" : [ "AWSEBLoadBalancerSecurityGroup", "GroupId" ]}option_settings:  aws:autoscaling:launchconfiguration:    SSHSourceRestriction: tcp, 22, 22, xx.xx.xx.xx/32There are no more unnecessary rules in the security group as shown below.ID: sg-058b4d99a88ea5c75Description: VPC Security GroupInbound RuleTypeProtocolPortSourceHTTPTCP80awseb-e-kbmrvrb9qk-stack-AWSEBLoadBalancerSecurityGroup-DXLN25QVL0F9SSHTCP22xx.xx.xx.xx/32Based on the above, I have two questions.I would like to complete the configuration with just Resources instead of separating it with Resouces and option_seggings, is there a way to do this?Is it possible to change the description field?for your information, AWSEBLoadBalancerSecurityGroup reflects the description field (security group is replaced). Thanks.FollowComment"

Answer: "1Accepted AnswerHi zizi, I answer your questions.Unfortunately No...The default allowed "SSH (22/tcp) from 0.0.0.0/0" must be overridden and restricted in the "option_settings".Not possible, as far as I know when "option_settings" is used.This is because there is no description field in the SSHSourceRestriction section of the AWS document.However, the description field can be set by using a security group that has already been created.See KNOWLEDGE-CENTER for more information.Just FYI,Inbound HTTP (80/tcp) permission from AWSEBLoadBalancerSecurityGroup is allowed by default without explicitly stating it.Therefore, if only HTTP(from AWSEBLoadBalancer) and SSH(from your environment IP) connections are to be allowed, the following statement in "01-security-group.config" is all that is required.option_settings:  aws:autoscaling:launchconfiguration:    SSHSourceRestriction: tcp, 22, 22, xx.xx.xx.xx/32I hope this will help.CommentShareTsumitaanswered a year agozizi a year agoHi Tsumita, Thanks.Share"


Question: i want my website to be restored

"Hello,i hosted my wordpress website on aws elastic beanstalk but after some month all my data went up and is showing a setup page. i will like if my site is restoredFollowComment"

Answer: "0Take a look at, Rebuilding Elastic Beanstalk environments.CommentShareEXPERTkentradanswered 2 months agoEXPERTalatechreviewed 2 months ago"


Question: Textract Volume

"Hi there, we are using an asynchronious query is there a way for us to send multiple documents to AWS Textract at the same time, so we aren't restricted waiting for one document to be OCR'd.FollowComment"

Answer: 1Accepted AnswerAmazon Textract supports multi-page PDFs so you could merge your documents into a larger document. Separately you could invoke parallel jobs as long as you are following limits documented for API calls https://docs.aws.amazon.com/general/latest/gr/textract.html.CommentShareChris_Ranswered 10 months ago


Question: What happen after my s3 storage goes down

"Hello,I am using s3 storage to store data generated from my web-application. As we know that AWs provide us 99.999.. durability  but how aws handle when any server goes down or whole region network goes down or Mutli AZ goes down?I mean what steps will be taken to come out from outage?FollowComment"

Answer: "1Hi,Regions are physical locations which are fully independent and isolated, they consist of Multiple Availability Zones. In case of failure these services are designed to handle concurrent device failures by quickly detecting and repairing any lost redundancy[1].A customer can implement the Cross Region Replication feature for more data redundancy (this can be done manually) [2][4].Data is stored as objects within resources called “buckets” also, S3 has a variety of Storage Classes which gives a users a chance to pick a way in which to store their data, classes differ in terms of data type,price and access patterns[3]. Refer to document[3] to better understand how AWS S3 is designed and how it actually achieves the % durability.Please see the documents in links [1], [2], [3]  for further explanations.Hope this help.Resources:-[1] https://docs.aws.amazon.com/AmazonS3/latest/userguide/DataDurability.html[2] https://docs.aws.amazon.com/general/latest/gr/rande-manage.html[3] https://aws.amazon.com/s3/faqs/[4] https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html#crr-scenarioCommentShareAsisiphoanswered a year ago"


Question: EC2 Access over Site to Site VPN

"I'd appreciate any help you can provide with this as I'm stumped, and I'm sure I'm missing something.I have a site to site VPN set up and I can confirm it's connect to our on-premises router (DrayTek 3900).The VPN has a transit gateway, customer gateway and static routing.I've set up a new EC2 instance with it's own VPC and I can access it via it's public IP address, and it can access the internet.I do not understand how I enable this EC2 instance to route traffic over the VPN to on-prem and vice versa? I need to be able to share resources between the EC2 instance and on-premise network.Thanks in advance for any help you can provide!FollowComment"

Answer: "1Howdy,Here are a few ideas to assist in your troubleshooting!To enable traffic between your EC2 instance and your on-premises network, you'll need to configure the routing tables for both the VPC and your on-premises router. Here are the steps you need to follow:1. Update the VPC route table to route on-premises traffic to the Transit Gateway:a. Open the Amazon VPC console: https://console.aws.amazon.com/vpc/b. In the navigation pane, click 'Route Tables'.c. Select the route table associated with your EC2 instance's VPC.d. Click the 'Routes' tab, and then click 'Edit routes'.e. Click 'Add route', and then enter the following:Destination: The CIDR block of your on-premises network (e.g., 192.168.0.0/16)Target: The Transit Gateway ID (e.g., tgw-abcdefgh)f. Click 'Save routes'.2. Configure your on-premises router (DrayTek 3900) to route AWS VPC traffic to the Customer Gateway:Refer to the DrayTek documentation on how to add a static route on your router. You'll need to add a route with the following details:Destination: The CIDR block of your AWS VPC (e.g., 10.0.0.0/16)Next Hop: The IP address of your Customer Gateway3. Update the security groups associated with your EC2 instance to allow traffic from your on-premises network:a. Open the Amazon EC2 console: https://console.aws.amazon.com/ec2/b. In the navigation pane, click 'Security Groups'.c. Select the security group associated with your EC2 instance.d. Click the 'Inbound rules' tab, and then click 'Edit inbound rules'.e. Add the necessary rules to allow traffic from your on-premises network (e.g., allow all traffic from the on-premises network CIDR block).f. Click 'Save rules'.After completing these steps, your EC2 instance should be able to route traffic to and from the on-premises network through the VPN. You can find more information on this topic in the AWS documentation:AWS Transit Gateway: https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.htmlVPC Route Tables: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.htmlSecurity Groups for Your VPC: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.htmlIn case my answer doesn’t address your question or if you have any follow up questions, please let me know.RockyCommentShareAWS-Rockyanswered 2 months ago0Hi Rocky,Thank you very much for your reply, although I get stuck at the first step!On editing the route table for the VPC, the transit gateway isn't available as an option:Thank you!CommentSharerePost-User-5096653answered 2 months agoAWS-Rocky 2 months agoHowdy again!I'm sorry that your still experiencing issues here. I will do my best to be of assistance.So if the transit gateway is not available as a drop-down option then it is likely due to a configuration issue somewhere. I have found a few resources that may help you track down the issue. Here are a some possible reasons you may still be experiencing issues:1. The VPC and the TGW are not connected:You need to attach your VPC to the Transit Gateway using a Transit Gateway attachment. Make sure you have done this before trying to edit the route table.Reference link: https://docs.aws.amazon.com/vpc/latest/tgw/tgw-vpc-attachments.html2. Transit Gateway Route Table:Ensure that you have associated the VPC with the correct Transit Gateway route table.Reference link: https://docs.aws.amazon.com/vpc/latest/tgw/tgw-route-tables.html3. Route table propagation:Verify that the route table associated with your VPC has propagation enabled for the Transit Gateway attachment. This will allow routes from the TGW to be automatically propagated the the VPC's route table.Reference link: https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.htmlHopefully this will serve as a good starting point to help you track down the issue. If you have checked all of these aspects and still can't edit the VPC route table with the TGW or if I have not addressed your question fully then please feel free to reach out again.RockyShare"


Question: Can’t add my AWS certification Credly badge in re:Post

I am trying to add my AWS Certification badges and I am getting “Could not verify recipient” error after I enter the Credly Badge ID or URL. How can I get my AWS certifications badges added?FollowComment

Answer: "23Accepted AnswerYour Credly badge is issued to a recipient at the time you received your credential. This may be different from your current re:Post email. If you know the email used at the time of your Credly credential and still have access to that email, you may temporarily update your re:Post email, then once verified within re:Post you can attempt to associate your Credly badge. Afterward, you may either keep that updated email or revert back to your preferred email address.CommentSharescoschreanswered 2 years agoMODERATORSesi Bhushan_Sreviewed 2 years agoscoschre 2 years agoSpecifically, the Credly API replies with a "one-way" SHA256 of the recipient's email at the time of receiving the badge, and compares a hash of the currently verified re:Post email to test for a match.  See https://www.credly.com/docs/obi_specified_endpoints#get-badge-assertion for detailsShareJohannes Konings 6 months agoThe upper and lower case of the email address must be respectedShare3Also worth noting  is that changing your Credly default email address will have no effect on the certificate. It seems to be hard coded into it.CommentShareRuairi_Manswered 2 years ago1If you haven't manually verified your Email on the Re:Post side, try changing your Email in Settings then changing it back to trigger the verification email. Once it's verified on the Re:Post side it will work as long as it matches the Credly Email.CommentShareSteven_Ganswered 2 years agoAlex 10 months agoI did it, verified my email on the re:post side, trigger the verification email. My Certs import are all failing.Share1Note that you have to specify each specific Badge URL. Specifying your general overview badges URL won't work.CommentShareheycaseyanswered 2 years ago0How exactly shall we update the email?Is it under "settings"  --> "profile" --> "Email for notifications"?CommentShareJason_Sanswered 2 years agoscoschre 2 years agoReplace 00000000-0000-0000-0000-000000000000 below with your badge id to find the hash:% curl https://api.credly.com/v1/obi/v2/badge_assertions/00000000-0000-0000-0000-000000000000 | jq -r '.recipient.identity' | sed 's/^sha256\$//g'd58c1142b3073cd201a369c95c5eda296e173a04027af75f11034cf546aa6dafTest emails until matched:% echo -n scott@example.com | shasum -a 256 -d58c1142b3073cd201a369c95c5eda296e173a04027af75f11034cf546aa6dafWhen matched, update re:Post Setting's Profile Email for notifications and verifyShareSteven_G 2 years agoYes, although I was told this issue is fixed now, so if you try again it might work regardless.Share0I have updated my email on re:Post and needed to confirm the email firstly before I could add my certification.CommentShareSUPPORT ENGINEERMunkhbat_Tanswered a year agoAlex 10 months agoI did exactly the same, but without successShare0I went the other way - I updated my Credly email from my personal account (as I had some certs prior to AWS) to my AWS email (which I use for re:Post). Waited for an overnight update, and it worked just fine today.CommentShareDan_Hanswered 2 years ago0Click on the certification Link in your Credly account, then in the bottom right part click on Public Link button, this is the valid link to add your Certification in your profileCommentShareAndrea Cavagnaanswered a year ago0You can now add up to three email addresses (within the profile tab in "My Dashboard"). You can add the email address that’s associated with your Credly account, without updating the primary email address that’s associated with your re:Post profile. This should allow you to link your AWS Certification successfully.CommentShareSUPPORT ENGINEERNguyen_Manswered 12 days ago"


Question: Read Parquet file from S3 without hadoop

"I need to read a parquet file from S3 using Java in a maven project. I am using the below code to read the Parquet file, but the serverless app I am deploying exceeds the limit of 50Mb when I include the parquet and Hadoop dependencies. I need Hadoop Path and Configuration classes to read the file on S3. Is there any way I can avoid Hadoop altogether?        List<SimpleGroup> simpleGroups = new ArrayList<>();         ParquetFileReader reader = ParquetFileReader.open(HadoopInputFile.fromPath(new Path(filePath), conf));         MessageType schema = reader.getFooter().getFileMetaData().getSchema();         List<Type> fields = schema.getFields();         PageReadStore pages;         while ((pages = reader.readNextRowGroup()) != null) {             long rows = pages.getRowCount();             MessageColumnIO columnIO = new ColumnIOFactory().getColumnIO(schema);             RecordReader recordReader = columnIO.getRecordReader(pages, new GroupRecordConverter(schema));             for (int i = 0; i < rows; i++) {                 SimpleGroup simpleGroup = (SimpleGroup) recordReader.read();                 simpleGroups.add(simpleGroup);             }         }         reader.close();FollowComment"

Answer: 1Accepted AnswerHave you tried S3 select? This will avoid Hadoop altogether. Also take a look at example to search data using S3 select with simple sql queries.CommentShareVivek_Sanswered 3 years ago


Question: EMR - UNHEALHTY nodes & HDFS utilization

"Hi,some doubts about why my EMR clusters are failing. As you can see on the image below, I have a cluster which utilizes HDFS (but only with peaks of 5% of utilization), and while its running  a job suddenly the nodes start to be marked as UNHEALTHY.Knowing that the cluster has a 95% of HDFS free space. The reason of having UNHEALTHY nodes is that they are running out of space on their Instance Storage volumes (local EBS)? (due to some temporary files, for example). Should I add/increase the EBSs volumes on the cluster's nodes?FollowComment"

Answer: "0Hi,Yes, increasing the EBS volume for nodes might help.ThanksCommentShareabhineet-sanswered 10 months ago"


Question: How to get insight into an EKS Kubernetes version update error

"In the EKS web console, it gives me the following warning at the top of the dashboard: "This cluster is running the oldest Kubernetes version currently supported by Amazon EKS. Ensure that your cluster is updated before the version end of support date." And it has a "Update now" button. But every time I try to update, it fails silently. No errors or logs to go on.When I select the button, it shows me that I am able to update from Kubernetes 1.22 to 1.23. After clicking Update, the status of the cluster changes to "Updating" for a couple minutes, but then back to "Active". And the version is still at 1.22. In the "Update history" tab, I can see the failed attempt. It has an Update ID, Submission time, Type, and Status. The type is VersionUpdate, and Status is Failed. When I click on it, the Error count is zero, and no errors are displayed. Only a status of Failed. How can I find out why the upgrade failed? Thanks in advance.FollowComment"

Answer: "0Hi. Error should be there in the update history. Try to update nodes and only then EKS.CommentSharemyronix88answered 2 months ago0The problem seems to have resolved itself.  After attempting a few days later, the upgrade worked.  The only difference was the Platform Version was updated from eks.6 to eks7.  The Update ID of the failed attempt:{"update": {"id": "cbb53f20-b5e2-4cf0-b95a-f6634e71b9de","status": "Failed","type": "VersionUpdate","params": [{"type": "Version","value": "1.23"},{"type": "PlatformVersion","value": "eks.6"}],"createdAt": 1680798494.173,"errors": []}}The Update ID of the successful attempt:{"update": {"id": "f0e0c973-d8c0-4bd2-85e3-99e1b8dd8aa2","status": "Successful","type": "VersionUpdate","params": [{"type": "Version","value": "1.23"},{"type": "PlatformVersion","value": "eks.7"}],"createdAt": 1681132540.091,"errors": []}}According to AWS "Amazon EKS automatically upgrades all existing clusters to the latest Amazon EKS platform version for their corresponding Kubernetes minor version" (https://docs.aws.amazon.com/eks/latest/userguide/platform-versions.html)CommentSharerePost-User-3464203answered 2 months ago"


Question: Running boto3 from a python script executed in CodeBuild

"To put it very simple i have a python script that i expect to run in CodeBuild.Python script uses boto3 and when it gets executed i get an error stating i have no credentials.response = self.client.get_parameters(Names=parameters, WithDecryption=with_decryption)\n","  File "/codebuild/output/src702091068/src/.tox/cloud/lib/python3.9/site-packages/botocore/client.py", line 530, in _api_call\n    return self._make_api_call(operation_name, kwargs)\n","  File "/codebuild/output/src702091068/src/.tox/cloud/lib/python3.9/site-packages/botocore/client.py", line 943, in _make_api_call\n    http, parsed_response = self._make_request(\n","  File "/codebuild/output/src702091068/src/.tox/cloud/lib/python3.9/site-packages/botocore/client.py", line 966, in _make_request\n    return self._endpoint.make_request(operation_model, request_dict)\n","  File "/codebuild/output/src702091068/src/.tox/cloud/lib/python3.9/site-packages/botocore/endpoint.py", line 119, in make_request\n    return self._send_request(request_dict, operation_model)\n","  File "/codebuild/output/src702091068/src/.tox/cloud/lib/python3.9/site-packages/botocore/endpoint.py", line 198, in _send_request\n    request = self.create_request(request_dict, operation_model)\n","  File "/codebuild/output/src702091068/src/.tox/cloud/lib/python3.9/site-packages/botocore/endpoint.py", line 134, in create_request\n    self._event_emitter.emit(\n","  File "/codebuild/output/src702091068/src/.tox/cloud/lib/python3.9/site-packages/botocore/hooks.py", line 412, in emit\n    return self._emitter.emit(aliased_event_name, **kwargs)\n","  File "/codebuild/output/src702091068/src/.tox/cloud/lib/python3.9/site-packages/botocore/hooks.py", line 256, in emit\n    return self._emit(event_name, kwargs)\n","  File "/codebuild/output/src702091068/src/.tox/cloud/lib/python3.9/site-packages/botocore/hooks.py", line 239, in _emit\n    response = handler(**kwargs)\n","  File "/codebuild/output/src702091068/src/.tox/cloud/lib/python3.9/site-packages/botocore/signers.py", line 105, in handler\n    return self.sign(operation_name, request)\n","  File "/codebuild/output/src702091068/src/.tox/cloud/lib/python3.9/site-packages/botocore/signers.py", line 189, in sign\n    auth.add_auth(request)\n","  File "/codebuild/output/src702091068/src/.tox/cloud/lib/python3.9/site-packages/botocore/auth.py", line 418, in add_auth\n    raise NoCredentialsError()\n","botocore.exceptions.NoCredentialsError: Unable to locate credentials\n"]The service i intend to access from CodeBuild system is in fact SSM Parameter Store.I've already granted permissions in the CodeBuild Service Role but i'm not quite sure why i keep getting NoCredentials.If i run the script locally it all works fine.FollowComment"

Answer: "2Take a look at this: Error: "Unable to locate credentials".CommentShareEXPERTkentradanswered 5 months ago1I wrote a python script to upload to AWS using boto3 and when I turn on debug level logging for boto3 and botocore, it shows where it's looking for credentials and what the result is.  I'm not sure this will help or not.  If you need an example of that, I can post the relevant code here.CommentSharejschwar313answered 5 months ago1If you only need to access a SSM parameter store parameter, you can use buildspec env section to get the parameter store as an environment variable.Please refer https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html#build-spec.env.parameter-store for more details.CommentShareJunseong_Janswered 5 months ago"


Question: AWS Managed Active Directory -  Disk error and restart capability

"ProblemWe are getting the following error message in our Directory ServiceThe server disk could be full or corrupted or the maximum permissible size for the server registry has been reachedThe DNS server could not open a registry key.  Reinstall the DNS server if it was not able to be started.  If the DNS server started, but couldn't load a zone, reload the zone or restart the DNS server.We followed the suggestions in this doc [ms_ad_troubleshooting_low_storage_spac]   but found that our disk is not full.Currently, storage configuration is not supported.https://aws.amazon.com/directoryservice/faqs/QuestionsThe error message suggests we restart the server, but this function seems to be out of our hands. Is there a way to do this in AWS managed AD?Has a similar problem been brought up and was there a solution?FollowComment"


Question: RabbitMQ Java connection throws UnknownHostException:  invalid IPv6 address

"A very simple connection, the RabbitMQ broker  has Public accessibility= YesOn  factory.newConnection(),, using Java1.8 &  amqp-client-5.12.0.jar (latest), getting the above exception.//factory is set:factory.setUsername(queueUser);factory.setPassword(queuePassword);factory.setVirtualHost("/");factory.setHost(queueHost);factory.setPort(5671);and the queueHost is set to the AMQP Endpoints on the RabbitMQ console.This should be a 5 minutes setup, but I already spent way too much time on this.I have not set this broker, nor do I see how to set it, with IPv6. I just need simple Ipv4 to work.Any idea ?FollowComment"

Answer: "0Hi there,Would you like to refer some of the documentation below and see if it works? Let us know if it doesn't.Creating and connecting to a RabbitMQ broker (Refer Create a ConnectionFactory and connect to your broker):https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/getting-started-rabbitmq.htmlBest Practices:https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/best-practices-rabbitmq.htmlCommentShareTPKohlianswered 2 years ago"


Question: WorkDocs Pricing and Versioning

"A customer has two questions about WorkDocs pricing:For billing, how, if you have two users, each with the included 1TB, and user A stores 1.5 TB, and user B stores .5TB, is that total 2TB free, or do you pay extra for the .5TB that user is using. The pricing calculators give pricing in terms of Number of users and usage per user per month, so it is hard to tell.Additionally, how does pricing for versioning work? If a user has a 3 versions of a 10GB file, are they charged for 30GB, 10GB, or something else?FollowComment"

Answer: "1Accepted AnswerFrom the FAQ - https://aws.amazon.com/workdocs/faq/Additional storage: your business receives 1 TB of storage capacity for each active user account. Administrators can allocate this storage across users by setting individual storage limits in the WorkDocs administrator dashboard. Your business will be charged once a user’s amount of storage utilized exceeds 1 TB for that user’s account. Additional storage is charged on a pay-as-you-go basis.From your example - you've got 2 users so you've 2TB of  storage included in the monthly fee. So no additional storage costs for a 1.5 and a .5 TB usage. You can set limits (when you activate a user, the default is 50GB).  If you did go above that 2TB, S3 rates apply.WorkDocs does allow unlimited versioning. When I've looked at versioning of files in WorkDocs in the console, standard S3 rules apply i.e. multiple versions accrue storage ... so a 128MB file that gets updated to be a 256 MB file would show 384MB of storage. In your example - 3 x 10GB versions would report as 30GB of storage used. Likewise, if a user tries to update a document that would take them over their admin defined storage limit - they'll be blocked. And just in case you're wondering - I can't see/find a method of removing/deleting versions of files: so copy most recent to a new file, delete old to remove an iterated file. How that is billed will be dependent on how much storage is available across all the users - going back to 1TB of storage available per active user.CommentShareEXPERTAndrew_Wanswered 3 years ago"


Question: State Language Specification

"It looks like the States Language specification contains fuzziness and is not up to date with the AWS Step Functions implementation.Example:Intrinsic Function 'States.Format' (https://states-language.net/):"The Value of the first MUST be a string".In your example on the following page (https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-intrinsic-functions.html), the first parameter can also be a JSONPath.Could you please update the State Language page (https://states-language.net/)?Thanks a lot!FollowComment"


Question: Provisioned Rate exceeded on DeleteFaces in Rekognition

"I am getting a Provisioned Rate exceeded error when calling the DeleteFaces api of AWS rekognition, using the current version of the .net DSK.I think what triggered the error in the first place is that I was running some batches in parallel, and even though they don't make many calls to AWS rekognition, it happened occasionally that their calls were simultaneous, exceding the limit of 5 per seconds (I managed retry attempts but I had not realised the SDK had its own retry policy by default).However it seems now that any single call I make to DeleteFaces returns a "Provisioned Rate exceeded" exception, no matter how long I wait before I retry (>1h), or how many face ids I try to delete per call (50 to 4096), or the retry policy of the sdk (legacy or standard). Other functions of the rekognition API seem to work fine. Is there a rate limit other than the 5 calls per seconds advertised as a default for rekognition (and when that limit is reached, how long does it take before it allows new calls)? Or is it some sort of shadow ban after a certain number of provisioned rate exceeded errors (and if so how long should I wait before the ban is lifted)? Does it matter how many faces I delete in one call? I already batch faceids by batches of 4096. Do these get further split by the .net sdk in multiple calls, resulting in some sort of api calls amplification?FollowComment"

Answer: "1Accepted AnswerHi Charles, the particular limit you're hitting is an internal limit that's currently not listed in the public documentation. Could you open a case using this link  or file a limit increase on DeleteFaces API and we can then engage on the case to help.We understand that the limit is not a good customer experience and there're a few options that's available to help.CommentShareAWS-User-3408220answered a year agoCharles a year agoThanks. I have already requested a limit increase (thinking I was somehow hitting the 5 calls/s.) I will mention your comment. If it is not confidential, I would be curious to know what that internal limit consists in, just so I can code to stay clear of it.Share1Hi!The 2 pages I'm looking at are https://docs.aws.amazon.com/rekognition/latest/dg/limits.html and https://docs.aws.amazon.com/general/latest/gr/rekognition.html.I don't see anything else.  Could you check https://us-west-2.console.aws.amazon.com/servicequotas/home/services/rekognition/quotas/L-220834FB (Use the region you're working in) and see the history?Some options include configuring exponential backoff and jitter, configuring retries, queuing as well.  Alternatively, you could increase the service quota too.CommentSharejsoncanswered a year agoCharles a year agoThe page shows a  <5% usage of the deletefaces. I just retried, and I managed to get one batch of 4096 faces deleted, but the second batch (5s pause between) of 4096 failed with the provisioned rate limit error. I went into cloudwatch so I can see the exact metrics for the deleteface api, and I can see exactly two calls in the last hour, one successful, one throttled. I am using Ireland but I believe the limit is 5 calls/s everywhere. I am clearly not hitting that limit. I wonder if it has something to do with the size of the collection (>500k), but that is well within the 20m limit.Share"


Question: AWS Amplify Angular JS sample code not working on local machine

Steps given to get started with Angular.js to run in local is failing with compilation error.import { Customer } from './models';Above line is throwing an error:"Cannot find module './models' or its corresponding type declarations"FollowComment

Answer: "0From the note I understand you want to import { Customer } from './models';  from Angular JS and is throwing an error: "Cannot find module”.Please note the "Cannot find module or its corresponding type declarations" error occurs when TypeScript cannot locate a third-party or local module in our project. To solve the error, make sure to install the module and try setting moduleResolution to node in your tsconfig. json file.If the module is a third-party module, make sure you have it installed.shellnpm install module-namenpm install --save-dev @types/module-nameMake sure to replace module-name with the name of the module in your error message.I hope this helps.References:https://bobbyhadz.com/blog/typescript-cannot-find-moduleCommentShareNonkululekoanswered a year ago"


Question: inbound smtp not DNSSEC signed

"HI,It seems that the inbound.smtp.eu-west-1.amazonaws.com domain is not DNSSEC signed. Is this something that we can configure?JeroenFollowComment"


Question: This morning started getting too many redirect error

"When I woke up this morning and tried to go to my website www.ebikenorthport.com hosted on AWS Amplify I got the following error.This page isn’t working www.ebikenorthport.com redirected you too many times.Try clearing your cookies.ERR_TOO_MANY_REDIRECTSNothing has changed and there is another branch running on test.ebikenorthport.com that is still working fine.Redirect checker is saying there are 19 redirects.Resulthttps://www.ebikenorthport.com301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved Permanentlyhttps://www.ebikenorthport.com/301 Moved PermanentlyProblems found:Too many redirects. Please try to reduce your number of redirects for https://www.ebikenorthport.com. Actually you use 19 Redirects. Ideally you should not use more than 3 Redirects in a redirect chain. More than 3 redirections will produce unnecessary load on your server and reduces speed, which ends up in bad user experience.As far as I know, nothing has changed, and has just stopped working properly.Please helpFollowComment"

Answer: "0Accepted AnswerI removed http redirects and that seemed to solve the problem.  However, everything was working for a week prior, and literally just started having issues overnight.CommentSharerePost-User-6465585answered 24 days ago0Good morning,Was this resolved? The website appears to be working fine on my end.curl -ILs www.ebikenorthport.com | grep -i 'HTTP\|Server'HTTP/1.1 301 Moved PermanentlyServer: CloudFrontLocation: https://www.ebikenorthport.com/HTTP/2 200 server: AmazonS3CommentShareDavidanswered 24 days ago"


Question: Amazon Linux 2 embedded Firewall

"Hello,I'm looking for guidance on configuring firewalld on Amazon Linux 2.I've been migrating some of our internal services to the Amazon Linux 2 AMI, and I encountered some connectivity issues, and during the investigation it seems that Amazon Linux 2 is running the firewalld service on the instance, and this is the default configuration:public (active)  target: default  icmp-block-inversion: no  interfaces: eth0  sources:  services: ssh dhcpv6-client  ports: 1433/tcp  protocols:  masquerade: no  forward-ports:  source-ports:  icmp-blocks:  rich rules:What should I be doing here?  I already have networking configured at the VPC level, as well as via security groups... should I be disabling firewalld?Should I be switching it to the 'trusted' zone?Is this the intentional base configuration?Thanks,PaulFollowComment"

Answer: "0I have a new Amazon Linux 2 up and running and it doesn't seem to have any type of firewall running.  I also checked the installed packages and while the firewalld.noarch package is available to install it is not installed by default.  Maybe your user-init script is installing it, or maybe there is a 3rd party service installing it for you, but I don't think it should be there by default.Anyway, my personal thoughts are that between NACLs and Security Groups a host based firewall is probably overkill.  We don't run any such software on our instances and I don't think I've ever heard a recommendation from AWS that it might be necessary.CommentShareDHarbor-RNHurtanswered 5 years ago"


Question: Visualize Robot in Gazebo RoboMaker

"I'm following the helloworld tutorial for RoboMaker, and when I have to launch the simulation application with the following command:docker run -it -v /tmp/.X11-unix/:/tmp/.X11-unix/ -u robomaker -e ROBOMAKER_GAZEBO_MASTER_URI=http://localhost:5555 -e ROBOMAKER_ROS_MASTER_URI=http://localhost:11311 \robomaker-helloworld-sim-app:latest roslaunch hello_world_simulation empty_world.launchit runs the application but it does not open Gazebo in the virtual desktop to visualize the robot. How do I have to change this command?FollowComment"

Answer: "0Use the following commands to visualize the simulation using the Gazebo GUI tool:Connect to your container running the simulation application.Visualize your application by running the Gazebo Graphical User Interface (GUI)# Enable access to X server to launch Gazebo from docker container$ xhost +# Check that the robot_app and sim_app containers are running. The command should list both containers$ docker container ls# Connect to the sim app container$ docker exec -it sim_app bash# Launch Gazebo from within the container$ rosrun gazebo_ros gzclient   For more information, see the documentation on Running a sample application with ROS Melodic and Gazebo 9. (There is also separate documentation for ROS2 Foxy and Gazebo 11).CommentShareEXPERTgoldericanswered a year agoMatteo Sartoni a year agoThank you very much!I have got the following two problems:when I run the command $ xhost + the following error appears:  xhost:  unable to open display ""when I run inside the container $ rosrun gazebo_ros gzclient the following error appears: bash: rosrun: command not foundShare"


Question: Promotional filters - Amazon personalize

Does promotional filters apply only on the recommended items or does it always return a specific category of items in the recommendations?I am trying to apply a filter and % as 20 but it does't return any promotional recommendation?FollowComment


Question: CloudFront redirects (301) to custom origin (ELB) instead of caching

"A customer has configured CloudFront in front of an ELB and he tells me that when he tries to reach the website with the CloudFront URL, CloudFront sends a redirect (301) to the URL of the ELB (the URL changes from the CloudFront URL to the ELB URL in the browser) instead of serving the request directly.Their custom origin redirects all http traffic to https. I suspect that when a user tries to access the website via the http address, CloudFront sends the request to the custom origin (ELB), the origin sends this redirect (301) to https to CloudFront, and CloudFront caches this redirect. In subsequent requests, CloudFront will send this cached redirect to the client, hence the client is just redirected to the custom origin and sees the URL change in his browser. This is explained in this page. Can you confirm this understanding is correct?What can be done to solve this? I saw that changing the "Origin Protocol Policy" to "Match Viewer" could maybe solve that? Could you confirm this?FollowComment"

Answer: "0Accepted AnswerThe customer's origin will be receiving the hostname of the origin configured in CLoudFront (which points to the ELB) unless they have configured CloudFront to forward the Host header.So assume that the public hostname for the website (and the CNAME set up on CloudFront) is www.mysite.com and the ELB's hostname is my-loadbalancer.us-west-2.elb.amazonaws.com. While the client sends:GET /page HTTP/1.1Host: www.mysite.comif the Host header is not forwarded to the origin, the origin will receive:GET /page HTTP/1.1Host: my-loadbalancer.us-west-2.elb.amazonaws.comand if it a not received over HTTPS, the origin probably issues a redirect response by simply concatenating https://, the Host header and the path to give the response:HTTP/1.1 301 Moved PermanentlyLocation: https://my-loadbalancer.us-west-2.elb.amazonaws.com/pageCloudFront will return that to the client, and thus the client will go directly to the ELB.As others have pointed out, you can configure CloudFront to redirect HTTP request to HTTPS, and enforce all requests to the origin to be HTTPS. This will solve the issue since the origin redirection will never be executed.If the redirection on the origin does additional logic that is needed, you could configure CloudFront to forward the Host header to the origin so it would then redirect to the public hostname, or you could modify the origin store the public hostname as a configuration and to redirect to the public hostname rather than using the Host header.CommentShareEXPERTLeeAtk@AWSanswered 2 years ago"


Question: CodeBuild session-role-name is incompatible with sts:AssumeRole

"What I'm trying to do is the following:CodeBuild assumes a roleThis assumed role then assumes a role in a different accountThe last role retrieves an SSM parameter in a different accountTo retrieve an SSM parameter with a regular account is possible: set sts:AssumeRole to Allow for the given account, e.g. for principal:arn:aws:sts::xxxxxxxxxxxx:assumed-role/power-user/role-session-nameHowever, when CodeBuild assumes the role in step 1, there is no control over the role-session-name, which will differ between each run of CodeBuild. It will look something like this:arn:aws:sts::xxxxxxxxxxxx:assumed-role/codebuild-role/AWSCodeBuild-12345678-1234-4321-1234-01234567890aThis is unfortunate, as sts:AssumeRole does not allow for wildcards in the principals specified.Adding codebuild.amazonaws.com as a Service-type principal does not work either, as it is not the CodeBuild service itself assuming the final role, but the role it has assumed in step 1.Is there a way to either change the role-session-name, or assume the role in a different way?FollowComment"

Answer: 1The solution here was to allow CodeBuild to assume the role:arn:aws:sts::xxxxxxxxxxxx:rootAs described here: https://dannys.cloud/create-reusable-assume-role-script-cross-account-awsCommentShareheemskanswered 2 years ago


Question: "VPC for ec2 instance running DB, connected via VPC Peering to another VPC with an ec2 instance running application"

"Hi,I am looking for AWS recommended best practice for connecting an application running on EC2, with a DB, running on another EC2 instance.I followed a recommendation to create two VPC instances, one for each EC2 (application, db), and connect them by using VPC Peering and security group rules (i.e., open specific ports for ingress and egress for each VPC).A peer reviewer claims that this is "an obsolete, not recommended, pricy" approach "which is not required, and adds no benefits to the overhaul architecture".The community's take on this issue is welcome. To VPC Peer, or not to VPC Peer - this is the question ...FollowComment"

Answer: "1Hi, you could have a read to this architecture whitepaper: https://docs.aws.amazon.com/whitepapers/latest/serverless-multi-tier-architectures-api-gateway-lambda/three-tier-architecture-overview.htmlThere are different cases depending on your scenario (https://docs.aws.amazon.com/whitepapers/latest/serverless-multi-tier-architectures-api-gateway-lambda/sample-architecture-patterns.html),but in general you could exploit reusing the same VPC and having subnets where you can deploy layers to. For instance for databases and EC2 accessing the database you may want to have in 2 separate private subnets.Finally, searching for 3-layer architecture will usually lead you to clear aws architecture which you can assess if fit your case.Hope it helps ;)CommentShareEXPERTalatechanswered a month ago0If you only want to separate applications and databases, you can simply divide subnets within the same VPC.An example of dividing a VPC would be to divide it by system or by environment (production, staging, etc.). (In the first place, in this case, it is often divided by AWS account.)It is also cumbersome to manage because it will be necessary to create flow logs for each VPC.CommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: Greengrass v2: how to cache MQTT messages in a local storage

"It seems that, in Greengrass v1, you can configure GG_CONFIG_STORAGE_TYPE of MQTT settings to be FileSystem and specify the size, etc. Is there a way to do the same in V2? I cannot find any documentation on that. Thanks in advance!FollowComment"

Answer: "0See https://github.com/aws-greengrass/aws-greengrass-nucleus/issues/825 :)CommentShareKrisSumanswered 2 years ago0Hi jcai,Thanks for using Greengrass V2. As the GitHub issue KrisSum pointed to, V2 currently does not support this feature but we have this on our roadmap.Thank you!CommentShareAWS-User-zhaoylinanswered 2 years ago0Thanks for the update.CommentSharejcaianswered 2 years ago"


Question: Backfill Data Feed Marketplace Reports

Is there a way to request data feed reports? Docs says: Information in data feeds is backfilled from 2010/01/01 to 2020/04/30 (inclusive) and is available in the CSV file in the year=2010/month=01 subfolder. but it's not available.FollowComment

Answer: 0It could be due to absence of transactions and hence no data during that time period. Did you have customers transact with you on AWS Marketplace before April 2020?CommentShareAiwen_Wanswered 3 months ago


Question: Problems with EFS in eu-west-1

Are there any problems with EFS in the eu-west-1 region? At around 2:40 UTC we started having problems with our EFS mount (Zone ID: euw1-az2).  Mounting the EFS with the efs helper program gives the following messages:# /bin/mount -t efs -o tls fs-1f72d3d6:/ /efsmount.nfs4: Connection reset by peerFailed to initialize TLS tunnel for fs-1f72d3d6FollowComment

Answer: "0leonblc,I will be sending you a private message regarding this issue.--JoeAmazon EFS teamCommentShareAWS-User-2481325answered 4 years ago"


Question: "Textract table extraction, splitting the table into two horizontal parts. How to get past this."

"Since, the March 2022 release update of AWS Textract (you can find the announcement here: https://aws.amazon.com/about-aws/whats-new/2021/04/amazon-textract-announces-quality-update-table-extraction-feature/), the AnalyzeDocument API has shown an unexpected behavior.I have been trying to process a single page pdf document through textract, which contains just one table of 40 rows and 25 columns. In the output, I happen to see that textract is breaking the table at the 4th column , dividing it into 2 tables (a left table with 3 columns, and a right table with remaining columns). This break in between is causing my accuracy to disrupt in the output.Surprisingly, this behavior was not observed before the latest release. I can say this, as I hold the outputs from the last release as well, in that the output was one single table like that of the source document.Can someone from the community help me on this, are there some extra hyper parameter  which I have to use while calling textract, to get past this break which is happening.Thanks in advance.FollowComment"

Answer: "0I am not aware of any parameter to avoid table splitting. The new release improves tables rows and column boundaries detection and you should see these improvements for many documents. However, I can suggest to have a look into this blog post which describe how to merge tables with postprocessing. The solution described in the blog post merge tables from different pages, although you can use the same idea and adapt the code to solve your issue.CommentShareIoananswered a year ago0Hi, AWS-User-9613621Thank you for using Amazon Textract. I am sorry to hear to that you are seeing issues with our latest table model. It would be helpful if you could provide us with sample file for which you're seeing issues, AWS account ID, and region you are operating in. You could contact AWS support to share the details. This will help us in identifying the issue.CommentShareaws-jennyanswered a year ago"


Question: Where can I find the AWS initiatives (#getawscertifiedchallenge that offer 50% off on certificates)

"Hello,I don't know if I can ask this question here, but if it is not the place, please kindly orient me to who I can contact.. Here is the question:I already received a coupon for 50% off the AWS Solutions Architect Professional exam (as part of the #getawscertifiedchallenge: AWS initiative). The original price is 300 dollars, with the discount it would become 150 dollars!is it possible to use the coupon today (I mean a date before the deadline 31 may 2023, the challenge was lanched mid-april and ends 31 May 2023), but book a date in June 2023 for the exam (because I'm going on vacation in June and I can be more comfortable passing the exam, as well as because it is easier to release 3 hours for the exam...)?if this is not possible, where can I find future initiatives of AWS on the reduction on the certificates?Note:the price of the exam is the same for all countries in the world while not all countries are largest economies (only TOP50 GDP). I say this because some cloud providers, for example, takes this into consideration and adjusts the prices of certificates according to the country. Below is a link for a random certificate Azure (which is 165 dollars in the USA and it is 110 dollars in my country): https://learn.microsoft.com/en-us/certifications/exams/pl-600This note is just for information, because I know that AWS is a company that is committed to corporate social responsibility (CSR).Thank youFollowComment"

Answer: "0Accepted AnswerHello,The Get AWS Certified: Professional Challenge Terms and Conditions state: You have until 5:00 p.m. PST on April 28, 2023 to register for the challenge to access your 50% off exam discount (while supplies last) and take your exam by May 31, 2023.This means you must sit for your exam on or before May 31, 2023. Your voucher will not be valid past this date.Also, the FAQs cover this question.Q: What are the dates of the Get AWS Certified: Professional Challenge?A: Registration for the Challenge opens on January 31, 2023 and will be open until April 28, 2023. To be recognized for meeting the Get AWS Certified: Professional Challenge and be able to leverage the 50% discount, take and pass an AWS Professional-level exam before May 31, 2023.CommentShareBriNasAWSanswered 20 days agorePost-User-2403365 19 days agoI received an email from Amazon web services about the challenge only in mid-April 2023! (exactly on April 10, 2023)!Share"


Question: Tape gateway speed limits

"We are using Veeam 9.5 with AWS Tape gateway for a couple of weeks now, But are unable to get higher throughput than ~30mbit/sec on a symmetrical 100mbit line no matter of how many parallel tapes (drivers) are working together.Upload buffer is constantly overflowing which causes slow backup times and increases the backup running window ...Cloud metrics shows ~1.2GB / 5 minutes uploaded which equals to roughly ~30mbit/secAny advises ?ThanksFollowComment"

Answer: "0When the upload buffer fills up completely you can get to a state where the gateway has to verify what's in the upload buffer and what hasn't been uploaded from the cache disk yet.From the sounds of this it would seem you are writing faster than can be uploaded. When the upload buffer was added, was the sizing formula used? https://docs.aws.amazon.com/storagegateway/latest/userguide/ManagingLocalStorage-common.html#CachedLocalDiskUploadBufferSizing-commonIf you can PM me your gateway ID and region I can look into some metrics on my side as well to see if I can find any bottlenecks.Thank you,Brian CCommentShareBrian Canswered 3 years ago0We've established the maximum of 2TB upload buffer from the beginning.I can't find the AWS documents but I remember seeing that each tape job is limited to 30mbit and the entire storage gateway is limited to 120mbit. So I don't understand why we are unable to get more than 30mbit when two tape jobs are running in parallel.I'll PM you our gateway info. Thanks.CommentShareMeddleanswered 3 years ago0We no longer have the network limits doc as you mentioned due to the limits mentioned not being a hard limit of the service. The previous limits mentioned were more of a max performance we saw in our own testing, however since then scaling improvements have been made which invalidated the previous information.CommentShareBrian Canswered 3 years ago0Hi,Just to update that we've replaced our ISP and now and the entire bandwidth is consumed by the storage gateway. the previous ISP was most likely limiting AWS uploads.Thanks for the help.CommentShareMeddleanswered 3 years ago"


Question: I cannot get my SSL Certificate to show installed.

"originally, I installed my ssl cert through the E2C but I was told that I cannot install it there to show up because I have ELBs with subnets and everything. I asked yesterday and literally got the advice of what I did and that did not work. So, are SSLs attached to new instances? because the certificate company is showing the it is on and working but when I go to the website dashboard, it still shows the old expired certificate.  And I have an Application LB not a classic LB. And all of the videos are about setting up a new ELB onto a classic LB. When setting things up, everything keeps trying to route to the subnets already there. I don't want to change anything, just want my newly installed SSL certificate to show installed because it has been but isn't showing installed publicly.I created a new VPC and did everything, but even AWS video talks about something completely different from what I am doing.FollowComment"

Answer: "0Hi thereFrom the note I understand that you installed SSL cert through the EC2 but when you go to website dashboard it still shows the old expired certificate, you have Application LB not a classic LB and you don't want to change anything, just want your newly installed SSL certificate to show. Please correct me if my understanding is wrong.If an old certificate shows up, it is likely that the browser has the site cached so you can double check that as well. Also, if you using ACM please consider running through these steps as well[1].Please make sure your your LB and your SSL certificate are in the same region and LB is listening to HTTPS(secureHTTP)on LB port 443 and instance port 80.Also check your private, public key and certificate chain if are in correct format and all in PEM-encorded[2].please note that the connection should be secured. Check the domain that you're accessing, and then check the domain names included in your certificate. You can view the domain name using your browser and by checking the certificate details. The domain in the URL must match at least one of the domain names included in the certificate[3].I hope the above information is helpful.Reference1.https://aws.amazon.com/premiumsupport/knowledge-center/associate-acm-certificate-alb-nlb/2.https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-create-https-ssl-load-balancer.html3.https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-error-https/CommentShareNonkululekoanswered a year ago"


Question: Can't access S3 bucket from Braket Notebook

"Hello,I am currently trying out AWS Braket in preparation for a larger research project. As part of my trails I am trying to load data from an S3 bucket I created into a pandas DataFrame. The script I am using for this is the followingimport sagemakerimport boto3import pandas as pdsagemaker_session = sagemaker.Session()role = sagemaker.get_execution_role()bucket='test'file_name = 'sine.txt'file_obj = boto3.client('s3').get_object(Bucket=bucket, Key=file_name)df = pd.read_csv( file_obj['Body'], delimiter=' ')unfortunately running it in a braket notebook results inClientError: An error occurred (AccessDenied) when calling the GetObject operation: Access DeniedI searched around and found that it should be due to missing IAM roles for Brakets. However, according to my Identity and Acces Management, the required AWSServiceRoleForAmazonBraket role is already active.I now spend several hours searching but all potential solutions result in the same (or similar) errors.That is why I am coming here. Can anyone tell me how I can solve this issue?Thanks and best wishes,PhilippFollowComment"

Answer: "0Accepted AnswerOh, I'm sorry I didn't catch that. You are right, our default role that us created when you launch a new notebook only gives access to S3 buckets that start with "amazon-braket-". Here is the corresponding statement from the AmazonBraketFullAccess Policy (which is attached to our default notebook role).        {            "Effect": "Allow",            "Action": [                "s3:GetObject",                "s3:PutObject",                "s3:ListBucket",                "s3:CreateBucket",                "s3:PutBucketPublicAccessBlock",                "s3:PutBucketPolicy"            ],            "Resource": "arn:aws:s3:::amazon-braket-*"        },So, it your bucket name was amazon-braket-test instead of test it should work. The easiest way is to just use this naming convention throughout.If you want to use the bucket with name test, you need to customize the Role attached to your notebook (I can't tell in which role you modified the permission above, but since there is a Principal line I suspect it wasn't in the role of your notebook). For instance, you can just add another resource in the above snippet:        {            "Effect": "Allow",            "Action": [                "s3:GetObject",                "s3:PutObject",                "s3:ListBucket",                "s3:CreateBucket",                "s3:PutBucketPublicAccessBlock",                "s3:PutBucketPolicy"            ],            "Resource": [                "arn:aws:s3:::amazon-braket-*",                "arn:aws:s3:::test"            ]        },CommentShareemkesslerAWSanswered a year ago0Hi Philipp,I'm sorry you're running into issues. You need to make sure that your notebook has assumed a Role with Permission to access S3 (a role defines what actions an AWS resource, such as a notebook, can perform on your behalf). The easiest way is to create a new notebook and select "Create a new role" in the Permissions and encryption interfaceThat will create a new role that has all required permissions and attach it to the new notebook. It is also possible to change the permissions for an existing notebook, but it's slightly more involved (happy to walk you through it if interested).For completeness, the AWSServiceRoleForAmazonBraket that you you were able to check is unrelated to the issue you are experiencing. This role is what is called a "service-linked role" (SLR) which defines the actions Amazon Braket (and not the notebook) can perform on your behalf. You can read more about it here https://docs.aws.amazon.com/braket/latest/developerguide/braket-slr.html.Let us know if this worked,EricCommentShareemkesslerAWSanswered a year ago0Hi Eric,thank you very much for your answer. Unfortunately, I need to tell you that it did not work. I created a new notebook instance, as you described, and ran the same notebook but I get the same error. Is there anything else I can try?Update - It looks like it depends on the bucket:I noticed that there is a new bucket in my S3 which was automatically created by the Braket when I ran a hybrid job. When I try to load data from this bucket it works (in both the old and the new notebook instance).I already tried to change the permissions of my old bucket to be equal to the ones in the one created by Braket. Specifically, I changed the Bucket policy to{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "Service": "braket.amazonaws.com"            },            "Action": "s3:*",            "Resource": [                "arn:aws:s3:::test",                "arn:aws:s3:::test/*"            ]        }    ]}Unfortunately, this does not seem to have an effect.CommentSharePhilHSanswered a year ago0Thank you very much, Eric.It now works when I use a bucket named with the convention you suggested.And just for interest: how would I change the role of the notebook?I think I found it in the IAM, but I can not modify it.CommentSharePhilHSanswered a year ago"


Question: Amazon seller central API authentication

"Hello everyone,I am trying to pull stock quantity from amazon seller central catalog API using the product ASIN.The issue I am facing now is with API authorization, I was expecting to send the clientId and clientSecret perhaps and retrieve the data, but the authentication process Amazon has put in place turns out to be confusing and lacks samples I could use.I would really appreciate if anyone could share their implementation either using any of Amazon SDK (PHP or JS preferably) or just steps used in Postman.Thanks.FollowComment"


Question: Have a service running in an ECS cluster dynamically create a new service in the same cluster

"Hi,We have an ECS cluster with a couple of HTTP services running in it.We have a requirement to run up new services (from known images, obviously) at run time - so we'll need to bake the AWS SDK into the management service so that it can do this.We currently deploy the entire stack (including an example of the type of service that will need to be created dynamically) via the CDK.Does anyone have a view on the best approach?I'm imagining creating a CloudFormation template from the existing CDK service definition and pushing it to S3 (or making it a Service Catalog CloudFormation Product?) and then just creating a new stack from it at runtime via the SDK. Does that sound like a sane approach?The new services would be in the same ECS cluster.FollowComment"


Question: ECS containers running on private subnet can not reach elastic search

I have an ECS cluster running containers on private subnet. My containers are running dotnet core applications and configured to send the logs to elastic search endpoint. They are running on private subnet and also with a NAT gateway.I have an elasticsearch cluster running also on aws with an ip based access policy. How can I provide access to elastic search to the ecs containers running on private subnets.FollowComment

Answer: "0Accepted AnswerHi,for your IP-based access policy, "Allow access to the domain from specific IP(s)", have you added the public elastic IP address that is assigned to your NAT Gateway?-randyCommentShareRandyTakeshitaanswered 4 years ago0Hi,To confirm, the ECS cluster is running in a private subnet in one VPC and the Elasticsearch cluster in a another private subnet in a different VPC and you want the ECS cluster to communicate to the Elasticsearch endpoint over private IP address space without going across the public internet?If yes, do both VPCs have non-overlapping CIDR blocks?  If yes, I would recommend reading up on how to setup up AWS VPC Peering. More info available here:https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.htmlIf this is not what you wanted, let me know.-randyCommentShareRandyTakeshitaanswered 4 years ago0Thank you Randy for your answer.So Basically the ES is running not on VPC access but on a public access. And secured via ip policy.However ECS are running on our VPC on private subnets.When i describe my es domain I cant see any information about the VPC and subnets and azs.aws es describe-elasticsearch-domain --domain-name xxxxxxHow do i get the information about the ES domain running with public access? When I setup ES domain I did not find any option to select the VPC so does that mean it runs on Default VPC?CommentShareiamsanjeevanswered 4 years ago0Hi,If your requirements allow you to have Elasticsearch running in a VPC, I would highly recommend that you re-install/or migrate the data from a public endpoint to a VPC so that you don't have to traverse the internet to use Elasticsearch. Note: "When you create a domain, you specify whether it should have a public endpoint or reside within a VPC. Once created, you cannot switch from one to the other. Instead, you must create a new domain and either manually reindex or migrate your data. Snapshots offer a convenient means of migrating data. ."https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-vpc.html#es-migrating-public-to-vpcWhen initially creating your Domain, step 12 in the following link shows:https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-gsg-create-domain.htmlFor simplicity in this tutorial, we recommend an IP-based access policy. On the Set up access page, in the Network configuration section, choose Public access.Here is where you can choose the VPC option instead of Public access.So, let me know if you want help to troubleshoot the current configuration, or if you want to re-install/migrate to the VPC and then see if that works.-randyCommentShareRandyTakeshitaanswered 4 years ago0Hi,Yeah I am well aware of the vpc based access elastic search, but the problem is not all of our infrastructure is  migrated to AWS completely.We are in the middle of migration and we still at least need around 6 months to completely in AWS. And since we are using elastic search public access that are running on our on premise application, it is not possible at a moment.And IF i am correct we can not access vpc based elasticsearch outside the VPC. Let me know if we can access VPC based elastic search somehow outside the VPC as well so our non aws applications still can use & access it.Anyway, thanks for the information. So think the best would be to wait until if we have everything inside aws environment and we migrate to VPC bases ES cluster.Thanks againCommentShareiamsanjeevanswered 4 years ago"


Question: Move files from S3 Bucket back to Site

How can I move all the files in my S3 Bucket back onto the website itself in anticipation of deleting the bucket and simply keeping the files on the site itself?  Luddite here....FollowComment

Answer: "2Create a role for EC2 with a policy including GetObject to the objects in the bucket. The policy looks like this:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "Stmt1647624289157",      "Action": [        "s3:GetObject"      ],      "Effect": "Allow",      "Resource": "arn:aws:s3:::mybucket/*"    }  ]}Assign the role to the webserver.On the webserver, copy the files:aws s3 cp s3://mybucket . --recursiveRemove role from webserver & delete the role and policyCommentShareEXPERTkentradanswered a year ago0It depends on your website software, and how does it treat the filesAs a general answer, you can download all bucket objects using the CLI with  the command aws s3 sync and adecuate access credentials  Once in your site's disk you'll have work ahead, for sureCommentSharetheistanswered a year ago"


Question: AWS Route53 domain registration is not working

The following error occurs when trying to register a domain:How can we solve this problem?리소스                       상태campingmoa.co     도메인 등록 실패: [2001 : Command syntax error ([Command syntax error])]campingmoa.tv     도메인 등록 실패campingmoa.tv     도메인 등록 실패: [Parameters in request are not valid]FollowComment


Question: Error : If Bucket contains '.' like part.txt in any url in rest api

AWS allows Bucket to contain '.'for example my.example.s3.bucketbut when I use this bucket name in rest API in net core  with URLhttps://my.example.s3.bucket.s3.amazonaws.comTo get the location of the bucket It shows below the ERROROne or more errors occurred. |An error occurred while sending the request. |The underlying connection was closed: Could not establish a trust relationship for the SSL/TLS secure channel. |The remote certificate is invalid according to the validation procedure.FollowComment

Answer: 0Accepted AnswerUsehttps://s3.amazonaws.com/my.example.s3.bucketCommentSharerePost-User-3543171answered 4 months ago


Question: "Need to change my region, not sure how! (Using Sendy)"

"Hi, for years I've used SES with no issues, I've recently moved my server stuff to a Uk based server, and when using Sendy, I'm experiencing significant delays when previewing draft emails.The makers of Sendy have suggested this is because the server is located in the UK but my SES region is Oregan and that I should change to the Irish region.I'm not sure how to do this, and not sure if doing it once I've figured it out will mean I can no longer send bulk emails via the SES servers without going to some additional procedures (like new verification etc.)I wonder if there is anyone who can offer some guidance?In case it's not known about, Sendy is an email creation and distribution server-based tool that connects to my ASES account to send the newsletters.Any help/advice gratefully received.ThanksSteve.FollowComment"

Answer: "0Amazon SES has endpoints in multiple AWS Regions, and the verification status of the email address is separate for each region. If you want to send email from the same identity in more than one region, you must verify that identity in each region.ref: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/verify-email-addresses.htmlCommentShareAWS-User-2857227answered 4 years ago0Hi! I also use Sendy but only for about a week. I can't even get them to bring me out of sandbox! How does this help you? well... I just went through all the stuff you're discussing while trying to get mine going.The first reply is correct, you WILL have to verify and do all the hoops again but you begin that in the upper right-hand corner and choose your region. You can't do it from support so you will have to go back to the home area and then re-begin.In other words things like your ID, your sending info, DKIM, etc.Which means if you are reading this and you look up to the right you will see My Account/Console. That's where you start and then from there just proceed as if you were new. In fact, I found it was easiest to just literally begin as if I knew nothing and always started each new page I encountered with a mouse-trip to the upper right-hand corner on each page (just in case it was needed).  It seemed like even then I kept forgetting to check each one.Honestly though if you stick with it, it won't be overwhelming.Maybe I will shoot a little screen-capture video of how.Best of luck,SageCommentShareSageMichaelanswered 4 years ago0Thanks everyone.CommentSharestevebcianswered 4 years ago"


Question: Pinpoint not receiving SMS

"I've got a UK long code and I can send through Pinpoint & SNS from this number, but any SMS's to this number don't appear to be received.Two way SMS is enabled and "enable self-managed opt-outs" is left unticked so AWS handle the HELP & STOP keywords.  But even when sending SMS's with those keywords, there is no response so would suggest the SMS's aren't even being received.Any suggestions on how to resolve this?I've got SNS logging enabled I believe, but can't find how to enable Pinpoint logs for incoming SMS's. All the articles I find are for logging of outgoing messages which appear to be operating correctly.FollowComment"


Question: Flexmatch cannot put a player back in session

"Hi,I am using flexmatch in automatic backfill mode and encounters a problem in the following situation:A player is put in a game session through matchmakingthe player leaves the session (and thus triggers a call to RemovePlayerSession)the player then restarts the matchmaking process ( which triggers a call to StartMatchmaking in our backend )I expected the player to be put back in the same game session but Flexmatch creates a new game session. Is there a way to change this behavior?FollowComment"

Answer: "0Accepted AnswerHi! StartMatchmaking will match backfill tickets against all tickets submitted using StartMatchmaking. It's not necessary that the same ticket will be matched to the same game session it was previously a part of. What I'd look for as part of auto-backfill is if the open spot was matched to some valid player.If you're using managed GameLift hosting you can potentially try using CreatePlayerSession to reserve an open slot for the dropped player before backfill finds another player for the slot.Thanks,ShashankCommentShareShashankJ_AWSanswered 10 months ago"


Question: Certificate used by Elastic Load Balancers in an unrecognized AWS account?

"I'm deleting an obsolete certificate, but Cert Manager shows it's in use by 5 load balancers. I scoured my account for services using these load balancers, but found nothing. Then I noticed the ARNs indicate the load balancers are in a different AWS account.I don't recognize the account number, nor do I recall making the cert available to another account. I'm concerned I may have been hacked.How do I figure out who/what is using the certs? How can I remove these dependencies so I can delete the cert?Thanks,SeanFollowComment"

Answer: "3Accepted AnswerThese ARNs may belong to ALBs created by regional API Gateway endpoints.https://docs.aws.amazon.com/acm/latest/userguide/troubleshoot-apigateway.htmlCommentShareChernetskyianswered 10 months ago1Hello,You cannot delete an ACM certificate that is being used by another AWS service. To delete a certificate that is in use, you must first remove the certificate association. This is done using the console or CLI for the associated service. Open the ACM console at https://console.aws.amazon.com/acm/Link- https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-delete.htmlSimilarly, defining a custom endpoint for your domain in Amazon ElasticSearch Service (Amazon ES) creates an Application Load Balancer. The Application Load Balancer is owned by the ElasticSearch service, not by your account. The ACM certificate provided with creating the custom endpoint is associated with the Application Load Balancer.The below link will help you locate the certificate: https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-resources/Gathering details about the specific certificate might also be of use, and that can be done by following this link: https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-describe.htmlHope this helps. Thanks for reaching out.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months ago0Upon further research, the ARNs are Gateway API regional endpoints using AWS system accounts, for example:arn:aws:elasticloadbalancing:us-east-1:392220576650:loadbalancer/app/prod-iad-1-cdtls-1-2-626/b90fa9e7c54b1b67My Gateway APIs in that region do NOT use this cert for custom domains.How can I determine if these are references to deleted or extant APIs?  The cert expires soon, so I want to avoid things breaking when it does.If they do reference deleted APIs, how can I remove the cert?Thanks,SeanCommentShareseandranswered 10 months ago"


Question: Java8 for iOS Appium testng test

"I am testing both an iOS and an Android native app with Appium/TestNG and my automation code is cross platform but only supports java8.  I build my zip and run my tests successfully on Android, but on iOS, the java version that I am finding is java 12.  I searched this forum and saw that previously someone had the opposite issue (needed java > 8) and their workaround was to install the jdk and do the exports.  I have that approach working, but am wondering if there a way in the Test Spec to specify java8 (so I don't have to provide it)?FollowComment"

Answer: "2HiTry adding the following code instead, since a binary of Java8 is included with the test host:[code]export JAVA_HOME=/usr/libexec/java_home -v 1.8java -version[/code]Thanks,JonCommentSharesimsjon at AWSanswered 2 years ago0Hi hclmobiletests ,Those are the standard mode settings, No we currently don't provide a direct mechanism for customer to be able to select java versions.Using Custom Mode settings is the only way to do that today.(Which you have already verified works)https://docs.aws.amazon.com/devicefarm/latest/developerguide/custom-test-environments.htmlCommentShareGuneesh-awsanswered 3 years ago0hi, Could you share sample custom mode settings script that install jdk1.8 and do the export with me?I tried this one but it didnt work.https://us-west-2.console.aws.amazon.com/devicefarm/home?region=us-east-2#/projects/e3de778f-4d0b-45a3-be78-fada79567b90/runs/1929a132-9351-4c63-a0b7-064db540379a/jobs/00000Thanks,CommentSharesbuyurananswered 2 years ago"


Question: [ERROR] ClientError: An error occurred (AccessDenied) when calling the PutObjectTagging operation: Access Denied

"[ERROR] ClientError: An error occurred (AccessDenied) when calling the PutObjectTagging operation: Access Denied Traceback (most recent call last):   File "/var/lang/lib/python3.8/site-packages/aws_lambda_powertools/metrics/metrics.py", line 184, in decorate     response = lambda_handler(event, context)   File "/var/lang/lib/python3.8/site-packages/aws_lambda_powertools/logging/logger.py", line 354, in decorate     return lambda_handler(event, context, *args, **kwargs)   File "/var/task/lambda.py", line 75, in lambda_handler     set_status(input_bucket, input_key, INPROGRESS)   File "/var/task/lambda.py", line 116, in set_status     s3_client.put_object_tagging(   File "/var/lang/lib/python3.8/site-packages/botocore/client.py", line 508, in _api_call     return self._make_api_call(operation_name, kwargs)   File "/var/lang/lib/python3.8/site-packages/botocore/client.py", line 915, in _make_api_call     raise error_class(parsed_response, operation_name)Can any one help me to resolve the issue.I double checked my IAM roles adn could not resolve the issue.FollowComment"

Answer: "0Accepted AnswerMy guess is that the Lambda role doesn't have permissions to update object tags so I'd check that first. The documentation has the various IAM permissions that can be created for S3 - search for PutObjectTagging.There might also be an issue with the bucket policy which is denying access.Otherwise, if you can provide a code snippet that might help.CommentShareEXPERTBrettski-AWSanswered 10 months ago"


Question: How to get response value from function B to function A

"I am invoking a lambda function (Function B) in another lambda function (Function A). as you can see in the code:Function Aimport jsonimport boto3client = boto3.client('lambda')def lambda_handler(event, context):    ab = {        'a': 'A',        'b': 'B'        }        Response = client.invoke(        FunctionName = 'arn:aws:lambda:us-west-2:747966+1193930:function:toInvoke',        InvocationType = 'RequestResponse',        Payload = json.dumps(ab)        )    print(Response)Function Bimport jsondef lambda_handler(event, context):    a = "I am Rehan"    print(a)    return aI want to get the value of the function B in Response but it is giving me response like this:{'ResponseMetadata': {'RequestId': 'f70db108-a9f44747474740-345367b39c53', 'HTTPStatusCode': 200, 'HTTPHeaders': {'date': 'Tue, 31 May 2022 06:55:20 GMT', 'content-type': 'application/json', 'content-length': '12', 'connection': 'keep-alive', 'x-amzn-requestid': 'f70db108-a9f4-36363636363667b39c53', 'x-amzn-remapped-content-length': '0', 'x-amz-executed-version': '$LATEST', 'x-amzn-trace-id': 'root=1-6295bbd8-7e71eebd66666666655;sampled=0'}, 'RetryAttempts': 0}, 'StatusCode': 200, 'ExecutedVersion': '$LATEST', 'Payload': <botocore.response.StreamingBody object at 0x7f355556ed430>}FollowComment"

Answer: "2What you are trying to do is to "tightly couple" two lambda functions together.I am not sure what business requirements you have, but, in general, this could be called an "anti-pattern". The approach to use with "modern applications" is to use "loose coupling". https://docs.aws.amazon.com/wellarchitected/latest/framework/a-workload-architecture.htmlFor example, you might want to send messages between Lambda functions using SNS (publish/subscribe) or SQS (message queues).On the other hand, if you are trying to put together some over-arching workflow that controls the execution of multiple business functions, then have a look at Step Functions as a way of orchestrating multiple actions:https://docs.aws.amazon.com/step-functions/latest/dg/welcome.htmlHope this helps.CommentShareDennis_Aanswered a year agoAWS-User-8471608 a year agoI am trying to get the data being returned by Lambda B in Lambda A.Share1Accepted AnswerThe response is returned in the Payload field. As you can see, the response type is botocore.response.StreamingBody. You should call the read() method on the Payload to get the content, e.g., body = Response['Payload'].read()CommentShareEXPERTUrianswered a year ago"


Question: Amazon corretto 11 commercial use

"Hello.If I am writing a commercial project using the amazon corretto 11 jdk, do I need to indicate in the license for my program that I use amazon corretto 11 or in the program itself in the program help create links to the amazon website and to the GPL2.0 license or maybe something  more ?Thank you very much in advance.FollowComment"


Question: EC2 instance starting status check fails after a volume attachment and dettachment exercise to my linux instance root volume

"Initially I had created my default linux instance. Then later I created new volume of 2 GB and attached to my linux instance. Within the linux instance I did some modifications such as creating a folder name volume1 and attached the 2 GB volume to it. To avoid mounting everytime after a server reboot, I went to mtab and copied information regarding the 2 GB storage mounting and pasted the same in fstab to just use mount -all option to automatically attach all the volumes available. Later I detached and deleted  the 2 GB volume from my linux EC2 instance. When I launch my EC2 instance it fails the status checks and the instance doesnot load up. I have confirmed that the volume is in the same availability zone as the instance, and the relevant security group has the correct inbound rules. I guess there is some issue happening relating the statement of the detached 2 GB volume present in fstab file of my main linux EC2 instance. Can you help me in regard of this ? I am not able to launch my EC2 instance.I checked for system log for my main linux instance, I got the following in the end lines:Welcome to emergency mode! After logging in, type "journalctl -xb" to viewsystem logs, "systemctl reboot" to reboot, "systemctl default" or ^D totry again to boot into default mode.Cannot open access to console, the root account is locked.See sulogin(8) man page for more details.Press Enter to continue.FollowCommentAWS-Everett a year agoIf you think you have an invalid fstab entry, have you tried removing it? Here is some info about how to do so from a separate EC2 instance -> https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-emergency-mode/Share"

Answer: "0Hello Deep,Was the suggestion from AWS-Everett useful? Please let us know.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago"


Question: Why encrypt an Aurora Read Replica when all instances share the same underlying storage

"Hi there,I often seen it mention in the documentation that you can encrypt an Aurora Read-Replica, but since all instances share the same underlying storage and data is not encrypted in memory then what is the point of it?Thanks in advance.FollowComment"

Answer: "-1You can't create an encrypted Aurora Replica for an unencrypted Aurora DB cluster. You can't create an unencrypted Aurora Replica for an encrypted Aurora DB cluster. Ref: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Replication.htmlData that is encrypted at rest includes the underlying storage for DB clusters, its automated backups, read replicas, and snapshots. Ref: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Overview.Encryption.htmlAmazon Aurora DB clusters support Secure Sockets Layer (SSL) connections from applications using the same process and public key as Amazon RDS DB instances. Ref: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Overview.Security.htmlCommentShareAnanth Tirumanuranswered 5 months agorePost-User-6390332 5 months agoI appreciate you taking the time to respond to my question but you have not really answered the question. From the AWS Docs, it says the following "For an Amazon Aurora encrypted DB cluster, all DB instances, logs, backups, and snapshots are encrypted. You can also encrypt a read replica of an Amazon Aurora encrypted cluster" Why does it add the 2nd line saying you can also encrypt an read-replica? when if you encrypt a cluster all the underlying storage is encrypted, the read-replica uses that underlying storage it does not have independent data on its instance, i.e. there is nothing to encrypt on the read-replica, only logs are replicated over and changes in memory which is not encrypted, so I guess is this line incorrect and should not have been in the documentation? Thanks in advance.Share"