Question: why aws s3 access denied on ubuntu but works on macos?

"Hi, just wondering why I try to upload an image on ubuntu OS but the got the error code 403. The following is the screenshot of the error message:However, when I try the same code on my MAC OS, everything works fine. I can upload the image to bucket. Does anyone know why? Soooo urgent!!!FollowComment"

Answer: "0Are the access keys the same on both machines?Is there a bucket policy restricting by SourceIp or other condition, like VPC?CommentShareEXPERTkentradanswered 3 months agoJoe Wang 3 months ago{"Version": "2012-10-17","Id": "Policy1668353125443","Statement": [{"Sid": "Stmt1668353113542","Effect": "Allow","Principal": {"AWS": "arn:aws:iam::458714226056:user/wenjie-new"},"Action": "s3:","Resource": "arn:aws:s3:::adp-learning"},{"Effect": "Allow","Principal": "","Action": ["s3:GetObject","s3:GetObjectVersion","s3:PutObject"],"Resource": "arn:aws:s3:::adp-learning/*"}]}Here is my bucket policy. I don't think I set any restriction on SourceIP or other condition. The thing I am confused is why it works on Mac but not on Ubuntu...Sharekentrad EXPERT3 months agoRun the following command on both machines: aws sts get-caller-identityShare"


Question: Load Balancer: no rule option?

"Hi guys,I can't seem to find where to create a rule for a load balancer. According to the docs there should be a link "View/edit rules" on the balancer listener, but it's not there.I tried creating various types of load balancers and target groups, but I never saw a way to add rules anywhere. Any idea?FollowComment"

Answer: "2Accepted AnswerHello,You have created Network Load Balancer, create/edit rule options are available only for Application Load balancer .  Please refer this docCommentShareAWS-User-7653869answered 7 months agoEXPERTTushar_Jreviewed 7 months agorePost-User-6619986 7 months agoThat was it! I thought I had tried with an ALB, but it seems I actually didn't. Thank you!Share2Hello,This is likely IAM permissions issue, see below from the documentation. Once the permissions issue is sorted you should see 'View/edit rules' under 'Default Action' column.By default, IAM users don't have permission to create, view, or modify AWS resources. To allow an IAM user to access resources such as a load balancer, and to perform tasks, you:Create an IAM policy that grants the IAM user permission to use the specific resources and API actions they need.Attach the policy to the IAM user or the group that the IAM user belongs to.When you attach a policy to a user or group of users, it allows or denies the users permission to perform the specified tasks on the specified resources.Edit:Please note NLB and GWLB do not have the 'View/edit rules' option, it is only supported with ALB.CommentShareEXPERTTushar_Janswered 7 months agoEXPERTIndranil Banerjee AWSreviewed 7 months ago0Thank you for your answer @Tushar_J! I'm logged in with the root user though, isn't it supposed to have unrestricted access to everything?CommentSharerePost-User-6619986answered 7 months ago"


Question: Connection Interruption Error during Fleet Provisioning

"Hi,I am trying to get the sample Python AWS Device SDK Fleet Provisioning sample code working:https://github.com/aws/aws-iot-device-sdk-python-v2/blob/main/samples/README.mdI have created the temporary cert and key and am then running the fleetprovisioning.py script.  This is doing the initial connection ok but when it gets to registerthing_subscribed_accepted_future.result() it fails with the following error:Connection interrupted. error: AWS_ERROR_MQTT_UNEXPECTED_HANGUP: The connection was closed unexpectedly.Does anyone know what issues could be causing this?  I'm fairly sure all my parameters are correct.  Also, what is this call actually doing i.e. identity_client.subscribe_to_register_thing_accepted?  Is this a topic that is used later on in the fleet provisioning process when the permanent keys and cert are provided?ThanksFollowComment"

Answer: "0Hi,As mentioned docs[1], IoT Fleet Provisioning MQTT APIs are topic based. Devices subscribe to response topics (.../accepted, .../rejected) and publish to request topics. If your connection is successful but the subscription failed, please check if you have enough permission in the IoT policy attached to claim certificate. Also, you can enable CW logs (INFO mode) to get more information for troubleshooting. Refer [2] for enabling CW logs.[1] https://docs.aws.amazon.com/iot/latest/developerguide/fleet-provision-api.html#register-thing[2] https://docs.aws.amazon.com/iot/latest/developerguide/cloud-watch-logs.htmlCommentShareAWS-User-3247576answered 2 years ago0Thanks for the explanation.  I get the flow of things now.  So my issue was a rookie mistake.  The sample script i was using to create the temporary cert was using a different provisioning template to the one i was calling for the fleetprovisioning.py!CommentShareronan-mfanswered 2 years ago"


Question: Inference endpoint not responding when invoked by lambda

"Hi fellow AWS users,I am working on an inference pipeline on AWS.Simply put, I have trained a PyTorch model and I deployed it (and created an inference endpoint) on Sagemaker from a notebook.On the other hand, I have a lambda that will be triggered whenever there is a new audio that gets uploaded to my S3 bucket and pass the name of that audio to the endpoint. The endpoint downloads the audio, performs some pre-processing (super-quick) and returns predictions. The lambda then sends these predictions by email.Audios get uploaded on the S3 bucket on a non regular basis, like around 10 audios a day, at irregular intervals.This morning, I tried manually uploading a test audio to the bucket to check if the pipeline was working.It turns out that my endpoint is correctly invoked by my lambda but looking at the endpoint logs nothing happens (and I don't get any email). I tried a couple of times, without any more success. The lambda just ends up timing out after 300ms (what I set).However, invoking the endpoint from my sagemaker notebook worked perfectly fine on the first try and seemed to unblock the endpoint. After that, the endpoint was responsive to the lambda invokation.Was that because the endpoint was not "cold" anymore and it was a coincidence, I couldn't tell.My questions are:Are there any differences in endpoint invokations between the two scenarios (from the lambda or from the Sagemaker notebook)?How can we see how much time after an invokation the endpoint will become "cold" again? Please correct me If I am wrong using the term cold here. I know it applies to lambdas as well. To what I understood, the endpoint is basically calling my inference script on a ECR container.According to my use case (number of inferences a day, pre-proccesing lightness, ...), what would be the best option for my endpoint? (async, batch, ...)My lambda seems to try invokation twice in total (invoke 1 - timeout 1 - invoke 2 - timeout 2). Can that be set differently?Shall I increase the timeout of my lambda and let it try more times until the ECR is "warm"? or is there such a setting that can be modified on the endpoint side?Thank you so much in advance for your support.CheersAntoineFollowComment"

Answer: "0I had a similar issue and in my case my lambda function was not transforming the input data into the right format for my inference endpoint to digest.  Assuming your lambda function takes an input of bucket/key for the location of the audio file try and mock-up a test directly in lambda to see what errors it is throwing.PS:  Yes there is a difference in how SageMaker Studio calls the inference endpoint and lambda.  With lambda the invoke_endpoint API is used and in SageMaker Studio (using MXNET/Gluon framework) the predict/predictor method is called.PS2: Initially to rule out IAM you may want to give Lambda function AmazonS3FullAccess and AmazonSageMakerFullAccess policies.CommentSharealekse_wanswered a year agoAWS-User-4250684 a year agoHello Aleksei,Thanks for your reply!In my case, my lambda function transforms the input data into the right format.It just didn't manage to invoke the endpoint at first but after invoking it from Sagemaker it unblocked everything.My pipeline works fine now, but I don't know where the issue came from. And It would be good to know. Maybe it happens at first invocation? What about when the endpoint is not invoked after a long time and the lambda tries to hit it again? Is it then due to a long cold start time, longer via Lambda than Sagemaker?My invocation lambda only has the following policy attached (see below extract of Serverless iml file):    - Effect: "Allow"      Action:        - "sagemaker:InvokeEndpoint"      Resource: "arn:aws:sagemaker:${file(./config.${self:provider.stage}.yml):ENDPOINT_ARN}"Is that not enough?CheersAntoineShare"


Question: Have an Alexa skill access private backend services or resources

"Customer wants to build a set of Alexa skills to be used internally, i.e. by their employees. The Alexa skills would need to access backend services that reside inside the corporate data center. I could think of two approaches:Run the Alexa skill inside the corporate data center and make the endpoint for it accessible across the internet.Develop the Alexa skill in Lambda, and open up access to the endpoints of the backed services that need to be accessed.Does anybody have any experience with one or either or these approaches and caveats to take into account?FollowComment"

Answer: "0Accepted AnswerI've seen customers build skills against APIs hosted elsewhere as you outline in scenario 1. The only caveat I'd mention is around security and that developers should validate that a request is actually coming from Alexa by verifying the signature of the request.If your customer has a VPN or DX link to their data center, they could also consider running their Lambda functions within the associated VPC and communicate privately with their backend APIs. It's likely opening up the APIs of their backend services as you outline in scenario 2 and might introduce other security concerns that are best avoided.CommentShareEXPERTAWS-User-0860851answered 6 years ago"


Question: error when deleting an instance on EC2

FollowComment

Answer: "1there is an attribute to Prohibit stop the instance from api calls , u need to modify this first to proceedCommentShareYasserAlhawaryanswered 10 months agopetr_krapek 10 months agoThank you for your advice. Where can I make this setting?Share1Check this outhttps://www.linkedin.com/pulse/enable-disable-stop-protection-ec2-instance-aws-new-feature-abhishekCommentShareYasserAlhawaryanswered 10 months ago"


Question: Lambda stuck on sending messages to SQS or upload files to S3 from time to time with no reason.

"For some reason from time to time during last 2 weeks, while i was developing serverless solution, lambda become stuck on using aws-sdk v2 and aws-sdk v3.It runы code before the moment it needs to send SQS message or upload json file to S3 and then stuck. When I used aws-sdk v2, I added a logger to it for debugging, during normal invocation it showed me that it sent it well (and some results), but when it stuck it doesnt return anything.I tried to change lambda timeout to 6sec,10sec, 60 sec. It just run out of time without any errors.Once I redeploy it, it can start working again. (but in some cases it's not).I also tried to create client outside of the handler, inside the handler. When I consoled log the client, I could see that it has an object.Syntaxis:in aws-sdk v2 I usedconst sqs = new AWS.SQS({apiVersion: '2012-11-05'});sqs.sendMessage(params).promise in aws-sdk v3 i usesqsClient.send(        new SendMessageCommand({ ...param })      );Can it be related to bad ENI or something ? Does anyone have any ideas on what can be the reason of that behaviourruntime: nodejs16.x.architecture: arm64FollowComment"


Question: TLS 1.2 + Aurora Serverless MySql

"My customer is currently using Aurora Mysql 5.7 to benefit from TLS 1.2 support, as the MySql v5.6 was limited to TLS v1.They would like to switch to Aurora Serverless, along with MySql compatibilty.Doing so, the latest MySql version they are able to pick up with Serverless is "Aurora (MySql)-5.6.10a". Everything beyond that is not available as Serverless.Now straight to the question:  the Aurora Serverless documentation states that it supports TLS v1.0, 1.1 and 1.2 (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.html#aurora-serverless.tls). Is it the case whatever MySql engine compatibility is picked up?To reformulate: if I pick classic Aurora Mysql 5.6, I don't have TLS 1.2 support. If I pick up Aurora Serverless MySql 5.6, will I have TLS 1.2 support?Thanks for your helpFollowComment"

Answer: "0Accepted AnswerAurora Serverless connectivity is handled differently from provisioned Aurora. While Aurora provisioned/RDS uses a manual certificate provisioning, which is directly installed on the database, Aurora serverless uses a fleet of proxy combined with ACM. This may explain the differences of support in TLS version.So in summary,Provisioned Aurora MySQL 5.6 only supports TLS version 1.0.Provisioned Aurora MySQL 5.7 supports TLS version 1.0, 1.1, and 1.2.Aurora Serverless supports TLS version 1.0, 1.1, and 1.2.Hope this helps.Thanks,-AdityaCommentShareAWS-User-8357187answered 3 years ago"


Question: The maximum number of addresses has been reached while attempting to an EB managed update

"Hi,I've tried clicking the "Apply now" button on the Elastic Beanstalk > Managed updates overview page, but when I do so and the managed update starts running, it soon reverts back to the original with the following error:FAILED - RollbackSuccessful Successful abort of the Managed Action.Or in detail:Failed to deploy configuration.Service:AmazonCloudFormation, Message:Stack named 'xxx' aborted operation. Current state: 'CREATE_FAILED' Reason: The following resource(s) failed to create: [AWSEBEIP].Creating EIP failed Reason: The maximum number of addresses has been reached. (Service: AmazonEC2; Status Code: 400; Error Code: AddressLimitExceeded; Request ID: xxx; Proxy: null)I haven't experienced these before and I wonder why could that be. It is true that there are 5 Elastic IP addresses already occupied in the same region, however either it was the case before too or I didn't notice that, but I thought that running a managed update will still make the container continue using the same IP it was assigned before.Could you please confirm/shed some more light on why is that the case and if I e.g. need to have one free IP address slot in the list of Elastic IP addresses so managed updates to work?I've not been able to find an answer to this particular question hence asking here.Thank you!FollowComment"

Answer: "1Accepted AnswerHello,The EB environment is trying to create an EIP for the environment but is failing because the EIP limit has been reached. For certain update types such as Immutable updates, additional resources would have to be launched such as an Autoscaling group and EIP. However, when EB attempted the update the environment it failed because the limit of EIPs had been reached. See Immutable environment updates for additional info.To fix this issue, please Request an increase and retry the environment update.CommentShareUgochukwu_Ianswered a year ago"


Question: Connect to AWS IoT/MQTT using Azure NetXDuo

"Does anyone have experience with connecting to AWS IoT using Azure RTOS NetXDuo? I have successfully connected to Azure IoT and Mosquitto public broker.  The problem I think is I'm using certificates in the wrong wayThis is an example of when I'm successfully connected to mosquitto: it uses only root_ca certificate without username/password.#define HOST_NAME "test.mosquitto.org"#define SERVER_NAME "test.mosquitto.org"#define DEVICE_ID "nxpevkboard"#define SERVER_PORT 8883#define PUBLISH_TOPIC   "devices/%s/test/me"#define SUBSCRIBE_TOPIC "devices/%s/notice/me"    for (i = 0; i < sizeof(threadx_tls_remote_certificate) / sizeof(NX_SECURE_X509_CERT); i++)    {        /* Need to allocate space for the certificate coming in from the remote host. */        nx_secure_tls_remote_certificate_allocate(tls_session, &threadx_tls_remote_certificate[i],                                                  threadx_tls_remote_cert_buffer[i],                                                  sizeof(threadx_tls_remote_cert_buffer[i]));    }    /* Add a CA Certificate to our trusted store for verifying incoming server certificates. */    status = nx_secure_x509_certificate_initialize(trusted_certificate, mosqitto_root_ca,                                          sizeof(mosqitto_root_ca), NX_NULL, 0, NX_NULL, 0,  NX_SECURE_X509_KEY_TYPE_NONE);    status = nx_secure_tls_trusted_certificate_add(tls_session, trusted_certificate);AWS provides one more certificate and private key.  I tried to include both certificates with provided private_key. API returned success status but later client can't connect to the host, so maybe I have a mistake in host or servername.#define HOST_NAME  "xxxx.iot.us-west-2.amazonaws.com"#define SERVER_NAME "xxxx.iot.us-west-2.amazonaws.com"#define DEVICE_ID "nxpevkboard"#define SERVER_PORT 8883#define PUBLISH_TOPIC   "devices/%s/test/me"#define SUBSCRIBE_TOPIC "devices/%s/notice/me"    for (i = 0; i < sizeof(threadx_tls_remote_certificate) / sizeof(NX_SECURE_X509_CERT); i++)    {        /* Need to allocate space for the certificate coming in from the remote host. */        nx_secure_tls_remote_certificate_allocate(tls_session, &threadx_tls_remote_certificate[i],                                                  threadx_tls_remote_cert_buffer[i],                                                  sizeof(threadx_tls_remote_cert_buffer[i]));    }    /* This should be local cert i think. */    status = nx_secure_x509_certificate_initialize(certificate, amazon_cert,                                          sizeof(amazon_cert), NX_NULL, 0, private_key, sizeof(private_key),  NX_SECURE_X509_KEY_TYPE_RSA_PKCS1_DER);    status = nx_secure_tls_local_certificate_add(tls_session, certificate);    /* Add a CA Certificate to our trusted store for verifying incoming server certificates. */    status = nx_secure_x509_certificate_initialize(trusted_certificate, amazon_root_ca_cert,                                          sizeof(amazon_root_ca_cert), NX_NULL, 0, private_key, sizeof(private_key),  NX_SECURE_X509_KEY_TYPE_RSA_PKCS1_DER);    status = nx_secure_tls_trusted_certificate_add(tls_session, trusted_certificate);FollowComment"

Answer: "0Hello,the private_key is only for device's certicat. For Root CA, you must write :/* Add a CA Certificate to our trusted store for verifying incoming server certificates. */status = nx_secure_x509_certificate_initialize(trusted_certificate, amazon_root_ca_cert,sizeof(amazon_root_ca_cert), NX_NULL, 0, NX_NULL, 0),NX_SECURE_X509_KEY_TYPE_RSA_PKCS1_DER);Regards,Eric F.CommentShareClairitec_AWSanswered 7 months ago"


Question: SES Paused and unable to use SES

"Hi,We used to use SES for transactional and marketing emails. One time there was a misconfiguration of our email list due to which mails were sent to the wrong email ids. This was a mistake that happened from our side. Because of this our account was paused as the bounce rate went high.  After this we removed all our older email lists, and basically started work on generating a new email list from scratch. We have still not been able to access SES and denied entry. Please let me know what else we can do to be able to use SES AGAIN.Thanks,KartikFollowComment"

Answer: "0Hi!  Good question, I would reach out to AWS Support regarding usage of SES.  AWS can suspend/pause accounts if the quality of emails is deemed to be low (high bounce/complaint rates).If you can contact support and go through why this happened, they may help with restoring your account access.CommentSharejsoncanswered a year ago0No. There is no way.I have the same problem. I gave them some new fresh information. I got nothing.Every time i add some information; the case appers as re-opened, after 2 minutes it will go automaticly as "SOLVED ".So answer is no.They are SES (!) , they are untouchables (!), they are unreachables...CommentShareExportminersanswered 9 months ago"


Question: SQS FIFO Queue subscribed to SNS FIFO topic stopped receiving messages suddenly

"Hello forum,I am facing a weird issue and that is not consistent. I have a SQS FIFO Queue subscribed to SNS FIFO topic. I have added a filter policy to receive only specific messages (messages with specific attributes) on SQS FIFO  Queue. This setup is working fine.But since last few weeks Im facing an issue where the SQS FIFO Queue suddenly stops receiving any messages. This occurred around 5 to 6 times since last three weeks.Please find the observations below for the tests performed to confirm that there is no issue with SNS (publishing on SNS FIFO topic successfully) and the issue is with same SQS FIFO Queue -I created one other SQS FIFO Queue with different name but same configurations (i.e. subscribing to same SNS FIFO topic with same filter policy). I observed that the new SQS FIFO Queue immediately starts receiving messages but the old SQS FIFO Queue is unable to receive message.If I subscribe the existing SQS FIFO Queue to other SNS FIFO topic and publish on the SNS FIFO topic, the existing SQS FIFO queue did not receive any message. While another SQS FIFO Queue subscribed to this SNS FIFO topic was receiving the published messages.I also observed that the old SQS FIFO Queue stars receiving messages automatically after couple of hours.If I delete this SQS FIFO Queue and create a new with same name and configurations, the new SQS FIFO Queue starts receiving messages immediately.All SQS FIFO Queues are being affected for one specific SNS FIFO topic. And to this SNS FIFO topic Im publishing from AWS Lambda.For other SNS FIFO topic to SQS FIFO Queue is not at all affected and its working fine all the time.I have already tried this but it's of no use.Has anyone faced similar issue and help me with this.FollowComment"

Answer: "0My first thought is "IAM permissions". Please check and make sure that the IAM roles/permissions assigned are correct and haven't changed.Otherwise if this doesn't help, please contact our support team - they can look at your configuration and determine what the problem is.CommentShareEXPERTBrettski-AWSanswered 5 months agoedgegoldberg 5 months agoThank you for the response. I don't find any issue with IAM permissions.Have raised query for this with support.Share"


Question: AWS::ECS::TaskDefinition DockerLabels: wildcard certificate and variables

"Hello,How about character * for wildcards TLS in cloudformation template please?We have a issue to use TLS with wildcard in DockerLabels:"traefik.http.routers.traefik.tls.domains[0].main": "*.example.com"We have issue unhashable type: 'dict' in label!Sub "traefik.http.services.${AppName}.loadbalancer.server.port": !Ref AppContainerPortThis does not work as well:"!Sub traefik.http.services.${AppName}.loadbalancer.server.port": !Ref AppContainerPortFollowComment"


Question: WAF is not blocking after string match

I create a rule  i.e.Type   --> Regular ruleField to match  --> URI pathPositional constraint ---> Contains stringSearch string     ----> /test/*Text transformations   --> Lowercase (Priority 0)Action   --> BlockCustom response code  --> 404But after loading a url https://a.xyz.com/test/a   or  https://a.xyz.com/test  its still works but not blocking. Why?What is wrong with the rule.Can anyone guide me pleaseFollowComment

Answer: "1Accepted AnswerI think the problem is your use of the wildcard in your search string. The string match condition is "contains string," so in order to match on both the examples you've provided, you would need to change it to "/test"If /test will always be at the start of the URI path then you should change the string match condition to "starts with string" as this consumes fewer WCUs.Documentation for this can be found here: https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-string-match.htmlCommentSharePaul_Lanswered a year agoAWS-User-0338648 a year agobut what if I want to setURI --> /test/a/*what should be string match condition?and forabc.example.com/*what should be string match condition?Share"


Question: How to send log data from Lambda to EC2-hosted ElasticSearch

"I have created a lambda and set the kinesis data stream as a trigger. When I send a log to the kinesis data stream, I can see lambda being triggered and I can view the logs on cloud watch.I have reserved an EC2 instance and installed elastic search and listening at 9200 port (ex say some IP like https://11.22.333.44:9200/).Now I need to send the data from lambda to elastic search which I have installed in an EC2 instance.When I clicked on the destination I do not have a way to reach EC2 instance hosting my Elastic search.Note: I do not want to use "Amazon OpenSearch Service".FollowComment"

Answer: "2Hi,I would take inspiration from this: https://aws.amazon.com/blogs/compute/using-aws-lambda-extensions-to-send-logs-to-custom-destinations/, which uses Lambda extensions, and perform http request against the elastic endpoint hosted in ec2.Hope it helps ;)CommentShareEXPERTalatechanswered 12 days ago0As your Lambda logs are in CloudWatch, you can install the Elastic Agent on your EC2 and use the ElasticSearch CloudWatch integration, specifying the LogGroup prefixes to pull.See https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html and https://docs.elastic.co/en/integrations/aws.CommentShareEXPERTskinsmananswered 12 days ago"


Question: Calling the invoke API action failed with this message: Network Failure timeout. Using Lambda

"I am trying to invoke a lambda to store data in a Dynamodb table. In my own AWS account, it works, but not in the company AWS account I'm working at. Cloudwatch does not show any errors. The timeout occurs at "await dynamodb.describeTable(describeParams).promise();".My code is as follows:const AWS = require('aws-sdk');const docClient = new AWS.DynamoDB.DocumentClient();const dynamodb = new AWS.DynamoDB();exports.handler = async (event) => {  const valueTostore = event.body || 'default_value';  const params = {    TableName: 'my-values',    Item: {      id: new Date().toISOString(),      SessionConfig: valueTostore    }  };  try {    const describeParams = { TableName: 'my-values' };    await dynamodb.describeTable(describeParams).promise();  } catch (error) {    const response = {      statusCode: 500,      body: JSON.stringify({ message: 'Error while accessing table' })    };    return response;  }  try {    await docClient.put(params).promise();  } catch (error) {    const response = {      statusCode: 500,      body: JSON.stringify({ message: 'Error while storing value' })    };    return response;  }  const response = {    statusCode: 200,    body: JSON.stringify({ message: 'Value stored successfully' })  };  return response;};FollowComment"

Answer: "0Accepted AnswerSecurity group for my lambda wasn't configured for outbound rules, so I opened all ports for outbound and it worked! It was a bad error and too broad if AWS sees it, please narrow it down.CommentSharecombiianswered 2 months ago0I would check that the Lambda has IAM permission to read and write to the DynamoDB table.CommentSharematthew_danswered 3 months ago0This error message is very generic in lambda. I am assuming you are attempting cross account access since you mentioned using 2 accounts. Not sure which account is your dynamoDb created, but you can start looking into if you have proper IAM permission to access dynamoDB for lambda execution role from your company account.Next you can look if your lambda is created inside your private subnet VPC, then its quite likely that it may not have proper route configured to access dynamoDB. It can be accessed via Internet as well AWS private network using gateway/interface vpc endpoints.CommentShareAritro Senanswered 2 months ago"


Question: CanNot connect EC2 instance using internet

"Hello I have EC2 Instance and I had apply all the configurations and internet gateway, elistic ip etc I can use instance connect option to SSH into my instance but I am not able to access my EC2 instance using public IP address from the internet.I have checked security groups many times..  I have allowed HTTP, HTTPS , SSH port in security group settings.FollowComment"

Answer: "1Hi ThereThere are other factors other than security groups.  Please make sure to check NACLs, route tables, etc.  Problems connecting to Amazon EC2 instances in Amazon VPC are usually related to the configuration of security groups, network access control lists (ACLs), or route tables.  Here is a very helpful troubleshooting guidehttps://aws.amazon.com/premiumsupport/knowledge-center/vpc-connect-instance/CommentShareEXPERTMatt-Banswered 9 months agoAshish Kumar 9 months agoI have checked all these settings many times but my problem has not been solved yetShare"


Question: WorkDocs CNAME for custom URL

"Hello!  Does anyone know of a way to provide a fully custom url for my organization's workdocs?For example, if I worked at yahoo, I might want to use CNAME:   fileshare.yahoo.com   <- cnamed to my workdocs here at AWS?Thanks!FollowComment"

Answer: "1AWS WorkDocs does not support custom URLs through CNAME records or any other method. The URLs for WorkDocs sites are automatically generated by AWS and cannot be changed or aliased. If you need to have a custom URL for users to access files, one possible workaround would be to create a simple web application that provides a file browser interface and uses the WorkDocs API to interact with WorkDocs. You could then deploy this web application on a domain of your choosing. However, this would require developing and maintaining an additional web application, and there would likely be additional costs associated with hosting and operating the web application.CommentShareEXPERTsedat_salmananswered 19 days ago"


Question: What is a F5 Load Balancer ?

Currently doing a migration and the one of the teams in their current architecture has an F5 Load balancer listed as part of the network.My questions are: What is a F5 Load Balancer ? What is the equivalent of an F5 Load Balancer in AWS?  Is it an Application Load balancer or a Network Load  balancer?FollowComment

Answer: "0Suggest checking the below link which has the feature comparison, ALB Vs NLB Vs GWLB Vs CLB. You would select a load balancer based on your use-case. If you need Layer 4 LB (TCP, UDP, TLS) then typically NLB is used; if the use-case if Layer 7 (HTTP, HTTPS, gRPC) then ALB is used.https://aws.amazon.com/elasticloadbalancing/features/CommentShareEXPERTTushar_Janswered 6 months agorePost-User-4937163 6 months agoThanks for your answer but I want to know what an F5 Load balancer is.I've got the clear understanding on the different load balancers that exist in AWS.ShareTushar_J EXPERT6 months agoSee more information here: https://www.f5.com/services/resources/glossary/load-balancerIts difficult to compare AWS LB flavors with external vendor LB because there are many features that each of the LBs support. If you are looking for a specific LB feature for AWS ELB family you can post it here.Share"


Question: Unload is broken when a column contains certain characters

"We are using the UNLOAD command to dump data to S3 in a TSV format and then read it using some other programs. Our UNLOAD command looks like the following:UNLOAD ('SELECT column1, column2, column2 FROM some_table')TO 's3://bucket/and/a/prefix/'CREDENTIALS 'aws_access_key_id=<put_access_key_id_here>;aws_secret_access_key=<put_secret_access_key_here>'ALLOWOVERWRITENULL AS '$$NULL$$'ESCAPEADDQUOTESDELIMITER '\t';This works fine, but we noticed it breaks the output format when column1 contains the following string: "1% G".Just to be clear:column1 = "some text 1% General more text"column2 = 10column3 = "whatever"We would expect to get a TSV with that looks like the following:"some text 1% General more text"\t"10"\t"whatever"Instead, we get:"some text 1-NANeneral more text\t"10"\t"whatever"Please note:The TSV we get is broken - the first column isn't enclosed in quotes.1% G has been turned into 1-NAN.FollowComment"

Answer: 0Accepted AnswerSorry you've experienced this problem. I think you are currently on 1.0.6145. We identified the issue and are releasing a new version 1.0.6230 that resolves it.You can either upgrade in the console to 1.0.6230 or later or you can rollback to the previous version temporarily. https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-clusters.html#rs-mgmt-cluster-versionPlease contact AWS Support if you need further assistance.CommentShareAWS-User-2965899answered 4 years ago


Question: Fleet Manager / RDP Session / Copy/Paste

"Hi,How do you copy/paste content between local computer and the RDP session opened with Fleet Manager ?Thanks for your helpFollowComment"

Answer: "0This depends on the browser:Chrome browser supports bidirectional copying and pasting between RDP sessions and your local machine. Firefox browser supports copying from an RDP session and pasting to your local machineSee the red notice in this doc to verify: https://docs.aws.amazon.com/systems-manager/latest/userguide/fleet-rdp.htmlCommentShareggalloanswered 2 months ago-2HelloYou can do that , Please check the link hereInfo from the Docs:To copy or cut and paste files or directories with Fleet ManagerOpen the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.In the navigation pane, choose Fleet Manager.-or-If the AWS Systems Manager home page opens first, choose the menu icon (  ) to open the navigation pane, and then choose Fleet Manager in the navigation pane.3. Select the link of the managed node with the files you want to copy, or cut and paste.In the Tools menu, choose File system.To copy or cut a file, select the File name of the directory that contains the file you want to copy or cut. To copy or cut a directory, choose the button next to the directory that you want to copy or cut and then proceed to step 8.Choose the button next to the file you want to copy or cut.In the Actions menu, choose Copy or Cut.In the File system view, choose the button next to the directory you want to paste the file in.In the Actions menu, choose Paste.CommentShareGKanswered a year agocasjorge 4 months agoThis explained procedure do not permit to copy to/from RDP session and the user PC but only for copy/paste inside the RDP session.It is pretty important to have an easy way to copy/paste files from RDP session to/from user PC.The unique way I see for now is to use S3 Buckets as a intermediary to copy/paste files, however this method is more messy than a simple copy/paste.Share"


Question: Point Spectrum to latest export of RDS snapshot

"Every day, we export to S3 the snapshot of an Aurora database using this feature.Exports are saved by RDS to S3 under a prefix that includes the export identifier.How can we have Redshift Spectrum tables always point to the latest export?I thought of two solutions but I'm not too satisfied with them and was hoping there's a better way I'm missing:After an export is completed, modify every external table so they point to the new pathCopy the Parquet files to a "latest/" prefix which the external table always point toFollowComment"

Answer: "0Thank you for posting the question and the detailed explanation. I understand you would like to know if there is a way to have Redshift Spectrum tables always point to the latest export. The other options you can explore are as follows:Option 1:After the latest snapshot is exported to S3 you can use AWS Glue crawler to create external tables . Please find the steps below:Automate the process of exporting snapshot to S3 whenever a automated snapshot is created.For more information on how to set this up, please refer to this GitHub  repository.Create a crawler in AWS Glue to periodically crawl through new data stored in the S3 bucket. The Glue crawler crawls the bucket and add the data in the form of tables. Upon completion, the crawler creates or updates table in the Data Catalog.For more information on how to add glue crawler, please refer Adding an AWS Glue crawlerPlease refer here to understand how does a crawler determine when to create partitionsPlease refer here to understand Incremental Crawls in AWS GlueThen create the external tables in Amazon Redshift Spectrum using the AWS Glue Data catalog.Please refer here to understand how to create and query external tables in Redshift Spectrum.Option 2:When a new snapshot is added to the S3 bucket, you can add this as a partition in your table and then query these partitions.  A common practice is to partition the data based on time.The following procedure describes how to partition your data:Store your data in folders in Amazon S3 according to your partition key.Create an external table and specify the partition key in the PARTITIONED BY clause.Add the partitions using ALTER TABLE… ADD PARTITIONFor more information on Partitioning Redshift Spectrum external tables refer here CommentShareSUPPORT ENGINEERSanket_Kanswered a year ago"


Question: after rebooting my instance my IP address changes

after rebooting my instance my IP address changes  cant access my application plus i lost my keypair how do I access itFollowComment

Answer: "1The auto-assigned public IP address associated with EC2 instance changes every time you stop and start the instance.An Elastic IP address is a static public IPv4 address associated with your AWS account in a specific Region. Unlike an auto-assigned public IP address, an Elastic IP address is preserved after you stop and start your instance in a virtual private cloud (VPC).https://aws.amazon.com/premiumsupport/knowledge-center/ec2-recover-ip-address/CommentShareEXPERTTushar_Janswered 8 months ago"


Question: Export Workdocs to S3

I am trying to export the content of WorkDocs to  S3. There is some service or procedure to do it efficiently?FollowComment

Answer: 0Are you looking at exporting an entire workdocs site? or a single user/directory? Do you want the process to be a once off or ongoing?There is no built in mechanism to bulk export your data - thought it is possible with the API - you could use the below blog past as an example to follow:https://aws.amazon.com/blogs/storage/auto-sync-files-from-amazon-workdocs-to-amazon-s3/If you are not looking at doing a real time sync but a one time export you could do away with the event bridge and api gateway component and run the whole thing from a small EC2 instance rather than a shorter lived lambda.Workdocs Developer guide:https://docs.aws.amazon.com/workdocs/latest/developerguide/getting-started.htmlThe API is well documented:https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/workdocs.html#clientCommentShareRobPowellanswered 9 months ago


Question: Fetching VAST Meta Data from Amazon Media Tailor

"In order to adhere to ad policies, I need to display "why this ad" overlays when an ad shows on the stream generated by Media Tailor.The VAST 3.0 returned from the ADS contains this information within the <Creatives> <Creative> <Linear> <Icons> <Icon> structure that is part of the spec of VAST 3.0However, that information is not passed through the client side tracking JSON supplied by MT as per the documentation hereI need to fetch this information in order to correctly construct the overlays, am I missing something? is there a way to get this information from MediaTailor?Thanks!FollowComment"


Question: AWS::ApiGatewayV2 not working in Spain Region. When it will be available?

"Hi everyoneI've tryed to deploy a serverless API, and I've received the following error:The CloudFormation template is invalid: Template format error: Unrecognized resource types: [AWS::ApiGatewayV2::Stage, AWS::ApiGatewayV2::Route, AWS::ApiGatewayV2::Integration, AWS::ApiGatewayV2::Api]After some research, I've found that I can't deploy an HTTP Api (my case) or a Websocket Api in Spain region, only a REST Api.I'd like to know when it will be possible, and if could you provide me a page where there is this info detailed (actual services, coming soon services, ...)Best regards and thanks in advance!FollowComment"

Answer: "0Hi Jorge-Gil, unfortunately you'll never get any future release dates on any services or enhancements from AWS - they stick to this policy most rigidly.  You'll sometimes know something is on the way after an announcement (or even in a Roadmap briefing from AWS if you're a Partner, Enterprise Support customer etc.) but never a date.CommentShareEXPERTskinsmananswered 4 months ago"


Question: Wrong Ruby version on Elastic Beanstalk platform

I just created an environment using the platform "Ruby 3.0 running on 64bit Amazon Linux 2/3.6.2" but when I shell into the server and check the ruby version using ruby -v it shows "ruby 2.7.5p203 (2021-11-24 revision f69aeb8314) [aarch64-linux]".I've provisioned 2 environments with this platform but they're both stuck on Ruby 2.7.5 instead of the expected 3.0.5.  I've also confirmed via IP addresses that I am indeed shelled into the correct instances for these Elastic Beanstalk environments.What should be my next step to get this working?FollowComment

Answer: "0Accepted AnswerI figured it out.  I had copied a saved configuration to create the new EB environments, updating the parameters as needed for the new platform.  However,  there was a configuration in there that specified an ami ImageId which overrode the platform preference:  AWSEBEC2LaunchTemplate.aws:autoscaling:launchconfiguration:    ImageId: ami-XXXXXXXXXXXXXXXXXI removed the ImageId line and once the environment was provisioned it had the proper Ruby version.CommentSharerePost-User-8337897answered 5 months ago"


Question: Can I use AWS Marketplace to purchase 3PP licenses and then use these 3PP product to populate the AppStore Catalog in AWS Workspace?

"To populate my AWS Workspace Product Catalog with 3PP software products e.g., AutoCAD, Adobe Premier Pro, so IT Admin can provision them to virtual desktops, I need to purchase licenses for those 3PP software first.Should I go to AWS Marketplace to find these 3PP software e.g., AutoCAD, Adobe Premier Pro and purchase these licenses for use in my AWS Workspace (i.e., purchase license and install apps in the VM so my AWS Workspace can access them)?If that is the case, do I have to go to AWS Marketplace to add licenses each time I need new licenses in my AWS Workspace?Any info on this will be greatly appreciated.THANKS.FollowComment"

Answer: "0Hi,I think there's some confusion here  with AWS Marketplace and Amazon WorkSpaces Product Catalog.AWS Marketplace provides a new sales channel for ISVs and Consulting Partners to sell their solutions to AWS customers. Licensing of products such as AutoCAD and AdobePremiere etc. is not done through AWS Marketplace. You need to work with your company's IT department to obtain those license and software.For installation of the software on Amazon WorkSpaces, you also need to work with your company's IT department/Administrator to obtain permission to install software. Unless your IT administrator has given you Administrator privilege to the Amazon WorkSpace to perform these task.Based on your question, I would recommend to first contact with the IT Department and find out who's responsible for the Amazon WorkSpaces deployment for your company. ThanksCommentShareEXPERTDzung_Nanswered a year agoNokoyashi a year agoThanks very much for your answer.I am the IT department/Administrator. For me to obtain licenses for AutoCAD, Adobe Premier Pro, Micosoft products or Quickbooks etc. for putting on the App Catalog of my AWS Workspace and installation, can I go to AWS Marketplace to purchase those licenses if they are in your AWS Marketplace?My next question is once I got the licenses either from ISVs directly or thru AWS Marketplace, do I have to upload it to a License Server before putting on my App Catalog in the AWS Workspace for them to run on any virtual desktop users' virtual workspace?Thanks again and look forward to more info.Share"


Question: "Boto3 Problem: "BucketName", must be one of: S3. Cannot move archives from Glacier to s3 bucket"

"I'm using Boto3 to try to create an Inventory Retrieval Job from Glacier. Relevant part of my job retrieval dict looks like this:job_params = {            'Type': 'inventory-retrieval',            'OutputLocation': {                'BucketName': self.returnBucket,            },            'InventoryRetrievalParameters': {                'StartDate': formatStart,                'EndDate': formateEnd,            },        }The error I get says" BucketName", must be one of: S3. The Boto3 Documents say that it's supposed to be a string, with the bucket name. I've tried both the bucket name and the ARN and they don't work.I Tried created resource that I thought was the right approach:s3_resource = boto3.resource('s3')s3_bucket = s3_resource.Bucket('the bucket name')but when the self.retrurnBucket = s3_bucket I still get the same error.FollowCommentalatech EXPERT4 months agoHave you tried ‘BucketName’ :s3_bucket[‘name’]?Share"

Answer: "0The doco page you linked to shows jobParameters contains:        'OutputLocation': {            'S3': {                'BucketName': 'string',Looks like you forgot the 'S3' bit.CommentShareEXPERTskinsmananswered 4 months ago0Hello you have to use it like below:jobParameters={        'Type': 'inventory-retrieval',        'Format': 'JSON',        'OutputLocation': {            'S3': {                'BucketName': bucket_name,                'Prefix': inventory_file_key            }        }    }CommentShareSUPPORT ENGINEERUjjawal_Sanswered 4 months ago"


Question: SAM CLI- Using "sam build" - Build includes non required folders

How can you force 'sam build' commands to not include sub directories such as /node_modules and tests. These get added to each function and take an incredible amount of time to 'build' and 'deploy'. Am I missing a step to stop these folders being included? using SAM CLI v1.55.0FollowComment

Answer: "0Have you tried .npmignore as mentioned on this Github thread - https://github.com/aws/serverless-application-model/issues/308 - "sam build command uses npm to package up the build folder (for nodejs projects), so you can use .npmignore to tell it which files should be excluded from the build"CommentShareEXPERTIndranil Banerjee AWSanswered 9 months ago0I have found in my template.yaml file under each resource you can declare a CodeUri - it appears to only build files from this directory. This works well for my use case as I have a seperate lambda layer I use which holds all dependencies needed. I will now just structure my lambdas under seperate directories and share code where needed.Snippet of tamplate.yaml:  listProvisioningTemplates:    Type: AWS::Serverless::Function    Properties:      CodeUri: src/provisioning/listProvisioningTemplates/      Handler: index.handler      Layers:        - !Ref awsCommandsLayer      Runtime: nodejs16.x      Architectures:        - x86_64      MemorySize: 128      Timeout: 100      Description: A Lambda function that returns a static string.      Policies:        # Give Lambda basic execution Permission to the helloFromLambda        - AWSLambdaBasicExecutionRole    #Metadata:    #  BuildMethod: makefileFolder StructureAWS-SAM-DIR:  -src:    -provisioning:      -listProvisioningTemplates:        index.js  -template.yaml  CommentSharePhil Begganswered 9 months ago"


Question: Beanstalk deployment process fails to update Proxy configuration

"I've seen this several times where it appears that Beanstalk will not deploy a bundle because artifacts contained in a previous deployment had syntax errors. I don't understand why Beanstalk would validate old artifacts rather than deploy the artifact as contained in the bundle currently being deployed. In order to resolve resolve the issue the syntactically bad files have to be manually replaced (or deleted?) before Beanstalk will deploy successfully.The current problem is highlighted below:eb-engine log3:572022/04/07 22:12:51.580831 [INFO] Executing instruction: configure proxy server2022/04/07 22:12:51.584473 [INFO] Running command /bin/sh -c cp -rp /var/app/staging/.platform/httpd/. /var/proxy/staging/httpdThis is done correctly – contains the version of the file from the app bundle I’m deploying…2022/04/07 22:13:31.619080 [INFO] Executing instruction: start proxy with new configuration2022/04/07 22:13:31.619124 [INFO] Running command /bin/sh -c /usr/sbin/apachectl -t -f /var/proxy/staging/httpd/conf/httpd.conf2022/04/07 22:13:31.687560 [INFO] [Thu Apr 07 22:13:31.670790 2022] [core:warn] [pid 21978:tid 139968169546304] AH00111: Config variable ${njpf_host} is not definedAH00526: Syntax error on line 1 of /etc/httpd/conf.d/apache_overides.conf:Cannot parse condition clause: syntax error, unexpected T_OP_BINARYWhy is he looking at /etc/httpd/conf.d/apache_overides.conf when the latest is in/var/proxy/staging/httpd? (or why wasn’t the latest apache_overides.conf copied from/var/proxy/staging/httpd to /etc/httpd/conf.d?)2022/04/07 22:13:31.687593 [ERROR] An error occurred during execution of command [app-deploy] - [start proxy with new configuration]. Stop running the command. Error: copy proxy conf from staging failed with error validate httpd configuration failed with error Command /bin/sh -c /usr/sbin/apachectl -t -f /var/proxy/staging/httpd/conf/httpd.conf failed with error exit status 1. Stderr:[Thu Apr 07 22:13:31.670790 2022] [core:warn] [pid 21978:tid 139968169546304] AH00111: Config variable ${njpf_host} is not definedAH00526: Syntax error on line 1 of /etc/httpd/conf.d/apache_overides.conf:Cannot parse condition clause: syntax error, unexpected T_OP_BINARYThis seems to confirm the copy from /var/proxy/staging/httpd failed but the reason it failed is that the last version (prior to the current deploy) of /etc/httpd/conf.d/apache_overides.conf had a syntax error. Well no kidding – that’s why I’m deploying the latest version of  apache_overides.conf (in /var/proxy/staging/httpd/conf.d) which does not have the reported syntax error).Again, I'm not sure why beanstalk is concerned about a syntax error that doesn't exist in the current deployment.Help! Thanks.FollowComment"


Question: AWS Glue 3.0 via Docker container - local development

"Attempting a basic glue example inside the latest amazon glue container fails withAn error occurred while calling o47.getDynamicFrame.: java.io.FileNotFoundException:  (No such file or directory)at java.io.FileInputStream.open0(Native Method)at java.io.FileInputStream.open(FileInputStream.java:195)at java.io.FileInputStream.<init>(FileInputStream.java:138)at com.amazonaws.glue.jdbc.commons.CustomCertificateManager.importCustomJDBCCert(CustomCertificateManager.java:127)at com.amazonaws.services.glue.util.JDBCWrapper$.connectionProperties(JDBCUtils.scala:952)at com.amazonaws.services.glue.util.JDBCWrapper.connectionProperties$lzycompute(JDBCUtils.scala:738)at com.amazonaws.services.glue.util.JDBCWrapper.connectionProperties(JDBCUtils.scala:738)at com.amazonaws.services.glue.util.JDBCWrapper.tableDF(JDBCUtils.scala:864)at com.amazonaws.services.glue.util.NoCondition$.tableDF(JDBCUtils.scala:86)at com.amazonaws.services.glue.util.NoJDBCPartitioner$.tableDF(JDBCUtils.scala:172)at com.amazonaws.services.glue.JDBCDataSource.getDynamicFrame(DataSource.scala:967)at com.amazonaws.services.glue.DataSource.getDynamicFrame(DataSource.scala:99)at com.amazonaws.services.glue.DataSource.getDynamicFrame$(DataSource.scala:99)at com.amazonaws.services.glue.SparkSQLDataSource.getDynamicFrame(DataSource.scala:714)at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)at java.lang.reflect.Method.invoke(Method.java:498)at py4j.reflection.MethodInvoker.invoke(MethodInvoker.java:244)at py4j.reflection.ReflectionEngine.invoke(ReflectionEngine.java:357)at py4j.Gateway.invoke(Gateway.java:282)at py4j.commands.AbstractCommand.invokeMethod(AbstractCommand.java:132)at py4j.commands.CallCommand.execute(CallCommand.java:79)at py4j.GatewayConnection.run(GatewayConnection.java:238)at java.lang.Thread.run(Thread.java:750)Am I supposed to be passing what looks to be a certificate manager of some sort, if so how do I do that?I'm loading this up in a very simple waydef spark_sql_query(    glueContext,     query,     mapping) -> DynamicFrame:    for alias, frame in mapping.items():        frame.toDF().createOrReplaceTempView(alias)        result = spark.sql(query)        return DynamicFrame.fromDF(result, glueContext)def jdbc_source(    glueContext,    connectionName,    table,) -> DynamicFrame:    connection_options = {        "useConnectionProperties": "true",        "dbtable": table,        "connectionName": connectionName,        "customJdbcDriverS3Path": "s3://my_path/mysql-connector-java-5.1.49.jar",         "customJdbcDriverClassName": "com.mysql.jdbc.Driver"    }    return glueContext.create_dynamic_frame.from_options(        connection_type='mysql',        connection_options=connection_options    )def main():    data_source = jdbc_source(        glueContext=glueContext,         connectionName='my_connection_name',        table="my_table")    spark_sql_query(        glueContext=glueContext,        query=query,        mapping={"myDataSource": data_source}    ).show()    job.commit()FollowComment"

Answer: "0You are taking properties from "connectionName", since you have "useConnectionProperties" enabled, seems that connection points to a relative certificate, so the engine is looking for it in the local filesystem instead of s3.If normally you provide the certificate file to Glue via --extra-files, you would need to put that file inside the container manually so Glue can find it.CommentShareGonzalo Herrerosanswered 4 months ago-1This is how I run my local env. On the command prompt , run :Note the MyProfile is your AWS profile set in your local systemReplace the path and all other paths containing <UserName> as appropriatePROFILE_NAME="MyProfile"JUPYTER_WORKSPACE_LOCATION=/Users/<UserName>/WorkSpace/jupyter_workspace/WORKSPACE_LOCATION=/Users/<UserName>/WorkSpace/jupyter_workspace/docker run -it -v ~/.aws:/home/glue_user/.aws -v $JUPYTER_WORKSPACE_LOCATION:/home/glue_user/workspace/jupyter_workspace/ -e AWS_PROFILE=$PROFILE_NAME -e DISABLE_SSL=true --rm -p 4040:4040 -p 18080:18080 -p 8998:8998 -p 8888:8888 --name glue_jupyter_lab amazon/aws-glue-libs:glue_libs_3.0.0_image_01-arm64 /home/glue_user/jupyter/jupyter_start.shAlso follow : https://aws.amazon.com/blogs/big-data/develop-and-test-aws-glue-version-3-0-jobs-locally-using-a-docker-container/Make a note of the system that you are running on . I run it on Mac M1 chip , and find the arm64 image appropriateCommentShareKoustavCanswered 5 months ago"


Question: "Build phase loops, even though its successfull"

"Hi,In the pipeline, the build phase completes the build, then immediately kicks off another build and will do this until stopped. Each build is successful, but it never progresses to deployment.What can I check to see why this is happening?This is the last 10 or so lines from a successful build output[Container] 2021/03/21 07:21:50 Phase complete: POST_BUILD State: SUCCEEDED[Container] 2021/03/21 07:21:50 Phase context status code:  Message:[Container] 2021/03/21 07:21:50 Expanding base directory path: .[Container] 2021/03/21 07:21:50 Assembling file list[Container] 2021/03/21 07:21:50 Expanding .[Container] 2021/03/21 07:21:50 Expanding file paths for base directory .[Container] 2021/03/21 07:21:50 Assembling file list[Container] 2021/03/21 07:21:50 Expanding imagedefinitions.json[Container] 2021/03/21 07:21:50 Found 1 file(s)[Container] 2021/03/21 07:21:50 Phase complete: UPLOAD_ARTIFACTS State: SUCCEEDED[Container] 2021/03/21 07:21:50 Phase context status code:  MessageEdited by: papapumpnz on Mar 21, 2021 12:38 AMFollowComment"

Answer: "0Resolution if anyone else is facing this problem.Check CloudWatch Event rules haven't been created to monitor your ECR repo for a latest build. What was happening was the pipeline created a build, then the CloudWatch event noticed a new image, then started a new pipeline build event again, for infinity. Nice little loop.So check CloudWatch > Events > Rules and see if you have a "CodePipeLine" type rule setup to monitor changes to your ECR repo. Disable and retest. This fixed my issue.CommentSharepapapumpnzanswered 2 years ago"


Question: Changing the bot's locale from en_US to en_GB results in a MASSIVE drop in accuracy - nonsense sentences are being matched to intents instead of to the fallback intent

"I've recently tried to change my bot's locale from en_US to en_GB as my bot is being used in the UK.With en_GB as the locale, nonsense sentences such as "khk djh kdjhc lkjf" are being matched to real intents rather than (as I would expect) the fallback intent. The training data is identical and there is no particular regional language being used. It's a v2 bot with around 100 intents.In fact, it's virtually impossible to trigger the fallback intent with any combination of input text.Has anybody else experienced this? Is there a workaround or is the en_GB locale just significantly worse at recognition?FollowComment"

Answer: 0Thank you for reaching out.Can you please share some sample request ids along with rough window of time for when these requests were made and the AWS region. This will help us investigate the issue.CommentSharekartiknatawsanswered 2 months ago


Question: botocore.exceptions.ClientError: An error occurred (ValidationException)

"Hi,I want to deploy an MLflow image to an AWS Sagemaker endpoint that contains a machine learning model. I executed the following code, which I found in  https://towardsdatascience.com/deploying-models-to-production-with-mlflow-and-amazon-sagemaker-d21f67909198 .import mlflow.sagemaker as mfs    run_id = run_id # the model you want to deploy - this run_id was saved when we trained our model  region = "us-east-1" # region of your account  aws_id = "XXXXXXXXXXX" # from the aws-cli output  arn = "arn:aws:iam::XXXXXXXXXXX:role/your-role"  app_name = "iris-rf-1"  model_uri = "mlruns/%s/%s/artifacts/random-forest-model" % (experiment_id,run_id) # edit this path based on your working directory  image_url = aws_id _ ".dkr.ecr." _ region + ".amazonaws.com/mlflow-pyfunc:1.2.0" # change to your mlflow version    mfs.deploy(app_name=app_name,              model_uri=model_uri,              region_name=region,              mode="create",             execution_role_arn=arn,             image_url=image_url)  But I got the following error. I checked all policies and permissions attached to the IAM role. They all comply with what the error message complains about. I don't know what to do next. I'd appreciate your help. Thanks.botocore.exceptions.ClientError: An error occurred (ValidationException) when calling the CreateModel operation: Could not access model data at https://s3.amazonaws.com/mlflow-sagemaker-us-east-1-xxx/mlflow-xgb-demo-model-eqktjeoit5mxhmjn-abpanw/model.tar.gz. Please ensure that the role "arn:aws:iam::xxx:role/mlflow-sagemaker-dev" exists and that its trust relationship policy allows the action "sts:AssumeRole" for the service principal "sagemaker.amazonaws.com". Also ensure that the role has "s3:GetObject" permissions and that the object is located in us-east-1.FollowComment"

Answer: 0I found the root cause. I had to go to "Trust relationship" section of the IAM role and then add "sagemaker.amazonaws.com" to the service principal.CommentSharefarshad123answered 2 years ago


Question: Automate AWS sandbox creation and deletion

I need a solution to automate the creation and deletion of AWS Sandbox for multiple people who need to do their work.FollowComment

Answer: "0You can use AWS Organizations and its APIs to automate account creation and closure. Please find the below blog posts for sample solutions and details. You can create a sandbox OU within an organization to apply necessary service control policies.Automate account creation, and resource provisioning using AWS Service Catalog, AWS Organizations, and AWS LambdaAWS Organizations now provides a simple, scalable and more secure way to close your member accountsSandbox OUCommentShareTaka_Manswered 7 months ago"


Question: WorkSpaces freezing upon WorkSpaces Client screen resize

"Has anyone else had issues with WorkSpaces freezing upon dragging to resize the client? I have had this at multiple clients with multiple unrelated AWS environments. Doesn't matter what version of the Amazon WorkSpaces Client software you use.Basically, what happens is:You log on, let's say with the WorkSpaces Client for Windows. Everything is fine.You drag the edge of the WorkSpaces Client to make the window of the application larger, OR let's say you go to Full Screen mode.The client simply freezes. The desktop does not immediately resize, OR the screen goes black.It stays frozen for about 5 mins, then magically the resize "catches up" and everything settles down and goes back to normal.It also happens if you use a zero client, but the WorkSpace was previously running in the WorkSpaces Client software (and sized for the client it was running on) and thus needs to resize again to fit the zero client. Or vice versa.Hope I'm explaining this properly.It does not happen on all WorkSpaces at all times. There does not even need to be any applications open. However, when it does start to happen on a particular WorkSpace, it is very repeatable on that WorkSpace for a considerable amount of time (like all day, or occasionally all week). Multiple reboots and it still recurs. Then on another day it might not do it at all, and resizes work fine on that same WorkSpace.I can't think of any common denominator that these WorkSpaces have. Maybe ScreenConnect? Incidentally, if you view the desktop through ScreenConnect while this is happening, it remains “stuck” - you click on things, nothing happens - you can't really interact with it…but you can connect to it.Interestingly, it does not disconnect the session. And if you send a reboot command it immediately restarts the WorkSpace, so it is still "alive" so to speak.I'm curious to hear if anyone else has run into this.Thanks!FollowCommentrePost-User-asrivas2 5 months agoI too am noticing identical issue i.e. 'WorkSpaces freezing upon WorkSpaces Client screen resize' . I have installed the latest Workspaces Client Version 5.6.2.3417 and also rebooted my Workspace. The network is healthy ( less than 75 ms round trip time) but still the Workspace keeps freezing upon resize. Is this a known bug?Share"


Question: "AWS Personalize: Difference between, E-commerce recommenders: Recommended for you & Custom Solution: User-Personalization recipe"

"In AWS Personalize, what is the the difference between the Domain data set E-commerce recommenders: Recommended for you &  Custom Solution: User-Personalization recipe, other than that of later one use impressions data. If we don't feed in impressions data, would they both produce similar recommendations.FollowComment"

Answer: "0The main benefit of having Recommenders vs Custom solutions is akin to the difference between hosting an API on Lambda vs. EC2. With Recommenders, you get an out-of-the-box managed solution that manages retraining with built-in filtering for already bought items. Custom solutions allow customers to manually manage their model updates and retraining at their own cadence. The underlying recommendations with the same data would be similar but the managed experience as a whole is what makes the difference.CommentShareSUPPORT ENGINEERStewyn_Canswered a year ago"


Question: Need help to understand Redshift Serverless costs

"I'm using Redshift Serverless to run some tests, but I don't understand how it's being billed. I'm still on the Free Tier $300, but already used almost $50 of those, and according to my calculations, the cost should be less than $2 so far.I understand that Redshift Serverless is billed for RPU and Storage. But when I check the usage using:select  date_trunc('day', start_time) usage_date,  sum(compute_seconds) total_compute_seconds,  sum(compute_seconds)/(60*60) total_compute_hours,  total_compute_hours*0.375 total_compute_costfrom sys_serverless_usagegroup by date_trunc('day', start_time);Result shows that the cost should be less than $2 so far:Storage doesn't seem to be the cost either, as the cost of it shows $0 so far, using:SELECT date_trunc('day', start_time) usage_date,SUM((data_storage/(1024*1024*1024))*(datediff(s,start_time,end_time)/3600.0)) AS GB_hours,GB_hours / 720 AS GB_months,GB_months*0.024 AS storage_cost_dayFROM sys_serverless_usageGROUP BY 1 ORDER BY 1;I need help to understand where the money is going, if there is some fixed cost or how is it draining so fast?I also tried to find Redshift Serverless on the Billing section, but it doesn't seem to be there (maybe cause it's still under the Free Tier, but some services show up there even when cost is $0)Thanks in advance!FollowComment"

Answer: "0Hi there,I'm sorry to hear about this frustrating experience.Our Billing team can look into this for you. I would recommend creating a support case here: http://go.aws/support-center.Hope this helps,— Aimee K.CommentShareEXPERTAWS Support - Aimeeanswered 9 months ago"


Question: "I AM User with EC2 Full access, can see the instance but is unable to connect to it"

"Hi,Our access woes continue!! After syncing the geo-location, my I AM Users could finally see the running instances, but despite full EC2 Access, they cannot connect to the instance. When they try to connect it gives this error: because no identity-based policy allows the iam:ListUsers action not authorized to perform: iam:ListUsers on resourceThey have full EC2access, what are we missing. Please help/FollowComment"

Answer: "0HiMy understanding is you cannot connect to EC2 despite having Full EC2 permission.And you want to see what configuration is missing?First, i am not clear how you try to access EC2? Are you usingEC2 Instance connect?Session Manager?SSH client?if you using EC2 instance connect. Ensure the instance allow SSH port and you have proper permission. EC2 full access is not giving this permission, use EC2 Instance Connect.  Follow this documentif you using Session Manager, ensure you instal the SSM agent in the EC2 and you have right Session Manager permission. Use SSM permission in addition to EC2 permission. You don't need full EC2 permission. Follow this document.If you using SSH client, ensure you have the right SSH key. However, given the error you use. I don't think you use this.I hope it help.CommentShareEXPERTResaanswered 4 months ago"


Question: Which headers are considered invalid by AWS in ALB attribute routing.http.drop_invalid_header_fields.enabled?

I couldn't find any official AWS documentation on which headers are considered invalid by the Application Load Balancer when the routing.http.drop_invalid_header_fields.enabled attribute is enabled. Which of my headers will be dropped? Which characters are allowed and which are not? Is there a standard which is followed here?I found this guide from TrendMicro but would still like to see some official AWS documentation:https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/ELBv2/drop-invalid-header-fields-enabled.htmlFollowComment

Answer: "1Accepted AnswerHope this helps -https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.htmlrouting.http.drop_invalid_header_fields.enabledIndicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true), or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names conform to the regular expression [-A-Za-z0-9]+, which describes all registered internet message headers. Each name consists of alphanumeric characters or hyphens.CommentShareRajesh Sanswered 10 months agoEXPERTToni_Sreviewed 10 months ago"


Question: Does AWS DMS has any way to touch or modify source tables?

"I created several Full load, ongoing replication task DMS tasks to copy data from a VPS MySQL server to RDS MySQL, and after some tweaks (time zone config, collations, etc) I was able to get everything working as expected and replicating data effectively.Yesterday however some tables were truncated in my source MySQL database (TRUNCATE table_name). The table statistics in the DMS task did detect a DDL change as appreciated in the below screenshot:https://i.postimg.cc/q7wsxsZc/Screen-Shot-2022-05-24-at-17-41-01.pngI was able to get the TRUNCATE commands from the MySQL binlog.Questions:Is there any way that DMS could have been the culprit in literally truncating my source tables? My tasks don't even have the preparation mode TRUNCATE, I have DO NOTHING.I didn't find any way in the configs or in the docs but, does DMS have a way to affect source tables?Edit:I get the feeling that the VPS server got hacked. But I haven't been able to confirm if that's the case.Edit 2:Even some tables DMS didn't know about (were not included in the table mappings) got truncated as well.FollowComment"

Answer: "1Hi AWS-User-6348262,DMS uses unidirectional replication from the source DB to the target DB. DMS will not update or delete any data in your source DB.Hope that helps!Best,SeanCommentShareSean-AWSanswered a year ago0DMS wont write or truncate any source user db tables. In some engine types it would create extra tables to capture ongoing changes but in that case also it wont truncate tables.CommentShareAWS-User-8174525-subhashanswered a year ago"


Question: Lambda function won't run in parallel via State Machines

"I am sure I am missing some basic info but my setup is as follows:I have 1 lambda function and  I have 2 State Machines.Each state machine is calling the same lambda function twice in sequence (30 sec pause between calls)Then I have rules setup to trigger the state machines every minute.Each state machine is passing different params to the lambda function so I am trying to get to a situation where my Lambda function is called every 30 seconds with 1 set of params (from statemachine 1), and the same lambda function is called with a different set of params (via statemachine 2) every 30 seconds.Looking at the lambda function logs it looks like the state machines will not run the lambda function until the other state machine has completed its entire execution (ie calling the lambda function twice). I would expect that the two state machines would run independently of each other.Is there some limitation because they are all calling the same lambda function? Or is there some setup issue or is this just how it works?Thanks!FollowComment"

Answer: "0State machine executions are independent of each other. The most probable reason for what you are describing is that the state machines do not start at the same time. Look at the state machine logs to see when they start and when they invoke the functions.CommentShareEXPERTUrianswered a year agoGottsy a year agoI don't expect the state machines to start at the same time but I expect that they should not be "blocking each other". Its clear from the logs that the execution of State machine 1 is only starting once the entire execution of State Machine 2 completes (ie 2 lambda calls) . So the timing is all offset and extended, ie instead of each state machine running every minute they are being delayed because of the other state machine running. I am sure there is some setup issue? Does it matter if the state machines or rules share the same resources? I dont think I created new resources for everythingShare0It turns out that I need to modify the Step functions to have InvocationType: event.I understood that that allows asynchronous execution of lambda functions WITHIN a single state machine but one machine would have no impact on the operations of another state machine.Seems that's not the case and they do impact each other. Changing the invocationtype solves the problem. Although it is not ideal as I would like the function calling to be sequential within the state machine.CommentShareGottsyanswered a year agoUri EXPERTa year agoDo you have reserved concurrency on the Lambda function?Share"


Question: "Created RDS database, Cannot connect via Microsoft SQL Server Studio"

"Hi,I am new to AWS. Just created new account and created my first SQL server Database (RDS) according to the tutorial.The database is up and running, but I cannot connect to it via microsoft sql server management studio.I got the following error:"A network-related or instance-specific error occurred while establishing a connection to SQL srever. The server was not found or was not accessible...... Error: 53)I tried to ping the endpoint in command window, but get timeout response.What could be the issue? Is it because the "outbound security group"? do I need to set up a outbound rule? Or it is some firewall block the connection?Please help. Thanks so muchFollowComment"

Answer: "0Hi,Are you following the Tutorial at this link?https://aws.amazon.com/getting-started/tutorials/create-microsoft-sql-db/My initial guess is that you may have skipped Step e. "Configure advanced settings", where you may have left the 'Public accessiblity' setting at the default "No", instead of setting it to "Yes".To start troubleshooting, please answer the questions below..- Is your Microsoft SQL server Studio running on a computer at home/work (as opposed to in an EC2 instance in the same VPC)?- Got to Services->RDS, Click on Databases, then click on the link for your SQL Server DB identifier.  Under Security, does Public accessibility say 'Yes'?-  In the same section, click on the the VPC security groups link. After the Security Group is displayed, click on Inbound tab.  Do you see an entry with:MS SQL   TCP     1433     0.0.0.0/0Note: you do NOT need to add an Outbound rule for your Security group. Security groups are stateful, meaning that if you allow the connection to be established coming into the server, the Security Group will allow the traffic to flow back to the originating client without an explicit Security Group Outbound Rule.-randyCommentShareRandyTakeshitaanswered 4 years ago"


Question: Putty network fatal error: Connection timed out

"I downloaded putty and connected it with aws ec2 a few days ago. I installed a lot of important data as well. But recently I am not able to connect to putty. How can I bring back the connection to putty without the loss of data? Also, I saw that the status check on ec2 management console is showing the error 1/2 checks passed and it is also showing that there is an error in instance status checks. Restarting the laptop also doesn’t work. What should I do so that my data is not lost and putty also starts working again??FollowComment"

Answer: "1Hi , This is not related to putty issue, as you can see status check failed, you will not able to connect.Please refer below documents for troubleshootinghttps://aws.amazon.com/premiumsupport/knowledge-center/ec2-windows-instance-status-check-fail/https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-status-check-failure/CommentSharesouravanswered a year ago"


Question: Ubuntu desktop resolution doesn't fit to Screen

"Hello there,I have implemented Nice DCV 2022.1 (r13300) Server on AWS EC2 Ubuntu-20.04.4 LTS with GNOME desktop. In DCV Server, I'm using console session. I have installed and configured Xdummy server to allows the X Server to run with a virtual frame buffer.Whenever, I connect to DCV session using browser or DCV Client, the desktop resolution doesn't fit to Screen. Even DCV display resolution is configured with adapt automatically.However, When I click Full screen on DCV tool bar, its extending and desktop is fit to screen.But normally its not fit to screen. I don't know what I was missing. I need to scaling the display resolution when I connect dcv session from browser or Dcv Client.Can any one please help me to resolve this case? I have attached screenshot to refer.FollowComment"

Answer: "-2Thanks for posting!This is expected behavior for DCV console session on Linux servers without GPU. With XDummy, you could add or change the list of supported resolutions by following the instructions here: https://docs.aws.amazon.com/dcv/latest/adminguide/setting-up-installing-linux-prereq.html#linux-prereq-nongpuThe reason that DCV scales up to fill the screen in full screen mode but not in regular window mode is probably because the full screen resolution is one of the specified resolutions on that list.Hope this helps!CommentShareAWS-Reyanswered 9 months agorePost-User-4311920 9 months agoHello,Just I had a look at the AWS AppStream2.0 with AmazonLinux. They are using DCV Console session in AWS AppStream. But linux desktop is fit to screen. If possible here, then we can do the same things in NiceDCV console session? Can you please share the Xdummy configuration for Scaling DCV screen resolution?Share"


Question: Customising the Customer Profile

I there a way to add another attribute to the customer profile that appears in the CCP ?I see in the examples of the schema there is an Attribute object for holding misc values but cannot see where these can be set.I am using the CTR model and S3FollowComment

Answer: 0You can indeed build unified profiles with different sets of data and ingest this to Customer Profiles for Amazon Connect.This Blog walks you through the process of ingesting transaction data into customer profiles as a custom ProfileObjectType.CommentSharefaddianswered a year agoEXPERTAWS-samfredreviewed 2 months ago


Question: How do we turn off SMPP delivery message when using Pinpoint and SNS for 2 way SMS?

"We are using AWS pinpoint and SNS to enabled 2 way sms.  AWS Lex is used and it connects with AWS Pinpoint.However when a user replies to our origination number , they get smpp delivery receipt. This completely spoils the chatbot experience we have built.how do we turn off the SMPP delivery message for the orignation number assigned to us? Here is an example of the message the user gets every time they reply to a message - "id:4a65e3f2-a090-11ec-814b-002655e85434 sub:001 dlvrd:001 submit date:1646930242 done date:220310163722 stat:DELIVRD err:000 text:-"FollowComment"


Question: AD Connector DNS not in AD

"Hello,I am looking at getting an AD connector setup to be able to login to workspace with AD credentials, as well as all of the governance around the system.The DNS servers that we have are appliances, not integrated into Active Directory.As such the DNS service does not run on the domain controllers.Could I point to the appliance that is running DNS to get domain resolution, it will then also connect to one of the 10 DC's that I have.Thanks,MattEdited by: Mattridd on Jul 6, 2020 5:48 AMFollowComment"

Answer: "0Yes, that will work.  The DNS servers do not need to be domain controllers.  They just need to be able to resolve all of the domain's DNS records.  This doc lists a couple of the DNS records that are used by the AD Connector dc locator process.https://docs.aws.amazon.com/directoryservice/latest/admin-guide/prereq_connector.htmlCommentShareJoeD_AWSanswered 3 years ago"


Question: Certificate associated with Cloudfront does not resolve to an IP

"Hello,I have created a subdomain certificate for one of my domains (e.g cdn.example.com) that are hosted through Route53 and then associated it with a Cloudfront distribution successfully. AWS Certificate manager shows my certificate as valid. However, if I check the cdn.example.com in any SSL validator it tells me "cdn.example.com doesn't resolve to any IP". I have a similar setup for many other domains and all certificates work fine.Did anyone have any experience in something similar?Thank you very muchFollowComment"

Answer: 0I figured out that I forgot to add the CNAME record from CDN domain name to cloudfront distribution.CommentShareathosferaseanswered 4 years ago


Question: Redshift cluster size best practice

Is there a recommendation on the cluster size topology for Redshift?From previous experience a 2 node cluster is not recommended as you would not get the benefit of distributed computing unless you have a minimum of 3 node.My question is the following:Is a 2 node cluster totaling 1TB of memory and similar CPU the equivalent in performance with a 3 node cluster with similar total memory and CPU.Has anyone done any testing and can share some best practice in terms of cluster topology for redshift?FollowComment

Answer: 0Accepted AnswerHere is a youtube video where this topic is covered at 43:15 minute mark.re:Invent 2018 - Redshift Best Practices - ANT401CommentShareEXPERTTony-AWSanswered 4 years ago


Question: App settings: Email notifications problem

"Hi,I can't add notifications email notifications to one of my accounts although it works for the other account.I enter my email and select the release/production branch, click save, then remains on: Notification creation : in progress...Wait... 5 mins, 10 mins, 20 mins, nothing...Any ideas?NikFollowComment"

Answer: "0Hi Nik,Thanks for contacting us about your issue.Can you send an email to aws-amplify-customer@amazon.com with the AppId and account information you're having issues with?Thanks,Samuelnm-awsCommentShareAWS-User-8737467answered 4 years ago0Hi Samuel,Sorry for the late reply, I hit the reply limits when I was trying to post.Eventually I found out the problem was due to having a slash '/' in the repository branch I was attempting to register the notification for.Kind RegardsNikCommentShareniklonganswered 4 years ago"


Question: Issue with activating Server 2016

I have an instance running Server 2016 Datacenter OS with SQL Web.It is up and running fine however I would like a copy of it in a new account.I created an AMI of the machine and shared it with another account.On the new account I created a new instance with the shared AMI and got it up and running however Windows is complaining about activation.Usually I have corrected this issue in other accounts with other AMIs by running:C:\ProgramData\Amazon\EC2-Windows\Launch\Scripts\InitializeInstance.ps1; cscript "${env:SYSTEMROOT}\system32\slmgr.vbs" /atoorslmgr.vbs /ckmsslmgr.vbs /skms 169.254.169.254:1688slmgr /atohowever when I try with this vm I always end up with message that no KMS could be contacted.It is a fresh instance in a fresh account with fresh default VPC etc. I can connect to the internet fine from it.I have opened outgoing 1688 in windows firewall and the security group has nothing outgoing being blocked at all.I can nslookup the KMS' IP and get a response from 169.254.169.254When it fails to contact the KMS the Windows Application Error Log says:License Activation (slui.exe) failed with the following error code:hr=0xC004F074Command-line arguments:RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=21c56779-b449-4d20-adfc-eece0e1ad74b;NotificationInterval=1440;Trigger=UserLogon;SessionId=7I have tried restarting several times and made sure all windows updates were installed.If I type in: http://169.254.169.254/latest/meta-data/into a web browser on the local machine I get a list of attributes displayed in the web browser:ami-idami-launch-indexami-manifest-pathblock-device-mapping/events/hibernation/hostnameiam/identity-credentials/instance-actioninstance-idinstance-life-cycleinstance-typelocal-hostnamelocal-ipv4macmetrics/network/placement/profilepublic-hostnamepublic-ipv4public-keys/reservation-idsecurity-groupsservices/So it seems like I can reach the KMS however Windows still does not want to activate.I am using DHCP IP for the local address and the stock VPC config. No changes to it at all.When I nslookup other KMS servers like 169.254.169.250 I get "non-existant domain" in the results so I am pretty sure I should be trying to use 169.254.169.254 as it is the only one that seems to respond.I have tried re-entering the license number using the KMS license number from the AWS site for Server 2016 Datacenter CB7KF-BWN84-R7R2Y-793K2-8XDDG  and then running through the process again A-Z with no luckI am running in Ohio us-east-2b.I then tried running the systems manager "Automation"  "AWSSupport-ActivateWindowsWithAmazonLicense" however it fails at step 1 with "property value from the API output is empty. Desired values: ['windows'].. "I tried running it logged in as root and as an "Admin" user I created in IAM. I also tried changing setting for "AutomationAssumeRole" giving it full access to SSM but that did not seem to make any difference as trying to run with logged in users permissions.I also tried copying the PS commands from step3 of the automation and running it manually in PS as admin user with admin privilege's and it didnt do anything (was a stab in the dark).Has anyone else had this issue when creating a new VM from a shared AMI running Server 2016?Any insight would be appreciated.FollowComment

Answer: 0what I ended up having to do to get windows to activate was create a new instance server 2016 sql web with fresh amazon ami and then turn it off.then i detached the drive from it and replaced it with the drives from my instance that would not activate. then in elavted PS:slmgr.vbs /skms 169.254.169.251:1688slmgr /atoto activate.CommentShareGiminianswered 3 years ago


Question: Auto Scaling Group with User Data Not working with cfn-signal

"I have an Auto Scaling Group provisioned by SAM (Serverless Application Model) which is similar to Cloud Formation, which provisions Windows EC2 instances. I have User Data being executed as powershell scripts. Sometimes some scripts fail. If the PS scripts fail as part of User Data Execution, I want to roll back the stack. For that, I understand there is cfn-init and cfn-signal. I have the following code in the CloudFormation AutoScalingGroup template. MyASG:     Type: AWS::AutoScaling::AutoScalingGroup     CreationPolicy:       ResourceSignal:         Count: 2         Timeout: PT15M     UpdatePolicy:       AutoScalingRollingUpdate:         MinInstancesInService: '1'         MaxBatchSize: '1'         PauseTime: PT12M5S         WaitOnResourceSignals: true         SuspendProcesses:           - HealthCheck           - ReplaceUnhealthy           - AZRebalance           - AlarmNotification           - ScheduledActionsIn my UserData, I have the following lines.`  UserData:Fn::Base64:!Sub |<powershell># START LOG.$LASTEXITCODE=0$ErrorActionPreference = "Stop"cfn-init.exe -v --stack ${AWS::StackName} --resource MyASG --region ${AWS::Region}cfn-signal.exe -e **%ERRORLEVEL% **--stack ${AWS::StackName}  --resource MyASG --region ${AWS::Region}$timestamp = Get-Date -Format yyyyMMdd-hhmmStart-Transcript -Path $logpath -Force          #  DOWNLOAD FILES          write "Downloading files from S3 bucket"          Get-S3Object -BucketName $bucketName -KeyPrefix ${myS3Path}/ | Read-S3Object -Folder "C:\"          #  CALL Custom Exe to execute some PS scripts          write "running command '.\custom.exe           .\custom.exe "config.yml" --region "${AWS::Region}"          if ( $LASTEXITCODE -ne 0 ) { write-error "Custom exe exit code '$LASTEXITCODE' does not indicate success. Refer to logs for details." }                      </powershell>  `In the above PS code, if I use %ERRORLEVEL% in cfn-signal, it always returns 0 success signals, even when there are no errors (verified the userdataexecution.log), whereas if I use 0 in place of %ERRORLEVEL%, it always returns 2 of 2 success signals, even when there are errors. I am confused on how to use this whole thing or get this working or achieve this functionality. Any help will be appreciated.FollowComment"


Question: What are the benefits when I run a Glue job inside VPC?

"I am having a Glue job and without VPC, the job work fine. However, I want to ask:What is the benefits if I move it to be inside a VPC?If I continue use the job outside VPC, will I face security issues such as leak data, etc.?Thank you so much!FollowComment"

Answer: "1Accepted AnswerHi. That's a great question.If you run a job outside of a VPC, the job potentially has direct access to the internet, and a rouge engineer could write code that would write data to some endpoint on the internet that is outside of your organization. There are various ways to address this risk, but one of them is to ensure the job runs on a VPC where you control all data egress.The other common reason to use a VPC endpoint with your Glue jobs is to enable access to other resources in your VPC (like RDS servers if you need to ingest data from those), or resources on your corporate network (if you have a connection between your VPC and your corporate network).See the IAM Policies that Control Settings Using Condition Keys in the AWS Glue documentation at the following link. This includes an example of how you can use an IAM policy to ensure that only Glue jobs that have a specific VPC connection are able to be created.https://docs.aws.amazon.com/glue/latest/dg/using-identity-based-policies.htmlAll the best with your AWS Glue data engineering!CommentShareGareth_Eanswered a year agoEXPERTFabrizio@AWSreviewed a year agoYen Trinh a year agoThank you so much for your answer.Share"


Question: Fetching Device Position @ Midnight Daily

"Part of our application needs to track the current location of a device every day at midnight with AWS Location. The tracking needs to be based off the devices local timezone.My first though was to have the backend get the devices position daily. But if we used this approach, we would need to do this EVERYTIME its midnight somewhere in the world. This could get expensive quick and does not seem a great approach, both from a user and system efficiency perspective.The other option I though of was having the devices attached to a tracker, but again it does not seem like I configure this to only track location at midnight. So again creates significant additional noise.Does any one have any suggestions or additional methods of doing this?Thanks! Greatly appreciated!FollowComment"

Answer: "0Hi Andy,Hope that I understood your requirements correctly. If you need to be able to get all device positions from when it was last midnight in their own timezone you could:Create a single tracker, tracker name "MidnightTracker".Every device should send a position update on midnight (local timezone), and this position update should go to the "MidnightTracker".Position updates from other times should go to other trackers.Then if you call ListDevicePositions with "MidnightTracker" it will only fetch positions for midnight.If I misunderstood your intention, please share some more details (such as when are devices sending position updates, when are you fetching positions, do you need to know which timezone the device was from etc).I'd be happy to take another look and propose something else.OrenCommentShareAWS-User-7918543answered a year ago"


Question: Difference between ARN and uri

I seem to be confused regarding arn and uri in aws. A s3 object have both arn and uri . so what's difference between ARN and URI ? And also what roles do they play ?FollowComment

Answer: "1Accepted AnswerI hope I can shed a little light into this topic.The Amazon Resource Name (ARN) is used to uniquely identify AWS resources. A Uniform Resource Identifier (URI) provides a name to an accessible resource.In S3, the URI is a resource identifier within the context of the S3 protocol. It is used for API access to said files. There is some more details regarding this here on an already answered post.In a summary of the differences, an ARN is used within the AWS Cloud infrastructure to identify/access resources, while the URI is used externally identify/access these resources via APIs.CommentSharetim-ivanchukanswered 2 months agoEXPERTkentradreviewed 2 months ago"


Question: "What to do to include details of the target, whose health checks failed, in the mail notification? (Lambda, SNS)"

"Backend API applications could be running on an EC2 instance, a PaaS like Elastic Beanstalk or even a container runtime platform like ECS. As you might already be aware, we configure the Target Groups with the application's health check endpoint, and allow the Load Balancer to determine the health with certain threshold parameters. We are able to run the health check periodically and send out an email ONLY when the check does not pass.  Now, what do I do to include details of the target, whose health checks failed, in the mail?and is there a way to do it  completely through console?FollowComment"

Answer: "0Accepted AnswerSet CloudWatch alarms to alarm when health checks exceed thresholds.Triggered by the alarm, Lambda executes "describe_target_health" to retrieve those with "unhealthy" status.How about sending that information from Lambda to SNS for email notification?Reference Documents:https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/elbv2/client/describe_target_health.htmlhttps://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sns/client/publish.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months agorushikes-3r 2 months agoThanks, I am getting some idea. And is there a way for it to do it  completely through consoleShareRiku_Kobayashi EXPERT2 months agoIt is not possible to configure this setting using only the management console.The use of Lambda will be mandatory.If this answer has led to a solution, please approve the answer for the betterment of the community.Sharerushikes-3r 2 months agoThank you.Share"


Question: Is it possible to transfer Jupyter notebook instance to a different region?

"While learning about Deep Racer, I have by mistake chosen region as Oregon. It appears that Deep Racer will work only on N.Virginia.Is it possible to transfer this notebook instance to N.Virginia or do I need to start fresh with N.Virginia.FollowComment"

Answer: "1Accepted AnswerHi! I'm afraid you will have to set up a new instance in another region. You can download your Jupyter Notebooks and import them in the new instance.CommentShareDani Manswered 10 months ago0Amazon SageMaker Notebook instances are managed instances that at this time you cannot move between regions. However, you can copy your data between notebooks using S3. To do this, select your notebook instance on the screen you showed, it will take you to a detailed view. In that view you will see a section called Permissions and encryption, the section has a link to the IAM policy of the notebook. Follow that link to IAM, and ensure that your notebook has access to an S3 bucket. You will have to create a bucket before granting access.To do this follow the instructions here. Provide permissions in IAM, as defined here.Once your Notebook role has access to the bucket you specify, you can launch your notebook and copy all your files to that bucket as follows. Open the Notebook, by pressing Open Jupyter. From the dropdown on the top right of the Jupyter environment select New followed by Terminal in the dropdown. You can then use the AWS command line to copy the files, specifically aws s3 cp. To do this from the terminal:aws s3 cp . s3://[your bucket name] --recursiveThis will copy all your files to the S3 bucket. Then in your new bucket located in us-east-1, setup the notebook with the same S3 permissions, and copy the files from S3 back to your new instance using the following command:aws s3 cp s3://[your bucket name] . --recursiveOnce you have copied all the files, you can delete the old notebook.CommentShareJason_Nanswered 10 months ago"