Question: EC2 Instance type results in reachability failure

"I have a r5.24xlarge instance with Windows 2016 + SQL Server 2017. All working good. Shut it down, changed instance type to x2iedn.8xlarge, started instance and now cannot reach instance. Instance status check shows "Instance reachability check failed". System status check passed. Instance screenshot shows Windows logon screen...What could be wrong? How do I troubleshoot this?FollowComment"

Answer: "0Hi TherePlease take a look at this troubleshooting article that talks about issues when upgrading drivers or changing instance types.Here is documentation about the compatibility of different instance types and AMI's.Since the instance screenshot shows the Windows logon screen, it sounds like the network card is not coming up.  You can try switching back to the R5 instance type and follow steps 1, 2, and 3 from this guide to update all of the required drivers, and then try switching instance types again.CommentShareEXPERTMatt-Banswered 4 months agorePost-User-4349426 4 months agoThanks for suggestions Matt// TTTTT... I tried the above; but the moment I install/upgrade the ENA on old instance type (Part 2 of https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/migrating-latest-types.html), I am disconnected from instance and the instance becomes unreachable.Share0Failure to check the status of an instance indicates that the instance may have the following problemsNetwork or startup configuration problemsExhausted memoryFile system problemsOperating system startup failureVolumes not mounted properlyIncompatible driversExhausted CPUhttps://aws.amazon.com/jp/premiumsupport/knowledge-center/ec2-windows-instance-status-check-fail/Troubleshooting for EC2 Windows instances can be found below.https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/troubleshooting-windows-instances.htmlCommentShareTTTT1234answered 4 months ago"


Question: Gradle can't find AWS libraries

"I'm new to using the AWS SDK and SQS both. According to the docs, I added the following to my build.gradle.// AWS  implementation platform('com.amazonaws:aws-java-sdk-bom:1.11.X')  implementation 'com.amazonaws:aws-java-sdk-sqs'  But when I re-import in IntelliJ, I get the following errors:Could not find com.amazonaws:aws-java-sdk-bom:1.11.X.Required by:project :Possible solution:Declare repository providing the artifact, see the documentation at https://docs.gradle.org/current/userguide/declaring_repositories.htmlCould not find com.amazonaws:aws-java-sdk-sqs:.Required by:project :Possible solution:Declare repository providing the artifact, see the documentation at https://docs.gradle.org/current/userguide/declaring_repositories.htmlHere's my dependencies section. I think MavenCentral should be enough.repositories {mavenCentral()// for heavyweight software dependenciesflatDir {dirs 'libs'}// Spock snapshots are available from the Sonatype OSS snapshot repositorymaven { url "https://oss.sonatype.org/content/repositories/snapshots/" }}Please hit me up with any feedback.Thanks.Edited by: lexaholic on Oct 12, 2020 8:34 AMFollowComment"

Answer: 0I simply changed it to:implementation 'com.amazonaws:aws-java-sdk-sqs:1.11.+'and it appears to be working fine.CommentSharelexaholicanswered 3 years ago


Question: Complex lag windows function help needed

"Im racking my brain about how to do this and I dont think its possible but not sure what to even search for. So the below is a subset of the data (using example numbers)I am trying to use the lag function to populate the flag column.   Status                             Flag   Connected -> Exiting               Maillink   Exiting -> Not equal to Connected  OnCorp ( All rows stay OnCorp until                                       we see Connected)   Connected -> Reconnecting          Mailink (It should stay Mailink for                                       all rows until we see "Exiting"                                       status )Is it possible in Sql?Using lag function in case statement to compare previous state is causing errorSample DataSql Code (But erroring out ) -:      WITH base as (                  select o.computername,                         o.currentuser,                         o.datetime,                         message,                         CASE                             WHEN                                     LEN(split_part(substring(split_part(message, 'STATE', 2), 13), ',', 1)) <> 0                                 THEN split_part(substring(split_part(message, 'STATE', 2), 13), ',', 1)                             WHEN  (message like 'WARNING%' OR message like 'OpenVPN%') THEN 'Start'                             WHEN message = 'SIGTERM[hard,] received, process exiting' THEN 'Exit1'                             WHEN message = 'Closing TUN/TAP interface' THEN 'Exit2'                             ELSE 'NO Status' END                                                                                State1,                         CASE WHEN State1 = 'Start' THEN 1                              WHEN State1 = 'RESOLVE' THEN 2                              WHEN State1 = 'WAIT' THEN 3                              WHEN State1 = 'AUTH' THEN 4                              WHEN State1 = 'GET_CONFIG' THEN 5                              WHEN State1 = 'ASSIGN_IP' THEN 6                              WHEN State1 = 'ADD_ROUTES' THEN 7                              WHEN State1 = 'CONNECTED' THEN 8                              WHEN State1 = 'EXITING' THEN 9                         END orderofoperation                          --row_number() over (partition by o.computername,o.currentuser,DATE(o.datetime) order by o.computername,o.currentuser,o.datetime) as rownumber                  from maillink_openvpn_logs_ext_schema.open_vpn_filtered o                  where o.message != 'message'                   and currentuser = 'wuellie'                  --and State1 in  ('EXITING' ,'OpenVPN','RESOLVE','WAIT','AUTH','ASSIGN_IP','GET_CONFIG','ADD_ROUTES')                  order by o.datetime,orderofoperation    )select final.*,  case when final.previous_record_state is null then ‘oncorp’ when final.currentstate = ‘CONNECTED’ then ‘maillink’ when final.previous_record_state is not null and final.previous_record_state not in (‘CONNECTED’)     then lag(flag) partition by computername,currentuser, nextstateddatetime ::DATE order by nextstateddatetime when previous_record_state in (‘EXITING’) and lag(flag) partition by computername,currentuser, nextstateddatetime ::DATE  order by nextstateddatetime = ‘maillink’ then ‘oncorp’         else  lag(flag) partition by computername,currentuser, nextstateddatetime ::DATE  order by nextstateddatetime         end as flagfrom(select b.computername,b.currentuser,b.State1 currentstate,b.datetime,       lag(State1) over (partition by b.computername,b.currentuser,(b.datetime) ::DATE  order by b.computername,b.currentuser, (b.datetime) ::TIMESTAMP,orderofoperation) as  previous_record_state       --lag(datetime) over (partition by b.computername,b.currentuser,b.datetime ::DATE order by b.computername,b.currentuser, (b.datetime) ::TIMESTAMP,orderofoperation) as nextdatetimefrom base border by b.datetime,orderofoperation)final    Computername      username    State       datetime                 onCorp/mailink         xyx              ads       start       2022-07-06T06:45:51         ONCORP                      xyx              ads       RESOLVE     2022-07-06T07:06:45         ONCORP                       xyx              ads       WAIT        2022-07-06T07:06:45         ONCORP          xyx              ads      AUTH         2022-07-06T07:07:00         ONCORP             xyx              ads     GET_CONFIG    2022-07-06T07:07:00         ONCORP              xyx              ads     ADD_ROUTES    2022-07-06T07:07:01         ONCORP          xyx              ads      CONNECTED    2022-07-06T07:07:01         MAILINK           xyx              ads       EXITING     2022-07-06T07:07:01         MAILINK           xyx              ads       RESOLVE     2022-07-06T07:07:46         ONCORP         xyx              ads       WAIT        2022-07-06T07:07:46         ONCORP         xyx              ads       AUTH        2022-07-06T07:07:50         ONCORP         xyx              ads    GET_CONFIG     2022-07-06T07:07:51         ONCORP         xyx              ads    ADD_ROUTES     2022-07-06T07:07:51         ONCORP         xyx              ads    CONNECTED      2022-07-06T07:07:52         MAILINK         xyx              ads    RECONNECTED    2022-07-06T07:08:01         MAILINK         xyx              ads      WAIT         2022-07-06T07:08:02         MAILINK         xyx              ads      AUTH         2022-07-06T07:08:09         MAILINK         xyx              ads    RECONNECTED    2022-07-06T07:08:10         MAILINK         xyx              ads    CONNECTED      2022-07-06T07:08:15         MAILINK         xyx              ads    RECONNECTED    2022-07-06T07:08:20         MAILINK         xyx              ads    CONNECTED      2022-07-06T07:09:01         MAILINK         xyx              ads    EXITING        2022-07-06T07:10:50         MAILINK         xyx              ads     START         2022-07-06T07:11:50          ONCORPFollowComment"


Question: How can organization accounts be accessed programmatically?

"I want to create accounts in an organization programmatically and once created, I would like to programmatically manage resources within the account. How can this be done without having to use the AWS Console to switch accounts or reset the password? Can I use the AWS API SDK with an access key from the organization account to target the sub account?FollowCommentAWS-User-3835952 a year agoAfter creating an account within an organization I'd like to create an IAM user with programatic access without having to switch roles or reset the password. Would prefer to do everything through the SDK.Share"

Answer: "0Accepted AnswerFigured out that I can use the AWS Security Token Service to assume the role of the account in the organization and before the actions I requireCommentShareAWS-User-3835952answered a year ago0Yes, you can accomplish these tasks using the AWS SDK.You could take a look at this AWS Bootstrap Kit example repository on GitHub. This repository contains examples of using the AWS Bootstrap Kit to set your development and deployment environment on AWS. You can get an impression how such centralized account and resource management could be accomplished.Using AWS CDK, this example shows you how to create and manage a complete AWS Organization (including multiple accounts). You can also explore how to manage the resources in those accounts using the IaC approach - by deploying CDK constructs into various accounts of the organization. This is one possible approach.You can also call the AWS API directly to achieve the same results, but the best practice is to use an IaC approach, for example with AWS CloudFormation or AWs CDK.Essentially, the target accounts you want to manage must allow the central (root) account to do so. You do this by configuring the corresponding IAM roles in the target accounts and assuming them when managing the resources. The Bootstrap Kit example mentioned above shows you how to achieve that using AWS CDK.CommentShareDmitry Balabanovanswered a year agoAWS-User-3835952 a year agoAre there any examples of how to do this using the SDK? These accounts will be created on demand for customer workloads so I'd rather manage the process myself using the SDK.Share"


Question: Inconsistent multiple Cost and Usage Report created

"Hi AWS and AWS users,I am creating CUR(Cost and Usage Report) with the following configurationsDefault contentRefresh automaticallyReport data time granularity : HourlyReport versioning : Create new report versionwith the settings above, I was expecting a single report containing hourly logs to be created when AWS refreshes the CUR(up to 3 times a day).However I am receiving multiple CUR in my bucket such as20230312T081141ZMyCostReport-00001.csv.gz (55.6 MB)MyCostReport-00002.csv.gz (3.6 MB)MyCostReport-00003.csv.gz (1.9 KB)20230314T152624ZMyCostReport-00001.csv.gz (58.3 MB)MyCostReport-00002.csv.gz (58.2 MB)MyCostReport-00003.csv.gz (4.4 MB)MyCostReport-00004.csv.gz (1.9 KB)To sum up, I'd like to ask whyMultiple CURs are created (with such different sizes)Numbers of CURs created are inconsistent (sometimes 3, sometimes 4)I'd appreciate any help possible with the issue.Thank you.FollowComment"

Answer: "0HelloYou can see explanation on CUR files in the documentation here https://docs.aws.amazon.com/cur/latest/userguide/understanding-report-versions.htmlIf the update includes a large file, AWS might split it into multiple files. size can vary between days, depending on your account(s) activityCommentShareAWS-yl-lfcanswered 3 months ago"


Question: How can I access/include "sessionIdentifier" in non-reserved mqtt topics with AWS IoT Core?

"I need to access the "sessionIdentifier" in a regular topic, but cannot figure out how to include or access that in my lambda function that is mapped to the topic via event bridge/SQL as below:      Events:        UserTickedTTLRule:          Type: 'IoTRule'          Properties:            AwsIotSqlVersion: '2016-03-23'            Sql: !Sub "SELECT * FROM 'chat/+/ttl'"How can I have "sessionIdentifier" included in the payload for a regular topic like this in my lambda function? Or how can I access it?FollowCommentMassimilianoAWS EXPERTa month agoWhat do you mean by sesssionIdentifier? Is this something you are adding to the message you are sending?Shareborg 22 days ago@MassimilanoAWS it is a per-connection identifier that is included in all AWS Iot lifecycle events (https://docs.aws.amazon.com/iot/latest/developerguide/life-cycle-events.html - search "sessionIdentifier"). I am using it to track per-connection sessions on the application side of my architecture via dynamodb.Shareborg 22 days agoThe problem is I have no way to access it outside a lifecycle event, and because aws does not include PING response as a lifecycle event, I need that identifier for building my own reconnection handling via a regular topic that my devices/clients publish a message to on a periodic basis, before keep-alive, in order to progressively delay the TTL for the dynamodb session record.Shareborg 22 days agoThis is different than client_id, which is a session-level id used for device connection, I am looking for a connection-level id, e.g. if a client goes stale and does a keep-alive, it would get a new connection-level id, which from what i've figured out is what the sessionIdentifier is/does. This will allow me to build a mechanism to auto-cleanup dynamodb records per-connection if they never phone home (keep-alive). When they keep-alive happens they get a new sessionIdentifier (connection id) but same client_id (session id). Can email to discuss further.Share"


Question: Oracle Glue crawler is not adding table to database

"Hi,I'm trying to setup an integration between Oracle and MySql via Glue. While the Sql crawlers I created have added tables into the Glue database, the Oracle crawler does not. Run is successful and log saysBENCHMARK : Finished writing to CatalogWhat am I doing wrong?FollowComment"

Answer: "0Hi,Have you specified the right SID  in the JDBC url ?CommentShareMelfanianswered a month ago0Can you give more details? In glue documentation it's mentioned to use the following rule:"Oracle Database and MySQL don’t support schema in the path; instead, enter MyDatabase/% "So for example, try:Servicename/% on the Include path inside your crawler.CommentSharerePost-User-5256747answered 22 days ago"


Question: Is there any way to create and access game data bundles and items that do not bounds to user? Shared bundles

"Hi there. Is there any way to create some sort of shared game bundle and items that can be accessible across all users? Let's say I want to store the info about our game title, game season title, default round length etc. and I want to read it when launching the game using gamekit. How can it be implemented at the moment? User bundles works great and provided sample helped a lot, but it would be nice to know how can I read some sort of global game data. Thanks a lot.FollowComment"

Answer: "0Hi,Thank you for sharing this use case. Currently, there is no such mechanism in-place today. We will keep this under consideration for upcoming feature updates.CommentShareAWS-User-0209180answered a year ago"


Question: How to fix duplicate transactional email issue caused by multiple EC2 instances?

"A business guy's description: customers get multiple email notifications about the same transaction.Developer's description: We have a problem with the load balancer and scheduled cron jobs in the Elastic Beanstalk ".ebextensions"-folder. When the load balancer scales in, there are multiple EC2 - instances and every instance executes cron jobs defined in the .ebextensions - folder of the project. That causes problems with the notification email delivery and our clients can receive multiple notifications -> sent email count is the same as the number of active instances. We've already tried scale in protection and "leader_only" = true definition for commands, but those are not working.What should we do to fix this problem correctly?FollowComment"

Answer: "2The "cloud native" way of doing this is to use a queue.It's not detailed in the question but my guess here is that there is a single submission to the application which is intended to cause a single email email notification. But the submission is (probably) stored in a database somewhere and when all of the instances run their cron jobs they all pick up the job out of the database and all send emails.Instead: Have the submission of the job create a message in SQS and have the email notification system retrieve it from SQS. Even if there are multiple instances running the notification code only one of them will ever receive the SQS message - that's how the service is designed.CommentShareEXPERTBrettski-AWSanswered 9 months agoEXPERTChris_Greviewed 9 months ago1Hello,Brettskis SQS Solution is probably the correct and more robust solution at scale. However, it could be a bit lite over-engineer for such an easy task.Just create an endpoint in your service for "notifications" (the same function that your cron job triggered), then have a cron job in cloud watch event bridge trigger it using SNS, or go via a private lambda if it's a private endpoint. TThis way, only one request will be sent even if you have multiple EC2s, and it's easy to test and trigger add hoc "notifications". And you won't have to spend money on SQS pooling (keep in mind that SQS pooling blooks one thread in your machine).Hope this helps!//CarlCommentShareCarl Ostrandanswered 9 months agoBrettski-AWS EXPERT9 months agoGiven that SQS is free for the first million requests per month if this is a small-scale application then costs isn't going to be an issue. I run this exact solution for a personal website because it is inexpensive and it's really easy to engineer. Many AWS services are there to solve problems small and large. And SQS polling only blocks for the long polling period specified by the caller.Share"


Question: AWS Workspaces - moving between OUs

We are using AWS Workspaces  with AD connector and would like to test moving Workspaces between OUs.I believe moving a Widows Workspace VM from the OU that it was deployed to initially should not affect the Workspace in any way from the point of AWS as OU parameter is only used for the initial deployment.Is this a correct assumption?FollowComment

Answer: "3Accepted AnswerYou are correct, moving the computer object is alright to do.  After moving the computer object to the new OU it will of course start receiving the GPOs for the new OU.  Just don't rename the computer and you should be fine.CommentShareNormanswered a year ago"


Question: Athena encountering internal error multiple times

I've tried multiple times to run a query with some changes from time to time but Athena encountered an internal error in all these cases. The last query I ran that had this error has an ID of: 01446e90-c179-46c6-a619-7a57a880555e.Please help.FollowCommentalatech EXPERT2 months agoPlease provide the query you tried to executeShare

Answer: "0Even if you share the query ID with me, I can't check it on re:PostPlease share the actual query you executed.CommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: Remove external identity from Cognito user

We have an existing userpool with standard Cognito users.  At some point we enable a external SAML identity provider for a group of users.  When the existing users go to login a new user is created by Cognito and linking the external identity provider.  We want to keep using the same Cognito user so we update the external provider on the original Cognito user record.  But since there is a matching one on this new Cognito user we still get the new user rather than the original.I have tried using the AdminDisableProviderForUser api call with both ProviderAttributeName=Cognito_Subject and ProviderAttributeName=Cognito.  But they both indicate that the Account is not linked to anyone.Is the ProviderAttributeName different for the linking that Cognito automatically creates for users?I think I can just disable that new user to solve this but I would rather not introduce code that would allow disabling of users.FollowComment

Answer: "1Hello,I understand from your use case here that you would like to maintain a single profile in Cognito User Pool for users signing in using external IDPsWhen users in cognito sign in using external IDP, a new user profile is created for them in User Pool. This creates two separate profiles for users who signed up using Cognito but afterwards signed in using external idp.For maintaining a central identity for user, we need to use adminLinkProviderForUser API [1] call. It links an existing user account in a user pool (DestinationUser) to an identity from an external identity provider (SourceUser) based on a specified attribute name and value from the external identity provider. In order to maintain single central record for the user, we need to know the userid for the external provider and link to the existing user.DestinationUser parameter: DestinationUser can be a native User Pool user or a federated user (for example, a SAML or Facebook user). The ProviderName will be Cognito for native users. For a native user, the ProviderAttributeName will be Username and the ProviderAttributeValue will be the actual username in the user pool. For a federated user, it will be the provider-specific user_id.SourceUser parameter: For social identity providers like Facebook, Google or Amazon the ProviderName will be Facebook , Google or LoginWithAmazon. The ProviderAttributeName will be Cognito_Subject and the ProviderAttributeValue for the user can be the same value as the id, sub or user_id value found in the social identity provider token. For SAML identity providers, the ProviderName will be the exact name identifier given to the identity provider in the Cognito User pool IdP configuration. (e.g., "Auth0", "Okta", “AzureAD”, "mySamlProviderName" etc.) The ProviderAttributeName can be any value that matches a claim in the SAML assertion. If you set ProviderAttributeName to Cognito_Subject , Cognito will automatically parse the default unique identifier found in the subject from the SAML token.Note - We cannot pass native user as the SourceUser in the above CLI command. If we try to do that that, we will receieve the following error:An error occurred (InvalidParameterException) when calling the AdminLinkProviderForUser operation: SourceProviderName must match a Provider that is configured for the User Pool====== Draw back of using Pre Signup Lambda trigger =======In order to link users to an existing identity with Google provider, we use adminLinkProviderForUser in Pre Signup Lambda trigger. However, while attempting to do so we face an issue where we need to provide the user_id for the external provider’s user prior hand itself and need to make the flow work.During the Pre Signup Lambda trigger, the identity for external provider is yet to be created in the User Pool. The Lambda receives the user id within the event under username. The username for Google provider will be in format “Google_103228613216140529882” where the user id is the string “103228613216140529882” from the username. If we attempt to link the provider in this case, it eventually results in two login attempts for the user.When we use external provider like Google, it creates a unique identity in the User Pool. This unique identity contains the user_id and the same identity is referred for subsequent logins. Since we want to maintain a single record, we need to delete the user created for external provider while noting down the user id. This user id should be then used for linking the existing user in Cognito.====== Leveraging Post confirmation Trigger =======Please note that when we use external provider for the first time to sign in, Cognito actually signs up the user. Thus, the first attempt to sign in for external provider is always a Signup process in Cognito. As the user is signed up, it also requires confirmation and is auto confirmed by Cognito.Hence, instead of using pre sign up trigger, we can leverage Post confirmation Lambda trigger[2] in this case. The Post confirmation trigger will be only triggered when the user gets confirmed.The Post confirmation trigger will be only triggered when the user gets confirmed.The Lambda pseudo code that needs to be followed is as below :The Lambda extracts the userid from the username received in the event parameter.The external provider user is deleted from the User Pool with API call here [3] with the help of username.We then perform admin link provider [4] operation using the extracted user id.  #you will need to implement logic to find existing user through list user[5]Below I am providing you with the tested python code in my test environment (For external IdP like Google Federation) for Lambda for reference of single profile maintenance :Note - Please make sure your Lambda's IAM Role has IAM permissions to be able to call Admin delete user and Admin link provider for Cognito API calls.import boto3def lambda_handler(event, context):    # TODO implement    client = boto3.client('cognito-idp')        print (event['userName'])           idname = str(event['userName']).split('_')[1]    print(idname)        response= client.admin_delete_user(    UserPoolId='us-east-1_2XXXXXXXX9',    Username= str(event['userName']) )            #print (response)            response = client.admin_link_provider_for_user(    UserPoolId='us-east-1_2XXXXXXXX9',    DestinationUser={        'ProviderName': 'Cognito',        'ProviderAttributeName': 'username',        'ProviderAttributeValue': 'googleUser'    },    SourceUser={        'ProviderName': 'Google',        'ProviderAttributeName': 'Cognito_Subject',        'ProviderAttributeValue': idname    })        #print (event)    return event========= Additional Testing with SAML provider ========Also, I created an AzureAD SAML integration with my userpool and noticed that the username looked like below -  "azuread_kXXXXX@yaXXXXXXX.onmicrosoft.com" where the user id was instead "kXXXXX@yaXXXXXXX.onmicrosoft.com", hence in the code I made the below changes. At the end the Cognito Native user was linked with the SAML IdP external User while maintaining one single profile in Cognito Userpool user directory.Code snippet change -     response = client.admin_link_provider_for_user(    UserPoolId='us-east-1_2XXXXXXXX9',    DestinationUser={        'ProviderName': 'Cognito',        'ProviderAttributeName': 'Username',        'ProviderAttributeValue': 'test3'    },    SourceUser={        'ProviderName': 'AzureAD',        'ProviderAttributeName': 'Cognito_Subject',        'ProviderAttributeValue': idname    })    Cognito Native User status after linking -Users - test3Account StatusEnabled / CONFIRMEDSMS MFA StatusDisabledLast ModifiedJun 30, 2022 1:18:02 PMCreatedJun 30, 2022 1:05:21 PMsub7XXXXXX-6XXXXXXXXXXXXXXXXXXca94a7identities[{"userId":"kXXXXX@yaXXXXXXX.onmicrosoft.com","providerName":"AzureAD","providerType":"SAML","issuer":null,"primary":false,"dateCreated":1656594967158},email_verifiedfalseemailXXXXXXXXXXXXXXXXXXXXXXXID Token received after federation - {  "at_hash": "SXXXXXXXXXXXXXQ",  "sub": "7XXXXXX-6XXXXXXXXXXXXXXXXXXca94a7",  "email_verified": false,  "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_2XXXXXXXX9",  "cognito:username": "test3",  "nonce": "xyq6tkMXXXXXXXXXDT8jyqECQh5YpPUKOEbPpdMrlQ",  "aud": "1XXXXXXXXXXXXXXXs",  "identities": [    {      "userId": "kXXXXX@yaXXXXXXX.onmicrosoft.com",      "providerName": "AzureAD",      "providerType": "SAML",      "issuer": null,      "primary": "false",      "dateCreated": "1656594967158"    },  ....  ....Here you can see the linked identities under section “Identities" - Once you have linked native User Pool user to external Azure AD user, when the external user logs into the Cognito User Pool a separate user with Account Status EXTERNAL_PROVIDER will not be created. Instead the external federated user will be linked to the native user account based on the specified attribute name and value from the external identity provider.Thus by leveraging Post confirmation trigger and admin link provider user API we can maintain central identity for the user.Finally, in regards to AdminDisableProviderForUser, Cognito User Pool provides this API  to help remove the link between an existing user account in an User Pool and an external identity provider user account. The next time the external user (no longer attached to the previously linked DestinationUser) signs in, they must create a new user accountNow, in order to delink the Azure AD identity from the existing user account in an User Pool you can use the following CLI command:aws cognito-idp admin-disable-provider-for-user --user-pool-id us-east-1_G1VobxXXX --user ProviderName=AzureAD,ProviderAttributeName=Cognito_Subject,ProviderAttributeValue=admin@xyz.comNote - The ProviderName, ProviderAttributeName and ProviderAttributeValue must be the same values that were used for the SourceUser when the identities were originally linked using AdminLinkProviderForUser API call.If the suggestions above do not assist you with your use case, we might need to troubleshoot based on your configurations. Could you please create a support case instead so we may discuss details on your resource configurations?Please do not post any sensitive information over re:Post since this is a public platform.As always, feel free to reach back with any further questions or concerns in the meantime!References:[1] https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminLinkProviderForUser.html[2] https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-post-confirmation.html[3] https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/admin-delete-user.html[4] https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/admin-link-provider-for-user.html[5] https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/list-users.htmlCommentShareSUPPORT ENGINEERYash_Canswered a year agorePost-User-3191797 8 months agoHey Yash! Thank you for a potential workaround from having to use the PreSignUp trigger. I stumbled upon this blog post because of the issue involving AdminLinkProviderForUser with the PreSignUp trigger. However, I cannot seem to get your approach to work. From what I understand, the end of the oauth flow will result in a code (authorization code) or a token (implicit grant). However, how will we be able to exchange the code for JWT tokens or use the token if the external provider user is deleted? The resulting code gives me an 'invalid code' error and the token gives me a 'user not found' error.Share"


Question: How to increase index.max_result_window on Elasticsearch?

"I am using AWS lambda function to save response in S3 bucket. I am able to save response size upto 10000. But, when increased beyond 10000 I end up getting the error - Result window is too large, from + size must be less than or equal to: [10000] but was [25000]. I am unable to increase the limit of the index max result window size greater than 10000. How do I proceed with the issue?FollowComment"

Answer: 0Use this below for reference:curl -XPUT "http://localhost:9200/my_index_name_here/_settings" -d '{ "index" : { "max_result_window" : 450000 } }' -H "Content-Type: application/json"CommentShareDwayneWhiteanswered a year ago


Question: Pulling docker image from ECR using task definition

"Hi, Im trying to setup my web app manually because I dont want to dive straight into Infrastructure as code or tools, if possible I want to know and play around with the AWS components.I have this EC2:https://preview.redd.it/twvyd2988sw71.png?width=2346&format=png&auto=webp&s=95b4fd078f951876008fefc00718e25cd6562661https://preview.redd.it/pp7yw4ma9sw71.png?width=2324&format=png&auto=webp&s=5793c19df39598c82e674e1f153acdff2705de84And put it inside my ECS cluster:https://preview.redd.it/kyxkldwh8sw71.png?width=2362&format=png&auto=webp&s=393cfc53e4d2c61e14f416025b2ad3e5bdc5beecI have this postgresql RDS:https://preview.redd.it/j6qy6a9s8sw71.png?width=2282&format=png&auto=webp&s=0c97237d6952bccc0d83cbb4b27666462b02dc94This is the security group I set up for ec2 to connect to rds:https://preview.redd.it/ehlynue49sw71.png?width=2308&format=png&auto=webp&s=5c8afa220bf94bea48f158b441484ecd24078184I have set up a task definition to pull docker image from my ECR:https://preview.redd.it/uh41nlui9sw71.png?width=1704&format=png&auto=webp&s=71644541501c4d9fd949c454323ccb9307e3d9cbhttps://preview.redd.it/2zl2680m9sw71.png?width=2374&format=png&auto=webp&s=ed8a1268221025b17850a8ebf4621e81db4c563dhttps://preview.redd.it/1q6b6zhr9sw71.png?width=2372&format=png&auto=webp&s=1220c9cc9728180a7c2af329361c85765cde419bI have run the task definition on my cluster but it always fail at the step to connect to the RDS database:https://preview.redd.it/05ecxwtpasw71.png?width=2310&format=png&auto=webp&s=f061ccbaf246d924431c7aaf7b40d8b603c6fa1bI have telnet and psql to that address from EC2 terminal and it is successful. Why am I not able to run docker image from task definition? I think it pulled from ECR correctly but when running the docker image, it is not able to connect to the db. ThanksUpdate: I changed network setting of the task to awsvpc instead of bridge, and set it to security group of my EC2. It keeps running with no logs. I dont know what is happening, whether the web app is deployed or not.FollowComment"

Answer: 0Turns out I look at the wrong ec2CommentSharethatmirroranswered 2 years ago


Question: Use WAF Captcha for the webapps hosted in amplify

"Our react based webapp is hosted in amplify web hosting. How do we enable the WAF Captcha for these apps.By reading few docs, I understand that we can add WAF on top of cloudfront distributions and api gateway and ALB. But I didn't see any references on WAF + Amplify hosting.Any recommendation on this will be super helpful ?FollowComment"

Answer: 0Accepted AnswerAmplify does not currently support direct integration with AWS WAF.A GitHub issue has already been opened regarding this feature request. Please see this link for more information: https://github.com/aws-amplify/amplify-hosting/issues/36 with some workarounds provided by other users.There is also an AWS sample in GitHub that talks about enabling WAF for Amplify Hosted web applications by using custom CloudFront distribution. You can refer to this link for details: https://github.com/aws-samples/aws-cdk-amplify-with-waf.CommentSharejoahnaanswered a month ago


Question: Dismissing a contact from the ccp without ending it

"I'm trying to dismiss active contacts from a user's ccp. StopContact does this and it works fine for task contacts. However, using it for chat contacts will completely close the chat instead of sending it to the disconnect flow.Is there any way to dismiss an active contact from the ccp and send it to the disconnect flow?FollowComment"

Answer: "0Accepted AnswerYou can use Stream API (custom CCP) to end the contact normally so Disconnect flow can be activated.connection.destroy()https://github.com/amazon-connect/amazon-connect-streams/blob/master/Documentation.mdCommentShareClarenceChoianswered 11 days agolkrimphove 7 days agoThank you for your input. I decided to follow this approach as it seems that there is no other way.I send a custom message (wanted it to be an json payload, but I can't get it to work with boto3 and json) to the agent. My custom CCP then checks all messages in the onMessage event and and triggers connection.destroy().Share"


Question: EKS pods get node IP address instead of IP from Calico IP Pool

"Hello,in order to take advantage of higher pod density along with network policies we removed AWS VPC CNI add-on (aws-node) and rely on Calico CNI add-on (calico-node) for pod network management.  After removing aws-node daemonset and terminating EKS worker nodes,  new nodes were created by ASG and all pods scheduled.My question, while most pods scheduled on the new nodes have been assigned IP address from Calico IP pool, as expected, a number of pods,  mostly daemonset pods, have been assigned the same IP as the node IP.Any help with this will be highly appreciated.JSFollowComment"

Answer: "0Accepted AnswerCan you inspect and see if the pod spec has hostNetwork set to true?CommentShareJason_Sanswered a year agoAWS-User-JS a year agoJason_S,thanks for that.  hostNetwork spec is set to true in pods with node IP, indeed.Obviously I'm new to AWS EKS and CNI in general.  I guess hostNetwork is set to true on purpose, for example,  calico-node pods require direct access to host network ?ShareJason_S a year agoThis is due to a limitation of EKS (Unable to deploy Calico to control plane nodes), you can refer here https://projectcalico.docs.tigera.io/getting-started/kubernetes/managed-public-cloud/eks.Generally speaking hostNetwork is a bad idea from a security point of view and only trusted pods should have it enabled (even that is not recommended).ShareJason_S a year agoAdditionally, not sure what pod density you are concerned about. For performance and reliability perspective we strongly discourage you from exceeding the limit such as in here https://github.com/awslabs/amazon-eks-ami/blob/master/files/eni-max-pods.txt.However if it's an ENI imposed limit (i.e. # of ENIs attached to the instance) you can refer to the following blogpost - https://aws.amazon.com/blogs/containers/amazon-vpc-cni-increases-pods-per-node-limits/ShareAWS-User-JS a year agoJason_S,many thanks for excellent answer.  That helps a lot.  Much appreciated.Share"


Question: Getting error message: The intent named 'IntentName' in bot 'BotName' is not allow listed for explicit next actions. Remove any explicit next actions from the intent and try your request again.

"I suddenly started getting an error when I try to Build a LexBot that's been working previously. I made a small change to the custom Payload response that should not have affected performance of the bot.The message I'm getting is: "The intent named 'IntentName' in bot 'BotName' is not allow listed for explicit next actions. Remove any explicit next actions from the intent and try your request again."I removed the Intent and re-added it and it worked until I added a Custom Payload. Once I added the custom payload, I continue to get the error, even if I remove the Custom Payload from the intent and just go back to a single text response.I haven't made any other changes to the Lex bot or to IAM permissions or to any other intent.I've searched high and low in the documentation as well as on Google at large and I can't find anything to point me in the direction of what to correct. I can't even find an inkling of where to modify or remove any explicit next actions from the intent.FollowCommentAaron Shipley 10 months agoI think this note may have something to do with the situation.NoteOn August 17, 2022, Amazon Lex V2 released a change to the way conversations aremanaged with the user. This change gives you more control over the path that the usertakes through the conversation. For more information, see Understanding conversation flowmanagement (p. 18). Bots created before August 17, 2022 do not support dialog code hookmessages, setting values, configuring next steps, and adding conditions.Share"

Answer: "0Hi Aaron,In your case, the best path forward is to delete the impacted intent and recreate a new intent with same settings. Also, we have deployed a fix to console and this problem should not occur again.Sorry about the churn and we hope this unblocks your development.CommentShareSaketanswered 10 months agoEXPERTChris_Greviewed 9 months ago"


Question: S3 Preflight and IAM

HelloWe are in the process of converting our Public buckets to Private buckets.  As part of our due diligence we are reviewing our logs for unauthenticated S3 access now that all our code changes are complete.We are seeing many S3 PREFLIGHT requests (REST.OPTIONS.PREFLIGHT) which I understand are related to the browser validating CORS.  I looked at the IAM documentation and I do no see any reference to Preflight which leads me to believe Preflight does NOT require authentication and will work the same whether or not the S3 bucket is Public or Private.Is that correct?  Will making our buckets Private break Preflight?Thank you!FollowComment

Answer: "0HelloThat's correct.   preflight (OPTIONS) does not require authentication and will work the same whether or not the S3 bucket is Public or Private.Amazon S3 supports cross-origin resource sharing (CORS) by enabling you to add a cors subresource on a bucket. When a browser sends this preflight request, Amazon S3 responds by evaluating the rules that are defined in the cors configuration.  If cors is not enabled on the bucket, then Amazon S3 returns a 403 Forbidden response.https://docs.aws.amazon.com/AmazonS3/latest/API/RESTOPTIONSobject.htmlIf you put CORS policy in the S3 bucket even the bucket is a private, using the example here https://docs.aws.amazon.com/AmazonS3/latest/userguide/ManageCorsUsing.htmlA browser can send this preflight request to Amazon S3 to determine if it can send an actual request with the specific origin, HTTP method, and headers.S3 bucket name: mybucket[{"AllowedHeaders": ["*"],"AllowedMethods": ["PUT","POST","DELETE","GET"],"AllowedOrigins": ["http://www.example.com"],"ExposeHeaders": ["x-amz-server-side-encryption","x-amz-request-id","x-amz-id-2"],"MaxAgeSeconds": 3000}]curl -v https://mybucket.region.amazonaws.com/example.txt -X OPTIONS -H "Access-Control-Request-Method:GET" -H "Origin:http://www.example.com"one will get the< HTTP/1.1 200 OK< Access-Control-Allow-Origin: *< Access-Control-Allow-Methods: PUT, POST, DELETE, GET< Access-Control-Expose-Headers: x-amz-server-side-encryption, x-amz-request-id, x-amz-id-2< Access-Control-Max-Age: 3000< Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method< Server: AmazonS3Regards!CommentShareAWS-User-6819265answered a year ago"


Question: I wanted to launch a new update to my web app I ended up changing the operating system on my EC2

"Hello everyone,I have a webapp on production and here are my configs:OS is Amazon Linux 2Backend hosted in my EC2 with a CodeDeploy pipeline between AWS and GithubI have an elastic IP AddressWebapp has a website and a mobile appFrontend is hosted in another EC2 instanceI have a script in my backend that does the automation of the build and deployment each time I push to GitHubI wanted to do some minor changes to my backend but I could not due to glibc as shown in the image bellowhttps://preview.redd.it/3wmkhably83a1.png?width=1537&format=png&auto=webp&s=7c1a34ef09598482dd628ed93715a6b5eddf6353After research I found out that Amazon Linux 2 does not update the libraries that are needed by node as shown in this link:https://repost.aws/questions/QUrXOioL46RcCnFGyELJWKLw/glibc-2-27-on-amazon-linux-2Now I am thinking of installing a new OS in my EC2 and I do not quite see all risks that might affect my clients.Any suggestions ?FollowComment"


Question: How do I setup a multi-stage API using Lambda Aliases in a VPC?

"I am trying to setup an API in AWS using Lambda functions, but I am finding it way more difficult than I expected. We have setup some one-off APIs with no problem, but setting up a more robust API with multiple versions seems to be beyond my understanding.I would like to create a single Lambda function with multiple aliases (development, sandbox, production). Each alias should use a different configuration for databases, notifications, etc. I have built my configuration information using AWS AppConfig, so if I can set an environment variable for each alias I should be able to retrieve the correct configuration information.We want the same url to be used for each Lambda alias (https://api.mydomain.com/development, https://api.mydomain.com/sandbox, https://api.mydomain.com/production).The Lambda functions need to be in a VPC so that we can connect to the VPC's resources.Does anyone have any guidance or an example somewhere?Thanks.Richard SargentFollowComment"

Answer: "0Hi Richard,As you know, A Lambda version is a snapshot of the $LATEST version of a Lambda function[1]. Since it is a snapshot, we are not able to edit the code or any configuration which includes the environment variables. On the other hand, an Alias is simply a pointer to a particular Lambda version[2].In order to achieve your desired setup, you would have to create three separate versions of your $LATEST Lambda function. Each version will have the desired configuration and environment variables for its intended environment. For example:On the $LATEST Lambda function, go to the "Configuration" Tab and provide the Environment variables for the development environmentCreate a new version for this Lambda functionCreate a "development" alias and point it to the version in #2.You will then need to go back to the $LATEST version and repeat this process 2 more times for your sandbox and productions environments.Now we have 3 aliases pointing to 3 different version with different environment variables which you can point your API to.If you need to make any codes changes then you will need to make sure that the above process is done again and to point the existing alias to the newly created versions.Aliases and versions should behave the same whether the Lambda is configured for VPC or not. The VPC settings are also taken in the version snapshot so each of version/alias combination can have different VPC settings.I hope this information helps. Please let me know if you have any other questions.References:https://docs.aws.amazon.com/lambda/latest/dg/configuration-versions.html https://docs.aws.amazon.com/lambda/latest/dg/configuration-aliases.htmlCommentShareSUPPORT ENGINEERRyan_Aanswered a year ago0Hi Ryan,Thanks for the response.I do understand Lambda aliases and versioning and have been using them for other projects. The problem lies in pointing an API stage to a particular alias. As far as I can tell, there is no good way of accomplishing this in a generic way.There is a way to point a method (or the ANY method) to a Lambda alias, but it appears that the entire ARN of the Lambda alias needs to be included in the Lambda Function field as opposed to just name:alias. In addition, although there is supposed to be a way of using stage variables to invoke a particular Lambda alias (arn:aws:lambda:<region>:<account>:function:<name>:${stageVariables.lambdaAlias}), I have not been able to get the security to work. Since there is no way to see the security associated with resources, it is hard to troubleshoot. There is also no way to see what resources have been published, so troubleshooting is almost impossible.I would suggest that the API Gateway page be redesigned with visibility in mind.Thanks.Richard SargentCommentShareAWS-User-5163325answered a year ago"


Question: Cropping a video for specific time

How to crop a video for a specific time interval. Let's suppose there a 10 minute video I want to crop from 2:50 - 6:00.FollowComment

Answer: "1Hi there,Just wanted to confirm use the use of the term cropping here.MediaConvert supports input clipping [1]. Where you can specify a section of video that you would like to include in your output. You can find this option by clicking on Create Job -> Under Inputs click Input 1 -> and under Input clips, click the 'Add input clip'. From there you would put your clipping region there. So for your example of 2:50 - 6:00 it would be 00:02:50:00 as the Start timecode and 00:06:00:00 as the End timecode. Keep in mind that our timecode syntax is HH:MM:SS:FF (Hours:Minutes:Seconds:Frames) from non-drop frame timecode or HH:MM:SS;FF (Hours:Minutes:Seconds;Frames) for drop frame timecode.Please keep in mind this is based on timecode of the input file. If you know the file has embedded timecode, make sure to set Timecode source appropriately.You also have the option  of starting at 0 (which we will ignore any embedded timecode on the input) or specify start time (which we would use that as the start time of the input file and any input related feature, like input clipping, would follow)We also support the concept of cropping video (per input, or per output), this feature is used when wanting to remove letter boxing or other sections of the video..however this happens for the duration of the file, there is no way to specify a time frame for this.Thanks,Jeremy== Resources ==[1] https://docs.aws.amazon.com/mediaconvert/latest/ug/input-clipping-stitching.htmlCommentShareAWS-User-8506763answered 4 years ago"


Question: AWS SCT for conversion of SSIS Packages

How much costing to use SCT for SSIS Packages conversion in AWS ETL?FollowComment

Answer: 0AWS Schema Conversion tool (SCT)  is a client tool and is free of charge as indicated in the first FAQ answer.To check how to use SCT to convert SSIS please refer to the documentation here.hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year ago


Question: MWAA airflow Dags are not starting

"My Dags are getting stuck and when I checked the worker logs, I see a connection timeout error with sqs. Is this the reason for Dags not starting? How to resolve this issue? Appreciate your immediate help on this.botocore.exceptions.ConnectTimeoutError: Connect timeout on endpoint URL: "https://sqs.us-east-1.amazonaws.com/"FollowComment"

Answer: "0A question about the setup of your Amazon MWAA Environment, did you setup Amazon MWAA without Internet access?  This could also be referenced as Private Routing.Based around the connection time-out of the SQS service, it leads me to question if that VPC has access to the AWS services.https://docs.aws.amazon.com/mwaa/latest/userguide/vpc-vpe-create-access.htmlCommentShareCurtis_Danswered 10 months ago"


Question: Bastion Hosts and Transit Gateway in Multi-VPC environment

"A customer has a large number of VPCs with EC2 bastion hosts in each one.Is Transit Gateway a good solution to allow a much smaller number of bastion hosts to provide access to all the VPCs?Or are there any drawbacks to this approach?The number of VPCs has grown recently and spending on bastion hosts is now a fairly significant line item by itself. The customer would obviously like to reduce spend on bastions.Longer term, the customer is evaluating alternatives like AppStream or System Manager.FollowComment"

Answer: "1Accepted AnswerHere are some considerations:If you already have a Transit Gateway connecting all the VPCs, this is probably a good idea because you can consolidate the bastion fleet and you can also improve the security posture in most VPCs by eliminating IGWs or tightening up security group rules. (For example, don't allow inbound ssh anymore except on the one remaining bastion VPC.)If you do not already have a Transit Gateway connecting the VPCs, then you need to weigh the costs of each solution in terms of both dollars and complexity:Cost: If you don't already have a transit gateway, you will have to pay an additional hourly cost for each VPC attachment. This would likely be the biggest cost so you can weigh the cost of bastion instances against the attachment. For example, if you used 3 t2.micro hosts per VPC as bastion hosts, you can't save any money with TGW because the transit gateway attachment costs more than that. OTOH, if you use big bastion hosts or your fleet is large, it's quite easy.Complexity: If you don't already have a Transit Gateway, you'll have to weigh the setup costs of of the Transit Gateway (creating attachments and adding routes) against the setup costs of setting up and running bastion hosts. It's likely that running hosts is a lot more work than the TGW setup but neither option is zero-touch.CommentShareAWS-User-5309376answered 4 years ago"


Question: CloudTrail event guardduty.amazonaws.com : GetRemainingFreeTrialDays not readOnly

"I'm working on analyzing CloudTrail events as they come in and when I was setting up a filter ( ignore events that are readOnly ) I was surpised to see the above events coming through. is that something that should be marked as readOnly or is it doing something I'm not aware of? Thanks...{"eventVersion" : "1.08","eventTime" : "2023-04-21T14:33:23Z","eventSource" : "guardduty.amazonaws.com","eventName" : "GetRemainingFreeTrialDays","requestParameters" : {"detectorId" : "","accountIds" : [ "", "****" ]},"readOnly" : false,"eventType" : "AwsApiCall","managementEvent" : true,"eventCategory" : "Management"}FollowComment"

Answer: "0The readOnly field in a CloudTrail event is a Boolean value that indicates whether the API call made was a read-only operation or not. In the case of the event you provided, the readOnly field is set to false, which means that the API call was not a read-only operation.However, not all API calls are marked as read-only, even if they don't modify any resources. The AWS API is designed to be flexible, and some API calls may not fit neatly into the read-only or write category. For example, the GetRemainingFreeTrialDays API call you provided may not modify any resources, but it still provides information about the account's free trial, which could be considered a non-read-only operation.It's generally a good practice to filter out CloudTrail events that are read-only, as they are less likely to be associated with security issues. However, as you have noticed, not all events that don't modify resources are marked as read-only. So, it's important to use your judgement and take into account the specific API being called and the context in which it's being used.CommentShareManuanswered a month agolarryjkl a month agoI think I agree with most of this, but probably not the conclusion in this case. An API call often either affects a change to data or system state  or something or it doesn't. But I can imagine there are some cases that are a bit fuzzier. But in this case, I'm not sure how that can apply since it is a "get" request and I can't see what data or system state would be changing because of it.But, it's not a big deal in any way, just seems confusing.Share"


Question: InvalidJobIdException

"Hi,I´m trying to use the textract async features and I´m getting an error that I don't understand. When I use the syncronus functions everything works fine, but for the async functions I get a InvalidJobIdException.My code:import boto3, sys, re, jsonimport pandas as pdfrom pandas.io.json import json_normalizeimport trp.trp2 as t2# find S3Bucket and S3Key for invoice filesS3Bucket = "Bucketname"S3key = "knime/Prüfprotokoll 0050-0035_image0.png"textract = boto3.client(aws_access_key_id="KeyId", aws_secret_access_key="Secret", service_name='textract', region_name='eu-central-1')class TextractWrapper:    """Encapsulates Textract functions."""    def __init__(self, textract_client, s3_resource, sqs_resource):        """        :param textract_client: A Boto3 Textract client.        :param s3_resource: A Boto3 Amazon S3 resource.        :param sqs_resource: A Boto3 Amazon SQS resource.        """        self.textract_client = textract_client        self.s3_resource = s3_resource        self.sqs_resource = sqs_resource    def start_detection_job(            self, bucket_name, document_file_name, sns_topic_arn, sns_role_arn):        """        Starts an asynchronous job to detect text elements in an image stored in an        Amazon S3 bucket. Textract publishes a notification to the specified Amazon SNS        topic when the job completes.        The image must be in PNG, JPG, or PDF format.        :param bucket_name: The name of the Amazon S3 bucket that contains the image.        :param document_file_name: The name of the document image stored in Amazon S3.        :param sns_topic_arn: The Amazon Resource Name (ARN) of an Amazon SNS topic                              where the job completion notification is published.        :param sns_role_arn: The ARN of an AWS Identity and Access Management (IAM)                             role that can be assumed by Textract and grants permission                             to publish to the Amazon SNS topic.        :return: The ID of the job.        """        try:            response = self.textract_client.start_document_text_detection(                DocumentLocation={                    'S3Object': {'Bucket': bucket_name, 'Name': document_file_name}},                NotificationChannel={                    'SNSTopicArn': sns_topic_arn, 'RoleArn': sns_role_arn})            job_id = response['JobId']            logger.info(                "Started text detection job %s on %s.", job_id, document_file_name)        except ClientError:            logger.exception("Couldn't detect text in %s.", document_file_name)            raise        else:            return job_id            def get_analysis_job(self, job_id):        """        Gets data for a previously started detection job that includes additional        elements.        :param job_id: The ID of the job to retrieve.        :return: The job data, including a list of blocks that describe elements                 detected in the image.        """        try:            response = self.textract_client.get_document_analysis(                JobId=job_id)            job_status = response['JobStatus']            logger.info("Job %s status is %s.", job_id, job_status)        except ClientError:            logger.exception("Couldn't get data for job %s.", job_id)            raise        else:            return responsehallo = TextractWrapper(textract, S3Bucket, "asd")hallo.start_detection_job(S3Bucket, S3key, "arn:aws:sns:eu-central-1:11111:MyTopic", "arn:aws:iam::1111:role/TextTractRolePaul")This code works fine and I get a JobID For example 'd8e8b13285a9e4494a95774bd0c525a5486e12691e26848da5c58536d425ea70'But when I callresponse_async = hallo.get_analysis_job('d8e8b13285a9e4494a95774bd0c525a5486e12691e26848da5c58536d425ea70')I get the Expection: InvalidJobIdException: An error occurred (InvalidJobIdException) when calling the GetDocumentAnalysis operation: Request has invalid Job IdIt doesn't matter how long I wait.I followed the following guide to setup Textract für Async analysis: https://docs.aws.amazon.com/textract/latest/dg/api-async-roles.htmlAny Pointers were I go wrong, or what I should check?Kind regards,PaulFollowComment"

Answer: "1Hello,I see that you are using "start_document_text_detection" API, to get the results for this you will need to use "get_document_text_detection" API.Similarly for "start_document_text_detection" you will have to use "get_document_analysis". Using these APIs interchangeably is not possible.CommentShareSUPPORT ENGINEERShashank Vanswered 11 days agoKshitij Patil SUPPORT ENGINEER11 days agoHi Shashank,You have pointed this out perfectly. I was able to solve the issue following your answer here for one of my customers. Thank you.Share0Hey Paul!Just to confirm, when you make the call are you using the following call format?response = client.get_document_analysis(    JobId='string',    MaxResults=123,    NextToken='string')CommentShareDani Manswered a year ago0Hi Dani,yes I do.Best regards,PaulCommentSharegoodvirusanswered a year ago"


Question: DNS TXT record not propagating

"Hi there,I added a TXT and SPF record to a existing domain we have as a hosted zone in Route 53, it has been over 48 hours and the record is still not visible on the internet.I've checked this on MXToolbox.com and by looking up against google DNSThe TTL is 3600, but it's a new record so this shouldn't matter?To add the record i simply used the "Create Record Set" selected TXT as type, added the details then went "Save Record Set"Why has it not replicated yet?Thank youFollowComment"

Answer: "0Hi,This typically happens when you have two or more hosted zones that have the same name, and the hosted zone that you updated is not the hosted zone that the domain registration is configured to use. Here's how you check:Get the names of the name servers your domain registration is using. See "Adding or Changing Name Servers or Glue Records" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.html#domain-name-servers-glue-records-procedureDetermine whether the name servers that you got in step 1 are the same as the name servers for the hosted zone that you added the record to. See "Getting the Name Servers for a Public Hosted Zone":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlMy guess is that they don't match, and that you added the TXT and SPF records to the wrong hosted zone. Rather than update the domain registration to use the name servers in the hosted zone that you updated, I recommend that you add the TXT and SPF records to the hosted zone that your domain registration is using. This is because adding records to a hosted zone takes effect almost immediately. Changing the name servers for a domain registration can take up to two days to take effect. For an explanation of why, see "How Amazon Route 53 Routes Traffic for Your Domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/welcome-dns-service.html#welcome-dns-service-how-route-53-routes-trafficScottCommentShareEXPERTAWS-User-6179575answered 3 years ago0Hi Scott,Thanks for replying, so the DNS servers listed in the hosted zone are:NSns-1809.awsdns-34.co.uk.ns-656.awsdns-18.net.ns-1490.awsdns-58.org.ns-248.awsdns-31.com.The DNS NS servers listed on nslookup the public web are:nameserver = ns-248.awsdns-31.comnameserver = ns-656.awsdns-18.netnameserver = ns-1490.awsdns-58.orgnameserver = ns-1809.awsdns-34.co.ukTo me they look correct?Still not propagated today?Thank youCommentShareDELTEngineeranswered 3 years ago0Hi,Another possibility is that you changed the name servers in the NS record to match the name servers in the domain registration. The name servers should instead match the name servers that Route 53 assigned to the hosted zone. Here's what to check:Get the names of the name servers your domain registration is using. See "Adding or Changing Name Servers or Glue Records" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.html#domain-name-servers-glue-records-procedureDisplay the settings for the NS record in the hosted zone, and compare those name servers with the name servers that you got in step 1. If they don't match, change the name servers in the NS record.If you include the domain name in your reply, I can check the settings.ScottCommentShareEXPERTAWS-User-6179575answered 3 years ago0Thank you for your answer, it came in handy when I encountered the same problem. Once I changed/glued the Nameservers, the propagation process took less than a minute.CommentSharedicksonoduoranswered 3 years ago0In my case, I was using @ on the left hand side.like @mydomain.comWhen I changed this to be empty, then the TXT record propogated OK.like   mydomain.domCommentShareSean Ryananswered 2 years ago0My problem was that I used LightSail. Therefore the DNS changes in Route53 didn't propagate. I needed to change the LightSail DNS records.CommentSharerePost-User-9356344answered 10 months ago"


Question: Amazon RDS for SQL Server Workshop - Question about the DB Instance creation

"Hello,I meet an issue when I follow the workshop to create the DB instance. (https://catalog.us-east-1.prod.workshops.aws/workshops/897acbd7-8f2e-46ed-8dcd-c97872d5b3ce/en-US/lab1/1-createdatabase)It is noticed : Start the pre-created instance.Before creating a new instance, let's start the workshop-saz-rds-sqlserver instance, which is currently in a Stopped state.The problem is , I have no pre-created db instance in my dashboard. Even in the YAML file I downloaded. the stack into CloudFormation is well in Completed sucess state.I can create a DB instance manually, but I have nothing in the secret Manager anyway.Maybe this pre-created instance came from another workshop ?Please advise.Many thx,Cheers,FollowComment"

Answer: "1I am sorry you are having issues with one of our workshop.I have reached out to the owner to clarify this. I will update here as soon as I have a response.Thanks for reporting.CommentShareEXPERTJonathan_Danswered a month ago1The instance is not automatically created to avoid unexpected charges for the users that decide to follow the workshop on their own account. You can follow Lab "Create a new RDS SQL Server" to create the Single AZ instance manually and follow through the lab to make it Highly Available and complete the rest of the lab using that instance.We will update the workshop note to clarify this as needed.Thanks!CommentShareEXPERTJonathan_Danswered a month ago0Hi,Thx for your feedback ! Really appreciated.I will do it manually so, then follow the HA through the lab.Cheers,CommentShareAnthony Thienpontanswered a month ago"


Question: Permissions not updating - Strange Symbolic links issue on Lightsail / WordPress

"When I launch a new instance on Amazon Lightsail for a WordPress website, I move the core WordPress files into a new folder under /opt/bitnami/wordpress/ named domainname.com, and do so for a couple virtual hosts.For some reason, the initial WordPress install has symbolic links for the wp-config file, and the wp-content files when I view the directory. This issue seems to prevent me from fixing permissions issues also. I usually update permissions with the following:sudo chown -R bitnami:daemon /opt/bitnami/wordpress/domain.comsudo find /opt/bitnami/wordpress/domain.com -type d -exec chmod 775 {} ;sudo find /opt/bitnami/wordpress/domain.com -type f -exec chmod 664 {} ;sudo chmod 640 /opt/bitnami/wordpress/domain.com/wp-config.phpBut this doesn't do anything on this initial WordPress install. Whenever I create additional virtual host directories for other websites, updating permissions works as expected, and I don't see these symbolic links.This issue is preventing me from updating plugins in the WP admin.Anyone with some info or help would be greatly appreciated on how to fix this problem. Thank you!FollowComment"

Answer: "2Accepted AnswerTo resolve the issue with the symbolic links in the initial WordPress install, you can try breaking the symbolic links and replacing them with the actual files. This can be done by executing the following commands:sudo rm /opt/bitnami/wordpress/domain.com/wp-config.phpsudo cp /opt/bitnami/wordpress/wp-config.php /opt/bitnami/wordpress/domain.com/wp-config.phpsudo rm -rf /opt/bitnami/wordpress/domain.com/wp-contentsudo cp -r /opt/bitnami/wordpress/wp-content /opt/bitnami/wordpress/domain.com/wp-contentThen, you can update the permissions with the commands you provided:sudo chown -R bitnami:daemon /opt/bitnami/wordpress/domain.comsudo find /opt/bitnami/wordpress/domain.com -type d -exec chmod 775 {} ;sudo find /opt/bitnami/wordpress/domain.com -type f -exec chmod 664 {} ;sudo chmod 640 /opt/bitnami/wordpress/domain.com/wp-config.phpThis should resolve the issue with the symbolic links and allow you to update plugins in the WP admin.CommentShareDivyam Chauhananswered 4 months agoBJSaws 4 months agoThat worked, thanks!Share"


Question: AWS DMS High Latency on Oracle CDC Source

"Hi,I'm having a high latency during the CDC on the source database. I would like to now if there is a way to tuning the configuration in order to decrease the latency or if there is anything else that I can do.Migration Task CDC metrics:Replication Instance metrics:My current configuration:Source endpoint configuration: Oracle{    "AddSupplementalLogging": true,    "ExtraArchivedLogDestIds": [],    "AllowSelectNestedTables": true,    "DatabaseName": "XXXXX",    "UseBFile": true,    "UseLogminerReader": false,    "SecretsManagerAccessRoleArn": "XXXXXX",    "SecretsManagerSecretId": "XXXXXXX"}Target endpoint configuration: Redshift{    "DatabaseName": "XXXXXX",    "DateFormat": "auto",    "MaxFileSize": 250000,    "TimeFormat": "auto",    "SecretsManagerAccessRoleArn": "XXXXXXX",    "SecretsManagerSecretId": "XXXXXXX"}Replication Instance:Instance class: dms.c5.9xlargeAllocated storage: 1.2TBMulti AZ: yesMigration Task:{    "Logging": {        "EnableLogging": true,        "EnableLogContext": false,        "LogComponents": [            {                "Severity": "LOGGER_SEVERITY_DEFAULT",                "Id": "TRANSFORMATION"            },            {                "Severity": "LOGGER_SEVERITY_INFO",                "Id": "SOURCE_UNLOAD"            },            {                "Severity": "LOGGER_SEVERITY_DEFAULT",                "Id": "IO"            },            {                "Severity": "LOGGER_SEVERITY_INFO",                "Id": "TARGET_LOAD"            },            {                "Severity": "LOGGER_SEVERITY_DEFAULT",                "Id": "PERFORMANCE"            },            {                "Severity": "LOGGER_SEVERITY_INFO",                "Id": "SOURCE_CAPTURE"            },            {                "Severity": "LOGGER_SEVERITY_DEFAULT",                "Id": "SORTER"            },            {                "Severity": "LOGGER_SEVERITY_DEFAULT",                "Id": "REST_SERVER"            },            {                "Severity": "LOGGER_SEVERITY_DEFAULT",                "Id": "VALIDATOR_EXT"            },            {                "Severity": "LOGGER_SEVERITY_INFO",                "Id": "TARGET_APPLY"            },            {                "Severity": "LOGGER_SEVERITY_INFO",                "Id": "TASK_MANAGER"            },            {                "Severity": "LOGGER_SEVERITY_DEFAULT",                "Id": "TABLES_MANAGER"            },            {                "Severity": "LOGGER_SEVERITY_DEFAULT",                "Id": "METADATA_MANAGER"            },            {                "Severity": "LOGGER_SEVERITY_DEFAULT",                "Id": "FILE_FACTORY"            },            {                "Severity": "LOGGER_SEVERITY_DEFAULT",                "Id": "COMMON"            },            {                "Severity": "LOGGER_SEVERITY_DEFAULT",                "Id": "ADDONS"            },            {                "Severity": "LOGGER_SEVERITY_DEFAULT",                "Id": "DATA_STRUCTURE"            },            {                "Severity": "LOGGER_SEVERITY_DEFAULT",                "Id": "COMMUNICATION"            },            {                "Severity": "LOGGER_SEVERITY_DEFAULT",                "Id": "FILE_TRANSFER"            }        ],        "CloudWatchLogGroup": "XXXXXX",        "CloudWatchLogStream": "XXXXXX"    },    "StreamBufferSettings": {        "StreamBufferCount": 3,        "CtrlStreamBufferSizeInMB": 5,        "StreamBufferSizeInMB": 8    },    "ErrorBehavior": {        "FailOnNoTablesCaptured": true,        "ApplyErrorUpdatePolicy": "LOG_ERROR",        "FailOnTransactionConsistencyBreached": false,        "RecoverableErrorThrottlingMax": 1800,        "DataErrorEscalationPolicy": "SUSPEND_TABLE",        "ApplyErrorEscalationCount": 0,        "RecoverableErrorStopRetryAfterThrottlingMax": true,        "RecoverableErrorThrottling": true,        "ApplyErrorFailOnTruncationDdl": false,        "DataTruncationErrorPolicy": "LOG_ERROR",        "ApplyErrorInsertPolicy": "LOG_ERROR",        "EventErrorPolicy": "IGNORE",        "ApplyErrorEscalationPolicy": "LOG_ERROR",        "RecoverableErrorCount": -1,        "DataErrorEscalationCount": 0,        "TableErrorEscalationPolicy": "STOP_TASK",        "RecoverableErrorInterval": 5,        "ApplyErrorDeletePolicy": "IGNORE_RECORD",        "TableErrorEscalationCount": 0,        "FullLoadIgnoreConflicts": true,        "DataErrorPolicy": "LOG_ERROR",        "TableErrorPolicy": "SUSPEND_TABLE"    },    "TTSettings": {        "TTS3Settings": null,        "TTRecordSettings": null,        "EnableTT": false    },    "FullLoadSettings": {        "CommitRate": 50000,        "StopTaskCachedChangesApplied": false,        "StopTaskCachedChangesNotApplied": false,        "MaxFullLoadSubTasks": 49,        "TransactionConsistencyTimeout": 600,        "CreatePkAfterFullLoad": true,        "TargetTablePrepMode": "TRUNCATE_BEFORE_LOAD"    },    "TargetMetadata": {        "ParallelApplyBufferSize": 1000,        "ParallelApplyQueuesPerThread": 0,        "ParallelApplyThreads": 8,        "TargetSchema": "",        "InlineLobMaxSize": 0,        "ParallelLoadQueuesPerThread": 0,        "SupportLobs": true,        "LobChunkSize": 0,        "TaskRecoveryTableEnabled": false,        "ParallelLoadThreads": 32,        "LobMaxSize": 32,        "BatchApplyEnabled": true,        "FullLobMode": false,        "LimitedSizeLobMode": true,        "LoadMaxFileSize": 0,        "ParallelLoadBufferSize": 1000    },    "BeforeImageSettings": null,    "ControlTablesSettings": {        "historyTimeslotInMinutes": 5,        "HistoryTimeslotInMinutes": 5,        "StatusTableEnabled": false,        "SuspendedTablesTableEnabled": false,        "HistoryTableEnabled": false,        "ControlSchema": "",        "FullLoadExceptionTableEnabled": false    },    "LoopbackPreventionSettings": null,    "CharacterSetSettings": null,    "FailTaskWhenCleanTaskResourceFailed": false,    "ChangeProcessingTuning": {        "StatementCacheSize": 50,        "CommitTimeout": 1,        "BatchApplyPreserveTransaction": true,        "BatchApplyTimeoutMin": 60,        "BatchSplitSize": 0,        "BatchApplyTimeoutMax": 60,        "MinTransactionSize": 1000,        "MemoryKeepTime": 60,        "BatchApplyMemoryLimit": 500,        "MemoryLimitTotal": 1024    },    "ChangeProcessingDdlHandlingPolicy": {        "HandleSourceTableDropped": true,        "HandleSourceTableTruncated": true,        "HandleSourceTableAltered": true    },    "PostProcessingRules": null}FollowComment"

Answer: "0Hi, Please check this blog post out for tuning Oracle DMS task configuration. https://aws.amazon.com/blogs/database/migrate-billions-of-records-from-an-oracle-data-warehouse-to-amazon-redshift-using-aws-dms/CommentShareKeerthi Maryadaanswered a month agoMarcus a month agoThanks for you response Keerthi, but most of the configuration is related to the full_load, I'm having problems with the ongoing changes (CDC). I tried the ASM endpoint configuration, but the AWS RDS doesn't support the ASM Feature for Oracle. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Oracle.Concepts.FeatureSupport.html#Oracle.Concepts.FeatureSupport.unsupportedShare"


Question: "If a client connects to the source server using the ipv6 address on the source server, how do I get the proxy server to proxy traffic for it?"

"The details are as follows.If by doing this it does enable clients connecting to the proxy to be proxied, but drops people outside the proxy.And I want to use a reverse proxy to take care of the server, not the client.I don't really want that, and if there is a ready-made example, it would be peer-to-peer, but I'm not sure how to deploy and implement it.Thanks for your answers.FollowComment"

Answer: "4if you are using Nginx as a proxy server, you can add the following lines to your Nginx configuration fileserver {    listen [::]:80 ipv6only=on; # Replace 80 with the desired port number    server_name your_ipv6_domain.com;    location / {        proxy_pass http://[source_server_ipv6_address];        proxy_set_header Host $host;        proxy_set_header X-Real-IP $remote_addr;        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;    }}if you explain your question more clearly i can give a better answer to youCommentShareEXPERTsedat_salmananswered a month agorePost-User-1933391 a month agoThe details are as follows.If by doing this it does enable clients connecting to the proxy to be proxied, but drops people outside the proxy.And I want to use a reverse proxy to take care of the server, not the client.I don't really want that, and if there is a ready-made example, it would be peer-to-peer, but I'm not sure how to deploy and implement it.Share"


Question: Can't deploy next js application

AccessDenied: Your account must be verified before you can add new CloudFront resources.FollowComment

Answer: "0Accepted AnswerChances are you have no more, or 0 distributions available on your account.This is typically be managed via the Service Quotas page, which you can find here (change the region to whatever is applicable in the url):https://us-east-1.console.aws.amazon.com/servicequotas/home/services/cloudfront/quotasYour maximum distributions can also be increased via a support ticket, but doing it through Service Quotas is usually faster.CommentSharekyageranswered 9 months ago"


Question: CSV file downloaded from QuickSight has extra single quotes when string starts with hyphens

"Hi,I'm creating a dashboard for operators to download the athena query results.The ID column values contain hyphens - andFor example, if table contains the following dataidname-xyzFirst examplea-b-cSecond exampleThe generated csv contains a extra single quote in the id column at the first row"id","name""'-xyz","First example""a-b-c","Second example"Is there any way to avoid it?FollowComment"

Answer: "0The single quote in front of the hyphen is intentional to escape the character when the file is opened using excel. If there is no single quote, the cell would have an error in excel when the data is opened. Here is a workaround if you don't want the single quote.Create a calculated field in QuickSight (use this link - https://docs.aws.amazon.com/quicksight/latest/user/adding-a-calculated-field-analysis.html)Use the concat function to add a space in front of the id field for e.g., concat(' ',id) then use this calculated field for your output.CommentSharerePost-User-venkyanswered 2 months ago"


Question: Current limit of fleets of 0 have been reached..

"Hello!I am trying to deploy the Gamelift test suite, but am getting the following error:Current limit of fleets of 0 have been reached..We are a video game development company and we want to deploy our games on your infrastructure. Please get in touch with us.If there is someone who can give us support in Spanish, it would be the best option.Thanks.FollowCommentKirkules a year agoWhen attempting to create a GameLift::Fleet resource, the follow error occurs:Error! Cannot create the fleet. Reason: Current limit of fleets of 0 have been reached..This link shows the GameLift service quotas for my home region (us-east-1).https://us-east-1.console.aws.amazon.com/servicequotas/home/services/gamelift/quotasThe Fleets per region is set to 20. I have one active fleet, but I have been unable to create a new GameLift::Fleet resource since Feb 28th 2022.Prior to Feb 28, 2022 I had been able to create multiple simultaneously active fleets.What changed?How does this get fixed?Shareznnxzz a year agoHello!We are facing the same problem. AWS Support Team keeps sending the boilerplate answer, and it is not helpful at all...Did you manage to solve this issue?Share"

Answer: "0Thanks for using GameLift. Please follow the below steps to reach out to AWS customer support, and they can help you increase your limits.Go to https://us-east-1.console.aws.amazon.com/support/home?region=us-east-1#/case/createSelect "Service Limit Increase"In "Limit type", select "GameLift"In "Requests", select your region. If you need multiple regions, select "Add another request" and select more regionsIn "Case description", specify the following informationInstance typeDesired limitSubmitCommentShareJamesM_AWSanswered a year ago-1HelloI think you have reached the Limits you need to contact AWS support to increase the Fleet limit, Please find the below link about the Limits of service quotas but any time you need AWS support team will help you to increase the limithttps://docs.aws.amazon.com/general/latest/gr/gamelift.htmlHere are the instructions how to request  for the limit increase https://us-west-2.console.aws.amazon.com/servicequotas/home/services/gamelift/quotas/L-FDDD1260Thank YouGKCommentShareGKanswered a year agoKirkules a year agoWhen attempting to create a GameLift::Fleet resource, the follow error occurs:Error! Cannot create the fleet. Reason: Current limit of fleets of 0 have been reached..This link shows the GameLift service quotas for my home region (us-east-1).https://us-east-1.console.aws.amazon.com/servicequotas/home/services/gamelift/quotasThe Fleets per region is set to 20. I have one active fleet, but I have been unable to create a new GameLift::Fleet resource since Feb 28th 2022.Prior to Feb 28, 2022 I had been able to create multiple simultaneously active fleets.What changed?How does this get fixed?Share"


Question: AWS Elastic Beanstalk - Ruby 3.0 running on 64bit Amazon Linux 2/3.4.4 - Wrong PUMA version

"Hi all,I'm using** AWS Elastic Beanstalk** with** Ruby 3.0** running on 64bit Amazon Linux 2 version 3.4.4 .I read from documentation here https://docs.aws.amazon.com/elasticbeanstalk/latest/platforms/platform-history-ruby.htmlthat Puma version should be** Puma 5.6.2** but it is not true.The actual Puma version on that machines is 5.5.2 .Is it possible to update to the newer Puma version in the next release?The Puma 5.5.2 one has some security issues already fixed in newest versions.Thanks a lotFollowComment"

Answer: "0Dear @emish89Hello,I am trying also to use the AWS EB Ruby 3.0 running on 64bit Amazon Linux 2/3.4.4 but until now I did not manage to make it workIn env status I get:100.0 % of the requests are failing with HTTP 5xxalso in /var/log/nginx/error.log[error] 2459#2459: *596 connect() to unix:///var/run/puma/my_app.sock failed (11: Resource temporarily unavailable) while connecting to upstream, client: 172.31.34.113, server: _, request: "POST / HTTP/1.1", upstream: "http://unix:///var/run/puma/my_app.sock:/", host: "52.29.66.93"and in /var/log/puma/puma.log[4898] ! Unable to start worker[4898] /opt/rubies/ruby-3.0.3/lib/ruby/site_ruby/3.0.0/bundler/runtime.rb:309:in `check_for_activated_spec!'[4898] Early termination of workerAs for your question, in my instance the version is 5.6.2, as expected[ec2-user@ip-172-31-xx-xx ~]$ pumactl -V5.6.2How did you see the the version is 5.5.2?If I check the processes:ps aux | grep puma    healthd  25925  0.0  3.6 828800 36624 ?        Ssl  09:39   0:15 puma 5.3.2 (tcp://127.0.0.1:22221) [healthd]    webapp   26497  0.2  2.2 255768 22912 ?        Ss   09:40   1:07 puma 5.6.2 (unix:///var/run/puma/my_app.sock) [current]    webapp   28653 64.0  2.1 327180 21668 ?        Rl   16:08   0:00 puma: cluster worker 0: 26497 [current]    ec2-user 28656  0.0  0.0 119420   924 pts/0    S+   16:08   0:00 grep --color=auto pumaI see another puma v5.3.2Maybe this other puma version is used for another reason (health service)?CommentShareaaonanswered a year agoemish89 a year agoI checked again and I have version 5.5.2 .I add a screen:https://ibb.co/b1YnQkWShare0strange....is this a AWS Elastic Beanstalk - Ruby 3.0 running on 64bit Amazon Linux 2/3.4.4?can you post here the configuration for this environment?eb web interrface - environment - actions - save configuration$ eb config get <name>CommentShareaaonanswered a year ago0Yes @aaon, for sure.This is one config file of the 3 beanstalk enviroment that I have. All with the same config and problem.EnvironmentConfigurationMetadata:  DateCreated: '1649421111000'  DateModified: '1649421111000'Platform:  PlatformArn: arn:aws:elasticbeanstalk:eu-west-1::platform/Ruby 3.0 running on 64bit Amazon Linux 2/3.4.4OptionSettings:  aws:ec2:instances:    InstanceTypes: t4g.micro    EnableSpot: true    SupportedArchitectures: arm64  AWSEBEC2LaunchTemplate.aws:autoscaling:launchconfiguration:    ImageId: ami-***    EC2KeyName: ****    RootVolumeType: gp3  aws:elasticbeanstalk:application:environment:    RAILS_SKIP_MIGRATIONS: true  aws:elasticbeanstalk:hostmanager:    LogPublicationControl: true  aws:elasticbeanstalk:environment:    ServiceRole: arn:aws:iam::****:role/aws-elasticbeanstalk-service-role    EnvironmentType: SingleInstance  aws:elasticbeanstalk:healthreporting:system:    ConfigDocument:      Version: 1      CloudWatchMetrics:        Instance:          RootFilesystemUtil: null          CPUIrq: null          LoadAverage5min: null          ApplicationRequests5xx: null          ApplicationRequests4xx: null          CPUUser: null          LoadAverage1min: null          ApplicationLatencyP50: null          CPUIdle: null          InstanceHealth: null          ApplicationLatencyP95: null          ApplicationLatencyP85: null          ApplicationLatencyP90: null          CPUSystem: null          ApplicationLatencyP75: null          CPUSoftirq: null          ApplicationLatencyP10: null          ApplicationLatencyP99: null          ApplicationRequestsTotal: null          ApplicationLatencyP99.9: null          ApplicationRequests3xx: null          ApplicationRequests2xx: null          CPUIowait: null          CPUNice: null        Environment:          InstancesSevere: null          InstancesDegraded: null          ApplicationRequests5xx: null          ApplicationRequests4xx: null          ApplicationLatencyP50: null          ApplicationLatencyP95: null          ApplicationLatencyP85: null          InstancesUnknown: null          ApplicationLatencyP90: null          InstancesInfo: null          InstancesPending: null          ApplicationLatencyP75: null          ApplicationLatencyP10: null          ApplicationLatencyP99: null          ApplicationRequestsTotal: null          InstancesNoData: null          ApplicationLatencyP99.9: null          ApplicationRequests3xx: null          ApplicationRequests2xx: null          InstancesOk: null          InstancesWarning: null      Rules:        Environment:          ELB:            ELBRequests4xx:              Enabled: true          Application:            ApplicationRequests4xx:              Enabled: true  aws:autoscaling:launchconfiguration:    RootVolumeIOPS: '3000'    RootVolumeSize: '16'    DisableIMDSv1: true    IamInstanceProfile:****EnvironmentTier:  Type: Standard  Name: WebServerAWSConfigurationTemplateVersion: 1.1.0.0CommentShareemish89answered a year ago0The only diff thing that I noticed is the spot instanceso,I created a new instance (spot) and when the creation completed, I dideb sshand thenps aux | grep pumahealthd   3600  0.2  3.7 828784 38088 ?        Ssl  14:23   0:00 puma 5.3.2 (tcp://127.0.0.1:22221) [healthd]webapp    3830  0.1  2.8 271748 28604 ?        Ss   14:23   0:00 puma 4.3.3 (unix:///var/run/puma/my_app.sock) [current]webapp    3910  0.0  3.0 841880 30724 ?        Sl   14:23   0:00 puma: cluster worker 0: 3830 [current]ec2-user  4065  0.0  0.0 119420   960 pts/0    S+   14:27   0:00 grep --color=auto pumaandpumactl -V    5.6.2As you can see the basic puma is 5.6.2 and the healthd puma version is again 5.3.2...Can you please create you too also a new spot instance environment, as I do, and run with eb ssh the same commands:ps aux | grep pumapumactl -VCan you please run in your original env ps aux | grep puma?Do you have any .ebextensions in your original env? Can you share them with us?Is there any Procfile on your root app?CommentShareaaonanswered a year ago0Hi and thanks for the support!and 2)I tried in new env and my env the command ps aux | grep pumaresult in new enviroment:[ec2-user@ip-172-31-9-xxx ~]$ ps aux | grep pumahealthd   1632  0.1  3.9 867356 38176 ?        Ssl  07:03   0:00 puma 5.3.2 (tcp://127.0.0.1:22221) [healthd]webapp    1861  0.0  2.9 206692 28512 ?        Ss   07:04   0:00 puma 4.3.3 (unix:///var/run/puma/my_app.sock) [current]webapp    1937  0.0  3.1 1158180 31188 ?       Sl   07:04   0:00 puma: cluster worker 0: 1861 [current]webapp    1938  0.0  3.1 1158096 30420 ?       Sl   07:04   0:00 puma: cluster worker 1: 1861 [current]ec2-user  2124  0.0  0.0 112916   476 pts/0    S+   07:13   0:00 grep --color=auto pumaBut if I go to current app folder and run pumactl -V I get the correct 5.6.2 .And in mine env was the same discussed before, 5.3.2 and 5.5.2 from ps aux | grep puma and 5.5.2 from pumactl -V .yes I have 3 .ebextensions files but they should be totally safe. 1 for options (a json map key -> value), 2 this one:packages:    yum:        amazon-linux-extras: []commands:    01_postgres_install:        command: sudo amazon-linux-extras install postgresql12And 3 this one to have RAM and Disk Usage monitored:packages:  yum:    perl-DateTime: []    perl-Sys-Syslog: []    perl-LWP-Protocol-https: []    perl-Switch: []    perl-URI: []sources:   /opt/cloudwatch: https://aws-cloudwatch.s3.amazonaws.com/downloads/CloudWatchMonitoringScripts-1.2.2.zip  container_commands:  01-setupcron:    command: |      echo '*/5 * * * * root perl /opt/cloudwatch/aws-scripts-mon/mon-put-instance-data.pl `{"Fn::GetOptionSetting" : { "OptionName" : "CloudWatchMetrics", "DefaultValue" : "--mem-util --disk-space-util --disk-path=/" }}` >> /var/log/cwpump.log 2>&1' > /etc/cron.d/cwpump  02-changeperm:    command: chmod 644 /etc/cron.d/cwpump  03-changeperm:    command: chmod u+x /opt/cloudwatch/aws-scripts-mon/mon-put-instance-data.ploption_settings:  "aws:autoscaling:launchconfiguration" :    IamInstanceProfile : "aws-elasticbeanstalk-ec2-role"    RootVolumeType: gp2    RootVolumeSize: "16"  "aws:elasticbeanstalk:customoption" :    CloudWatchMetrics : "--mem-util --mem-used --mem-avail --disk-space-util --disk-space-used --disk-space-avail --disk-path=/ --auto-scaling"no ProcfileThanks again for all the supportCommentShareemish89answered a year ago"


Question: "ENA Express Support - Does ENA is active between AWS owned endpoints as well?  EC2 to ALB, EC2 to VPC or EC2 to EBS?"

My customer is heavy users of Oracle on EC2 and this ENA express might be big Boost Performance boost for them. They have pointed questions on ENA express support b/w EC2--> ENA Express --> RDS/EBS.FollowComment

Answer: "0Currently this feature is supported for only 1 instance type, see below link:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ena-express.html#ena-express-supported-instance-typesSupported instance types for ENA ExpressENA Express is supported by the c6gn.16xl instance type.CommentShareEXPERTTushar_Janswered 4 months ago"


Question: I want to automatically delete records 10 years ago from Redshift on a regular basis

"When using Redshift, I would like to create a mechanism to automatically delete past records 10 years ago.Is it possible to set the TTL and delete it regularly like DynamoDB?FollowComment"

Answer: "1You have to create your own logic to delete data from Redshift tables. If the volume of data to be deleted is not too large then you can create a stored proc and schedule it to run on a regular interval. For large volume tables with lots of records to delete, its better to design tables into time series, this way you can simply drop the entire table containing that time period, making the operation simple and fast. Details are documented here.CommentShareEXPERTBehramanswered a year agoAWS-User-5680610 a year agoThanks for helping me out. I really appreciate that!Share"


Question: Message Variables/Attributes in Emails are blank

"Hey,I'm learning Pinpoint, and I've gone through  https://docs.aws.amazon.com/pinpoint/latest/userguide/message-templates-personalizing.html, I've worked through the User Guide examples, and I'm working through the Developer Guide examples, but I've spent at least 2 days over the last 2 weeks trying to get any email message variables to appear.I can export segments with the endpoint data, or call the API to also show the same data, but whether using Campaign emails, test emails, or message templates, the data from standard attributes or custom attributes {{ }} is always blank or uses the null values I supply in the message templates.Does this occur because I'm using a sandbox environment?This doesn't look hard, but is there a setting I'm missing?Thanks for any help!FollowComment"

Answer: "0Hey FinHead,Sorry your having some difficulty with using message templates.  I created a small test to see if I could get some steps for you to follow that may help you troubleshoot.Before following, verify your email is verified and the email channel is enabled.  Navigate to the Pinpoint Console > Project > Settings > Email to verify this information. Your account shouldn't need to be out of sandbox if your just sending these test messages - but you can see if your exceeding your sandbox limits on the Pinpoint Console > Project Overview page.Here's some simple steps to get off the ground and see the feature work:Navigate to the consoles Create Segment section and download the sample .csvModify one of the rows for EMAIL channel by adding your email address ( note the value in Attributes.FavoriteBaseballTeam for that column this will surface in your message later).  Delete the other rows so you just have the one with your EMAIL.  Save the csvBack at the Console attach the csv and name the segment.  Click Create.Navigate to the Pinpoint Console > Messages Templates.  Create a template for the email channel with the following content: subject: "Forum Test", body: "Your favorite team is {{Attributes.FavoriteBaseballTeam}}" and save it.Go back to the Pinpoint project where you uploaded the segment and navigate to the Campaigns feature in the left menu. Create a campaign for the email channel, choose the same created segment in step 3 above, then the same created template in step 4 above, and for schedule choose IMMEDIATE.Hopefully the above will give you insight into how the feature works and help you troubleshoot.  If you are still running into issues please share your step by step and I will help debug further.CommentShareawsomeaustinanswered 3 years ago0Hey awsomeaustin,Thank you for the reply, it was very helpful!! I walked through your quick test and got it working.I went back to look through my other attemptsI was able to fill simple email templates using segments derived from loaded csv files, and also from a file stored in an S3 bucket!"Pinpoint >> "Test Messaging" email tests will never fill in message variables?New Campaign, Template preview, "send a test message" email tests will never fill in message variables?I had a complex html email and now noticed that I had one message variable that was misspelled and this was causing my email to not be sent? Once I fixed the misspelling, the email was sent!If test messages don't have access to message variables, I didn't notice this mentioned in the help, tutorials, or docs?Thank you for your help!Edited by: FinHead on Apr 17, 2020 7:13 AMCommentShareFinHeadanswered 3 years ago"


Question: Mutual TLS for S3 rest api

"Can we configure mtls when using the S3 rest api?From looking at the documentation, I understand that the way to perform such activity would be to put the call behind an API gateway service and have it manage the mtls partFollowComment"


Question: net.core3.1 layer with amplify

"Hello. There are several lambda features on net.core 3.1 without layers. All this business is implemented through amplify cli. At the moment, there is a need to add layers for these lambdas, but amplify only offers python or nodejs.  From what I've tried, I've deployed the layer through Amazon.Lambda.Tools, then I inserted the layer explicitly into the cloudformation, spelling out the layer's arn. But this trick attaches a layer to the function, but the size of the lambda does not decrease, that is, it does not work) Question is it possible to add net.core 3.1 layers for lambdas via amplify? Or change the generated cloudformation files to apply layers for lambdas?FollowComment"

Answer: "0Hello,I  understand that you’re facing an issue since amplify only offers Python or NodeJS layers for lambda and you're unable to add net.core 3.1 layers for lambdas via amplify. Please correct me if my understanding is wrong.Upon checking, I can see that we can add a specific layer by its ARN through the amplify update function workflow, which will allow the layer to persist across amplify update function executions.[+] https://docs.amplify.aws/cli/function/layers/#add-a-layer-to-a-functionAt the moment, the CLI does not currently support this runtime (net.core3.1) for Lambda Layers, I will mark this as a feature request for the team to evaluate further.I understand that the lack of native feature to achieve your use-case might be causing inconvenience at your end. Therefore, I have shared this as a feedback with our Internal Service Team and filed a feature request with them.Please be assured that our Service Teams take feedbacks very seriously and work consistently for better customer experience. I won’t be able to provide an ETA regarding its release because of the limited visibility into the progress of internal distributed software development processes. I would suggest keeping an eye on our News page/blog for future announcements:[+] AWS blogs: http://blogs.amazon.com/[+] What's New: http://aws.amazon.com/new/CommentShareSUPPORT ENGINEERAditya Panditaanswered 10 months ago"