Question: Export PBR from Substance Painter to Amazon Lumberyard

"Hello,I'm trying to import materials I created in Substance Painter into Amazon Lumberyard.As mentioned in the documentation, I'm using the PBR Specular/Glossiness workflow. https://docs.aws.amazon.com/lumberyard/latest/userguide/mat-substances.html And the Gloss map is stored in the alpha channel of the Normal map. https://forums.awsgametech.com/t/ao-maps-and-gloss-maps/2681/1REMOVEDUPLOADHowever, lumberyard doesn't seem to recognize the gloss map.When I export my model from Substance Painter, it looks like thisREMOVEDUPLOADBut when I create the material with the Diffuse, Specular and Normal maps (and glossiness), I get the following result.REMOVEDUPLOADREMOVEDUPLOADI have to manually change the Specular Color and the Smoothness of the Lighting Settings to get a similar result.REMOVEDUPLOADWhen I edit the material file, I see that the smoothness map is defined, but it doesn't seem to be taken in charge:<Texture Map="Smoothness" File=".../.../.../iron_ddna.dds"/>Is there a way to import my PBR to have the same result I have in Substance Painter, without having to edit the specular and smoothness value twice?Thanks for your helpFollow"

Answer: "0Accepted AnswerHey @Malof, Thecurrent workflow with Lumberyard is that you will still have to make some material adjustments for your Specular and Smoothness values since the default values on a new .MTL in Lumberyard won't be representative of what settings you have in your Substance Painter shader.Thereare some differing results currently when bringing over Substance Materials from Substance Designer, so I wouldn't be surprised if it's similar to what you're encountering with Substance Painter having visualdifferences. We also have some different gamma calculations in Lumberyard that are contributing to the visual difference. We are aware of the 1:1 problems with Substance so it is something we are trying to address on the Substance Material side.Asfor the pixelization issues with your textures, I have some follow up questions to try and help sort out what might be happening:Is the Lumberyard Result image with the different spec/gloss stripes you provided representative of your 4k textures?Duringyour export from Painter, are they being exported as .TIFs originally or are they coming out as .DDS? The .DDS is the Asset Processed version of the texture, which I see mapped in your material texture paths, so that's why I'm wondering what the source originally is.SharerePost-User-7951591answered 5 years ago0From what I can tell you're already using exported images, instead of the import plugin, but just to make sure we're at the same starting point, use exported textures (smoothness in normals alpha using _ddna suffix, again seems you did this already, so just to make sure :) ), not the Substance Plugin for Lumberyard.Next bump the smoothness value up to 255 in your LY material, if it's set to anything lower the smoothness map won't have any effect. This should fix it.Remember that you'll have to use a specular map for metals to be displayed correctly.SharerePost-User-0887237answered 5 years ago0I'm not an artist so I can't tell you if it looks correct. You could create a smoothness map with very obvious values like a checker pattern and test if the settings of your material in LY are correct.SharerePost-User-0887237answered 5 years ago0Hello,Thanks for quick reply.I tried to set the smoothness value to 255 in my LY material and I get this result:REMOVEDUPLOADIf I set the value to 254, I get the same result, so I'm not sure the map is applied correctly.I have a specular map defined, as you can see in the screenshot I made in the initial post.I tried to play with lighting to make sure it wasn't because of the environment but that doesn't seem to be the case.SharerePost-User-1026337answered 5 years ago0Hello Ihatenames,I tried what you asked.I've set a black diffuse color on my model.Then I painted multiple stripes of specular overridden by multiple stripes of glossiness.SpecularREMOVEDUPLOADGlossinessREMOVEDUPLOADSubstance Painter ResultREMOVEDUPLOADAmazon Lumberyard ResultREMOVEDUPLOADWe can see that the mapping is working in AL (Amazon Lumberyard). However, the result is different. Maybe it has to do with the shader used in Substance Painter compared to AL?In addition, the mapping is somewhat pixelized, even if I used 4k resolution.If anyone used Substance Painter with Amazon Lumberyard, I would really appreciate your feedback on issues I'm having.ThanksSharerePost-User-1026337answered 5 years ago0Hello @REDACTEDUSERSorry for the delay, I've been working on something else.I don't have the test I made any more, but I was able to get "similar" result by adjusting Specular and Smoothness values as you mentioned.I'm happy to know that this is a known issue with Substance Designer and Substance Painter. I thought I was doing something wrong.Thanks for your timeSharerePost-User-1026337answered 5 years ago"


Question: AWS DMS Neptune target endpoint error

"According to the following documentation for creating a target endpoint using AWS DMShttps://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Neptune.htmlThe setup looks like as follows:A Neptune DB cluster(without Notebook)A DMS replication instanceA source endpoint (S3)A role that has full access to S3, Neptune and RDSA target endpoint (AWS Neptune) <-- This is the point of failureAfter configuring the target endpoint when I click on "Run test" I see following error:arn:aws:iam::12xxxxxx2:role/xxxx-dms-role role should be associated with xxx-cluster-xxx-neptune cluster.Is there something missing?The role is configured with policies that provide full access to all resources(especially Neptune and S3){    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "s3:*"            ],            "Resource": "*"        },        {            "Effect": "Allow",            "Action": "neptune-db:*",            "Resource": "*"        },        {            "Effect": "Allow",            "Action": "rds:*",            "Resource": "*"        }    ]}FollowComment"

Answer: "1It is likely that the role needs to be added to the Neptune cluster, such that the cluster can use this role for reading data from the S3 bucket used as intermediate storage for the transformed data.  https://docs.aws.amazon.com/neptune/latest/userguide/bulk-load-tutorial-IAM.html#bulk-load-tutorial-IAM-add-role-clusterCommentShareTaylor-AWSanswered a year ago0If trying out the above suggestion doesn't work, to answer your question, we require details that are non-public information. Please open a support case with AWS using the following link -> https://aws.amazon.com/contact-us/, after which you can select Technical Support. Thanks.CommentShareSUPPORT ENGINEERAWS-User-1485210answered a year ago"


Question: I want SSH as drive so i can use better windows editor (visual c code)  to program. I prefer aws team create Windows Aws drive that can point to instances as drives.

"http://makerlab.cs.hku.hk/index.php/en/mapping-network-drive-over-ssh-in-windowsI tried these but dont show up in windows 11.Why no one made a software for this simple stuff? May be use whole operating system as drive as bad idea?  I feel it is good idea. All you need is point to particular directory as drive for editing and coding purposes.Nano and Vi is terrible editors. Sure i can be expert after using but once you are comfortable in visual code , you only want it only that way.FollowComment"

Answer: 0Accepted AnswerDecided to use Mobxterm ssh client for now to keep session aliveCommentSharealexkanswered a year ago


Question: Requirement for continuous_mine functionality for Oracle 19 DMS as source

"HelloContinuous_mine functionality from logminer is getting desupported. Does DMS requires this to continuous mine operation in Oracle 19 RDS servers?Im hoping it can handle the log switching process in the same way as debezium does, handling the log switching task as the same way as debezium doeshttps://franckpachot.medium.com/ideas-for-event-sourcing-in-oracle-d4e016e90af6FollowComment"

Answer: "0Amazon database migration service can use Binary reader method to mine the logs.https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.Oracle.html#CHAP_Source.Oracle.CDCCommentShareSVanswered 10 months ago0Sure, but i dont have EE, and im expecting to use LogminerCommentSharealexhguerraanswered 10 months ago0FInally, Got the answer that i was looking for. Thanks Abhinav!No need for GG , nor EE . Yayhttps://aws.amazon.com/pt/blogs/database/aws-dms-now-supports-binary-reader-for-amazon-rds-for-oracle-and-oracle-standby-as-a-source/Still, this information must be clear in the Online DocCommentSharealexhguerraanswered 10 months ago"


Question: DNS resolve request limitation to Route 53?

I have a very busy website. Are there any DNS requests count limitations that I can theoretically hit when using Route 53?Thanks.FollowComment

Answer: "0Understand that DNS is a distributed solution, and zones are cached across the internet as requests are made:  All DNS requests do not hit route53.Route53 is one of the most scalable services on the internet:  It would be hard to break with  non-DDOS/normal traffic.CommentSharecloudbuttonanswered 4 years ago"


Question: Dynamodb scan bug

"Hi, having an issue with incorrect results returned from a dynamodb scan, either from the console or programatically.First image shows the correct result for a query (5 rows returned):https://www.dropbox.com/s/7x6s9q89q7gd5go/dunamodb1.png?dl=0Second image shows same results from a scan - either in the console or through node.js code (4 rows returned)https://www.dropbox.com/s/kpk3wus2vlf1ywz/dynamodb2.png?dl=0There are actually 840 rows in this table if i just move through 50 rows at a time by viewing table details, but a scan only returns 813 rows.ThxFollowComment"

Answer: "1DynamoDB has a maximum page size of 1MB:A single Scan operation reads up to the maximum number of items set (if using the Limit parameter) or a maximum of 1 MB of data and then apply any filtering to the results using FilterExpressionThis means that you requests reads up to 1MB of data, then applies the filter, then returns you the response. In order to retrieve the full set of results, you must use PaginationTo satisfy yourself with my answer, try the request using the CLI, it will automatically paginate so will provide you with the response you expect.aws dynamodb scan \    --table-name activations \    --filter-expression "txn = :a" \    --expression-attribute-values '{":a":{"S":"your tx id here"}}CommentShareEXPERTLeeroy Hannigananswered 3 months ago0Hi, thanks for the answers - got this working. thxCommentShareleehuanswered 2 months agoalatech EXPERT2 months agoNo worries leehu. If answer helped please accept or state what was the resolution so that other people can benefit, thanks ;)Share0Hi,In second screenshot you can see the message that you need to click “continue search” to find all items.This could be a related to dynamo scan reaching 1mb data in response https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Scan.htmlCheck if LastEvaluatedKey is present in the response, and if so,  you need to paginate the result set.CommentShareEXPERTalatechanswered 3 months ago"


Question: Unable to launch the following solution from Sagemaker jumpstart: Fraud Detection in Financial Transactions using Deep Graph Library

"The solution could not be launched.Errors from CloudFormation: [{LogicalResourceId : SC-695657518426-pp-fihw4ilwhvf6u, ResourceType : AWS::CloudFormation::Stack, StatusReason : The following resource(s) failed to create: [SageMakerEndpointStack]. Rollback requested by user.}, {LogicalResourceId : SageMakerEndpointStack, ResourceType : AWS::CloudFormation::Stack, StatusReason : Embedded stack arn:aws:cloudformation:us-east-2:695657518426:stack/SC-695657518426-pp-fihw4ilwhvf6u-SageMakerEndpointStack-16DP1LZW9RDSF/db80b940-0eb1-11ed-b37d-020cb2efa270 was not successfully created: The following resource(s) failed to create: [Model]. }, {LogicalResourceId : DataPreprocessingLambda, ResourceType : AWS::Lambda::Function, StatusReason : Resource creation Initiated}, {LogicalResourceId : GraphModellingLambda, ResourceType : AWS::Lambda::Function, StatusReason : Resource creation Initiated}, {LogicalResourceId : SageMakerEndpointStack, ResourceType : AWS::CloudFormation::Stack, StatusReason : Resource creation Initiated}, {LogicalResourceId : SC-695657518426-pp-fihw4ilwhvf6u, ResourceType : AWS::CloudFormation::Stack, StatusReason : User Initiated}]FollowComment"

Answer: "0It seems like there is a permission issue with the CloudFormation stack caused by your domain location, thus a resolution would be to use the reduced permissions mode feature for AWS environments to manually create the CloudFormation stack for s3.This problem seems to have a similiar solution as the following troubleshooting case in Cloudera Data Warehouse (CDW): https://docs.cloudera.com/data-warehouse/cloud/troubleshooting/topics/dw-trblshoot-aws-env-activation-failure.html?Here's an outline of the steps:Remove one of the permissions in your IAM permissions policy for the AWS account that you used to register the environment you want to activate.Follow the steps in https://docs.cloudera.com/data-warehouse/cloud/aws-environments/topics/dw-aws-reduced-perms-mode-activating-environments.htmlAfter you activate the environment and create the AWS CloudFormation stack resources in your AWS account, make sure that you apply the required tags to the stack that are listed in Required tags for CloudFormation stacks created with reduced permissions mode found here: https://docs.cloudera.com/data-warehouse/cloud/aws-environments/topics/dw-aws-reduced-perms-mode-required-tags.htmlAdd the s3:CreateBucket IAM permission back to your IAM permissions policy to make sure you have adequate permissions so CloudFormation stack resources can be created for you when you activate environments later.Hope this helps.CommentShareNtiyiso Ngonyamaanswered 10 months ago"


Question: Do I need to reboot an EC2 instance that has been updated via 'yum update' first before making an AMI image of it?

"I have SSHed into an EC2 instance and the logs tell me that two security related packages are available for installing. I can install them by running sudo yum update. Some Linux packages may require an EC2 reboot in order to take effect.After installing the packages I like to create a new AMI image of the EC2 instance that reflects these updates. But I need to be sure that any (kernel) updates (the ones that require a reboot) are also used whenever the image is used to create a new EC2 server. In other words the resulting new EC2 server should not have to reboot to implement the installed kernel updates present in the image.So my question is this: If I've installed packages with yum update and I want to create an image of the update EC2 server, do I first need to reboot this EC2 server before creating an new AMI image in order to implement any kernel changes? Or will these kernel changes also happen when I don't reboot and instead immediately create an AMI image but with the 'reboot' option set to 'true'?FollowComment"

Answer: "0See section "create image" of https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/creating-an-ami-ebs.html to answer your questionCommentShareDidier_AWSanswered a month ago0An in-depth Linux-specific question like this is best asked on a Linux forum, or if you are running RHEL (you mention using yum) then log a support call with Red Hat.You're not going to get a watertight answer from AWS on this (even if you're running Amazon Linux, which is really just a fork of Fedora), nor should you rely on the well-meaning but unpaid contributors to this forum to give you an answer you can take to the bank.FWIW I think what you describe should be okay, as part of the yum update it should do any mkinitrd or dracut operations that it needs to, fix up any changes that need to be made in GRUB, and so on. So if you made your new AMI at this point and then spun up a new EC2 from that AMI, it should be ready to roll.But making sense in your head isn't the same as actually working in the real world. It's best to try this in various scenarios and report back what works and what doesn't, and perhaps even write a Knowledge Centre article about it?CommentShareRWCanswered a month ago"


Question: Creating an Opsworks app instance with Ubuntu 22.04

"We've been using Ubuntu 18.04 for years, but it's time to retire its use. It's at EOL, and we need to start using Ubuntu 22.04 with our Chef recipes for hosting stacks in Opsworks. I don't see an option for 22.04 in the dropdown when creating the instance, so I think my only option is to use an AMI. However, I've tried to "configure" the below AMI and added it to my "service catalog", but it's not showing as an operating system choice when I attempt to add an instance.As a matter of troubleshooting, I've allowed some time before attempting to create the instance again. I've also logged out of AWS and back in, but still it doesn't show as a dropdown choice or under the list of AMIs when I choose "Use custom Linux AMI" from the dropdown. Any ideas where I'm going wrong? This is really putting a wrench in my testing window for a launch that's supposed to be happening this week. I haven't really used AMIs much before, so maybe I'm doing something wrong 🤷♂https://aws.amazon.com/marketplace/pp/prodview-o5bowpuwmx3ngFollowCommentsuperduperadmin a month agoI managed to create a custom AMI from the EC2 instance that was launched. Then, from that AMI, was able to create new Opsworks instances on the apps layer. However, they tried booting for ~20m or so before failing start. I must still be missing a piece of this puzzle.Share"

Answer: "0As far as I'm aware there is currently no way to run OpsWorks Stacks on a newer Ubuntu version than 18.04, even trying to use an AMI like you did here. The opsworks-agent does not run on newer Ubuntu versions and would need updated by Amazon, additionally the integration with Chef on their backend would need to support installing and deploying a newer Chef version as well as the Chef-client version on your EC2 instance. Unfortunately none of this has been updated in quite some time. They have tried to integrate Chef into SSM/Application Manager which your mileage may very.https://aws.amazon.com/blogs/mt/migrate-your-aws-opsworks-stacks-to-aws-systems-manager/CommentSharejhundley9109answered 14 days ago"


Question: How to disassociate CloudFront distribution from alias sub-domain?

"We have the following scenario:We are using S3 and CloudFront.An engineer has created an S3 bucket and CloudFront Distribution under their personal account.They then associated the CloudFront to a sub-domain owned by the company.The company owns the domain.They left the company.This is obviously an unacceptable practice and is probably one of the reasons the engineer is no longer working for the company. Unfortunately, we now have to sort it out.Now to the issue at hand.We've created a new S3 bucket and CloudFront distribution. But as you'd expect, we are unable to associate the new distribution ID with the same sub-domain and are getting the following error:CNAMEAlreadyExists: One of more of the CNAMEs you provided are already associated with a different resourceWe have already tracked down the conflicting CF distribution id:$ aws-vault exec corp-dev -- aws cloudfront list-conflicting-aliases --alias dev.local.domain --distribution-id XYZ{    "ConflictingAliasesList": {        "MaxItems": 100,        "Quantity": 1,        "Items": [            {                "Alias": "dev.local.domain",                "DistributionId": "******ECHOHUO",                "AccountId": "******000000"            }        ]    }}However, it is not entirely clear how to disassociate the subdomain from that distribution ID. The company is owns the domain and Route53.Do we need to involve AWS support for this or is there a non-obvious way to force the disassociation, so the subdomain(s) can be re-used again?FollowComment"

Answer: "1Accepted AnswerThis is definitely a case where engaging the support team is the right answer. Because the resource is owned by another account there's nothing that you can (directly) do here.CommentShareEXPERTBrettski-AWSanswered 12 days agocarlspring 9 days agoWe have reached out to suppor and it does indeed seem like the only viable option in our case. Thank you for your help!Share0One thing I can think of is that the subdomain definition in the domain's hosted zone is still pointing to the former employee's Route 53, where he set up a hosted zone to control the subdomain. If that is the case, you should create your own hosted zone for that subdomain and then change the NS records for the subdomain in the hosted zone of the domain to NS records define in the subdomain's hosted zone. Then you can add the Aliased A records to the subdomain's hosted zone. Something like this:Current Company Hosted Zone (company.com):sub.company.com NS - NS1, NS2, NS3Current Ex-Employee's Hosted Zone:sub.company.com NS - NS1, NS2, NS3sub.company.com A (alias) - Employee CloudFront DistributionTo fix this:New Company Hosted Zone (sub.company.com)sub.company.com NS - NS4, NS5, NS6sub.company.com A (alias) - Company CloudFront DistributionModified Company Hosted zone (company.com)sub.company.com NS - NS4, NS5, NS6CommentShareEXPERTkentradanswered 11 days agocarlspring 11 days agoThe setup we found is close to what you have mentioned in your answer. We did remove all DNS records pointing to the hosted subzone and created a new hosted zone in the appropriate sub account. We also created a completely new bucket, Cloudfront distribution and a Route53 A Alias record to point towards the new distribution. Unfortunately, no matter what you point to -- it always opens the old Cloudfront distribution. We suspect it might be related to the TLS certificates which were probably also created under the personal account.Any other ideas we can try?https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.htmlYou must own the domain name, or have authorization to use it, which you verify by adding an SSL/TLS certificate.Sharekentrad EXPERT11 days agoAs a troubleshooting step, I would change the value of the subdomain to a known value, like 1.1.1.1. Then run a 'dig' against the subdomain to verify that you truly have control of the subdomain. If it does not return 1.1.1.1, you know something is still not correct with the DNS setup. You can also do a 'dig NS subdomain' to verify that the NS records.Sharekentrad EXPERT11 days agoThough the TLS certificate won't affect the routing, I would create a new one on ACM and use that in your CloudFront distribution.Sharecarlspring 10 days agoYes, we have tried troubleshooting the hosted zone the same way you suggested. The DNS records are indeed updated properly and point to the IP we define (i.e. 1.1.1.1).$ dig +noall +answer +multiline dev.local.domain Adev.local.domain.        30 IN A    1.1.1.1But the moment we change it back to  an A Alias record pointing to the new distribution id we end up in the same situation as previously mentioned.Of course we are also assigning the newly generated ACM certificates as well.Any further ideas?Sharecarlspring 9 days agoThank you for your suggestions!Share"


Question: Lack of "workspaces:RegisterWorkspaceDirectory" permission when registering a Workspaces Directory

"Hi, I am using Terraform to provision a new Amazon Workspaces. I have an AD Connector created and linked to our internal domain. The next step is to create a Workspaces Directory. Part of creation is to link the Directory to the AD Connector using the Terraform "aws_workspaces_directory" resource. However, I've got the following error when running the Terraform code even though the user below is granted AmazonWorkSpacesAdmin & AWSDirectoryServiceFullAccess permission policies. Error: error registering WorkSpaces Directory (d-xxxxxxxxxx): AccessDeniedException: User: arn:aws:iam::xxxxx:user/xxxx is not authorized to perform: workspaces:RegisterWorkspaceDirectory on resource: arn:aws:workspaces:us-east-1:xxxxx:directory/d-xxxxxxx because no identity-based policy allows the workspaces:RegisterWorkspaceDirectory actionIs there anybody who knows what permission policy is needed to grant the "workspaces:RegisterWorkspaceDirectory" action? If I read the error correctly, the user is lack of permission to register workspace directory with the AD connector? If so, how do I check who has such permission on the AD Connector?Thank you.FollowComment"

Answer: "0Accepted AnswerI can't find that permission in any of the managed policies (including AmazonWorkSpacesAdmin) aside from granting AdministratorAccess, so I'd recommend attaching an inline policy [1] to your IAM user similar to the following:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "workspaces:RegisterWorkspaceDirectory",      ],      "Resource": "*"    }  ]}You might need to add more permissions (or just workspaces:*) to this if you get any more errors like this.Looking at the docs, you'll also need to create the workspaces_DefaultRole if you haven't already.[1] https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.htmlCommentShareEdanswered 10 months ago0Thanks, Ed! You suggestion works well. I am surprised even AmazonWorkSpacesAdmin permission policy does not include the register action. Appreciate your quick reply!CommentShareAWSLearner66answered 10 months ago"


Question: A question about inter-region latency.

According to this blog post from concurrencylabs the latency per region can differ widely when you compare them to each other. The author of the blog post had made a test to measure both the inter and intra region latency between regions and posted the results in a few matrix tables.Heres the matrix table that shows the inter- and intra-region latency results. https://www.concurrencylabs.com/img/posts/9-choose-region-wisely/ec2-s3-1mb-table.pngAll of the intra-region latencies (marked in blue) vary wildly with Oregon and Tokyo being big outliers. Oregon is by far the fastest and takes only 81 ms to transfer 1 MB from EC2 to S3 within the same region. Tokyo is the slowest of them all and takes 755 milliseconds.The ping latency results are interesting as well https://www.concurrencylabs.com/blog/choose-your-aws-region-wisely/. They all have an inter-region ping of around 3 ms except for Oregon. The ping latency for oregon to oregon is a whopping 211 ms.My question is: Why do all these regions differ so much in latency? Shouldn't the infrastructure at each region be of similar quality?FollowComment

Answer: "1Accepted AnswerI find the latency test for Oregon to be quite out-of-the ordinary; I just ran a test with some instances across different AZs in Oregon and got times that I expected (single digit millisecond or less). I suspect there was some network anomaly there while the test for the blog was running - but as always, I encourage customers to do their own tests because there are so many variables - operating systems, software versions, test stacks, application stacks, etc.As for the 1 MB transfer table: If you look at the numbers and compare them to the 10 MB transfer table you'll see a lot of transfer times that are very close to each other despite one transfer being ten times the size of the other. For small transfers (and 1 MB is a small transfer) there will be a fair chunk of that taken in negotiating the TLS session and then some time will be taken by S3 to deal with the file that is being uploaded.Again, there are going to be variances in this particular benchmark - far greater than with the latency test because S3 is a multi-tenant service. When the test is being run you simply don't know what else is going on; other operations that other customers are running; or what is happening within the service itself. Naturally, this is why the blog post writer has run many tests to get a good set of data - but it's a good idea to run those tests across several days; weeks or even months to ensure that the data set is representative of the conditions being tested.The great thing about creating a test suite and a set of data like that (especially if you're testing so that you have a benchmark to compare your production systems against) is that you can see when performance improves (or degrades) and (perhaps) do something about it; or at least take that data and explain why your system might be behaving in a different way.To answer your final question: Regions have all been built at different times and there will be differences in how they were constructed. Regions are always undergoing change - mostly expansion; but also new services being deployed; and existing services (even ones you can't see like the network) being upgraded. Each region is built on a different geography - there's no way to get the same length fibre runs between AZs in a different city and the speed of light in glass (or the speed of electrons in copper) does make a difference - it isn't infinite.TL;DR: Run your own tests if these types of numbers matter; there are many, many variables.CommentShareEXPERTBrettski-AWSanswered a year agoEXPERTToni_Sreviewed a year agoViridios a year agoWhen i look at the inter-region ping test result for North virginia against Frankfurt I see that the ping is 169 ms. I'm currently testing an application thats running on localhost but is communicating with a database in the region North virginia. For a simple query like SELECT 1 FROM table i get an average ping of about 552 milliseconds. Thats a lot more then that reported 169 milliseconds. I live relatively near Frankfurt, (Groningen to be exact). Is the difference in latency caused because i'm using the public internet instead of the private network of AWS to do the query? Thank youShareBrettski-AWS EXPERTa year agoA ping test is (generally) two packets: An echo-request; and echo-reply. That's it.A database query is part of a TCP session (which may or may not be already established; if not already established it's three packets to start then an unknown number of packets to authenticate to the database; then:) and depending on the database you might only have two packets (one for the query, on for the acknowledgment) and then the query response (an undetermined number of packets depending on the size of the response).It's unsurprising that a database query is longer than a ping test because you're not testing the round-trip time of the network; you're testing that plus the database response time and that's dependent on the load on the database as well (and perhaps CPU, memory, disk load on the server if it isn't single-purpose).Assuming a 169ms round-trip time, 552/169 = (approx) 3 round trips which seems somewhat correct (two round trips - one for query; one for response) plus some database response time. But I'm guessing. The only way to know is to run the same test across multiple different scenarios.Share"


Question: How to query all items of a specific type?

"I have a dynamo table, and have two main types of items: groups and users. I am using groupIds and userIds as partition keys, and userIds and groupIds as sort keys. In this way I am able to map many to many relationships. So querying a userId I can get all of the users groups, and querying a group I can get all of the users in that group.I'm wondering if there is a way to architect it in such a way where I can easily query all groups without performing a scan?My thought is to have a partition key that is just something like "groups" and a sort key of groupIds. Is this a proper approach?FollowComment"

Answer: "1What do you mean by "query all groups"? Get a list of group names? I'm going to assume so with my answer here.Within each item collection for a group do you have an item which holds the metadata about that group? So the other items in the item collection are the users, but the one item is about the group itself? Having the group name and such. I'm guessing yes.Setup a GSI having a PK of whatever attribute stores the group name. Then with a scan of the GSI you can get all the group metadata items and nothing else (because nothing else is in the GSI), so it's efficient. Project into the GSI whatever attributes are needed for that "query all groups" query.Again, I'm making a lot of assumptions here on what you really intend.CommentSharejzhunteranswered a year agosweetshootinsam a year agoYes, you are right in assuming I meant "Get a list of group names". And yes there is an item for each group that holds the metadata about that specific group. The other items in the collection are the users.I think you have a good approach, and I will try this out.Thank you for your help, and you did a good job at making assumptions :)Share"


Question: How to call createLedger / any QLDB (Quantum Ledger Database) management API requests from a lambda without internet access?

We are trying to create new ledgers in QLDB (Quantum Ledger Database) from a lambda within a vpc without internet access however the request is bouncing due to there not being a VPC endpoint for the management API. We are using the driver to create indices and tables within the ledger which is working successfully with the VPC endpoint com.amazonaws.${AWS::Region}.qldb.session.We are also looking to call export ledger and delete ledger in the same lambda setupDoes anyone have a solution to creating ledgers inside a vpc without internet access?If someone in AWS is available is there a timeframe for a QLDB management API VPC endpoint being made available.FollowComment

Answer: 1We already have a VPCE for com.amazonaws.region.qldb.session however this is only used for communicating with the transactional data API. There currently isn't a endpoint which allows the management API (creating and deleting ledgers etc.CommentSharerePost-User-6531985answered 13 days agoRodney Lester 12 days agoYou could isolate a layer that would communicate through a NAT Gateway where that layer would implement controls and mitigations for the threats you identify.Share


Question: How can I make my resource record sets reachable please?

I am trying to re-direct this websitehttps://versionofeverything2.herokuapp.com/ to a web domain www.versionofeverything.com which is on Route 53 AWSMy Route 53 Hosted Zone is currently set as below and the test passesHeroku looks happyI checked and the domains registered on the domain and in the NZ zone are the samens-743.awsdns-28.netns-1954.awsdns-52.co.ukns-28.awsdns-03.comns-1228.awsdns-25.orgDNS checks look okayI have three hosted zones. I created new zones as the advice on deleted zones was to create a new one ! I think the most recent is the onebeing usedI tried this step below with the following (fail) result. I don't know what else to try at this pointhttps://aws.amazon.com/premiumsupport/knowledge-center/route-53-reachable-resource-record-sets/Any help you can offer is gratefully received.FollowComment

Answer: "1Accepted AnswerCommentShareMuhammadanswered 5 months ago1Working fine for medig www.versionofeverything.com; <<>> DiG 9.10.6 <<>> www.versionofeverything.com;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25170;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 1232;; QUESTION SECTION:;www.versionofeverything.com.INA;; ANSWER SECTION:www.versionofeverything.com. 300 INCNAMEradiant-silkworm-qqa57jon74nbjjbk2zqrsb5b.herokudns.com.radiant-silkworm-qqa57jon74nbjjbk2zqrsb5b.herokudns.com. 5 IN A18.205.36.100radiant-silkworm-qqa57jon74nbjjbk2zqrsb5b.herokudns.com. 5 IN A52.204.242.176radiant-silkworm-qqa57jon74nbjjbk2zqrsb5b.herokudns.com. 5 IN A54.157.58.70radiant-silkworm-qqa57jon74nbjjbk2zqrsb5b.herokudns.com. 5 IN A54.162.128.250;; Query time: 608 msec;; SERVER: 172.17.200.21#53(172.17.200.21);; WHEN: Wed Jan 11 15:23:40 AEDT 2023;; MSG SIZE  rcvd: 189CommentShareMuhammadanswered 5 months ago0Wow you are right ! Thank you so much. I have been going crazy trying to get this to work. I thought I had flushed the DNS settings but clearly not. I finally tested it okay on my work phone using 5G not my Wifi and it works. I think maybe my router is caching the DNS settings, as I had tried to flush them using ipconfig.Thank you again ! Much appreciated.CommentSharerePost-User-1230805answered 5 months ago"


Question: "s3 - date folder structure for etl data processes (airflow, etc)"

"Trying to verify the best practice.Say I have a "folder" structure like so:s3://my-bucket/events/2022/09/01s3://my-bucket/events/2022/09/02...As an example,On 9/3, the client should export into the "folder" s3://my-bucket/events/2022/09/02  (after the 9/2 day).We have a client who is running their etl on 9/3 and then placing the files on 2022/09/03 folder and we're trying to convince them to put it in the 9/2 folder.Am I correct is saying that this is the best practice?FollowComment"

Answer: "0Hello,I would like to inform you that there is no general guidance or best practices prescribed by AWS for the query that you are asking.  That being said, it is a subjective question and depends from use-case to use-case. Personally, I would agree with you in convincing your client to put the ETL processed data in the same named folder as the date on which the data was produced.CommentShareSUPPORT ENGINEERanil_danswered 9 months ago"


Question: API gateway lacks permissions to trigger lambda when made by terraform

"My environments includes an API gateway with two methods: POST and OPTIONS. The POST one requires an API key and the OPTIONS one do not.Each triggers a different lambda. I am using terraform to build the environments.When I build an environment the AWS console shows that everything is as it should: The gateway, the methods and the lambda shows that the gateway has permissions.Calling the POST method works well.Calling the OPTIONS method fails and on Cloudwatch it shows an empty error:Lambda invocation failed with status: 403. Lambda request id: 43284993-c96d-4416-8db4-5c05b18eb2e1Execution failed due to configuration error:Method completed with status: 500If I manually remove the OPTION method, and re-make it manually and deploy the API - it works.A difference I have noticed after the manual change is that under the lambda "Triggers" view the trigger is a bit different:The triggers made by terraform have these fields:API key: <value of the the api key>API type: RESTAuthorization: NoneMethod: OPTIONSResource Path: /my_url_pathStage: <name of the API stage>And the one made manually lacks the "API key" one. Although my terraform code does not specify an API key at the lambda permission configuration.I am not sure whether it is a terraform mis-configuration or mis-feature in AWS API.Would love any suggestion for debugging it or a solution.Thank you!FollowComment"

Answer: "3AWS Lambda and many other AWS services support** resource-based permission policies**. Resource-based policies let you grant usage permission to other AWS Services or accounts on a per-resource basis. You also use a resource-based policy to allow an AWS service to invoke your function on your behalf.When we use console to build the environment some resources are automatically created to make it easier for us. It is opposite when we build it via terraform/CloudFormation/CDK/SDK or CLI, every single resource must be defined in the code.Example AWS Lambda resource-based policy:{  "Version": "2012-10-17",  "Id": "default",  "Statement": [    {      "Sid": "nodejs-apig-functiongetEndpointPermissionProd-BWDBXMPLXE2F",      "Effect": "Allow",      "Principal": {        "Service": "apigateway.amazonaws.com"      },      "Action": "lambda:InvokeFunction",      "Resource": "arn:aws:lambda:us-east-2:111122223333:function:nodejs-apig-function-1G3MXMPLXVXYI",      "Condition": {        "StringEquals": {          "aws:SourceAccount": "111122223333"        },        "ArnLike": {          "aws:SourceArn": "arn:aws:execute-api:us-east-2:111122223333:ktyvxmpls1/*/GET/"        }      }    }  ]Terraform resource for AWS Lambda resource-based permission policy is called aws_lambda_permission. So you can check if this resource exists it the current terraform code that you use. If not you can add it and properly configured.Example configuration:resource "aws_api_gateway_rest_api" "MyDemoAPI" {  name        = "MyDemoAPI"  description = "This is my API for demonstration purposes"}resource "aws_lambda_permission" "lambda_permission" {  statement_id  = "AllowMyDemoAPIInvoke"  action        = "lambda:InvokeFunction"  function_name = "MyDemoFunction"  principal     = "apigateway.amazonaws.com"  # The /*/*/* part allows invocation from any stage, method and resource path  # within API Gateway REST API.  source_arn = "${aws_api_gateway_rest_api.MyDemoAPI.execution_arn}/*/*/*"}For more information:Lambda resource-based policiesUsing AWS Lambda with Amazon API GatewayTerraform Resource: aws_lambda_permissionCommentSharec3nIvoanswered a year agoAssaf Shechter a year agoThanks for the detailed answer!I have tried this approach and when I used the "///*" suffix the permissions failed. It wrote me that there is no such path.Any idea?Share"


Question: How to open a schematic file once synthesis is complete to verify ?

"I am using aws_build_dcp_from_cl.sh script to run synthesis and once synthesis is complete tar file is generated from which I can generate afi. When I run synthesis in vivado gui I can see implementation schematic. How I can do the same when running synthesis in bach mode ?Edited by: aiquanta on Mar 7, 2021 1:32 PMFollowComment"

Answer: "0Hello,In our build flow, we end up generating a design checkpoint(dcp) file which is included in the tar file. You could extract the tar file and open the dcp file in Vivado GUI and see the schematic from the tools section.To extract the tar file, you can run: tar xf <timestamp>.Developer_CL.tarThis should extract the dcp and the manifest in a to_aws folder.Let me know if this doesn't help or if you have further questions!Thanks,DeepCommentShareDeep_Panswered 2 years ago"


Question: Are there difficulties migrating from Aurora MySQL to Aurora Serverless

"A customer is running Aurora MySQL on an R5.4xlarge.  They have a very spiky workload and need the large server to handle the peak load, but that is for a single hour of the day.  They are wanting to experiment with using Aurora Serverless that will automatically scale as they expect this would reduce their overall RDS costs.They are looking at this post for migrating and it looks relatively straightforward.  Are there any issues with migrating from Aurora MySQL to Aurora Serverless?The pricing doc indicates that 1 ACU ~ 2GB of memory.  With an r5.4xlarge having 128GB of memory that would be 64 ACU for peak load.  Is that an accurate conversion?R5.4xlarge pricing is $2.32/hourServerless is $0.08/ACU, so 64 ACU is $5.12FollowComment"

Answer: "0Accepted AnswerIn addition to snapshot restore method mentioned in customer provided blog they can also migrate the data from Aurora Provisioned Cluster to Aurora Serverless cluster by using one of the below methods.Customer can use a snapshot of Provisioned Aurora cluster running in version 5.6.10a and restore the same to a Serverless cluster. It was also mentioned in the shared blog post link that only version is 5.6 10aReference[+] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_CreateSnapshotCluster.html[+] https://docs.amazonaws.cn/en_us/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.restorefromsnapshot.html.Customer can use native backup and restore process using mysqldump to perform a logical static migration.Reference[+] https://dev.mysql.com/doc/refman/5.6/en/replication-howto-mysqldump.htmlThey can use services like DMS to perform a full migration with capture changes, but this will require extra configuration from source and also a replication instance, it can be useful to minimize database downtime.Reference[+] Targets for Data Migration - https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.html[+] https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.htmlAbout Pricing: it may not use 64 ACU all the time and customer need to look at their usage pattern(CPU/Memory) in 24 hours and ACU will be consumed based on the usage which varies over a period of time, here are some detailed pricing examples:https://aws.amazon.com/rds/aurora/serverless/CommentShareAWS-User-9931586answered 3 years ago"


Question: Alisases Emails Undeliverable

"My website sends out verification emails to new members. However, I am notified that the verification email is undeliverable. The site developer states it is an AWS issue. The emails are sent successfully with other email services.  Email aliases addresses are used for different services on the website.  Does AWS have issues with email aliases?FollowComment"


Question: AWS Glue Data Catalog Tables Not Appearing

"Newly created tables have stopped appearing in my Data Catalog GUI. I have created several tables via S3 crawlers to parse compressed JSON and can see the newly created tables in other services (for instance Glue Studio or Kinesis Firehose), but cannot view or edit them in the Data Catalog "Tables" menu. This started occurring after I deleted several tables via the GUI and has persisted since.Any help is appreciated!FollowComment"


Question: How to install 3rd party odbc driver at RDS sql server

We are planning to migrate our sql server 2016 standard edition database from ec2 instance to RDS. Need a guidance to install 3rd party odbc driver at it.  We have a requirement to access the out site dB in our application.FollowComment

Answer: "0I don't think I can install the ODBC driver because RDS is a managed serviceCommentShareEXPERTRiku_Kobayashianswered 2 months ago0In general RDS does not allow the user to customise the OS or DB environment ... but RDS Custom gives some of that power back if you need it - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-custom.html.  It's best though to stick with standard fully-managed RDS if you can, it's likely to result in lower TCO.Generally an ODBC driver would be installed in the DB's client though, so as part of your application?CommentShareEXPERTskinsmananswered 2 months ago"


Question: Need Urgent help: Name correction in AWS Training and certification account

"Hi,I have my AWS AWS Certified Cloud Practitioner exam scheduled on 21 Aug 2020 at 16:00. This is an online proctored exam managed by Pearson VUE.Candidate ID:AWS01638874Registration ID:  379597711On my Passport my surname is blank and my full name is written as below,Surname:Given Name(s):  Mohammad Mohsin KhanOn the AWS Training & Certification account, Since the both fields are mandatory in the form it is added as below,First name (Given name):  Mohammad MohsinLast name (Surname): KhanI have already raised the Customer Support request to update my name but I have not received any response yet.Is there any method to get it resolved urgently? I have 2 days left from the examination time. Please let me know if my request will be resolved by then or I will need to reschedule my exam?ThanksEdited by: mmkCloud2346 on Aug 19, 2020 4:04 AMFollowComment"

Answer: "0mmkCloud2346,I have escalated this to our Customer Support team and someone will get back to you as soon as possible.KimAWS CertificationCommentShareKimWD-AWSanswered 3 years ago0Thanks a lot for the quick support. My issue is resolved now.CommentSharemmkCloud2346answered 3 years ago"


Question: systemctl command doesn't work inside of amazonlinux:latest container

"When running "docker run --rm amazonlinux systemctl --version" to pull the latest amazon linux 2 docker container and checking the version of systemctl, I get this output:docker: Error response from daemon: OCI runtime create failed: container_linux.go:349: starting container process caused "exec: "systemctl": executable file not found in $PATH": unknown.However I would expect a similar output for pulling the latest centos container like when running "docker run --rm centos systemctl --version" which gives me the output:systemd 239_PAM _AUDIT _SELINUX _IMA -APPARMOR _SMACK _SYSVINIT _UTMP _LIBCRYPTSETUP _GCRYPT _GNUTLS _ACL _XZ _LZ4 _SECCOMP _BLKID _ELFUTILS _KMOD _IDN2 -IDN +PCRE2 default-hierarchy=legacyThe systemctl command even works when trying it on an amazon linux 2 AMI, so I'm not sure why this doesn't work for the docker container. Also, I know that I am pulling an amazon linux 2 docker image from the command above because when I run "docker run --rm amazonlinux cat /etc/os-release" to print out the OS details I see:NAME="Amazon Linux"VERSION="2"ID="amzn"ID_LIKE="centos rhel fedora"VERSION_ID="2"PRETTY_NAME="Amazon Linux 2"ANSI_COLOR="0;33"CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"HOME_URL="https://amazonlinux.com/"FollowComment"

Answer: "0By default, systemd is not installed in the Amazon Linux 2 container image.Try this: yum install -y /usr/bin/systemctl; systemctl --versionCommentShareAWS-User-1004892answered 3 years ago"


Question: [light leaking] total illumination skylight in interiors

Starter game has this issue too if you enable it interiors get so bright due to sky light contribution.Follow

Answer: "0Accepted AnswerGood morning!So I have looked into this more, and there are a couple of layers to this issue.The starter game lacks "visareas" in the interiors which would allow you to ignore the sky color when GI is enabled, or ignore GI altogether. However, there is a bug with these features currently in 1.9.1 and I have exposed this to the correct parties. So thank you for bringing this issue up!1a. Normally you would create a "visarea"1b. Then set your "visarea" to ignore skycolorREMOVEDUPLOADIn the mean time you can, for the sake of iteration adjust your "sky color multiplier" in the Environment settingsREMOVEDUPLOAD2a. Adjust your global fog color (which is multiplied against the sky)2b. Or also use probes in your GI settings (this will multiply the probe color against the GI result)I also included a snippet with the Integration Mode notes, for using probes with GIREMOVEDUPLOADAgain thanks for bringing some of these issues up, I will get the right eyes on it, as for workarounds, I hope the information I provided helps!-MajorBlissSharerePost-User-4093265answered 6 years ago0Good afternoon! I wanted to let you know I am looking into this issue and will communicate shortly!Thanks for the input!-MajorBlissSharerePost-User-4093265answered 6 years ago0I'm getting other kind of problems with vis areas maybe i'll post them in a specific thread.it is about probes turning off while still visible through a portalSharerePost-User-7621041answered 6 years ago0Thanks for your answer .What's the meaning for global enviroment probe?just the one with the most priority for the entire level or something else?What's the problem with visareas?SharerePost-User-7621041answered 6 years ago0No problem at all!Global probe is a large probe you would create to cover your whole level, so there is either secondary lighting, or reflections in areas where you have not created "local" or more refined probes. Basically, it fills in gaps where you need baked coverage.As for visareas some of the options, such as, "ignoregi" and "ignoreskycolor" do not seem to function currently, BUT I have gotten the issue in front of the correct people to resolve!-MajorBlissSharerePost-User-4093265answered 6 years ago0good to hear that , total illumination is a great system but few issues here and there makes it really unreliable, more consistency required. Please also check this other post with major details on few other issues with total illumination and SamplesProject\Levels\Samples\Particles_Technical_Sample where there are some issues with discrete light bounces and total illumination (bounces affects the wrong meshes if I remember well)SharerePost-User-7621041answered 6 years ago"


Question: MySQL on RDS: performance_schema has no SQL_TEXT and QUERY_SAMPLE_TEXT

"We're using Mysql 8.0.32 on RDS, with Performance Insights and auto-managed performance_schema.The performance_schema mostly works, but some fields are absent.On performance_schema.events_statements_summary_by_digest these fields are always empty:query_sample_textquery_sample_seenquery_sample_timer_waitFor example:> SELECT distinct query_sample_text FROM performance_schema.events_statements_summary_by_digest;NULL2) On performance_schema.events_statements_history_long, this field is always empty:sql_textFor example:> select distinct sql_text from events_statements_history_long;NULLThese tables do have the data, it's just these fields that are empty.On the same version of MySQL, deployed on a regular server, outside of AWS RDS, these fields are not empty, they contain data about SQL queries.I reviewed the server variables, and they seem to be good.Do you observe the same on your RDS?Any related AWS option/bug/feature, to fix it?FollowComment"


Question: Nucleus upgrade restarts a component install step before timeout expires

"I think this might be a bug, here is the scenario - in the same deployment upgrade aws.greengrass.Nucleus from any version (in my case 2.9.1) to 2.9.4 and an example component called com.example.longinstall .  Nucleus doesn't seem to respect the installing component install step timeout, and restarts everything in the middle of the install.  This is a problem for things like MSIs which are backgrounded and can't be interrupted.Component source:---RecipeFormatVersion: "2020-01-25"ComponentName: "com.example.longinstall"ComponentVersion: "1.0.0"ComponentType: "aws.greengrass.generic"ComponentDescription: "This component takes 120s to install"ComponentPublisher: "Me"Manifests:- Platform:    os: "windows"  Lifecycle:    Install:      Script: "powershell -command \"for ($i = 0; $i -lt 120; $i++){ 'Installing ('+$i+')'\        \ | Write-Output; Start-Sleep -Seconds 1 }\""      RequiresPrivilege: true      Timeout: 150    Startup:      Script: "powershell -command \"write-output Startup\""      RequiresPrivilege: true    Shutdown:      Script: "powershell -command \"write-output Shutdown\""      RequiresPrivilege: true  Artifacts: []Lifecycle: {}Log from component:2023-03-09T00:58:47.101Z [INFO] (pool-2-thread-22) com.example.longinstall: shell-runner-start. {scriptName=services.com.example.longinstall.lifecycle.Install.Script, serviceName=com.example.longinstall, currentState=NEW, command=["powershell -command \u0022for ($i = 0; $i -lt 120; $i++){ 'Installing ('+$i+')' | W..."]}2023-03-09T00:58:48.460Z [INFO] (Copier) com.example.longinstall: stdout. Installing (0). {scriptName=services.com.example.longinstall.lifecycle.Install.Script, serviceName=com.example.longinstall, currentState=NEW}2023-03-09T00:58:49.484Z [INFO] (Copier) com.example.longinstall: stdout. Installing (1). {scriptName=services.com.example.longinstall.lifecycle.Install.Script, serviceName=com.example.longinstall, currentState=NEW}2023-03-09T00:58:50.488Z [INFO] (Copier) com.example.longinstall: stdout. Installing (2). {scriptName=services.com.example.longinstall.lifecycle.Install.Script, serviceName=com.example.longinstall, currentState=NEW}2023-03-09T00:58:51.502Z [INFO] (Copier) com.example.longinstall: stdout. Installing (3). {scriptName=services.com.example.longinstall.lifecycle.Install.Script, serviceName=com.example.longinstall, currentState=NEW}..snip..2023-03-09T00:59:46.057Z [INFO] (Copier) com.example.longinstall: stdout. Installing (57). {scriptName=services.com.example.longinstall.lifecycle.Install.Script, serviceName=com.example.longinstall, currentState=NEW}2023-03-09T00:59:47.069Z [INFO] (Copier) com.example.longinstall: stdout. Installing (58). {scriptName=services.com.example.longinstall.lifecycle.Install.Script, serviceName=com.example.longinstall, currentState=NEW}2023-03-09T00:59:53.984Z [INFO] (pool-2-thread-10) com.example.longinstall: shell-runner-start. {scriptName=services.com.example.longinstall.lifecycle.Install.Script, serviceName=com.example.longinstall, currentState=NEW, command=["powershell -command \u0022for ($i = 0; $i -lt 120; $i++){ 'Installing ('+$i+')' | W..."]}2023-03-09T00:59:55.743Z [INFO] (Copier) com.example.longinstall: stdout. Installing (0). {scriptName=services.com.example.longinstall.lifecycle.Install.Script, serviceName=com.example.longinstall, currentState=NEW}2023-03-09T00:59:56.752Z [INFO] (Copier) com.example.longinstall: stdout. Installing (1). {scriptName=services.com.example.longinstall.lifecycle.Install.Script, serviceName=com.example.longinstall, currentState=NEW}..snip..2023-03-09T01:01:55.966Z [INFO] (Copier) com.example.longinstall: stdout. Installing (119). {scriptName=services.com.example.longinstall.lifecycle.Install.Script, serviceName=com.example.longinstall, currentState=NEW}2023-03-09T01:01:57.019Z [INFO] (pool-2-thread-10) com.example.longinstall: shell-runner-start. {scriptName=services.com.example.longinstall.lifecycle.Startup.Script, serviceName=com.example.longinstall, currentState=STARTING, command=["powershell -command \u0022write-output Startup\u0022"]}2023-03-09T01:01:58.281Z [INFO] (Copier) com.example.longinstall: stdout. Startup. {scriptName=services.com.example.longinstall.lifecycle.Startup.Script, serviceName=com.example.longinstall, currentState=STARTING}FollowCommentMichaelDombrowski-AWS EXPERT3 months agoWhere do you see the component is being "restarted"? If the startup is timing out you will see the log "Timeout in install" and the component will move to the errored state and then retry the installation. This log will be in the greengrass.log file.I see in your log that the startup script does execute which means that the installation must have completed.The timeout is definitely respected, but you may have something else going on which is causing a restart. You will need to review the greengrass.log file for things relating to your component.Cheers,MichaelShareMichaelDombrowski-AWS EXPERT3 months agoAnother possibility is that you are doing a local deployment but com.example.longinstall also exists in your AWS account. If you deploy, even locally, the cloud version of a component version will be deployed, not the local copy. So if this is the case, make sure you deploy a version which does not exist in your account.Sharepsact 3 months agoThis was with a cloud deployment, no local deployments ever on this machine.  The deployment file only includes these components:"components": {        "aws.greengrass.Cli": {            "componentVersion": "2.9.4"        },        "aws.greengrass.LocalDebugConsole": {            "componentVersion": "2.2.7"        },        "aws.greengrass.Nucleus": {            "componentVersion": "2.9.4"        },        "com.example.longinstall": {            "componentVersion": "1.0.0"        }    },You're right, it does complete the second time, but the timeout fires in greengrass.log at 00:59:17, when the install section started at 00:58:47, suspiciously 30 seconds. I can attach a santized log here in a minute.Sharepsact 3 months agoLooks like there's no attachment feature and each comment can only be 600char, so I'll put it in code blocks and hopefully not make the thread unreadable:Nuclueus restart2023-03-09T00:58:45.218Z [INFO] (pool-2-thread-16) com.aws.greengrass.deployment.activator.DeploymentActivator: Nucleus restart requested to complete bootstrap task. {}Component is restarted (but not installed?)2023-03-09T00:58:47.054Z [INFO] (Serialized listener processor) com.aws.greengrass.lifecyclemanager.GenericExternalService: service-config-change. Requesting restart for component. {configNode=services.com.example.longinstall.lifecycle.Install.Script, serviceName=com.example.longinstall, currentState=NEW}(part1)Sharepsact 3 months agoShutdown timeout exception:2023-03-09T00:59:17.073Z [ERROR] (pool-2-thread-16) com.aws.greengrass.lifecyclemanager.KernelLifecycle: services-shutdown-errored. {unclosedServices=[com.example.longinstall]}java.util.concurrent.TimeoutException  at java.base/java.util.concurrent.CompletableFuture.timedGet(CompletableFuture.java:1886)  at java.base/java.util.concurrent.CompletableFuture.get(CompletableFuture.java:2021)  at com.aws.greengrass.lifecyclemanager.KernelLifecycle.stopAllServices(KernelLifecycle.java:462)  at com.aws.greengrass.lifecyclemanager.KernelLifecycle.softShutdown(KernelLifecycle.java:478)  at com.aws.greengrass.lifecyclemanager.KernelLifecycle.shutdown(KernelLifecycle.java:516)  at com.aws.greengrass.lifecyclemanager.KernelLifecycle.shutdown(KernelLifecycle.java:498)  at com.aws.greengrass.lifecyclemanager.Kernel.shutdown(Kernel.java:273)<more stack trace>(part 2)ShareShow 3 more comments"


Question: AWS Greengrass v2 pull docker images from private a ECR registry in a different account

"Hi,I am currently deploying docker images using Greengrass Core v2 (GGC) to my edge devices. The docker images and GGC devices are located in the same account. This is working fine with the help of the aws.greengrass.DockerApplicationManager and aws.greengrass.TokenExchangeService components.Now, I was wondering if it is possible to deploy or pull docker images from a private ECR Registry in a different AWS account than the GGC device. I wouldn't currently know how and where to set appropriate permissions to allow this.As a workaround, I would otherwise consider the approach of cross-account replication. However, if there is a simpler way, I would be pleased to hear about it.Thanks in advance!FollowComment"

Answer: "1Accepted AnswerGreengrass doesn't support this directly. Using the builtin Docker image pulling support that Greengrass provides, your image must be in the same account and region that the Greengrass device is registered in.You may be able to download the image yourself by using the appropriate commands in your component recipe, but not in a directly provided and supported way. See the ECR documentation for downloading images yourself: https://docs.aws.amazon.com/AmazonECR/latest/userguide/docker-pull-ecr-image.htmlCommentShareEXPERTMichaelDombrowski-AWSanswered 5 months ago"


Question: my ec-2 instance limit

"Hello. When my friend set up ec-2 machine with aws account, 32 cpu limit was defined for him, but 8 cpu limit is defined for me. what is the reason of this ?FollowComment"

Answer: "0Different EC2 instance types have different VCPU limits.Please see the information in this link regarding Different instance types.Also confirm with your friend which Type they usedhttps://aws.amazon.com/ec2/instance-types/#:~:text=Amazon%20EC2%20provides%20a%20wide,of%20resources%20for%20your%20applications.CommentShareGary Mcleananswered 2 months ago0After both my friend and I installed the i3.xlarge machine, a 32 cpu limit was defined for my friend, but an 8 cpu limit was defined for me. We didn't do anything different.CommentSharerePost-User-5890860answered 2 months ago0Hi,Your quotas are based on your usage. Amazon EC2 will automatically increase your On-Demand Instance quotas based on your usage.You can read more about On-Demand Instance quotas in the EC2 User Guide at this link: https://docs.aws.amazon.com//AWSEC2/latest/UserGuide/ec2-on-demand-instances.html#ec2-on-demand-instances-limitsKind regards,MarilynAWSCommentShareMarilynAWSanswered 2 months ago"


Question: API Gateway Custom Domain Name | message:not found

"I tried to create a HTTP API through API Gateway.This API generated a URL e.g. https://{api-id}.execute-api.{region}.amazonaws.com/This URL works fine. After this; I created a custom domain name and under "Api Mappings", I added this newly created API., set the stage the $default and left Path (Optional) as blank. This generated another endpoint (which is supposed to be added as an A record in Route53). When I try to hit this new endpoint; I get {"message":"Not Found"}. I followed the documentation as mentioned, but seems to me, that something is missing - any pointers on how to make this work? (Its a minimal configuration and the SSL certificate for the domain is also added)FollowComment"

Answer: 0This debugging article from AWS Premium support may be helpful - https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-custom-domain-error/CommentShareEXPERTIndranil Banerjee AWSanswered 7 months ago0how did you solve it ? i've the same problem :(CommentSharecrisanswered a month ago


Question: How to further improve Sagemaker Canvas Model Score?

"Hi,I've started exploring and using Sage Maker canvas upon the pilot launch of the service a few months back. I wanted to ask if there's anyway I can further improve my model performance apart from what's available in the canvas console?JaniceFollowComment"

Answer: "1Accepted AnswerHi Janice,Given that Canvas is a no-code tool that abstracts and automate most of the model training process. Model tuning and training performance are mostly limited to the amount of data + your features selection when you train the model.Nonetheless, one key option you can adopt in improving your score is at the pre-processing stage (i.e feature engineering). Assuming you aren't a technical developer,  you can explore the use of AWS Data Brew.AWS Glue DataBrew is a no-code visual data preparation tool that makes it easy for data analysts and data scientists to clean and normalize data to prepare it for analytics and machine learning. You can choose from over 250 pre-built transformations to automate data preparation tasks, all without the need to write any code. You can automate filtering anomalies, converting data to standard formats, and correcting invalid values, and other tasks. After your data is ready, you can immediately use it for analytics and machine learning projects.In your case, you can store your initial data in S3 and have databrew performs feature engineering on it before writing it back to S3 again. From there, you can import the processed data back into Canvas and build your model from there. This should gives you a better score compared to building your model directly using the initial raw data.Data Brew Getting Started guide : LinkCheers.VincentCommentShareAWS-Vincentanswered a year ago"


Question: AWS Kinesis Video Stream WebRTC IoT credential setup

"Hello all, I am trying to connect to AWS Kinesis Video Streams using a webRTC tutorial. I am trying to use IoT credentials rather than the Access Key and Secret Key. I thought I followed the tutorial correctly but I get the error message "AWS_ACCESS_KEY_ID must be set"**More info below. **I created a IAM policy:KVSIoTCameraPolicy:  "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "kinesisvideo:DescribeStream",                "kinesisvideo:PutMedia",                "kinesisvideo:TagStream",                "kinesisvideo:GetDataEndPoint"            ],            "Resource": "arn:aws:kinesisvideo:*:*:stream/${credentials-iot:ThingName}/*"        },        {            "Effect": "Allow",            "Action": [                "kinesisvideo:DescribeSignalingChannel",                "kinesisvideo:CreateSignalingChannel",                "kinesisvideo:GetSignalingChannelEndpoint",                "kinesisvideo:GetIceServerConfig",                "kinesisvideo:ConnectAsMaster"            ],            "Resource": "arn:aws:kinesisvideo:*:*:channel/${credentials-iot:ThingName}/*"        }    ]}Connected to KvsIotCameraIAMRolecreated a thing: rpi*****generate/download Certificatesdownload RootCA1Added Thing to Thing Group: KvsCameraDevicesCreated Role Alias: KVSCameraIoTRoleAliasGenerated IoT Policy: KvsIoTDevicePolicy*KvsIoTDevicePolicy{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "iot:Publish",        "iot:Receive"      ],      "Resource": "arn:aws:iot:us-east-1:************:topic/${iot:Connection.Thing.ThingName}/*"    },    {      "Effect": "Allow",      "Action": "iot:Subscribe",      "Resource": "arn:aws:iot:us-east-1:************:topicfilter/${iot:Connection.Thing.ThingName}/*"    },    {      "Effect": "Allow",      "Action": "iot:AssumeRoleWithCertificate",      "Resource": "arn:aws:iot:us-east-1:************:rolealias/KVSCameraIoTRoleAlias"    },    {      "Effect": "Allow",      "Action": "iot:Connect",      "Resource": "*",      "Condition": {        "Bool": {          "iot:Connection.Thing.IsAttached": [            "true"          ]        }      }    }  ]}I followed a tutorial found here https://www.youtube.com/watch?v=9YI4POQVUl8&authuser=0 posted May 13, 2021. It matched up to current procedure fine until the editing of the Common.c file. I then switched to the instructions found at https://github.com/awslabs/amazon-kinesis-video-streams-webrtc-sdk-cInstructions:With the IoT certificate, IoT credentials provider endpoint (Note: it is not the endpoint on IoT AWS Console!), public key and private key ready, you can replace the static credentials provider createStaticCredentialProvider() and freeStaticCredentialProvider() with IoT credentials provider like below, the credentials provider for samples is in createSampleConfiguration():createLwsIotCredentialProvider(            "coxxxxxxxx168.credentials.iot.us-west-2.amazonaws.com",  // IoT credentials endpoint            "/Users/username/Downloads/iot-signaling/certificate.pem",  // path to iot certificate            "/Users/username/Downloads/iot-signaling/private.pem.key", // path to iot private key            "/Users/username/Downloads/iot-signaling/cacert.pem", // path to CA cert            "KinesisVideoSignalingCameraIoTRoleAlias", // IoT role alias            channelName, // iot thing name, recommended to be same as your channel name            &pSampleConfiguration->pCredentialProvider));freeIotCredentialProvider(&pSampleConfiguration->pCredentialProvider);However, this is listed in the Common.c file for createLwsIotCredentialProvider:#ifdef IOT_CORE_ENABLE_CREDENTIALS    CHK_STATUS(createLwsIotCredentialProvider(pIotCoreCredentialEndPoint, pIotCoreCert, pIotCorePrivateKey, pSampleConfiguration->pCaCertPath,                                              pIotCoreRoleAlias, channelName, &pSampleConfiguration->pCredentialProvider));#else    CHK_STATUS(        createStaticCredentialProvider(pAccessKey, 0, pSecretKey, 0, pSessionToken, 0, MAX_UINT64, &pSampleConfiguration->pCredentialProvider));And this for freeIotCredentialProvider:#ifdef IOT_CORE_ENABLE_CREDENTIALS    freeIotCredentialProvider(&pSampleConfiguration->pCredentialProvider);#else    freeStaticCredentialProvider(&pSampleConfiguration->pCredentialProvider);Which I assume already does what the instructions say but I changed it to this for createLwsIotCredentialProvider:#ifdef IOT_CORE_ENABLE_CREDENTIALS    CHK_STATUS(createLwsIotCredentialProvider(                           "coxxxxxxxx168.credentials.iot.us-west-2.amazonaws.com",  // IoT credentials endpoint                           "/Users/username/Downloads/iot-signaling/certificate.pem",  // path to iot certificate                           "/Users/username/Downloads/iot-signaling/private.pem.key", // path to iot private key                           "/Users/username/Downloads/iot-signaling/cacert.pem", // path to CA cert                           "KinesisVideoSignalingCameraIoTRoleAlias", // IoT role alias                           channelName, // iot thing name, recommended to be same as your channel name                           &pSampleConfiguration->pCredentialProvider));#else    CHK_STATUS(        createStaticCredentialProvider(pAccessKey, 0, pSecretKey, 0, pSessionToken, 0, MAX_UINT64, &pSampleConfiguration->pCredentialProvider));And this for freeIotCredentialProvider:#ifdef IOT_CORE_ENABLE_CREDENTIALS    freeIotCredentialProvider(&pSampleConfiguration->pCredentialProvider);#else    freeStaticCredentialProvider(&pSampleConfiguration->pCredentialProvider);Still I get the error message: AWS_ACCESS_KEY_ID must be setI then changed the createLwsIotCredentialProvider function to:#ifdef IOT_CORE_ENABLE_CREDENTIALS    CHK_STATUS(createLwsIotCredentialProvider(pIotCoreCredentialEndPoint, pIotCoreCert, pIotCorePrivateKey, pSampleConfiguration->pCaCertPath,                                              pIotCoreRoleAlias, channelName, &pSampleConfiguration->pCredentialProvider));#else    CHK_STATUS(createLwsIotCredentialProvider(                           "coxxxxxxxx168.credentials.iot.us-west-2.amazonaws.com",  // IoT credentials endpoint                           "/Users/username/Downloads/iot-signaling/certificate.pem",  // path to iot certificate                           "/Users/username/Downloads/iot-signaling/private.pem.key", // path to iot private key                           "/Users/username/Downloads/iot-signaling/cacert.pem", // path to CA cert                           "KinesisVideoSignalingCameraIoTRoleAlias", // IoT role alias                           channelName, // iot thing name, recommended to be same as your channel name                           &pSampleConfiguration->pCredentialProvider));And the "freeIotCredentialProvider" function to this:#ifdef IOT_CORE_ENABLE_CREDENTIALS    freeIotCredentialProvider(&pSampleConfiguration->pCredentialProvider);#else    freeIotCredentialProvider(&pSampleConfiguration->pCredentialProvider);Still I get the error message: AWS_ACCESS_KEY_ID must be set.I changed everything back to the original settings and  found that in the Samples.h file I have to uncomment a line to enable IoT core credentials.**I changed it from this: **/* Uncomment the following line in order to enable IoT credentials checks in the provided samples *///#define IOT_CORE_ENABLE_CREDENTIALS  1To this:/* Uncomment the following line in order to enable IoT credentials checks in the provided samples */#define IOT_CORE_ENABLE_CREDENTIALS  1I then repeated the same steps as above and got the same error message AWS_ACCESS_KEY_ID must be set.In the Common.c file in the createSampleConfiguration() function it does show that if IoT credentials are enabled, it should  check for the IoT credentials instead of the Access Key and Secret Key as shown here#ifdef IOT_CORE_ENABLE_CREDENTIALS    PCHAR pIotCoreCredentialEndPoint, pIotCoreCert, pIotCorePrivateKey, pIotCoreRoleAlias, pIotCoreThingName;    CHK_ERR((pIotCoreCredentialEndPoint = getenv(IOT_CORE_CREDENTIAL_ENDPOINT)) != NULL, STATUS_INVALID_OPERATION,            "AWS_IOT_CORE_CREDENTIAL_ENDPOINT must be set");    CHK_ERR((pIotCoreCert = getenv(IOT_CORE_CERT)) != NULL, STATUS_INVALID_OPERATION, "AWS_IOT_CORE_CERT must be set");    CHK_ERR((pIotCorePrivateKey = getenv(IOT_CORE_PRIVATE_KEY)) != NULL, STATUS_INVALID_OPERATION, "AWS_IOT_CORE_PRIVATE_KEY must be set");    CHK_ERR((pIotCoreRoleAlias = getenv(IOT_CORE_ROLE_ALIAS)) != NULL, STATUS_INVALID_OPERATION, "AWS_IOT_CORE_ROLE_ALIAS must be set");I am using a script to run the kvsWebRTCClientMasterGstreamerSample sampleScript:#!/bin/bashset +xexport AWS_IOT_CORE_THING_NAME=rpi******export CERTS_DIR=$HOME/export AWS_DEFAULT_REGION=us-east-1export AWS_IOT_CORE_CREDENTIAL_ENDPOINT=**************.credentials.iot.us-east-1.amazonaws.comexport AWS_IOT_CORE_ROLE_ALIAS=KVSCameraIoTRoleAliasexport AWS_IOT_CORE_CERT=$HOME/**********-certificate.pem.crtexport AWS_IOT_CORE_PRIVATE_KEY=$HOME/**********-private.pem.key export IOT_CA_CERT_PATH=$HOME/root-CA.crtexport AWS_KVS_CACERT_PATH=$HOME/amazon-kinesis-video-streams-webrtc-sdk-c/certs/cert.pemexport LD_LIBRARY_PATH=$HOME/amazon-kinesis-video-streams-webrtc-sdk-c/open-source/lib/ :$HOME/amazon-kinesis-video-streams-webrtc-sdk-c/build/$HOME/amazon-kinesis-video-streams-webrtc-sdk-c/build/kvsWebrtcClientMasterGstSample $AWS_IOT_CORE_THING_NAMEBut I still get the error message AWS_ACCESS_KEY_ID must be set.Can anyone tell me what I am doing wrong?FollowComment"

Answer: "0Please review this onehttps://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html# Add these lines, pleaseexport IOT_CORE_CREDENTIAL_ENDPOINT=$AWS_IOT_CORE_CREDENTIAL_ENDPOINTexport IOT_CORE_ROLE_ALIAS=$AWS_IOT_CORE_ROLE_ALIASexport IOT_CORE_CERT=$AWS_IOT_CORE_CERTexport IOT_CORE_PRIVATE_KEY=$AWS_IOT_CORE_PRIVATE_KEYCommentShareEXPERTsdtslmnanswered a month ago"


Question: Where to find AWS Redshift Release Notes?

"Previously AWS Redshift Release Notes used to be published on AWS Forums. Since the deprecation of AWS Forums platform, where can customers check for Redshift release notes for every release/cluster version?FollowComment"

Answer: "1Between now and next major release, Redshift release notes will be posted on this platform(re:Post). They can be searched with the phrase "AWS Redshift Maintenance Announcement". Starting with next major release in the mid of April, Redshift release notes for every cluster version will be posted on AWS Redshift public documentation, which will also support RSS feed to which Redshift customers can subscribe and get notified.Alternatively one can also find the description of the cluster version a Redshift cluster is patched to using the API DescribeClusterDbRevisionsCommentSharemeghanaAtAWSanswered a year agoEXPERTFabrizio@AWSreviewed a year ago"


Question: Best practices for securing service to service REST communication in a microservices architecture

"Hi all,With so many options available ((API Gateway REST API, HTTP API,  ALB ) I'm looking for best practices regarding internal service to service communication in a micro service architecture.Specific questions I have:Which load balancing service to choose when for internal service-to-service communication (API Gateway REST API, HTTP API,  ALB)?What is a best practice for securing internal microservices (just by IP range or OIDC) ?FollowComment"

Answer: "0Accepted AnswerThere are multiple considerations when building microservices. What is a good fit depends on your use case, for instance do you run servers or serverless, is service discovery needed, are the services sync or async in nature or mix - best practice can be different depending on the needs.I would recommend to read this white paper we have on microservices on AWS https://d1.awsstatic.com/whitepapers/microservices-on-aws.pdf. It will give good overview and lots of context how to approach microservices on AWS.CommentShareAWS-User-2851372answered 3 years ago"


Question: Delayed cron execution for scheduled task

"I have a scheduled task set to run Monday-Friday at 9am and 9pm EST.  This past Friday night, the task appears to have triggered based on the CloudWatch metrics for it, but the logs for the task did not appear until Sunday at 9pm.  Is this delay expected when using scheduled tasks in ECS?  If not, is there a way to tell why the delayed execution occurred?  If it is expected, is there a way to control it more granularly?FollowComment"

Answer: "0After some digging, it seems that this is related to timezones.  Our code has a check for hours to run, and due to the UTC timezone that the scheduled tasks run under, there is a conflict.CommentSharebradycharronanswered 2 years ago"


Question: Lightsail instance snapshot stuck in pending

"I created an instance snapshot, but it took too long and I decided to terminate the instance.Now the instance snapshot is stuck in pending state and I cannot delete it through the CLI, even after 8 hours.How do I resolve this issue and remove the instance snapshot?ThanksFollowComment"

Answer: "1The issue has been resolved. The snapshot took about 15h to complete, after which I have deleted the snapshot.CommentShareJiraffe7answered 2 years ago"


Question: Routing VPC to VPC traffic through an on-prem firewall via Transit Gateway

"A customer is trying to setup VPC to VPC routing through their on-prem firewall over TGW.  The desired behavior is that traffic from VPC-A will route through the on-prem firewall to get to VPC-B.  With the current setup, the traffic routes from VPC-A to VPC-B without making it to the on-prem firewall.  When we perform a traceroute, the 2nd hop in the path is a 169.254.x.x address, which I believe may be the DXGW or something similar.  I can replicate the same behavior If I have a 0.0.0.0 route defined to a nat gateway as well, but in that case the 2nd hop is the nat gateway address.  The customer POC setup is as follows:VPC-A - 10.0.0.0/24VPC-B - 10.0.1.0/24DXGW connected to DX via TVIFVPC-A-Route-Table Routes10.0.0.0/24, local0.0.0.0, TGWVPC-B-Route-Table Routes10.0.1.0/24, local0.0.0.0, TGWTGW -VPC-Traffic route tableassociations:VPC-AVPC-BPropagations:DXGWRoutes:On-Prem routes, propagated0.0.0.0/0, DXGW attachment, staticTGW - On-prem traffic route tableAssociations:DXGWPropagations:VPC-AVPC-BRoutes:10.0.0.0/2410.0.1.0/24I believe we are missing an explicit route to tell traffic to use the on-prem firewall for routing of VPC to VPC traffic, but I am not exactly sure of the best place to configure that in this scenario.FollowComment"

Answer: "0Accepted AnswerThe problem you are hitting is at DXGW. Since same DXGW is being used for egress/ingress path. DXGW can not allow you to route traffic for destination that is advertised from AWS side.You need to separate the egress path and ingress path. Possible options are 1) two separate DXGW paths, 2) one DXGW (egress) with one VPN(ingress) or vice versa, 3) two VPN connections (egress, ingress).At the same time I would advise customer to not do it as it is suboptimal routing, creates delay, dependency for intra region traffic on external connectivity. It is recommended to do that inspection via Inspection VPC which inspects the inter VPC traffic. You can use AWS Network Firewall or 3rd party firewalls in the inspection VPC.CommentShareEXPERTVKanswered 2 years ago"


Question: AWS Backup pricing for EFS explanation

"I noticed the costs for backing up EFS in Ireland region is as follows:Resource TypeWarm StorageCold StorageAmazon EFS File System Backup$0.05 per GB-Month$0.01 per GB-MonthAmazon EBS Volume Snapshot$0.05 per GB-Monthn/a†Amazon RDS Database Snapshot$0.095 per GB-Monthn/a†The example given for US East (N. Virginia) region is:Total usage (GB-Hours) = (400 GB x 15 days x (24 hours / day)) + (800 GB x 15 days x (24 hours / day)) = 432,000 GB-HoursWe add up GB-Hours and convert to GB-Month to calculate monthly charges:Total Monthly Storage Charge = 600 GB-Month x $0.05 = $30https://aws.amazon.com/backup/pricing/How is the 432,000 GB-Hours arrived at?My EFS metered size is 350 GiB. How much would it cost per month if I backup daily and weekly?Edited by: ec-confounder on Mar 20, 2020 5:53 AMEdited by: ec-confounder on Mar 20, 2020 5:54 AMFollowComment"

Answer: "0Stupid me! I worked it out.Total usage (GB-Hours) = (400 GB x 15 days x 24 hours) + (800 GB x 15 days x 24 hours) = 432,000 GB-HoursGB-Month= 432,000 GB-Hours / 720 hours per month = 600 GB-MonthTotal Monthly Storage Charge = 600 GB-Month x $0.05 = $30CommentShareec-confounderanswered 3 years ago"


Question: One glue job for multiple workflows

"Hello there:We have ingest jobs A, B, C, and D and Transformation jobs X and Y in PySparkFor Workflow 1:  the steps are:Once Job A, B, and C successfully doneStart transformation job XFor Workflow 2: the steps are:Once job A, C, and D are successfully doneStart transformation job YJobs A, B, C, and D need to run only once (if it runs in Workflow 1, it should nor run in Workflow 2)Does Glue job workflow support this?Please adviseThanks a lot in advanceLiFollowComment"


Question: Can I disable randomly generated suffixes to Job names in AWS Glue Blueprints?

"As the documentation mentions, https://docs.aws.amazon.com/glue/latest/dg/developing-blueprints-code-classes.html#developing-blueprints-code-jobclass, Glue Blueprints on a Blueprint run create Jobs and Crawlers with randomly generated suffixes at the end.Is there a way to disable this? It's making things complicated during migrations and ideally want to control the naming of the jobs ourselves by making them unique at creation time. The random suffixes are becoming a pain for deployment and future job updates and deployment across environments.FollowComment"


Question: Confusion on Greengrass Certificate Rotation

"I have a question around certificate rotation. As you know the MQTT server in GG uses a server certificate signed by a group CA certificate. In GG documentation it is mentioned that the certificate is rotated per the setting in greengrass (7 to 30 days). But it is not clear if it is the server certificate or the group CA itself. I found some previous posts that seem to indicate that both the group CA and server cert are rotated.However, in my testing that doesn't seem to be the case. On creation, group CA certificate seem to show an expiry date until the end of the century (2100). The expiry date on the server certificate seemed to match the duration specified in the setting, so my guess is that the setting is for server certificate and the group CA remains the same unless manually changed. However, when you change the slider to adjust the expiration time, the server certificate on GG core doesn't seem to get updated. Can someone clarify the rotation process, which certificate is it supposed to rotate and when?Here is the ultimate issue I am trying to solve for. I have a non Greengrass aware device that connects to Greengrass core using manually configured information (since it doesn't support discovery). I am trying to determine at what interval (or on what event) is it necessary to update the CA certificate on the client so it continues to make connection to Greengrass core MQTT broker.FollowComment"

Answer: "1Accepted AnswerYou should not need to run discovery every time the MQTT server certificate is rotated. When you do discovery, you obtain the GG root CA, which, as you mention expires in 2099. This certificate is not automatically rotated, but can be forced using the Rotate CA button in the console or by using CreateGroupCertificateAuthority. https://docs.aws.amazon.com/greengrass/latest/apireference/creategroupcertificateauthority-post.htmlSo, if you used the console option to Rotate the CA, you actually did generate a new CA and  a new server cert which eventually required your devices to do a new discovery.There is currently no way to force the rotation of the MQTT server certificate independently from the group CA - in order to do a test you will need to wait 7 days.=== EDIT ===You can also change the connectivity information for your GG group to force a server certificate rotation, as this information is part of the certificateCommentShareEXPERTMassimilianoAWSanswered 2 years ago"


Question: EC2 Launch Template doesn't start Spot Instance (but works for on-demand instance)

"My EC2 launch template doesn't work when using it to launch a Spot instance. The launch template is set to launch a c5.xlarge instance associated to a pre-existing Elastic Network Interface @ index 0.When launching a spot instance, I receive the following cryptic message, and the spot request fails:c5.xlarge, ami-b2b55cd5, Linux/UNIX: A network interface may not specify both a network interface ID and a subnetFirst off, how can a network interface specify a network interface id? I believe this error means to say "a spot instance may not specify both a network interface ID and a subnet", but I can't be sure. Secondly, my launch template doesn't specify a subnet directly - it only specifies a network interface ID, which in turn specifies the subnet.As a troubleshooting step, I've tried launching an on-demand EC2 instance directly using the same launch template, via "Launch Templates -> Actions -> Launch Instance from Template" - when I do this, the EC2 instance launches successfully.I've been able to reproduce this error consistently for over 9 months now, and am surprised that no one else has brought this up. What gives?Here is my Spot config:"MySpotFleet" : {        "Type" : "AWS::EC2::SpotFleet",        "Properties" : {        "SpotFleetRequestConfigData" : {"AllocationStrategy" : "lowestPrice","IamFleetRole" : {"Fn::GetAtt" : ["MyIAMFleetRole", "Arn"]},"InstanceInterruptionBehavior" : "stop",    "LaunchTemplateConfigs": [        {            "LaunchTemplateSpecification": {                "LaunchTemplateId": { "Ref" : "MyLaunchTemplate" },                "Version": { "Fn::GetAtt" : [ "MyLaunchTemplate", "LatestVersionNumber" ]}            }        }    ],"ReplaceUnhealthyInstances" : false,"SpotMaxTotalPrice" : "5.01","SpotPrice" : "5.01","TargetCapacity" : 1,"TerminateInstancesWithExpiration" : false,"Type" : "maintain","ValidFrom" : "2021-01-01T00:00:00Z","ValidUntil" : "2050-12-31T23:59:59Z"        }        },            "DependsOn": [                "MyLaunchTemplate"             ]    }If I replace the above Spot config with this on-demand instance config, it works:"MyInstance" : {        "Type" : "AWS::EC2::Instance",        "Properties" : {"LaunchTemplate" : {                "LaunchTemplateId": { "Ref" : "MyLaunchTemplate" },                "Version": { "Fn::GetAtt" : [ "MyLaunchTemplate", "LatestVersionNumber" ]}}        },            "DependsOn": [                "MyLaunchTemplate"             ]    }If it helps, here is my Launch Template:"MyLaunchTemplate" : {        "Type" : "AWS::EC2::LaunchTemplate",        "Properties" : {"LaunchTemplateName":"MyLaunchTemplate","LaunchTemplateData":{"IamInstanceProfile" : {"Arn" : {"Fn::GetAtt" : ["MyEC2IAMInstanceProfile", "Arn"]}},"ImageId" : "ami-b2b55cd5","InstanceType": "c5.xlarge","NetworkInterfaces" : [{         "NetworkInterfaceId" : {"Ref" : "MyENI00"},          "DeviceIndex" : "0"     }],"InstanceInitiatedShutdownBehavior" : "stop","KeyName" : "my-keypair"        }    }And the ENI in question:        "MyENI00": {            "Type": "AWS::EC2::NetworkInterface",            "Properties": {                "Description" : "MyENI00",                "GroupSet" : [                 {"Ref" : "MySecurityGroup"}             ],                "PrivateIpAddresses": [ {"Primary" : true,"PrivateIpAddress" : "172.16.0.100"},{"Primary" : false,"PrivateIpAddress" : "172.16.0.101"}                ],                "SourceDestCheck": false,                "SubnetId": { "Ref" : "MySubnet" }            }        }FollowCommentPritam_P a year agoWhat You are doing is Launching a Spot Fleet = Which can be 1 or more than 1 Spot Instances based on Config. Have u tried launching a Single Spot Instance ( Not Fleet) using Run Spot request ?What is happening here is Spot Fleet trying to check all available AZs and its conflicting with conditions like NetworkInterfaces which are. Subnet Based ( AZ bound )Share"

Answer: "0Hello,I understand that you are trying to launch a spot instance with the given config but are receiving the error: "A network interface may not specify both a network interface ID and a subnet".Currently it is not possible to include a networkinterfaceId on a spotfleet.CLI documentation: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/request-spot-fleet.htmlAfter analyzing your spot config I noticed that your "AllocationStrategy" is set to "lowestprice". This leads to spot instances being launched in spot instance pools with the lowest price in the default subnet of an AZ. Your spot instance is attempting to launch in the default subnet of an AZ, but according to your launch template the ENI to be attached to the instance has another subnet ID specified. This causes both the subnet ID of the spot instance and the given subnet ID of the ENI to be used when launching the instance.This process is not followed when launching an on-demand instance which explains why it works during your troubleshooting session.Here are examples of spot fleet configurations: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-fleet-examples.htmlCommentSharePrithvidhar_Panswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: Pass additional parameters to cron destination

I have 5 crons which have separate destination lambdas. All lambdas do same work except they just pass a different parameter to a common downstream. Currently there is no way to pass additional parameter alongside cron so that I can have 1 lambda as destination for 5 crons instead of 5 different ones. Can you add this feature?FollowComment

Answer: "1Hi,I assume you created your cron using an eventbridge rule. If that's the case, and you trigger all 5 lambdas using the exact same cron schedule, and your parameters are fixed, did you try the following?on your eventbridge rule, create 5 targetsevery target calls your lambdain every target, open the additional settings panel, set "configure target input" to "Constant (json text)", and in the "Specify the constant in JSON" editor, add the parameters you need to pass to your lambda, e.g. {"region": "eu-west-1", "myParam": "paramValue" }in your lambda, read the parameters that you have set in the eventbridge rule using the event inputExample using the ruby languagedef lambda_handler(event:, context:)    symbol_event = JSON.parse(JSON[event], symbolize_names: true)    puts symbol_event[:region]endHope that's what you're looking for. If not, please let me know what I missed in your case.CommentShareJscanswered a year ago0You can configure the payload that will be sent to the targets by specifying a Constant json object. Each target will have a different value.CommentShareEXPERTUrianswered a year ago"