Question: Linux c++ Plugin doesn't run on Amazon Linux

"Hi there,I am having issues with running an Unreal Engine 4 game with GameLift integrated on an amazon linux server.It appears that the .SO file doesn't have what it needs to run.I built the SO file as instructed in the readme on an Ubuntu server./local/game/CharAnim/Binaries/Linux/CharAnimServer: /usr/lib64/libstdc++.so.6: version `GLIBCXX_3.4.20' not found (required by /local/game/CharAnim/Binaries/Linux/../../Pl ugins/GameLiftServerSDK/ThirdParty/GameLiftServerSDK/Linux/x86_64-unknown-linux-gnu/libaws-cpp-sdk-gamelift-server.so)/local/game/CharAnim/Binaries/Linux/CharAnimServer: /usr/lib64/libstdc++.so.6: version `CXXABI_1.3.8' not found (required by /local/game/CharAnim/Binaries/Linux/../../Plug ins/GameLiftServerSDK/ThirdParty/GameLiftServerSDK/Linux/x86_64-unknown-linux-gnu/libaws-cpp-sdk-gamelift-server.so)/local/game/CharAnim/Binaries/Linux/CharAnimServer: /usr/lib64/libstdc++.so.6: version `CXXABI_1.3.9' not found (required by /local/game/CharAnim/Binaries/Linux/../../Plug ins/GameLiftServerSDK/ThirdParty/GameLiftServerSDK/Linux/x86_64-unknown-linux-gnu/libaws-cpp-sdk-gamelift-server.so)/local/game/CharAnim/Binaries/Linux/CharAnimServer: /usr/lib64/libstdc++.so.6: version `GLIBCXX_3.4.22' not found (required by /local/game/CharAnim/Binaries/Linux/../../Pl ugins/GameLiftServerSDK/ThirdParty/GameLiftServerSDK/Linux/x86_64-unknown-linux-gnu/libaws-cpp-sdk-gamelift-server.so)/local/game/CharAnim/Binaries/Linux/CharAnimServer: /usr/lib64/libstdc++.so.6: version `GLIBCXX_3.4.21' not found (required by /local/game/CharAnim/Binaries/Linux/../../Pl ugins/GameLiftServerSDK/ThirdParty/GameLiftServerSDK/Linux/x86_64-unknown-linux-gnu/libaws-cpp-sdk-gamelift-server.so)Can this be looked into please?FollowComment"

Answer: "0Hello @REDACTEDUSERThis looks like a GCC version mismatch between the one used to compile on Ubuntu and the version installed on AMAZON_LINUX.Found this article that might help.What are the versions you currently use? (gcc --version)Hope this helps.AlexisCommentSharerePost-User-4132750answered 6 years ago0I am currently trying to build the SDK on a Amazon Linux ec2 instance, what a terrible experience.Firstly, the SDK doesn't support the default cmake version installed on Amazon Linux.Secondly, curl by default doesn't have SSL enabled so when it downloads dependencies for the SDK it fails.Any assistance would be great.gcc --versiongcc (GCC) 4.8.3 20140911 (Red Hat 4.8.3-9)Copyright (C) 2013 Free Software Foundation, Inc.This is free software; see the source for copying conditions. There is NOwarranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.gcc -vUsing built-in specs.COLLECT_GCC=gccCOLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-amazon-linux/4.8.3/lto-wrapperTarget: x86_64-amazon-linuxConfigured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --with-bugurl=http://bugzilla.redhat.com/bugzilla --enable-bootstrap --enable-shared --enable-threads=posix --enable-checking=release --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-gnu-unique-object --enable-linker-build-id --with-linker-hash-style=gnu --enable-languages=c,c++,fortran,ada,lto --enable-plugin --enable-initfini-array --disable-libgcj --with-isl=/builddir/build/BUILD/gcc-4.8.3-20140911/obj-x86_64-amazon-linux/isl-install --with-cloog=/builddir/build/BUILD/gcc-4.8.3-20140911/obj-x86_64-amazon-linux/cloog-install --enable-gnu-indirect-function --with-tune=generic --with-arch_32=x86-64 --build=x86_64-amazon-linuxThread model: posixgcc version 4.8.3 20140911 (Red Hat 4.8.3-9) (GCC)CheersCommentSharerePost-User-3267681answered 6 years ago0Building the game is done on Windows. I build for the game's Linux Server on Windows. I used an Ubuntu VPS to build the SDK, as I was unable to do this on Windows, and that's where the first compatibility issues came. I also tried (and failed) to build the SDK on a Amazon Linux EC2 instance (which I assume is the best way to do this to get compatibility?).CommentSharerePost-User-3267681answered 6 years ago0Hi @REDACTEDUSERAny luck on this?I'd like to better understand your workflow.My understanding is that you build the SDK on Ubuntu and also build your Unreal game on Ubuntu.Then, you create a standalone build of your game and upload it to GameLift, is that right?AlexisCommentSharerePost-User-4132750answered 6 years ago0Any advise? How would you suggest I build the .so files to run on amazon linux if amazon linux can't even build it?CommentSharerePost-User-3267681answered 6 years ago0@REDACTEDUSERCommentSharerePost-User-3267681answered 6 years ago0Hi @REDACTEDUSERI'll try and reproduce the issue over here and get back to you as soon as I find a workaround.AlexisCommentSharerePost-User-4132750answered 6 years ago0Hello @REDACTEDUSERI just finished a round of tests.Here's what I did to get around the "GLIBCXX" errors you are experiencing.First, I spun up an Ubuntu VM. I'm using Ubuntu 14.04.On that machine, I have the default versions for:cmake version 3.2.2gcc (Ubuntu 4.8.4-2ubuntu1~14.04.3) 4.8.4GNU Make 3.81I built the sdk using:wget https://s3-us-west-2.amazonaws.com/gamelift-release/GameLift_04_11_2017.zipunzip GameLift_04_11_2017.zipcd GameLift-SDK-Release-3.1.5/GameLift-Cpp-ServerSDK-3.1.5/mkdir outcd outcmake .. -DBUILD_FOR_UNREAL=1 makeI took libaws-cpp-sdk-gamelift-server.so and copied it over to my Windows box.After that, I built a Linux flavored Unreal Server from Windows following the steps described here: https://wiki.unrealengine.com/Compiling_For_LinuxI am on Unreal 4.13, so I used the v7 of their toolset.Once I had my standalone build, I uploaded it to a vanilla Amazon_Linux box.From there, I ran 'ldd' on the executable (GameLiftFPSServer in my case).Here's the outputs:ldd GameLiftFPSServer linux-vdso.so.1 => (0x00007fff135c0000)libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fd1ddb23000)libdl.so.2 => /lib64/libdl.so.2 (0x00007fd1dd91f000)libaws-cpp-sdk-gamelift-server.so => /tmp/UnrealFromWin/LinuxNoEditor/GameLiftFPS/Binaries/Linux/./libaws-cpp-sdk-gamelift-server.so (0x00007fd1dd3a1000)librt.so.1 => /lib64/librt.so.1 (0x00007fd1dd198000)libm.so.6 => /lib64/libm.so.6 (0x00007fd1dce96000)libc.so.6 => /lib64/libc.so.6 (0x00007fd1dcad4000)/lib64/ld-linux-x86-64.so.2 (0x00005639fb377000)libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007fd1dc8bd000)libstdc++.so.6 => /usr/lib64/libstdc++.so.6 (0x00007fd1dc5b8000)So, as you can see, both installed libstdc++ and libc libraries are found and loaded properly.Hopefully this helps you. Let me know if that all made sense.Cheers!AlexisCommentSharerePost-User-4132750answered 6 years ago0Oddly enough I just experienced this myself when building the GameLiftServerSDK for Unreal Engine. Although the library files may build successfully, you can still experience similar issues to what OP encountered after uploading a game server build with the generated libaws-cpp-sdk-gamelift-server.so to GameLift and creating a fleet with that build. Keep in mind that you won't specifically see errors like those in OP's original post until you ssh into a Amazon Linux EC2 instance in your fleet (in the FAILED state) and try to run the server executable from there.To fix this, if you are cross compiling the GameLiftServerSDK library files for Linux from Windows using the Ubuntu Windows Subsystem For Linux, make sure to get Ubuntu 18.04 LTS, not regular Ubuntu (which defaults to version 20.04) or Ubuntu 20.04 LTS, from the Microsoft Store. If you use a newer version of Ubuntu (20.04 for e.g.), the versions of cmake, gcc, and make are too new for the Amazon Linux EC2 instances. The newest versions of these same tools for Ubuntu 18.04, according to the Advanced Package Tool (APT), are as follows:cmake version 3.10.2gcc (Ubuntu 7.5.0-3ubuntu~18.04)GNU Make 4.1Building the GameLift Server SDK, specifically version 4.0.0, with these utilities on the Ubuntu 18.04 environment worked for me.CommentSharerePost-User-5100160answered 3 years ago0Thanks Chrisgong, that solve my problem !CommentSharerePost-User-1305385answered 3 years ago0Hi, I know this is a very old post, but I figured out those parts already if it can help others bumping into this.. Most of what I say here was also mentioned by others.You can build on an EC2 like you did, or in my case, I ran a local docker container using this image:FROM amazonlinux:latestAnd built it in there.Then, i had to use libwebsockets, curl, and jsoncpp.I had to install them like this:# Lib websockets are not part of the default repo, so setup another oneyum install -y wgetwget https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm -P /tmpyum install -y /tmp/epel-release-latest-7.noarch.rpm# install build toolsyum groupinstall -y "Development Tools"# Default cmake doesn't work with amazon SDK! Use cmake3yum install -y cmake3# Install libcurl and openssl separatelyyum install -y libcurl-develyum install -y openssl-devel# jsoncppyum install -y jsoncpp-devel# libwebsocketsyum install -y libwebsocketsyum install -y libwebsockets-devel# nodejs is required for amazon SDK to install...yum install -y nodejs# Build gamelift SDK first and install itmkdir -p GameLift-Cpp-ServerSDK-3.4.1/buildcd GameLift-Cpp-ServerSDK-3.4.1/buildcmake3 -DCMAKE_BUILD_TYPE=Release VERBOSE=1 ..make -j16cd ../..# build appmkdir -p buildcd buildcmake3 -DCMAKE_BUILD_TYPE=Release -DGAME_LIFT=1 VERBOSE=1 ..RUN make -j16# Make sure amazon CLI is installed# (Otherwise I couldn't call into it, somehow... even on an amazon linux 2 iamge)pip3 install --upgrade awscli# Setup awscli credentialsaws configure set default.region us-west-2aws configure set aws_access_key_id ...put your access key id...aws configure set aws_secret_access_key ...put your secret key...aws ecr get-login# Upload custom server to gameliftaws gamelift upload-build --name MyExecutable --build-version 1.0.0 --build-root build --operating-system AMAZON_LINUX_2 --region us-west-2CommentSharerePost-User-2813319answered 2 years ago"


Question: Can we have the total amount divided into smaller parts and get charged via multiple cards?

"We are a startup based in India and are using AWS for our entire tech stack from a long time. Recently, our EC2 reserved instances expired and we upgraded to Savings plan for them. Our credit card is declining the partial payment amount because it is high for a lump sum amount. The plan already got rejected once due to this. We have applied again.Can we have the total amount divided into smaller parts and get charged via multiple cards? Do we have any other mode of payment like payment via link, bank transfer, cheque etc. to complete this process asap.We are getting charged on the on-demand pricing that is costing us a lot. Any help is highly appreciated.FollowComment"

Answer: "1Hello,As I understand, you would like to know if the total amount for a Savings plan can be divided into smaller parts and get charged via multiple cards. For payment and billing related questions, I suggest creating a support case [1] with our Billing team to gain specific payment and billing related information.[1] Creating support cases and case management - https://docs.aws.amazon.com/awssupport/latest/user/case-management.htmlCommentShareRahul_Ganswered a year agoEXPERTNataliya_Greviewed a year ago"


Question: Logging which account used which email address

"I am trying to figure out what email address is being used by a specific IAM user.  I followed the article here: https://aws.amazon.com/premiumsupport/knowledge-center/ses-iam-user-sent-email/ to log which IAM user is sending emails through SES.  But I am unsure what dimension to use to also get the email address used.  I can't find any documentation on the dimensions available for either Message Tag or Email Header.Thanks,JoshFollowComment"

Answer: 0Accepted AnswerI was able to add "Email Header" "from" as a second item to my already "Message Tag" "ses:caller-identity".  This gives me the information I was looking for.  A list of all available dimensions will still be nice.CommentSharejswainanswered a year ago


Question: Cannot Update Trail with CloudWatch Log Group via Boto3

"Hey all,I'm trying to update my CloudTrail trail with a CloudWatch Log Group. I firstly create an IAM Role (that will be assumed by CloudTrail), I then create the CloudWatch Group and run the update_trail Boto3 API call. The error I receive when trying to update is:"errorCode": "InvalidCloudWatchLogsRoleArnException"    "errorMessage": "Access denied. Check the trust relationships for your role."The API request extracted from CloudTrail itself looks like:{    "eventVersion": "1.05",    "userIdentity": {        "type": "AssumedRole",        "principalId": "<principal_id>:auto-remediate-dev",        "arn": "<sts_arn>",        "accountId": "<acc_num>",        "accessKeyId": "<access_key>",        "sessionContext": {            "sessionIssuer": {                "type": "Role",                "principalId": "<principal_id>",                "arn": "arn:aws:iam::<acc_num>:role/auto-remediate-dev-AutoRemediate-<region>-lambdaRole",                "accountId": "<acc_num>",                "userName": "auto-remediate-dev-AutoRemediate-<region>-lambdaRole"            },            "webIdFederationData": {},            "attributes": {                "mfaAuthenticated": "false",                "creationDate": "2019-05-15T09:13:30Z"            }        }    },    "eventTime": "2019-05-15T09:58:20Z",    "eventSource": "cloudtrail.amazonaws.com",    "eventName": "UpdateTrail",    "awsRegion": "<region>",    "sourceIPAddress": "13.238.217.58",    "userAgent": "Boto3/1.9.42 Python/3.7.3 Linux/4.14.109-80.92.amzn1.x86_64 exec-env/AWS_Lambda_python3.7 Botocore/1.12.42",    "errorCode": "InvalidCloudWatchLogsRoleArnException",    "errorMessage": "Access denied. Check the trust relationships for your role.",    "requestParameters": {        "name": "MaratTest",        "cloudWatchLogsLogGroupArn": "arn:aws:logs:<region>:<acc_num>:log-group:/aws/cloudtrail/MaratTest:*",        "cloudWatchLogsRoleArn": "arn:aws:iam::<acc_num>:role/CloudTrail-CloudWatchLogs-MaratTest"    },    "responseElements": null,    "requestID": "3244c931-3892-4fca-9664-df38cdb3be54",    "eventID": "0d5a1e82-95be-46b5-a430-91a407bd7b13",    "readOnly": false,    "eventType": "AwsApiCall",    "recipientAccountId": "<acc_num>"}The strange thing about this is, when I use the exact same IAM Role and CloudWatch Log Group but initiate the CloudTrail update via the console, it all works perfect and then exact same API request is captured by CloudTrail but is successful this time.I'm not sure what the error could be and nothing I've researched has helped me find the right solution. Any help would be greatly appreciated.FollowComment"

Answer: "0Accepted AnswerIt is possible that the IAM role was not propagated yet when you attempted to update the trail.  Is the problem still occurring?If so,  I recommend that you double-check the role policy and trust relationships as the next step.If the issue is not resolved, you could post the role policy and trust policy or you could open a case with AWS support to dive deeper.CommentShareAWS-User-3197379answered 4 years ago0Thanks very much Jeff. We actually solved this a couple of hours after posting. The answer was as you first mentioned... the IAM Role had not propagated throughout the system quickly enough for me to assign it.CommentSharemlevitanswered 4 years ago"


Question: SSH from Mac gives error

Executing an SSH commend from Mac terminal with the pathname for the pem file gives an error:Warning: Identity file /Userkeypair.pem not accessible: No such file or directoryFollowComment

Answer: "1It maybe seems to be not AWS problem but your mac environment problem.is '/Userkeypair.pem' really your EC2 instance's identity file?If so, Try specifying your identity file in your computer with an absolute path.If you still get an error, write the command you just executed.CommentSharepypypyo14answered a year ago1Make sure you are ssh in the same directory with the correct .pem file. Also change the permissions on the file so that only you (as the file owner) can read it. I ran into the same error when trying to ssh to my website about best stock research websitesCommentShareAWS-User-1617512answered a year ago"


Question: Unable to SSH into my EC2 Instance Permission denied (publickey)

"Hello!I keep getting Permission denied (publickey) when I attempt to log into my instance.The key pair was lost for my instance. I created a new (temporary) instance with a new Key Pair and attached it to the volume from the main instance. From here I was was able to connect via ssh and I went through all the steps from this link... hhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#replacing-lost-key-pairI thought I was set but, I keep getting Permission denied (publickey) when I attempt to log in with the new key. Any help would be greatly appreciated!My Instance ID is i-076850d43eaaf5ee3Edited by: RebelGrot on Apr 16, 2019 2:26 PMFollowComment"

Answer: "0Hi RebelGrot,Generally, as noted in the AWS documentation here [1], 'Permission Denied' error messages when attempting to SSH are commonly caused by either 1) incorrect username, 2) incorrect private key or 3) incorrect OS level permissions.Since you already attempted to change the private key with no success, I would also recommend reviewing the following permissions (mount point refers to the recovery mount point you attached the volume on your temporary instance):chmod 755 <mount_point>/homechmod 700 <mount_point>/home/ec2-userchmod 700 <mount_point>/home/ec2-user/.sshchmod 600 <mount_point>/home/ec2-user/.ssh/authorized_keysAdditionally, I would also recommend reviewing your SSH configuration file <mount_point>/etc/sshd_config.Thanks.[1] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesConnecting.html#TroubleshootingInstancesConnectingMindTermCommentShareAWS-User-5964800answered 4 years ago0Thanks LoiyAWS! I am a bit of a newb when it comes to command line and ssh.I am going to give these permission changes a try again. I'll check back and let you know how it goes.Edited by: RebelGrot on Apr 24, 2019 9:30 PMCommentShareRebelGrotanswered 4 years ago0I changed the permissions and still got the result of Permission Denied (publicly). So I created a new key pair and a new recovery instance and went through the process again. This time it worked!CommentShareRebelGrotanswered 4 years ago"


Question: Application Connections after PITR Aurora Postgres or DynamoDB

"Hi! First question on this forum and it may seem trivial, but I'm trying to get around seamless reconnections of applications and interfaces after Point in Time Recovery. PITR of Aurora Instances and DynamoDB tables always result in new instances of either being created. Potentially these could be hosting connections from many targets. My experience (more that 2 decades) is with the likes Oracle and SQL Server and in situ restores/recoveries so no need to repoint applications. How are people handling the change of database target if they have to performs such a recovery?(We are thinking of going RDS rather than Aurora because we can understand the process there, but this seems like a poor reason to choose one over the other).Thanks,JohnFollowComment"

Answer: "1I can answer in terms of DynamoDB but not the relational tables as they both use a different means of connections. For DynamoDB its common to use Parameter Store to store the table name. Your application would always retrieve the table name from the parameter store, meaning if you need to restore the table to one with a new name, that just means you need to update one value in parameter store and your applications will automatically resolve the correct table name.CommentShareEXPERTLeeroy Hannigananswered 6 months ago"


Question: Call Recording on Demand

"Hi, Is it possible to have call recordings enabled on demand?  I would like the ability for the agents to toggle the recording feature on/off.I thought about transferring to another flow that enables call recording but quick connect does not allow for voice contact flow transfers.  I also tried Queue transfers but don't want the call to go to another agent.Am I missing something, any ideas?Thanks.FollowComment"

Answer: "0Currently, the only way to a achieve this is to1- Do the transfer you suggested.2- Use live media streaming (KVS) you have control of the pause / resume3- Timestamp the event and silence the section required in post processingHowever, the real question is, what are you trying to do that needs pause/resume? PCI payments?ThxDanCommentShareDanBloyanswered 3 years ago0From the GPDR customers can revoke the agreement for CallRecordings in the same phone call and then you have as provider the issue to do that.We also only provide a custom button in the CCP, that flags the current call recording to be deleted afterwards. As soon as the recording was written to the S3 bucket, a S3 notifier checks for this flag and  delete the call recording if this flag is true.For sure, this is not 100% compliant with the GDPR, but the recording will be deleted post-processing.Edited by: ADiedler1979 on Apr 9, 2020 7:28 AMCommentShareADiedler1979answered 3 years ago0Hi, thanks for the suggestions.  The request is not payment info driven.  We have a dept that requires some part of a conversation to be recorded but not the entire conversation.  The calls begin with recordings turned off until the conversation is needed to be recorded.ThanksCommentShareMuaGSanswered 3 years ago0Thx for the use case. I’m not seeing a different way, other than the 3 called out in my last post. I’m sure we’ll see more options in the future, that’ll make this easier for you. Over the last few years many API enhancements have been made.CommentShareDanBloyanswered 3 years ago0Hi MuaGS, I had the same problem and I solved it using Quick Connect capability (it's a work around). In a couple of words, in order:Step 1) I created a new Transfer Queue contact flow (called "Start Recording") with the call recording block enable (Customer and Agent), that terminates with the Transfer Queue blockWe'll use that Contact Flow in the Quick Connect definitionStep 2) I created 1 Queue x agent (called "Queue 1")Step 3) I created 1 Profile Routing (called "Route 1") and set up the queue "Queue 1" in the Default Outbound Queue attributeStep 4) I created 1 Quick Connect called "Connect 1" with type Queue; the Destination is "Queue 1" and as Contact Flow "Start Recording" (created in the Step 1)Step 5) After having created the Quick Connect, I modified the Quick Connects attribute in the Queue "Queue 1" set up "Connect 1"Step 6) I created 1 user as Agent and set up the "Route 1" as profiling route attributeYou have to repeat all the Steps from 2 to 6 for each Agent that potentially manage the outbound call (attention to the Service Quotas https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-service-limits.html).In this way, when the Agent calls a Customer he can choose to start the call recording on demand selecting the Quick Connect. Of course, with 1 queue x agent when the internal-transfer is completed, the call returns to the original agent.I hope this scenario may be feasyble and usefull also for you.Regards,CommentSharecma74answered 3 years ago0Hello,Thank you for the input and suggestion.  This is give me a good foundation to start.I appreciate it,MCommentShareMuaGSanswered 3 years ago0I am also looking for something like this.We need to have the ability to cease recording if a customer wishes not to be recorded.Currently our only option is to end the call and call the customer back from a separte line that is not recorded. This is not ideal and leads to poor customer service.I have tried to use a quick connect to switch the "Set Call recording and Analytics behavior" to "none" but this has no effect.This should be a fundamental function, simply being able to terminate the recording.Has anyone got a workable solution?With 80+ agents it is NOT workable to create queues and profiles for each agent to have them able to bounce the call that way. it needs to be functional to stop the recording easily and stay with the same agent.CommentShareAdamAbberfieldanswered 3 years ago0After posting the original request back in Apr, I followed up with amazon and was made aware of this info hot off the press!https://aws.amazon.com/blogs/contact-center/pausing-and-resuming-call-recordings-with-a-new-api-in-amazon-connect/I was able to successfully implement and get this new API functioning.Hope this helps someone needing a similar solution.CommentShareMuasGSanswered 3 years ago"


Question: Codepipeline got stuck with deploy "in progress" ... but deploy was done

"Hi, we are experiencing a strange behavior in our pipeline flow. Step from source pulling e image building are correctly marked as succeeded in pipeline but the procedure fall in a "in progress" state for the deploy step. Anyway, when I check ECR panel, I can see the image correctly deployed to cluster. Nothing was changed in the last days about the pipeline setting up, just as usual new commits. Logs are clean and nothing can point me to resolve this issue. Is there something that I can check further to fix this situation? Thanks!FollowComment"


Question: Unable to train custom label object localization model: Amazon Rekognition experienced a service issue

"Hello,I have tried to train Amazon Rekognition Custom Label object localization model on 105,000 images. I have tried training the model 2 times and reduced training datasets to 70,000 and 55.000, but all I am getting a "training failed" message after almost 48 hours of training with status message: "Amazon Rekognition experienced a service issue."The model seemed can successfully trained when I used a smaller subset of the data with only about 60 labeled images. Is the dataset size the issue? I found in web, "AWS Rekognition CustomLabels supports upto 250,00 images for Object Detection/Localization." I was also able to train image classification model use Amazon Rekognition Custom Label on 105,000 images successfully with no issue.AWS Region in which I ran these trainings: us-west-2AWS account: XXXX-XXXX-5633Approximate time of trainings: 12/22/2022-12/28/2022, with failed model name list:*****.2022-12-27T19.35.49*****.2022-12-26T16.04.56*****.2022-12-25T16.19.44*****.2022-12-22T20.43.45Any help would be appreciated! Thank you.FollowComment"

Answer: "0Thank you for reaching out to us. We identified and fixed the underlying issue, and you can now retry your training. Please feel free to create a support case to us directly for further support.CommentShareAWS-User-4103787answered 5 months agoAWS-User-0918828 5 months agoI retried training but still failed with "Amazon Rekognition experienced a service issue".Share"


Question: Example 1 create an Aws code commit pipeline with Aws cloudformation

"Am trying to complete that tutorial on codepipeline and when I create a stack in cloud formation , using the provided appspec.yaml file, i get the error that says “ Template format error: at least one resources member must be defined” and it won’t let me upload the file.What did I miss ? How can I resolve it please ?FollowCommentJames_S EXPERTa year agoCould you share a link to the tutorial you're following?Share"

Answer: "1AppSpec files aren't CloudFormation deployables, they're for the CodeDeploy service/agent to process. See https://docs.aws.amazon.com/codedeploy/latest/userguide/application-specification-files.html for more information on AppSpec files.If the tutorial is directing you to launch a template with CloudFormation, check you're using the right file; a CloudFormation template will have AWSTemplateFormatVersion specified near the top of the file, and Resources will be a map rather than a list.CommentShareEXPERTJames_Sanswered a year agoAWS-User-9368651 a year agothank you , that was helpful !!Share"


Question: Was Cloudfront affected by the Friday 9th September outage in the US-EAST-1 Region?

Our users reported some strange behaviour - maybe things being cached which aren't normally. I wasn't able to reproduce it myself.Was Cloudfront affected by the Friday 9th September outage in the US-EAST-1 Region?FollowComment

Answer: "1Hello,My suggestion would be to check the AWS SHD (Service Health Dashboard), choose 'North America' and then search for Service 'Amazon CloudFront'; it would show you current events as well as recent history. I took a quick look and don't see any known events for CF on the 9th.https://health.aws.amazon.com/health/statusThe other alternative would be to open a Support case to double check if any known events around that time.CommentShareEXPERTTushar_Janswered 9 months ago"


Question: Managed Nodes - Deregister This Managed Nodes is Grayed Out

"Hello!I am trying to remove some EC2 instances off the fleet manager. I found some documentation stating the way to remove it is to deregister from the portal. However, when I follow these instructions, the "Deregister This Managed Node" is grayed out and I unable to click on it. I am not sure on next steps to troubleshoot this. If anyone has idea, I appreciate it!Thanks!FollowComment"


Question: NAT Gateway w/ Elastic IP in Public + Private VPC with AWS Workspaces ..

"Hi -We've just setup a NAT gateway to securely provide outbound internet to our Private VPC containing a whole bunch of AWS Workspaces (Windows + Linux). According to the solution we followed, all machines should show the same IP when egressing the network via the NAT gateway. But, that's not happening for us somehow.Although most machines show the same elastic IP we've configured on the NAT gateway, some are still showing different IPs. How come?Can someone please help explain this and suggest where we may have made a mistake.FollowComment"

Answer: 0It was a misconfiguration of security groups in one of our subnets.CommentShareJohnDoe112answered 3 years ago


Question: Does RI purchase for RDS guarantee capacity reservation?

"Customers can purchase dedicated reserved capacity for EC2 which means the instance is guaranteed to be available, but I do not think you can do that for RDS.  Can you please confirm? DB engine is SQL Server.Does buying a RDS reserved instance help with instance availability as customers with RIs get priority over on demand.FollowComment"

Answer: "1Accepted AnswerVia https://aws.amazon.com/rds/faqs/Q: Do reserved instances include a capacity reservation?Amazon RDS reserved instances are purchased for a Region rather thanfor a specific Availability Zone. As RIs are not specific to anAvailability Zone, they are not capacity reservations. This means thateven if capacity is limited in one Availability Zone, reservations canstill be purchased in the Region and the discount will apply tomatching usage in any Availability Zone within that Region.CommentShareEd Sanswered 3 years agoEXPERTNataliya_Greviewed 2 years agoNataliya_G EXPERT2 years agoTo clarify - RDS RIs do not reserve actual capacity, and they just provide a billing discount.Share0Yes ODCR (On-Demand Capacity Reservation) capability  is not available on RDS today.I did not come across any documentation indicating RI prioritized over On-Demand. The value of RI is in discountsCommentSharerePost-User-7912100answered 8 months ago"


Question: Ec2 Instance & RDP was not accessible

"Last week, my application hosted on ec2 instance was down. Server was not accessible and the server health shows insufficient data. Although, I tried rebooting instance the server, everything remained the same. However the server issues got resolved only after I stopped and start the ec2. Surprisingly, it took more than 10 minutes to stop the instance. Can anyone explain me the cause of this issue ? Was that a server /hardware updated issues ? Any help will be highly appreciatedFollowComment"

Answer: "0Hello.Seems like a pressure inside the OS.Please verify your current free Memory inside windows.Also, check for available disk space in C drive.When you stop the instance, the system send a Shutdown signal to the OS, and the OS will wait until all processes stop. If that not happen in 10 minutes, the system will force a shutdown.CommentShareHugo Vanswered 5 months ago0It is telling that things were resolved when you did a stop/start cycle. If there was underlying issues with the host, the stop/start cycle will move your instance to a different host. You may also want to investigate Recover your instance.CommentShareEXPERTkentradanswered 5 months ago"


Question: AWS Batch on Fargate job failing with error No Credentials raises

"Hi Team,I am calling the credentials from ssm parameter store to login to database from ECS cluster. I have attached ssm full access to Job execution role even tough it's getting fail.botocore.exceptions.NoCredentialsError: Unable to locate credentialsAny suggestions to this issueFollowCommentDon 4 months agoHi, sorry to answer your question with another question but it really depends how you are retrieving the secrets :)E.g. are you adding the secret to the task definition as an ENVIRONMENT VARIABLE or through direct code access in you application?A bit more information will make it much easier to help you.Share"


Question: Is it possible to create RDS replica in public subnet while master db is in private?

Is it possible to create RDS replica in public subnet while master db is in private?It seems this might be possible if we create replica in different region as getting errorDbSubnetGroupName should not be specified for read replicas that are created in the same region as the masterFollowComment

Answer: "1As long as subnets are part of the same DB Subnet group all can be donesee documentation below of creating read replicas[1]https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.htmlCommentSharerePost-User-9017359answered a year agoy0zg a year agoI create the config via terraform and it seems the only option worked for me is to use cross-region replicaion due to this error DbSubnetGroupName should not be specified for read replicas that are created in the same region as the masterI tried to create separate DB Subnet group with public subnets but in that case creation of read-replica in the same region doesn't workShare0Ideally you would have a private subnet for primary RDS instance, hence the replica would use the same subnet group and would not be accessible publicly. You cannot place the replica in a different subnet group. If your subnets are public, but primary DB has Publicly Accessibility set to No to ensure it can only connect privately, then you can have a public replica with Public Accessibility as Yes. I wouldn't recommend making the subnets public here. Here are some approaches:Setup manual replication to an RDS instance which will be public, and use that for reading purposesUse AWS DMS to move data and changes similar to 2 instead of manual replication setupUse cross region replica(might not fit the use case) within a subnet group which has public subnets in another regionCommentShareShivam_Ganswered a year ago"


Question: Windows Username/Password Injection into CloudFormation

"A customer built Active Directory on the AWS and wants to use CloudFormation template to spin up Windows machines. When launching an EC2 machine, it should run a PowerShell script to join to the AD Domain. But the script should know the username and password of the AD admin account which has the 'AD Join' permission.Now this customer needs to inject the AD admin's username and password into the User Data section of CloudFormation template. What options are available? What are the pros and cons?Getting username/password as CloudFormation Input Parameter?Getting username/password from a securely managed S3 object?Wonder how other people handle this usual scenario.FollowComment"

Answer: "0Accepted AnswerBoth are good options. S3 has been widely adopted for passing long credentials (e.g. keys) to CloudFormation stacks, however there is another option now; KMS.Benefits of this approach include an audit trail of decryptions, automated rotation of password encryption and not having to use an entire S3 bucket.The following is an example of how KMS encrypted content can be referenced from a Mapping and an IAM role used by the instance in question to decrypt the key:"Mappings": {       "KMSSecrets": {            "GithubSSHKey": {                "CMKRegion": "us-east-1",                "CipherTextBlob": "CiAKP2NjuykOmiYWxqmifMaTak0q.........",                "IAMRoleName": "tmaddox-githubconsumer"            }      }},"Resources":         "IAMInstanceProfileWWW": {            "Properties": {                "Path": "/",                "Roles": [{"Fn::FindInMap": [ "KMSSecrets", "GithubSSHKey", "IAMRoleName"]}]            },            "Type": "AWS::IAM::InstanceProfile"        },        "WWWAdminServer": {            "Metadata": {                "AWS::CloudFormation::Init": {"config": {"packages": {"yum": {                    "git": []                }}}}            },            "Properties": {                "IamInstanceProfile": {"Ref": "IAMInstanceProfileWWW"},                ...                "UserData": {"Fn::Base64": {"Fn::Join": [ "", [                        "#!/bin/bash\n",                        "yum update -y\n",                        "echo -e \"\n### Running cfn-init\"\n",                        "/opt/aws/bin/cfn-init",                        "    -s ",                        {"Ref": "AWS::StackName"},                        "    -r WWWAdminServer ",                        "    --region ",                        {"Ref": "AWS::Region"},                        "\n",                        "",                        "echo -e \"\n### Saving Github's SSH Host Key\"\n",                        "GITHUB_HOST_KEY='github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=='\n",                        "if [ ! -f /root/.ssh/known_hosts ] || grep -v $GITHUB_HOST_KEY /root/.ssh/known_hosts; then\n",                        "  echo $GITHUB_HOST_KEY >> /root/.ssh/known_hosts\n",                        "fi\n",                        "",                        "echo -e \"\n### Fetching code\"\n",                        "echo '", {"Fn::FindInMap": [ "KMSSecrets", "GithubSSHKey", "CipherTextBlob" ]}, "'",                        "    | base64 -d > /root/.ssh/github.pem.encrypted\n",                        "aws kms decrypt",                        "    --output text",                        "    --query Plaintext",                        "    --region ", {"Fn::FindInMap": ["KMSSecrets", "GithubSSHKey", "CMKRegion" ]},                        "    --ciphertext-blob fileb:///root/.ssh/github.pem.encrypted",                        "    | base64 -d > /root/.ssh/git.pem\n",                        "",                        "rm -f /root/.ssh/github.pem.encrypted\n",                        "chmod 600 /root/.ssh/git.pem\n",                        "rm -rf /var/www/html\n",                        "eval `ssh-agent`\n",                        "ssh-add /root/.ssh/git.pem\n",                        "git clone https://github.com/magento/magento2.git /var/www/html\n",                        "rm -f /root/.ssh/git.pem\n",                        ""                    ]                ]}}            },            "Type": "AWS::EC2::Instance"        },CommentShareAWS-User-6691991answered 8 years agoEXPERTsedat_salmanreviewed 13 days ago"


Question: How to assign role for a group of users

"Hello,I'm writing terraform manifest, i create roles,groups, users, and assigned users to those groups, now i want to assign roles to groups, i was not able to find anything about that by googling, except this https://registry.terraform.io/modules/terraform-aws-modules/iam/aws/latest/examples/iam-group-with-assumable-roles-policy, which apparently doesn't do what i need.Any suggestions? is it even possible?FollowComment"

Answer: "1Accepted AnswerAccording the documentation, IAM Identities (users, user groups, and roles), this is not possible.A user group cannot be identified as a Principal in a resource-based policy. The role trust policy is a resource-based policy.You can achieve something similar using a condition in the trust policy that compares the tag on the role to the tag on the user."Condition": {       "StringEquals": {"aws:ResourceTag/project": "${aws:PrincipalTag/project}"} }CommentShareEXPERTkentradanswered a year agoJoann Babak a year agoThank you, for the ones who have the same problem, there is a work - around, you can just define multiple users in the role trust policy, adding  "AWS": ["user","user2"] in the policy. Very strange why AWS would not make it possible to do the same with groups tho.Share"


Question: Custom classifier for AWS Glue crawler

I have a set of files in my S3 bucket which have a delimiter ASCII 31 (unit separator). I am using a crawler to read these files and create the tables in AWS Glue catalog. I tried using the custom delimiter in the classifiers but with no luck since this is a non-printable character. What is the best way to incorporate this delimiter within a crawler?FollowComment


Question: CodeBuild Projects do not complete:  They are stuck in the QUEUED status.

"My CodeBuild projects are built using the image: aws/codebuild/amazonlinux2-x86_64-standard:3.0I am building a .NET Core 3.1 Angular app.But when I try to build thru the pipelines, none of my projects complete because they are stuck in the QUEUED status.Several answers have said to just let the pipeline run and it will eventually complete but mine timed out after 8 hours.This is also not a billing issue:  I have checked and we have paid our bills.Besides opening a ticket, which I might have to do, is there anything else I can do.  This is a blocker for me.Thank youJustineFollowComment"

Answer: "0Hi.CodeBuild logs debug information for each phase during Build. You can get more detailed information on where the CodeBuild project stops.Step 7: View summarized build information - AWS CodeBuildStep 8: View detailed build information - AWS CodeBuildIf no logs are output, the VPC configuration of the CodeBuild container is often a problem. You need to have a route to access CloudWatch Logs and S3 via the Internet or VPC endpoints.Then troubleshoot the problem if you can identify where it is stopped.CommentShareEXPERTiwasaanswered a year agoJustine a year agoThank you for the suggestion @iwasaMy build projects are all built with this image: aws/codebuild/amazonlinux2-x86_64-standard:3.0I have logging set up for each of my codebuild projects.  Last week I was using my codepipeline to build my projects and it logged adequately.  This week, starting on Monday I am unable to get past the QUEUED stage, even if I just wait and the build projects time out after 8 hours which is configured.  I have checked my billing and that is not the issue.  The bill is up to date.According to the doc: https://docs.aws.amazon.com/codebuild/latest/userguide/builds-working.html"A build in a queue that does not start after the number of minutes specified in its time out value is removed from the queue. "My build timeout is 60So I am thinking that maybe the build was removed from the QUEUE but the status still says QUEUED.I checked my IAM user and the credentials are still validI pull the artifacts from github and I have never had a problem.  I will check the github auth token and the webhooks to make sure they are valid.What I do not understand is why the projects have a QUEUED state if they were possibly removed from the queue.  They are queued but never provisioned.  With no log output I have no way of what is going on.  Do you know why the stage does not get past the QUEUED stage.  How else can I trouble shoot this?  This is a blocker for my team.Share0We are facing the same issues with AWS Codebuild, starting a few days ago on US-EAST-1.We replicated our stack to US-EAST-2, and Codebuild runs fine there.This is clearly an AWS issue, but support on this is terrible with no acknowledgement on their side.If this continues we will move cloud platforms as this is a major blocker for us.CommentShareAWS-User-3145276answered a year agoJustine a year ago@AWS-User-3145276 I totally believe this is an AWS issue as my code base and pipelines have not changed.  Are you using terraform to build out your resources on AWS in these code build projects?  I am.  My Codebuild projects are typical, running shell scripts to build out a .NET 3.1, python, nodejs lambdas with front end actions that run unit and e2e tests.  My deployment code build projects do not Queue up either.  No logs are produced at all.  I almost thought it was a auth issue but no.Share"


Question: how to create multiple ingress port on Amazon EKS using single Application Load Balancer

"there is requirement to create application load balancer with ingress or external traffic going to 2 different port for example port 80 and 81 into EKS Cluster, any sample yaml config file to setup this requirement ? we are trying to create the config using annotation with   alb.ingress.kubernetes.io/group.name with two separate rules service port 80 and service port 81, but when trying to run the yaml file the second rules service is overwriting on the ALB Rules.trying to create something similar with this post https://aws.amazon.com/blogs/containers/how-to-expose-multiple-applications-on-amazon-eks-using-a-single-application-load-balancer/ , but the differences is the requirement to have single services with 2 port [ingress]ThanksFollowCommentJeremy a year agoFirst, have you read this, https://stackoverflow.com/questions/65969301/eks-alb-ingress-route-by-port. Second, can you provide a copy of your ingress definition here?Share"


Question: SDAccel + RTL kernel utilization and timing report

"Hi,Does anybody know how to get utilization and timing reports when using SDAccel + RTL flow?. I was trying to use --report estimate on xocc but it is not reporting anything on the system_estimate.xtxt file. I think this option only works for OpenCL kernels and not for RTL's ones?Thanks!FollowComment"

Answer: "0Hi xor, for RTL kernels the only time this information would be generated would be for a system run as this is the time that the RTL is synthesized. Once a system run is completed, the timing and utilization reports are put in the same folder as the system_estimate is generated in, under the syn and imp folder names.CommentSharekmorrisXilinxanswered 4 years ago0Hi,Yeah, system_estimate is located under _x/reports/link but the file reporting utilization is under _x/logs/link/syn/pfm_dynamic_KERNEL_NAME_synth_1_runme.logThe reports are not in rpt, txt, or xtxt as they used to. They are now in log files, in case anyone is using find command to look for them.CommentSharexoranswered 4 years ago"


Question: Reboot instance in sequence

Is there anyone here that has Document or script that can reboot multiple instances in order?The logic of the solution or script I want to achieve is Server 1 will reboot first then wait for netlogon service to start before restarting Server 2.FollowComment

Answer: "0Accepted AnswerHi, apart from above, you could look inspiration in this: https://repost.aws/knowledge-center/start-stop-lambda-eventbridge.Personally, I would combine the above with an orchestrator such as step function and see if you can achieve the waiting of service programmatically.Hope it helps ;)CommentShareEXPERTalatechanswered a month agoGary Mclean a month agoAlatech approach is a great way. I’ve used step functions before and I wonder if you can incorporate a ssm process to check a service is running https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-managewindowsservice.htmlI’ve done this type of stuff with ecs services and Rds instances.I’m currently writing one for ec2 instances but without checking services.Share0Arh your wanting to reboot domain controllersYou could use a mixture of aws cli to reboot an instance then a power shell script to check the status of the netlogon service remotely. This of course requires access to the servers directly.https://theitbros.com/get-service-powershell/CommentShareGary Mcleananswered a month ago0Thanks guys for the suggestions. I created an automation document and create steps  to restart and check window serviceCommentSharerePost-User-4804538answered a month ago"


Question: Greengrass Snap on Ubuntu Core cannot execute NodeJS lambdas

"HiIt's undocumented but it is impossible to run a NodeJS lambda with the Greengrass Snap. The snap only provides the Python environment : python 2.7 lambdas work like a charm.After Greengrass snap install on Ubuntu Core and successful lambda deployment of the "hello world" nodejs lambda, no message is posted in the hello/world topic. On the local GG machine, the following error shows in the runtime.log file :\[2019-05-19T07:46:55.967Z]\[INFO]-Starting worker arn:aws:lambda:eu-west-1:919510806644:function:Greengrass_HelloWorld:4\[2019-05-19T07:46:56.045Z]\[ERROR]-Runtime execution error: unable to start lambda container: failed to run container sandbox: container_linux.go:344: starting container process caused "exec: "nodejs6.10": executable file not found in $PATH"\[2019-05-19T07:46:56.047Z]\[ERROR]-failed to start worker d5260972-1b3a-483d-7df8-7c7e27e2e90f: process start failed: failed to run container sandbox: container_linux.go:344: starting container process caused "exec: "nodejs6.10": executable file not found in $PATH"How can I install and run nodejs lambdas in this environment ?Regards--Jean-PhilippeEdited by: Jips71 on May 19, 2019 3:54 PMFollowComment"

Answer: "0FYI I posted this issue on snapcraft.io for cross referencing :  https://forum.snapcraft.io/t/nodejs-runtime-issues-with-the-greengrass-support-interface-and-the-aws-iot-greengrass-snap/11424/4I checked the aws-iot-greengrass snap files in /var/aws-iot-greengrass/2/snap/ and here is what I found:There is no plugin: node or node-engine specified in the snapcraft.yaml. Instead, nodejs is referenced in the rootfs-stage-packages section. Abstract:parts:rootfs-stage-packages:stage-packages:- nodejs=4.2.6~dfsg-1ubuntu4.2in the dpkg.list node 4.2.6 is referenced. Abstract:Desired=Unknown/Install/Remove/Purge/Hold| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)||/ Name                         Version                       Architecture Description+++-============================-=============================-============ii  nodejs                       4.2.6~dfsg-1ubuntu4.2         amd64This is obviously not the required nodejs6.10 required by Greengrass 1.8.0 specs.CommentShareJips71answered 4 years ago0Hi Jips71,I was able to replicate the issue on my end. I'm investigating a solution. I'll keep you posted.Thanks,KR-AWSCommentShareKR-AWSanswered 4 years ago0Great thank you !!!Let me know if I can be of any helpBy the way, is the snap source code available somewhere on a public repo (GitHub?)I would gladly try to contribute with PRsCommentShareJips71answered 4 years ago0If you work on the snap,  will you take a look at upgrading it into 1.9.x ?Because the deprecation of node 6.10 for AWS lambdas by the end of the month will make it unusable with node anywaySee my other thread  https://forums.aws.amazon.com/thread.jspa?threadID=303437&tstart=0CommentShareJips71answered 4 years ago0Hello KRAny news on that topic ?RegardsJean-PhilippeCommentShareJips71answered 4 years ago0Hi Jean-Philippe,The Snap isn't in a public repo. I'm sorry but pull requests aren't possible on that project at the moment.We are also aware that a new Snap needs to be generated for Greengrass 1.9.x. We are still actively working on this issue. We don't provide release dates or estimates.I'll keep this issue open and continue to update the forum as more information becomes available.Thanks,KR-AWSCommentShareKR-AWSanswered 4 years ago0HiDo you have any news on that topic ?Do you know how to make it possible to execute a nodejs lambda on a Greengrass endpoint ?CommentShareJips71answered 4 years ago0Hi Jean-Philippe,As you're already aware, we're working on the 1.9.x Snap which will include support for node8.To address your question, nodejs lambda failures are specific to Snap and we're working on the fix. Deploying nodejs lambdas to Greengrass outside of a Snap works perfectly fine.Thanks,-joeCommentShareJoeAtAWSanswered 4 years ago0HiI didn't intend to put any pressure. Sorry if I sounded pushy.KR wrote that he was investigating for a solution, that's why I upped the thread. I'll mark it as answered.Thanks--Jean-PhilippeCommentShareJips71answered 4 years ago0Hi Joe,Could you please let us know when the Greengrass 1.9.x Snap will be available? It would also be interesting to understand the reason for the delay and if we should expect delays also for coming versions since that would affect our choice of platform.RegardsRCommentSharedahlborganswered 4 years ago0Thank you Dalhbord. I was feeling alone on that topic and I am glad (sadly) that other users are impacted by the problem.See this broader topichttps://forums.aws.amazon.com/thread.jspa?messageID=908238&tstart=0#908238CommentShareJips71answered 4 years ago0Hi Jips71,  and dahlborg,There's an announcement about Greengrass and Snap support.https://forums.aws.amazon.com/ann.jspa?annID=6967I'll continue to post updates as they become available.Thanks,KR-AWSCommentShareKR-AWSanswered 4 years ago"


Question: Value of property PolicyDocument must be an object  with CloudFormation policy

I get the following error when I add 3 lines to my policyValue of property PolicyDocument must be an object (Lines with #JustAdd) If I remove those 3 lines it works great whats wrong ?Policies:    - PolicyName: !Sub 'X-${AWS::Region}'      PolicyDocument:        - Effect: Allow          Action: 'ssm:GetParametersByPath'          Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/X'        - Effect: Allow          Action: 'ssm:GetParameters'          Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/X/*'        - Effect: Allow          Action: 's3:*'          Resource: '*'        - Effect: Allow          Action:            - secretsmanager:GetSecretValue          Resource:            - !Sub 'arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:C*'        - Effect: Allow          Action:            - 'ec2:DescribeNetworkInterfaces'            - 'ec2:CreateNetworkInterface'            - 'ec2:DeleteNetworkInterface'            - 'ec2:DescribeInstances'            - 'ec2:AttachNetworkInterface'          Resource: '*'        - Effect: Allow          Action: 'kms:Decrypt'          Resource: '*'        - Effect: Allow                                                                         #JustAdded          Action: sqs:*                                                                          #JustAdded          Resource: 'arn:aws:sqs:us-east-1:000000000000:Q.fifo' #JustAdded    RoleName: !Sub 'X-${AWS::Region}'FollowComment

Answer: "0Hi ThereI dont see a "Statement:" directive in your code under PolicyDocument.  (reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html).  Also  Action: sqs* is not surrounded by single quotes like the others which could be causing formatting issues.CommentShareEXPERTMatt-Banswered 2 months ago0Hi thereIn agreement with the above, please kindly add the "Statement:" directive and surround 'sqs:*' with single quotes as indicated below:Policies:- PolicyName: !Sub 'X-${AWS::Region}'PolicyDocument:Statement:- Effect: AllowAction: 'ssm:GetParametersByPath'Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/X'- Effect: AllowAction: 'ssm:GetParameters'Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/X/'- Effect: AllowAction: 's3:'Resource: ''- Effect: AllowAction:- secretsmanager:GetSecretValueResource:- !Sub 'arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:C'- Effect: AllowAction:- 'ec2:DescribeNetworkInterfaces'- 'ec2:CreateNetworkInterface'- 'ec2:DeleteNetworkInterface'- 'ec2:DescribeInstances'- 'ec2:AttachNetworkInterface'Resource: ''- Effect: AllowAction: 'kms:Decrypt'Resource: ''- Effect: AllowAction: 'sqs:*'Resource: 'arn:aws:sqs:us-east-1:000000000000:Q.fifo'RoleName: !Sub 'X-${AWS::Region}'CommentShareTheLichanswered 2 months ago"


Question: Amazon Linux 2 - How can I know if a CVE has been patched?

"Hi,My question is - how can we see what CVEs are patched? Where is it recorded if Amazon Linux has patched a particular CVE? There is the security centre here: https://alas.aws.amazon.com/alas2.html, however, that only lists the advisories as far as I can tell - it doesn't say what's patched and what isn't. Is it the case that if an item there shows that there are new packages, we can just assume it's patched in AL?Thanks in advance for any help.ContextWe've had a pen test conducted in our Elastic Beanstalk / Amazon Linux 2 environment. It flagged some potential common vulnerability & exposures (CVEs) - a number of which turned out to be false positives as Amazon Linux maintains its own release of packages. We found that Nginx running in our environment was not version 1.20.0 - vulnerable to CVE-2021-23017, but was version 1.20.0, release 2.amzn.2.0.4 - which according to https://github.com/aws/elastic-beanstalk-roadmap/issues/221 , has been patched against this vulnerability. Having the same version number for each seems like a recipee for disaster. It certainly cost me a few days time trying to look into the issue.[ec2-user@ip-x ~]$ yum info nginxLoaded plugins: extras_suggestions, langpacks, priorities, update-motd207 packages excluded due to repository priority protectionsInstalled PackagesName        : nginxArch        : aarch64Epoch       : 1Version     : 1.20.0Release     : 2.amzn2.0.4Size        : 1.7 MRepo        : installedFrom repo   : amzn2extra-nginx1I've a number of other CVE's that I need to determine if our elastic beanstalk environment is potentially compromised by: If I can just look them up, it would be helpful.OpenSSH <= 8.6 Command Injection Vulnerability CVE-2021-23017Diffie-Hellman Ephemeral Key Exchange DoS Vulnerability (SSH, D(HE)ater) CVE-2002-20001nginx <= 1.21.1 Information Disclosure Vulnerability CVE-2013-0337OpenSSH 6.2 <= 8.7 Privilege Escalation Vulnerability CVE-2021-41617OpenBSD OpenSSH <= 7.9 Multiple Vulnerabilities CVE-2018-20685, CVE-2019-6109, CVE-2019-6110, CVE-2019-6111OpenBSD OpenSSH Information Disclosure Vulnerability (CVE-2020-14145) CVE-2020-14145SSL/TLS: BREACH attack against HTTP compression CVE-2013-3587OpenSSH 'auth2-gss.c' User Enumeration Vulnerability - Linux CVE-2018-15919OpenSSH 'sftp-server' Security Bypass Vulnerability (Linux) CVE-2017-15906OpenSSH < 7.8 User Enumeration Vulnerability - Linux CVE-2018-15473OpenSSH Information Disclosure Vulnerability (CVE-2016-20012) CVE-2016-20012FollowComment"

Answer: "0This is not a direct way to know which CVEs are patched in your instance, but you can go through the steps below to check:Use Amazon Inspector to identify the CVE issues in your instance. There is a new Amazon Inspector that is faster in identifying these, but personally I still currently prefer the Amazon Inspector Classic as I know how to specify which particular EC2 instance I want to include in the security assessment (by using Tags).New Amazon Inspector Overview Demo ORSet up Amazon Inspector ClassicOnce Amazon Inspector is done with the assessment, check the CVE findings in your instance.Compare the CVE findings of your instance against the CVE rules package included in Amazon Inspector. [Note: The rules package in the link is for Amazon Inspector Classic.]CommentSharejoahnaanswered 10 months agoMrKnowNothing 10 months agoThanks for the response - I'll take a look.Share"


Question: Unable to create new users on Amazon Connect - The resource couldn't be found or the input format is incorrect.

Why do I get this error when trying to create a new user? I get this every time:FollowComment

Answer: "0Accepted AnswerIn answer to my own question -- this issue is due to the new interface. When clicking 'use old interface' from the user management page on Amazon Connect, and following the process to add new users there, all seems to work ok.CommentSharerePost-User-0821575answered 10 months ago"


Question: Sagemaker keeps charging even after deleteing the domains

"Hi,I was using dataset in sagemaker data wrangler to discover how it works . I deleted the sagemaker domain without removing all the resources and i keep getting bills because of this . How can I fix this.Thank you for your help.FollowComment"

Answer: "1hi,When you delete a SageMaker domain, some of the resources associated with that domain are deleted automatically. Your files are kept in an Amazon EFS volume as a backup. When you use the SageMaker console to delete the Domain, the Amazon EFS volume is detached but not deleted. The same behaviour occurs by default when you use the AWS CLI or the SageMaker Python SDK to delete the Domain. Refer: https://docs.aws.amazon.com/sagemaker/latest/dg/gs-studio-delete-domain.htmlAlso, note that deleting a SageMaker domain does not delete other AWS resources that may have been created or associated with the domain, such as Amazon S3 buckets or AWS Identity and Access Management (IAM) roles. You will need to manually delete those resources separately.For you to check what resources you are charged on,Go to the AWS Management Console, select AWS Cost Explorer.Select Cost Explorer.Select the date, hour range and then run the report to find out which services are in use and what services you are billed on.Based on this, you can cleanup those resources that you are billed on.Hope this helps,Thanks,ArunCommentShareArunanswered 3 months ago0This is not my area of expertise, but here are 2 resources I found:There are notes here about how to delete EFS associated with a domain: https://docs.aws.amazon.com/sagemaker/latest/dg/gs-studio-delete-domain.html#gs-studio-delete-domain-efsShut down Data Wranger: https://docs.aws.amazon.com/sagemaker/latest/dg/data-wrangler-shut-down.htmlI hope one of these help.CommentShareLisa_Hanswered 3 months ago"


Question: S3 HeadBucket AccessDenied Events from AWS Config are logged by CloudTrail

"We are receiving some events in Cloudtrail every day that AWS Config cannot execute the HeadBucket-Event to its S3 bucket. See Cloudtrail event below.AWS Config has full access to that S3 bucket and events are logged fine.How can we avoid this event in Cloudtrail? Or maybe this is a bug in AWS?"eventVersion": "1.05",    "userIdentity": {        "type": "AWSService",        "invokedBy": "config.amazonaws.com"    },    "eventTime": "2019-06-28T07:04:33Z",    "eventSource": "s3.amazonaws.com",    "eventName": "HeadBucket",    "awsRegion": "eu-central-1",    "sourceIPAddress": "config.amazonaws.com",    "userAgent": "config.amazonaws.com",    "errorCode": "AccessDenied",    "errorMessage": "Access Denied",    "requestParameters": {        "bucketName": "o-op-c3s-config-XXXXXXX",        "Host": "o-op-c3s-config-XXXXXXX.s3.eu-central-1.amazonaws.com"    },    "responseElements": null,    "additionalEventData": {        "SignatureVersion": "SigV4",        "CipherSuite": "ECDHE-RSA-AES128-SHA",        "bytesTransferredIn": 0,        "AuthenticationMethod": "AuthHeader",        "x-amz-id-2": "XXXXXXXX",        "bytesTransferredOut": 243    },    "requestID": "7F64F2B43ECBAF50",    "eventID": "d73d8811-7ef7-49fd-8ee7-fc132478ed2e",    "readOnly": true,    "resources": [        {            "type": "AWS::S3::Object",            "ARNPrefix": "arn:aws:s3:::o-op-c3s-config-XXXXXXX/"        },        {            "accountId": "XXXXXXX",            "type": "AWS::S3::Bucket",            "ARN": "arn:aws:s3:::o-op-c3s-config-XXXXX"        }    ],    "eventType": "AwsApiCall",    "recipientAccountId": "XXXXXXX",    "sharedEventID": "24fbb551-99e9-41f7-96ef-f1ca01769e9f",    "vpcEndpointId": "vpce-XXXXXX"}FollowComment"

Answer: "0Thanks for bringing this issue to our attention. We apologize for any inconvenience this has caused. We can confirm that AWS Config is delivering recorded data to your configured S3 bucket correctly.  The AccessDenied error logs for HeadBucket API calls you are seeing in CloudTrail is a side effect of a check we introduced last week. We are making a HeadBucket API call to check for the existence of the S3 bucket and determine the region in which the S3 bucket is located before delivering the data. This was added so that data can be delivered efficiently to S3 buckets located in regions different from where Config data was recorded.  You can update your S3 bucket policy to include s3:ListBucket permissions for config.amazonaws.com to stop the AccessDenied events from getting logged in your CloudTrail logs.Here is a sample S3 bucket policy{"Version": "2012-10-17","Statement": [{"Sid": "AWSConfigBucketPermissionsCheck","Effect": "Allow","Principal": {"Service": ["config.amazonaws.com"]},"Action": "s3:ListBucket""Resource": "arn:aws:s3:::YOUR_BUCKET_NAME"}]}[1] S3 Head Bucket API reference https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketHEAD.htmlCommentShareSUPPORT ENGINEERAWS-User-4908883answered 4 years ago0Thanks, been seeing this in my cloudtrail as well. There's a typo in the policy, add a comma after Action line:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "AWSConfigBucketPermissionsCheck",            "Effect": "Allow",            "Principal": {                "Service": [                    "config.amazonaws.com"                ]            },            "Action": "s3:ListBucket",            "Resource": "arn:aws:s3::: YOUR_BUCKET_NAME"        }    ]}CommentSharejarrettjanswered 4 years ago0Hi,I am getting this error in my Cloudtrail logs every few minutes. I have tried adding this policy to the S3 Bucket policy directly but doesn't seem to fix the issue.This error triggers my unauthorized api call metric alarmAny help would be appreciated.CommentShareRadweb-AWSanswered 3 years ago0Looking at my Source IP in the error it displays as "AWS Internal" which I cannot add as the service name and errors on saving.CommentShareRadweb-AWSanswered 3 years ago"


Question: "Logging EC2 power state before maintenance window, then return to that state"

"Hello All, I need to patch EC2 instances that are currently powered down and return them to this state after patching. I'm trying to figure out if there is an easy way to track the power state of an EC2 instance before starting it for a maintenance window. I know maintenance windows automation tasks can power on and power off EC2 instances, but how would it keep track of an instances state so I can return it to that state after the maintenance window is over? After googleing for days, I've read a few people suggesting you can trigger a lambda function to run first and tag your instances with a state tag, once your maint window is over, you run another lamba that captures all instances with the tag state of say "powerOffWhenDone" and you then power them off and remove the tag. Can anybody suggest any other methods their currently using? I cant find much in regards to this topic.FollowComment"

Answer: "0Hello. Just come across your post. I'm looking for the same solution. Did you eventually go for the lambda method that records the instance state as a tag? ThanksCommentShareKalanswered 6 months agorePost-User-8281643 6 months agoHey Kal, I couldn't find anything much on the internet besides suggesting lambda BUT I stumbled upon Systems Manager > Automation .. Which allows you to write "documents", these documents can execute a script or call AWS APIs and all other sorts of neat stuff.https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-automation.htmlSo what I ended up doing was creating an automation doc that executes a powershell script that finds all powered off EC2 instances, tags them then powers them on. You can then put this automation doc in a maintenance window that runs say monthly. After the instances are patched, you can trigger another doc that shutsdown instances and removes the tags. This method was pretty simple, i dont have much experience with lambda so this approach was much easier to build. I also did stumble upon this doc, which explains how to make a parent-child automation doc which i think will be my ultimate end goal so i can scrap the powershell.https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-authoring-runbooks-parent-child-example.htmlShare0Thanks for the reply. Yes the pshell method sounds like an easier option.I'm more comfortable with powershell than Lambda, so will try that.Thanks again for your help.CommentShareKalanswered 6 months ago"


Question: website is not working

"Hello, hope you are doing well, our main website https://pahenjiakhbar.com/ is not working. I think web server is not completing requests. An Error 522 occurring while a visit the website. Please see it and we are facing problems over this issue.FollowComment"

Answer: "0It will take a lot more information to solve the issue you're running into fully, and I am not sure this site is the proper forum for that.However, I do have one place you can start. HTTP 522 status codes, according to Wikipedia, indicate that Cloudflare timed out while trying to access your origin server. Be sure your DNS is configured correctly and your security settings are appropriately set. The security settings on Cloudflare can cause significant issues with communication between Cloudflare and the origin if misconfigured.CommentShareJason Butzanswered a month ago0Agree with Jason - we would need a lot more information to troubleshoot.  A couple of things.  First, can you reach the website directly without CloudFlare in the loop?  Go stright to the public address and fake out DNS by updating your computer's host file if necessary.  Another thing does come to mind.  On an EC2 instance, if you let a public IP be assigned at the time of creation versus manually assigning an elastic IP after creation - the public IP will be released and reassigned on reboots.  This could also be your problem.  Please verify your public facing IP address and then if CloudFlare is pointing to the correct one.  Provide more infor and we will try to help.CommentShareChristian Lorisanswered a month ago"


Question: How to access wp-admin

"Hi,We have just completed the website migration to AWS Lightsail however we are not able to login to the admin account. Since there is SMTP configured yet we cannot even reset the password. Is there a way to access the file manager to disable some plugins?FollowComment"

Answer: "0Hi.Did you configure Bitnami Wordpress and migrate your data?In that case, you can SSH from the Lightsail console and reset your password with the following approach.https://aws.amazon.com/premiumsupport/knowledge-center/lightsail-reset-wordpress-password/?nc1=h_lsCommentShareEXPERTiwasaanswered a year agorePost-User-2992523 a year agoYes I tried this and it gave me all users registered on the platform which is in thousands. No luck here because there is no search functionality.Shareiwasa EXPERTa year agoit gave me all users registered on the platform which is in thousands. No luck here because there is no search functionality.Is it possible to access by SSH and reset the administrator password? Please share the issue.Share"


Question: cognito signout

hey there iam using aws sdk in which i am using Class: AWS.CognitoIdentityServiceProvider for cognito methods. for user log out i am using globalSignOut to signout user. The issue i am facing whenever this method is called call the accessToken issue to particular user revoked. if user is signed with same email on multiple device  when try to logout on a specific device all accessToken of there devices revoked. so i want only the user with particular device get logout and only single accessToken revoked . is there any way to achieve this i cant find any methods for this .FollowComment

Answer: 0You can use the Cognito logout endpoint to for logout . This will delete the session cookie. Refer to this link https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.htmlPlease refer to this post for the differences between logout endpoint and global logout https://repost.aws/knowledge-center/cognito-logout-endpoint-globalsignoutapiCommentShareGauravanswered 2 months ago


Question: Error when requesting thing shadow - TOO_MANY_REQUESTS

"I'm getting error with TOO_MANY_REQUESTS code when requesting thing shadow in a server connection.I think this error is caused by a quota exceeds, but I don't know what is the specific quota. If it is the case, can anyone help me to understand what is the quota my server is exceeding?Bellow is the part of stack trace errorCaused by: com.amazonaws.services.iot.client.AWSIotException: TOO_MANY_REQUESTSat com.amazonaws.services.iot.client.core.AwsIotCompletion.get(AwsIotCompletion.java:213) ~[aws-iot-device-sdk-java-1.3.4.jar!/:na]at com.amazonaws.services.iot.client.shadow.AwsIotDeviceCommand.get(AwsIotDeviceCommand.java:58) ~[aws-iot-device-sdk-java-1.3.4.jar!/:na]at com.amazonaws.services.iot.client.shadow.AwsIotDeviceCommandManager.runCommand(AwsIotDeviceCommandManager.java:135) ~[aws-iot-device-sdk-java-1.3.4.jar!/:na]at com.amazonaws.services.iot.client.shadow.AwsIotDeviceCommandManager.runCommandSync(AwsIotDeviceCommandManager.java:108) ~[aws-iot-device-sdk-java-1.3.4.jar!/:na]at com.amazonaws.services.iot.client.shadow.AbstractAwsIotDevice.get(AbstractAwsIotDevice.java:93) ~[aws-iot-device-sdk-java-1.3.4.jar!/:na]at com.amazonaws.services.iot.client.AWSIotDevice.get(AWSIotDevice.java:299) ~[aws-iot-device-sdk-java-1.3.4.jar!/:na]at com.kl.compatec.app.central.iot.service.impl.AwsCentralIoTServiceImpl.loadCentralShadow(AwsCentralIoTServiceImpl.java:78) [classes!/:1.0.0]... 121 common frames omittedFollowComment"

Answer: "0Hi,device shadow quotas are documented in the general reference under AWS IoT Core endpoints and quotas. The TOO_MANY_REQUESTS error is generated when there are more than 10 in-flight requests on a single connection.In case you are requesting shadows from multiple devices you can also think of using fleet indexing to index the shadow and request multiple shadow with a single query.KR,PhilippCommentSharePhilipp Sanswered a year ago"


Question: Failed to join domain: failed to lookup DC info for domain 'ldap.examp;e.com' over rpc: The attempted logon is invalid. This is either due to a bad username or authentication information.

"Hi there, I keep getting the following error when trying to join  aws managed Microsoft AD from a linux ec2 (centos 7)AWSFailed to join domain: failed to lookup DC info for domain ldap.exmaple.com' over rpc: The attempted logon is invalid. This is either due to a bad username or authentication information.! Joining the domain ldap.example.com failedThe command I am running is sudo realm join -U web.service@ldap.example.com ldap.example.com --verbose.The username and PW is correct, I have even changed the password a few times.i have followed the  guide here https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.htmlBut it it doesn't seem to working for me?FollowComment"

Answer: 0Have you tried verifying the krb config is correct with a realm discover and verified you can reach the domain successfully from the machine?CommentShareEXPERTRob_Hanswered 5 months ago


Question: JSON in ElastiCache for Redis Not working

"When I test against my Redis cluster with the command 'JSON.SET', I get an error that says "unsupported command 'JSON.SET'". However, I did test against the cluster using the command 'SET', and that one worked properly. It seems that the cluster doesn't support JSON data types/ commands, but I can verify that the Redis cluster engine is 6.2.6.Is this some configuration issue or is JSON commands no longer supported?References:https://aws.amazon.com/blogs/database/unlocking-json-workloads-with-elasticache-and-memorydb/?sc_channel=EL&sc_campaign=Live_Streaming_2022_vid&sc_medium=YouTube&sc_content=a76oXjtQcK4&sc_detail=DATABASE&sc_country=UShttps://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/json-gs.htmlFollowComment"

Answer: "0As checked link Supported Redis JSON commands. The command JSON.SET shoud be supported, and follow doucment:JSON.SET is working as expected. Could you double check your ElastiCacache redis version, and your redis client version.The testing in my new created Elasticache redis cluster for reference.$ redis-6.2.6/src/redis-cli --versionredis-cli 6.2.6$ redis-6.2.6/src/redis-cli -h xxx.cache.amazonaws.com pingPONG$ redis-6.2.6/src/redis-cli -h xxx.cache.amazonaws.com info server | grep redis_versionredis_version:6.2.6$ redis-6.2.6/src/redis-cli -h xxx.amazonaws.com JSON.SET k1 . '{"firstName":"John","lastName":"Smith","age":27,"weight":135.25,"isAlive":true,"address":{"street":"21 2nd Street","city":"New York","state":"NY","zipcode":"10021-3100"},"phoneNumbers":[{"type":"home","number":"212 555-1234"},{"type":"office","number":"646 555-4567"}],"children":[],"spouse":null}'OK$ redis-6.2.6/src/redis-cli -h xxx.cache.amazonaws.com JSON.GET k1 $.address.*"[\"21 2nd Street\",\"New York\",\"NY\",\"10021-3100\"]"CommentShareJerry_Kanswered 8 months ago"


Question: How can I update a stack parameter which was set by an SSM parameter?

"I have an SSM parameter value set with a value I want to use in a CFN template. In the CFN template I have a parameter configured as follows:Parameters:  DDAPIKEY:    Type: String    Default: '{{resolve:ssm:DDAPIKEY:1}}' I then use this parameter as an environment variable in a lambda function. This works for the first deployment just fine, but if I change the SSM parameter value and redeploy the stack my expectation is that my lambda function would be updated. But given how CFN default parameters work (they only set the value the first time) I'm out of luck. Subsequent deployments do not update the environment variable even if the SSM parameter value is changed.Am I mistaken about something or are there ways to work around this?FollowComment"

Answer: "0Nevermind. I didn't realize you could use the{{resolve:ssm:DDAPIKEY:2}}notation in a parameter override. Since you can do that, then I have a workaround.CommentShareStealthSid2answered 3 years ago"


Question: Where is "AdministratorAccess" among the permission policies for my AWS IAM initial setup?

"I am a new AWS user and I'm following the tutorial for "Setting Up Your AWS Environment / Securing Your Account":https://aws.amazon.com/getting-started/guides/setup-environment/module-two/As instructed, I created a group called "administrators" and now I'm trying to add the permission policy called "AdministratorAccess" by choosing it from the list of policy names. But it does not appear when I search by that name, nor does it appear when I sort the policy names alphabetically and scroll through them. What am I missing? Is the tutorial out of date?This forum doesn't seem to allow attachments so I'm sharing a link to a screenshot via Google Drive. Thanks!https://drive.google.com/file/d/1uvpFlCqK886i2uzJ5wgSPM9r73zzX3q_/view?usp=sharingFollowComment"

Answer: 2Accepted AnswerThat particular filter box requires you to hit ENTER to apply the filter.CommentShareEXPERTkentradanswered a year agoBluemont a year agoBingo -- just like the prompt told me inside the text input field (smile). Thanks!ShareJaccoPK a year agoJust too late :-) Indeed ENTER.Share


Question: getting Resource handler returned message: "Access to the resource https://sqs.us-east-1.amazonaws.com/ on cloudformation

hi..while trying to create a queuepolicy in cloud formation:SQSNotificationPolicy:    Type: AWS::SQS::QueuePolicy    Properties:      PolicyDocument:        Version: '2008-10-17'        Statement:          - Effect: Allow            Principal:              AWS: "*"            Action: SQS:SendMessage            Resource: !GetAtt NotificationQueue.Arn            Condition:              ArnLike:                aws:SourceArn: !Sub '{{resolve:ssm:${SNSTopic}}}'       Queues:        - !Ref NotificationQueuei get Resource handler returned message: "Access to the resource https://sqs.us-east-1.amazonaws.com/ is deniedwhy?FollowComment

Answer: "0Hi, I would start troubleshooting by checking your AWS Identity and Access Management Permissions for how you're trying to deploy the SQS Policy.Identity Policies for Deploying CloudFormation (Typically the User or Role you are using to deploy the CloudFormation)(If exists) Ensure the Queue Policy is not blocking access to deploy/update another Queue Policy.If in Organizations, that no SCPs are blocking SQS or any of the necessary permissions.CommentSharejsoncanswered a year ago"


Question: aws redis vs dynamodb vs rds

"My supervisor ask me to explore the options to put a repository or cache between a database that is sourced (from other team) and an App that we are building, it will contain a subset (not big) of that db to be read-only from the API of that App, that subset will be fully reloaded from its origin on a daily basis, We already have a RDS (pg), my question is being the size of the data equal to the three options what will be cheaper, put that data into the existing RDS, put a a cache layer with redis or use a (new) dynamodb repo?FollowComment"

Answer: "2From the description, it sounds like you are looking for a solution where you could temporarily cache data that can be consumed (read-only) by an API.Redis seems to be a potential fit, you could also look at Memcached. Below document has a comparison of Memcached and Redishttps://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/SelectEngine.htmlHaving said this, I would recommend you to review the requirement in a bit more detail and make a choice. Here are some areas you could think of and some questions you could ask yourselves (Not an exhaustive list) -What is the type and structure of data? What is the volume of data?A reference on evaluating DynamoDB - https://aws.amazon.com/blogs/database/how-to-determine-if-amazon-dynamodb-is-appropriate-for-your-needs-and-then-plan-your-migration/Redis is also a key-value pair data store.How often this data changes? Can the external source propagate the incremental data changes to AWS i.e. Do you really need a daily full dump or incremental delta feeds?Would persisting this data in RDS or DynamoDB serve any of your long term goals? (Based on the volume of reads, this could be a combination of 'RDS and Redis' or 'DynamoDB & DAX')?What is the request volume? What volumes of requests query for same data as response (i.e. repeated reads)?Do you have an API gateway for the API and does that already cache the API responses? Also, do you have any CDN (Content Delivery Network) already caching the API responses.What are the data encryption/security, back-up and recovery (RTO and RPO), availability, durability requirements?Use the below cost calculator to create an estimate for these 3 services to compare. Make sure you also consider the opportunity of reservations for these services  -  https://calculator.aws/#/CommentShareRajesh Sanswered 10 months agoEXPERTChris_Greviewed 10 months agoaurzola 10 months agoThank you!, That calculator is complex, there are some parameters that I dont have, we never be writting to the cache/repo (only reading from it) with full loads everyday from the source (external), we can adapt to any form of data structure, tabular from a db or key, value, we are not willing to persists this data, and suppose we are not weighting the benefits (caching) of responses times between one option or the other, we are being forced to use this because the owners of the source data do not want us to be openning db connections all day, just once a day. The question is what will be cheaper, keep in mind that we already have an RDS.Share"


Question: Monitoring Algorithms for Anomaly Detection - MULTIVARIATE?

Do we support MULTIVARIATE ANOMALY DETECTION? I looked at all the Anomaly detectors from Monitron to Lookout seems everything is SINGLE or UNI VARIATE???FollowComment

Answer: "0Hi,Amazon Lookout for Equipment is a multivariate time series anomaly detection service. This service analyzes the data from the sensors on your equipment (e.g. pressure in a generator, flow rate of a compressor, revolutions per minute of fans), to automatically train a machine learning model for your equipment. Lookout for Equipment builds unique unsupervised ML models to analyze incoming sensor data in real-time and identify early warning signs that could lead to machine or process failures.Amazon Monitron uses both machine learning (clustering capabilities using both vibration and temperature data) and ISO for vibration analysis.Hope this helps,CommentShareMichael Hoarauanswered 6 months ago"


Question: App Runner Service Logs to debug deployment error

"Everything was working just before the error - (deployments from a push worked, build scripts worked).I also test the nextjs site before pushing for deployment using npm run build.I made some updates to the code(basically added images), did my npm run build - it came out clean, then I committed and pushed. (nothing else was changed - build scripts are still the same).the issue starts after "[AppRunner] Starting source code build"then I get "[AppRunner] Deployment failed. For details, see service logs."So, I have no idea where the "service logs" are.... (I also looked in Cloudwatch- it just shows the same general error message)FollowComment"


Question: What does Amazon Simple Email Service define as a "representative volume of email" when computing the bounce rate?

"https://docs.aws.amazon.com/ses/latest/dg/reputationdashboardmessages.html#reputationdashboard-account-status"We calculate your bounce rate based on a representative volume of email. A representative volume is an amount of email that represents your typical sending practices. To be fair to both high- and low-volume senders, the representative volume is different for each account and changes as the account's sending patterns change."FollowComment"