Question: Windows instance unreachable after instance type change

"Hello,Today I attempted an instance type change on a Windows machine from m5.4xlarge to c6a.4xlarge resulting in Instance reachability check failed. I've tried rebooting, stopping, and starting the instance, but the outcome was the same: no connectivity.Are there any networking differences between the 2 instance types that would require driver installation? I'm asking about the network, as the instance screenshot displayed no connectivity on the network adapter and the remote desktop connection was not working either.FollowComment"

Answer: "0Based on the article you have posted, my understanding is that c6a.4xlarge is not ENA compatible and m5.4xlarge is.Is this the case? I am a bit confused about the terminology here.CommentSharerePost-User-1093784answered 2 months agoGary Mclean 2 months agoSee the steps here.. You could try upgrading the network drivers before you migrate to a newer instance. however, it does say if its not compatible then launch a new instance and migrate your applicationhttps://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2-instance-resize.htmlShare0Yes, you are correct. There are differences esp with the network adapator.Please see https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/resize-limitations.html for CompatibilityIf this answers your question, please be sure to accept to help others and myselfCommentShareGary Mcleananswered 2 months ago0Your AMI may have an outdated network driver.Do update your ENA network driver as per What do I need to do before migrating my EC2 instance to a sixth generation instance to make sure that I get maximum network performance?For Windows installation instructions, refer to Enable enhanced networking with the Elastic Network Adapter (ENA) on Windows instancesCommentShareMike_Lanswered 2 months ago"


Question: Licensing AWS SQL Server for Development databases

"Hi,I am new to AWS RDS and am investigating the licensing for SQL Server RDS for development databases.On premise we can use the Developer Edition for SQL Server that prevents us to pay licensing costs for our development databases.For production database we have the licensed Enterprise Edition.Now I would like to use AWS RDS for SQL Server for the development databases.However I can't find an option in the AWS Create database console where I can configure that the databases are development databases.There is a template where I can choose between Production and dev/test but I don't think that that is the option.Is it possible to have development databases in AWS RDS without having to pay licensing?Or doesn't AWS RDS work like that? Should we always pay for all databases including development databases?Thanks in advance.RegardsFollowComment"

Answer: "0Accepted AnswerIt has nothing to do with licensing, all it does is choose a set of defaults the Console uses. So, for example, if you say it is a production instance then the Console will default to Multi-AZ whereas it defaults to Single-AZ for development. You can still change all of these, it is just the defaults to make instance creation easier.CommentShareHalTempanswered 3 years ago0Microsoft doesn't make SQL Server Developer Edition available under the Service Provider License Agreement (SPLA), which is how AWS is allowed to offer its License Included offering. The only free license that AWS is able to offer is Express Edition. Just one of Microsoft's looney licensing practices.CommentShareHalTempanswered 3 years ago0Hi Hal,Thanks for the reply.That's too bad.So the choice when creating a new RDS Instance between Production and Dev/Test Template is nothing but a tag?. It has nothing to do with the licensing. Am I right?thanksCommentShareMariananswered 3 years ago"


Question: AWS Lightsail hosting own service

"Hello,I have a AWS Lightsail instance which hosts my WordPress static webpage for me.  I'm wondering if I can manually install  (or extend) the website with a Golang webserver end point (api endpoint) that would additionally responsed to  a query i.e. www.aws-site.com/api/do/someting which I'd install through SSH or so.If this is possible, is there limit on number of requests comming in and pricing? My instance is the basic 512MB Ram, 1vCPU.Thank youFollowComment"

Answer: "0Hello and thank you for choosing Lightsail!You can certainly add additional software to any Lightsail instance even when started using an application blueprint like WordPress. You should consult the Bitnami documentation (https://docs.bitnami.com/general/apps/wordpress/) for information about how the system is structured.There are no limits to the number of requests that can be serviced by your instance, however, there is an allowance on the amount of bandwidth (raw count of bytes transferred over time) that can be transfered for each instance. If this allowance is exceeded data transfer overage charges will apply (see https://aws.amazon.com/lightsail/pricing/ for more information). For your instance size your allowance is 1TB in most regions and 0.5TB in Mumbai and Sydney.I hope this answers your question.CommentSharedonleyatawsanswered 7 months ago"


Question: Multitenacy in quicksight embedded dashboard without session capacity pricing

I have embedded dashboards in an application from quicksight. I want to restrict data access to some users where they can view data relevant to them only and not the complete dataset.  Is there any way we can do this without using session capacity pricing?FollowComment

Answer: "1I want to restrict data access to some users where they can view data relevant to them only and not the complete datasetIf you need to restrict the data by dataset rows, you can use the Row Level Security  with the help of user based rules. That does not need session capacity pricing.If you need to restrict the dataset columns, then you can use Column Level Security.CommentShareVijayanswered a year agoEXPERTiwasareviewed a year agoEXPERTFabrizio@AWSreviewed a year ago"


Question: Glue Job triggered with EventBridge

"I want to create EventBridge event to trigger Glue job, but when I create glue trigger there is no option for EventBridge (on legacy page it is but is blocked). I have CloudTrail enabled. Where is the problem? Is this option still available?FollowCommentalatech EXPERT3 months agoDid you look into this page? https://docs.aws.amazon.com/glue/latest/dg/starting-workflow-eventbridge.htmlShare"

Answer: 0you can use this blog for your requirement. i think is is same what you are looking forhttps://aws.amazon.com/blogs/big-data/build-a-serverless-event-driven-workflow-with-aws-glue-and-amazon-eventbridge/CommentShareSachinanswered 3 months ago


Question: Host S3 website with on-premises DNS server without Route53

"I have an S3 bucket set up for "Static Website Hosting", a CloudFront distribution with our own SSL certificate and allowing Host header, a Global Accelerator IP address attached to an Application Load Balancer.The Application Load Balancer does a 301 redirect to the S3 bucket.  I know that you can set an EC2 instance as a target group and forward to that to preserve the original URL.Can you also preserve the original URL using this method of 301 redirect to a Cloudfront distribution tied to an S3 bucket?FollowComment"

Answer: "1Accepted AnswerI'm a little unclear about what you're trying to do here.If I follow correctly: Browser navigates to firstexample.com (hosted on ALB/EC2) which then redirects to secondexample.com (hosted on CloudFront/S3). You're looking for a way such that the browser doesn't see secondexample.com once redirected but firstexample.com instead?By setting up (say) static.firstexample.com on CloudFront you can then pull static content from any S3 bucket you like. Then the redirect would be to static.firstexample.com. But you can't have the same hostname firstexample.com used for both CloudFront and ALB - well, not without randomly sending browser to either location.However, the subject of your question mentions Route 53. In this case, if you're hosting content on firstexample.com you do need Route 53 in order to assign the "apex record" to a specific endpoint (ALB, CloudFront, whatever). If you were redirecting from www.firstexample.com to www.secondexample.com or static.firstexample.com then an on-premises DNS will work fine. Naturally, my next question would be "why not use Route 53 given it is a fully managed and highly available service".CommentShareEXPERTBrettski-AWSanswered a year agochasteen a year agoI wanted to keep the original domain entered into the browser while serving up content from the S3 bucket.  We did not want to use Route53 as that would require us to dedicate a portion of our IP address space to Route53 and that may change in the future.  The question was incomplete and should have provided more detail.  You were right in guessing what I was actually trying to do. In this case, I think we should use ALB/EC2 forwarding to an EC2 managed by Elastic Beanstalk.ShareBrettski-AWS EXPERTa year agoI'm not sure why using Route 53 means dedicating a portion of your IP address space to Route 53. The only restriction here is that apex records are assigned to Route 53 Alias records which necessitates those resource being in AWS. But that has nothing to do with IP addressing.Share"


Question: Could not receive email on GoDaddy after moved DNS to AWS

"Hi guys,Please help me with this.I bought a domain from GoDaddy, then I have moved DNS to AWS already.Everything is working fine, but email issue.I can't receive email anymore from the email address like this my_email@my-domain.comI have following this article https://productivity.godaddy.com/#/externaldomain/20575653 and added all the record to the AWS Route53.But I think the TXT record is not effected.Here is what I have added:Can anyone help me with this?Thanks!FollowComment"


Question: Name mismatch in AWS Training and certification account

"Hello!When I registered my  AWS Training and certification account, I left out a part of my name that I usually dont use, but I just read, that for taking exams, the name must match exactly what is on the ID card. I tried to edit my name in my account, but that part is not editable.Current data:First name (Given name): BenceLast name (Surname): Dergezthe First name shoud be corrected to:First name (Given name): Bence BendegúzI hope support can help me with this.Thanks in advance!FollowComment"

Answer: "0debence,If you have not already, please submit to ticket with the AWS Customer Support team. They will work with you to verify your account/name and make any changes if necessary. You can submit a ticket here: https://support.aws.amazon.com/#/contacts/aws-training.KimAWS CertificationCommentShareKimWD-AWSanswered 2 years ago"


Question: How to create revisions automatically when a new file is added to S3?

"We're posting a product to the data marketplace that covers a dataset that has new data added every hour. While onboarding we were told we could set something up to automatically create a revision each hour to add the new csv containing new data, but haven't seen any info on how to do this. Anybody know the best way to go about setting up a system like this to keep our data up-to-date? ThanksFollowComment"

Answer: "0Hi loften,Thanks for your question.  AWS Data Exchange Publisher Coordinator should be able to help with this.  This solution automates the steps to create a new revision for an existing AWS Data Exchange dataset. Please find the link here: https://aws.amazon.com/solutions/implementations/aws-data-exchange-publisher-coordinator/If you have any additional questions, please don't hesitate to reach out!CommentSharericcardop-awsanswered 2 years ago0Data Exchange supports automatic revision creation through the console and through AddRevisions in the Catalog API.CommentSharejchananswered 10 months ago"


Question: AWS Codebuild logs on a black background?

"Hi,I am pretty sure that previously logs were on a black background and now it is on white? Did AWS change anything?FollowCommentArnoud 10 months agoYes, it was black before. They must have changed it. I liked black better as it resembled the terminal I normally use to build.Share"


Question: sagemakee endpoint failing with ""An error occurred (ModelError) when calling the InvokeEndpoint operation: Received client error (413) from primary and could not load the entire response body""

"Hello, I have created sagemaker endpoint by following https://github.com/huggingface/notebooks/blob/main/sagemaker/20_automatic_speech_recognition_inference/sagemaker-notebook.ipynb and this is failing with error ""An error occurred (ModelError) when calling the InvokeEndpoint operation: Received client error (413) from primary and could not load the entire response body"".The predict function returning me following error but CW log does not have any error details for the endpoint.ModelError Traceback (most recent call last)/tmp/ipykernel_16248/2846183179.py in2 # audio_path = "s3://ml-backend-sales-call-audio/sales-call-audio/1279881599154831602.playback.mp3"3 audio_path = "/home/ec2-user/SageMaker/finetune-deploy-bert-with-amazon-sagemaker-for-hugging-face/1279881599154831602.playback.mp3" ## AS OF NOW have stored locally in notebook instance----> 4 res = predictor.predict(data=audio_path)5 print(res)~/anaconda3/envs/amazonei_pytorch_latest_p37/lib/python3.7/site-packages/sagemaker/predictor.py in predict(self, data, initial_args, target_model, target_variant, inference_id)159 data, initial_args, target_model, target_variant, inference_id160 )--> 161 response = self.sagemaker_session.sagemaker_runtime_client.invoke_endpoint(**request_args)162 return self._handle_response(response)163~/anaconda3/envs/amazonei_pytorch_latest_p37/lib/python3.7/site-packages/botocore/client.py in _api_call(self, *args, **kwargs)493 )494 # The "self" in this scope is referring to the BaseClient.--> 495 return self._make_api_call(operation_name, kwargs)496497 _api_call.name = str(py_operation_name)~/anaconda3/envs/amazonei_pytorch_latest_p37/lib/python3.7/site-packages/botocore/client.py in _make_api_call(self, operation_name, api_params)912 error_code = parsed_response.get("Error", {}).get("Code")913 error_class = self.exceptions.from_code(error_code)--> 914 raise error_class(parsed_response, operation_name)915 else:916 return parsed_responseModelError: An error occurred (ModelError) when calling the InvokeEndpoint operation: Received client error (413) from primary and could not load the entire response body. See https://us-east-1.console.aws.amazon.com/cloudwatch/home?region=us-east-1#logEventViewer:group=/aws/sagemaker/Endpoints/asr-facebook-wav2vec2-base-960h-2022-11-25-19-27-19 in account xxxx for more information.`FollowComment"

Answer: "0Hello AmitKayal,I understand that you have successfully created an Endpoint. However, when you try to invoke this Endpoint you get the following error:ModelError: An error occurred (ModelError) when calling the InvokeEndpoint operation: Received client error (413) from primary and could not load the entire response body. See https://us-east-1.console.aws.amazon.com/cloudwatch/home?region=us-east-1#logEventViewer:group=/aws/sagemaker/Endpoints/asr-facebook-wav2vec2-base-960h-2022-11-25-19-27-19 in account xxxx for more information.And when you looked at your CloudWatch logs there was nothing related to this error. Let me know if I have misunderstood anything.The ClientError 413 usually occurs when the payload size for the endpoint invocation exceeds the limit of 6 MB [1,2], this could be the reason why your Endpoint is throwing the error 413.If your payload size is more than 6MB you can work around this by using either Batch Transform [3] or Asynchronous Inference [4]. Batch Transform can be used if you would like to process the request to your model in batches. With Batch Transform you have an option to define your own maximum payload size [5]. Otherwise, if you want to receive inference for each request to your model you can use Asynchronous Inference which takes up to 1 GB of payload size with the runtime of about 15 minutes [6]. Asynchronous Inference queues requests to your model and processes them asynchronously, this is ideal for payloads that are greater than 6MB but not more than 1GB.Should the suggested work around not work, I recommend that you open a Support case with AWS Technical Support [7]. The Technical Support team will be able to help you to further troubleshoot this issue.I trust this information finds you well. Should you have any further questions, please feel free to reach out.References:https://github.com/aws/amazon-sagemaker-examples/issues/245https://docs.aws.amazon.com/general/latest/gr/sagemaker.html#limits_sagemakerhttps://docs.aws.amazon.com/sagemaker/latest/dg/inference-pipeline-batch.htmlhttps://docs.aws.amazon.com/sagemaker/latest/dg/async-inference.htmlhttps://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.htmlhttps://docs.aws.amazon.com/sagemaker/latest/dg/hosting-faqs.html#hosting-faqs-generalhttps://support.console.aws.amazon.com/support/home?region=us-east-1#/case/createCommentShareAWS-Cebzanswered 6 months agoAmitKayal 6 months agoThanks a lot for your comments. I have tried now within 6MB and this is working. But batch transform is failing with following error. Can you please guide how I can fix this?'''inputs = ffmpeg_read(inputs, self.feature_extractor.sampling_rate)File "/opt/conda/lib/python3.8/site-packages/transformers/pipelines/audio_utils.py", line 39, in ffmpeg_readraise ValueError("Malformed soundfile")'''I believe the packge installed as part of container instantiated as part of transform is lacking this version? I have added my requirements.txt into model package as below...The package has code subfolder where my requirements.txt file also available. But looks like the container is lacking soundfile package which is there in my requirements.txt file'''Hub Model configuration.hub = {'HF_MODEL_ID':'openai/whisper-tiny','HF_TASK':'automatic-speech-recognition'}create Hugging Face Model Classhuggingface_model = HuggingFaceModel(env=hub,                      # configuration for loading model from Hubrole=role,                   # iam role with permissions to create an Endpointmodel_data = s3_location,transformers_version="4.17.0",  # transformers version usedpytorch_version="1.10.2",        # pytorch version usedpy_version='py38',            # python version used)'''Share"


Question: Lightsail debian instance ssh with vs code

"Hey everyone,I am trying to connect to my debian instance with vs code. I created an debian instance with a static ip 35.1XX.XXX.XXX. I installed the remote ssh extension in vs code. I downloaded the default key from the debian instance and placed it in my .ssh folder.The config file for the ssh extrension looks like that:Host dlmDev  HostName 35.1XX.XXX.XXX  User admin  IdentityFile C:\Users\XXX\.ssh\aws-key\LightsailDefaultKey-eu-central-1.pemIf I open an ssh vs code window and select linux as a the platform, I just get an error that the connection did not work. I just don't know what to do now. Maybe someone can help me with this stupid question?Thanks!FollowComment"

Answer: "1Just wondering, can you do normal SSH? Have you opened firewall / Security Group Rules at port 22? Here is a reference: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/understanding-firewall-and-port-mappings-in-amazon-lightsailCommentShareapradanaanswered 9 months agoEXPERTChris_Greviewed 9 months ago0Please put the keypair file (.pem) under C:\Users\XXX\.ssh, and try again.CommentShareAWS-raymondanswered 9 months ago"


Question: "AWS Athena - Cross Account access - Engine version 2 deprecate on August 6, 2023 in EU-WEST-1 region"

"Hi,I have 2 aws accounts as below. Both the accounts are in the region eu-west-1. I need to do Athena Cross Account queries with right catalog permission settings.Account 1 (producer account) - Glue database and tables (ICEBERG table with input format, output format and SerDe lib) present, Tables are created via glue jobs and AWS glue CLI. Data is stored as parquet format in S3 bucket.Account 2 (consumer account) - New data source with AWS S3 Glue catalog from Account 1 is created. Athena has engine version 2 - cross account querying works good.I tried to use Athena engine version 3 in Account 2 after seeing the deprecation message for engine version 2 but the cross account access for ICEBERG table is not working. Error below:"Cannot query ICEBERG table"I see the notification that, Athena engine version 2 will be deprecated on August 6, 2023 in EU-WEST-1 region.How can I access the ICEBERG tables with Parquet SerDe lib, input and output formats using cross account access on Athena engine version 3?FollowComment"


Question: Can I use my own phone number as an origination number for SNS?

"Can I use my own phone number as an origination number for SNS?I'm testing out SNS and would like messages sent to my phone, ideally from my own number.When filling out this process, it seems like I'm required to buy a new number in pinpoint in order to set this up.Is there anyway I can just register my own number?FollowComment"

Answer: "1Accepted AnswerNot unless your phone carrier has an API to send text messages using your phone number. If your phone carrier does have such api, you can use a custom channel using lambda to send the text message.CommentShareAnaAtAWSanswered 3 months ago"


Question: CUP number on invoice

"Hello, there is the possibility to insert the CUP number (related to a public work).This number to be significant must be reported on the invoices. But in my invoices it doesn't.Could you please help me?Thank youFollowComment"

Answer: "0Hello,I would recommend speaking with our Billing & Accounts team for guidance & insight around your request.You can reach us by creating a support case, here: go.aws/support-center.— Ben G.CommentShareEXPERTAWS Support - Benanswered 25 days ago"


Question: BatchWriteItem Validation Exception

"Hey all,I'm gettingat 'requestItems' failed to satisfy constraint: Map keys must satisfy constraint: [Member must have length less than or equal to 255, Member must have length greater than or equal to 3, Member must satisfy regular expression pattern: [a-zA-Z0-9_.-]+]when trying to batch write items to dynamo. The primary key for my table is only two characters:idCould that be the issue?Edited by: AustinK on Dec 18, 2019 5:26 PMFollowComment"

Answer: "0Hi,It should not be an issue with the partition key attribute name. The constraints have been placed on the requestItems map and here is the format for reference:https://docs.aws.amazon.com/cli/latest/reference/dynamodb/batch-write-item.html#examplesYou can refer to the examples section in the below doc for boto3:https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/dynamodb.html#DynamoDB.Client.batch_write_itemIf you could provide the code snippet, especially the requestItems that you are passing to the batch write item request, we should be able to help you better.CommentShareAWS-User-1057810answered 3 years ago0Hey JuhiPatAWS,Sorry I never responded to my OP sooner. So the issue ended up being that I hadn't included a table name that I was trying to access through dynamo. The error is slightly different using batch than when using normal Write, so that's why I didn't catch it immediately. We add the table names through cloudformation as env variables, and I'm assuming it was just an empty string when getting the env var.CommentShareAustinKanswered 3 years ago"


Question: I am unable to customise my AWS SSO URL

"I am trying to customise my AWS SSO URL  but it is not working ,is there any limitations on the naming convention .I have tried as many number of names with different combinations but noting worked for me .FollowComment"

Answer: "0Afaik no such limitations. Are you seeing "This field is required." even after you've entered your custom URL or something else?CommentShareShasankaanswered a year agoAWSJoe a year agoJust to add on to Shasanka's comment, there is a single limitation that you can change the URL once, this change to the user portal URL is permanent, and you will not be able to edit it later. So if it's previously been changed, that may be why you're experiencing issues.Share0Note that these are "universal," meaning the namespace is shared across every customer worldwide.  Is there a specific error you're getting?  You might need something more specific/less generic to avoid namespace collisions.CommentSharethat_mikeanswered a year agoAWS-User-5392889 a year agoI have tried different  combination of names in the subdomain text field and which were unique but it is still not accepting without any message  .And what is the Type your subdomain to confirm field  that I am see on the bottom ,does that mean that we need to register a domain name .Share"


Question: ESP32 MQTT file delivery example

"Reading this document I see there is a good example for MQTT file delivery using OTA update as the case study, it is from the freeRTOS sdk repo, and I have actually implemented this in my code with success.However I am unable to find example code for arbitrary file delivery. The OTA code is very specific to freeRTOS OTA, saves directly to the ota partitions in flash, it is triggered in the AWS dashboard by an OTA specific dashboard flow, and is not a great example to implement file delivery in any other use case.Is there a good reference example in freeRTOS C for MQTT file delivery?thank you!FollowComment"

Answer: "1Hi Andrew. MQTT file delivery is primarily aimed at resource constrained devices that want to perform OTA entirely over MQTT. It can save the constrained device from having to include an HTTP client (just for OTA) in its firmware image, and also reduces the RAM footprint by having a single TLS connection. MQTT file delivery incurs additional messaging costs (as compared to HTTP file transfer). For resource-constrained devices, the firmware image is generally small, so these costs are small. If your device already supports an HTTP client, and/or your files are large, then HTTP file transfer may be a better choice. The AWS IoT Device SDK for Embedded C includes a small footprint HTTP client and demos of how to use it, including how to download a file from S3.I'm not aware of a more general MQTT file streaming example that I can point you to. However, please be aware that the device-side implementation of the file streaming part of OTA is C and is free of any FreeRTOS dependencies: https://github.com/aws/ota-for-aws-iot-embedded-sdk. So you could potentially re-use the stream handling parts of that library to implement MQTT file streaming, outside of the OTA mechanism.https://github.com/aws/ota-for-aws-iot-embedded-sdk/blob/main/source/ota_mqtt.chttps://github.com/aws/ota-for-aws-iot-embedded-sdk/blob/main/source/ota_cbor.cThe OTA operation you see in the console calls the CreateOTAUpdate API. OTA is in fact just an AWS IoT job with a special job document. That API call (depending on the parameters you pass) in turn calls StartSigningJob, CreateStream and CreateJob. You could instead call CreateStream (and maybe CreateJob too) directly to achieve file streaming outside of the OTA mechanism.Again though, I would advise you to be sure you have a good reason for not using HTTP instead.CommentShareEXPERTGreg_Banswered 4 months agoAndrew 4 months agoThank you so much for a great answer @Greg_B.MQTT has the added benefit of inbuilt security, so an http solution will incur some development cost to implement securely. It's a little embarrassing to admit that, although I know the OTA process is writing to the OTA partitions in flash on esp32, reading into the files you linked, I am unable to find the low level function which handle the buffer and do this writing. An arbitrary file handling solution would take these full MQTT file buffers and work on them before calling for the next chunk.ShareGreg_B EXPERT4 months agoThe HTTP demo I linked to uses the SigV4 library and the Credentials Provider to achieve a secure file transfer.ShareGreg_B EXPERT4 months agoI am unable to find the low level function which handle the buffer and do this writingIt's handled by the Platform Abstraction Layer (PAL). A now-deprecated example: https://github.com/aws/amazon-freertos/blob/main/vendors/espressif/boards/ports/ota_pal_for_aws/ota_pal.cShareAndrew 4 months agoOMG i see now, the pOtaInterfaces struct has all the methods, and I see I can hook into them. Thank you so much! I deeply appreciate the thoughtful, patient and informed support. It's a great community here!ShareGreg_B EXPERT4 months agoThanks for the feedback. Please don't be shy about accepting and/or upvoting answers. :-)Share1As a maintainer of the OTA for Embedded SDK library (part of the FreeRTOS team), I have a bit of further guidance for you.For the simplest approach possible - You could integrate AWS IoT ExpressLink into your solution. We made sure to specifically allow this kind of behavior through what we call the 'Host OTA'. The Host OTA (or HOTA for short) allows any file to be sent through the OTA mechanism to the ExpressLink device and be read off by the Host processor - which would be your MCU in this example. The Host processor can then use this file in any way it desires. The API to do so is simple, revolving around a couple of AT+ commands and diverges very little from the traditional flow of an OTA. Some documentation on this can be found here.For the doeesn't-cost-you-anything-additional-but-software method, you could implement something very similar to ExpressLink OTA/HOTA mechanisms by using the OTA FileTypeId field to select how you handle files. For a traditional OTA, you can provide a certain file type value while for a generic file you can provide another. Doing this method, you'd need to modify the callback provided to the OTA_Init to select how it handles the files based off the file type ID.And finally - the OTA library is configurable and allows the file transfer over either the MQTT and HTTP protocol when you configure the configENABLED_CONTROL_PROTOCOL macro which can be found here. Note this doesn't mean the entire OTA is handled over HTTP if configured so. The setup and negotiation of the OTA job state is always done over the MQTT protocol, however when configured the file transfer is done over HTTP. This is to reduce cost associated with an OTA file transfer.If you have further problems or need guidance feel free to post on the FreeRTOS Forums or create an issue on the OTA library repository (if you select this library to use). Our team, and the FreeRTOS community, is very active and has many of experts who volunteer their knowledge.CommentShareKodyAWSanswered 4 months agoAndrew 4 months agoThank you @KodyAWS for thoughtful answer.I can see where I would examine the OtaJobEvent_t and be informed that the file is now in the OTA partition in flash. However whats not clear is how I would then access that data. Using esp-flash-read() to access that file seems odd, how would I determine for ex. the size of the file, which OTA partition, or what the raw flash address is?In the AWS console, when creating an OTA job, there is a field for the device file path, where we always use "/". In an idea solution, I could pass a different path, and retrieve it with NVS.ShareKodyAWS 4 months agoThe hardest part is determining where you want to write the block to. For OTA updates, it's often flash since it's non-volatile. For example, if you're using an ESP32 you can use the OTA data partition with it's corresponding APIs to store your file. Then you can simply read out from that.The number of partitions is either determined by you or the vendor.The size of the file should be tracked in the OtaFileContext_t struct as the fileSize member.ShareAndrew 4 months ago@kodyAWS it feels strange to use this API, but I suppose why not? So I would wait for the OTA download to complete, and then call esp_ota_get_next_update_partition to obtain the uint32_t address and uint32_t size, and then esp_flash_read into my buffers. The state machine for the OTA update is a little opaque, with the additional library layer from the freeRTOS example code for OTA, where would be the best place to cancel the OTA UPDATE, such that the system is left in a good state, and I am then still able to get my data? Thanks again for your help! I think we are close to having a good solution for future users!Share"


Question: Can we chmod for a "subdir" under an S3 bucket from an AWS SFTP server?

"I have an SFTP server with a couple of users. Their roles allow for read, list, and write but not delete. Once I log into the server, is it possible to do chmod to change permissions of a specific directory? How does that work given the roles and permissions already set in a policy?FollowComment"

Answer: 2Accepted AnswerChmod would not work with AWS SFTP back by S3 as it is not POSIX compliant. You would need to change the policy for s3 access controls. If you were using EFS it would work.CommentShareMichael_Kanswered a year ago


Question: "AWS Amplify: Is it possible to retrieve the S3 bucket, SSR Lambda@Edge, and API Lambda@Edge names during Build process?"

"Hello,During a Preview Environment build process, is there any way to retrieve information regarding the S3 bucket name, SSR Lambda@Edge name, API Lambda@Edge information for the deployment? (Please see image below).  I would like to be able to get this information during pre-build process to set it in my own environment variables due to how our code is structured.Please advise.Thank you.FollowComment"

Answer: "0Nope, since these are Amplify Hosting managed resources provisioned/updated at build time, we would not have a mechanism to get this information prior to a successful deployment.CommentShareSUPPORT ENGINEERVishal_Nanswered 8 months ago"


Question: Pass IAM roles to Quicksight - Enable different user creation depending on IAM group

"Hi everyone,We are setting up an application for our clients which includes a Quicksight dashboard. External users to the dashboard should be invited through Quicksight, but all users of the client who will have some administrative tasks in the operation of the application, and thus also have IAM users, should access Quicksight through their IAM user.I tried to follow the steps in your documentation on Quicksight and IAM, but I am not sure I understood everything.What I want is that users within a certain IAM group for readers will only be able to create Reader accounts when first signing in to Quicksight, while those in another group for Quicksight admins will create admin or author accounts.But when I select "Manage QuickSight access to AWS services" and choose "IAM / Use existing role" I only see the option to select one role. So how would I best design this to get a different treatment for different users? Variables in the policy? Or did I misunderstand and the steps outlined in the documentation on passing the IAM role with Quicksight permissions to Quicksight apply only for the administrator role, but not the users who should only be readers?Did I understand correctly that at first at least one "normal" login and user creation (with email registration) in Quicksight via the managed service role is needed as one can only change to the use of IAM roles there?Many thanks for your help!Best regardsFollowComment"

Answer: "1Hi.I understand that you want an IAM user to be able to self-provision their own QuickSight user with the QuickSight role (ADMIN/AUTHOR/READER) determined by the IAM group they belong to.First, QuickSight role when self-provisioning is determined by having one of the following in the applied IAM policy:quicksight: Create Adminquicksight: Create Userquicksight: Create ReaderSo you should set IAM policy to allow any of the above actions for IAM group.https://dev.classmethod.jp/articles/quicksight-iam-provisioning/ (Sorry for Japanese, please translate)But when I select "Manage QuickSight access to AWS services" and choose "IAM / Use existing role" I only see the option to select one role. So how would I best design this to get a different treatment for different users?This role you're seeing is from the QuickSight admin screen, right?This is a QuickSight service role.For example, this IAM role is used when QuickSight accesses Athena or S3 to retrieve data.It has nothing to do with logged-in QuickSight users.CommentShareEXPERTiwasaanswered 4 months ago"


Question: Amazon comprehend PII detection job: Error parsing parameter 'cli-input-json': Invalid JSON received.

I am trying to run a pii detection job using the commandaws comprehend start-pii-entities-detection-job \    --region us-east-1 \    --job-name pii_test\    --cli-input-json input.jsonBut I get the errorError parsing parameter 'cli-input-json': Invalid JSON received.My json is formatted correctly as far as I can tell. Has anyone seen this before or know a fix? ThanksFollowCommentJames_S EXPERT7 months agoCan you share your JSON? Does it parse correctly through a tool such as jq?Share

Answer: "1The --cli-input-json option takes the actual JSON document as its value, not a filename. You need to use file://input.json, which will make the CLI read the value from the file.(Had a brainwave a while after posting my initial comment above!)CommentShareEXPERTJames_Sanswered 7 months agoCharith 7 months agoThanks that worked!Share"


Question: CFN or CLI to deploy lambda layer from Serverless Application Repository?

"My project is using canvas-nodejs from the AWS Serverless Application Repository. When at the referenced page, you click deploy, the layer is installed into your current account. Once this is done you can get  its ARN and use it as a layer in your Cloudformation file. I gather that this happens using a SAM template--I see a stack in my account that creates the lambda layer resource.I'd like to do this automatically (via Cloudformation or CLI) when I build my application (no user button click required). I should be able to query the SAR for info on this layer and use that information to create a shell script or CFN file to deploy the layer (and get a reference to it for my subsequent Lambda creations). I see serverlessrepo stuff in the CLI manual but get permission errors (as admin?) when I try to run any of it and I'm not sure if this is the way to go.Lost and would appreciate some pointers on this--there's got to be a way to automate it.FollowComment"

Answer: "0Hi,One option could be, as pointed out here: https://docs.aws.amazon.com/serverlessrepo/latest/devguide/sharing-lambda-layers.html,To reference the arn under the layers section:Resources:  MyFunction:    Type: AWS::Serverless::Function    Properties:      Handler: index.handler      Runtime: python3.7      CodeUrl: source/app-code/      Layers:        - arn:aws:lambda:us-east-1:012345678901:layer:shared-layer:1This case would fork if you can just keep track of layer arns. Does it fit your case?CommentShareEXPERTalatechanswered 17 days agoLos Alamos Al 17 days agoThanks. That's what I do now to USE the layer (I grab the ARN from the deployed CFN resource using the console). I want to automate the deployment process (and retrieval of the ARN) so I don't need to use the console.Sharealatech EXPERT17 days agoHi, above does not use the console, as it handles provisioning via CFN. You could store a configuration or mapping which Holds the information of the layer ARN WITHIN your cloud formation template, as the layer ARN is a static string.If you instead want to dynamically retrieve the layer ARN from the SAR site, you can try and look into this: https://docs.aws.amazon.com/serverlessrepo/latest/devguide/serverlessrepo-api-permissions-ref.html or CLI https://docs.aws.amazon.com/cli/latest/reference/serverlessrepo/list-applications.html to list application programmaticallyShareLos Alamos Al 16 days ago@alatech Thanks for your links that you posted. They helped get me down the road. I will be posting a detailed answer soon.Share0There are two ways to deploy a Lambda layer from the AWS Serverless Application Repository (SAR) depending on your preferences and familiarity:Using the AWS CloudFormation (CFN) templateUsing the AWS Command-Line Interface (CLI)Using the AWS CloudFormation templateThe AWS SAR provides a CloudFormation template for each layer. You can use this template to deploy the layer to your account. To do this, follow these steps:Go to the AWS SAR page for the layer that you want to deploy.Click the CloudFormation template link.Copy the template code.Open a CFN template file in a text editor.Paste the template code into the file.Replace the REPLACE_WITH_YOUR_ACCOUNT_ID placeholder with your account ID.Deploy the template using the aws cloudformation deploy command.Using the AWS CLIYou can also use the AWS CLI to deploy a Lambda layer from the AWS SAR. To do this, follow these steps:Install the AWS CLI.Run the following command to list the available layers:aws serverlessrepo list-layersFind the ARN of the layer that you want to deploy.Run the following command to deploy the layer:aws serverlessrepo deploy-layer --layer-arn <layer-arn>If you're experiencing difficulties deploying a Lambda layer from the AWS SAR, you should check if you are using the correct account ID. Next, verify that the layer you are attempting to deploy is available in your designated region. Lastly, double-check that you possess the necessary permissions to deploy layers.CommentShareNeerajskydiveranswered 17 days agoLos Alamos Al 17 days agoThanks for the detailed response. I'd like to reiterate that I want to do all of this in a CI/CD process, so I can not use the console. I could do everything you suggest in "Using CFN Template", but if I'm in the console I may as well just hit the Deploy button and manually copy the ARN as I do now.Second, I do not see list-layers as an option in the AWC CLI V2 aws serverlessrepo command?Thanks again for taking the time to post this detailed reply.ShareNeerajskydiver 17 days agoHi Los Alamos Al,Thanks for your feedback. I understand that you want to automate the deployment of the Lambda layer from the AWS Serverless Application Repository (SAR) in your CI/CD process.To do this, you can use the AWS CLI to deploy the layer from a shell script or CFN file. The following code snippet shows how to deploy the layer from a shell script:#!/bin/bash# Install the AWS CLIaws-cli# List the available layersaws serverlessrepo list-layers# Find the ARN of the layer that you want to deploylayer_arn=$(aws serverlessrepo list-layers | jq -r ".Layers[].Arn")# Deploy the layeraws serverlessrepo deploy-layer --layer-arn $layer_arnTo deploy the layer from a CFN file, you can use the following code snippet:{  "AWSTemplateFormatVersion": "2010-09-09",  "Resources": {    "MyLambdaLayer": {      "Type": "AWS::Serverlessrepo::Layer",      "Properties": {        "LayerName": "MyLambdaLayer",        "ContentUri": "https://example.com/my-lambda-layer.zip"      }    }  }}Once you have created the shell script or CFN file, you can deploy the layer by running the following command:# Deploy the layer from a shell scriptbash deploy_lambda_layer.sh# Deploy the layer from a CFN fileaws cloudformation deploy -f deploy_lambda_layer.yamlI hope this helps!ShareLos Alamos Al 16 days ago@Neerajskydiver Thanks again for taking the time to post a detailed response. However, as I mentioned in my first comment, list-layers is not a subcommand on the aws serverlessrepo command (it's on the aws lambda command). Nonetheless, your post did help me find a solution which I will be posting as a answer soon.Share"


Question: How to override resourceRequirements with aws_cloudwatch_event_target?

"I have a AWS Batch Job defined in Terraform and working fine in AWS. I am creating several override rules with cronExpression() so the job is invoked at specific times.I am using aws_cloudwatch_event_target and aws_cloudwatch_event_rule. Most of the functionality works. I am the rule triggers with the right, name, arn, etc. even the right command.My TF code looks like:resource "aws_cloudwatch_event_rule" "batchjob" {  name       = "foo"  is_enabled = true  # runs on the first of every month at 15:00 UTC   # https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html  schedule_expression = "cron(0 15 1 * ? *)"}resource "aws_cloudwatch_event_target" "batchjob_target" {  rule     = "foo"  arn      = "<queue arn>"  role_arn = "<role arn>"  input = jsonencode({    # https://docs.aws.amazon.com/batch/latest/APIReference/API_ContainerOverrides.html    "ContainerOverrides" : {      "Command" : [        "/bin/java",        "-jar",        "/batch-jobs.jar",        "foobar"      ],      # VCPU and MEMORY are linked: https://docs.aws.amazon.com/batch/latest/APIReference/API_ResourceRequirement.html      # https://repost.aws/questions/QUP1kkGbDrT1uC4jTW6DXZ4A/set-cpu-and-memory-requirements-for-a-fargate-aws-batch-job-from-an-aws-cloudwatch-event      "ResourceRequirements" : [        {          "Type"  = "VCPU"          "Value" = "4"        },        {          "Type"  = "MEMORY"          "Value" = "8192"        }      ]    }    }  )}batch_target {  job_name       = "foo"  job_definition = aws_batch_job_definition.job_definition.arn}I have confirmed that ContainerOverrides and Command must be pascal case for it work. If I use camel case, it doesn't see the overrides.I was able to get it to work vai the AWS CLI with the following command:AWS_PROFILE=dev aws batch submit-job \        --job-name "foobar" \        --job-queue "arn:aws:batch:us-west-2:<queue>" \        --job-definition "arn:aws:batch:us-west-2:<definition>" \        --container-overrides '{"command": ["/bin/java","-jar","/batch-jobs.jar","foobar"], "resourceRequirements": [{"value": "4", "type": "VCPU"}, {"value": "8192", "type": "MEMORY"}]}'But I cannot figure out the proper syntax, in terraform to override the resource requirements. What am I missing?FollowComment"

Answer: "1Accepted AnswerHi Eric, thanks for reaching out!Looking in to this, I was able to confirm internally that the ResourceRequirement parameters under ContainerOverrides are not processed when configuring a Batch Job as an EventBridge rule target. The parameters under Command will be accepted, but ResourceRequirements do not get passed from the EventBridge Target to the Batch Job. I can also confirm that there is a Feature Request in place to allow for this, but I'm unable to provide an ETA on when this may be available.However, I can recommend that instead of using an EventBridge rule with a cron expression, you can accomplish your use case using the newer EventBridge Scheduler feature. This feature has TerraForm support and will allow you to schedule direct Batch SubmitJob calls with all the parameters you wish to pass, including Container Override parameters with ResourceRequirement fields.I tested this feature with VCPU and MEMORY ResourceRequirements with a Scheduler schedule in the console and passed the following JSON for the API call:{"JobDefinition": "arn:aws:batch:us-west-1:123456789012:<definition>","JobName": "MyData","JobQueue": "arn:aws:batch:us-west-1:123456789012:<queue>","ContainerOverrides": {"ResourceRequirements": [{"Type": "VCPU","Value": "4"},{"Type": "MEMORY","Value": "8192"}]}}The job was successfully started using the VCPU and MEMORY requirements specified in my ContainerOverride fields.I hope this information was helpful!CommentShareSUPPORT ENGINEERJustin_Banswered a month agoEric L a month agoJustin, thank you very much for all the info. I will get with our Cloud team and see if we can start using Scheduler. That definitely seems like the better way to go!Share"


Question: "502 error Beanstalk with load balancer and vpc, Metabase"

"hello everyone,I am trying to deploy the metabase service to my prod env using this method hereI have been able to do it multiple times without any failure on my tests env.I am facing a problem during the deployment of the environment, the health check is failing and the instance is unreachable resulting to a 502 bad gatewayHere are the Health status  :Process default has been unhealthy for 6 hours 27 minutes (Target.FailedHealthChecks).Instance has not sent any data since launch.The load balancer receive the requests but fail to forward it according to the monitoring page.It is obviously a problem on my production environment since it's working on the others but I have no clue where the problem is, I think it is linked to my VPC.I have a VPC on my envs with private and public subnet all linked to an internet gateways such as the illustration below.I am not a network expert and I do not know where to start.I have check all the route tables and try to see a difference between prod and tests and did no find anything.Of course I have tried to rebuild the app from scratch resulting to the same result.I hope someone could lead me in the right direction.Thanks a lot and have a nice day.FollowComment"


Question: How to get MAC Address for M5Stack

How can i get MAC Address for M5Core kit ? I need that to be able to get it connected to the secure wifi networkFollowComment

Answer: "0Hi. Unless I misunderstand, this is more a general ESP32 question than AWS. If I understand correctly: https://github.com/m5stack/m5-docs/blob/master/docs/en/api/wifi.md#wifimacaddress. That's assuming you can modify the firmware.CommentShareEXPERTGreg_Banswered 10 months ago"


Question: How to communicate with a single ECS Container from a server less environment

"Dear Community,Please imagine the following scenario:I have multiple long running computation tasks. I'm planning to package them as container images and use ECS Tasks to run them.I'm planning to have a server less part for administrating the tasksOnce a computation tasks starts, it takes the input data from a SQS queue and can start its computation. Also all results end up in an SQS queue for storage. So far, so good.Now the tricky bit: The computation task needs some human input in the middle of its computation, based on intermediate results.Simplified, the task says "I have the intermediate result of 42, should I resume with route A or route B?". Saving the state and resuming in a different container (based on A or B) is not an option, it just takes too long. Instead I would like to have a server less input form, which sends the human input (A or B) to this specific container. What is the best way of doing it?My idea so far:Each container creates his own SQS queue and includes the url in his intermediate result message. But this might result in many queues. Also potentially abandoned queues, should a container crash. There must be a better way to communicate with a single container. I have seen ECS Exec, but this seams more build for debugging purposes.FollowComment"

Answer: "1The SQS option is a good one. A way to work around the abandoned queue issue is to write the names of the queues into a DynamoDB table with a TTL. Every so often, the container updates the TTL. If the container crashes, the record will eventually be deleted, which will show up in a DynamoDB stream, which can be used to delete the queue.An alternative might be to expose and HTTP endpoint directly on the ECS task itself, and send the URL with the request. When the use input is received, you make a call to the specific URL. This will make the solution easier.I am not sure I understand that saying that saving the state and resuming from a different container takes too long. What do you mean? The time it takes to save and restore? If so, don't forget there is a human in the loop which will take much longer probably. Also, while the container is waiting for the result, it doesn't do anything, which means that you are just idling there, wasting money. I would check again the option to make it event driven and resume in a different container.Finally, I would recommend looking into breaking the process into smaller tasks and use StepFunction to orchestrate them, instead of an ECS task. You can then use the Wait For Task Token to get the human's response.CommentShareEXPERTUrianswered 4 months agostefan 4 months agoThanks! Is it possible to reach a single container via http if multiple containers are running on a single host machine?ShareUri EXPERT4 months agoNot a container expert, but should be possible.Share0This seems like orchestration, have you considered Step Functions ?  You can Invoke and Manage ECS Tasks.https://docs.aws.amazon.com/step-functions/latest/dg/connect-ecs.htmlCommentShareRolyanswered 4 months agostefan 4 months agoI see the similarities, but as long as the task is not splittable, I need to pass information into an already running container, not only start-parameters.Share0While this isn't exactly what you were asking, as a generic way of getting interactive access to ECS tasks you could use ECS exec. It works for both EC2 and Fargate. And using Copilot makes it easier.https://aws.amazon.com/blogs/containers/new-using-amazon-ecs-exec-access-your-containers-fargate-ec2/https://aws.amazon.com/blogs/containers/connecting-to-an-interactive-shell-on-your-containers-running-in-aws-fargate-using-aws-copilot/CommentShareKalluanswered 4 months ago"


Question: "Amazon cognito throwing error - phone number required, when i signin with google"

"I have created a user pool and have added google as identity provider. When i try to login with google, it is throwing error as phone_number requiredFollowComment"

Answer: "0Have you configured a phone number with Amazon Pinpoint? You are required to do this so you can send SMS messages for identity verification:Create Cognito User Pools:Note: This action might generate an SMS text message. Starting June 1, 2021, US telecom carriers require you to register an origination phone number before you can send SMS messages to US phone numbers. If you use SMS text messages in Amazon Cognito, you must register a phone number with Amazon Pinpoint. Amazon Cognito uses the registered number automatically. Otherwise, Amazon Cognito users who must receive SMS messages might not be able to sign up, activate their accounts, or sign in.https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPool.htmlCommentShareJamesMcDuffieanswered 4 months ago"


Question: How to find Availability Zone of Site to Site VPN Outside IP address?

I need to find out what is the Availability Zone for each of two Outside IP  addresses for my Site to Site VPN.In other words I want to know AZ where each VPN tunnel terminates.FollowComment

Answer: 0You cant. It could be in any 2xAZ out of total AZ of the region.  but both VPN devices wont be in same AZ.CommentShareMuhammadanswered 4 months ago0AWS Site-to-Site VPN is a managed service and the Tunnel endpoints are inherently highly available; You will not be able to find out the AZ.As shown in the documentation 1 VPN connection has 2 redundant Tunnel endpoints.CommentShareEXPERTTushar_Janswered 4 months ago


Question: Stopped/start instance

"Hi, I am a bit of a newbie. I wanted to change my instance type, so I stopped my instance change the type from t2.medium to t2.micro and then tried to start again the instance however now I cant see the service in my domain.How can I revert that change or attach again the service I had. (Passbolt)FollowComment"

Answer: "1What do you mean by "cannot see the service in my domain"?The documentation describes the steps to change the instance type [1].If the instance starts and you can connect via SSH for instance, I would recommend to troubleshoot the service itself in the OS.Also, are you using the public IP to access the service? If so, if you do not attach an elastic IP to the instance, the IP will change once you stop and start the instance.Finally, as per the Passbolt documentation [2], t2.micro does not seem to match the vendor minimum hardware requirements (2 cores, 2Gb RAM).Hope that helps.[1] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-resize.html[2] https://help.passbolt.com/faq/hosting/hosting-requirementsCommentShareEXPERTJonathan_Danswered 4 months agoEXPERTkentradreviewed 4 months ago0I attempted to change the instance type from medium to micro. Because of your comment i set back to the medium instance again.... do you happen to know how to see my passbolt again? The IP has changed and the page where I used to see my passbolt fails at the moment.CommentSharerePost-User-3737208answered 4 months agogmougenel 4 months agoHey,If the IP changed, I would recommend you to use the command "dpkg-reconfigure passbolt-pro-server" (change pro by ce in the command depending on the Passbolt version you use)-> answer "no" for the mysql part-> answer "yes" for the nginx server then choose the same option you did the first time (none or manual or auto) and here you will be able to chain the Passbolt domain name, you can put your new IP and then get back to your browser to access back to your Passbolt instance via the new IP/Domain name.As mentioned before, I would strongly recommend you to attach an elastic IP to your instance in order to not have to reconfigure this every time it restarts. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.htmlShare"


Question: AWS Services That Use EC2 Instance MetaData by Default

"I have been trying to see what services could be utilizing IMDSv1 or v2 by default, but could not find resources that could list any of those services, if any. We are switching all of our instances from IMDSv2 being optional to required (only allowing the use of IMDSv2). For some instances and prior to switching from v1 to v2, where we are sure we are not leveraging the meta data in any way within the instance, I can still see consistent use of the IMDSv1, by using the AWS recommend way of tracking the MetadataNoToken metric in CloudWatch. At this point not sure if there is any way to track what could be utilizing the metadata for those instances, and constantly, on almost equal intervals.Saw an answer here, that is somewhat helpful, but would like to better understand what could possibly be happening behind the scenes.https://repost.aws/questions/QU28Zq5Ge0Q5WJF27HPNMhoA/are-there-any-unintended-side-effects-of-disabling-the-ec-2-instance-metadata-service-endpoint-both-imd-sv-1-imd-sv-2FollowComment"

Answer: "0Behind the scenes as per the documentaiton the various AWS SDKs (as long are they are recent!) support both IMDSv1 and IMDSv2. IMDSv2 is definitely preferred but both will work.You're right - it's going to be quite difficult to determine which processes/applications on an EC2 instance are calling IMDS - that's going to require software on the instance that tracks "outbound" TCP connections then inspects those going to IMDS to determine what HTTP verb it is using. It's highly possible there are libraries which use IMDSv1 as a preference but will use IMDSv2 when v1 isn't available but the only way to be sure is ti test - or look at the source code.CommentShareEXPERTBrettski-AWSanswered 5 months agoZiad 5 months agoThanks for the answer! just to clarify im fully aware of the SDK scenario, but we have no code running on the instance, we are only running a simple 3rd party solution that is not EC2 nor aws specific. This behaviour is observed on a couple of different instances. Does using an amazon-linux ami have any effect at all, im mean does it utilize any meta data at all, by default ?ShareBrettski-AWS EXPERT5 months agoThere are likely tools and automated scripts running on the instance that do access IMDS. A good example would be the CloudWatch agent.Share"


Question: Cannot connect to RDS instance with PGAdmin

"Hi, I've been connecting to a public RDS instance with pgAdmin for the past 2 years with no problems.  Starting 2 weeks ago, I get a timeout error connecting to the same instance.  Nothing has changed in the RDS configuration.  Public Assessible is turned on.  There are inbound rules of the vpc security group open on port 5432 for all IPs.  I added a rule with my own IP just in case, but that doesn't help.The website that query the postgres DB on this instance still works which means the DB is there and working, but its just pgAdmin that cannot connect to it.Can't figure out what is causing this.  Help !FollowComment"

Answer: "0It could be that the version of the RDS Postgres database was upgraded recently and that has rendered the pgadmin version incompatible. Or else your pgadmin may have gotten corrupted for whatever reason. If you haven't tried it already, I would try reinstalling pgadmin and see if that helps.We also have a Premium Support article that may help debug - https://aws.amazon.com/premiumsupport/knowledge-center/rds-cannot-connect/CommentShareEXPERTIndranil Banerjee AWSanswered 9 months agorePost-User-4968810 9 months agoThanks for the reply.  I downloaded the latest version of pgAdmin 4 and still getting the same timeout expired error.ShareIndranil Banerjee AWS EXPERT9 months agoIs the application that is working using the same username/password to connect to the database, as pgadmin? If not, make sure the password of the user was not modified. If the Security Group inbound rules are fine, I would also take a look at the security group outbound rules and also NACLs on the subnet to ensure nothing has changed recently. Can't think of any other reason why pgadmin would suddenly stop connecting to the database.Share"


Question: Connecting to Glue Hive Data Catalog from EC2 or Local Computer with Spark

"Hi,I built Iceberg table that uses Glue as the Hive catalog. Team members I work with want to connect to it using Spark. They run Spark locally on their laptop and want to read the table or they have Spark running locally in an Airflow Task on an EC2 and want to connect to it.Is that possible to configure Spark not running on Glue or EMR to connect to Glue as the Hive Metastore? If so some examples would be appreciative.We set this conf when running Iceberg  "spark.hadoop.hive.metastore.client.factory.class=com.amazonaws.glue.catalog.metastore.AWSGlueDataCatalogHiveClientFactory".Is this a JAR I can add to any Spark application that allows it to connect to AWS Glue as the Hive site or only works on EMR?FollowComment"

Answer: "0Unfortunately, it's not enough to configure that and add the library, the Spark distribution needs to be patched to work with the Glue catalog client.You can build that distribution yourself following the instructions here: https://github.com/awslabs/aws-glue-data-catalog-client-for-apache-hive-metastore but it's much easier to extract the patched jars from EMRCommentShareGonzalo Herrerosanswered 3 months ago"


Question: All events skipped due to certificate verify failed

I have a code deployment setup that has worked fine in the past. I'm trying to deploy a simple update and am getting a failed status due to "certificate verify failed" (pasted below). From researching I found this issue coming up where codedeployagent was not running on the instance. I logged into the instance and codedeployagent was not running so I reinstalled and confirmed it's now running (pasted below). I don't understand why this would suddenly happen after it's been working. Any thoughts on what I'm missing? thxError:2019-07-31T00:01:23 ERROR [codedeploy-agent(1476)]: InstanceAgent::Plugins::CodeDeployPlugin::CommandPoller: Error during perform: Seahorse::Client::NetworkingError - SSL_connect returned=1 errno=0 state=error: certificate verify failed - C:/Windows/TEMP/ocrBFEB.tmp/lib/ruby/2.3.0/net/http.rb:933:in `connect_nonblock'codedeployagent running:PS C:\Users\Administrator> powershell.exe -Command Get-Service -Name codedeployagentStatus   Name               DisplayNameRunning  codedeployagent    CodeDeploy Host Agent ServiceFollowComment

Answer: "0Solution: reboot instance, confirm codedeployagent is running again (I had to restart it).CommentSharejon222answered 4 years ago"


Question: Can the 1MB request payload limit for an ALB Lambda target be increased?

"According to documentation, when using a Lambda target with ALB "The maximum size of the request body that you can send to a Lambda function is 1 MB." https://docs.aws.amazon.com/elasticloadbalancing/latest/application/lambda-functions.htmlAccording to Lambda documentation the maximum synchronous invocation payload is 6MB.Is the 1MB maximum request body size for a Lambda target in ALB a hard limit or can it be raised if a customer use case warrants it?FollowComment"

Answer: 0Accepted AnswerThe 1MB max size for the request body cannot be changed.Also do note the header limits for ALBs which are also hard lmits:HTTP/1.x headersRequest line: 16 KSingle header: 16 KWhole header: 64 KHTTP/2 headersRequest line: 8 KSingle header: 8 KWhole header: 64 KCommentShareAWS-User-1129528answered 2 years ago


Question: File Gateway running in Hyper-V on premise fails to start up

I have a storage gateway that has been running for a while now and today we were unable to access the file shares. The VM was restarted but doesn't get to the menu.Is there a way to run a diagnostic boot which lets me capture the output to look for errors? I used pause/resume to step through the boot process and nothing looked like an error.How do you recover a failed file gateway?ThanksFollowComment

Answer: "0I restored the system disk of the gateway from a VEEAM backup and the gateway came up OK.CommentSharevcStuartanswered 2 years ago0Hello,I'm Mike with the Storage Gateway team.  I'm glad you were able to get your storage gateway running again.  Should you run into a similar situation, you can take steps to verify and recover the system disk as described in these steps:https://docs.aws.amazon.com/storagegateway/latest/userguide/recover-data-from-gateway.html#recover-corrupt-file-systemPlease let me know if you have any more questions.CommentShareMike-HAWSanswered 2 years ago"


Question: NLB-ECS Health Check

"A customer is using NLB with ECS. ALB is not an option for customer as of now.They want to create a Services reporting Health Check info on URL’s, functionality similar to Liveliness/Readiness probes in k8s to ensure service is up and functioning properly and not just port based health checks which NLB does.Is this possible with NLB and ECS? Any recommendations around this?FollowComment"

Answer: "0Accepted AnswerYes, you can use HTTP(s) healthchecks with NLB target groups and choose the path/status codes that indicate whether the target is healthy or not. HealthCheckProtocol and HealthCheckPath are the relevant settings:https://docs.aws.amazon.com/elasticloadbalancing/latest/network/target-group-health-checks.htmlCommentShareAWS-User-8141359answered 2 years agoSmotrov a year agoI've just tested it. Unfortunately it doesn't work with ECS Fargate + NLB in my scenario.The reply from CloudFormation is: "Health check paths are not supported for TCP health checks"ShareSmotrov a year agoIf I try to change health check protocol it says: You cannot change the health check protocol for a target group with the TCP protocolShare"


Question: Cannot assign MFA device

"In our project when we do onboarding of new users, we assign them IAM roles specific to their scope of permissions (account created through terraform). However, all users have MFA enforced (these perms present https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_my-sec-creds-self-manage-mfa-only.html). Unfortunately, some of the users when trying to set up MFA device after logging into the console for the first time, the only thing they can see is a loading icon, which never stops loading. It is very random, it works for some people and not for others. As a result, they are not able to assign an MFA device themselves. Loggin out and in again does not help.When I try to query a list of mfa devices for the user, I get an empty list, which is right as the user just logged in. It doesn't explain the behaviour though. Any help appreciated!FollowComment"

Answer: "0How are you navigating to the MFA setup page via IAM service or via the Security Credentials  shortcut? I have faced this issue in the past with ForceMFA and navigating directly from Security Credentials helps 90% of the timeCommentShareEXPERTgauravanswered 8 months agokmbzdyk 8 months agoUnfortunately, we already navigating to the MFA setup page through Security Credentials. But thanks for the answer! Have you ever managed to fully get rid of this behaviour?Share"


Question: Output HLS Manifest file contains NEITHER Master nor Stream Playlist tags

"Hello,I've successfully configured the MediaLive channel to output incoming stream to the S3 bucket in HLS format.And from time to time, the "main" manifest is missing its master tags (#EXT-X-STREAM-INF), even though other playlist manifests, to which the main one should point, are present and contain he correct data.Example:_stream.m3u8_#EXTM3U#EXT-X-VERSION:3#EXT-X-INDEPENDENT-SEGMENTS_stream_1.m3u8_#EXTM3U#EXT-X-VERSION:3#EXT-X-TARGETDURATION:10#EXT-X-MEDIA-SEQUENCE:1#EXT-X-PLAYLIST-TYPE:VOD#EXTINF:10.00000,stream_1_00001.ts#EXTINF:6.00000,stream_1_00002.ts#EXT-X-ENDLISTI was not able to find out what is the cause of this strange behaviour and would be really grateful for any help.Best regards.FollowComment"

Answer: "0Hi Ibrcko,This usually indicates the pipeline has paused. One reason this might occur is that the input has been lost, and the InputLossAction is set to PAUSE_OUTPUT. One of the things MediaLive does when pausing outputs is removes their renditions from the parent manifest.Try changing InputLossAction to EMIT_OUTPUT and see if that changes the behavior.Regards,SteveCommentShareSteve_Wanswered 3 years ago0Hi Steve,Thank you for your response.After I have changed InputLossAction to EMIT_OUTPUT, the problem mentioned does not occur anymore.The reason why InputLossAction has been set to PAUSE_OUTPUT in the first place is to stop MediaLive from outputting if there is no input video detected.How would one achieve the described behavior if InputLossAction option is out of the question?Best regards.CommentShareibrckoanswered 3 years ago0In this case you have a couple of options.Leave the InputLossAction configured to EMIT_OUTPUT and use the Cloudwatch Events emitted by MediaLive to detect when an input goes away. These events correspond to the alerts seen in the MediaLive console and could be used as the basis for taking action (like stopping the channel).Change InputLossAction back to PAUSE_OUTPUT, and create a static version of the main manifest by copying it to a different name. Direct your players to the static version of the manifest instead of the dynamically created one from the channel. Note that part of the default behavior of pausing the output includes deleting the rendition manifests, so this may not achieve your goal either.Regards,SteveCommentShareSteve_Wanswered 3 years ago0Thank you, that advice is really helpful.I have configured events and targets for MediaLive alerts.Now I'm trying to figure out how to distinct alerts:There is no input data - is it because input data has never been detected, or because it is lost.How can I distinct these two virtually equal states/alerts?CommentShareibrckoanswered 3 years ago0Hi ibrcko,There is one message that occurs at channel start that does not happen when a source goes away once the channel is already running, the message text is "Initial Probe is Taking Longer Than Expected"That should allow you to differentiate between no signal at start versus signal going away later.Regards,SteveCommentShareSteve_Wanswered 3 years ago"


Question: Is it possible to use Auto Scaling for SAP Applications?

Is it possible to use Auto Scaling for SAP Applications?“NOTE: This is a common question asked by AWS customers. The AWS team is posting it to provide an answer that can benefit everyone.”FollowComment

Answer: 1Accepted AnswerSAP has specific application requirements for autoscaling to work correctly (e.g. understanding of workprocess and server availability). AWS has worked with customers in the past to implement autoscaling solutions. Please refer to the following blog for example details: [https://aws.amazon.com/blogs/awsforsap/using-aws-to-enable-sap-application-auto-scaling/]We recommend you reach out to your local SAP on AWS team https://pages.awscloud.com/GLOBAL-partner-SP-SAP-on-AWS-2020-interest.html to discuss possible SAP autoscaling solutions which meet your requirements.Please note AWS native EC2 Auto Scaling is not supported with SAP on AWS.NOTE: This answer is provided by the SAP on AWS speciality team and is accurate at the time of publish. Please check comments as the answer may have changed/services evolved.CommentShareDeep_Kanswered a year ago


Question: Possibilities for securing public ECR

GEO BLOCKING FEATURE IN ECRCurrently we have a public ECR hosted for one single docker image in Production Account.We need to enable geoblocking for this public ECRFollowComment

Answer: "0Hello,As of now please note that ECR does not support Geo blocking and thus the image hosted in Public ECR will be available globally. However if you feel that it is important to have this feature then you can open a new Feature request as a GitHub issue in our containers roadmap[1]. The issues opened in our roadmap will be regularly checked and you will also be able to track it in container-roadmap[2].[1] https://github.com/aws/containers-roadmap/issues[2] https://github.com/aws/containers-roadmap/projects/1CommentShareSUPPORT ENGINEERNambinayagan_Yanswered 7 months agokamal k 7 months agoThanks for your suggesstionShare"


Question: Can I enable my SFTP Server during certain hours and disable it when not needed?

Would I be able to schedule our Amazon SFTP Server to be enabled only at certain times and have it automatically disabled at other times.Example: if I always get files transferred between 10:00 PM - 2:00 AM (EST) then I do need need to have the SFTP Server active all times. There is also a cost associated with having it on 24/7.Thank youFollowComment

Answer: 1Accepted AnswerYou can start and stop your SFTP server but this does not impact billing. You must delete the server to stop billing. As per https://docs.aws.amazon.com/transfer/latest/userguide/API_StopServer.htmlCommentShareleftbrainstuffanswered 2 months ago


Question: Windows Server Standard Edition

A customer is asking if AWS only provide Datacenter editions of Windows Server or if we also offer Standard editions. Checking on the AMI's I could not see any Standard edition as well.Has anyone have insights on this?FollowComment

Answer: "0Accepted AnswerPart1:It might depend on the version you're looking for but here comes a full list of supported AMIsFor instance the answer is "yes" for  Windows Server 2012 R2"We will be releasing AMIs with Windows Server 2012 R2 Standard Edition. For details on the differences between the Windows Server Editions, please refer to the Microsoft documentation."And you'll see a variety of offerings for Win 2019.Part 2 :It looks you're right for AWS provided AMIs , but there seems to be an option if you enhance your search to marketplace :"Microsoft Windows Server 2016 with SQL Server 2019 Standard"Frankly speaking i'm not quire sure about its difference than AWS provided"Microsoft Windows Server 2019 Base". It might make sense to check with MS TeamBut it seems to be the license you're looking for as per MS Docs :CommentShareAWS-User-7941877answered 3 years ago"


Question: certificate problem

"We have an App hosted on AWS (app.sailingplan.ca, dashboard.sailingplan.ca and api.sailingplan.ca).We have renewed our Amazon certificates (3) but continue to get a certificate error (NET::ERR_CERT_DATE_INVALID). The certificate manager shows that the certificate is in good order. Still trying to figure out what to do to resolve this problem.  Please advise.FollowComment"


Question: CLI for renaming file in S3

"I've renamed a S3 file with this CLI command:aws s3 mv s3://bucket/folder/file1 s3://bucket/folder/file2It took some seconds, so I presume it moved physically the file data. Is there a way to simply rename the file, without moving the data? It will make the command quicker for large files.FollowComment"

Answer: "1Accepted AnswerThat is an interesting questions and I was looking at the possibilities for this. And I believe there is no better or easier way to rename an object other than what you have mentioned. There is no such option available to rename an object in either S3 CLI or s3api CLI. Further,  in the AWS doc, it is suggested you have to copy an object in order to rename it.I was also looking at possible options to somehow change some object metadata. You can see details about object metadata here. However, I don't see any metadata field in system metadata for the object or key name. Furthermore, the document explicitly mentions the following:After you upload the object, you cannot modify object metadata. The only way to modify object metadata is to make a copy of the object and set the metadata.So I believe copying the object is going to be your only option.CommentSharetahatahiranswered 10 months ago"


Question: Parameter file not is not working in Code Build template

"I have created a codebuild solution. It is able to create stack when the parameters are assigned in the template.yml file. But when the parameters are defined into a separate file, unable to create the Changeset.I have added TEMPLATE_PATH = template.yml and PARAM_FILE_NAME = param.json in codebuild environment variable.template.yml look like ---->AWSTemplateFormatVersion: '2010-09-09'Transform: 'AWS::Serverless-2016-10-31'Description: CloudFormation template to create lambda layerParameters:  pPyPackageBucket:    Type: String    Description: S3 Bucket for software lib packageResources:  LambdaLayer:    Type: 'AWS::Lambda::LayerVersion'    Properties:      CompatibleRuntimes:        - 'python3.9'      Content:        S3Bucket: !Ref pPyPackageBucket        S3Key: 'package/python.zip'      Description:  'Python package'      LayerName:  'pandas'param.json look like ---->{    "Parameters": {        "pPyPackageBucket": "s3-my-softwares"    },    "StackPolicy": {}}buildspec.yml look like ---->version: 0.2phases:  pre_build:    commands:      - . ${CODEBUILD_SRC_DIR}/build-scripts/pre_build.sh  build:    commands:      - . ${CODEBUILD_SRC_DIR}/build-scripts/build.shartifacts:  files:    - ${TEMPLATE_PATH}    - ${PARAM_FILE_NAME}  discard-paths: noGetting the below codebuild error:Failed to create changeset for the stack: cicd_lambda_layer, An error occurred (ValidationError) when calling the CreateChangeSet operation: Parameters: [pPyPackageBucket] must have values.How to resolve this issue?FollowComment"


Question: Snowball use-case as a backend server

"Dear community members,  I am trying to evaluate Snowball as small backend server for demonstration of our functionalities in remote locations. It could be simple option for me instead of having Data Center due to temporary usage.I have below questions with respect to it,Can I get the Snowball delivered in East African countries from South Africa region. For example, I need it in Kenya, Zambia, Zimbabwe where there is no Azure region.Can I run a VMs for my local application specific workload on Snowball ?  For example, I want to run AWS RDS, EKS, Application Load Balancer, etc...For how long I can keep Snowball with me. I can see 3 year plan available but is it possible to even extend further if required.Does it support All region specific services to run Container based backed application?FollowComment"

Answer: "0Regarding shipping, AWS does not currently support shipping of devices between countries, with exceptions in the EU (see link).https://docs.aws.amazon.com/snowball/latest/developer-guide/shipping.htmlRegarding device capabilities, AWS Snowball Edge does support VMs (using Amazon EC2), AWS Lambda, and Amazon EKS.https://docs.aws.amazon.com/snowball/latest/developer-guide/using-device.htmlWhen ordering the Snow Family device, we have the option to enable auto-renew on the three year plan you have mentioned.CommentShareDarren Ranswered 3 months ago"


Question: Cannot connect to registry.npmjs.org from EC2/us-west-2

"It started when I couldn't install npm packages on one of my VMs and eventually I tracked it down to TCP connections to registry.npmjs.org hanging indefinitely on any VM in us-west-2 for my account. When I create an identical VM in us-east-1, npm works fine and I can connect to registry.npmjs.org with curl as well. This appears to be a routing problem with VMs in us-west-2.This is one of npm's registry IP addresses. There's a few more, different only in the 3rd quad.registry.npmjs.org.     205     IN      A       104.16.27.35  This command hangs indefinitely and so does any npm command:curl https://registry.npmjs.org/  Wireshark just shows that no packets are ever received. What's weird is that when I run traceroute from us-east-1, there's only a dozen of hops to registry.npmjs.org and everything works fine, but traceroute from us-west-2 goes through as many as 27 hops before it times out. Here's last few hops, skipping timed out ones:20  100.92.128.96 (100.92.128.96)  18.412 ms  21  100.92.128.61 (100.92.128.61)  7.759 ms  22  100.92.125.38 (100.92.125.38)  9.742 ms  25  100.92.133.49 (100.92.133.49)  7.865 ms  26  150.222.214.102 (150.222.214.102)  10.175 ms  27  99.83.70.195 (99.83.70.195)  9.859 ms  The last couple of addresses belong to AWS, which seems to hint that it's an AWS problem, but it's just a guess.This has been going on for over a week and there are no active AWS issues reported in my console. If anybody has a working npm in us-west-2, can you share any insights how you got it working?This is the traceroute command I ran. Wonder if it goes through as many hops in a working environment.traceroute -q 1 -F registry.npmjs.org  Thanks!FollowComment"

Answer: "0I tried creating a VM in us-west-1 today and it also works and pulls npm packages from the registry and traceroute only takes 14 hops to reach registry.npmjs.org. There's something not quite right with routing in us-west-2.CommentShareaws-27182answered 2 years ago0See this thread for detailshttps://repost.aws/questions/QUlO_9mGjYQbieMm-HhMaIpA/cannot-connect-to-registry-npmjs-org-from-ec-2-us-west-2Edited by: aws-27182 on Dec 4, 2021 4:08 PMCommentShareaws-27182answered a year ago"


Question: How to find cause of mailbox export failure

"I set up a Cloudwatch rule to schedule a Lambda to call Boto3's start_mailbox_export_job on a Workmail mailbox.  The Lambda checks the JobId to ensure it didn't immediately fail, logs the job information, and quits.  However, I noticed later when I used describe-mailbox-export-job through the CLI that the export job failed after some 5 hours and 30 minutes.  The API doesn't offer any insight into the cause of the failure.  Is there any way to obtain this information?FollowComment"

Answer: "0Hi,I'm sorry to hear you're experiencing problems with the mailbox export of your user. I checked with the service team and the confirmed there was a problem that has been fixed. You should be able to try again.The team also mentioned that the error output needs to be improved and will work on that.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 2 years ago0Hello, Robink,Unfortunately, another automated export ran today, but failed after 5.5 hours.  Is there no way to gain any insight on what's happening?I manually triggered the lambda yesterday on a smaller test mailbox, which completed without issue, so I know it's not a mundane problem like inadequate permissions.Edited by: brianbauman on Feb 9, 2021 7:54 PMCommentSharebrianbaumananswered 2 years ago0Hi,I'm very sorry to hear that. I will contact the service team to investigate this.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 2 years ago0I appreciate your efforts, Robin.If it's helpful, both exports started around 17:15 UTC and failed a bit over 5 hours later at around 22:30 UTC.So perhaps the mailbox exporter times out after 5-ish hours?  Or possibly there's some sort of regular maintenance or scheduled event at ~22:30 UTC that interrupts any mailbox exports running at that time?Just some thoughts.~BrianCommentSharebrianbaumananswered 2 years ago0Hi Brian,The service team checked your error and pushed out another fix. Could you try to do the export again?Kind regards,RobinCommentShareMODERATORrobinkawsanswered 2 years ago0That last change seems to have shaken something loose - today's scheduled backup completed successfully after only an hour and 14 minutes.  Hopefully that remains consistent.  Thanks for looking into it!CommentSharebrianbaumananswered 2 years ago"


Question: "Make multi-az cluster read replica, to be writable."

"Im trying to find a way, to make the multi-az cluster read replica, to become writable.Is it even possible? or the only way of "promoting" the read replica, to be writable, is to "failover" the primary instance?FollowCommentGary Mclean 2 months agoWhat RDS instance/type are you running? MYSQL/Auora?Share"

Answer: "0Accepted AnswerAn RDS Multi-az cluster has one writer node and two reader nodes. Only one of these is writeable. You can call failover-db-cluster to switch roles, but the result will still be one writer and two readers. Hope that answered your question.CommentShareMODERATORphilawsanswered 2 months ago"


Question: port 22: connection timed out error

while connecting to ec2 instance through ssh tool like git bash i am getting above said connection timed out error. it is getting after waved off of bill only. and i have tried with different regions and with pem file and ppk file in putty also.i wanted to know is there any problem with payment or something else.FollowComment

Answer: "0Have you setup the Security Group to allow port 22 access?The Security Group is a default virtual firewall that restricts traffic inbound to your instance.These to docs will provide a bit more information, if needed.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.htmlhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.htmlCommentSharetedtrentanswered 3 months ago"


Question: Ruby 2.6.5 runtime missing on Amazon Linux Standard 3.0 image

I have a ruby project and I am trying to build via AWS codedeploy and having some issues specifying the ruby version. I am using Ruby 2.6.5 and I am using AWS Codedeploy standard image (aws/codebuild/standard:2.0) because according to the docs it supports Ruby 2.6.5. .ruby-version has 2.6.5. I also attempted a build where I put "runtime-versions: ruby: 2.6.5" in the buildspec but that threw the following error: "Phase context status code: YAML_FILE_ERROR Message: Unknown runtime version named '2.6.5' of ruby. This build image has the following versions: 2.6". This is my buildspec.version: 0.2phases:  install:    runtime-versions:      ruby: 2.6.5    commands:      - echo Installing Bundler...      - gem install bundler -v 2.2.27      - bundle install  build:    commands:       - bundle exec rspecI also tried using aws/codebuild/amazonlinux2-x86_64-standard:3.0-20.03.13 image version from AL Standard 3.0 image instead of the latest but I get the same error while on github I see ruby version 2.6.5 has been added https://github.com/aws/aws-codebuild-docker-images/tree/20.03.13.I also tried Ubuntu Standard 5.0 and same thing.What am I missing?FollowComment


Question: EC2 EBS volume shows "no attachments" but still "in-use". Won't detach or force-detach

"I have an EC2 EBS volume that won't detach or force-detachD:\repos> aws ec2 describe-volumes{    "Volumes": [        {            "AvailabilityZone": "us-east-1b",            "Attachments": [],            "Encrypted": false,            "VolumeType": "standard",            "VolumeId": "vol-cd8365a4",            "State": "in-use",            "SnapshotId": "",            "CreateTime": "2009-03-17T23:20:21.000Z",            "Size": 20        }    ]}I have no instances running in us-east-1b, so it can't be attached to anything. It won't detach or force detach.If I try to detach it, it says the volume is 'in-use'D:\repos> aws ec2 delete-volume --volume-id vol-cd8365a4An error occurred (IncorrectState) when calling the DeleteVolume operation: The volume 'vol-cd8365a4' is 'in-use'D:\repos>If I try to force detach it, it says the volume is in the 'available state'D:\repos> aws ec2 detach-volume --force --volume-id vol-cd8365a4An error occurred (IncorrectState) when calling the DetachVolume operation: Volume 'vol-cd8365a4' is in the 'available' state.D:\repos>Is there anyway to get rid of this? I'm being billed monthly for it.FollowComment"

Answer: "0Accepted AnswerI found the answer!I was doing nothing wrong, and Amazon had a bug. I was able to get someone at Amazon tech support to kick the thing for me and unstick it. Because I don't pay for support, I filed an issue with "billing" as I was being billed for a volime that couldn't be deleted.EC2 "volumes" really do get stuck and can't be force-detached and the only option is to get technical support from Amazon.CommentShareThrill Scienceanswered a month ago0Are you able to get more details about the volume using AWS Config? A query something like the below and then looking at the configuration to see if it gives you any additional data?SELECT  resourceId,  resourceName,  resourceType,  tags,  configurationWHERE  resourceType = 'AWS::EC2::Volume'  and resourceId = 'vol-cd8365a4'CommentSharelarryjklanswered a month agoThrill Science a month agoThanks for the idea. It didn't give me any more information. Shows as "in-use" with no attachements  "aggregator": "none",  "expression": "SELECT  resourceId,  resourceName,  resourceType,  tags,  configurationWHERE  resourceType = 'AWS::EC2::Volume'  and resourceId = 'vol-cd8365a4'",  "creationTime": "Fri Apr 28 2023 12:46:15 GMT-0700 (Pacific Daylight Time)",  "count": 1,  "results": [    {      "resourceId": "vol-cd8365a4",      "configuration": {        "volumeType": "standard",        "attachments": [],        "snapshotId": "",        "availabilityZone": "us-east-1b",        "tags": [],        "encrypted": false,        "size": 20,        "createTime": "2009-03-17T23:20:21.000Z",        "volumeId": "vol-cd8365a4",        "state": {          "value": "in-use"        },        "multiAttachEnabled": false      },      "tags": [],      "resourceType": "AWS::EC2::Volume"    }  ]} ```Share0Just a thought, is your account's "home" region in your config/env settings the same region as the volume is in (us-east-1)? If it isn't then maybe append --region us-east-1 to the command.If you think this is superfluous then I agree, as Resource IDs should be globally unique. But it's surely worth a try.CommentShareRWCanswered a month ago"


Question: where does source repository live in CodeCatalyst?

"I could not figure out where does the source repository code in CodeCatalyst live, is it in S3 (couldn't found there)? where could I find it? does it really use CodeCommit behind the scene, couldn't find anything in CodeCommit related to CodeCatalyst repositories?Could we use the repositories created in CodeCommit in the CodeCatalyst or vice versa?I am looking forward to hear answers.Thanks,FollowComment"

Answer: "2Hello, As a member of a project you can view the source repositories via the Amazon CodeCatalyst Console. Here is a guide on getting started with Amazon CodeCatalyst source repositories. Today repositories created in CodeCommit cannot be used in Amazon CodeCatalyst or vice versa, however you can clone a source repository from any git provider (including CodeCommit) to Amazon CodeCatalyst by following this guideCommentShareMODERATORSundaresh_Ianswered 3 months ago"


Question: InternalServerError while trying to create item dataset import job

"InternalServerError: We encountered an internal error. Please try again.I've tried to recreate the import job but fails with the same error every time. Example job name: "item-_1e105c531-4d00-437d-b260-6ea789ca1c00".How can I get more visibility into what went wrong? What's the underlying problem for this error?Thanks,FollowComment"

Answer: "0I've resolved the problem, it was a data issue. One of the attributes had more than 1000 characters in it. I'd expect Personalize to drop that item and continue with the rest of the data but instead it was returning a 5xx error.CommentSharescihananswered 2 years ago"