Question: WAF managed rule to prevent dotenv vulnerability

"Hi There,Please help to identify which WAF managed rule is responsible to prevent dotenv scanning e.g.Examples/.env, /docker/.env, /anypath/.envI was thinking that that this rule AWSManagedRulesCommonRuleSet would help, but while testing it doesn't work and allows scanning dotenvThanks!FollowComment"

Answer: "0Hi,These are couple of Rule sets that do have certain calls to env coverage :AWSManagedRulesUnixRuleSetPHP RuleSetwe were not able to find anything specific for docker. However we would recommend you to consider managed rules and a base coverage using which you can write custom rules to meet any additional coverage that may be needed.Here is the link which talks about managed rule groups :https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-use-case.html#aws-managed-rule-groups-use-case-posix-osI hope this helps.CommentShareSUPPORT ENGINEERWilsina_Ranswered a year ago0Hi There!Thank you for your answer!I added 2 more AWS managed rules AWSManagedRulesUnixRuleSet and AWSManagedRulesPHPRuleSet but still can access .envcurl -I  https://example.com/.envHTTP/2 404content-type: application/jsonAny thoughts?CommentSharey0zganswered a year ago"


Question: Can't we change timezone in Glue SCHEDULED trigger type

we have a usecase to create a Glue schedule trigger (timezone: UTC-3)FollowCommentGonzalo Herreros 3 months agoI'm afraid you'll have to adjust the time accordingly when you create it. In my experience it's better to always use UTC and then there is no confusion with timezones or daylight saving.Share

Answer: "0Glue's time based scheduled jobs always referred in UTC only. So setup the job time as per your need. Like you want to schedule at 14 HRS in UTC-3 timezone, set it at 17 Hrs in the job.CommentSharerePost-User-2054795answered 3 months ago"


Question: Snapshot restore is stuck or not working in RDS Custom for SQL Server

My snapshot restore is hung and not progressing.FollowComment

Answer: "1Accepted AnswerPlease ensure that the ‘sysadmin’ privilege is not revoked from the ‘NT AUTHORITY\SYSTEM’ server principal. This can block the localSystem Account from performing certain actions.If these permissions were changed by a user, you will need to grant ‘sysadmin’ privileges to the ‘NT AUTHORITY\SYSTEM’ login.CommentSharelightanswered 7 months ago"


Question: unable to find match : mysql

i been trying to deploy wordpress  website using ec2 and RDS with the help of Module 3: Configuring Your Amazon RDS Database and when i am running yum install -y mysql its showing error :unable to find match : mysql anyone can help me how to solve that error. and steps for deploying wordpress using ec2 and RDSFollowComment

Answer: "0Accepted AnswerThis error is likely due to MySQL not being installed on your EC2 instance which you actually don't need.However, there is a how-to guide that provides step by step instructions on how to install WordPress using RDS and EC2.It is available here - https://aws.amazon.com/getting-started/hands-on/deploy-wordpress-with-amazon-rds/Hope this helps!CommentShareCarlos del Castilloanswered 13 days ago"


Question: Why Keypair is now being automatically downloaded upon creation?

Keypair generation on AWS Console previously asked if I wanted to download the new keypair generated. Recently it is automatically downloading without my autorization.  Why? This is not secure.I am using Firefox browser. I also tried with Private Browser session and it is still downloading the new keypair without my authorization.FollowComment

Answer: "0You have to understand the usecase of creating keypair in the console.By creating keypair in the console, you already give the permission to download because otherwise you will NOT create one in the first place and you don't get to download it after creation.You don't have access to your private keys anymore after creation. That's why it's auto downloading so you will have your private key.If you don't want auto download, don't create the key in AWS console.CommentShareJason_Sanswered a year agoAWS-User-7331572 a year agoNo. I don't need to give permission to download. It didn't work like that before. In fact, using Safari browser I still receive the prompt to choose if I want to download.  You are missing something important, I decide the action according to my use case. Can an EC2 run without keypair? No.Thank you.ShareChris Pollard a year agoAn EC2 instance can run without a keypair. It's very common to create an EC2 instance without a key pair and use Simple System Manager (SSM) to access the console of the instance.ShareJason_S a year agoIf you don't want to download the key just don't create it in the first place. If that's not feasible for you can you elaborate more as to what is your usecase?Share0If you don't download the private key, what use the public key is then? Meaning the default, and only sensible action is to download it. You can only download private at creation time, after that you can deploy the keypair to instance but there is no way of getting private key so it is kind of useless. Or am I missing something?CommentShareKalluanswered a year agoKallu a year agoSeem that Jason_S beat me by 2 minutes :-)ShareAWS-User-7331572 a year agoIt is being very useful. We can't run EC2 without keypair right?  Such credentials should never be automatically downloaded. Need to keep the prompt.Share0I don't think the issue is to do with AWS. It is browser settings that's causing the issue in my opinion. Check the option "always ask you where to save files" under Downloads in the Firefox settings. This should start throwing the prompt you are looking for. If not the issue should be in similar lines. Tweak your browser settings till you get a prompt. A bit of Google search can help if my suggestion above doesn't resolve your problem. I think you also have options to specify for what file extension types you need a prompt. Check firefox support QnAs for more.CommentShareSandeepVudataanswered a year ago"


Question: Connect a Lambda function to an S3 bucket while being connected to a VPC to make queries to a private RDS.

"I'm creating a Lambda function that receives parameters in a POST request, including an object (CSV file) that I need to access and execute a series of queries based on its content to a private RDS.I can access the S3 bucket if the Lambda function is not associated with a VPC, but in this case, I cannot access the private RDS. Also I have reviewed the security groups, route tables, and there is an internet gateway. I have also checked the IAM policies, which allow listing and reading from any bucket.FollowComment"

Answer: "3Accepted AnswerThis is very common scenario as same applicable for all compute.As a best practice you should create Lambda within VPC so you can access RDS.To access S3 from Lambda function inside a VPC, use VPC endpointsCommentShareNirmalanswered a month agoGary Mclean a month agoAnd or have your Lambda function connect to a subnet with a route to a NAT gateway to provide internet connectivity so that you can reach services such as S3.However, I do agree with Nirmal. Create VPC Endpoints. I believe a S3 gateway endpoint is free. Make sure you have a route with the preflix list applied to the subnet where your Lambda function connectsSharejlroser a month agoThanks to all. I follow the advice and create the endpoint and works properly.Share1You must connect the Lambda to a VPC that can communicate with the database or look at other options, such as RDS Proxy or the RDS Data API. I haven't used RDS Proxy or RDS's Data API recently, and I can't remember if they enable communication with the DB without being in the private VPC, but that is where I would look first.CommentShareJason Butzanswered a month agojlroser a month agoThanks for the advice, I made the endpoint first and it works, perhaps in another time I can try the proxy.Share"


Question: Kinesis data stream iterator age spikes

"Hi,I am working on a system that uses kinesis to ingest data, this data is then processed by a lambda function and kinesis delivery stream. We have CloudWatch alarms set up that trigger if the iterator age for a stream goes above 10 seconds, as this means that lambda has crashed and can no longer process data, causing a build up of data.Over the last couple of weeks, we have seen an increase in alarm triggers. The cause is that the iterator age spikes to an insanely high number and then drops again within 1 to 2 minutes. There does not appear to be any pattern to the spikes, sometimes it is multiple a day, sometimes not for a couple of days. Some articles and post seem to mention that this could be caused by data built up or hitting a limit of the stream. However, when these spikes happen, there is usually no data being added to the stream. There have even been instances where only the stream was configured, but there was no system to put any data on the stream, and the spikes still occurred.This is what the spikes look like over a 3-day period.I have already checked the following causes, and it is None of these issues:Lambda stuck processingLambda error (there is also an alarm for this)A lot of data added in a short timeThe stream is configured with 1 shard, enhanced fan-out is disabled, server-side encryption is enabled, the data retention is set to 1 day, and there are only 2 consumers.  The kinesis delivery stream is configured with convert record format enabled, converting data to Parquet from JSON using standard AWS functions, there is no custom lambda. The delivery stream reports no failures. The lambda has starting position "LATEST" and max record age at "-1".What could be the cause of these spikes? Or how could I investigate this and figure out a solution?FollowComment"

Answer: "0I would recommend checking the Lambda metrics for the same time frame and check if the number of invocations changed, or if the duration changed. If you do not see any difference compared to other times, I recommend to create a support case.CommentShareEXPERTUrianswered 10 months agoBob 10 months agoThe spikes in iterator age are almost always when there are no lambda invocations, and it seems to happen more often when there is fewer data on the stream, but that could just be a coincidence. I have even seen this error happen multiple times when there was no data on the stream for days.We are not on an AWS support plan, so we cannot create a support case. I guess we'll just have to keep going to figure out what is going on here.ShareUri EXPERT10 months agoThis is really strange. The Iterator Age represents how far behind you are processing the events in the stream. Could it be that you have more than once consumer? If that is the case, and the second consumer doesn't reads messages constantly, when it will read messages, the iterator age will be big.What metric are you looking at? GetRecords.IteratorAgeMilliseconds or the Lambda IteratorAge. If you are using the first one, I would expect that you have another consumer. If the second one, I have no clue.ShareBob 10 months agoThere are 2 consumers. An AWS firehose delivery stream that converts records from JSON to parquet using standard configuration, so no lambda. And a lambda that processes the data on the stream. The entire application is configured using CDK, so besides these 2, there are no more consumers of this stream.I am looking at the GetRecords.IteratorAgeMilliseconds metric of the kinesis stream. And Iterator age of the consumer lambda always hovers around 800 to 1800 milliseconds. What is a bit is another metric I found while investigating this, which is the "KinesisMillisBehindLatest" metric of the delivery stream. And this metric is almost identical to the "GetRecords.IteratorAgeMilliseconds" metric, but not always. Sometimes the kinesis stream has an iterator age of 11M and the  "KinesisMillisBehindLatest" metric of the delivery stream is still at 0.I did manage to find this GitHub issue that describes a similar issue. https://github.com/awslabs/amazon-kinesis-client/issues/185 but in my case I am not using the amazon-kinesis client. I am only using a lambda which is fed directly by the stream, and a delivery stream that converts records using Glue.ShareUri EXPERT10 months agoI do not know what is causing the issue, however, I think you are only interested in the iterator age of the Lambda function, so I would change my alarm to that metric.ShareBob 10 months agoThat seems like it would probably be better in this case. I'll move the alarm to that metric. I'd rather have a proper solution for those stream spikes, but I'll settle for this. Thanks for your help.Share"


Question: S3 multipart upload to presigned URL returns HTTP 500 on OPTIONS request

"We have set up a S3 bucket with CORS rules to upload data to. The upload is done using a presigned URL and a multipart upload. We have several deployments that have this setup working. On the latest setup that we deployed today the S3 bucket is returning a HTTP code 500 (in the OPTIONS request) and a CORS error No 'Access-Control-Allow-Origin' header is present on the requested resource when attempting a PUT request using the needed payload and headers.While investigating the error with curl we found that the bucket returns a redirect from https://bucketname.s3.amazonaws.com/ to https://bucketname.s3.eu-central-1.amazonaws.com/. When we send a request to the URL that includes the region with the needed payload and headers, we now receive Access-Control-Allow-Origin headers but a HTTP code 403 with a response that the signatures do not match.When the CORS configuration is removed from the bucket, we receive HTTP code 403 and a CORS error.We have also tried server different options in the CORS configuration, all of which resulted in a HTTP code 500.Rebuilding the bucket also did not change the above-described problems.FollowComment"

Answer: "1Accepted AnswerIf the bucket is new, this redirection response is expected while DNS propagation takes place. See https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingRouting.html for further details.The redirection will stop once DNS has propagated fully, and S3 should start responding to the non-region-specific DNS name for your bucket.However, it may be more reliable to specify the region when creating the presigned URLs, just in case S3 returns a redirect at some point in the future.CommentSharePaul_Lanswered a year ago"


Question: How to setup phase 2 selector to FortiGate

"Hello, I have a windows print server that I host in an EC2 instance and have it connected to a FortiGate that is physically located on-site at our office. We currently have 2 vpn tunnels connected from it to AWS. For this example AWS1 and AWS2 are the tunnels. This print server can communicate with anything that is hardwired but we have our WIFI networks on a different subnet. Within FortiGate to add communication on the WIFI networks we configured the phase 2 selector but need to add that subnet in AWS somewhere. Does anyone have experience with making it so I can connect to this server when I am connected to WIFI on a different subnet rather than having to hardwire every single time I need it?FollowComment"

Answer: "0Accepted AnswerI think you're trying to add two CIDRs (The ethernet and the wireless subnets) as the interesting traffic.I'll answer your question on how do add that in AWS side, but first AWS VPN is a route-based VPN, hence it does not support multiple security associations SA.If you're using policy-based VPN and define several CIDRs then you'll run into multiple SA issues which will cause intermittent connectivity, refer to this knowledge article https://repost.aws/knowledge-center/vpn-connection-instabilityQ: How many IPsec security associations can be established concurrently per tunnel? https://aws.amazon.com/vpn/faqs/A: The AWS VPN service is a route-based solution, so when using a route-based configuration you will not run into SA limitations. If, however, you are using a policy-based solution you will need to limit to a single SA, as the service is a route-based solution.Make sure you're using route-based VPN on the FortiGate.To add your WiFi network to communicate over the VPN tunnels in AWS side, by default the interesting traffic is 0.0.0.0/0 which means all traffic is allowed over the tunnels, see this on how to modify the interesting traffic https://docs.aws.amazon.com/vpn/latest/s2svpn/modify-vpn-connection-options.htmlCommentShareMatt_Eanswered 17 days agoEXPERTTushar_Jreviewed 5 days agoSkyler 10 days agoThis is all great! The change I had to make was your very last bullet point. I had to do the following...change the tunnel to have the local address set to 0.0.0.0/0 on both the FortiGate and AWS (ours is in a private vpc so no security issue there)-Add the subnets to the route table (somehow missed that)-Lastly had to add the static route on the site-to-site VPN connections tab as well.On the site-to-site VPN connections tab as well I had to select the connection > actions > Modify VPN tunnel options and then change that and all is working now!I appreciate the help here!Share"


Question: Webdav & webvtt

"Hello,I am currently trying to update a webvtt segment file over webdav, on a live channel. When I request the .vtt file directly (from the endpoint), it is loaded just fine (it is loaded fine as well by my web player - jwplayer).Now, I can successfully write a full replacement via webdav onto the ingest channel - I get a response such as:<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">    <title>201 Created</title>
Created

Resource /in/v2/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/index_3_0_225.vtt has been created.

  <address>AWS Elemental MediaPackage Server at xxxxxxxxxxxxxxxx.mediapackage.xx-xxxxx-x.amazonaws.com Port 80</address>    But when I reload the .vtt file on the endpoint, no change has occured, and I can't figure why. I also tried with a totally new filename such as "test.vtt" (to try and find if it had something to see with an overwriting issue on the existing .vtt file), to no avail, the "test.vtt" file does not exist on the endpoint (404). I must be missing something here.I double checked the format and it is OK (just a very simple caption example, keeping the proper WEBVTT first lines identical to the original file). How come I can't see any change on the output despite the successful Webdav PUT operation? Do I need to update another file as well to "trigger" the change (such as the manifest, the equivalent .ts segment, ...)?Many thanks in advance for your help!CheersJean-MarcEdited by: Jean-Marc on Jan 4, 2021 11:42 AMFollowComment"

Answer: "1Accepted AnswerHi Jean-Marc, I’ve looked into this further. We don’t support the ability to modify segments once they have already been ingested. After a segment has been ingested, it is packaged per your configuration for egress and the ingested file cannot be modified. Posting an updated segment with the same name will not modify an existing ingest segment. A re-ingest of content will be required in order to achieve this.Your use case as I understand it is to issue a ‘hot fix’ where captions are wrong or missing in the input stream at the time of ingest. I came across this solution which would be worth reading: https://forums.aws.amazon.com/thread.jspa?threadID=325142&tstart=0 this covers a scenario where captions are added at a later date after being encoded in MediaConvert. However for your example where you are streaming from MediaLive, a possible live-to-vod solution could be to do the following on MediaPackage:Enable a catch up window on your MediaPackage HLS endpoint.Identify a content window where captions need changing.Create a harvest job to download that content to S3Add/change your WebVTT files as required in S3, and modify the manifest to reference the new caption files (if it doesn’t already have a caption track in the harvested stream).Re-ingest as VOD content.Do let us know if this could be a possible solution for you, and let us know if you have any other questions.Kind Regards,BenCommentShareAWS-User-0287910answered 2 years ago1Hi Ben,Many thanks for your very detailed reply!Definitely makes sense, in the meanwhile I read some more documentation and threads, specifically about VOD and captions, and it all indeed described that a whole re-ingest was necessary to achieve what I wanted to do, so came to the conclusion that re-sending an already ingested file, in Live mode, was definitely not supported.Thank you for the examples and insight that you supplied me with: I'll have a proper look and will run further tests thanks to them!Thank you again!Best Regards,Jean-MarcCommentShareJean-Marcanswered 2 years ago1Hi Jean-Marc, glad I could help - that sounds great. Do get in touch if you have any further queries!Kind Regards,BenCommentShareAWS-User-0287910answered 2 years ago0Hi Jean-Marc, thanks for your post!I’ve sent you a private message asking for some further details such as example arns and endpoints we can review internally. I’ll be happy to review this.Kind Regards,BenCommentShareAWS-User-0287910answered 2 years ago0Hi Ben,Thank you! I have replied to your pm just a few seconds ago.Please let me know if you need any further information.Best Regards,Jean-MarcCommentShareJean-Marcanswered 2 years ago"


Question: Instance unavailable for 4 minutes

"HiOur instance (ID - i-06ac0afc4c2c59618) stopped responding on 20th Jan 2019 between 16:46 and 16:50 UTC. We were unable to login to the server. In some time, it came back online with uptime of a few minutes. This is an extremely high priority server and such a downtime can be disastrous for us. Please share all information regarding the reason for the unavailability of the instance as soon as you can.ThanksFollowComment"

Answer: "0Hello ashutoshshah,I am sorry to hear about the issue with your instance i-06ac0afc4c2c59618.I have checked the instance and I could see that the underlying physical host, on top of which your instance was hosted, had been experiencing hardware related issues during the above mentioned times. This caused your instance to reboot.Please note that in the future you can check whether an instance was affected by a hardware related event by checking its 'System Status Checks' [1]. The history of these checks can also be viewed in Amazon CloudWatch by looking at StatusCheckFailed_System metric \[2,3].Please accept our apologies for the above issue and for any inconvenience caused by it. I have now checked the instance and I can see that it is back up and running again.I would like to suggest that you to take a look at the Auto Recovery feature for Amazon EC2. You can create an Amazon CloudWatch alarm that monitors an Amazon EC2 instance and automatically recovers the instance if it becomes impaired due to an underlying hardware failure or a problem that requires AWS involvement to repair. Basically, you can use CloudWatch to set up the alarm which will trigger when the System Status check fails. This alarm can further trigger an EC2 Action like "Recover this instance" \[4,5].We also advise to our customers to design their application in such a way such that there is no single point of failure in their environment. Please refer to our white paper on Building Fault-Tolerant Applications in the AWS Cloud \[6] for more information.Please let us know if you need any further help.Links:[1] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-system-instance-status-check.html#types-of-instance-status-checks[2] https://aws.amazon.com/blogs/aws/ec2-instance-status-metrics/[3] https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ec2-metricscollected.html#ec2-metrics[4] http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/UsingAlarmActions.html#AddingRecoverActions[5] https://aws.amazon.com/blogs/aws/new-auto-recovery-for-amazon-ec2/[6] https://aws.amazon.com/whitepapers/designing-fault-tolerant-applications/Regards,awstomasCommentShareAWS-User-3892169answered 4 years ago0Thanks.CommentShareashutoshshahanswered 4 years ago"


Question: migration tool for DB2 zOS to AWS RDS

"Hello all, just wondering if anyone had any solutions for extracting data from DB2 zOS into AWS RDS or redshift using DMS. Struggling to find an effective solution.FollowCommentAWS-VG a year agoDMS doesn't work with Db2 zOS as source. There are many third party CDC technologies that work with Db2 zOS - IBM Data replication, Oracle Goldengate to name a few. Is it important that you have CDC?Share"

Answer: "0You can use AWS SCT to convert schemas, code objects, and application code from IBM Db2 LUW.AWS SCT supports as a source Db2 LUW versions 9.1, 9.5, 9.7, 10.1, 10.5, 11.1, and 11.5.This would involve a 2-step process:Use SCT to convert the SCHEMA from DB2 into the target database schema (such as RedShift or Amazon Aurora).Use DMS (Database Migration Service) to read the source and write to the target.Note: You need to have JDBC connectivity to both the Source and Target databases.More details are here:https://docs.aws.amazon.com/SchemaConversionTool/latest/userguide/CHAP_Source.DB2LUW.htmlCommentShareDennis_Aanswered a year agokblaauw a year agoThanks This is specifically for DB2 zOS not LUWShare0DB2 for z/OS is now a source for DMS: https://docs.aws.amazon.com/SchemaConversionTool/latest/userguide/CHAP_Source.DB2zOS.htmlCommentShareLuiz Decaroanswered a year ago"


Question: CDK Multi environment set up as per git branch

#help_postIs there anyone worked with Step function state machine to get step response as the output for the state machine response?Please let me know if you have encountered this situation. I am only getting an execution arn from the state machine as response! I need the success or fail response from the step function added to that state machine as the response.Can we achieve this in anyways?#statemachine #stepfunction #awscloudFollowComment


Question: Unable to upgrade SLES12 SP5 to SLES 15 SP1

"In SLES 12 SP5, when we reboot the Server after installing below package to migrate the system to SLES 15 SP1zypper in SLES15-Migration suse-migration-sle15-activationits failing to migrate to SLES 15 SP1 with below mentioned error logs:Device path /dev/disk/by-uuid/"b7bbd4b5-81ee-4cf9-b80f-048dd3eb6085" not found and skippedDevice path /dev/disk/by-uuid/"242dbaba-e687-48ea-99fb-3b5f905123da" not found and skippedDevice path /dev/disk/by-uuid/"03eefbc1-b95f-4125-a7bc-83034bff48ae" not found and skippedDevice path /dev/disk/by-uuid/"b9459393-776b-473c-bc7a-7d17de295a6d" not found and skippedDevice path /dev/disk/by-uuid/"f7cf5298-1a20-4a79-8b22-546b0c44176b" not found and skippedDevice path /dev/disk/by-uuid/"aef286fb-4fb0-4e47-a2cd-f2bc31af7d03" not found and skippedDevice path /dev/disk/by-uuid/"19456e98-c7da-4591-b295-e0fc297179f4" not found and skippedDevice path /dev/disk/by-uuid/"04db4e56-3f5a-4f77-86c1-5c3932f8ca58" not found and skippedCalling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-label/ROOT']Running suse-migration-pre-checks with options: fix: FalseDevice path /dev/disk/by-uuid/"b7bbd4b5-81ee-4cf9-b80f-048dd3eb6085" not found and skippedCalling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-label/ROOT']Running suse-migration-pre-checks with options: fix: FalseCalling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-label/ROOT']Running suse-migration-pre-checks with options: fix: FalseCalling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-label/ROOT']Running suse-migration-pre-checks with options: fix: FalseCalling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-label/ROOT']Running suse-migration-pre-checks with options: fix: FalseCalling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-label/ROOT']Running suse-migration-pre-checks with options: fix: FalseCalling: ['blkid', '-s', 'TYPE', '-o', 'value', '/dev/disk/by-label/ROOT']This happening after 25th Aug 2022. Before that we could migrate successfully.Please check and help us to fix this error.FollowComment"


Question: Enable to resolve no space on device for Elasticbean stalk deployment

"Hi,I am trying to deploy a deep learning flask application which is running into a storage issue. I tried to fix it with addition config file but it does not seem to work and error is same as before("no space on device"). If I increase EBS volume from 10 to 40, then it works fine for an EC2 instance. As this should be increased automatically instead of manually in case there would be upscaling of resources, I am not sure how to do it. Can anyone help?file add-ebs-volume.configcommands:  01mkfs:    command: "mkfs -t ext3 /dev/sdh"  02mkdir:    command: "mkdir /media/volume1"  03mount:    command: "mount /dev/sdh /media/volume1"option_settings:  - namespace: aws:autoscaling:launchconfiguration    option_name: BlockDeviceMappings    value: /dev/sdh=:100FollowComment"

Answer: "0Accepted AnswerYou can set a bigger volume size in the Benastalk environment configuration:Elastic Beanstalk -> Environments -> examle-env -> Configuration -> Instances -> Edit -> Root volume (boot device) -> SizeThen instances will be recreated with a new EBS volumes.CommentShareOleksii Bebychanswered 4 months agorePost-User-1153664 4 months agoThanks Oleksii, It worked!Share"


Question: How Add Gem To Gem?

I can't understand how add one Gem to another. Example how Multiplayer gem see GameLift Gem ?p.s.I try in wscript add bld.Path('Gems/GameLift/Code/Include/GameLift') but i feel this is not correct way.Follow

Answer: "0Accepted AnswerSolved. If needed add some gem to gem, you must add to gem.json code.        "Dependencies": [{"Uuid": "<AddedGemUuid>","VersionConstraints": ["~>1.0"],"_comment": "GemName"}For more info look in Modular Gems System (Gem JSON File)SharerePost-User-0150549answered 6 years ago0Thanks for posting your solution @REDACTEDUSERSharerePost-User-8353690answered 6 years ago0Hi Herpaderp. If you add Dependencies to some gem, and not include dependencies gem to project you take error on configure command. In error message will saying about not included gem. You must add hands needed gems.SharerePost-User-0150549answered 6 years ago0This seems to be a hack for me.What happens if you load a gem into your game but not the other gem, the first gem depends on?SharerePost-User-5460328answered 6 years ago"


Question: Lambda Function Missing

"A few months ago, I set up a Lambda Function that is invoked through a API Gateway Integration. A few days ago I noticed that endpoint was returning HTTP 500 (Internal Server Error). When I went to check the Lambda function, the main console for Lambda showed no set up functions, with a red error box with no text, and next to the refresh button the message "Last Fetched 53 years ago". Through API Gateway I was able to access the Lambda function, but the code window is missing (not empty, missing), and when I go to the "versions" tab, I once again get the red error box with no text. Same thing when I tried the "aliases" tab, and to view the function  url. Oddly, when I ran the built in test, it says it passed, but when I checked the browser devtools, it showed it returned a HTTP 403 (Forbidden) error. When testing the function url in Postman, I get the same HTTP 403 error.When I tried to create a new function, I went through the wizard without issue, but pressing "Create Function" at the end gives me a spinner that after 30min is still spinning.Honestly, I haven't a clue how to even approach trying to solve this issue, or even what the issue is. Any guidance or assistance would be very much appreciated.FollowComment"

Answer: "0The odd thing here is "53 years ago" which (probably not coincidentally) is the beginning of "time" as Linux/Unix operating systems measure it. It's possibly that your computer is a little bit in the future (from a clock perspective) so I would make sure that your timezone is set correctly and that the time on your computer is synced to a reliable (good) NTP source.Having the clock wrong on your computer is an issue because the API calls are signed with the current time; and if the service (Lambda in this case) sees a request come from the future it won't process it - hence the errors that you're seeing.CommentShareEXPERTBrettski-AWSanswered 3 months agosilent-critter 3 months agoI didn't realize that 53 years would put it at the beginning of Unix Epoch Time. I synced my computer's clock to time.nist.gov, and no changeShare0Over the past few years various parts of the AWS Console have started relying on Websockets - the Lambda "Create Function" page is one of them.  Are you behind a proxy that might be blocking Websockets?  You can do an echo test at sites like https://socketsbay.com/test-websockets.  Here, I get "Connection ready!" if I bypass our enterprise proxy but no successful connection otherwise.CommentShareEXPERTskinsmananswered 3 months agosilent-critter 3 months agoI also got "Connection ready!". Regardless, as far as I know I am not behind any proxy or vpn.Share0Was there ever a solution here? I'm running into the same issue and can't figure it out.CommentSharerePost-User-1875716answered 2 months agosilent-critter 2 months agoIn my case the issue was caused by my account being frozen for some reason. Apparently, when an AWS account is frozen it only affects like 3 or so services which stop working without explanation, but everything else is fine which is not confusing at all.If that is the case for you, you should have gotten an email about it, and there should be a ticket in the support dashboard. Through the ticket the reps will take you through the process of unfreezing the account. You may need to prompt them with a "I did that, now what?" message as it is a multi-step process...Hope this helps. Good luck!Share"


Question: One-Way trust between AWS Managed AD and On-Prem AD (reachable via AD Connector) ?

"Experts,I have scenario for a customer. Customer has their on-prem AD which is reachable in their VPC via an AD Connector.We need to establish a one-way trust relationship between On-Prem AD and the AWS Managed AD (in another account). We have established TGW peering between 2 accounts.Question: Can I establish a one-way trust between my AWS Managed AD and Customer's on-prem AD which is reachable via AD connector? Is this a support scenario / use-case? If yes, any link to some blogs/articles will be highly appreciated.The guide here (https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_ad_connector.html) says transitive trusts are not supported by AD connector. Does that means the scenario I mentioned above is not a valid one when using AD connector?Thanks.FollowComment"

Answer: "0Transitivity is used to log into child domains of the forest that is on-premise.AD Connector is used as a gateway for authenticating users not for replication or trust.CommentShareedmarinhoanswered 3 months agoShiraz Malik 3 months agoThanks, @edmarinho. So do you suggest that I request my customer to replace their AD Connector with AWS Managed AD (or AD based on an EC2 instance). I assume that will allow to establish trust between my own AWS Managed AD and customer's on-prem but this time transiting through their AWS Managed AD in their account.Or I should ask customer to replicate their on-prem AD with their newly provisioned AWS Managed AD in their account. And I establish one-way trust with their new AWS Managed AD only, instead of trying to establish one with their on-prem?Sorry. Not an AD expert so not sure if both scenarios I mentioned above are valid. If both are valid, which one is preferable over the other.Please advise.Thanks.Share"


Question: Cognito set user MFA required when using TOTP only

"Good dayCognito can enforce MFA across the whole pool, which enforces the MFA setup auth flow, even for users that hasn't set up TOTP yet. However, when making the pool MFA optional then setting TOTP MFA required on a user fails with the error: User does not have delivery config set to turn on SOFTWARE_TOKEN_MFAHowever, as mentioned, when enforcing MFA globally this is not an issue.How then can one force MFA auth flow when using TOTP only on a per-user basis?What we've discovered thus far, when explicitly calling associateSoftwareToken after a login (without MFA), one can set a user to REQUIRED with SOFTWARE_TOKEN_MFA, however the auth flow is still not enforced and there is no way with the API to discover whether the MFA is functional.We have the requirement to have per-user MFA requirements.We believe this is in fact a bug. Currently we are forced to either manually implement MFA in our app itself, or force MFA globally for all users.FollowComment"

Answer: "1Is there any update on this thread?  When MFA is set to optional for the User Pool then when I try to turn on Software Authenticator access for a user I get the "User does not have delivery config set to turn on SOFTWARE_TOKEN_MFA" error.CommentShareMarkanswered 10 months ago1Anyone found a solution for this? We've been dealing with the exact same issue and the docs don't provide any information on this.CommentSharesymaganswered 9 months ago0Hi,The code samples from the Amplify documentation for MFA might help with setting up TOTP for a user. The same can be accomplished using the cognito library api calls as well.CommentShareRajarshi_Danswered 10 months ago"


Question: S3 connection randomly times out

"I'm storing and retrieving objects on S3 using AWS SDK for PHP. Most of the time it works fine, but occasionally the following errors pop up in a seemingly random way:"Error retrieving credentials from the instance profile metadata server. (cURL error 28: Connection timed out after 1001 milliseconds  (see http://curl.haxx.se/libcurl/c/libcurl-errors.html))"Our connection timeout parameter is set at 30 seconds so I'm trying to find out what else can be going on.FollowCommentHarshavardhan_G SUPPORT ENGINEER10 months agoThis seems more like an issue with the EC2 instance. Can you please provide more details on your architecture and the code snippet where you are accessing the objects in S3 to better understand the issue?Sharejulia_g 10 months agoWe use two EC2 instances and a load balancer. It makes sense that it may be an EC2 problem - I tried to run the same code with the same objects on my local VM, and everything is retrieved perfectly. Here's the (simplified) connection code.$S3connectParams = array('region' => 'us-east-1','version' => '2006-03-01','http' => array( 'timeout => 30,'connect_timeout' => 30 ));$client = new S3Client($S3connectParams);$result = $client->GetObject(array("Bucket" => $ourBucket, "Key" => $S3objectKey));ShareHarshavardhan_G SUPPORT ENGINEER10 months agoThank you for providing the details.Share"

Answer: "0Hello @julias_g,Considering the above details, I am assuming that there are no hard coded credentials in your application and it is instead getting the necessary credentials from the IAM role attached to the instance.Please feel free to correct me if I am wrong.The PHP application first looks for credentials in environment variables and then checks the shared credentials profile. If neither of these are found, it gets the credentials from the instance's IAM role. [+] https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_credentials.html#default-credential-chainTo get the credentials from the IAM role attached to the instance, the SDKs are designed to make a query to the instance's metadata service which is a pool of instance related details.[+] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.htmlIt is important to note that these credentials retrieved from the Instance's IAM role are temporary. If you are using IMDS version 2, the credentials are refreshed every 6 hours by default. I believe your application is facing issues connecting while the credentials in the metadata are being rotated. As a result, the applications fails to reach the metadata service and times out. More details here:[+] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.htmlFull disclosure, my expertise with PHP is very limited. However, I dived deep into our documentation to see if I can find anything that might help you. I found the below:\While using IAM role credentials is the preferred method for providing credentials to an application running on an Amazon EC2 instance, the roundtrip from the application to the instance metadata server on each request can introduce latency. In these situations, you might find that utilizing a caching layer on top of your IAM role credentials can eliminate the introduced latency.The easiest way to add a cache to your IAM role credentials is to specify a credentials cache using the credentials.cache option in a client's factory method or in a service builder configuration file. The credentials.cache configuration setting should be set to an object that implements Guzzle's Guzzle\Cache\CacheAdapterInterface (see Guzzle cache adapters). This interface provides an abstraction layer over various cache backends, including Doctrine Cache, Zend Framework 2 cache, etcEvery request that uses this cache adapter first checks if the credentials are in the cache. If the credentials are found in the cache, the client then ensures that the credentials are not expired. In the event that cached credentials become expired, the client automatically refreshes the credentials on the next request and populates the cache with the updated credentials.More details on the same here:[+] https://docs.aws.amazon.com/aws-sdk-php/v2/guide/credentials.html#environment-credentialsI hope the above information proves useful.In case you feel I missed out to address something more to your concern, please do not hesitate to let me know.Take Care and Stay Safe!CommentShareSUPPORT ENGINEERHarshavardhan_Ganswered 10 months ago"


Question: AppASG error: Received 0 SUCCESS signal(s) out of 1. Unable to satisfy 100% MinSuccessfulInstancesPercent requirement

"Hello,I putted the stack offline (maybe on a wrong way) by creating a change set and executing it. Now I wanted to put it back online by using the same way but I get this errormessage and it doesn't start. Also when it is offline it goes to a wikipedia page about rubber ducks and not the page a configured.SamFollowCommentRiku_Kobayashi EXPERT2 months agoCan you share the CloudFormation template you used?ShareSam Cappan 2 months agoJust Copy the whole text in here? It is to big...ShareSam Cappan 2 months agohttps://edusoantwerpen-my.sharepoint.com/:t:/g/personal/sam_cappan_so_antwerpen_be/EVqa4jQqtdFGlHrIJVZVHakBZOInV4KSC31Mbnd2j3VfZw?e=01d7YQThis is the link to the .txt file.Share"


Question: DocumentDB availability in Stockholm region?

"Hi,Is providing DocumentDB support in Stockholm region (eu-north-1) being planned?ThxFollowComment"

Answer: 0I do not have any ETA on when DocumentDB will available in eu-north-1 region. But I urge you to keep an eye on the following to get the update on the same.RDS blog: https://aws.amazon.com/blogs/aws/category/amazon-rds/RDS updates: https://aws.amazon.com/rds/whats-new/RDS Forum: https://forums.aws.amazon.com/forum.jspa?forumID=60CommentShareVetrivelanswered a year ago


Question: DNS da instancia (EC2) com Google domains

"I have my instance running and working perfectly, accessing the ec2 automatic DNS: http://ec2-35-171-112-70.compute-1.amazonaws.com/I have my domain purchased on google domains with the name: ryanbarbosa.dev, I already create a router53 and I took the NS (name servers) and added it to the DNS settings on google domains, as shown in the images below:Router53 is already associated with my instance with the public ip as you can see in the image.The problem is that I can't access my instance through dns: ryanbarbosa.dev, I don't know what I'm missing, can someone help me?my application is running with apache, with this config: I believe the apache configuration is ok. Something I thought was the instance's security group, but I released all possible entries, just to see if it resolved, but no, it didn't prevent it.Some help? I'm willing to explain more if needed. Hug.FollowComment"

Answer: "0Are there any errors when accessing the site?CommentShareEXPERTRiku_Kobayashianswered a month ago0It's not your Apache config. A lookup of ryanbarbosa.dev gives a different address to the one you are expecting:$ nslookup ryanbarbosa.devServer:8.8.8.8Address:8.8.8.8#53Non-authoritative answer:Name:ryanbarbosa.devAddress: 75.101.184.39The DNS record for ryanbarbosa.dev is still using the Google name servers - verify this by running dig ryanbarbosa.dev ns or at https://toolbox.googleapps.com/apps/dig/Your screenshot shows that you have updated these to be the Amazon nameservers, but it clearly hasn't been implemented yet. When you made the change to the nameservers you would have got a confirmation message that the changes had been made. Did it also advise how long you might have to wait (24 or 48 or 72 hours , etc.)?Your best place to start is Google Domains, and see if anything is still pending (or indeed, if the new config was properly saved in the first place).CommentShareRWCanswered a month agoEXPERTRiku_Kobayashireviewed a month ago"


Question: What will happen when API call to get a object from S3 which is in S3 infrequent storage or in Glacier ?

We have setup the data life cycle configurations to archive the objects from s3 to Glacier.We have service which will fetch the data from S3 and return the object in the response.After a year some objects would be archived to infrequent storage and then to Glacier.What will happen when API get a request for the object which is present in the Glacier ?Will it throw error ? or will S3 API try to fetch the data but it will take longer to return ?FollowComment

Answer: "0Hi there,The behavior will depend on the storage class that you are using. S3 Standard-Infrequent Access and S3 One Zone-Infrequent Access are both storage classes that are intended for data that does not need to be accessed frequently, but must be retrieved quickly when requested. With these storage classes, a GetObject request will succeed without any issues.S3 Glacier Instant Retrieval is a new storage class that is designed for long-lived data that's rarely acessed, but requires quick retrieval when needed. A GetObject request to an object using this storage class will also succeed without any issues.If you are using Glacier Flexible Retrieval or Glacier Deep Archive, you will first need to initiate a restore request before you can download data from this storage class. If you attempt a GetObject request without restoring the object, S3 will return an InvalidObjectState error. For more information on S3's storage classes, please see https://aws.amazon.com/s3/storage-classes/CommentShareSUPPORT ENGINEERMichael_Lanswered a year ago"


Question: Suddenly kicked out from my EC2 instance

"Hello, its my first time asking something here. To work on my EC2 Instance I use VSCode to connect via SSH with the "Remote-SSH" plugin. I have been working on this instance with no problem for 1 weeks with occasional disconnections, but I really want to fix this error.I have tried to turn off all firewalls. Im sorry to not have any more information, but it literally happen while i code so i have no idea what could have cause it.FollowComment"

Answer: "4Accepted AnswerIf you're experiencing occasional disconnections while using VSCode with the Remote-SSH plugin to connect to your EC2 instance, there could be several possible causes.Here are some troubleshooting steps you can try:Check your network connectivity: Make sure your local network connection is stable and strong. You can also try pinging the EC2 instance from your local machine to check if there are any network issues.Check the system logs: Check the system logs on the EC2 instance to see if there are any error messages or warnings related to SSH or network connectivity.Check the SSH daemon logs: Check the logs of the SSH daemon (/var/log/auth.log on Ubuntu, for example) on the EC2 instance to see if there are any error messages related to SSH authentication or connectivity.Increase the SSH timeout: You can try increasing the SSH timeout value in your VSCode Remote-SSH settings. To do this, go to the VSCode settings and search for "remote.SSH.timeout". Then, set the value to a higher number, such as 60.Enable SSH keepalive: You can also try enabling the SSH keepalive feature to prevent disconnections due to inactivity. To do this, add the following lines to your SSH configuration file (~/.ssh/config on your local machine):Host *    ServerAliveInterval 60This will send a keepalive message to the SSH server every 60 seconds to prevent the connection from timing out.Check for any resource limitations: If your EC2 instance is running low on resources, such as memory or CPU, it could cause disconnections. Check the system logs on the EC2 instance for any error messages related to resource limitations.Try a different SSH client: If none of the above steps work, you can try using a different SSH client, such as PuTTY, to connect to your EC2 instance.I hope these steps help you resolve the issue. If you're still experiencing problems, feel free to provide more information about the error message or any additional details that could help diagnose the problem.Please feel free to accept this answer in case your query were answered to close this thread.CommentShareGovind Kumaranswered a month ago"


Question: VCRUNTIME140_1.dll was not found

"So I got a brand new laptop because I want to keep working on my game, but I find myself on the go a lot with a lot of down time.  I installed lumberyard, but when I try to launch it, I get the error VCRUNTIME140_1.dll was not found 3 times and it closes out.  I've tried repairing my C++redistributable 64 bit and 86, restarting my pc as I do.  I've tried uninstalling and reinstalling while also restarting.  I've tried uninstalling and reinstalling lumberyard as well before doing this with my C++redistributable's, I guess I can try reinstalling it again, but I somehow think that won't work.Other software work just fine, and games too.  It's a dell, gtx 1050, i5 cpu, 12gb ram.Any help would be greatly appreciated, thank you.Follow"

Answer: "0BumpI also tried removing Waves maxxaudiopro thinking that might help, but no luck at all.SharerePost-User-4763596answered 3 years ago0Hi @REDACTEDUSERWhat version of Lumberyard are you using? And what version of Visual Studio are you using? Also, is this issue happening when attempting to launch the Lumberyard Editor, or some other executable?SharerePost-User-7527243answered 3 years ago0@REDACTEDUSERSharerePost-User-0158040answered 3 years ago0I am using v1.26.00. I got the same problem! Yes, it is happening when I attempt to launch Setup Assistant, Project Configurator and Lumberyard Editor.SharerePost-User-9338844answered 3 years ago0hi @REDACTEDUSERSharerePost-User-8164888answered 3 years ago0Have you checked our documentation about Visual C++ redistributable packages at https://docs.aws.amazon.com/lumberyard/latest/userguide/setting-up-system-requirements.htmlto see if this may help?Also, I had some issues with my firewall setting when first launching 1.26, you can find more info about firewall settings athttps://docs.aws.amazon.com/lumberyard/latest/userguide/setting-up-firewall.htmlLet me know if you are still experiencing problems with this.BestSharerePost-User-8164888answered 3 years ago0Don't worry, I've got it fixed! I answered it on reddit here.I downloaded the VCRUNTIME140_1.dll file  from the link , extracted it and pasted it into the following folders :C://windows/system32/ and C://windows/sysWOW64/.It should work!SharerePost-User-9338844answered 3 years ago0that DLL should have been installed in the appropriate location if you installed all the required runtimes. If you downloaded visual studio you should have already had it.SharerePost-User-9359627answered 3 years ago"


Question: aws.greengrass.clientdevices.mqtt.EMQX fails on Windows

"Basic deployment for the new EMQX MQTT Broker (https://docs.aws.amazon.com/greengrass/v2/developerguide/mqtt-broker-emqx-component.html) fails on WindowsThe EMQX log is failing w/ a Windows Credentials error:2022-08-19T20:29:26.491Z [INFO] (pool-2-thread-63) aws.greengrass.clientdevices.mqtt.EMQX: shell-runner-start. {scriptName=services.aws.greengrass.clientdevices.mqtt.EMQX.lifecycle.startup.script, serviceName=aws.greengrass.clientdevices.mqtt.EMQX, currentState=STARTING, command=["C:\greengrass\v2\packages\artifacts-unarchived\aws.greengrass.clientdevices.mq..."]}2022-08-19T20:29:26.492Z [ERROR] (pool-2-thread-63) aws.greengrass.clientdevices.mqtt.EMQX: shell-runner-error. Error while running process. {scriptName=services.aws.greengrass.clientdevices.mqtt.EMQX.lifecycle.startup.script, serviceName=aws.greengrass.clientdevices.mqtt.EMQX, currentState=STARTING, command=["C:\greengrass\v2\packages\artifacts-unarchived\aws.greengrass.clientdevices.mq..."]}java.io.IOException: Failed to read credentialat vendored.com.microsoft.alm.storage.windows.internal.WindowsCredUtils.read(WindowsCredUtils.java:36)at com.aws.greengrass.util.platforms.windows.WindowsExec.getPassword(WindowsExec.java:298)at com.aws.greengrass.util.platforms.windows.WindowsExec.createProcess(WindowsExec.java:116)at com.aws.greengrass.util.Exec.exec(Exec.java:316)at com.aws.greengrass.util.Exec.background(Exec.java:373)at com.aws.greengrass.lifecyclemanager.ShellRunner$Default.successful(ShellRunner.java:110)at com.aws.greengrass.lifecyclemanager.GenericExternalService.run(GenericExternalService.java:683)at com.aws.greengrass.lifecyclemanager.GenericExternalService.run(GenericExternalService.java:701)at com.aws.greengrass.lifecyclemanager.GenericExternalService.run(GenericExternalService.java:629)at com.aws.greengrass.lifecyclemanager.GenericExternalService.startup(GenericExternalService.java:343)at com.aws.greengrass.lifecyclemanager.Lifecycle.lambda$handleStateTransitionStartingToRunningAsync$9(Lifecycle.java:530)at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)at java.util.concurrent.FutureTask.run(Unknown Source)at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)at java.lang.Thread.run(Unknown Source)Caused by: com.sun.jna.LastErrorException: [1168] Element not found.at com.sun.jna.Native.invokeInt(Native Method)at com.sun.jna.Function.invoke(Function.java:426)at com.sun.jna.Function.invoke(Function.java:361)at com.sun.jna.Library$Handler.invoke(Library.java:265)at com.sun.proxy.$Proxy30.CredRead(Unknown Source)at vendored.com.microsoft.alm.storage.windows.internal.WindowsCredUtils.read(WindowsCredUtils.java:31)... 15 moreFollowCommentMichaelDombrowski-AWS EXPERT10 months agoHi, the log which you have posted doesn't contain any errors. Can you provide the EMQX component log file?I may also recommend opening a support case through the AWS Console for better private support.ShareMichaelDombrowski-AWS EXPERT10 months agoOne reason why it may fail on startup is if you have an existing program using the same port (8883). Similarly, the Windows firewall (if enabled) may stop things from functioning properly.You can use the following command as an administrator to enable inbound MQTT connections to port 8883.New-NetFirewallRule -DisplayName "Allow MQTT" -Direction Inbound -Protocol TCP -LocalPort 8883 -Action AllowSharegstclair 9 months agoI have updated the original post to include the EMQX log (apologies, I thought it was captured in the greengrass.log). Thanks for your help, happy to open a private support ticket if neededShare"

Answer: "1Accepted AnswerThe error "failed to read credential" means that Greengrass was not able to find the password for the component's runWith user. This does not only apply to EMQX, but to any component which runs an external process. This happens when Greengrass is not running as the user which our instructions would have you run it, or if you did not create and store a user's password following: https://docs.aws.amazon.com/greengrass/v2/developerguide/quick-installation.htmlIf Greengrass is running as a Windows system service, which is what our instructions will have you do, then the user's password must be stored in the LOCAL_SYSTEM account's credential store. Our instructions have you store the password using the PsExec utility, so see that portion of the instructions to make sure that you've followed that.If you aren't running Greengrass as a system service, then you should stop Greengrass and instead run it as a system service.CommentShareEXPERTMichaelDombrowski-AWSanswered 9 months ago"


Question: Attach Volume to FSx Lustre

"I have created an Amazon FSx. The FSx using Lustre Filesystem. And this Lustre filesystem I have mounted on some EC2 machine. How to create a Volume in FSx?When I try to create a Volume, it says to select Filesystem, but the drop down is empty?  So, we cannot attach/create a volume for Lustre Right?FollowComment"

Answer: "0Hi,You can create volume only when you have File systems as Amazon FSX for NetApp ONTAP or Amazon FSX for OpenZFS.https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateVolume.html ,VolumeTypeSpecifies the type of volume to create; ONTAP and OPENZFS are the only valid volume typeCommentShareAWS-User-7653869answered 7 months ago"


Question: What is the most cost efficient and fastest way to start GLUE ETL development

We are going to start development of GLUE ETLs . The different options available are :From the AWS Console : This seems to be costly and slow and not very efficient for developing scriptsFrom Dev Endpoints : Billing Rate is highBy AWS Glue Docker Image : Lacks functionalityInteractive SessionsLocal SetupWhich among these will be simple to set up and not incur cost ?FollowComment

Answer: "0Accepted AnswerHello,I would say the most cost efficient,simple and fastest way to start Glue ETL development are:Use Glue Docker imageUse Interactive sessionReferences:[1] https://aws.amazon.com/blogs/big-data/develop-and-test-aws-glue-version-3-0-jobs-locally-using-a-docker-container/[2] https://docs.aws.amazon.com/glue/latest/dg/interactive-sessions.htmlCommentShareShubham_Panswered a year agoEXPERTFabrizio@AWSreviewed a year ago0Yes , I agree, I am more inclined to use the docker image , but I faces quite a lot of challenges and still facing , in setting it up.For starter , the Jupyter notebook does not have nbextensions preinstalled ,and I could not get it installed either , asked a separate question on that . Then the SPARK is very slow .Havent tried the interative sessions , will start with it soon .CommentShareKoustavCanswered a year agoKoustavC 9 months agoI started using VSCode , which was much simpler to setup and work on .Start the Docker image for GlueOpen VS CodeAttach the containerIt will automatically install Python and other libraries .Good to go .Share0Hi,It always depend on the actual priorities you have to define the trade off between cost efficiency and developer experience.The most cost efficient I would agree is using the docker container . If you prefer to use a traditional IDE environment instead of a notebook you should be able to use it for that as well. Performance will depend on the local machine.If you give more weight to a flexible developer experience using notebooks  and performance when running the jobs or cells then Interactive sessions would be a better choice. You can install your notebook with all extensions and tune the number of DPUs you want to use changing that between sessions.If the developer is fine with a managed notebook, Glue Studio Notebooks would have the same cost of Interactive sessions (it just depends on the DPU you select for the session and duration of the session), same configuration based on session .  Glue Studio Notebooks are only available in some regions currently.hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year agoKoustavC a year agoIs there a way to increase DPU  or Spark config on the Docker ?Share"


Question: HyperparameterTuner: give unique checkpoint_s3_uri to spawned TrainingJobs

"I am implementing a sagemaker tuner for a previously implemented custom estimator that uses spot instances with sagemaker's python sdk. Since until now there is one estimator per submitted training job, I could easily generate a unique s3 prefix for each training job.Since the tuner takes a pre-initialized estimator object, it seems to me I cannot assign a unique S3 prefix to the spawned training jobs anymore, and therefore every training job would have to download all previously exported checkpoints before it can start.While I could hack some cleanup code into the training script, and then only have to download checkpoints of currently active training jobs, it seems to me that there must be a better way I am not seeing.xref: EstimatorBase, HyperparameterTuner.FollowComment"


Question: AWS S3 - Can We Presign an Entire Bucket?

"Hi all,Newbie just getting started with rest api and S3...Q: Is it possible to presign an entire bucket / or folder rather than just one object?Goal : to sign into a whole bucket for a period of time (ex: one day) and then use the same signature to access varied content inside the bucket with the same signature until it expires?https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.htmlFollowComment"

Answer: "1No, a presigned URL is only valid for a single object only. You could look into using a lambda to generate the presigned url's on-demand as part of your API.CommentSharebenduttanswered a year agoAWS-User-5340815 a year agoOK thanks very much.Just checking: Inside a test bucket I have several items with type = folder and it has several images inside.Is the type = folder considered an object?So you are saying that I am NOT able to sign for the whole single folder for one day and then access the individual images inside (one by one) with the folder signature (rather than an item signature)?Thanks much for your help - DaveShare1In my case, I consider using S3STS (S3 Security Token Service), the client assumes the role of accessing a specific folder, backend return access key, secrete key with expiration time.The client will use that S3STS token to access the entire specific folder.CommentShareHoan Phamanswered a year agoAWS-User-5340815 a year agoThanks very much Hoan, I will look into this possibility.Share"


Question: PostAuthentication - auto verify phone_number (not in PreSignUp)

"Hello All, Cognito/Amplify Team,I am implementing passwordless SMS auth. Flow is: signIn -> error (userNotFound) -> signUp -> signIn -> OTP sent to mobile -> OTP entered by  user -> confirmSignIn -> success and user is logged in. This flow works and user is able to successfully sign in. But verification of phone_number should better happen in PostAuthentication (after user is signed in after entering and successfully checking OTP) and not before that in PreSignUp.I have following lambdas: PreSignUp, DefineAuthChallenge, CreateAuthChallenge, VerifyAuthChallengeResponse, PostAuthentication. Things have run fine. Want to change one thing for good: Auto verify phone number in Post Authentication instead of PreSignUp lambda. How to do that? I thought following can do it in PostAuthentication lambda:    event.response.phone_number_verified = "true"it did not. I also tried with setting:event.request.userAttributes.phone_number_verified = "true"it also did not.In PreSignUp, following did work fine:event.response.autoVerifyPhone = true;PostAuthentication lambda (custom.js):exports.handler = async (event, context) => {  console.log('Received EVENT', JSON.stringify(event, null, 2));                      if (event.request.userAttributes.hasOwnProperty("email")                                 && event.request.userAttributes.email_verified != "true") {                         event.request.userAttributes.email_verified = "true"                                  event.response.email_verified = "true";  }     if (event.request.userAttributes.hasOwnProperty("phone_number")              && event.request.userAttributes.phone_number_verified != "true") {         event.request.userAttributes.phone_number_verified = "true";        event.response.phone_number_verified = "true";     }   console.log('Returning event', JSON.stringify(event, null, 2))                        return event;                                                                       };PreSignUp (custom.js):"use strict";exports.handler = async (event) => {    console.log('Received EVENT', JSON.stringify(event, null, 2));    event.response.autoConfirmUser = true;    /*    if (event.request.userAttributes.hasOwnProperty("email")) {        event.response.autoVerifyEmail = true;    }    if (event.request.userAttributes.hasOwnProperty("phone_number")) {        event.response.autoVerifyPhone = true;    }    */    console.log('Returning EVENT', JSON.stringify(event, null, 2));    return event;But when I check user in Cognito, it still shows as NotVerified.[1] which is in TS but also suggest to set: event.request.userAttributes.email_verified = "true"[2] does not suggest how to auto verify phone_number in PostAuthentication lambda.[3] does suggest how to auto verify phone_number in PreSignUp.[1] https://github.com/aws-samples/amazon-cognito-passwordless-email-auth/blob/master/cognito/lambda-triggers/post-authentication/post-authentication.ts[2] https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-post-authentication.html[3] https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-sign-up.htmlCan you help resolve this. How/what to set in PostAuthentication to auto verification of phone number?Thanks in advance.FollowComment"

Answer: "0Accepted AnswerHi,you must not return verified true as part of the return structure but update the attribute through a dedicated API Call to AdminUpdateUserAttributes [ https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateUserAttributes.html ] in one of the Lambda function.That is why the status is not updated.JeffCommentShareJeff Lombardo-AWSanswered 2 months agoRaj 2 months agoThanks Jeff. It worked. Though, had to give the required permission to lambda.Share0Cognito showing the phone_number as NotVerified. This is after user has successfully logged in and session screen is presented using the baked-in authUser.CommentShareRajanswered 2 months agoJeff Lombardo-AWS 2 months agoyou masked the sub in the user attributes but no in the user Information pane, I do not know if this is a problem.ShareRaj 2 months agoSharp eyes! sub is uuid inside aws and will change for next authUser instantiation. Looks harmless if such transient handle is leaked at one experimental point.Share"


Question: Not being able to launch OnVue platform for AWS certification exam

"Hi all,I'm giving AWS CCP exam next week and I registered for it today. I received an email with some steps to complete before the exam day.If you've ever given an AWS certification on Pearson VUE, you know you have to download OnVue application and run a system test. I downloaded it and went through the speaker, microphone, and webcam checks successfully.Next, the network connection check also went successfully. Now to launch the exam simulation, it said I had to close the following applications: swusb.I had to manually shut it down because it couldn't do it automatically. I need help with this because I am not able to close this application.Has anyone ever had this issue before? I am not able to launch the exam simulation because I can't close this swusb application. I'd really appreciate any help or advice.FollowComment"

Answer: 0I would recommend reaching out to Pearson on this issue. They are likely the most well equipped to help you troubleshoot issues with their platform: https://home.pearsonvue.com/Contact-Us.aspxCommentShareEXPERTRob_Hanswered a year ago


Question: There is a SubscribeToShard SDK call.  Is there an "unsubscribe from shard"?

There is a SubscribeToShard SDK call.  Is there an "unsubscribe from shard"?  Thank you.FollowComment

Answer: "0Hi,Kinesis Data Streams API doesn't offer an explicit "Unsubscribe" operation as there is "SubscribeToShard"[1]. However, by stopping your consumer from processing SubscribeToShard events, you can essentially unsubscribe from a shard.[1] SubscribeToShard - https://docs.aws.amazon.com/kinesis/latest/APIReference/API_SubscribeToShard.htmlCommentShareSUPPORT ENGINEERLovetesh_Canswered 2 months ago"


Question: Change name on my certification account

"Team,Am trying from past few days to change name on my certification account, I have all screenshots proving this link never works.As per the doc using this link (https://support.aws.amazon.com/#/contacts/aws-training) but this never works. 1) there is no inquiry field called  "Account Assistance". 2) it always throws som error.IMP : my exam is scheduled for May 16th 5:00 am CDT. I need immediate assistance.This is my candidate id : *Current Name in AccountFirst Name: SreeramLast Name: SomanchiCorrected Name for AccountFirst Name: *Last Name: Somanchi*Edit: Removed candidate ID and part of name since it's considered PII. - John M.FollowComment"

Answer: "0Hello Sreeram,Someone from AWS Training and Certification Customer Support will be reaching out to you shortly. Check for an email with more information.CommentShareBriNasAWSanswered 19 days agoSreeram Somanchi 19 days agoMy exam is done, please dont change any name now. leave it as is.First Name : SreeramLast Name : SomanchiShare-1Hi,Are you able to select as below screenshot?That should be able to ask for the right enquire.Manage to submit the enquire too:Hope it helps ;)CommentShareEXPERTalatechanswered 20 days agoSreeram Somanchi 20 days agoI have selected Certification and Name change. however when I click submit its throwing error at the bottom of the screen and there is a blank space so I can't even read what the error is to fix. Is there a way that I can attach a screenshot?Sharealatech EXPERT20 days agoSee above. I just managed to send enquire successfully.  am using Chrome, also make sure if you are not in VPN or similar, as at least worked for meShareSreeram Somanchi 20 days agoI just tried again now, I see some error unfortunately I can't see what the error is.Am NOT on any VPN. I have tried both in Chrome and in Safari nothing works.Am not sure how do I attach screenshotShareSreeram Somanchi 19 days agoFinished my exam.ShareSreeram Somanchi 19 days agoWould you be able to submit the request on my behalf, am not sure if this gets resolved as my test is 15 hrs away now.See details below :Candidate ID: *Current Name in AccountFirst Name: SreeramLast Name: SomanchiCorrected Name for AccountFirst Name: *Last Name: Somanchi*Edit: Removed candidate ID and part of name since it's considered PII. - John M.Share"


Question: AWS SSM / Patch Manager Windows / SSL Error

"HI,I tried to use AWS SSM Patch manager for a Windows 2019 instance.I' used S3 VPC Endpoint with a private route53 hosted Zone.The SG of the S3 endpoint allow https and http.In the SSM logs it seams I have a SSL certificate issue but I do not know how to solve this issue.Preparing to download PatchBaselineOperations PowerShell module from S3.Downloading PatchBaselineOperations PowerShell module from https://s3-eu-west-3.amazonaws.com/aws-ssm-eu-west-3/patchbaselineoperations/Amazon.PatchBaselineOperations-1.35.zip to C:\ProgramData\Amazon\SSM\InstanceData\i-0e71b155c8a6cbe29\document\orchestration\84e87dc6-d218-45de-bb2a-e3d855cabe3b\PatchWindows\Amazon.PatchBaselineOperations-1.35.zip.C:\ProgramData\Amazon\SSM\InstanceData\i-0e71b155c8a6cbe29\document\orchestration\84e87dc6-d218-45de-bb2a-e3d855cabe3b\PatchWindows_script.ps1 : An error occurred when executing PatchBaselineOperations: The underlying connection wasclosed: Could not establish trust relationship for the SSL/TLS secure channel.CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorExceptionFullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,_script.ps1failed to run commands: exit status 0xffffffffThe instance profile is set to AdministratorRole for the test.Have you ever encountered this issue ?ThanksFollowComment"


Question: Patching SLES12 SP3

"I want migrate my S4HANA Server from SLES12 SP 3 to SLES15 SP3. However when I try to patch SLES12 SP3, I am getting following options and not sure how to go about it:Resolving package dependencies...7 Problems:Problem: nothing provides python3-pyparsing >= 2.0.2 needed by python3-packaging-17.1-2.7.1.noarchProblem: nothing provides python-cryptography >= 1.5 needed by python-paramiko-2.4.0-9.10.2.noarchProblem: nothing provides python3-cryptography >= 1.3.4 needed by python3-urllib3-1.25.10-3.29.1.noarchProblem: nothing provides SUSEConnect > 0.3.31 needed by cloud-regionsrv-client-10.0.0-52.66.1.noarchProblem: nothing provides SUSEConnect > 0.3.31 needed by cloud-regionsrv-client-10.0.0-52.66.1.noarchProblem: nothing provides SUSEConnect > 0.3.31 needed by cloud-regionsrv-client-10.0.0-52.66.1.noarchProblem: nothing provides python-cryptography >= 1.5 needed by python-paramiko-2.4.0-9.10.2.noarchProblem: nothing provides python3-pyparsing >= 2.0.2 needed by python3-packaging-17.1-2.7.1.noarch Solution 1: Following actions will be done:  deinstallation of python3-setuptools-40.6.2-4.12.23.noarch  deinstallation of python3-pyOpenSSL-16.0.0-4.17.1.noarch  deinstallation of python3-cryptography-1.3.1-7.13.4.x86_64 Solution 2: do not install patch:SUSE-SLE-Module-Public-Cloud-12-2020-3594-1.noarch Solution 3: break python3-packaging-17.1-2.7.1.noarch by ignoring some of its dependenciesChoose from above solutions by number or skip, retry or cancel [1/2/3/s/r/c] (c): Please guide me to fix this issue.FollowComment"


Question: OpsWorks: cannot connect with Github due to SSH key / RSA issues

"Our OpsWorks stacks will no longer deploy.  They are failing when trying to connect to GitHub.  Here's the error (with my github stuff obfuscated):================================================================================Error executing action `checkout` on resource 'git[Download Custom Cookbooks]'================================================================================  Mixlib::ShellOut::ShellCommandFailed------------------------------------Expected process to exit with [0], but received '128'---- Begin output of git ls-remote "git@github.com:********"  ----STDOUT: STDERR: ERROR: You're using an RSA key with SHA-1, which is no longer allowed. Please use a newer client or a different key type.Please see https://github.blog/2021-09-01-improving-git-protocol-security-github/ for more information. fatal: Could not read from remote repository. Please make sure you have the correct access rightsand the repository exists.The repo does exist.  And when I try to put in a newer form of RSA key, the OpsWorks control panel rejects it.  OpsWorks seems to want an old version of RSA which GitHub will no longer support.  We're totally stuck.  How do we get out of this?FollowCommentrePost-User-4480187 5 months agoI'm running into the same issue. Did you figure out any solution?Share"

Answer: "0Accepted AnswerUnfortunately my only solution was that I realized we had another OpsWorks stack using the same SSH key, and when I copy/pasted that old key back to my machine, it worked.  Magical solution that I still do not understand. I'm sorry I can't be more helpful.  ;(  For what it's worth, we are going to try to migrate completely off of OpsWorks during 2023.CommentSharewinehooklg...answered 5 months agolg..."


Question: Unable to use AWS-ApplyDSCMofs with managed instance

"I can't seem to get this to work with state manager on a managed instance. Keep getting this error about access denied to a Windows\Temp\DSCMofs directory. Looks like the mof file is not getting downloaded to the directory. The managed instance has the correct role with access to all s3 resources.----------ERROR-------C:\ProgramData\Amazon\SSM\InstanceData\mi-07acb6590a0dfc02e\document\orchestration\f719dfce-ae7d-41a1-9e86-e3eae936b328\RunPowerShell_script.ps1 :##################################################################Error Message##################################################################Exception calling ".ctor" with "6" argument(s): "Access to the path'C:\Windows\TEMP\DSCMofs\0C3A1C8AC41FBD80A39720740875CCB7.mof' is denied."(line 1936)##################################################################Failing command##################################################################$fs = New-Object System.IO.FileStream($FilePath, [IO.FileMode]::OpenOrCreate,[IO.FileAccess]::ReadWrite, [IO.FileShare]::Read, 4096,[IO.FileOptions]::Encrypted)##################################################################Base Exception##################################################################System.UnauthorizedAccessException: Access to the path'C:\Windows\TEMP\DSCMofs\0C3A1C8AC41FBD80A39720740875CCB7.mof' is denied.at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)at System.IO.FileStream.Init(String path, FileMode mode, FileAc---Error truncated----FollowComment"

Answer: "0Accepted AnswerI have an update. It turns out that we had some GPO settings (Computer Configuration/Policies/Windows Settings/Security Settings/Public Key Policies/Encrypting File System) that were using old certificates from before I started at this organization. They were expired. I removed those certificates from the GPO, ran gpupdate on all my test machines, and now 'AWS-ApplyDSCMofs' is working as intended.I'd suggest checking these settings.CommentSharembobkeerianswered 4 years ago0One thing I noticed in the applydscmof.ps1 file. The $env variable is different compared to other run documents that I have looked at. It shows:if ($mm.S3Modules.Contains($moduleKey)){$moduleDir = "$env:TMP\DSCModules"While another article references the temp area on a windows instance as $env:TEMPHere for example: https://docs.amazonaws.cn/en_us/systems-manager/latest/userguide/sysman-install-managed-win.htmlCommentSharekleinbergeranswered 4 years ago0Hi,Thank you for reporting this issue. We will look into this and get back to you. We have tried to repro this locally with no success although it is not exactly equivalent - we used a aws instance with activation code to simulate on-prem instance.We will send an update as soon as we find more information.Regards,UpenderCommentShareAWS-User-7592761answered 4 years ago0I tried another vm, non domain joined, using the same role. I also modified the role to have the full s3 access policy by amazon, to test whether it was an S3 permissions issue. The output looks a little different now, but same result.I am using the service role: AmazonEC2RunCommandRoleForManagedInstancesVERBOSE: [2018-12-17 20:37:41.287] Sending HTTP Get request to'https://s3-us-east-2.amazonaws.com/aws-ssm-us-east-2/statemanagerdocumentspayload/AWS-ApplyDSCMofs/AWS-ApplyDSCMofs-20181115.ps1'VERBOSE: [2018-12-17 20:37:41.631] Received response with status codeNotModifiedVERBOSE: [2018-12-17 20:37:41.655] Local file matches remote file, no contentwas downloaded.VERBOSE: [2018-12-17 20:37:41.678] Importing script functionsVERBOSE: [2018-12-17 20:37:42.193] Importing AWSPowerShell moduleVERBOSE: [2018-12-17 20:37:44.177] Ensuring AWSPowerShell module is v3.3.270.0or higherVERBOSE: [2018-12-17 20:37:44.187] AWSPowerShell module is at or above theminimum required version. Installed: 3.3.428.0VERBOSE: [2018-12-17 20:37:44.190] Ensuring AWS RegionEndpoint can be obtainedby FallbackRegionFactoryVERBOSE: [2018-12-17 20:38:00.069] Ensuring AWSCredentials can be obtainedfrom FallbackCredentialsFactoryVERBOSE: [2018-12-17 20:38:00.089] Ensuring we can retrieve the instance Id ofthe machineVERBOSE: [2018-12-17 20:38:00.117] Retrieving instanceID from SSM environmentvariableVERBOSE: [2018-12-17 20:38:00.146] Starting function InvokeComplianceRun(called from l---Output truncated-------------ERROR-------C:\ProgramData\Amazon\SSM\InstanceData\mi-020b50196866dcec0\document\orchestration\feba1115-1b8e-476b-89a0-a4b76db02907\RunPowerShell_script.ps1 :##################################################################Error Message##################################################################Failed to download file: <?xml version="1.0" encoding="UTF-8"?><Error>InvalidRequest<Message>The authorization mechanism youhave provided is not supported. Please use AWS4-HMAC-SHA256.</Message><RequestId>A5B79C168ADA1F49</RequestId><HostId>5A7w9I37lTu1QHgotjiTt9ONrt5m4MGFmHE0CPcU4L1V6pPoWKRZv2YiEFdcWd4EAslp9fhvD5A=</HostId></Error> (line 1959)##################################################################Failing command##################################################################throw "Failed to download file: $er"##################################################################Base Exception##################################################################System.Management.Automation.RuntimeException: Failed to download file: <?xmlversion="1.0" encoding="UTF-8"?><Error>InvalidRequest<Message>The authorization mechanism youha---Error truncated----Edited by: kleinberger on Dec 17, 2018 12:52 PMCommentSharekleinbergeranswered 4 years ago0Something must have been updated. It's working fine today now. I plan on testing multiple mof's next.CommentSharekleinbergeranswered 4 years ago0Actually, this has something to do with joining a vm to the domain. Works all day long on a non-domain server 2012r2vm. I have another vm joined to the domain, and it will not download the mof file to a temp directory. I'm looking at IE domain trusts and security settings. I think it's something to do with how the applymof script is pulling down the mof file. In the powershell logs, there is a step that is different between the 2 servers. The failing one has something to the effect:"Dynamic Parameters HelpMessage=The dynamic parameter is required for Find-Module and Install-Module"Edited by: kleinberger on Dec 21, 2018 4:40 PMCommentSharekleinbergeranswered 4 years ago0This definitely breaks once a vm joins the domain. If I disjoin it, and reboot, it starts working again immediately. The vm is in the default computers OU, which doesn't have that much being enforced. I have tried manually turning on the items being enforced by group policy on the non domain joined vm, to see if I can find if it's a policy item causing the behavior. I have not been able to replicate by just turning on by hand these policy items.The apply mof file will not download to the C:\Windows\Temp directory once the vm is joined to a domain. The filename on a working vm is AWS-ApplyDSCMofs-20181130.ps1. There is also a folder that gets created named DSCMofs, and one name Microsoft.PackageManagement.The permissions on the Temp folder are the same for joined and non-joined.CommentSharekleinbergeranswered 4 years ago0Hi,We are suspecting something wrong with the proxy server when VM is joined to a domain. There is verbose logging option in the document parameters. When you create an association or run the DSC document via Run Command, can you enable verbose logging and send us the logs?Regards,UpenderCommentShareAWS-User-7592761answered 4 years ago0Here is the verbose output. I'm able to do an invoke web request from powershell on the vm and get to all of the described ps1 files in the scripts. Not sure what is going on. This vm is in an OU with not much gpo applied.Works fine without domain join. Continues to work after domain join, but once I manually removed the C:\Windows\Temp\ dsc files used, and try to apply the association....it fails with this:stdout:VERBOSE: [2019-02-07 13:27:40.683] Sending HTTP Get request to'https://s3-us-east-2.amazonaws.com/aws-ssm-us-east-2/statemanagerdocumentspayload/AWS-ApplyDSCMofs/AWS-ApplyDSCMofs-20181207.ps1'VERBOSE: [2019-02-07 13:27:41.329] Received response with status code OKVERBOSE: [2019-02-07 13:27:41.346] Local file did not exist, or did not match remote file ETag (MD5) value. New contentwas downloaded.Exiting with code '219'stderr:C:\ProgramData\Amazon\SSM\InstanceData\mi-0d81776e7dce96ccd\document\orchestration\6905e7e2-630b-46b0-b493-5cb4dfc40676\RunPowerShell_script.ps1 :##################################################################Error Message##################################################################Exception calling ".ctor" with "6" argument(s): "Access to the path 'C:\Windows\TEMP\AWS-ApplyDSCMofs-20181207.ps1' isdenied." (line 219)##################################################################Failing command##################################################################$fs = New-Object System.IO.FileStream($scriptPath, [IO.FileMode]::OpenOrCreate, [IO.FileAccess]::ReadWrite,[IO.FileShare]::Read, 4096, [IO.FileOptions]::Encrypted)##################################################################Base Exception##################################################################System.UnauthorizedAccessException: Access to the path 'C:\Windows\TEMP\AWS-ApplyDSCMofs-20181207.ps1' is denied.at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights,FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, BooleanbFromProxy, Boolean useLongPath, Boolean checkHost)at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize,FileOptions options)##################################################################PSGarbage##################################################################+ CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,_script.ps1failed to run commands: exit status 219CommentSharekleinbergeranswered 4 years ago0Have you had a look at the encryption option ([IO.FileOptions]::Encrypted)? Can you run it without that option.I found that attempting to encrypt files under authority "nt authority\system" will fail with access denied in C:\Windows\Temp.Edited by: OZaws on Jun 27, 2019 8:27 AMCommentShareOZawsanswered 4 years ago0Hi there, hoping to revive this thread.I encountered the exact same error on our domain-joined instances when I attempted to implement DSC using the 'AWS-ApplyDSCMofs' document. I created a test instance and confirmed it occurs on a brand new, domain-joined instance. The instance is joined using a copied 'AWS-JoinDirectoryServiceDomain' document.After unbinding the instance from the domain through Control Panel, the 'AWS-ApplyDSCMofs' document executed as expected. Then after binding the instance back to the domain using SSM, 'AWS-ApplyDSCMofs' continued to function correctly. Something about unbinding and rebinding fixed it.Can anyone confirm similar behavior?CommentSharembobkeerianswered 4 years ago0I'm confirming that it's failing in the same way still.It has to be something related to security or trust settings once joined to the domain.It continues to work after a domain join if that Temp document is already populated from the first run without domain join, but if I delete it....the process fails and it's unable to grab the .ps1 file again.CommentSharekleinbergeranswered 4 years ago0This was indeed the solution. Thank You!CommentSharekleinbergeranswered 4 years ago"


Question: issue connecting EC2 instance

HI Im trying to connect my EC2 instance named production in the canada central hosting but when i click connect it gives me an SSH connection error. please advice...ScreenshotFollowComment

Answer: "0If you have not, I recommend following the below troubleshooting article to identify the root cause/fix the issue. The troubleshooting steps listed in the article are as follows:Verify that EC2 Instance Connect supports your instance's Linux distribution.Verify that your supported instance has the EC2 Instance Connect package installed.Verify that the IAM user trying to use EC2 Instance Connect has permission to push the public key to the instance.Verify that the instance's security group rules list EC2 Instance Connect IPs:ReferenceHow do I troubleshoot issues connecting to my EC2 instance using EC2 Instance Connect?CommentShareTaka_Manswered 5 months ago"


Question: AWS Glue Catalog is not fetching the New fields added to the parquet thru pyspark script

"Hi,We have a scenario where we have multiple parquet files in S3 where we added new fields to some of the parquet files. After that ran the crawler and the glue catalog table is showing the newly added fields. However when we are reading the parquet files in a Glue Job using Pspark script with glueContext.create_dynamic_frame.from_catalog the new fields are not showing up in the schema at all. We tried with Mergeschema in additional options but it is also not working. We are expecting Glue to read from the catalog as it is updated and show Null values for the parquet files where the new fields were not there.Please help on how to get the new fields in the Glue job thru catalog read.FollowComment"

Answer:
"0Hello,As you have mentioned this is an expected behaviour with the parquet files. This is because Glue and Apache Spark both use the same Parquet readers. Since the parquet files have their own schema, while reading using Glue Dynamic Frame when defining the schema for a parquet table, it picks the schema from the first file in the S3 location. It does not scan through all the files to define the schema. If the files are stored in multiples folders, then it picks the first file from the first folder.
Generally, usage of the mergeSchema in your read should resolve such issue. Can you please verify if the syntax is correct or not:======datasource0 = gc.create_dynamic_frame.from_catalog(database = "tsetdb", table_name = "testtable", transformation_ctx = "datasource0",additional_options={"mergeSchema":"true"})======Try also using Spark SQL and check if that provides the expected result. You can enable the same for SQL queries in glue by adding this line to your script:
======glueContext.sql("set spark.sql.parquet.mergeSchema=true")======I hope these help. If not, can you also try to rename the new file with the new schema such that it’s on top of the listing in s3. Not a very good approach, but can be tried.CommentShareSUPPORT ENGINEERManish Kumar_Nanswered 10 months ago"


Question: CDK UserpoolClient refreshTokenValidity duration fails to synthesize correctly

"new UserPoolClient(this, 'Client', {  idTokenValidity: Duration.hours(2),  accessTokenValidity: Duration.hours(2),  // CDK BUG! sets to 1 minute which is error  refreshTokenValidity: Duration.hours(12),is synthesized as:      TokenValidityUnits:        AccessToken: minutes        IdToken: minutes        RefreshToken: minutes      RefreshTokenValidity: 1    // <- WRONG!      IdTokenValidity: 120      AccessTokenValidity: 120FollowCommentLawrence Aiello 2 months agoYou might want to post this as a bug on the github repository, as that is the best place for it if this is really a bug. Link here: https://github.com/aws/aws-cdkShare"


Question: lightsail ssh "connecting to instance..."  can't connected to my instance with ssh

I am trying to connect to my instance and it always says "connecting to instance...". I've rebooted and also re-created the instance. but its still stuck at  "connecting to instance..."  anyone has same problem? my port 22 is openedFollowComment

Answer: "0I answered the following in "Cannot SSH to Lightsail instance via AWS Console. Port 22 is open". Will it help you?In my case, I was able to connect by deleting Cookies (Chrome).I don't know the cause, but when I couldn't connect, I was getting the following Websocket error in the console log.CommentSharezizianswered a year ago0Please open your lightsail console with browser traceless mode.CommentShareAWS-User-7220467answered a year ago"


Question: `no data available` in IoT device defender metrics

"I can't see any defender metrics on the device's "info" page (AWS IoT -> Manage -> Things -> my_thing_name -> defender metrics tab)?I only see the message "no data available".I have installed defender agent to my things, which sends custom metrics from the device to iot defender.Both cloud side metrics and device custom metrics shows "no data available" msg on all iot devices.I don’t have any security profile etc. created, because I tought that at least these cloud side metrics should be visible without any needs to configuration.Have I misunderstood something? and what i shoud do to enable those metrics to be availabe per deviceFrom device side, i cant see any errors. I send metrics to right topic and i get response from MQTT broker with message "{"thingName":"my_thing_name","reportId":1674798651,"status":"ACCEPTED","timestamp":1674798652251}'FollowComment"

Answer: 0Hi. You need to define the Security Profile. It defines what metrics are collected and retained for a particular Thing group or groups.https://docs.aws.amazon.com/iot/latest/developerguide/detect-concepts.htmlYou can use the AWS IoT console or API commands to create a Security Profile and associate it with a group of devices. AWS IoT Device Defender Detect starts recording security-related data and uses the behaviors defined in the Security Profile to detect anomalies in the behavior of the devices.CommentShareEXPERTGreg_Banswered 4 months ago


Question: Aurora Cluster stuck in "Creating" status

"I created an Aurora Postgres 10.6 database cluster (no instance yet) and it's stuck in "Creating" status.When I try to delete it, it doesn't do anything (both in the console and the CLI).The resource id is cluster-REYE5YEBCJTISBPU2GWIL7XC5Q and it's in us-east-2.I'd like to delete it, if possible.JoeFollowComment"

Answer: 0The resource aged off/out.CommentShareJosephPardianswered 4 years ago


Question: Changing "primary" replication database

"Im trying to follow this guide https://workmarket.tech/zero-downtime-maintenances-on-mysql-rds-ba13b51103c2 , for *active*-*active* replication.But on commandCHANGE *active* TO *active*_HOST=....i get error:ERROR 1227 (42000): Access denied; you need (at least one of) the SUPER or REPLICATION_*secondary*_ADMIN privilege(s) for this operationAs i understood AWS forbids this kind of access via command line access.So, how do i then do this change? i assume via parameters group... but how?*active* = some non inclusive word*secondary* = some other non inclusive wordFollowComment"

Answer: "0Accepted AnswerSo, the "active-active" replication worked, there is just a some things that needs to be configured.As far as i understood those values in parameter groups of RDS DB must be configured:auto_increment_incrementauto_increment_offsetlog_bin_trust_function_creatorsThen you also need to set the retention periodaws rds modify-db-instance --backup-retention-period 1 --db-instance-identifier <dbname> --apply-immediatelyAnd then, just following any common guide of setup-ing the "active-active" replication should work.CommentShareJoann Babakanswered 3 months ago0There is a better option. RDS now support managed blue green deployment to make maintenance operations easier: https://aws.amazon.com/about-aws/whats-new/2022/11/amazon-rds-blue-green-deployments-safer-simpler-faster-updates/CommentShareMODERATORphilawsanswered 3 months agoJoann Babak 3 months agoIt might be better solution in some cases, but in our case, we need to remove downtime fully, and this "blue/green deployment" solution does have downtime.Share"


Question: what is the best practice for custom authorizer in case of an exeptions

"Hi I have an APIGateway with a customAuthorizer source identity set to the Authorization field in the header of the request I also have a 5minute cache set up(default) for the authorizer responsesthe problem that I have is when the customAuthorizer throws an exeption it is cached and the user that made this request will be blocked for the next 5 minutes because of the source Identity. Is there a way to only cache responses if they return an IAM policy or I have to do something to work around this .The cache is needed because I dont want to call the authorizer on each request and blocking the user because something went wrong inside the lambda is not the user experience that i wanna provide.Basically I would like to know if there is a way to cache the result of an "Allow" or "Deny" policy but allow a retry in case of error.Thanks for the time,FollowComment"

Answer: "0One approach to achieve the desired outcome would be to define your cache key and ensure that a request retrying after an error would not be triggering an existing cache key based on how the cache key is composesd.API Gateway offers a caching key mechanism, which uniquely identifies a particular user in your custom authorizer. All the requests passing the same header will receive a cached response if the request is sent with an expiry time-frame. When a cached method or integration has parameters, which can take the form of custom headers, URL paths, or query strings, you can use some or all of the parameters to form cache keys. API Gateway can cache the method's responses, depending on the parameter values used.See https://www.linkedin.com/pulse/aws-lambda-authorizer-patterns-caching-harshit-pandey/CommentShareAlexanderanswered a year ago"


Question: "When upgrading RDS(mariaDB) version, will endpoint and ARN information change?"

I am trying to upgrade Maria DB version. (It's because aws has stopped supporting that version.)The thing to worry about is that the DB endpoint and address such as ARN seem to have changed.Does the version upgrade change values such as endpoints or ARNs?FollowComment

Answer: "0Accepted AnswerIf you created a new database, exported the data and imported, then of course the ARN and endpoint will change. If you requested an upgrade on an existing RDS instance, it will remain the same. See https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.MariaDB.html#USER_UpgradeDBInstance.MariaDB.MajorCommentShareRodney Lesteranswered a year ago"