Question: Minimize the downtime of Aurora mysql engine Upgrade.

"Hi,I want to upgrade our mysql engine 5.6 to latest available. I have 4TB of data in Aurora Mysql.So how i can perform this task in our production servers without downtime or Is there any way we can minimize the downtime.FollowComment"

Answer: "1Accepted AnswerTo minimize the downtime during major version upgrade, blue-green upgrade technique could be the option. Please note, using blue-green upgrade, source cluster should be binary log enabled. To do this, need to engine restart to enable binary log and may cause some performance impact due to additional resourceconsumption by writing and shipping binaly log.Another option should be in-place upgrade. You can estimate upgrade time by create cloned cluster and upgrade it for measuring upgrade time.CommentShareYUTAKA_Hanswered 10 months ago"


Question: Getting Amazon S3 object tags through CloudFront distribution URL

"We have a private S3 bucket to store imagesWe have created a CloudFront distribution to expose images in this private S3 bucket.S3 bucket policy allows 'Read' access only for the CloudFront Identity.Through the CloudFront URL, we are able to get list of objects/images in the bucket but this list does not have the S3 object tags in the response.There is a different API to get tags for individual S3 objects:https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectTagging.htmlWe are unable to get this working through the CloudFront URLHow can we get access to S3 object tags through CloudFront distribution URL?FollowComment"

Answer: 0Accepted AnswerS3 object tags are not exposed through HTTP access. If you need to get object metadata the right way to do that is through the usage of "x-amz-meta-" metadata settings. You will be then able to see it in the response headers when you GET the object.x-amz-meta-test: MyCustomTagCommentShareTzoori Tamamanswered 3 years ago


Question: Coding in Lumberyard - Resources for getting started

"The Amazon Game Services Solutions Architect Al Murray posted the great reply to the question "How do I get started using C++ with Lumberyard?" and I thought it was very useful information that might be helpful to anyone new to Lumberyard.The first suggestion I have is to look into this video [[1](https://youtu.be/mNulWXcJ1JA)] which describes some of the underlying theory of Lumberyard engine's coding architecture and shows a very quick demo of how core concepts as reflection, code generation, components, events and slices work.Then, actually start making a project in which the object is to create a native C++ component that can be attached to a game entity in the editor.1. You will as a minimum need a Lumberyard project. It will be in charge of loading any gems that you create for your game. Open the <lumberyard_root_folder>\dev\Bin64\, then run ProjectConfigurator.exe. Create a new project there and give it a name.2. Games in Lumberyard should be made as one or more gems. A gem is a way of isolating your own code from the engine code so that, imagine if you update your version of Lumberyard, you don't end up with a bunch of code that you have to untangle to update. Also it may make sense to break up the game into pieces for whatever reason, these would also be gems. Gem creation is covered here [[2](http://docs.aws.amazon.com/lumberyard/latest/userguide/gems-system-gems.html)]. The structure of gems is discussed here [[3](http://docs.aws.amazon.com/lumberyard/latest/userguide/gems-system.html)] but you can basically assume that a gem contains assets that can be loaded, a code module, and some waf data to build the code module in the gem. [[4](http://docs.aws.amazon.com/lumberyard/latest/developerguide/az-module-gems.html)]3. Gems in the latest release of Lumberyard (since 1.5.0.0) contain code created as AZ Modules [[5](http://docs.aws.amazon.com/lumberyard/latest/developerguide/az-modules-intro.html)] (which is a good thing). These are the libraries (static .lib or dynamic .dll) that contain the built code. The AZ module source includes an interface derived from AZ::Module and this contains a system entity and adds any required system components to it (one by default). It will also come with an event bus by default, and a single system component. System components are singleton components [[6](http://docs.aws.amazon.com/lumberyard/latest/developerguide/az-module-parts.html)]. The module is registered with the autogenerated code, e.g.```AZ_DECLARE_MODULE_CLASS(HelloWorld_010c14ae7f0f4eb1939405d439a9481a, HelloWorld::HelloWorldModule)```4. You are also free to derive components from AZ::Component and include them in the gem. [[7](http://docs.aws.amazon.com/lumberyard/latest/developerguide/component-entity-system-create-component.html)] Registering is as easy as the example code shows:```AZ_COMPONENT(MyComponent, "{0C09F774-DECA-40C4-8B54-3A93033EC381}");```5. If you will need to store any information out of the component instances, it must have metadata added in a reflect function which tells Lumberyard what will be stored, or serialized. If it is to be seen in the editor, so that you can attach it to a game object, for example, you will need to add metadata in the reflect function which tell Lumberyard what it does in the editor, including what settings you can make on the component and how the UI looks in the editor. Reflection is simply the term used for any code you write that tells another part of the system how to use your class. You may say in the reflection code that a particular function needs to be called when data is changed by the editore, and you should also write these change callbacks in the component. [[8](http://docs.aws.amazon.com/lumberyard/latest/developerguide/component-entity-system-reflect-component.html)]6. You should be able to create an entity in the editor now, and attach your component and set values in the object, and print them out or see them in the debugger.7. You should learn about slices and dynamic slices now, to get you to the level where you can start using code effectively in Lumberyard. [[9](http://docs.aws.amazon.com/lumberyard/latest/developerguide/dynamic-slices.html)]Please let us know if you run into difficulties, and I will be happy to help,Al Murray :)Solutions ArchitectAmazon Game Services[1] [https://youtu.be/mNulWXcJ1JA](https://youtu.be/mNulWXcJ1JA)[2] [http://docs.aws.amazon.com/lumberyard/latest/userguide/gems-system-gems.html](http://docs.aws.amazon.com/lumberyard/latest/userguide/gems-system-gems.html)[3] [http://docs.aws.amazon.com/lumberyard/latest/userguide/gems-system.html](http://docs.aws.amazon.com/lumberyard/latest/userguide/gems-system.html)[4] [http://docs.aws.amazon.com/lumberyard/latest/developerguide/az-module-gems.html](http://docs.aws.amazon.com/lumberyard/latest/developerguide/az-module-gems.html)[5] [http://docs.aws.amazon.com/lumberyard/latest/developerguide/az-modules-intro.html](http://docs.aws.amazon.com/lumberyard/latest/developerguide/az-modules-intro.html)[6] [http://docs.aws.amazon.com/lumberyard/latest/developerguide/az-module-parts.html](http://docs.aws.amazon.com/lumberyard/latest/developerguide/az-module-parts.html)[7] [http://docs.aws.amazon.com/lumberyard/latest/developerguide/component-entity-system-create-component.html](http://docs.aws.amazon.com/lumberyard/latest/developerguide/component-entity-system-create-component.html)[8] [http://docs.aws.amazon.com/lumberyard/latest/developerguide/component-entity-system-reflect-component.html](http://docs.aws.amazon.com/lumberyard/latest/developerguide/component-entity-system-reflect-component.html)[9] [http://docs.aws.amazon.com/lumberyard/latest/developerguide/dynamic-slices.html](http://docs.aws.amazon.com/lumberyard/latest/developerguide/dynamic-slices.html)Follow"

Answer: "0Can we get more/better documentation on how threading and more specifically thread safety works using the new Component Entity System and the engine in general. I searched the Developer Guide for the term "thread" and only got 9 hits and the closest useful result was the EBUS Documentation. Even the System Documentation category in the Developers Guide had nothing in regards to thread safety or locking mechanisms and more specifically how thread safety works with multiple handlers attached to a Component.I've seen cases where there could be both a TickBus(which isn't documented) and an EventBus on a Component and in theory both could conflict with each other without a single locking mechanism if they each have their own. On top of that given the nature of how specific Components are to a specific feature or data it's not unreasonable to want to directly access one component from another component on the same entity when handling a certain Event which could also lead to problems. Better documentation on threading and thread safety would help, especially for anyone new to Lumberyard.SharerePost-User-9435498answered 6 years ago0You are right, the docs are pretty sparse at the moment and is something the documentation team is working very hard to address and update. You should start to see more documentation coming on board with each new release. Sorry for the inconvenience this has caused.SharerePost-User-8353690answered 6 years ago0[[3]](https://begamedev.com)[http://docs.aws.amazon.com/lumberyard/latest/userguide/gems-system.html](http://docs.aws.amazon.com/lumberyard/latest/userguide/gems-system.html)Thanks a lot Binky.SharerePost-User-4903043answered 4 years ago"


Question: AWS Directory Service unable to resolve EFS dns name

"Hello,I am using AWS Directory Service and therefore my VPC has the required custom DHCP options. This seems to be causing my EFS dns name to not resolve:$ sudo mount -t efs fs-981781a1:/ efsFailed to resolve "fs-981781a1.efs.ap-southeast-2.amazonaws.com" - check that your file system ID is correct.$ sudo mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport fs-981781a1.efs.ap-southeast-2.amazonaws.com:/ efsmount.nfs4: Failed to resolve server fs-981781a1.efs.ap-southeast-2.amazonaws.com: Name or service not knownHowever, specifying the EFS target ip address does work:sudo mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport 10.0.14.62:/ efsAny help would be appreciated.Thanks!FollowComment"

Answer: "0Accepted AnswerThere are two areas you can check:Verify that the DNS service provided by AWS Directory Service is configured to forward unknown quries to your .2 DNS server.  Given the EFS IP you provided I would guess that DNS server is at 10.0.0.2.  Here is a screenshot showing where to configure the forwarder.http://www.mcmcse.com/microsoft/guides/70-410/images/dns_forwarding1.jpgEFS creates mount targets at the AZ level.  So if you have instances in three AZs and only created mount targets in two AZs, then the instances in the third AZ without a mount target will not be able to resolve the name.The common problem we hear about in Directory Service is that the EFS mount target is only in AZ A and the Directory Service domain controllers are in AZ B and C.  The EC2 instances send all of their DNS queries to the domain controllers and they then forward the lookup to the .2 DNS server in their AZ.  But since there isn't a mount target in the domain contorller's AZ the .2 DNS server gives an NX (non-existent) response and the domain controller forwards that response to the EC2 instance.  The easy fix in this scenario is to create EFS mount targets in all of the AZs where you have provisioned Directory Service domain controllers.CommentShareJoeD_AWSanswered 4 years ago0Hello,Thank you for your reply.My EFS, managed Microsoft AD Directory Service and EC2 are all using the same subnet/availability zone. However, I had no idea I needed to setup a forwarder for unknown queries. I provisioned the managed Microsoft AD Directory Service using a cloudformation template based upon the following:https://github.com/aws-quickstart/quickstart-microsoft-activedirectory/blob/master/templates/ad-3.templatePreferrable I'd like to add the additional setup of the forwarder to it.If I was to do it manually do I really need to install DNS Manager tools on a windows EC2 instance? Or can it be done in the Directory Service console?Any help would be appreciated.ThanksCommentShareJimmy514answered 4 years ago0Sorry, but we have not provided a way to alter the forwarder setting through the console or a public API.  Configuring it through a domain joined EC2 instance is the only option available today.CommentShareJoeD_AWSanswered 4 years ago"


Question: Is the Amazon Timestream pricing example wrong?

"It seems to me that the pricing example for Timestream on  https://aws.amazon.com/timestream/pricing/ is incorrect. The example is for monthly costs but the magnetic storage piece appears to mix a GB/month rate of $0.03 with the number of days in a year 30 * 12?Magnetic store would cost: $108. This is computed as ( 10 ** 1GB ** 30 days ** 12 months ) ** $0.03 GB-month = $108Shouldn't this simply be 10 ** 1GB ** $0.03 GB-month = $0.30?Edited by: TedOC on Feb 25, 2020 6:05 AMFollowComment"

Answer: "0Hello TedOC,I think the first month would be:sum j**0.009864, j=1 to 25   == *$3.20Because: 0.009864 = (10 GB/day ** $0.0000411/h ** 24h),  and this adds up for 24 days (starting at day 4...28)But $108 is really strange...GreetingsChristianEdited by: ChristianAchenbachUbix on Feb 26, 2020 7:08 AMCommentShareChristianAchenbachUbixanswered 3 years ago0Hello TedOC,oh, now I see: The retention of the magnetic store is 12 month. After a while you have to pay for the complete 12 month worth of data.So: 10GB every day for the last 12 month = 3600 GB on magnetic disks * 0.03 = $108GreetingsChristianEdited by: ChristianAchenbachUbix on Feb 26, 2020 11:22 PMCommentShareChristianAchenbachUbixanswered 3 years ago0Thanks. That might explain the cost of the final month after having used the system for a year. That doesn't seem to be what the example is trying to explain though.Since Timestream is still not released two years after it was announced I don't know that the pricing really matters at this point.CommentShareTedOCanswered 3 years ago0Is there any update or guidance on ETA? It has indeed been almost two years since Timestream was announced. Back in 2018 it was one of the major reasons to start migration to AWS as we are processing gigabytes of smart parking sensor time-series data.We are using RDS as a placeholder but the overheads are growing as data volumes build up!https://www.nwave.io is waiting for Timrestream!InfluxDB on EC2 is not the best recipe for 2020!CommentShareybirchanswered 3 years ago"


Question: EFS mount failed

"Hi guys,I created an EFS in my VPC. I tried to mount it on ec2 server in same VPC. But I am unable to attach it to instance. If I am using mount via IP it is showing connection timeout whereas NFS port is opened in EC2 server. On the other hand, If I try to mount it via DNS it is unable to resolve DNS whereas DNS settings are enabled for that VPC.Can anyone please help me out.FollowComment"

Answer: "0Hi,Your issue is probably related with a not properly configured Security Group, that does not allow the connection between both systems.Could you check if your EC2 instance security group allows outbound access to the mount target on the NFS, and if the NFS mount target security group allows inbound access from the EC2 security group?Anyway, I recommend that you take a look at the Amazon Elastic File System (EFS) user guide, since it details how troubleshoot most mount issues, including your timeout error, as well as DNS name resolution fails.CommentShareMikel Del Tioanswered 19 days agoRWC 18 days agoIt's also worth mentioning that as well as creating an EFS you also need to create a mount target, usually in the same AZ as your EC2 https://docs.aws.amazon.com/efs/latest/ug/accessing-fs.htmlThis may be what's missing here, if it still doesn't work then the links in Mikel's answer should lead you to a solution.Share"


Question: SSO issue working with Fleet Manager and RDP: SSO is not shared in a org

"I'm trying to follow this posthttps://aws.amazon.com/blogs/security/how-to-enable-secure-seamless-single-sign-on-to-amazon-ec2-windows-instances-with-aws-sso/But I have an error message related with SSO"An error occurred while calling the ListDirectoryAssociations API operation. SSO features are disabled. AccessDeniedException: SSO is not shared in org: xxxxx"I have configured SSO with AzureAD as external provider.Can somebody help me with this issue?RegardsFollowCommentsircompo a year agoHi Hernan. I have the same issue; did you get anywhere with it?For me it works when SSOing into the AWS Organizations management account, but not on an invited account. On the latter, there's no option in Fleet Manager to use SSO as an authentication method, and the errors you mention crop up in the browser network debug log.I'll post here if/when I figure it out 👍Share"

Answer: "0Hello, my suggestion is that you check that "trusted access" for SSO is enabled in the organization, please go to AWS Organizations>Services>Single Sign On and make sure "trusted access" is enabled, if that is enabled, then it may be a permissions issue, in this guide https://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-sso.html you can check the role and it's permissionsCommentShareAlvar Torresanswered a year agoHernan Jarcov a year agoThanks for your answer. Trustes Access was enable and related to permission, it seems the role has the needed ones. But I don't know if the permission should be related with the ec2 role o related with the user role.Share0In the AWS Fleet Manager documentation, it mentions -Fleet Manager supports AWS SSO authenticated RDP connections in the same AWS Region where you enabled AWS SSOI have instances in multiple regions and it wasn't until I re-read the docs that I noticed this colossal limitation and understood why I wasn't getting anywhere. I'm guessing you're in the same boat.The regional limitation of SSO is also mentioned  here.I'm still finding it hard to believe such a fundamental feature isn't supported by AWS SSO 😢CommentSharesircompoanswered a year ago"


Question: SEPA Payment option isn't working after successfully adding and meeting all the requirements.

"Hello, as my card is giving me problems paying ammounts over 3000$ I'm trying to move the payment to a SEPA in my bank.I added the payment method but when trying to pay it says that the payment methond is no elegible.I've checked all the trouble shooting steps provided here: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-debit-emea.htmlmy SEPA payment method is added and valid. But still the payment methond appears to be no elegible. What could be the reason? Is there any way to resolve this..?FollowComment"

Answer: "0Hello Princy,Some banks might require the AWS Company ID to allow the direct debit. If your account is billed by AWS Inc, then use 9049016352. If your account is billed by AWS Europe, then use DE22ZZZ00002144049.If you've already provided your bank with the AWS Company ID, and are still unable to pay with SEPA, open a support case. Visit Contacting AWS Support for instructions on getting Billing help.CommentShareBriNasAWSanswered 14 days ago"


Question: Copying files from AWS Appruner to S3

I am planning to use AWS Apprunner to run my load test using JMeter.The Apprunner service is configured to use my github repo which contains only 2 files(Jmx file and shell script which to downloads jmeter and run the load test)— till this part is working fine. However I am looking for option to copy the test result file into S3 bucket.One option which I could think of is create rest call with API gateway for S3 put and use the curl command within the apprunner container after the test completion.Also I  have set one environment variable while creating Apprunner service - How can I access it in above shell.example:MYTESTNAME = CUSTOMER-VALI tried echo $MYTESTNAME - it prints as $MYTESTNAMEAppreciate if someone can help.FollowComment

Answer: "0Accepted AnswerI was able to figure out the way to run the test and copy the test results to S3 bucket by:Creating role for apprunner with S3 trust relationshipInstalled AWSCLIAfter the test execution, I run the aws s3 cp commandhttps://github.com/myanees284/apprunner-jmeter/blob/main/run_test.shCommentShareaneesanswered 9 months ago"


Question: How do a trigger a reboot action on lightsail cloudwatch alarm state?

I have a lightsail instance that I want to reboot if cloudwatch alarm on it goes off. I don't see in cloudwatch how to restart lightsail instances. Please let me know if someone knows a way to do this.FollowComment

Answer: "0Accepted AnswerHello Hunainkapadia,I understand that you want to trigger a reboot action using CloudWatch alarm on Lightsail. The monitoring that is built in on Amazon Lighsail is only accessible within Lightsail console and are not visible in CloudWatch dashboard by default. If you would like to view Lighsail metrics in CloudWatch and set CloudWatch alarm to trigger an action. You will have to[1]:Create an IAM user with the necessary permissions to submit the CloudWatch metrics data collected from the Lightsail instance.Installing the CloudWatch Agent on your Lightsail.Configuring the CloudWatch Agent to use the IAM user when submitting data to CloudWatchOnce that is done, you can create a CloudWatch Event. Then use that event with a Lambda function to reboot your instance. Below is a sample code you can use to reboot your instance:import boto3region = 'us-west-1'client = boto3.client('lightsail', region_name='region')def lambda_handler(event, context):      client.reboot_instance( instanceId='ID-OF-YOUR-LIGHTSAIL-INSTANCE')For region, replace "us-west-1" with the AWS Region that your instance is in and replace 'ID-OF-YOUR-LIGHTSAIL-INSTANCE' with the ID of the specific instance that you want to reboot.I hope that this information will be helpful.Resources:https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/installing-cloudwatch-agent-ssm.htmlCommentShareCebianswered a year ago0When creating the alarm, you can configure an 'EC2 action' of recover/stop/terminate/reboot. You may want a notification too so that you know it has happened.CommentShareSiTheAWSGuyanswered a year ago0The cloudwatch alarm has been setup automatically when a health check on route53 DNS route fails. This alarm does not allow me call any EC2 Action as it says it's "This action is only available for EC2 Per-Instance Metrics."How do I reboot the instance when a health check fails?CommentSharehunainkapadiaanswered a year ago"


Question: Is a WebSocket client guaranteed to see messages in the order they were POSTed to the @connections API?

"In API Gateway, to push a message to a connected WebSocket client, you're supposed to send a POST request to API Gateway's @connections API.My question is:Will this POST request block until the message has been sent over the network?Or, if it returns sooner than that, is it at least guaranteed to be seen by the client before a subsequent POST?I can't find this guaranteed anywhere in the API Gateway docs, but the usability of AWS API Gateway for WebSocket APIs would seem to hinge on this. If there is no such guarantee, the client could theoretically see messages in a random order.FollowComment"


Question: IAM Policy Cognito Variables for DynamoDB LeadingKeys Restriction

"My setup:Mobile AppCognito User PoolApi GatewayDynamoDBWhat I got working so far:The User can sign up/in with the Cognito User Pool and get an Id and AccessToken.The IdToken is used with the Api Gateway Cognito Authorizer to access the Api Gateway.The Mapping of the user sub into the integration message to DynamoDb works."userId": {    "S": "$context.authorizer.claims.sub"}Restricting the access to non user rows in a DynamoDb Table does not work.The DynamoDb tables were created using Mobile Hubs Protected Table feature, which creates the following policy:            "Condition": {                "ForAllValues:StringEquals": {                    "dynamodb:LeadingKeys": [                        "${cognito-identity.amazonaws.com:sub}"                    ]                }            }But thats not working, because this expression returns the Identity User Id and NOT the User Pool Sub. At first I'm not using Identity Pools and second I want to use the User Sub here.I found out${cognito-idp.<REGION>.amazonaws.com/<POOL-ID>:sub}should do the trick, but thats not working too.If I hardcode the Condition to use the Sub of my test user, everything works as expected, so the Policy itself is okay, it's only the expression to get the sub of the current user is not working correctly.Any Ideas, hints, suggestions?Thanks in advance.Edited by: TheCutter on Jun 27, 2019 11:23 PMBTW: Is there any way to debug a IAM Policy to see what the value of an expression/variable is like?Edited by: TheCutter on Jun 27, 2019 11:25 PMFollowComment"

Answer: "1First, for you to be able to limit access to a leading key in a Dynamo table, you need AWS credentials for a specific end user.  The easiest way is to get credentials for your user pools end user is to integrate your Cognito User Pool with Cognito Identity Pools https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-integrating-user-pools-with-identity-pools.html If you do this, you will be able to use ${cognito-identity.amazonaws.com:sub} in your role policy.  Note that the sub will not be the sub of the user in Cognito User Pools, but the identity id of the identity the end user is associated with in Cognito Identity Pools.However, you are asking about the sub for the Cognito User Pool user. Let us send you a private message to see if we can find an alternative that works. Will post back if we have a general solution.CommentShareAWS-User-2053392answered 4 years agohescul a year agohello, have you found a solution to access the sub attribute of the user in the user pool? I need this variable to update my IoT resource policy.Share0Looks like it's not an easy topic...CommentShareTheCutteranswered 4 years ago0I got the answer now. You are only able to use the${cognito-idp.us-east-1.amazonaws.com/us-east-1_XXXXXXX:sub}variable if you configure the Cognito User Pool as an open ID Connect provider directly against IAM.But there is a big problem, because you need to update the SSL Thumbprint of the service endpoint if the certificate changes in the Open ID Connector configuration. But you are not able to tell when the aws certificate has changed.CommentShareTheCutteranswered 4 years ago0Its been 3 years since this question was asked...do we have a good clean solution for this yet?CommentSharekevlaranswered 9 months ago"


Question: "Security group outbound rules for RDS, ElastiCache, EFS"

"We are using RDS PostgreSQL, ElastiCache Redis and EFS as managed services. For each service we have currently our security group allow any IPv4 outbound connections. We want to restrict this. Do we need to add any specific protocols/ports/destinations so that AWS can maintain the managed services, i.e. for performing updates?FollowComment"

Answer: "1Hello,I don't have the answer for ElastiCache and EFS, however for RDS you don't need to allow any outbound connections by default. All the communication the service itself needs to function is done over a different networking path (a separate internal networking interface not impacted by the security group).RegardsCommentShareAWS-ADolganovanswered a year agoAWS-User-5446251 a year agoThanks for your answer. Since, you mentioned the separate network interface, I hope it's ok to ask an extended question:Does AWS require any specific network ACL inbound/outbound rules to maintain services such as RDS? We would like to adapt the network ACLs to our particular applications running on AWS infrastructure, too. In case we would create a custom network ACL only allowing HTTPS for a specific source/destination IPv4 address, is it still possible that AWS can maintain the managed services? Can AWS then still install updates for RDS or ElastiCache even if the network ACLs do not allow any inbound/outbound connections for that? If not, which protocol, ports and destinations need to be allowed?Share"


Question: Too many messages in flight

"Hi,I have an SQS-consumer (https://github.com/bbc/sqs-consumer) running on an EC2 machine (t2.medium). There is only one instance of this process running at the time. However, when I open my SQS dashboard I see more than 30 messages in flight. It's a FIFO queue, with deduplication based on MessageGroupId. I'm not using any batching the library offers, just simple consumer one message at a time as the library tutorial shows. What am I missing here?The reason for concern is that I'm getting A LOT of timeout errors when processing messages (I'm using Puppeteer to open websites and check for links on them) - and I'm trying to narrow down the cause for this - and overloading the t2 machine network bandwidth might be one of them (I think).FollowComment"

Answer: "0Accepted AnswerIt's possible that the sqs-consumer is not deleting messages from the queue immediately after they are processed. This could be causing the messages to remain "in flight" for longer than necessary and causing the number of messages in flight to accumulate over time.Are you deleting messages after processing?CommentShareNikoanswered 3 months agomikejackowski 3 months agothank you for pointing me in the right direction, in fact due to some other errors I wasn't doing a Promise.resolve for my message handler (which is required by sqs-consumer library to delete the message).ShareNiko 3 months agoGlad you found the root cause!Share"


Question: EC2 issue when starting: cloud-init-nonet gave up waiting for a network dev

"I had an instance running successfully for several years and earlier today it got stuck while running freshclam. I shut the instance down, and changed the instance type to a larger one to be able to update CLAM database faster.Instance ID: i-05c312353d4c47c7bBut when trying to restart it don't work no more. I'm having a network issue, as well as some issues with mounting ebs volumes.The network error:cloud-init-nonet waiting 120 seconds for a network device.  cloud-init-nonet gave up waiting for a network device.  ci-info: ens5  : 0 .               .               12:da:07:9b:5c:57  ci-info: lo    : 1 127.0.0.1       255.0.0.0       .  I checked /etc/network/interfaces and it's set to auto:# The loopback network interface  auto lo  iface lo inet loopback    # The primary network interface  auto eth0  iface eth0 inet dhcp  EBS volume error:The disk drive for /mnt/ebs is not ready yet or not present.  Continue to wait, or Press S to skip mounting or M for manual recovery  I already tried restoring an image from January and it gives me the same error. I also tried starting a new instance based on the current one image without success.Would appreciate some tips and guidance on how to find the root cause. Thanks.Edited by: danielslcosta on Aug 30, 2021 12:16 PMEdited by: danielslcosta on Aug 30, 2021 12:27 PMFollowComment"

Answer: "0The issue was caused by me starting the current root device with a T3 instance, instead of a T2 - I was looking to start with a bigger instance to make the CLAM update faster.After restarting it with a T2 instance, everything worked...CommentSharedanielslcostaanswered 2 years ago"


Question: How do I know why my application is not being deployed?

"Hello everyone,I am using the AWS app runner service to deploy an application coded with Flask. Here is my yaml file "apprunner" :version: 1.0runtime: python3 build:  commands:    build:      - yum -y install git      - pip install -r requirements.txt      - pip install -e git+https://github.com/twintproject/twint.git@origin/master#egg=twintrun:   command: python app.pyI tested the last command locally and my web application worked perfectly. But when I am creating the service and deploying it, I get the following logs :08-18-2022 05:18:45 PM [AppRunner] Failed to deploy your application source code.08-18-2022 05:10:36 PM [Build] Successfully tagged application-image:latest08-18-2022 05:10:36 PM [Build] Successfully built ecfdf95e65ad08-18-2022 05:10:36 PM [Build]  ---> ecfdf95e65ad08-18-2022 05:10:36 PM [Build] Removing intermediate container c58cebc4e5d908-18-2022 05:10:36 PM [Build]  ---> Running in c58cebc4e5d908-18-2022 05:10:36 PM [Build] Step 7/7 : EXPOSE 8080How can I get more informations about what was wrong in my code ?FollowComment"


Question: How am user from Cognito user pool can access a CodeCommit repository?

"Hello,I have created a Cognito user pool with an identity pool, Identity pool has two attached IAM roles auth and unauth, auth has an IAM policy, which gives all Cognito permission as well as all CodeCommit permissions as well. Now when I add a user to the Cognito user pool, how that user can have access to a particular CodeCommit repository? Thanks in advance.FollowComment"

Answer: "1When you create/configure the Code Commit repository, you have the options to setup and use HTTPS/SSH/HTTPS(GRC). The steps to connect to the respiratory are available in the code commit console for the type of connection you want to support.The user would then need the link to the repository and the correctly configured git client to connect to the repository and perform their git commands. The link is available via the console by clicking the "clone URL" in the top right of the repository.But as a side note, giving someone permission to access your code commit repository does not give them access to the console to get the clone URLs. So they would either need the access or you would have to provide them that information through another mechanism.CommentShareJamesMcDuffieanswered 6 months ago"


Question: Automatically reboot EC-2 linux servers of a target-group if OS update requires a reboot

"We're having some Ubuntu instances that are registered targets of Target Groups behind an Elastic Load Balancer.Also, those servers make use of the "unattended-upgrades" package to install security relevant packages. Some of those newly installed packages require the server to be rebooted. Therefore it sends an email to our System Engineers to let them know.So now, in order to reboot those instances they need to be deregistered from their Target Group, rebooted, and registered again with the Target Group. Those Target Groups have redundant targets - so the missing one target is okay for the time it takes to make it become functional again.So now my actual question. Can this easily be automated or is there some light-weighted solution available? If possible I would like to avoid a "full-blown" fleet management software. However, I can see how it can get complicated fast but still thought to ask.My first thought was some sort of AWS-CLI scripting that unregisters the instance from the target-group and registers itself again after the reboot succeeded. If there are enough other targets available to cover for a few minutes. Or maybe have the instance shut down and let an auto-scaling group boot up a new instance. However, that new instance would need to be updated from the base-image first as well then.Any idea where or what to look for?Thanks,MFollowComment"

Answer: "0This could be accomplished with a few AWS services and some scripting.  If your unattended upgrades sends an email to SysAdmins, you could leverage Amazon SES to accept the email and then trigger a Lambda function to deregister the target and reboot the server.   Finally you could use AWS Step Function State Machines to monitor the status of the reboot and then register the target when the server is back up.CommentShareRobert_Fanswered 10 months ago"


Question: Error Creating Aurora DB Clusterr

"We are trying to launch an Aurora DB cluster from a snapshot using CloudFormation template, but getting the following error.Cannot find version 5.7.mysql_aurora.2.10.2 for aurora (Service: AmazonRDS; Status Code: 400; Error Code: InvalidParameterCombination; Request ID: 10a8c2f0-ee79-4b30-be99-1790f66948e5; Proxy: null).We are not passing any value for engine version. Also the version "5.7.mysql_aurora.2.10.2" mentioned in the error message is an available version as per the docs.FollowComment"

Answer: 0Accepted AnswerI understand that you have not used the engine version in your CF Templare. Try adding engine version and engine in your CF Template and see if it works-"engineVersion": "5.7.mysql_aurora.2.10.2""engine": "aurora-mysql"CommentShareD-Raoanswered a year ago


Question: AWS AppRunner Service Deploy failing : Unable to access AWS Secrets Manager SDK

"Hi,While trying to deploy the AWS Apprunner service which is a Spring boot application integrated with AWS Secret Manager, The deployment fails citing the reason :com.amazonaws.SdkClientException: Unable to execute HTTP request: Connect to secretsmanager.eu-west-1.amazonaws.com:443I am using a VPC connector to enable an RDS connection for the application. Any insights on fixing this issuewould be really helpfulFollowCommentHari 3 months agoHi @Aritra,Thanks for reaching out. A few follow up questions:Is the spring boot app trying to read the secrets from AWS Secrets manager using AWS SDK or in this case you are using the native App Runner integration with these Secrets Manager using environment variables?Just looking at the error message this seems to be a transport error which might be intermittent, did you retry creating a new service?Can you share the serviceARN of this service? so we can understand whats going on with this service.Share"


Question: On Premise FileServ - SMB or NFS to S3 using DataSync Not Working.

I am trying to connect SMB or NFS folder but in both I am getting this error.Task failed due to a transient error. Please re-run the task and contact AWS support if the problem persistsand in CloudWatch :[INFO] Execution exec-0000000000 finished with status Ping received for wrong hostId.I installed VM on HyperV.Connectivity to FS and Network both are working. PASSEDThere is no mounting or authentication issue still getting same above error.Please advise.Thank YouFollowComment

Answer: "0Hi Alpha,If this error continues could you file a support case so AWS can gather additional details.https://aws.amazon.com/contact-us/Please provide your AWS DataSync task and execution ID along with any relevant network information from on your on premises data center.Thank you!CommentShareDarryl_Dioanswered 4 months ago"


Question: Should ECS Service Task start be triggered by ASG capacity 0->1?

"TL;DR: If an ECS cluster's ASG scales from 0->1 running instances, should a Service with Task Desired=1 and Running=0 automatically react and start a Task, or does it have to be prodded?I have an ECS EC2-backed cluster with an EC2 Auto Scale Group.  The ASG can be scaled-to-zero, either manually or via some alarm.  When the ASG scales to zero, ECS notices and stops the Task, so Desired=1, Running=0.  All good.If I later scale the ASG to Desired>0 (e.g. Desired=1) and instances start, these appear in ECS, however it does not seem to trigger the ECS Service to attempt to start a Task, now having capacity to do so, and Desired=1, Running=0.Is this expected - does an ECS Service need to be prodded in some way so it notices that it now has capacity to deploy tasks, and if so, what is the best prod to do?Edit: I'm now finding that ECS will start a task, but after some considerable delay after the ASG has reached desired capacity and new instances have started and the ECS agent registered with ECS - >10 minutes on all occasions.  Is this some sort of tuneable polling, or instance-warm-up safety?FollowComment"

Answer: "1Accepted AnswerYou are observing ECS's retry behavior. If ECS cannot start a Task in a Service because there are insufficient resources, ECS will retry scheduling the Task until it is successful (or the desired count is reduced, negating the need to schedule a replacement task).Per AWS best practices, ECS implements an exponential backoff algorithm. The interval between retries grows longer and longer after each scheduling failure. So, if a Task has failed to schedule for some time, you may experience a significant delay after adding new capacity before the Task is rescheduled. 10-15 minutes is the maximum retry interval.If you are intentionally terminating EC2 instances in order to save cost, it is recommended that you also reduce the Desired Count of your ECS services on the cluster so that they all fit. If you use EC2 Auto Scaling Capacity Providers with ECS, ECS will manage the ASG's desired count for you. Alternatively, you can use Fargate, which is serverless; you only pay for Tasks that are actively running.CommentShareEXPERTMichael_Fanswered a year agojavabrett a year agoThanks Michael for this sound advice: 1) Don't leave an ECS Service with a desired count that can't be fulfilled by the ASG (will suffer backoff-retry and slow recovery), and 2) Prefer EC2 Auto Scaling Capacity Providers.I've just done some testing and the Auto Scaling Capacity Provider works nicely when configured correctly.  I wasn't yet on this path because a) starting CloudFormation didn't use it and b) in my specific case it was easier to detect/scale-to-zero the ASG directly than the ECS Service, without custom metrics.Share"


Question: EC2 User data script for node js using NVM

I am new cf template try to install with nodejs using nvm in aws ami .UserData:Fn::Base64: |#!/bin/bashsudo sucd ~yum update -yyum install httpd -yservice httpd startcurl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.34.0/install.sh | bashcat <<EOF >> .bashrcexport NVM_DIR="$HOME/.nvm"[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"  # This loads nvm[ -s "$NVM_DIR/bash_completion" ] && . "$NVM_DIR/bash_completion"EOF. ~/.nvm/nvm.shnvm --versionnvm ls-remotenvm install v12.7.0nvm use v12.7.0nodeVersion=$(node -v)echo "Running Node.js  + $nodeVersion" > test.txtcurl -o- -L https://yarnpkg.com/install.sh | bashexport PATH="$HOME/.yarn/bin:$HOME/.config/yarn/global/node_modules/.bin:$PATH"aws s3 sync s3://reactsearch /var/www/cd /var/www/yarn installyarn run buildFollowComment

Answer: "0Hi, here you go..Note: To allow run the 'aws s3 sync' command from the UserData section, you will also need toCreate an IAM policy to enable reading of objects from the S3 bucketCreate a Role to enable the EC2 instance to access the s3 bucketAdd the Role to the EC2 instance on Launch creation timeSteps on how to do this are available at the following Link: https://optimalbi.com/blog/2016/07/12/aws-tips-and-tricks-moving-files-from-s3-to-ec2-instance/#!/bin/bashyum update -yyum install httpd -yservice httpd startchkconfig httpd oncat > /tmp/subscript.sh << EOF# STARTecho "Setting up NodeJS Environment"curl https://raw.githubusercontent.com/nvm-sh/nvm/v0.34.0/install.sh | bashecho 'export NVM_DIR="/home/ec2-user/.nvm"' >> /home/ec2-usr/.bashrcecho '[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"  # This loads nvm' >> /home/ec2-user/.bashrc# Dot source the files to ensure that variables are available within the current shell. /home/ec2-user/.nvm/nvm.sh. /home/ec2-user/.bashrc# Install NVM, NPM, Node.JS & Gruntnvm alias default v12.7.0nvm install v12.7.0nvm use v12.7.0curl -o- -L https://yarnpkg.com/install.sh | bashexport PATH="$HOME/.yarn/bin:$HOME/.config/yarn/global/node_modules/.bin:$PATH" aws s3 sync s3://reactsearch /var/www/cd /var/www/yarn installyarn run buildEOFchown ec2-user:ec2-user /tmp/subscript.sh && chmod a+x /tmp/subscript.shsleep 1; su - ec2-user -c "/tmp/subscript.sh"Hope that helps.-randyCommentShareRandyTakeshitaanswered 4 years ago0HI rtakeshi, thank you for your reply and this working fine. now but could help me on if i want to write like a step in CNF.configure_cfn: files:            /tmp/subscript.sh:              content: !Sub |                  echo "Setting up NodeJS Environment"                  curl https://raw.githubusercontent.com/nvm-sh/nvm/v0.34.0/install.sh | bash                                    echo 'export NVM_DIR="/home/ec2-user/.nvm"' >> /home/ec2-usr/.bashrc                  echo '[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"  # This loads nvm' >> /home/ec2-user/.bashrc                                    # Dot source the files to ensure that variables are available within the current shell                  . /home/ec2-user/.nvm/nvm.sh                  . /home/ec2-user/.bashrc                                    # Install NVM, NPM, Node.JS & Grunt                  nvm alias default v12.7.0                  nvm install v12.7.0                  nvm use v12.7.0                                    curl -o- -L https://yarnpkg.com/install.sh | bash                  export PATH="$HOME/.yarn/bin:$HOME/.config/yarn/global/node_modules/.bin:$PATH"               mode: "777"              owner: root              group: root        install_node:          commands:            01_config:              cwd: "/tmp/"              test: "test ! -e subscript.sh"                command:  sleep 1; ./subscript.sh HERE THIS SCRIPT IS NOT WORKING.Please can guide where i am doing wrong here.CommentShareRahulWiproDanswered 4 years ago0Hi,This appears to work in my environment:---AWSTemplateFormatVersion: '2010-09-09'Description: 'A simple template intended to be run in N.Virginia (us-east-1) with a Linux (1) distro. Feel free to change the ami so that you can run this in a different Region'Parameters:   KeyName:    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance    Type: AWS::EC2::KeyPair::KeyName    ConstraintDescription: must be the name of an existing EC2 KeyPair.Resources:  SSHSecurityGroup:    Type: AWS::EC2::SecurityGroup    Properties:      GroupDescription: Enable SSH access via port 22      SecurityGroupIngress:      - CidrIp: 0.0.0.0/0        FromPort: 22        IpProtocol: tcp        ToPort: 22      - CidrIp: 0.0.0.0/0        FromPort: 80        IpProtocol: tcp        ToPort: 80  EC2:    Type: AWS::EC2::Instance    Metadata:      AWS::CloudFormation::Init:        config:           commands:            a_download:              command: "wget https://reactsearch-scripts.s3.amazonaws.com/myscript.sh"              cwd: "/home/ec2-user"            b_setup:              command: "chown ec2-user:ec2-user myscript.sh && chmod a+x myscript.sh"              cwd: "/home/ec2-user"            c_run:              command: "su - ec2-user -c /home/ec2-user/myscript.sh"              cwd: "/home/ec2-user"            d_run_sync:              command: "aws s3 sync s3://reactsearch /var/www/"            e_yarn_install:              command: "su - ec2-user -c yarn install"              cwd: "/var/www"            f_yarn_run:              command: "su - ec2-user -c \"yarn run build\""              cwd: "/var/www"    Properties:      ImageId: ami-0b898040803850657      InstanceType: t2.micro      KeyName: !Ref KeyName      SecurityGroups:      - !Ref SSHSecurityGroup      UserData:        Fn::Base64:          !Join [ "", [            "#!/bin/bash -xe\n",            "sudo yum update -y\n",            "sudo yum install httpd -y\n",            "sudo service httpd start\n",            "sudo chkconfig httpd on\n",                        "sudo yum install -y aws-cfn-bootstrap\n", #download aws helper scripts            "sudo /opt/aws/bin/cfn-init -v ", #use cfn-init to install packages in cloudformation init            !Sub "--stack ${AWS::StackName} ",            "--resource EC2 ",            !Sub "--region ${AWS::Region} ",            "\n" ] ]      IamInstanceProfile:        !Ref RootInstanceProfile              RootRole:    Type: AWS::IAM::Role    Properties:      AssumeRolePolicyDocument:        Version: '2012-10-17'        Statement:        - Effect: Allow          Principal:            Service:            - ec2.amazonaws.com          Action:          - sts:AssumeRole      Path: "/"  RolePolicies:    Type: AWS::IAM::Policy    Properties:      PolicyName: root      PolicyDocument:        Version: '2012-10-17'        Statement:        - Effect: Allow          Action:            - "s3:ListAllMyBuckets"            - "s3:GetObjects"            - "s3:ListBucket"          Resource:             - "arn:aws:s3:::reactsearch-scripts"            - "arn:aws:s3:::reactsearch-scripts/*"      Roles:      - !Ref RootRole  RootInstanceProfile:    Type: AWS::IAM::InstanceProfile    Properties:      Path: "/"      Roles:      - !Ref RootRoleI am storing the main myscript.sh script in an s3 bucket called, for example, "reactsearch-scripts"myscript.sh:#!/bin/bashecho "Setting up NodeJS Environment"curl https://raw.githubusercontent.com/nvm-sh/nvm/v0.34.0/install.sh | bashecho 'export NVM_DIR="/home/ec2-user/.nvm"' >> /home/ec2-user/.bashrcecho '[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"  # This loads nvm' >> /home/ec2-user/.bashrc# Dot source the files to ensure that variables are available within the current shell. /home/ec2-user/.nvm/nvm.sh. /home/ec2-user/.bashrc# Install NVM, NPM, Node.JS & Gruntnvm alias default v12.7.0nvm install v12.7.0nvm use v12.7.0curl -o- -L https://yarnpkg.com/install.sh | bashexport PATH="$HOME/.yarn/bin:$HOME/.config/yarn/global/node_modules/.bin:$PATH"Hope this helps...-randyCommentShareRandyTakeshitaanswered 4 years ago"


Question: Health Lake issues

My health lake is gone. Just disappeared.FollowComment

Answer: "0You could be in the wrong region on the AWS console. Confirm that the region you are in is the same region where your Health Lake is supposed to be.CommentShareCebianswered a year ago0All I have to say is Duda!!! It was in the wrong region. ThanksBut there don't seem to be a lot of support for Health Lake, I'm reading all the documents. But trying to export to s3, can't seems to make it work. My region is globe Health Lake  and my s3 in a different region. working really hard on the IAM. Can't anyone help.CommentSharerePost-User-4063195answered a year ago0Amazon Healthlake is available in the U.S. East (N. Virginia), U.S. West (Oregon), and U.S. East (Ohio) regions. Make sure you are in the right region where your HealthLake was created. We have answered the question on how to query HealthLake data and export data into S3 in 'AWS Supports You'  Episode [https://www.youtube.com/watch?v=-nfDpE3Rr3Y?t=14m26s]CommentShareLaksanswered 7 months ago"


Question: IoT TwinMaker and Grafana integration where component has multiple list properties

"Hello!I'm currently trying to create a dashboard where one component of an entity has multiple property definitions of the list type.My property definitions and lambda function seem to be operating as intended. Using the "Test" functionality in the AWS IoT TwinMaker console shows me the following:{  "assetId": {    "propertyReference": {      "componentName": "master_task_list",      "entityId": "AllTasks",      "propertyName": "assetId"    },    "propertyValue": {      "stringValue": "master_task_list"    }  },  "assetType": {    "propertyReference": {      "componentName": "master_task_list",      "entityId": "AllTasks",      "propertyName": "assetType"    },    "propertyValue": {      "stringValue": "task_list"    }  },  "robotIdList": {    "propertyReference": {      "componentName": "master_task_list",      "externalIdProperty": {},      "entityId": "AllTasks",      "propertyName": "robotIdList"    },    "propertyValue": {      "listValue": [        {          "stringValue": "3e2b4d1d-a86f-4f7b-a436-46e7653f7fef"        }      ]    }  },  "siteArn": {    "propertyReference": {      "componentName": "master_task_list",      "entityId": "AllTasks",      "propertyName": "siteArn"    },    "propertyValue": {      "stringValue": "arn:aws:iotroborunner:us-east-1:<accountId>:site/<siteId>"    }  },  "stateList": {    "propertyReference": {      "componentName": "master_task_list",      "externalIdProperty": {},      "entityId": "AllTasks",      "propertyName": "stateList"    },    "propertyValue": {      "listValue": [        {          "stringValue": "ACTIVE"        }      ]    }  },  "taskIdList": {    "propertyReference": {      "componentName": "master_task_list",      "externalIdProperty": {},      "entityId": "AllTasks",      "propertyName": "taskIdList"    },    "propertyValue": {      "listValue": [        {          "stringValue": "0ed00afe-c55f-4311-9468-4dca01b1625d"        }      ]    }  },  "waypointsList": {    "propertyReference": {      "componentName": "master_task_list",      "externalIdProperty": {},      "entityId": "AllTasks",      "propertyName": "waypointsList"    },    "propertyValue": {      "listValue": [        {          "stringValue": "[(0, 0, 5), (40.529312, -74.626496, 5), (40.52904, -74.6267648, 5), (40.529152, -74.6268927, 5), (40.5291568, -74.6268862, 0)]"        }      ]    }  }}Which tells me all the values are being reported correctly as their respective types.However, when issuing a request from Grafana using the IoT TwinMaker data source, the query inspector asks for multiple properties, but only one comes backThe query:{  "queries": [    {      "componentName": "master_task_list",      "entityId": "AllTasks",      "properties": [        "waypointsList",        "taskIdList",        "robotIdList",        "stateList"      ],      "queryType": "GetPropertyValue",      "refId": "A",      "componentTypeId": "com.defuzzy.task_list",      "datasource": "AWS IoT TwinMaker",      "datasourceId": 3,      "intervalMs": 10000,      "maxDataPoints": 2738    }  ],  "range": {    "from": "2022-04-26T22:54:24.962Z",    "to": "2022-04-27T04:54:24.962Z",    "raw": {      "from": "now-6h",      "to": "now"    }  },  "from": "1651013664962",  "to": "1651035264962"}The response{  "results": {    "A": {      "frames": [        {          "schema": {            "name": "waypointsList",            "refId": "A",            "meta": {              "custom": {}            },            "fields": [              {                "name": "Value",                "type": "string",                "typeInfo": {                  "frame": "string",                  "nullable": true                }              }            ]          },          "data": {            "values": [              [                "[(0, 0, 5), (40.529312, -74.626496, 5), (40.52904, -74.6267648, 5), (40.529152, -74.6268927, 5), (40.5291568, -74.6268862, 0)]"              ]            ]          }        }      ]    }  }}Even if I only ask for one (different) property, I still only get one property back (waypointsList in this case).Am I doing something wrong? This feels a little broken. Any help would be appreciated!FollowComment"

Answer: "0Thank you for reaching out!I've confirmed this bug and submitted an issue in our plugin's github repo: https://github.com/grafana/grafana-iot-twinmaker-app/issues/42Will follow up with Grafana to make the fix.CommentShareHarry Wandersmananswered a year agorobotHamster a year agoAwesome, thank you!Share"


Question: Oversize handling WAF

"I got an email from AWS to configure WAF for oversize before October 1,2022. I want to inspect first 8 KB and ignore remaining bytes of body.While looking documentation, I found there are 3 options- Continue, Match and NO Match.Is 'Continue' option right to inspect first 8 KB only?I don't understand clearly the 'Continue ' option.FollowComment"

Answer: "0Accepted AnswerYes, you are correct - "Continute" inspects content up to the inspection size limit, and ignore the rest. See here: https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-oversize-handling.htmlCommentShareTzoori Tamamanswered 10 months ago"


Question: RDS increase max connections for MySQL 5.6.10

"I have a RDS medium.The command: select @@max_connections shows 90The free memory:803772 freerds endpoint: gym.cluster-coh9kf7kotgs.us-east-1.rds.amazonaws.comAccording to other responses to similar questions, the default for this server should be around:296I need to increase max connections, but the configuration is kinda clumsy.How should i proceed to increase max conn?Can you help me to configure?ThanksFollowComment"

Answer: "0You can increase max_connections by specifying a new value in the DB Parameter Group.  Instructions are at http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithParamGroups.html, and for simplicity ignore the CLI and API examples and just stick with the AWS Management Console.Theses are discussion forums, and 1-on-1 technical support here is intermittent at best.  When I look at the AWS Support comparison page at https://aws.amazon.com/premiumsupport/compare-plans/ it shows that Basic Support does NOT include Technical Support.  A suggestion I would make is that if you need individualized technical support then you should sign up for Developer Support.  It starts at $29/month, which is less than I've had other vendors charge for per-incident support.  So you could sign up for Developer Support, open up a case, then (if you want to) cancel support before the start of the following month to avoid additional charges.  https://aws.amazon.com/premiumsupport/developer-support/CommentShareHalTempanswered 6 years ago"


Question: Problems with AWS Support

"We have been using AWS for a year now, have received credits as a startup and everything has been great until now. The AWS org is set up as different accounts under the root/payer account. For one of the new accounts that we are setting up as a test environment, we needed to set up SNS to configure SenderId, and ContentTemplate and raise the SMS limit. The request was rejected by AWS Support for the following reason,"Due to some limiting factors on your account at this time, you are not eligible to send SMS messages in Asia Pacific (Mumbai) region. You will need to show a pattern of use of other AWS services and a consistent paid billing history to gain access to this function.We enforce these limitations on all new accounts. Your continued usage of other AWS services will give us greater flexibility to increase your spending limits in the future.Please open a new case after you have a successful billing cycle and additional use of other AWS services and we will gladly review your account."Since we are using >10 services for a year now under different accounts, I do not understand why AWS will block us? There have not been any missed payments and there is ample credit in the account to pay. We are in internal testing and only send SMS to developers and testers.I want to know if anyone has faced a similar situation.FollowComment"

Answer: "0Hello,I apologize for the trouble, Sabyasachi. Our Accounts team is best tooled to assist with these matters. I recommend creating a case with them to take a closer look into this. Here's where you can create your case:http://go.aws/support-centerIn the meantime, I suggest reading through these resources for a possible solution:https://aws.amazon.com/premiumsupport/knowledge-center/sns-sms-spending-limit-increase/&https://docs.aws.amazon.com/sns/latest/dg/channels-sms-originating-identities-sender-ids.htmlIf these aren't quite what you're looking for, you're welcome to look into these additional help options for further assistance:http://go.aws/get-helpSincerely,— Thomas E.CommentShareEXPERTAWS Support - Thomasanswered 8 months agoSabyasachi Bose 8 months agoI reached out to accounts for escalation. To summarise I was told to follow up on the same thread.Here is their response,"I'm suggesting you take the path to direct access to escalate this. If you disagree with me and insist that I attempt to escalate this from a position of limited influence and zero scope, I will do it, because you are my customer right now, but that's not the best move."At the moment AWS Support closes the ticket every day with the same message as the original post and I re-open it asking for a reason and requesting to update SenderID and Template.Didn't expect this from AWS!Share0Hi Sabyasachi,Sorry to hear about the trouble you've communicated in your follow up comment. This isn't the experience we aim for. I can understand your urgency for getting this matter resolved, which is why I've taken steps internally to relay the priority and feedback you've shared with us.After locating your support case, I can confirm it's queued with the best suited team and your request is actively being reviewed. Please note, a recent update on your request was communicated on the case yesterday. For any additional questions or concerns, our internal team handling your case has the visibility to directly assist. To reach secure guidance, please continue to follow up your case correspondence:https://go.aws/support-center.Thank you for your patience as our internal team continues to investigate.Kind regards,- John M.CommentShareEXPERTAWS Support - Johnanswered 8 months ago"


Question: MWAA 2.4.3 - can't install `mysqlclient==2.1.1` due to missing OS dependencies

"I'm trying to upgrade my Airflow MWAA Cluster to 2.4.3, but there's a crucial dependency for MySQL access that can't be installed due to missing OS dependencies.Here is my requirements.txt:--constraint "https://raw.githubusercontent.com/apache/airflow/constraints-2.2.2/constraints-3.7.txt"cryptoplyvelapache-airflow-providers-amazonapache-airflow-providers-common-sqlapache-airflow-providers-cncf-kubernetessnowflake-connector-pythonsnowflake-sqlalchemyapache-airflow-providers-snowflakemysql-connector-pythonapache-airflow-providers-slackcroniterapache-airflow-providers-mysqlAnd these are the logs I'm getting from Cloudwatch when I try to install those dependencies:2023-02-09T14:37:06.229-05:00Collecting mysqlclient>=1.3.62023-02-09T14:37:06.244-05:00Downloading mysqlclient-2.1.1.tar.gz (88 kB)2023-02-09T14:37:06.260-05:00━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 88.1/88.1 kB 15.0 MB/s eta 0:00:002023-02-09T14:37:06.279-05:00Preparing metadata (setup.py): started2023-02-09T14:37:06.294-05:00Preparing metadata (setup.py): finished with status 'error'2023-02-09T14:37:06.309-05:00error: subprocess-exited-with-error2023-02-09T14:37:06.345-05:002023-02-09T14:37:06.361-05:00× python setup.py egg_info did not run successfully.2023-02-09T14:37:06.375-05:00│ exit code: 12023-02-09T14:37:06.391-05:00╰─> [16 lines of output]2023-02-09T14:37:06.405-05:00mysql_config --version2023-02-09T14:37:06.419-05:00/bin/sh: mysql_config: command not found2023-02-09T14:37:06.487-05:00mariadb_config --version2023-02-09T14:37:06.527-05:00/bin/sh: mariadb_config: command not found2023-02-09T14:37:06.542-05:00mysql_config --libs2023-02-09T14:37:06.556-05:00/bin/sh: mysql_config: command not found2023-02-09T14:37:06.575-05:00Traceback (most recent call last):2023-02-09T14:37:06.589-05:00File "<string>", line 2, in <module>2023-02-09T14:37:06.655-05:00File "<pip-setuptools-caller>", line 34, in <module>2023-02-09T14:37:06.670-05:00File "/tmp/pip-install-0q1pd5qd/mysqlclient_fcbf326f5008433ba2f5254795ee81da/setup.py", line 15, in <module>2023-02-09T14:37:06.687-05:00metadata, options = get_config()2023-02-09T14:37:06.705-05:00File "/tmp/pip-install-0q1pd5qd/mysqlclient_fcbf326f5008433ba2f5254795ee81da/setup_posix.py", line 70, in get_config2023-02-09T14:37:06.722-05:00libs = mysql_config("libs")2023-02-09T14:37:06.745-05:00File "/tmp/pip-install-0q1pd5qd/mysqlclient_fcbf326f5008433ba2f5254795ee81da/setup_posix.py", line 31, in mysql_config2023-02-09T14:37:06.761-05:00raise OSError("{} not found".format(_mysql_config_path))2023-02-09T14:37:06.773-05:00OSError: mysql_config not found2023-02-09T14:37:06.790-05:00[end of output]2023-02-09T14:37:06.808-05:002023-02-09T14:37:06.824-05:00note: This error originates from a subprocess, and is likely not a problem with pip.2023-02-09T14:37:06.842-05:00error: metadata-generation-failed2023-02-09T14:37:06.859-05:002023-02-09T14:37:06.872-05:00× Encountered error while generating package metadata.2023-02-09T14:37:06.904-05:00╰─> See above for output.2023-02-09T14:37:06.917-05:002023-02-09T14:37:06.932-05:00note: This is an issue with the package mentioned above, not pip.2023-02-09T14:37:06.949-05:00hint: See above for details.2023-02-09T14:37:06.963-05:002023-02-09T14:37:06.990-05:00[notice] A new release of pip available: 22.3.1 -> 23.02023-02-09T14:37:07.009-05:00[notice] To update, run: pip install --upgrade piThe PyPi description of the package talks about OS dependencies that must be present for this package to be installed - https://pypi.org/project/mysqlclient/ .It's important to note that I don't currently have any issues installing this package tree with MWAA 2.2.2.Given MySQL is such an essential piece of our tech stack, this makes us unable to upgrade airflow to the latest version. But why was that OS dependency removed? Why there's no mention of it anywhere in the docs? Am I doing something wrong? How can I fix this?Any help is appreciated.FollowCommentClaudio Reggiani 4 months agoHi, we are experiencing the same error while deployment Airflow 2.4.3 having apache-airflow-providers-mysql[amazon] as requirement. Thanks for providing a solutionShare"

Answer: "0Hi,I see that you are receiving the following error while installing "apache-airflow-providers-mysql" package during upgrading your Airflow MWAA Cluster to 2.4.3 version.× python setup.py  egg_info did not run successfully.  │ exit code: 1  ╰─> [16 lines of output]      mysql_config --version      /bin/sh: mysql_config: command not found      mariadb_config --version      /bin/sh: mariadb_config: command not found      mysql_config --libs      /bin/sh: mysql_config: command not found      Traceback (most recent call last):        File "<string>", line 2, in <module>        ......        not found".format(_mysql_config_path))      OSError: mysql_config not foundFix for installing apache-airflow-provider-mysql in MWAA environment 2.4.3 is now deployed to all regions. Please update your MWAA environments so the web server, schedulers, and workers can restart with the fix.On the console you need to click 'Edit' for your MWAA environment then click 'Next' on the 'Specify details' and 'Configure advanced settings' pages, then 'Save' on the 'Review and save' page, then the environment will update. Or the you can use the update-environment mwaa cli command for your environment and not use any additional options for the command.I had tested the same recently while deploying a MWAA cluster with 2.4.3 version in us-west-2 region which deployed successfully along with the mysql provider package. I was able to install below requirement file on MWAA without any issue.requirements.txt=============--constraint "https://raw.githubusercontent.com/apache/airflow/constraints-2.4.3/constraints-3.10.txt "apache-airflow[amazon,docker,mysql]==2.4.3pendulum==2.1.2pydantic==1.10.4pyaml==21.10.1mysql-connector-python==8.0.31sqlparse==0.4.3deepmerge==1.1.0Thank you.CommentShareSUPPORT ENGINEERNirmal_Canswered 3 months agorePost-User-9382422 3 months agoHi Nimral, should this requirement text allow for the MySQL connection type to appear in the UI in connections? This thread from a couple years ago (https://lists.apache.org/thread/p7lljxdgsvpc4tg13nk7f367617brt1f) makes is seem like the webserver does not get updated?Share"


Question: ACM was unable to renew the certificate automatically using DNS validation. Next step verification.

"Problem:AWS Certificate Manager (ACM) was unable to renew the certificate automatically using DNS validation.Site has been running for one year.Fix:To renew this certificate, you must ensure that the proper CNAME records are present in your DNS configuration for each domain.My setup:Purchased domain name through GoDaddyGoDaddy pointing at AWS NSStatic HTML files hosted in web-enabled S3Using AWS CloudfrontsUsing Route52 for hosted ZoneUsing AWS certificate manager for certsI found the required CNAME name/value for each of the domains in ACM.I can see the Renewal Status is set to ‘Pending validation’ for each.Hosted Zone currently includes; A, NS, SOA, records but no CNAME records.Questions:Is my next step to add these CNAME name/value records to the ‘Records’ section of the Hosted Zone?Are there any changes I should make to the name/value strings, like removing period postfix?Is there anything else I will need to do?Thank you for any assistance.FollowComment"

Answer: "0Accepted AnswerThese troubleshooting step should resolve your issue: https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-DNS-validation.html#troubleshooting-DNS-GoDaddyCommentShareSeanManswered a year agowall-x a year agoThank you SeanM.So instead of adding records manually I can just use the 'Create records in Route53' button.Will there be anything else to do ... besides test after some period?The test would be to check on Renewal Status, then also confirm site's cert on the day it was due to expire I assume.Thanks again.Share"


Question: Upload of a new application version in Elastic Beanstalk does not work

"Hello AWS community,uploading new application versions to Elastic Beanstalk no longer works for me.As far as I know, there are two ways to do this:This option has never worked for us. On the next screen, there is only a deploy button and no matter how often we click it or how long we wait, the new application version is never uploaded and deployed - very frustrating.However, that is why we have used the second way so far: to upload a new application version first and then deploy it in the next step.So far it has worked like this. However, when I deleted all versions, all action buttons at the top suddenly became greyed out. Especially the upload button. At first, we thought there was a hidden limit for uploads per day, but after 24 hours the button is still greyed out and we still can't upload the new application version.We need help urgently because we really need to upload a new version. Thank you very much in advance for your help!Best regards,BenediktFollowCommentBenedikt Lueth a month agoUpdate: In the meantime, we have set up a new environment and make sure that we do not delete all versions before uploading a new one. We are now sure that it must be a bug. By the way, here is the corresponding Stack Overflow post, in case there are quicker solutions there than here: https://stackoverflow.com/questions/76126585/upload-of-a-new-application-version-in-elastic-beanstalk-does-not-workShare"

Answer: "1Hey there BenediktHave you tried to use the AWS CLI or API? you can use these to also gain access to beanstalkAlso, check if you have the valid permissons enabled for you to access beanstalk and also check the file size to see if its too large (max size is 2gb i believe)Maybe clear cache/cookies, or try a different browser?If the problem still persists, i would recommend reaching out to AWS supportCommentShareAWS_Guyanswered a month agoBenedikt Lueth a month agoHi,Thank you very much for your quick reply!I have already tried it in Chrome and Safari and in incognito mode. So it shouldn't be the browser or the cookies.The permissions shouldn't be a problem either, because we haven't changed anything. As I said, I have already deleted the last versions several times and added and deployed new ones. Only at the moment, I deleted them all, the upload button was greyed out - in my opinion, a bug.I have also read about the AWS CLI or API, but we are complete beginners in the cloud and would like to stay in the graphical interface.I can also exclude the file size, we are far below that.Apart from that, I don't know how to reach AWS support for free. In my opinion, this is a bug, but I can only report/discuss technical problems if I take out a support subscription.Many thanks and best regards,BenediktShare"


Question: Invited Workdocs user can't sign in when user identity already exists

"we have a situation where when we invite a new customer to join a folder as a viewer, it is occasionally unsuccessful. This appears to be the case when the email address being used is one they have previously associated with another AWS service/account. In the user admin console, the full name of the user appears (i.e. as if there registration details had been accepted) but the status remains pending. When the user attempts to complete and submit their password, they get an error message : Server Error - There was an error with your request. Please try again later. Retrying later does not help.FollowComment"

Answer: "0Hello! Is your issue with an internal user (meaning, it's part of the Directory Services) or external (invited to an external email address that doesn't belong to the WorkDocs directory?If it's internal, you can try removing the pending invitation from the Admin panel and try inviting the user again. If it's external, you should see a new user account created in Active Directory with the email address of the user as the username. You can try to manually set a password in the account and see if the user can login.If none of the above works, please open a new support case and provide a HAR log [1] from the web browser while reproducing the issue and we will be able to assist further. Have a great day![1] https://aws.amazon.com/premiumsupport/knowledge-center/support-case-browser-har-file/CommentShareSUPPORT ENGINEERFrancisco_Lanswered 10 months ago"


Question: Where to copy OTA binary - internal or external flash of TI CC3220SF

"For AWS OTA project (aws_demo) using TI CC3220SF, downloaded from below link:https://docs.aws.amazon.com/freertos/latest/userguide/download-ota-ti.htmlWhere is OTA binary copied, to external or internal flash of CC3220SF? Did see most references using external flash. Need guide to part of code where FW OTA is fetched and copied to flash.Didn’t find separate bootloader project. Wanted to know which bootloader used and usage guide.We wanted to know the availability of source code materials for the above tasks.FollowComment"

Answer: "0I've not had experience with this part, or the TI software ecosystem, but this document explains the OTA process for this part and how the FreeRTOS and TI softwares cooperate: https://www.ti.com/lit/wp/sway021/sway021.pdfThe bootloader comes from TI. It seems the OTA image is stored in the secure file system (external flash). With ports to FreeRTOS you will usually find an OTA PAL that binds the OTA agent to the device. In the case of this part, it's here: https://github.com/aws/amazon-freertos/tree/main/vendors/ti/boards/cc3220_launchpad/ports/ota_pal_for_awsIn there, you will see it wraps the SimpleLink FileSystem API: https://software-dl.ti.com/ecs/SIMPLELINK_CC3220_SDK/2_10_00_04/exports/docs/wifi_host_driver_api/html/group___file_system.htmlCommentShareEXPERTGreg_Banswered a year ago"


Question: Alias values are getting null in appsync subscriptions

"What is the reason for getting null in subscription response, getting proper value in mutation responsesubscription MySubscription {  updateFieldResponseSubscription(id: 1){    __typename    ... on TaskFieldResponse {      id      fieldId      field {        response {          ... on GQLStringType {            stringVal: value            __typename          }          __typename        }        __typename      }      __typename    }  }}Here I am getting null for the stringValMy Mutation ismutation MyMutation($inputArguments: UpdateFieldResponseArgs!) {  updateFieldResponse(inputArguments: $inputArguments){    __typename    ... on TaskFieldResponse {      id      fieldId      field {        response {          ... on GQLStringType {            stringVal: value            __typename          }          __typename        }        __typename      }      __typename    }  }}FollowComment"


Question: Does AWS Has InspectorV2 CLI commands

"In AWS CLI we have Commands for INSPECTOR (which works for Inspector Classic), But Not able to find commands for INSPECTOR v2, Can any please help sharing any available infoFollowComment"

Answer: 0Accepted Answerhttps://awscli.amazonaws.com/v2/documentation/api/latest/reference/inspector2/index.htmlRemember to update the CLI to pull in new services & features.CommentShareEXPERTkentradanswered a year agoRGADA a year agoCLI update worked Thank youShare


Question: Cognito TOTP MFA issue

"Hello,I am trying to integrate AWS Cognito to my Java application and I am facing some issues with TOTP MFA. More specific:AWS Java SDK version1.11.755Cognito configuration1. Users sign in using email address2. Sign up is only allowed by administrators3. MFA is optional and only TOTP is supported4. An application client is created without secret, which only supports ALLOW_ADMIN_USER_PASSWORD_AUTH authentication flowProcess1. I create a user using the adminCreateUser function2. I try to login using the adminInitiateAuth function. The first time I login when MFA is not yet enabled, I get the relevant tokens successfully, without having to respond to an authentication challenge (i.e.  SOFTWARE_TOKEN_MFA )3. I enable the MFA to the created user using the adminSetUserMFAPreference function. I set the software token MFA as preferred and as enabled. Also, I execute the associateSoftwareToken function to get a secret, in order to use it in the authenticator application.4. I try to login using the adminInitiateAuth function expecting that I will receive in the response the SOFTWARE_TOKEN_MFA challenge, but this does not happen. I get the relevant tokens and no challenge (like MFA is disabled). I verify at the user information that the MFA is correctly set.I do exactly the same process using SMS as MFA method and the behavior is the expected one. In step 4 (i.e. sign in after MFA was enabled), I get the SMS_MFA challenge.Can you please elaborate why is this happening? Is something wrong in the process I am following?I tried also to use the ALLOW_USER_PASSWORD_AUTH authentication flow (via initiateAuth function), for the login of the user but the result was the same.FollowComment"

Answer: "0Hello,I leave this comment in case someone faces the same issue in the future. In order to have the TOTP MFA method to work, you have to do an extra step (apart the ones I described). More specific, after you have called the associateSoftwareToken to get a key and added it in your authenticator application, you must verify one TOTP code. So, in your application you should call the VerifySoftwareToken function with a valid accessToken and a valid TOTP code. If everything is successful, the next time you try to login (in my case using adminInitiateAuth ), you get the SOFTWARE_TOKEN_MFA challenge.Best Regards,KonstantinosEdited by: ktzevelekidis on May 6, 2020 4:21 AMCommentSharektzevelekidisanswered 3 years ago0In your case is it working for all logins? I have a problem where the TOTP challenge is only sent on the first login after activation, did you find anything about it?CommentShareEricLau1answered 3 years ago0Hello,No, in my case it works as expected. Each time I try to login, it asks for the SOFTWARE_TOKEN_MFA challenge. In case it helps, I am using the adminInitiateAuth function for the login process.Best Regards,KonstantinosCommentSharektzevelekidisanswered 3 years ago"


Question: Nowhere to unlock EIP from account

"AWS Support, can you please unlock EIP 54.194.161.48. I cannot see where to do this:54.194.161.48: The address with allocation id [eipalloc-9f2823fd] cannot be released because it is locked to your account. Please contact AWS Support to unlock it.FollowComment"

Answer: "0EIP still had rDNS rec. The A rec needed to be deleted, then the release worked. The error message you get does not mention this; just tells you to contact support, which you cannot do on Basic other than Account or Billing queries.CommentSharechrispatrobanswered 4 years ago"


Question: HITs - MTurk Workers Upload Problem with AWS

"Hello,I tried to do everything in this tutorial:https://blog.mturk.com/tutorial-how-to-create-hits-that-ask-workers-to-upload-files-using-amazon-cognito-and-amazon-s3-38acb1108633But in the end, when the MTurk workers try to upload their work, they get this message: "Failed to upload. Please contact the Requester."I don't know what is the problem. Please help.FollowComment"


Question: Slow LightSail instance when opening Excel

LightSail instance gets very slow when opening or closing Excel; also when executing formulas.You cannot open any other application for several minutes.You have office 365FollowComment

Answer: "0Hi,I don't know if you were able to finish your question here, but I would assume that you are running an Windows Lightsail instance that is too small for what you are trying to do. I would not go any lower than the $12/month version of Windows Lightsail, and would be more inclined to go even bigger. Excel likes RAM (memory), if it's taking a long time my guess is there is not enough memory and to try a bigger instance type.CommentShareBrian Grafanswered 9 months agorePost-User-PCI 9 months agoHi, thanks you answer.My plan is $12016 GB4 vCPUS320 GB SSD6 TBI don't understand why it's slow.Share0Interesting. Have you looked at your task manager/process manager to see if something is consuming a lot of CPU? 16GB is plenty. If you click on your instance you can go to your monitoring metrics. Take a look through each of the different ones (CPU Utilization and others) feel free to screenshot and post hereCommentShareBrian Grafanswered 9 months agorePost-User-PCI 9 months agoI solved it by creating a new instance from scratch.Now everything works perfect.The metrics did not give much information.Thanks for your interest.Excuse my english.Share"


Question: Amazon WorkDocs client deprecation notification message

"Some of my users are getting the following message on the Workspaces. They are using the current WorkDocs Drive client and not the Sync client that is being deprecated. Does anyone know what might trigger this message? Some of these workspaces are a brand new image that never used the WorkDoc Sync but some were migrated from an older image that did use the older WorkDoc Sync client. We began getting reports from users yesterday, but are not seeing the issue on our internal test workspaces.FollowComment"

Answer: "0Hello,Thank you for reaching out on RePost!I understand that the error is specific to your Amazon Workspaces and the upgrade notification appears despite the WorkDocs client being installed at the latest version(as opposed to WorkDocs Sync client which is set to deprecate on October 15 2022). This could be a result of residual registry keys or directories/files from a previous installation of the WorkDocs Sync application.In order for us to troubleshoot further, we will need to perform a review of the installed applications and related registry keys on impacted Workpaces. For this, please feel free to open a support case with AWS using this linkThis will help us request the correct set of logs and review your Workspaces to diagnose the issue better.CommentShareSUPPORT ENGINEERRicha_Banswered 9 months ago"


Question: IAM Authentication to RDS Aurora Serverless PostgreSQL Proxy (Non-Public)

"I have a non-public DB Cluster & a Proxy (Aurora RDS PostgreSQL Serverless v2 13.7). It's in a VPC with private subnets. The Security Group is same for both Cluster and Proxy. Inbound rule allows TCP for Self Referenced Security Group on 5432 port. Outbound rule allows all traffic (0.0.0.0/0).I have a Lambda function (Python) in the same VPC, subnets and Security Group. I have also created an IAM user and attached a Policy for rds-db:connect. Likewise, I have a similar policy attached to the Lambda also for rds-db:connect. I manually created this IAM user into PG database, but without password and attached rds_iam role.However, I tried various ways to authenticate with the Proxy using IAM, but nothing seems to be working. I would really appreciate, if someone can please provide the code sample for this in Python. I am not even sure which certificate to use. Please help.FollowComment"

Answer: "0From your query, I could understand that you wanted to authenticate RDS Aurora Serverless Postgresql proxy using IAM_Authentication. I would like to inform that currently Aurora Serverless (Both MySQL and PostgreSQL) does not support IAM DB authentication, this is also listed in the public facing documentation linked below:[+] Using Amazon Aurora Serverless - Limitations of Aurora Serverless - https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.html#aurora-serverless.limitationsThat being said, there is an existing feature request for incorporating the "IAM DB Authentication" for Aurora Serverless clusters. I have added your concern to justify the feature request indicating your interest in the availability of this feature. Meanwhile, I request you to keep an eye on our What's New[1] and Blog pages[2] for any new feature announcements.References:[1] https://aws.amazon.com/new/[2] https://aws.amazon.com/blogs/aws/CommentShareVaraha Sai_Aanswered 8 months agorePost-User-4110171 8 months agoI am using serverless v2 and not v1.Share"


Question: "Importing existing resources change set fails with Index: 1, Size: 1"

"There was an error creating this change setIndex: 1, Size: 1I get this ver unfriendly error message. Any ideas?I am trying to import a manually created eks node group into cloud formation.I got the template from former2FollowComment"

Answer: "0What does your template look like?  What are you importing?  Are you importing resources creating a new Stack or updating an existing one?  If the latter, are you avoiding any template changes not strictly related to the import, as this will make the import fail?CommentShareEXPERTskinsmananswered 4 months agorePost-User-6881997 4 months agothanks for the answer. I was updating  my post as you were typing  :) . I think the template which i got from former2 might be bad. I will try to create the template manually. This is a very tedious process !!Share0One thing I've learnt from importing resources is to start small.  Start with a template that defines just one or two resources to import and get that working, then modify your template to progressively add more with Stack updates.  Otherwise all the retries are very tedious!CommentShareEXPERTskinsmananswered 4 months ago"


Question: My MX record is not showing when I do a dig command

"Hello,I am trying to activate gmail for business for my domain hosted on Route 53. I have included all MX records as described but NX records are not showing on dig and google can not verify.Domain name is novotthon.com.I will appreciate your help.Thanks,MehmetFollowComment"

Answer: "0Hi Mehmet,I have performed a DNS lookup ( dig novotthon.com MX) for MX record for your domain and it does not return an answer. This means that the MX record is missing in Route 53 hosted zone.Please create the MX record record (steps below) and perform similar lookup to confirm.Sign in to the AWS Management Console and open Route 53 console at https://console.aws.amazon.com/route53/.In the navigation pane, choose Hosted zones.In the Records section, click Create record.Leave Routing policy as Simple routing.Leave Record name blank.Leave Alias off (slider to the left).For Record type select MXIn the TTL (seconds) field, leave the default value.In the Value field, enter the values/mailserver  provided by google.You can also refer to google article for the same. https://support.google.com/a/answer/6149697?hl=en#zippy=%2Cstep-go-to-your-dns-records%2Csep-delete-existing-mx-records%2Cstep-add-the-new-mx-records%2Cstep-tell-google-to-find-your-new-mx-records$ dig novotthon.com MX; <<>> DiG 9.11.18 <<>> novotthon.com MX;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11669;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 4096;; QUESTION SECTION:;novotthon.com.INMX;; AUTHORITY SECTION:novotthon.com.300INSOAns-1162.awsdns-17.org. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400Regards,PeterEdited by: PeterN-AWS on Mar 23, 2021 10:34 PMCommentShareSUPPORT ENGINEERPeter_Nanswered 2 years ago0And what if this doesn't work? I did mine yesterday and the MX records still have not propagated. I thought AWS had a 60-second propagation turnaround.How do I post my own thread on here? I don't see an option to.Edited by: Swartz on Mar 24, 2021 11:22 AMCommentShareSwartzanswered 2 years ago0Hi Peter, thank you very much for your help. Actually, the reason was my stupidity, I have added the MX records to Lightsail where I host my website, problem solved. So it was not a Route 53 problem at all.CommentShareMehmetDilekanswered 2 years ago0Responded in your new thread - https://forums.aws.amazon.com/thread.jspa?messageID=978638&#978638CommentShareSUPPORT ENGINEERPeter_Nanswered 2 years ago"


Question: Can AWS IoT add a new lifecycle event for PING response?

"Currently AWS IoT supports lifecycle events for connected/disconnected/subscribed/unsubscribed.I'd like to be able to plug a lambda function into the PING response sent by a client keep-alive, in order to progressively delay the TTL set in my application's Session record for that connection (dynamodb).Currently there is no way that I'm aware of to natively handle this with lambda in the same way I can other lifecycle events, as the PING response isn't available to use as an IoT topic rule.Is there a way to do this or can this be added as a new optional lifecycle event?ThanksFollowComment"


Question: Error saving: Cannot modify a default parameter group.

"Hello,I am trying to modify the default parameter group "default.aurora5.6" for my cluster on N.CALIFORNIA region, especially "binlog_format". The value is currently set to "OFF" and I want to set it to value "MIXED". When I set it to "MIXED" and click "SAVE CHANGES" I get the following error:"Error saving: Cannot modify a default parameter group. (Service: AmazonRDS; Status Code: 400; Error Code: InvalidParameterValue; Request ID: 758f6240-e1d6-40bd-8b5b-3d7ec6d88e1c)"Please help.ThanksEdited by: AudioVerse on Nov 1, 2017 4:55 PMEdited by: AudioVerse on Nov 1, 2017 4:55 PMFollowComment"

Answer: "1You can't modify the default parameter group, you need to create a custom parameter group, make the parameter changes, then modify the instance to use the new parameter group.  See:http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithParamGroups.html.CommentShareHalTempanswered 6 years ago"


Question: "Unable to import module 'lambda_function': No module named 'charset_normalizer'"

"i'm following this" Tutorial: Creating a search application with Amazon OpenSearch Service", on this url 'https://docs.aws.amazon.com/opensearch-service/latest/developerguide/search-example.html'.Now in the lambda functions screen under functions I have a testFunction. Here i uploaded a zip file with a folder 'packages' and a file 'lambda_function.py'. If I test the file in the browser I get this error "Unable to import module 'lambda_function': No module named 'charset_normalizer'". In the package folder there is a folder 'charset_normalizer'?If I run the code local, I get no errors...FollowComment"

Answer: "0Accepted AnswerHello robbe,I think what causes the error is that Lambda cannot find the module 'charset_normalizer'. I think you can solve it by creating a layer for you Lambda. Try to follow these steps:Go to pypi charset-normalizer download page: https://pypi.org/project/charset-normalizer/#filesDownload whl file for desired Python version x86_64. (e.g. charset_normalizer-3.0.1-cp311-cp311-musllinux_1_1_x86_64.whl). You need to check the compatible version of the package with the runtime of your lambda function.Create a folder with the name "python",  don't use other names different than “python” because it won't workMove all the extracted files from whl to "python" folder.zip compress this "python" folder.Now you can upload the zip file on Lambda to create the Layer by following these steps:Go to LambdaOn the left side pane go to "Additional resources" -> "Layers"Click on "Create Layer" on the rightGive your layer a nameUpload the zip file you createdIn "Compatible architectures" choose x86_64In "Compatible runtimes" choose the code runtime you used in your lambda functionClick on "Create"Now you can add the Layer to your Lambda:Go to you Lambda functionScroll down to the bottom until you see the "Layers" bannerClick on "Add a layer"Choose "Custom Layer"In the dropdown menu select the name of the layer you previously createdIn the "Version" dropdown menu select the version of the layerClick on "Add"Now try to test your function again and see if the error is solved.I attach this medium article that explains how to create pandas and numpy layer for Lambda, maybe it can be useful in case my answer is not clear: https://medium.com/@shimo164/lambda-layer-to-use-numpy-and-pandas-in-aws-lambda-function-8a0e040faa18CommentShareGaia Nardellaanswered 4 months agorobbe 4 months agoThanks for the answer, i think my import errors are gone. Now i have this error when i test: "list indices must be integers or slices, not str", i have copied the code from the tutorial so i dont know what the error is. my code looks like this:def lambda_handler(event, context):# Put the user query into the query DSL for more accurate search results.# Note that certain fields are boosted (^).query = {    "size": 25,    "query": {        "multi_match": {            "query": event['queryStringParameters']['q'],            "fields": ["title", "directors"]        }    }}# Elasticsearch 6.x requires an explicit Content-Type headerheaders = {"Content-Type": "application/json"}# Make the signed HTTP requestr = requests.get(url, auth=awsauth, headers=headers,                 data=json.dumps(query))# Create the response and add some extra content to support CORSresponse = {    "statusCode": 200,    "headers": {        "Access-Control-Allow-Origin": '*'    },    "isBase64Encoded": False}# Add the search results to the responseresponse['body'] = r.textreturn responseThe error is on this line:  "query": event['queryStringParameters']['q']Share0Hello robbe, sorry for my late response, what I understand from the error is that Lambda sees event['queryStringParameters'] as a list and tries to access element at position 'q' that throws an error since only integers can be used as indices in a list. Could you please add a print(event) on the line beforequery = {    "size": 25,    "query": {        "multi_match": {            "query": event['queryStringParameters']['q'],            "fields": ["title", "directors"]        }    }}and provide me the output so I can read what Lamdba gets as input and have a better understanding of the error?CommentShareGaia Nardellaanswered 4 months ago"


Question: Can MSK Connect be made rack-aware?

"We have a Kafka cluster in Amazon MSK that has 3 brokers in different availability zones of the same region. I want to set up a Kafka Connect connector that backs up all data from our Kafka brokers to Amazon S3, and I'm trying to do it with MSK Connect.I set up Confluent's S3 Sink Connector on MSK Connect and it works - everything is uploaded to S3 as expected. The problem is that it costs a fortune in data transfer charges - our AWS bills for MSK nearly double whenever the connector is running, with EU-DataTransfer-Regional-Bytes accounting for the entire increase.It seems that the connector is pulling messages from all three of our brokers, i.e. from three different AZs, and so we're getting billed for inter-AZ data transfer. This makes sense because by default it will read a partition from that partition's leader, which could be any of the three brokers. But if we were creating a normal consumer, not a connector, it would be possible to restrict the consumer to read all partitions from a specific broker:"client.rack" : "euw1-az3"☝ For a consumer in the euw1-az3 AZ, this setting makes the consumer read all partitions from the local broker, regardless of the partitions' leader - which avoids the need for inter-AZ data transfer and brings the bills down massively.My question is, is it possible to do something similar for a Kafka Connector? What config setting do I have to pass to the connector, or the worker, to make it only read from one specific broker/AZ? Is this possible with MSK Connect?FollowComment"

Answer: "0Hi there, in order to fetch from a nearest replica consumer side config client.rack must be set as you might be aware. When using a Sink connector, it acts as a consumer to Kafka topic so Kafka connect allows you to specify all consumer config by using prefix 'consumer.*' However in MSK any configuration property that starts with the consumer. prefix is allowed only if it starts with the prefixes mentioned here https://docs.aws.amazon.com/msk/latest/developerguide/msk-connect-workers.html#msk-connect-custm-worker-config. Hope this helps!CommentShareSUPPORT ENGINEERHarshith_Manswered a year ago"


Question: Error when trying to import package installed using lambda layer on nodejs14 ES module enabled lambda function

I have created a lambda function on the nodejs14 runtime that has the ES module enabled. I have installed a custom package using the lambda layer following the folder structure specified on documentation.nodejs/node_modules/my-package-name/index.jsornodejs/node14/node_modules/my-package-name/index.jsWhen I try to import this packageimport my-package-name from "my-package-name"I get an error that says can't find the module. The weird part is it works perfectly fine when CommonJS is enabled (ES module disabled).FollowComment

Answer: "0Not sure if you ever got an answer on this but we just went through the same issue with Node.js 16. I updated my original question with support's response. Short answer, not possible. Longer answer, you can use a wrapper to get the module paths.CommentSharerePost-User-4160403answered a year ago"


Question: Weird loadbalancing behavior from Classic ELB

"We have 4x EC2 instances with httpd web server scattered across B and D zones.In random times of the day, one of the instances in Zone B would get none of the traffic and have its traffic rerouted the other EC2 instance in that zone.The user-traffic would be like this:Zone B, Instance 1 - 50%Zone B, Instance 2 - 0%Zone D, Instance 3 - 25%Zone D, Instance 4 - 25%I mentioned user-traffic above because the traffic from health checks during this period are equal across all machines and all of them are fine.After 5 minutes it would return back to normal.Any help would be appreciated.FollowComment"

Answer: 0HiHave you looked at this Knowledge center article:https://aws.amazon.com/premiumsupport/knowledge-center/elb-fix-unequal-traffic-routing/CommentShareEXPERTTushar_Janswered a year ago