Question: Lambda to DB connectivity - best practices

"Hi,I have a some AWS Lambda functions which connect to a Postgres SQL database hosted on EC2 and and Oracle DB hosted out of AWS.  I have been facing some intermittent connectivity challenges  in connecting to DB hosted outside AWS.Also, basis some research I came across articles stating that directly connecting Lambda to a DB is not ideal for production workloads as Lambda cant maintain a connection pool. There is an option for AWS RDS proxy to handle this but that appears to be only working for MYSQL hosted on RDS.Any pointers on best practices to connect Lambda to a relational database both within and outside AWS network?Regards,dbeingsFollowComment"

Answer: "1Using AWS Lambda to connect to a database, both within and outside of the AWS network, can be challenging due to the stateless and short-lived nature of Lambda functions. Here are a few best practices to consider when connecting Lambda to a relational database:Use a connection pooling library: Since Lambda functions cannot maintain a persistent connection to a database, it's best to use a connection pooling library to manage database connections. This can help reduce the overhead of creating and closing connections for each Lambda invocation.Use a VPC endpoint: If the database is hosted within the same VPC as your Lambda function, you can use a VPC endpoint to connect to the database. This can help improve security and reduce the risk of connection interruptions.Use an API Gateway: You can use an API Gateway to create an HTTP(s) endpoint that your Lambda function can connect to. The API Gateway can then forward requests to the appropriate database. This can help improve security and scalability, and also provide a level of abstraction between your Lambda function and the database.Use AWS RDS proxy: AWS RDS proxy can handle the connection pooling and also improve security by providing a central point of authentication and access control to your RDS instances.Use a Data Migration Services: If you are facing connectivity challenges with databases hosted outside AWS, consider using a data migration service like AWS DMS (Database Migration Service) to replicate data to a database within the AWS network.Evaluate the use of AWS AppSync: AppSync is an AWS service that allows you to develop GraphQL APIs, it also allows you to connect your backend to multiple data sources like RDS, DynamoDB, Elasticsearch, and more. It can also cache the queries to improve performance.Please note that, AWS RDS proxy supports only MYSQL hosted on RDS.Please also note that, in most cases, it is recommended to use a managed service like RDS, Aurora, or DocumentDB, instead of running your own databases on EC2 instances.CommentShareVarun Mittalanswered 4 months ago1First, regarding the connectivity. I assume your self hosted database is running in a private subnet in a VPC. You will need to attach your Lambda functions to that VPC and allow the connectivity inside the VPC using Security Groups. With regards to the database hosted on premises, I assume it is not exposed to the internet, and as such, you should have a direct connect (or VPN) from your network to a VPC in AWS. In this case you will also need to attach the function to the VPC and use routing and security groups to allow the connectivity.The main issue with connecting Lambda functions to a relational database is the number of connections. As Lambda functions can scale very high, very fast, it may cause a lot of connections to the database, which may cause issues on the DB. For that reason we recommend using RDS proxy, which is not an option in your case. The other option is to limit the concurrency if your functions to a number which is supported by your database. How to do that depends on the function's event source. For instance, if the function is invoked from API Gateway, you can use throttling in the gateway. If the function is invoked from SQS, you can use the event source's Max Concurrency setting. You can always use Reserved Concurrency on the function to limit its maximum concurrency.Finally, I would recommend that you create the connection outside the function handler, and reuse it across all invocations. That way you reduce the create connection/close connection load on the database, and you reduce your function's duration, which will also reduce your cost.CommentShareEXPERTUrianswered 4 months ago0Small clarification:Amazon RDS Proxy is available for Amazon Aurora with MySQL compatibility, Amazon Aurora with PostgreSQL compatibility, Amazon RDS for MariaDB, Amazon RDS for MySQL, Amazon RDS for PostgreSQL, and Amazon RDS for SQL Server.https://aws.amazon.com/rds/proxy/CommentSharedbcappsanswered 4 months ago"


Question: please help me to install free vps

please help me to install free vps on windowsFollowComment

Answer: 0Can you elaborate on the  request? Are you running into issue? Assuming you are following the guidelines provided with vsp software.CommentShareSanjay Aggarwalanswered 3 months ago


Question: Is it possible to use a private S3 bucket for an OIDC provider?

"Hi everyone,I'm currently trying to find out, if it is possible to have a non public s3 bucket, which hosts theopenid-connect and jwks files required for an open id connect provider?So my end goal would be, that only the OIDC provider has access to the public s3 bucket.Best,PatrickFollowComment"

Answer: "0It depends on the definition of public bucket. You could use aws:sourceIp condition key in the bucket policy to allow only known IPs to access your bucket without authentication. In that sense, according to the AWS documentation, the bucket might not be considered anymore as public.CommentShareRoberto_Manswered 9 months ago0Hi,From the case notes I understand that you would like to know if it would be possible to have a public S3 bucket that only grants access to an OIDC provider.It would be possible to scope down principals that can access a bucket however this would no longer be a public bucket as a public bucket would be one that can be accessed by any principal rather than only a specific one. The following would be examples of how you can restrict s3 access to a specific IPv4 or IPv6 address [1].  You can allow the specific IP address for your OIDC provider in order to limit access to only that provider.I hope you have a great rest of your day!References[1] https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-use-case-4CommentShareSUPPORT ENGINEERPatrick_Vanswered 9 months ago0Hi,Thank you for your answers! We want to integrate this while setup with an IAM identity provider.Are the IPs which query the endpoints well known? Or is there maybe a special principal we couldallow access to the bucket (a bit like with the custom origin for cloudfront)?Best,PatrickCommentSharerePost-User-3444987answered 9 months ago0Hi Patrick,Were you able to make this work?Thank youCommentShareTarek Shanswered a month ago"


Question: Latency of STL_INSERT/STL_DELETE

"What is the latency/SLA of STL_INSERT, STL_DELETE and STL_QUERY? For example, how soon after an INSERT query is run is it guaranteed to show up in STL INSERT?Can a query show up in STL_INSERT but be missing in STL QUERY and therefore be lost if the tables are joined together?FollowComment"


Question: List of waiters for AWS Transcribe

The documentation for the Boto3 TranscribeService getWaiter() saysSee the waiters section of the service docs for a list of available waiters....but there are no waiters listed in the documentation. Are waiters available for AWS TranscribeService?FollowComment


Question: Inside IPv4 Next Hop won't reply to a Ping

"For the life of me, I'm pulling my hair out to get redundancy working on my VPN from On-Prem to my VPCI am able to ping between my On-Prem LAN (10.1.0.0/16) to the VPC (10.2.0.0/16) consistentlyI have dual VPN's set-up between my PA Firewall and AWS following all the guides I've foundI am NOT using BGP and using Static Routes [currently manually created]My Firewall has a couple ways to monitor the VPN and change the Static Routes via monitoring Next Hop. I've tried numerous ways to get this to work, an can only conclude that on the Inside IPv4 CIDR that the AWS next-hop endpoint isn't responding to a Ping request from my FirewallFor example: [As assigned by AWS]CIDR - 169.254.112.132/30Next Hop (AWS Side) - 169.254.112.133On-Prem Tunnel Interface - 169.254.112.134These are in the same subnet, so ACL's/Security Groups/Routing/Firewall Policies shouldn't impact the ability to ping.  Though I've played with all of these with no resolve.The bottom line is .133 just won't get a ping response from .134, which is crucial for monitoring the connections.  All the guides out there show that this set-up is a best practice and .134 should respond to a ping for me.Anyone else having issues with this?  Is there something on the AWS side I need to enable to allow the Inside IP for my Virtual Private Gateway to respond to a ping?  Clearly it is allowing LAN to VPC traffic through, so it is functioning as it's the Next Hop in my routing table for 10.1.0.0Since I am able to ping from LAN to VPC without issue, my fall-back would to use Next Hop between these segments instead of within the Inside IP's, but this is supposed to work..FollowComment"

Answer: "0I have a session schedule with the Firewall Support team.  They are going to want to prove that the Next Hop IP address responds to pings.  I have set-up an EC2 instance which is able to ping to my remote LAN without a problem, but it too can't ping the Inside IP address for the tunnel.  Any idea how I can confirm that 169.254.x.x assigned to the VPN will respond to a ping?CommentShareCompKinganswered 2 years ago0All my testing can only conclude that the 169.254.x.x Inside IP's assigned by AWS no longer respond to pings.At one time, they must have been pingable, and at some point they no longer are, as the set-up documentation provided currently when hitting "Download Configuration" which provides guidance on setting up the customer gateway device has a bunch of instructions to use the peer 169.254.x.x IP address for fail over detection. Specifically the documentation for Palo Alto firewallsWhether this is Static Route Path Monitoring, Policy Based Forwarding, or Tunnel Monitoring, they all rely on the ability to ping the other Inside IP for connectivity detection.I now know more about Routing, Firewall Config, and AWS VPC than I ever wanted to know.Two optionsRe-establish the ability to ping the Internal IP so that the documentation provided worksUpdate the documentation so not to mislead people and waste countless hoursHoping someone smarter than me has a recommendationCommentShareCompKinganswered 2 years ago0The Next Hop logic in the FW uses the egress interface to generate the ping (which is a 169.254.x.x network).  I don't expect that the private IP address inside the tunnel would be able to ping an IP address on my LAN without some routingCommentShareCompKinganswered 2 years ago0Can someone from AWS confirm whether or not the Inside IP address should be able to be Pinged by the other Inside IP Gateway on the other side of the connection?This is pretty critical for Peer detection and adjustments to Static/Policy Based Routing automation...CommentShareCompKinganswered 2 years ago0I am not sure if anyone can see my post.  I've been talking with myself..Since I couldn't get Static Route based monitoring to work, I decided to try Dynamic BGP.  I run into the same issue again.In the AWS troubleshooting document "If the configuration settings are correct, then ping the remote BGP peer IP from your local BGP peer IP to verify the connectivity between BGP peers." per:  https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-bgp-vpn/I wasn't able to ping 169.254.x.x addresses before, so I don't know how this is supposed to work any better..Is anyone able to help?  Should I be able to ping 169.254.x.x internal IP's on the Gateways?  So far I haven't been able to, and I wonder if AWS documentation is out of date..CommentShareCompKinganswered 2 years ago0Well.  After a month of troubleshooting, I am finally able to get a ping response from the AWS gateway.  Of course it was a local firewall issue.For anyone else who runs into this, check your Zone Protection profile on Palo Alto.CommentShareCompKinganswered 2 years ago0PA has a zone policy which discards Link-Local IP's which must be disabled.Ensure to disable Strict IP Address CheckSee:  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g0000008U3FCAU&lang=en_US%E2%80%A9CommentShareCompKinganswered 2 years ago"


Question: Windows EC2 Instance is unreachable

"I have a windows instance running Windows Server 2019 and after stopping and starting the instance, I cannot connect to it SSM or RDP. When I run aws ec2 get-console-output returns the instance id and timestamp only:{"InstanceId": "i-07dd6exxxxxxxxd1","Timestamp": "2022-04-11T18:25:04+00:00"}If I try to execute ssm start session, it times out and returns:Command '['session-manager-plugin', '{"SessionId": "oscars@blank.com-0473707d8049c843c", "TokenValue": "", "StreamUrl": "wss://ssmmessages.eu-west-1.amazonaws.com/v1/data-channel/oscars@blank.com-0473707d8049c843c?role=publish_subscribe&cell-number=", "ResponseMetadata": {"RequestId": "f44033cc-12da-4617-81ad-195e17ef2e69", "HTTPStatusCode": 200, "HTTPHeaders": {"server": "Server", "date": "Mon, 11 Apr 2022 18:06:58 GMT", "content-type": "application/x-amz-json-1.1", "content-length": "839", "connection": "keep-alive", "x-amzn-requestid": "f44033cc-12da-4617-81ad-195e17ef2e69"}, "RetryAttempts": 0}}', 'eu-west-1', 'StartSession', 'prod', '{"Target": "i-07dd6exxxxxxxxd1"}', 'https://ssm.eu-west-1.amazonaws.com']' returned non-zero exit status 3221225786.Starting an RDP session returns a timeout even though Reachability Analyzer states that the instance is reachable via TCP on port 3389 from another instance. Basically the instance has become unreachable and I can only stop and start it in the console.FollowCommentAkhil a year agoHave you tried these troubleshooting pages -https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/screenshot-service.htmlhttps://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/troubleshoot-connect-windows-instance.htmlShare"

Answer: "0It sounds like there is something on the instance that is stopping the networking stack from working correctly. For example, this could happen if the Windows firewall was incorrectly configured.You can try mounting the C: drive of the instance on another instance and then looking at logs or editing entries in the registry.If all else fails, please create a support case and get the team to help you troubleshoot.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: Using SSML tags in WordPress

"Hi All,I have integrated Polly into my WordPress blog and so far so good.The only issue I have is that it reads everything and I’d like to leave out certain things like twitter embeds etc.I’ve seen that you can insert SSML tags in to the content to do this but this is where I’m completely clueless. Am I inserting this into WordPress? If so, how and where?Or is it something I need to do in the Polly Dashboard (where the file lives in the S3 bucket perhaps)?Thanks in advance for any pointers.FollowComment"


Question: Wordpress website hosted on AWS downs frequently

"Hi, I hosted a Wordpress website on AWS (1 GB RAM, 1 vCPU, 40 GB SSD), but the website always goes down - the frequency ranges from daily to weekly and each time it goes down for 1-2 hours. The max traffic of my website is ~ 2,000 visits and well below the sustainable zone. And the website resumes after I reboot the instance, and sometimes it resumes itself.Do you know if there is a way to determine where the problem might be? Should I upgrade my bandwidth? Thank you.FollowComment"

Answer: "1You may want to check the Cloudwatch metrics and logs to monitor the resource utilization on the machine.You can also create an auto-scaling group and put an Application Load Balancer in front of the auto-scaling group, so that more instances will be spun up if the load on your website increases.You may want to go through this document thoroughly - https://docs.aws.amazon.com/whitepapers/latest/best-practices-wordpress/welcome.htmlIn particular this sub-document - https://docs.aws.amazon.com/whitepapers/latest/best-practices-wordpress/scaling-the-web-tier.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 10 months ago"


Question: Aggregation stage not supported:lookup on multiple join conditions

"I got the error from documentdbAggregation stage not supported: '$lookup on multiple join conditions and uncorrelated subqueryhow to fix this do you have any solution for solving this problem?i have 3 document to join this is lookup command{  from: "subscribe",  let: {    program_id: "$program_id"  },  pipeline: [    {      $match: {        $expr: {          $and: [            {              $eq: [                "$program_id",                "$$program_id"              ]            }          ]        }      }    },    { "$lookup": {        "from": "user_token",        "let": { "user_id": "$user_id" },        "pipeline": [          {             "$match": {               "$expr": {                 "$eq": [ "$user_id", "$$user_id" ]               }            }          }        ],        "as": "tokens"      }    }    // { "$wind": "$token" }  ],  as: "subscribers"}Edited by: BECIDEV on Apr 17, 2020 1:02 AMEdited by: BECIDEV on Apr 17, 2020 1:03 AMFollowComment"

Answer: "0Same case here, any one know how to workaround?CommentShareKelvin2020answered 2 years ago0There's no workaround for now, the $let and $expr operators are not supported and are needed in order to achieve this extension to $lookup. As we are working backwards from customer needs, these operators may be supported in the future versions of the service.CommentShareMihai Aanswered a year ago"


Question: Stuck in Stopping State for Days

"I have a lightsail instance that is stuck  in a stopping state.amzls-custom-ap-southeast-2-2019-08-07-13-29-44-nec9r54cHow to fix?Can delete either....Cheers,ShaunFollowComment"

Answer: "0Hi Shaun,I believe you wanted to stop your lightsail instance and it got stuck on “Stopping” state for days, you can’t also delete it. I would advise you to force stop your instance through the AWS CLI, resolution steps are provided to force stop the instant [1]. I will also recommend to first setup an AWS CLI if one is not already available [2].[1] https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_StopInstance.html[2] https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.htmlCommentShareLwazianswered a year ago"


Question: IoT core error actions

"Hi,How can I go about testing IoT core error action rules to send error messages to an S3 bucket with SSE-KMS?FYI, my action rule in this use case sends telemetry data to another encrypted bucket by way of a Lambda.ThanksGaryFollowComment"

Answer: "2Accepted AnswerHi there,Adding onto the response above, here's another example with a sample lambda function IoT rule and error action, however I would also like to point out the SSE-KMS permission requirement. Since the S3 bucket is configured with SSE-KMS you may need the IoT IAM Role seen in "roleArn" section below, to have the correct KMS key policy permissions to write to the S3 bucket, you can find the steps to add these here [1][2][3].{    "sql": "expression",    "ruleDisabled": false,    "awsIotSqlVersion": "2016-03-23",    "actions": [{        "lambda": {            "functionArn": "arn:aws:lambda:us-west-2:123456789012:function:my-lambda-function"        }    }],    "errorAction": {        "s3": {            "roleArn": "arn:aws:iam::123456789012:role/aws_iot_s3",            "bucketName": "message-processing-errors",            "key": "${replace(topic(), '/', '-') + '-' + timestamp() + '-' + newuuid()}"        }    }} Please find the resources below for more information :[1] Allowing users/roles to access KMS S3 : https://repost.aws/knowledge-center/s3-bucket-access-default-encryption[2] Granting an AWS IoT rule the access it requires - https://docs.aws.amazon.com/iot/latest/developerguide/iot-create-role.html[3] KMS permissions required for access : https://docs.cloudera.com/HDPDocuments/HDP3/HDP-3.1.4/bk_cloud-data-access/content/SSE-KMS-permissions.htmlCommentShareSUPPORT ENGINEERPanasheanswered 2 months agogary 2 months agoHi Panashe, thanks. I'll check how i can assign permissions or grants to IoT to write to the bucket.Share1Hi - I am assuming that you referring to this https://docs.aws.amazon.com/iot/latest/developerguide/rule-error-handling.html.  Yes the error action can write data to an Amazon S3 bucket. For example see errorAction{    "sql" : "SELECT * FROM ..."    "actions" : [{         "dynamoDB" : {            "table" : "PoorlyConfiguredTable",            "hashKeyField" : "AConstantString",            "hashKeyValue" : "AHashKey"}}    ],    "errorAction" : {         "s3" : {            "roleArn": "arn:aws:iam::123456789012:role/aws_iot_s3",            "bucketName" : "message-processing-errors",            "key" : "${replace(topic(), '/', '-') + '-' + timestamp() + '-' + newuuid()}"        }    }}If you want to test, you can do like this change the permission of the role which invokes the lambda function so that that error fails.CommentShareEXPERTAWS-User-Nitinanswered 2 months agogary 2 months agoHi Nitin, I am, but I'm sending to a SSE-KMS bucket and I see @Panashe has added some more detail on how to achieve this. Thanks for the role permissions suggestion............ah, I see the roleArn statement in you example thanksShare"


Question: ESP32 internet disconnect

"Hi, the framework given by AWS for ESP32-DevkitC based OTA MQTT is crashing when internet disconnects. During crash, 6 out of 5 retry for TLS attempts is seen in serial log. Please suggest how to overcome this. If any other info required please let me know.FollowComment"

Answer: 0I would suggest you report this issue on the github project for the OTA library (https://github.com/aws/ota-for-aws-iot-embedded-sdk/issues) providing all the logs and instructions to reproduce.CommentShareEXPERTMassimilianoAWSanswered a year ago


Question: "Storage Gateway for files, SMB Share Size vs Size on Disk"

"HelloI notice that Size and Size on Disk differs a lot, Is that something to be concerned about?Size and the size of the bucket match, so it is the Size on disk that is wrongSize on disk is 1MB even if the file is 1KBThanksFollowComment"

Answer: "0The gateway mediates between file operation requests (NFS or SMB) and S3 (Object) storage and  may need to occupy larger space on your disk than the individual file sizes. This is especially true in the case of smaller files. So, while the object size in S3 and file size locally match, but you'll observe that it's not always going to be the same as the size occupied in cache. Let me know if this addresses your concern.CommentShareAWS-User-9826533answered 4 years ago"


Question: Audio Devices menu not appearing for agents in the CCP - Amazon Connect

"I've recently setup Amazon Connect for my organisation this week and have come across a strange issue I haven't been able to find any information about in any of the support documentation and searching online.Basically any accounts I have that are assigned the Agent role do not see the Audio Devices menu under the settings in the Contact Control Panel. Due to this they are unable to modify the sound, microphone and ringer devices. If I grant the same accounts the Admin role, this menu appears just fine without issue, so the problem seems to be related to the user permissions in some way.Can anyone assist in pointing me to which permission I may need to assign to the Agent role to allow this ability, currently they are assgined the default "CCP: Access CCP" &  "CCP: Outbound" permissionsThanksFollowComment"

Answer: "1this option currently is only available when you have a customized CCP,  https://docs.aws.amazon.com/connect/latest/adminguide/audio-device-settings.htmlin your custom CCP,  connect.core.initCCP options under  here:pageOptions: { //optionalenableAudioDeviceSettings: true, //optional, defaults to 'false'enablePhoneTypeSettings: true //optional, defaults to 'true'},CommentShareClarenceChoianswered 5 months agodmacias 5 months agoThis is the right answer. The good news is that setting up a custom CCP with this setting is pretty trivial.davidShare0This is new functionality which is yet to be announced. In my instance, I don't see the Audio Devices menu when using an Admin security profile; it only shows up when I use the 'Log in for emergency access' link.Keep an eye on the What's New Feed near the bottom of https://aws.amazon.com/new/ (you can filter by Customer Engagement -> Amazon Connect) and there should be an announcement sometime soon when it's completed.CommentSharelukwarneanswered 5 months ago0It sounds like the issue may be related to the permissions that are assigned to the Agent role in Amazon Connect. In order to access the Audio Devices menu in the Contact Control Panel, the user needs to have the "CCP: Change Audio Devices" permission.To grant this permission to the Agent role, you can follow these steps:Sign in to the Amazon Connect console and navigate to the "Routing profiles" page.Click on the name of the routing profile that you want to edit.In the "Permissions" section, click on the "Edit" button.Scroll down to the "CCP permissions" section and select the "CCP: Change Audio Devices" permission.Click on the "Save" button to apply the changes.After making this change, users with the Agent role should be able to access the Audio Devices menu in the Contact Control Panel and modify the sound, microphone, and ringer devices.CommentShareSeanSianswered 5 months ago"


Question: Is one supposed to grayscale and brightness contrast process the image before sending to textract?

Textract results on recognizing basic arithmetic seems to degrade with colorThis series of images show Textract failing unusually in all cases except the one where the image has been both grayscale and brightness/contrast (50/50 and 25/25)unedited image from the camera FAILbrightness contrast applied without grayscale FAILgrayscale FAIL[grayscale with brightness contrast] (https://i.gyazo.com/22269131293c8e7b50c7aee7b998554c.png) finally!Is one supposed to grayscale the image before sending to textract? Should one also apply brightness/contrast?I assume Textract was trained with grayscale images - so should the service automatically convert the input images to grayscale?FollowComment

Answer: "0Grayscaling and contrast-correcting images before sending to Textract should not be "required" and the service is trained and evaluated on a broad variety of OCR tasks.However, as you've found, there are definitely cases where adding your own pre-processing if possible can help boost accuracy - sometimes with significant improvement. For example you might also explore skew detection and correction if that's relevant to your images, as I've seen customers benefit from it before.It's worth mentioning that Amazon Textract is optimized more towards document extraction use-cases, while the Rekognition DetectText API may perform better in situations where the background is busier and there are fewer than 100 words to detect. I'm not sure how well Rekognition performs with handwriting (it's not explicitly mentioned in the doc from what I can see), but might be worth trying out to compare since your images seem to have relatively little text.CommentShareEXPERTAlex_Tanswered a year agoina a year agoJust tried ReKognition... Colored: https://gyazo.com/8fc20ca073ca33e715af9c6348dc49daGrayscale/Brightness/Contrast: https://gyazo.com/cb16c701b43738b7c533731d2550c901Complete failure at https://gyazo.com/e3991e6e46b900e16e145a5a7481127e alsoShare0Grayscale and brightness contrast processing is not a pre-requisite for using Textract. There may be different use cases where pre-processing will produce better results but it is not required.CommentShareAWS-User-5884210answered a year ago"


Question: Lightsail Windows Server 2019

"I have two questions, How can i instal a complete application on an image of Windows Server 2019 in lightsail and can i have five RDP connections simultaneously ? Thanks in advance for any helpFollowComment"

Answer: "0Hello asacchetto,What kind of application are you wanting to install on a Lightsail Windows Server 2019 instance? There are many tutorials available on the web you might reference.Thanks for using LightsailCommentShareAWS-User-7183595answered a year agoasacchetto a year agoThank you for your attention, the application is used in the management of our commodity brokerShare0What is your use-case for multiple simultaneous RDP connections? Will you need separate users per-connection?CommentShareAWS-User-7183595answered a year agoasacchetto a year agoYes, the application is used in the management of our commodity broker, so the sellers and the financial manager should have separated users and in some moments simultaneous accessShare"


Question: SES GetSendStatistics has a drifting timestamp?

"I've started using SES recently and I'm trying to keep track of the usage using the GetSendStatistics API call (https://docs.aws.amazon.com/ses/latest/APIReference/API_GetSendStatistics.html). I thought that I could store the received SendDataPoints and use the Timestamp information as a unique key as the result of the API call can overlap in periods. I noticed that the Timestamp changes per API call. This makes it impossible to rule out duplicate SendDataPoints when I do a daily or hourly call to the GetSendStatistics API.How do others track their SES usage via an API? (including the bounces, complaints, etc.. )FollowComment"

Answer: "1Accepted AnswerGood Question!One AWS-native way to do this is to publish metrics to CloudWatch.  This would require SES Event Publishing and a Configuration Set (along with message/auto-tags) to categorize them.  That can provide more granular metrics past the GetSendStatistics API call or Amazon SES console.You can publish to Kinesis Data Firehose or SNS as well.More information here:Set up event publishing: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/monitor-sending-using-event-publishing-setup.htmlSpecify a Configuration Set: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/event-publishing-send-email.htmlCommentSharejsoncanswered a year ago0Thank you for your answer I will need to give this a try and see if this solves my problem. Give me a few days...Several questions bug me:Why is the GetSendStatistics API not useable for this? What's the use case that this API solves.Why do I need to build my own scaffolding to monitor usage? AWS needs these internally as well, why not expose this. How can we verify the numbers in any other way...CommentSharerichardanswered a year ago0The CloudWatch option does give me insight in the usage as you indicated. This solves the biggest problem I had of getting proper insight in usage.I still think there is an issue with the GetSendStatistics API which in my opionin isn't suited for its intended purpose. I hope someone can shed some light on its use case because I don't understand it.CommentSharerichardanswered a year ago"


Question: BadRequestException: Failed to fetch secret in Lambda with Node.js

"I am using the aws-sdk for connecting to a serverless RDS via RDS Data API and I am using the Secrets Manager for the credentials. I have done this before (on another AWS account) and it worked fine. Today I wanted to reproduce this and came up with the following error:2021-05-27T15:53:30.917Zcf4707a1-1a38-4ae6-9929-856c32a5217cINFOBadRequestException: Failed to fetch secret arn:aws:secretsmanager:us-east-1:xxxxxxxxxxxx:secret:secretRDSxxxxxxxxx-vyJYDLat Object.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/json.js:52:27)at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/rest_json.js:55:8)at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:106:20)at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:78:10)at Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:688:14)at Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10)at AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12)at /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9)at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:690:12) {code: 'BadRequestException',time: 2021-05-27T15:53:30.916Z,requestId: 'f323d3fe-18c8-46e8-890c-cd1ee41294d5',statusCode: 400,retryable: false,retryDelay: 39.82601622170287}I am tyring a simple SQL SELECT here in the following code:try {let sqlParams = {secretArn: process.env.RDSsecretArn,resourceArn: process.env.RDSresourceArn,sql: sqlStatement,database: process.env.RDSdatabase,includeResultMetadata: true}const data = await RDS.executeStatement(sqlParams).promise();aReturn = data.records[0];} catch(e) {console.log(e);}The environment variables seem to be correct, as the correct secrectARN is shown in the error message.Any ideas what this could be or what I can do?RegardsDanielEdited by: danielbrose77 on May 27, 2021 9:14 AMFollowComment"

Answer: "0I do not know what the solution has been, because I only played around a little bit with adding another Secret Key, switching back to the orinigal one etc.I think I did not really change anything here, however it works now.So might have been a temporary issue, read about that somewhere as well...CommentSharedanielbrose77answered 2 years ago"


Question: DynamoDB local GSI KeyConditionExpression difference from live Dynamo

"I'm running some tests with dynamodb local and live dynamo. When I use a KeyConditionExpression, only the hash key is allowed with live dynamo and to filter results based on the sort key I have to use a FilterExpression. In dynamodb local, the opposite is true. I want my code to be the same for my local tests and in production, but it doesn't seem possible with this difference. Here's some example code:table = boto3.resource('dynamodb').Table('tablename')  # Table has hash/sort keys of `hash` and `sort`  # GSI of table has hash/sort keys of `gsihash` and `sort`  # Works with dynamodb local, throws an error with live dynamo  table.query(KeyConditionExpression=Key('hash').eq('somevalue') & Key('sort').begins_with('someprefix'), IndexName='GSI')  # Works with live dynamo, throws an error with dynamodb local  table.query(KeyConditionExpression=Key('hash').eq('somevalue'), FilterExpression=Attr('sort').begins_with('someprefix'), IndexName='GSI')  Edited by: ewok on Dec 29, 2020 7:30 AMEdited by: ewok on Dec 29, 2020 8:33 AMNevermind, was a difference in the table definition locally vs liveFollowComment"

Answer: 0See editCommentShareewokanswered 2 years ago


Question: Multiple DNS Providers with Route 53

"Hi All,We are planning to change our DNS provider to Route 53, keeping the registrar as Godaddy (existing). As part of this process, we are planning to keep our old Name Servers (hosted on-prem) and add the new Route 53 Name Servers on Godaddy.Will this approach work? I read somewhere that all the Name Servers have to be present in all the zone files present in all the DNS providers. However, Route 53 doesn't support updating NS for the domain. How do we accomplish this?For eg: I want to keep 3 NS from old DNS provider and 3 NS records from Route 53. Do I need to update the NS records of old DNS provider in Route 53? How to do that?Any guidance would be much appreciated.Thanks,ShrutiEdited by: Explorer14 on Mar 4, 2019 7:19 AMFollowComment"

Answer: "0Yes, this is definitely possible to do! :)In order to avoid running into strange DNS lookup issues, you will want to ensure that the configuration is consistent across the different name servers. It means that your on-prem name servers should have the exact same records as the Route 53 name servers since a DNS lookup request may end up being handled by any one of these.So the first step is to put all records you have on-prem into your Route 53 hosted zone as well. Also, Route 53 allows you to update the NS/SOA record sets to achieve your goal. For the NS records, you will want to have the combined list of name server addresses listed in both locations. The SOA record should match as well to ensure the configuration is fully consistent. Then it doesn't matter if a client ends up talking to an on-prem or Route 53 name server - they both have the same information.As GoDaddy is your domain registrar, you then add the Route 53 name servers to the existing set of name servers for your domain through their management interface. In case you've been using GoDaddy as your DNS provider in the past, note that this is (likely) configuration done outside of the actual DNS record management. This step is about modifying the set of name servers for the domain itself.CommentSharesvanlundanswered 4 years ago0We were able to take a soft cutover approach with zero downtime by adding the AWS NS at the bottom of the existing NS records in Godaddy. Gradually removing all old NS and adding rest of the AWS NS. AWS NS propagation was quicker than we expected. Query Logging is magical and a great tool to analyse the  DNS traffic.CommentShareExplorer14answered 4 years ago"


Question: Create Read Replica (RDS PostgreSQL) fails

Trying to create a Read Replica for my PG 10 DB fails with undefined is not an object (evaluating 'S.DBSubnetGroup.VpcId').What to do?FollowComment

Answer: "0Accepted AnswerI didn't came so far as to choose a DB subnet group. The problem was likely related to the instance using Classic networking. After moving to VPC, the option was available without error.CommentSharefuturetapanswered 5 months agorePost-User-7694765 5 months agoHi, glad to hear that you are able to solve it. Thanks.Share0Hi thanks for asking,Please make sure, you are choosing right and existing db subnet group when creating read-replica, either through console or cli.Thank you, if you think this answer is helpful please accepted this answer.CommentSharerePost-User-7694765answered 5 months ago"


Question: There is no AWS account with that login information. Please try again or create a new account.

"All my backups are on s3, and I lost access.ERROR on login:An error has occurredThere is no AWS account with that login information. Please try again or create a new account.I had to create another account, but I need the original account because everything is there,,, how do I solve this? Please.. I can't get any contact with amazonPortugues:Todos meus backups estão no s3, e perdi o acesso.ERRO::::Ocorreu um erroNão existe conta da AWS com essa informação de login. Tente novamente ou crie uma nova conta.FollowComment"

Answer: "0Hello,Sorry to hear you are having trouble connecting.Please follow this article: https://repost.aws/knowledge-center/forgot-aws-sign-in-credentials in case you forgot you sign in credentials.This page also provide further guidance on troubleshooting steps: https://docs.aws.amazon.com/signin/latest/userguide/troubleshooting-sign-in-issues.htmlHope it helps,JonCommentShareEXPERTJonathan_Danswered 2 months agoEXPERTalatechreviewed 2 months ago"


Question: Can't run airflow backfill via cli

"I am trying to run the equivalent of backfill -t TASKNAME DAGNAMEI copied the script from  https://docs.aws.amazon.com/mwaa/latest/userguide/access-airflow-ui.html#call-mwaa-apis-cli , but it looks to me as if the environment running the cli does not have the same packages loaded as per my requirements.txt (Airflow can parse the DAGs)Result is this  Traceback (most recent call last):    File "/usr/local/bin/airflow", line 37, in <module>      args.func(args)    File "/usr/local/lib/python3.7/site-packages/airflow/utils/cli.py", line 76, in wrapper      return f(*args, **kwargs)    File "/usr/local/lib/python3.7/site-packages/airflow/bin/cli.py", line 187, in backfill      dag = dag or get_dag(args)    File "/usr/local/lib/python3.7/site-packages/airflow/bin/cli.py", line 164, in get_dag      'parse.'.format(args.dag_id))  airflow.exceptions.AirflowException: dag_id could not be found: sentinel-hourly. Either the dag did not exist or it failed to parse.    \[2021-04-01 21:40:27,020] {{__init__.py:50}} INFO - Using executor CeleryExecutor  \[2021-04-01 21:40:27,020] {{dagbag.py:417}} INFO - Filling up the DagBag from /usr/local/airflow/dags  \[2021-04-01 21:40:27,023] {{dagbag.py:259}} ERROR - Failed to import: /usr/local/airflow/dags/test.py  Traceback (most recent call last):    File "/usr/local/lib/python3.7/site-packages/airflow/models/dagbag.py", line 256, in process_file      m = imp.load_source(mod_name, filepath)    File "/usr/lib64/python3.7/imp.py", line 171, in load_source      module = _load(spec)    File "<frozen importlib._bootstrap>", line 696, in _load    File "<frozen importlib._bootstrap>", line 677, in _load_unlocked    File "<frozen importlib._bootstrap_external>", line 728, in exec_module    File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed    File "/usr/local/airflow/dags/test.py", line 3, in <module>      from airflow.providers.amazon.aws.operators.ecs import ECSOperator  ModuleNotFoundError: No module named 'airflow.providers'  \[2021-04-01 21:40:27,026] {{dagbag.py:259}} ERROR - Failed to import: /usr/local/airflow/dags/sentinel-hourly.py  Traceback (most recent call last):    File "/usr/local/lib/python3.7/site-packages/airflow/models/dagbag.py", line 256, in process_file      m = imp.load_source(mod_name, filepath)    File "/usr/lib64/python3.7/imp.py", line 171, in load_source      module = _load(spec)    File "<frozen importlib._bootstrap>", line 696, in _load    File "<frozen importlib._bootstrap>", line 677, in _load_unlocked    File "<frozen importlib._bootstrap_external>", line 728, in exec_module    File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed    File "/usr/local/airflow/dags/sentinel-hourly.py", line 3, in <module>      from airflow.providers.amazon.aws.operators.ecs import ECSOperator  ModuleNotFoundError: No module named 'airflow.providers'  FollowComment"

Answer: "0Hi!CLI commands run on the Airflow web server, which for security reasons does not install plugins or requirements. There is an open Airflow issue https://github.com/apache/airflow/issues/15306 to address this.In the interim, while not officially supported, a workaround is to run "airflow backfill -t TASKNAME DAGNAME" from a BashOperator.  See https://github.com/aws-samples/amazon-mwaa-examples/tree/main/dags/bash_operator_script for an example.Thanks!CommentShareJohn_Janswered 2 years ago0Thanks for the answer, I was able to work around it by clearing or failing the earliest of the ones I wanted to re-run and selecting "future" in case its useful to anyone else.CommentSharetth-planswered 2 years ago"


Question: Running SQL query from AWS Glue to BigQuery

"I am trying to write data from S3 to BigQuery using Glue, this is working perfectly fine -** have used the Glue BQ connector from Marketplace**. I am able to write the data to the table at BQ but when trying to use prequery/postquery to run a delete SQL query on BQ table, it does not run. How can I perform the deletion that I need to run on the table at BQ, is there any way for this, or am I doing any mistake while adding the prequery?Below is the code for writing the dynamic_frame to BQ where I am adding the prequery as option:prequery = f"""DELETE FROM fynd-1088.fynd_warehouse_pre.rds_subscriber_config_dms WHERE id in ({list_id})"""preact = False if deletedf_count == 0 else Truewritedf = (glueContext.write_dynamic_frame.from_options(frame=target_df,connection_type="marketplace.spark",connection_options={"parentProject": "parentProject","table": "parentProject.dataset_name.table_name","temporaryGcsBucket": "bucket_name","connectionName": "new_bq","prequery": prequery,"addPreAction": preact,},transformation_ctx="writedf",))FollowCommentFabrizio@AWS EXPERTa year agoCould you please share where you have read about the prequery option?I could not find any mentions in the documentation. Thank youShareAWS-User-2896664 a year agoHere is the link to it, but seems like it is supported for Redshift as target only,https://aws.amazon.com/premiumsupport/knowledge-center/sql-commands-redshift-glue-job/Please check this and let me know.Share"

Answer: "0Hi,to my knowledge the bigQuery Connector does not support the prequery option, as stated in the connector documentation you can see other available options here: https://github.com/GoogleCloudDataproc/spark-bigquery-connector/tree/0.22.0 .The only connector that supports pre and post query is the Redshift connector as you mentioned in your comment.hope this helps,CommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: AWS - S3 - Creating a Bucket Policy - Error: Access Denied

"Trying to create an Amazon Web Services - S3 bucket policy, but when running the script I get the following error. Where exactly is my access being denied? Could this issue relate to how I set up my aws configurTraceback (most recent call last):File "C:\Users*****\githubb\aws\s3operations.py", line 40, in <module>print(create_bucket_policy())File "C:\Users\Patrick\githubb\aws\s3operations.py", line 36, in create_bucket_policyPolicy=policy_stringFile "C:\Users\Patrick\Python36\lib\site-packages\botocore\client.py", line 357, in _api_callreturn self._make_api_call(operation_name, kwargs)File "C:\Users\Patrick\Python36\lib\site-packages\botocore\client.py", line 661, in _make_api_callraise error_class(parsed_response, operation_name)botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the PutBucketPolicy operation: Access DeniedThe following is my script:import boto3import jsonBUCKET_NAME ='patricksbucket'def s3_client():s3 = boto3.client('s3')""":type : pyboto3.s3"""return s3def create_bucket(bucket_name):return s3_client().create_bucket(Bucket=bucket_name,CreateBucketConfiguration={'LocationConstraint': 'us-east-2'})def create_bucket_policy():bucket_policy = {"Vesrion": "2012-10-17","Statement":[{"Sid": "AddPerm","Effect": "Allow","Principal": "","Action":["s3:"],"Resource":["arn:aws:s3:::patricksbucket/*"]}]}policy_string = json.dumps(bucket_policy)return s3_client().put_bucket_policy(      Bucket=BUCKET_NAME,      Policy=policy_string  )FollowComment"

Answer: "0Accepted AnswerIt could happens because of several reasons although mainly related to your credentials or your policy. Anyway, you just follow the permission specifications that say how to grant everything with a wildcard as I see in your codeAn example from Amazon Docs can shed a light"Action": "*"  "Action": "s3:*"  The other reason, additional to the one above, is your credentials. For example, if you use AWS CLI$ aws configure  AWS Access Key ID \[None]: AKIAIOSFODNN7EXAMPLE  AWS Secret Access Key \[None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY  Default region name \[None]: us-west-2  Default output format \[None]: jsonCommentShareharshmanvaranswered 4 years ago"


Question: Scale errors on simple CloudWatch Dashboard

"I have a very simple CloudWatch DashboardJust show CPU and Memory usage of my ECS service.The CPU value in the tooltip is ok, but the scale is wrongThe scale must be between 0 an 100, but is showing a weird 129 for a CPU value of 99,3Any idea about how solve this issue? looks like a AWS error.FollowComment"

Answer: "0Accepted AnswerLooks like you've used the "stacked=true" setting for a Metric Widget, hence you are plotting all metrics on the graph in a "stacked area" visualization.  Only use this for metrics that add up logically.In your case CPU is being added to the Memory below it, giving the 120 value.  Remove the stacked setting, or set it to false (default). Also consider moving the Memory metric to the right Y-axis so the scale of each metric does not "drown out" the detail of the other.CommentShareAmazon-CloudWatch-01answered a year ago0Actually, CPUUtilization of ECS service can go over 100%. It's because this metric is not for CPU utilization of host machine, but rather for CPU utilization of CPU units allocated to your tasks. There are more details in AWS doc.Though for the chart itself - indeed there seems to be an issue somewhere as those figures do not match, but it's not that obvious which one is wrong.CommentShareA-Shevchenkoanswered a year ago"


Question: AWS SES Open tracking not working

"Hi,I have sending html transactional emails to my customers. For this I have enabled SNS topic with an email subscription to monitor open tracking. But it doesn't seem to be working at all. Maybe I am missing something, but I don't see that clearly.I have sent a sample email (html) to myself to test this, but no open metrics are recorded.Message ID010001682c9803f3-1b6a5f21-267c-45be-98cd-2b96b4b35556-000000@email.amazonses.comIn SES Configuration Set, I have following settings:SNSName:OpenEvent types:OpenDomain for Open tracking:Amazon SES Default DomainEnabled:TrueTopic:openCan someone please guide me here?FollowComment"

Answer: 0This helped https://docs.aws.amazon.com/ses/latest/DeveloperGuide/using-configuration-sets-in-email.htmlCommentSharearjneoanswered 4 years ago


Question: Why am i getting EC2 Charge during my free teir?

I am still in the free teir period but for some reason i am incuring some charges. Can someone please explain what might be the problem. I currently have just one instance runningFollowComment

Answer: "0Hi, most likely due to this:When using AWS Free Tier, you might incur charges due to the following reasons:You exceeded the ec2 monthly free tier usage  limits of one or more services.You're using an AWS service, such as Amazon Aurora, that doesn't offer free tier benefits.Your free tier period expired.Check below to find out what exceeded and how to prevent it:https://repost.aws/knowledge-center/stop-future-free-tier-chargeshttps://repost.aws/knowledge-center/free-tier-chargesHope it helps and if does, I would appreciate answer to be accepted so that community can benefit for clarity, thanks ;)CommentShareEXPERTalatechanswered 2 months agoEXPERTkentradreviewed 2 months ago"


Question: Problem with data showing null value when executing Query twice in athena

"I fetched data from S3 from athena and ran a Query that looked at 10 rows.The first run shows the table, the second table gets null values.If you delete the result folder executed in athena from within the bucket, it will be executed again.But I want to check the table without deleting the folder.Thanks for your help.FollowComment"

Answer: "1Accepted AnswerBased on what is happening, it seems as though the query results location is writing into the same location as the Athena table and that seems to be causing the issue. I suggest the following steps to set up another location for the Athena query results.Click on Settings tab in the Athena consoleClick the manage buttonChoose the bucket (Ideally we create a separate bucket for Athena). you can choose a folder result such as bucket-name/athena_results/team_name/user_name. If you end up using the same bucket as the data location, ensure the folder location and the athena results location are different.CommentShareAnanth Tirumanuranswered 7 months ago"


Question: Issue with S3 bucket

"I have created one S3 bucket, and  i deployed my code in that bucket and i try to open that code in chrome with bucketname as url but am getting site can't be reached what is issue ? Can any help me ?FollowComment"

Answer: "0Hello,The bucket should be public:https://aws.amazon.com/premiumsupport/knowledge-center/read-access-objects-s3-bucket/?nc1=h_lsThanksJoelCommentShareJoelanswered a year ago"


Question: RDS Postgres Instance Stuck In Modifying

"I wanted to switch from Magnetic Storage to SSD overnight, and this morning the RDS instance is still in the "modifying" state. I also applied a custom parameter group. Only some of them have been applied, and the instance still says it is using Magnetic storage. I can currently still query the database but am concerned that it has been modifying for 12 hours now. What can I do to troubleshoot this?FollowComment"

Answer: 0Typically changing storage type does not require much time. However you have a large magnetic source volume which requires a full copy. The modify volume process on your instance is still in progress.-PhilCommentShareMODERATORphilawsanswered 2 years ago


Question: CloudFront-Viewer-Postal-Code does not work in Vietnam country

"I configured CloudFront to use the CloudFront-Viewer-Postal-Code header in order to obtain postal codes, and it operates effectively in various regions, including Japan. Nonetheless, in certain countries, like Vietnam (Ho Chi Minh city), I am unable to acquire postal codes using this technique.I am curious if the CloudFront-Viewer-Postal-Code feature has country-specific restrictions.FollowComment"

Answer: "0CloudFront uses Maxmind database to update geo specific information. This data is refreshed on a weekly basis, however, will take up to five weeks to propagate across the worldwide fleet in a phased approach. This slow rollout is intentional to limit the potential impact of a negatively impacting deployment or geolocation dataset.If Geo database installed in CloudFront edge location did not have geo information like Longitude, Latitude or Postal Code, CloudFront will not forward such information to origin though cache policy or origin request policy through headers like:CloudFront-Viewer-Postal-Code,CloudFront-Viewer-Longitude,CloudFront-Viewer-LatitudeTherefore, if the request is made using an IP address that might have been updated in Maxmind databases within the last 5-6 weeks you don't see the 'CloudFront-Viewer-Postal-Code' header for these requests and you would be able to see them updated in 5-6 week time.Thus, the CloudFront team suggest to send requests from different client IP addresses if you need to test CloudFront-Viewer header with your application.[+] GeoRestriction - https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GeoRestriction.htmlCommentShareSUPPORT ENGINEERrePost-User-9353937answered 2 months ago"


Question: Add CloudWatch Log Stream name to Metric filter dimension

"Hello there,I am creating a CW Metric Filter on my Log Group. Inside my log group I have multiple log streams each prefixed with the EC2 instance ID. I want to use the instance ID as a dimension in my metric filter. Is this possible?Resources:  VendorStatusMetricFilter:    Type: AWS::Logs::MetricFilter    Properties:      FilterPattern: "Connection timed out"      LogGroupName: "/my/loggroup"      MetricTransformations:        - MetricValue: "1"          DefaultValue: "0"          MetricNamespace: "MyApp/VendorStatus"          MetricName:  "Status"          Unit: Count          Dimensions:            - Key: InstanceId              Value: ???Is it possible to populate the Dimensions.Value with the log stream name?FollowComment"

Answer: "0I would like to inform you that , Amazon CloudWatch Logs announces Dimension support for Metric Filters. CloudWatch Logs Metric Filters allow you to create filter patterns to search for and match terms, phrases, or values in your CloudWatch Logs log events, and turn these into metrics that you can graph in CloudWatch Metrics or use to create a CloudWatch Alarm. Now with Dimension support for Metric Filters you can create metrics from JSON or space-delimited logs with up to 3 dimensions, where a dimension is a key-value pair that is part of the identity of a metric.Having said that, A dimension is a name/value pair that is part of the identity of a metric. Because dimensions are part of the unique identifier for a metric, whenever you add a unique name/value pair to one of your metrics, you are creating a new variation of that metric. For example, many Amazon EC2 metrics publish Instance Id as a dimension name, and the actual ‘instance ID’ as the value for that dimension[1].Further more, The Dimensions value is from the log event and NOT log stream name. if the log events inside the log stream are JSON or space-delimited and have the instance ID then it can be possibleCommentSharerePost-User-0285377answered 3 months ago"


Question: AWS EFS rest API to manage file and folder of any filesystem

I'm working on research for Amazon EFS.What I figured out:File systemMoute it with ec2 of Linuxmkdir file and share it among different EC2 instances.What I can't findhow to work with files and folders in RestAPIs or in PostmanEven the handling of files is not given in the EFS SDK documentCould anyone please shed some light if it's possible to work with files like upload/download/list/archive with RestAPI or with SDKFollowComment

Answer: "1EFS is network file storage, so it is not possible to upload, download, list, or archive files via Rest API or other means.The only way to do this is to mount and manipulate files from EC2, etc.https://docs.aws.amazon.com/efs/latest/ug/whatisefs.htmlIf this answer leads to a resolution, please approve the answer for the betterment of the community.CommentShareEXPERTRiku_Kobayashianswered 2 months agorePost-User-3543171 a month agoIf that is so, is it possible to work with files using code? Is any client library available?ShareRiku_Kobayashi EXPERTa month agoIf EFS is mounted with NFS, it would be possible to manipulate files using the code.For example, in Python, the "open()" function can be used to open and write files.The "os" module can also be used to delete files.SharerePost-User-3543171 a month agocould you please provide me some documentation for the same or a more detailed version of it? It would be really helpfulShareRiku_Kobayashi EXPERTa month agoThe open() function is documented below.open() is a built-in Python function and can be used as is.https://docs.python.org/3/library/functions.html#openThe following document is the documentation for the os module.The os.remove() function here can delete files.Incidentally, os.mkdir() and os.rmdir() can also be used to create and delete directories.https://docs.python.org/3/library/os.htmlShare"


Question: Increase in S3 charge after versioning is disabled

"customer had disabled the versioning on an S3 bucket. After disabling the Versioning, the timed storage cost went down, however, customer observed increase in the request-tier 2 costs (gets and heads).Some background on this bucket: this bucket is used as a parquet file data lake where data is streamed in from a number of sources.  Databricks is used for querying, notebooks, and reporting dashboards.could you please let us know why the increase in tier2 requests when only versioning was disabledFollowComment"

Answer: "0Accepted AnswerSince nobody has yet to assist you yet I thought I would suggest that perhaps the bucket is in a version-suspended state. While it is not creating additional versions the other applications may be attempting to perform the tier2 requests a scale. Did the customer remove the old versions of objects, or simply turn off bucket versioning?https://docs.aws.amazon.com/AmazonS3/latest/userguide/VersionSuspendedBehavior.htmlCommentShareDavidanswered a month ago"


Question: Does Amazon SageMaker XGBoost support parallel training across multiple machines?

"I'd like to set up Amazon SageMaker XGBoost to train datasets on multiple machines. Is that possible? If so, how?FollowComment"

Answer: "0Accepted AnswerYes, using Amazon SageMaker hosting with XGBoost allows you to train datasets on multiple machines.For more information, see Docker registry paths and example code in the Amazon SageMaker developer guide.CommentShareGili Nachumanswered 3 years ago"


Question: Elstic Benstalk not terminating

"I deleted the application from elstic beanstalk instead of terminatioong the envirnment, sicne then the termination window is still spinning by auto-refesing.FollowComment"

Answer: "2It seems similar to the problem here.We have confirmed that the same issue will be automatically deleted after a period of time.https://repost.aws/ja/questions/QUrXZ-TK1iQ9KQNjTcEpkP5Q/delete-elastic-beanstalk-environment-delete-environment-option-disabled#ANVhS7DaJ1S_y__ts9WDEVnACommentShareEXPERTRiku_Kobayashianswered 14 days agoEXPERTsedat_salmanreviewed 13 days ago0Accepted AnswerThank You for your response. Yes, it took a while but all cleared.CommentSharerePost-User-6068875answered 13 days ago"


Question: Workspaces Image deployment - How do we preserve the user data on D drive

"A customer will build new images (based on different versions of applications embedded/installed on Workspaces).They have C: drive which is a system drive and a D drive which has user data.Question: When they redeploy a new image, they have to define a new bundle where they define the new C and D drives again.Is there an automated way to restore the contents of old customer data on his/her D Drive which was there before the new image was deployed?What the ways to take a snapshot of the D drive and restore them when a new image is deployed?FollowComment"

Answer: "0Accepted AnswerIn general, I think they're looking at this wrong. First WorkSpaces snapshot the D drive every 12 hours. Under normal usage, rebuilding a WorkSpace (redeploying the OS from the bundle) will restore their profile from that last Snap. As long as the customer is updating the bundle properly / rather than creating completely new ones, they can update the existing WorkSpace without nuking the D drive.If they want to leverage constant rebuilds, I would suggest looking at partners that offer profile layering and/or Windows File and Folder redirection. This gets the profile off the system and makes it more disposable.This is a lot of work for little to no payoff. WorkSpaces are designed to be persistent. So leveraging post-deployment tools is far more efficient and creates less potential for issues.CommentShareEXPERTJustin_Sanswered 4 years ago"


Question: How can I use AWS Glue to split a file by number of lines?

"I have a file that contains about 1000 lines currently stored in an S3 bucket, and I want to split this file into smaller files (about 200 - 500 lines/file).I have searched for internet and only found solution to merge files into a larger file only.  Can I use Glue to custom output file by lines? Or I should use any other method? I would very thankful if you can guide me the procedure.Thank you so much!FollowComment"

Answer: "1Accepted AnswerHello,As you mentioned you have only 1000 lines file which is quite small and for this purpose instead of using Glue ETL Spark job(It is recommended to process large amount of data) I would suggest to use below shell command which you can execute on Ec2 instance.aws s3 cp s3://sourcebucket/csv/nycflights13.csv - | split -d -l 200 --filter "aws s3 cp - \"s3://destbucket/csv/bigdata_\$FILE.csv\""Also you can use Glue python shell job and execute above shell command. [1]Reference:[1] Execute shell command using Python: https://www.codingninjas.com/blog/2021/06/25/how-to-execute-shell-commands-with-python/#:~:text=The%20naive%20approach%20to%20run,function%20that%20executes%20shell%20commands.CommentShareShubham_Panswered 10 months ago"


Question: What happens when you give TimeStream a timestamp in the future?

"I am testing some calculations in DraftSight that come from TimeStream. I an using an IOT thing to send a timestamp to AWS, a rule to insert the packet into TimeStream. When I send a timestamp in the past it seems to show up in TimeStream. When I send a timestamp from in the future it seems to not show up. I am not sure though if it is latency or if timestream is rejecting the entry because the timestamp is in the future.Does TimeStream reject timestamps from the future?FollowComment"

Answer: "4Accepted AnswerHello AWS Customer,I understand you are trying to send a timestamp from in the future and it seems to not show up.So, according to this timestream quota document: https://docs.aws.amazon.com/timestream/latest/developerguide/ts-limits.html#limits.defaultFuture ingestion period in minutes --> The maximum lead time (in minutes) for your time series data compared to the current system time. The default value is 15 minutes. For example, if the future ingestion period is 15 minutes, then Timestream will accept data that is up to 15 minutes ahead of the current system time.So, you might be providing the future time which is greater than 15 minutes of the current system time. However, if your input future time is within 15 minutes and still not able to see the timestamp, i would recommend you to open a case with AWS Premium Support so the engineer can look into the logs/configuration to see if anything is missing/wrong.CommentShareKunal_Manswered a year ago"


Question: Cross-account VPC connection using CDK

I was trying to come up with the best approach for creating cross-account VPC connection using CDK. What is the best recommendation to achieve this?FollowComment

Answer: "0Hello Suman,I understand that you are trying to create cross-account VPC connection using CDK, but you want to know the best way to connect VPCs across accounts. Please let me know if I misunderstood your question. There is no "best" approach for creating cross-account VPC connection, you are free to use any method for VPC peering that you are comfortable with (for example using console, CDK, etc).To to create the VPC peering across account using CDK:Create a stack with the number of VPC's that you wantSynthesize the Cloud Formation for your codeCreate EC2’s and peering connections between the VPC'sPlease note that the CDK is in place such that it does not have dependency on the resource creation.For more information on CDK and VPC Peering please Refer to documentation belowPlease contact if you have any further questions, and feel free to reach out to us via a support case to facilitate a discussion on the specifics of your resources. I have attached some resources to help guide with the AWS CDK and Cloud Formation process, Thank you and Good Luck!https://aws.amazon.com/blogs/devops/cdk-credential-plugin/https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/peer-with-vpc-in-another-account.htmlhttps://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnVPCPeeringConnection.html4.https://docs.aws.amazon.com/vpc/latest/userguide/vpc-peering.htmlCommentShareArish_Tanswered 10 months ago0You can use the following to get started using cdk.CommentSharejthornes-awsanswered 10 months ago"


Question: Will AWS Neuron support a PyTorch model that inferences audio to audio?

"The audio going into the model would be different lengths, and I saw a post saying "At the time of writing, the AWS Neuron SDK does not support dynamic shapes, which means that the input size needs to be static for compiling and inference."Does this mean I can't use Neuron (and therefore Inferentia2) without truncating my audio going into the model to a fixed size? Or am I misunderstanding?FollowComment"


Question: How to pass Cognito user info to a Lambda function

"Hello,I am using a Cognito user pool authorizer in my REST API.I am trying to pass the Cognito user information (e.g. username, user group) from the API Gateway to a Lambda function, i.e. passing it in the 'event' or 'context' of the request.My goal is to query different databases (test/dev/etc.) according to which user group the caller belongs to.What is a good way to proceed in this case?I saw the 'invoke with caller credentials' checkbox in the API Gateway, but it cannot be checked with a Cognito UP authorizer. I also tried switching from a Cognito authorizer to IAM, but don't know what execution role to select.Any help would be greatly appreciated.FollowComment"

Answer: "0I found out: I had to check the "Lambda proxy integration" checkbox in the Integration request of the method.Then the Lambda can fetch the user info from the event object of the lambda handler (e.g. in Python):event['requestContext']['authorizer']['claims']['cognito:groups'](or: 'cognito:username', etc.)Then I could query different databases according to which group the user belongs to.Additional info: it is also possible to assume the user role from within the Lambda function, to make sure to access only what's the user is allowed to (by default only the Lambda function's role is assumed to execute actions); this is very well explained at https://www.youtube.com/watch?v=GDkkDUnICrsCommentSharemanu-lmadanswered 3 years ago"


Question: How do I upgrade MySQL from 5.6 -> 5.7 with custom parameter groups

"We're preparing to migrate our MySQL 5.6 database to 5.7 before the upcoming deadline in March.  Our 5.6 database is using a non-default parameter group (mostly to enable utf-8 character support), and we're not sure what steps to take to ensure that our parameters are carried forward.So far it looks like we need to create a new parameter group for 5.7 and recreate the changes that we had made to our 5.6 parameter group before we perform the actual migration.  Is this correct?  What happens if we just let the database get auto-migrated to 5.7 by RDS?  Will it fall back to the default parameter group for 5.7 or will it attempt to diff changes from the 5.6 parameter group and carry those changes forward?FollowComment"

Answer: "1Accepted AnswerWhen you perform a DB major version upgrade, you'll have to create a new parameter group and add the custom parameter values which you had set currently. Per documentation, "If your DB instance is a member of a custom DB parameter group, create a new DB parameter group with your existing settings that is compatible with the new major version."By default, a version upgrade will switch to default parameter group on the newer version.CommentShareShivam_Ganswered a year ago"


Question: Textract - Not Reading All Columns of a table

"I have noticed an issue when testing with Textract where it is not able to read the entire table. The table has three columns, with the middle column being wide and containing a significant amount of blank space. Unfortunately, this seems to cause Textract to cutoff the reading of the third column. Is there a way to resolve this issue and ensure that Textract reads the entire table?FollowCommentMartin Schade _AWS_ 4 months agoCan you share a sample?Share"

Answer: "0Please see exampleExampleCommentSharerePost-User-9273407answered 4 months ago0Hi,Thanks for using Textract service. The example do shows 4th column is not included in the same table due to 3rd column is blank. Can you please share the sample image so we can investigate the root cause? Thank you!Thanks,ShayneCommentShareAWS-Shayneanswered 3 months ago"


Question: AWS IoT Greengrass (V2) Scheduling Deployment of Components

"Hello,How can I ensure minimal impact on service availability (AWS IoT Greengrass Core Device) while deploying new/updated components? Is there a way to schedule these activities (e.g., maintenance windows)?The Greengrass device is not connect to any client-device, it is the actual device used by users and it may have severe impact on users if it goes down unexpectedly.Thank you,YossiFollowComment"

Answer: "2Accepted AnswerDeployments cannot be scheduled directly, but you can write any logic that you want to defer a deployment on a device until later. This is accomplished using the IPC API "DeferComponentUpdate".See: https://docs.aws.amazon.com/greengrass/v2/developerguide/defer-component-updates-tutorial.htmlCommentShareEXPERTMichaelDombrowski-AWSanswered a year ago"


Question: S3 object and lambda function in step machine with the asynchronous express workflows

"My state machine starts with a MAP state. Inside the Map state,  there are 2 tasks, one after one (task#1 invokes lambda A, task#2 invokes lambda B). The lambda A will process the files conversion, upload those files into S3, and return a S3 object key.  The lambda B will grab the S3 object key from task#1, get the object from S3, and then interact with the third party API.My question is that before the lambda B is invoked, is there a way to notify the state machine that the files have been saved in S3 and ready to be read? Could we implement the S3-EventBridge in the asynchronous express workflows?FollowComment"

Answer: "0Accepted AnswerWhy do you need to notify the state machine about it? Lambda A writes the file and only returns when the file is on S3. Lambda B will not be invoked until Lambda A finishes (assuming they are in sequence and not in a Parallel state).CommentShareEXPERTUrianswered a year agostrange-folk-df787 a year agoMy bad, forget to mention that I am using python boto3 SDK for the lambda. When the uploading through upload_file() is finished, it returns nothing. So I am not sure that it means the files uploading are done or just S3 accepts the API call without an exception.ShareUri EXPERTa year agoShould be done when it returns.Share"


Question: CloudFormation is buggy and won't properly clean up VPC and Internet Gateway

"I'm using the eksctl utility to build and destroy Kubernetes clusters on Amazon EKS. When I delete the CloudFormation stacks, most of the resources are properly destroyed, including the EKS cluster itself. However, the VPC and Internet Gateway are getting hung up, and will not clean up properly. This is leaving my account with a bunch of orphaned VPC resources that I don't want, and contributing to my resource limits unnecessarily. The CloudFormation stacks get stuck in the DELETE_FAILED state.The vpc 'vpc-096bd7c39859b6afb' has dependencies and cannot be deleted. (Service: AmazonEC2; Status Code: 400; Error Code: DependencyViolation; Request ID: 28dda82e-9aa9-4d05-b870-9371d77cee23; Proxy: null)The internetGateway 'igw-0c214b63b8b795b81' has dependencies and cannot be deleted. (Service: Ec2, Status Code: 400, Request ID: 71c41fe9-1247-4a29-ac47-d5c32d29837d, Extended Request ID: null)Question: Can the AWS CloudFormation team fix this, so that the resources are properly cleaned up?FollowComment"

Answer: "2Accepted AnswerAs noted here, do you have any active services associated with LBs in your EKS cluster?If so, you should delete those services through kubectl and wait until the LBs are deleted properly.Also generally it is recommended you use eksctl, or ensure you followed the steps in the above page when deleting clusters.As a last resort, you can try to delete the IGWs and resources, such as ELBs, within the VPC manually to resolve dependencies and clean up resources.CommentShareJason_Sanswered a year agoAWS-User-7755424 a year agoYes that is the case. Thanks for pointing that out. I actually discovered that by attempting to manually delete one of the VPCs, and noticed there were ENIs attached to it. However, the CloudFormation service could do a much better job of describing why the stack fails to delete.Share"


Question: secure access to RDS DB ans Sonar server from devs laptops

"Hi Team :)I have a SonarQube server + an RDS DB on the same subnet, with an SG that allows all traffic.Would like to know what would be the best approach to secure access to my RDS DB and SonarQube server from CodeBuild and all devs laptops1 - All devs must access the DB and the* sonarQube server*2 - AWS CodeBuild also must be allowed to access the Sonar server (add CodeBuild IP range in my SG?)FollowComment"

Answer: "2Accepted AnswerDev access, see: Port Forwarding Using AWS System Manager Session ManagerCodeBuild Access to your VPC, see: Use AWS CodeBuild with Amazon Virtual Private CloudCommentShareEXPERTkentradanswered a year agoJess a year agoThank you Kentrad, I had this error :An error occurred (TargetNotConnected) when calling the StartSession operation: i-0327089515ca31537 is not connected.==>aws ssm start-session --target i-0333089515xx31234 --document-name AWS-StartPortForwardingSession --parameters "portNumber"=["9000"],"localPortNumber"=["9090"] --profile myProfileSharekentrad EXPERTa year agoDo you have the SSM Agent installed and running on your Sonar instance?Share"


Question: Does ModelMutations.update() from flutter to DynamoDB require a primary key?

"https://docs.amplify.aws/lib/graphqlapi/mutate-data/q/platform/flutter/#run-a-mutationReferencing the official, I've been trying to .update() an item I was successfully able to add through the .create(). The mutation response that I receive shows me a successful attempt, but there are no actual updates being made.Tried to make simpler changes, such as switching bools, but same result.Then I remembered that making changes from lambda required the .key() method to check the primary key of the item to be updated. Is there a same check mechanism from flutter/Dart? If so, what would the implementation of that look like?FollowComment"

Answer: "0Accepted AnswerThank you for reaching out us regarding the above query. I would like to share that, for performing update/delete mutation, primary_key for the existing record would be needed for the mutation to be successful.For example, consider the below sample schema, in which 'id' would be used as the primary key :type Todo @model {  id: ID!  name: String!  description: String}Now, in my test setup, i have performed and tested the update mutation in two ways:1. Making the .create and .update mutation in a same function://Creating a recordTodo todo = Todo(name: 'my first todo', description: 'todo description');final request = ModelMutations.create(todo);final response = await Amplify.API.mutate(request: request).response;Todo? createdTodo = response.data;//Updating a record using the returned response for .create()final todoWithNewName = createdTodo.copyWith(name: 'new todo');final request1 = ModelMutations.update(todoWithNewName);final response1 = await Amplify.API.mutate(request: request1).response;Todo? updatedTodo = response1.data;2. Making .update mutation in a separate function//At first, fetching the existing record with idfinal request = ModelQueries.get(Todo.classType,"<passing_record_id>");final response = await Amplify.API.query(request: request).response;Todo? createdTodo = response.data;//then, updating the fetched record final todoWithNewName = createdTodo.copyWith(name: 'updated todo');final request1 = ModelMutations.update(todoWithNewName);final response1 = await Amplify.API.mutate(request: request1).response;Todo? updatedTodo = response1.data;While making the request in both the case, I was able to observe that the update mutation was performed as expected. However, when making the request with incorrect record (i.e, wrong value of id or without id), i observed that it was returning null in the response. Kindly note that the above code is only shared for reference purposes.Additionally, please note that the AWS API plugins do not support conflict detection. If AppSync returns errors about missing _version and _lastChangedAt fields, or unhandled conflicts, then we will have to disable the conflict detection in our API.Please refer to the below links that might be useful to move past this issue:https://docs.amplify.aws/lib/graphqlapi/getting-started/q/platform/flutter/#configure-apihttps://docs.amplify.aws/lib/graphqlapi/mutate-data/q/platform/flutter/https://docs.amplify.aws/lib/graphqlapi/query-data/q/platform/flutter/GitHub Issue Discussion: https://github.com/aws-amplify/amplify-flutter/issues/1434Having said that, in case you face further challenges, please feel free to open a support case with AWS using the following link.CommentShareSUPPORT ENGINEERAbhishek_Sanswered 6 months agorePost-User-6453445 6 months agothank you and sorry, I had this one solved, but forgot to delete.Share"


Question: HIVE_BAD_DATA: Not valid Parquet file:

"Hi Team,Me trying to build Cost and usage analysis using Glue & Athena. Referring https://wellarchitectedlabs.com/cost/200_labs/200_4_cost_and_usage_analysis/2_setup_athena/. While previewing the table facing following error:HIVE_BAD_DATA: Not valid Parquet file: s3://aws-s3-access-inventory/NS/NS-AWS-CUR/20220201-20220301/20220221T114629Z/NS-AWS-CUR-Manifest.json expected magic number: PAR1 got:This query ran against the "cost" database, unless qualified by the query. Please post the error message on our forumor contact customer supportwith Query Id: 28d914a4-7640-4641-9c72-627d48cb02f0The json file does exists in stated folder under bucket.Please assist.Regards,Nikhil ShahFollowComment"

Answer: "0I think those labs might be out of date. This one I know works: https://wellarchitectedlabs.com/cost/200_labs/200_cloud_intelligence/CommentShareAaron Edellanswered a year agoAWS-User-1576695 a year agoHi Aaron,Thank you, will review the lab and confirm.Regards,Nikhil ShahShare"


Question: EC2 stops after Start Instance is initiated

"Hello Team,I'm trying to understand and remediate whats causing one of my ec2 instances to stop after start is selected. I'd recently detached some volumes from a previous instance that has been terminated and attached them to a new instance recently created.The state reason doesn't give any real details as to what is causing this."SourceDestCheck": true,"StateReason": {"Code": "Client.InstanceInitiatedShutdown","Message": "Client.InstanceInitiatedShutdown: Instance initiated shutdown"}The instance id is i-07fdde796e2cd519bEdited by: mcollins on Jun 7, 2021 12:19 PMEdited by: mcollins on Jun 7, 2021 12:21 PMFollowComment"

Answer: "0Hi mcollinsThanks for reaching out :)To my understanding, you did not receive an error code when attempting to start the instance. Did you run the describe-instances command in the AWS Command Line Interface (AWS CLI)?aws ec2 describe-instances --instance-id MYINSTANCE --output jsonAs you have mentioned detaching EBS volumes, I suspect that you might have a Client.InternalError which could be for the following reasons:An Amazon Elastic Block Store (Amazon EBS) volume isn't correctly attached to the instance.An EBS volume that's attached to the instance is in an ERROR state.An encrypted EBS volume is attached to the instance. However, you don't have permissions to access the AWS Key Management Services (AWS KMS) for decryption.For more information on how to resolve this, please see the below link:https://aws.amazon.com/premiumsupport/knowledge-center/ec2-client-internal-error/I hope this helps!CommentSharenaz97answered 2 years ago0Hello Naz97,Thanks for your response.I did run a describe on my instance and it does look like the volumes attached with no immediate error. Here is the json output for the Block Device Mappings associated with the instance.This is what was ran.aws ec2 describe-instances --instance-ids i-019381bb15b76e622 | cat"BlockDeviceMappings": [{"DeviceName": "/dev/xvda","Ebs": {"AttachTime": "2021-06-08T16:40:00+00:00","DeleteOnTermination": false,"Status": "attached","VolumeId": "vol-09b5cf4d16d7963f5"}},{"DeviceName": "/dev/xvdb","Ebs": {"AttachTime": "2021-06-08T16:40:14+00:00","DeleteOnTermination": false,"Status": "attached","VolumeId": "vol-08ace4d37be668dc6"}}Below is the StateReason from the ec2 describe."StateReason": {"Code": "Client.InstanceInitiatedShutdown","Message": "Client.InstanceInitiatedShutdown: Instance initiated shutdown"},I don't see any errors with the volumes; that said one of the volumes is encrypted with aws/ebs kms. Could you point me to some documentation going over the process for getting the instance to use the encrypted volume?CommentSharemcollinsanswered 2 years ago0Hi mcollinsThanks for your response :)Amazon EBS encryption uses AWS KMS keys when creating encrypted volumes and snapshots. In my previous message, I have listed:3. An encrypted EBS volume is attached to the instance. However, you don't have permissions to access the AWS Key Management Services (AWS KMS) for decryption.Please see the last resolution in the below link called "Attached volumes are encrypted"For more information on how to resolve this, please see the below link:https://aws.amazon.com/premiumsupport/knowledge-center/ec2-client-internal-error/Additionally, I have found another link that may help:https://aws.amazon.com/premiumsupport/knowledge-center/encrypted-volumes-stops-immediately/I hope this helps!CommentSharenaz97answered 2 years ago0For the link that was provided: https://aws.amazon.com/premiumsupport/knowledge-center/encrypted-volumes-stops-immediately/We're not getting a "Client.InternalError: Client error on launch" error; we are instead only seeing "Client.InstanceInitiatedShutdown: Instance initiated shutdown". Are they generally one and the same?We've done this with a different ec2 prior to the one we're having issues with and that one started fine. It is also using an encrypted device using the same kms encryption key.The process was done exactly the same only the instance we're having issues with starting has an elastic ip attached.CommentSharemcollinsanswered 2 years ago0For the link that was provided: https://aws.amazon.com/premiumsupport/knowledge-center/encrypted-volumes-stops-immediately/We're not getting a "Client.InternalError: Client error on launch" error; we are instead only seeing "Client.InstanceInitiatedShutdown: Instance initiated shutdown". Are they generally one and the same?We've done this with a different ec2 prior to the one we're having issues with and that one started fine. It is also using an encrypted device using the same kms encryption key.The process was done exactly the same only the instance we're having issues with starting has an elastic ip attached.CommentSharemcollinsanswered 2 years ago0Hi mcollinsThanks for your response.Client.UserInitiatedShutdown: The instance was shut down using the Amazon EC2 API.Operating system shutdown commands always terminate an instance store-backed instance. You can control whether operating system shutdown commands stop or terminate an Amazon EBS-backed instance. For more information, see Change the instance initiated shutdown behavior:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#Using_ChangingInstanceInitiatedShutdownBehaviorAlso, check if your AMI type (PV or HVM) and the volumes are compatible and you are mounting the volumes to the correct device.I hope this helps!CommentSharenaz97answered 2 years ago0Thanks for all of your assistance; I will verify the amis and volumes are compatible.CommentSharemcollinsanswered 2 years ago"


Question: Handle Amazon Seller Central Buyer Messages in Amazon Connect

"Hello All,Is it possible to route Buyer Messages from Amazon Seller Central into Amazon Connect chat?Thanks in advance.LouFollowComment"

Answer: "1Accepted AnswerNot out of the box and I am assuming you are talking about this API, https://developer-docs.amazon.com/sp-api/docs/messaging-api-v1-use-case-guideIf so, you can create an Amazon Connect Task with the link to the order/item/message interface so the agent will get the Task and click on the llink to respond to the customer in amazon.comhttps://docs.aws.amazon.com/connect/latest/APIReference/API_StartTaskContact.htmlCommentShareClarenceChoianswered 4 months agoEXPERTAWS-samfredreviewed 2 months agoLouGibson 4 months agoThanks Clarence, much appreciated.Share"


Question: AWS Rekognition Resiliency

"Hi,New to Rekognition and just had some resiliency related questions that I'm struggling to find the answers for.How are the underlying photos in a collection stored? Does AWS store these in an S3 bucket? If so, is there any need to store the source photos in your own private S3 bucket or is simply having them in a collection sufficient?How are Rekognition collections backed up?Thanks!FollowComment"

Answer: "0Accepted AnswerHI Gary - 2/3 of the way down "Non-storage and storage based operations", it says "Non-storage API operations – In these operations, Amazon Rekognition doesn't persist any information. You provide input images and videos, the operation performs the analysis, and returns results, but nothing is saved by Amazon Rekognition."The API calls you can make for non-storage (and storage, for that matter) are listed >here.<CommentShareDan_Hanswered a year agoGaryTurner a year agoThanks for the link. That makes sense for the non-storage API operations. In our case we'd be using storage based operations because we want to create collections. So when it says this on the storage based operations page:"After you create a face collection and store facial feature information for all faces, you can search the collection for face matches"I assume it's only storing the facial features / template or is it storing the actual photo itself?ShareDan_H a year agoLooks like it doesn't keep the photo, rather the template. "The service does not persist actual image bytes. Instead, the underlying detection algorithm first detects the faces in the input image, extracts facial features into a feature vector for each face, and then stores it in the database. Amazon Rekognition uses these feature vectors when performing face matches."https://docs.aws.amazon.com/rekognition/latest/dg/how-it-works-storage-non-storage.html#how-it-works-storage-basedShare0Image recognition can be from an S3 bucket, or from a local system.If you are storing your images in S3, there are multiple options for backup on S3, I would recommend reviewing those against your business needs for retention.CommentShareDan_Hanswered a year agoGaryTurner a year agoHi, thanks for the answer. I guess my question is more tailored towards the latter. If I create a collection, then index a photo from my local file system, is the photo itself stored anywhere in an S3 bucket behind the scenes or is AWS only storing the metadata for that photo?Share"


Question: Quicksight - Multiple customized email reports

"Hi,The dashboard I created is used by multiple groups of users. Every group applies certain filters (chooses parameters) to view the data they need.I would like to:Setup an email report with parameters (filters) set to specific values. In the email report, the parameters are set to their default value. This works fine when I use the export option: the PDF that is generated is created using the parameter values that I selected.Setup multiple email reports, with every report being sent to one group of users. Currently, I can only create one report. When I try to create a new one, the existing report is overwritten.Is this currently possible?Thanks in advance.FollowComment"


Question: is it possible to creating Control Tower OUs programmatically with selected guardrails?

Hi im am not very familiar with AWS CLI or any iac code there but im looking for an option to create OUs in Control Tower programmatically with a bundle of selected Guardrails. Because the Guardrails based on AWS Config Rules are not put automatically on new created OUs :/.Highly appreciated if there would be a way to iac this creation. We do not want to do this with account factory customization if there it would be possible. We just need the OUs created.FollowComment

Answer: "0Unfortunately not at this time. There are no CLI commands or API calls available for Control Tower actions. OU's can be createad programmatically via AWS Organizations CLI commands. But they will not be registered within Control Tower until that action is performed in the Console. This feature is in high demand, and we hope to release updates for this in the future.CommentShareJimmy_Manswered 10 months ago"


Question: When will Lambda support Ruby 3.x?

"I know that Lambda runtimes doesn't support Ruby 3.x today and is limited to Ruby 2.7.x.  However, I would like to know if/when AWS will add Ruby 3.x runtime support.  Is there anything we can do to encourage it?Ruby 2.7 is EOL soon (March 2023) and Ruby 3.x has been out for 2 years already.  Come on AWS, let's get with the program!FollowCommentrePost-User-3540186 4 months agoI have not seen any updates on this from AWS. How are you getting around this issue for now?Share"

Answer: "3I found an issue on the Lambda Base Images GitHub repo - https://github.com/aws/aws-lambda-base-images/issues/54CommentShareRNHurtanswered 6 months ago1In the interim, consider using Custom Lambda runtimes.CommentShareEXPERTBrettski-AWSanswered 6 months ago"


Question: AWS EC2 running a server on 8080 but cannot connect from outside

(https://repost.aws/media/postImages/original/IM_Ch0O0wWS6Wwh7Xsk1oVWw)0Here is a shot of my inbound rulesenter image description hereI should be able to connect using the domain that is up and running so I can get the index page at http://www.marblecake.net but I can't get my server at http://www.marblecake.net:8080. (My server is a Smalltalk Seaside server running under VAST 11)I can run the server locally using localhost:8080. I have the same problem with FTP in that I can't connect externally (I have removed ftp server for now so don't check that one).Can anyone explain what I have to do further to get to connect to my AWS server please?amazon-web-servicessmalltalkvastFollowCommentChris_G EXPERT10 months agoCan you confirm your server is bound to 0.0.0.0 and not localhost for port 8080 within the configuration of your FTP server?Share

Answer: "0This is sorted. I forgot (as I am usually on a Mac) about Windows Defender Firewall. I have opened up the FileZilla app and port 8080. Everything now works.CommentShareLongHairedDavidanswered 10 months agojtirrell 10 months agoAwesome! I hope my suggestions helped. =-DShare0Good morning,There are a few different things that could be causing this.Is there a firewall on the local machine blocking non-local connections to the port?Is the application listening on localhost:8080 or on 0.0.0.0:8080. If it is the local host then only connections from the local machine would be able to connect to the port. This is usually configured this way in order to use nginx or apache as a reverse proxy to connect to the machine. And is a pretty common configuration.Best practices in AWS would have you deploying this instance into a private subnet and using an ALB in the public subnet to pass traffic to the exposed port. This protects you from inadvertently opening ports to the internet. Like port 3389 which in your image is open to the entire internet. At the bare minimum go into the security group and limit that port to only being accessible to "My IP".CommentSharejtirrellanswered 10 months ago-1Thank you for your response. It is quite complex an answer but I have a very simple question. When AWS set up this instance it included a security setting for port 80, which works fine from my home network. I need port 8080 to work to access my prospective program. At the moment there is only a basic host page working. Can you explain to me why port 80 works but port 8080 doesn't when set up in the same way? My http request isn't getting anywhere - as you can see from the attached Safari response.It is a simple request because 80 is working so can you explain what I must do to get 8080 working please?CommentShareLongHairedDavidanswered 10 months ago"


Question: Getting images from private s3 bucket and display it on the website

"Hello everyone, i am new to aws and i really overwhelmed by all the services that on my screen. I am building a website and i should store some images and pdf files in my database but since its not a good practice i wanted to store these in a cloud service. After some research i found the aws as the best option. I followed some tutorials on the internet about s3, created a bucket and succesfully stored some files. But right now i can only put images to my s3 bucket. I need to display the images on the website for my users but everytime i try there is an "access denied" error message pops up. I am using the right access key and correct iam user. I changed my bucket access to public and it worked but i dont want it to be public. How can i do it? Can you help me please? Thanks.FollowComment"

Answer: 0You can serve content from a private bucket using CloudFront. See this article for setting this up: How do I use CloudFront to serve a static website hosted on Amazon S3?.CommentShareEXPERTkentradanswered 4 months ago


Question: extraneous key [DestinationConfig] is not permitted

I am trying to add the destination config into my cloud formation script. getting an error "extraneous key [DestinationConfig] is not permitted"Properties:DestinationConfig:OnSuccess:Destination: !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:MyErrors2"FollowComment

Answer: 0You don't say but I assume you're referring to https://docs.amazonaws.cn/en_us/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventinvokeconfig-destinationconfig.html - I ask because there is one other place where DestinationConfig is used but it doesn't have an option of OnSuccess so I think I'm in the right place.It would help a lot if you could paste a larger snippet of your CloudFormation template - because what you've given looks ok but it's impossible to tell without the preceding lines.Editing here because it provides better formatting that in commentsOk. You're putting the DestinationConfig part into the AWS::Lambda::Function section - but that's not where it goes. You need to create a different section which is AWS::Lambda::EventInvoke as per the documentation.CommentShareEXPERTBrettski-AWSanswered 6 months agoPrakash Paul 6 months agoAWSTemplateFormatVersion: "2010-09-09"Description: "my sync Lambda Functions stack"Parameters:PrivateSubnet1:Type: 'AWS::EC2::Subnet::Id'PrivateSubnet2:Type: 'AWS::EC2::Subnet::Id'PrivateSecurityGroupID:Type: 'AWS::EC2::SecurityGroup::Id'Resources:EmployeeSyncFunction:Type: "AWS::Lambda::Function"Properties:Description: ""FunctionName: "EmployeeSync"Handler: "MyLambda::MyLambda.Functions::SyncEmployees"Architectures:- "x86_64"Code:S3Bucket: "my-lambda-s3"S3Key: "MyApp.zip"MemorySize: 512Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/AWSLambdaBasicExecutionRole"Runtime: "dotnet6"Timeout: 15TracingConfig:Mode: "PassThrough"VpcConfig:SubnetIds:- !Ref PrivateSubnet1- !Ref PrivateSubnet2SecurityGroupIds:- !Ref PrivateSecurityGroupIDEphemeralStorage:Size: 512Tags:- Key: "Project"Value: "My app"ReservedConcurrentExecutions: 100DestinationConfig:OnFailure:Destination: "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:Errors2"Share