Question: Access denied when trying to GET objects uploaded to s3 bucket via aws sdk using cloudfront

"Using client-s3 sdk signed URLs, i was able to PUT and DELETE objects in my s3 bucket. But when trying to access those same objects using a GET request via cloudfront, s3 denies me access (Access Denied) to the objects. On the permissions section of the bucket, i set the bucket policy to allow GET requests from my cloudfront distribution. I know it works because when i upload objects via the s3 console, i can use cloudfront signed URLs to GET the objects from s3, that works. But once i programmatically use the client-s3 to upload the object, i am unable to GET it using my cloudfront distributionFollowComment"

Answer: "1Hi there,Sharing access to objects uploaded to S3I created an IAM user. And that user is what's used to PUT the objects in s3. So it means the policy actions only apply to that user, therefore, that user is the only one allowed to access those objects.I might be misinterpreting, but if I understand what you're saying, this is not accurate. Once you write an object into your bucket, there are several ways to grant access to others. A few common examples include:The entity is an IAM role or user in your account whose IAM policy allows S3 access (e.g. s3:GetObject). Your root user will have full access by default.If the entity is an anonymous user (any non-AWS authenticated request), the S3 bucket policy or an individual object's ACL allows anonymous reads.If the entity is an IAM principle from another account, then both the principle's IAM policy and your S3 bucket policy need to grant the principle permission to S3.Your IAM users or roles can generate an S3 signed URL for a given object (assuming they have this permission via an IAM policy). Anyone with that URL can access your object as long as the URL hasn't expired.You set up a CloudFront distribution with an S3 bucket as it's origin and your bucket configuration is correct. If you're using SSE-S3 encryption, you must also use a CloudFront Origin Access Identity (OIA). If you're using SSE-KMS, you must use Lambda@Edge and to modify the request to allow the object to be decrypted (otherwise, you will get an access denied; see this blog post for detailed instructions).There are certain scenarios where the above methods won't work (or won't work without additional steps). For example, a DENY in a bucket policy will always overrule an ALLOW in an IAM policy, and vice versa. Per #5, using SSE adds additional requirements.Identity used by CloudFrontI am guessing cloudfront is using the root user of my account to access the objects in the bucket, thats why its getting denied access. So my new question is, how do i make it that cloudfront accesses the bucket as the user i created as opposed to the root userThis is not accurate. When communicating with your S3 bucket, CloudFront cannot use your root identity or any other IAM identity in your account. You should think of CloudFront like any other anonymous user (i.e. does not have an IAM identity), with one key exception: you can optionally create a special type of CloudFront user called an Origin Access Identity (OAI) and attach it to your CloudFront Distribution. Similar to an IAM identity, you can refer to this OAI in your bucket policy and grant CloudFront access to your bucket.Why CloudFront can't access objects you create with the client-s3 SDK?Under the hood, the S3 web console, AWS SDK, and AWS CLI all use the same S3 REST APIs.Therefore, if you receive errors when uploading an object from the web console but do not receive errors if uploaded with the S3 SDK, that means one or both of only two possibilities:When uploading objects, the AWS principle (i.e. IAM user, role, or account root) you're using in the S3 web console is from an AWS account that is not the same as the account you use with the S3 SDK. TLDR; things get a bit more complicated if Account A uploads objects to Account B's bucket and Account B wants to read them or share them with others outside of Account B. I'm guessing you're doing everything from a single AWS account and if so, we can rule this out.While the same API (PutObject) is used in both methods, the parameters issued are different, and you're getting an error because a parameter is either missing or has the wrong value with your SDK.#2 is almost certainly your problem, but without performing a detailed comparison of the settings you're choosing in the web console vs. the s3 SDK, but I can't say for certain. If this is the cause, the two settings I can think of that might cause a problem are:S3 Object ACLEncryption settings - depending on whether you're using server-side encryption and which method you use can impact whether CloudFront can read from S3.CommentSharemwrbanswered a year agoInfinityString a year agoThanks a lot. I just came to that theory about the identity being the issue because i just couldn't figure out the problem. Yes i'm doing everything from a single AWS account, so it can't be #1. As for #2, ACLs and server side encryption are disabled on my bucket. I haven't enabled SSE yet, because i want things to work first.If there's anything you need to help investigate the issue further, I will provide. Thanks again for your timeShare0Accepted AnswerApparently, the issue was from how i was naming the object in the bucket. I added a timestamp in ISO8601 format to each objects' name when creating the s3 presignedUrl for the PUT request. So when cloudfront tries to access it, it changes the some of those weird characters in the date string, and as a result, s3 denies access. Because the object cloudfront is trying to access doesn't exist. Thanks for the helpCommentShareInfinityStringanswered a year ago0Are you using ACLs in your bucket, by any chance? It sounds as though when you PutObject via the SDK, there is an object ACL being applied which prevents CloudFront from accessing it, despite this being allowed via your Bucket policy. We recommend that you disable ACLs, except in unusual circumstances where you do need to control access to objects individually: https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.htmlYou can disable ACLs via the Object Ownership section on the permissions tab of your bucket, in the console.CommentSharePaul_Lanswered 2 years agoJason_S 2 years agoAgreed and it should be checked and verified.However, as far as I know, SDKs should not put any ACL on objects unless it's explicitly done so through setObjectAcl https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/examples-s3-access-permissions.html#set-the-access-control-list-for-an-objectShareInfinityString 2 years agoACLs are disbaled in my bucket. I use the bucket policy only.@Jason_S I don't use s3 pre signed URLs at all for GET. i am trying to use a cloudfront URL for that functionality. Although prior to deploying a cloudfront distribution, i used different s3 presigned URLs for GET and PUT, and that worked fineShareJason_S 2 years agoCan you please share the code sample where you generated the CloudFront signed URL, including the import statements, if possible. thanksShareInfinityString 2 years ago@ Jason_S i actually used a hacky solution to do this. I am using the aws sdk v3 for javascript on my project. But at the moment, the sdk v3 doesn't support signed URLs for cloudfront, so i am running a shell command in aws-cli to get the signed URL and returning that URL to the client.Here's the code:import { Arg, Ctx, Mutation, Resolver, UseMiddleware } from "type-graphql";import { exec } from "shelljs";import path from "path";import dayjs from "dayjs";async getSignedFileFromS3(@Arg("key") fileName: string): Promise<string> {const time = dayjs().add(60, "second").unix();const keyPairId = process.env.AWS_CLOUD_FRONT_KEY_PAIR_ID;const pathToPrivateKey = path.join(__dirname,"/../../../awsKeys/private_key.pem");const signedUrl = exec(aws cloudfront sign --url ${process.env.AWS_CLOUD_FRONT_DOMAIN}/${fileName} --key-pair-id ${keyPairId} --private-key file://${pathToPrivateKey} --date-less-than ${time});return signedUrl;}Share0If you want to get signed URL fron CloudFront, you should use CloudFront SDK. S3 SDK will give you S3 pre-signed URL.That is assuming that you have setup CloudFront OAI correctly in your S3, which seems to be true based on your question.CommentShareJason_Sanswered 2 years agoInfinityString 2 years agoI am able to get cloudfront signed URLs. The issue is that i can't access objects uploaded via s3 pre-signed URLs using the cloudfront signed URL. s3 denies me access to those kind of objects. I am thinking its a permission issue, but i am not sure about what to changeShareJason_S 2 years agoJust to clarify, are you using the same pre-signed URL you use for the PUT operation for the GET?If so, can you please try to have two pre-signed S3 URLs, one for the PUT another for the GET, specifically with different HTTP verb in SDK?Share0I think i figured out the issue. I created an IAM user. And that user is what's used to PUT the objects in s3. So it means the policy actions only apply to that user, therefore, that user is the only one allowed to access those objects. I am guessing cloudfront is using the root user of my account to access the objects in the bucket, thats why its getting denied access. So my new question is, how do i make it that cloudfront accesses the bucket as the user i created as opposed to the root userCommentShareInfinityStringanswered 2 years ago"


Question: Cross Account Copy S3 Objects From Account B to AWS KMS-encrypted bucket in Account A

"My Amazon Simple Storage Service (Amazon S3) bucket in Accounts A is encrypted with a AWS Managed AWS Key Management Service (AWS KMS) key.I have created lambda function to copy objects from Account B to Account A which has AWS Managed KMS key used as Server Side Encryption on S3 bucket.When function executes and tries to copy objects from AWS account (Account B) to  Account A S3 bucket, I get an Access Denied error.I came across an Knowledge-center article which talks about the same scenario **except one difference ** and In that they are talking about **Customer Managed Key ** server side encryption mechanism.Because they have using Customer Managed Encryption Key they are able to modify KMS policy to allow Lambda function Role ARN permission to the kms:Decrypt action.As mentioned earlier, S3 bucket encrypted with AWS managed keys, we cant modify the key policy because it is managed by AWS.So, my question is how do we copy objects from S3 buckets from Account B to Account A ( with AWS Managed KMS encryption enabled)?Reference Links:https://aws.amazon.com/premiumsupport/knowledge-center/cross-account-access-denied-error-s3/Changing a key policy documentationhttps://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying.html#key-policy-modifying-how-to-console-policy-viewThanks in advance.FollowComment"

Answer: "0Hi, as it says in the Reference Link you provided, "Because AWS managed KMS key policies can't be updated, cross-account permissions also can't be granted for those key policies. Additionally, objects that are encrypted using an AWS managed KMS key can't be accessed by other AWS accounts".If you want cross-account access you have to use a customer-manager KMS master key.CommentShareEXPERTskinsmananswered a year ago0@skinsman - Thanks for your input. I understood it. If that's the scenario then there is one part that I would like to understand.As I mentioned that, Account A has AWS Managed Key (KMS) encryption set on S3 bucket So when I performed **the similar lambda function execution on Account A to copy objects to Account B (Server side encryption - SSE-S3) s3 bucket **then it successfully copied.Only when I was copying objects from Account B to Account A then I was getting an error message "Access Denied".Can you please help me understand that?CommentShareSwwapnilanswered a year ago"


Question: Node unable to resolve dns on aws lambda function "getaddrinfo "

"I have a simple HTTPS request that works well on my local envoiremnt. But on aws lambda it works for some urls only and for other urls it can't be resolved and I'm getting this error:"Error: getaddrinfo ENOTFOUND myUrl.co.il","    at GetAddrInfoReqWrap.onlookup [as oncomplete] (node:dns:107:26)"The script is just a simple https request: const params = {        host: event.url , //  event.url is without https! just the DNS        path: "/login",    };    const req = https.request(params, function(res) {        let data = '';        console.log('STATUS: ' + res.statusCode);        res.setEncoding('utf8');        res.on('data', function(chunk) {            data += chunk;        });        res.on('end', function() {            console.log("DONE");            console.log(JSON.parse(data));        });    });    req.end();};**  When event.url = url1 it work on lambda and my local but when event.url = url2 it work only on my local, on lambda I got the getaddrinfo error.** If i replace the event.url with the url ip address and add rejectUnauthorized:false" it will work on both urls on both envoiremnt. (ofc i dont like this solution , it just to demonstrate that the issue is with the dns resolver on aws lambda envoiremnt)FollowComment"

Answer: "0I don’t suppose url2 on your local machine is in your host file?CommentShareGary Mcleananswered a month agoBennyh960 a month agoI'm not sure what do u mean? both , url1 and url2 are just example to demonstrate that some url can't be resolved.ShareGary Mclean a month agoYeah I was checking what ever url your not having an issue with wasn’t in your host fileShare"


"Hello,i don't arrive to create an post request for create an multpi part upload. Today, i arrive to upload or download a little file on my bucket but, with an upgrade, i would like upload an big file. In the documentation i see this : "https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateMultipartUpload.html"  for create the request, i use this : "https://docs.aws.amazon.com/fr_fr/general/latest/gr/sigv4-signed-request-examples.html" with the different change but, i can arrive to make the request, i have the error "Signature problem" i try different solution but, the result it's the same. Do you havec any solution for fixe my bug, or an other python code ? It's really important for my application.# Copyright 2010-2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.## This file is licensed under the Apache License, Version 2.0 (the "License").# You may not use this file except in compliance with the License. A copy of the# License is located at## http://aws.amazon.com/apache2.0/## This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS# OF ANY KIND, either express or implied. See the License for the specific# language governing permissions and limitations under the License.## ABOUT THIS PYTHON SAMPLE: This sample is part of the AWS General Reference # Signing AWS API Requests top available at# https://docs.aws.amazon.com/general/latest/gr/sigv4-signed-request-examples.html## AWS Version 4 signing example# GET file from S3 bucket# See: http://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html# This version makes a GET request and passes the signature# in the Authorization header.import sys, os, base64, datetime, hashlib, hmacimport requests # pip install requestsfrom urllib.parse import urlparsefrom requests_toolbelt.utils import dump# ************* REQUEST VALUES *************bucket_name = <name bucket>region = 'eu-west-3'endpoint = f'https://{bucket_name}.s3.{region}.amazonaws.com/test_slicer.waypoints'method = 'POST'service = 's3'host = f'{bucket_name}.s3.{region}.amazonaws.com'request_parameters = 'uploads'# Key derivation functions. See:# http://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html#signature-v4-examples-pythondef sign(key, msg):    return hmac.new(key, msg.encode('utf-8'), hashlib.sha256).digest()def getSignatureKey(key, dateStamp, regionName, serviceName):    print(f'key : {key}')    kDate = sign(('AWS4' + key).encode('utf-8'), dateStamp)    #for i in range(0,len(kDate)):        #print(int(kDate[i]))    #print(" ");    kRegion = sign(kDate, regionName)    #for i in range(0,len(kDate)):        #print(int(kRegion[i]))    #print(" ");    kService = sign(kRegion, serviceName)    #for i in range(0,len(kDate)):        #print(int(kService[i]))    #print(" ");    kSigning = sign(kService, 'aws4_request')    #for i in range(0,len(kDate)):        #print(int(kSigning[i]))    #print(" ");    return kSigning# Read AWS access key from env. variables or configuration file. Best practice is NOT# to embed credentials in code.access_key = <my acces key>secret_key =<my secret key>if access_key is None or secret_key is None:    print('No access key is available.')    sys.exit()# Create a date for headers and the credential stringt = datetime.datetime.utcnow()amzdate = t.strftime('%Y%m%dT%H%M%SZ')datestamp = t.strftime('%Y%m%d') # Date w/o time, used in credential scope#amzdate="20220105T164100Z"# ************* TASK 1: CREATE A CANONICAL REQUEST *************# http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html# Step 1 is to define the verb (GET, POST, etc.)--already done.# Step 2: Create canonical URI--the part of the URI from domain to query # string (use '/' if no path)canonical_uri = urlparse(endpoint).path# Step 3: Create the canonical query string. In this example (a GET request),# request parameters are in the query string. Query string values must# be URL-encoded (space=%20). The parameters must be sorted by name.# For this example, the query string is pre-formatted in the request_parameters variable.canonical_querystring = request_parameters# Step 6: Create payload hash (hash of the request body content). For GET# requests, the payload is an empty string ("").payload_hash = hashlib.sha256((canonical_querystring).encode('utf-8')).hexdigest()# Step 4: Create the canonical headers and signed headers. Header names# must be trimmed and lowercase, and sorted in code point order from# low to high. Note that there is a trailing \n.canonical_headers = 'host:' + host + '\n' + 'x-amz-content-sha256:' + payload_hash + '\n' + 'x-amz-date:' + amzdate + '\n'# Step 5: Create the list of signed headers. This lists the headers# in the canonical_headers list, delimited with ";" and in alpha order.# Note: The request can include any headers; canonical_headers and# signed_headers lists those that you want to be included in the # hash of the request. "Host" and "x-amz-date" are always required.signed_headers = 'host;x-amz-content-sha256;x-amz-date'# Step 7: Combine elements to create canonical requestcanonical_request = method + '\n' + canonical_uri + '\n' + canonical_querystring + '\n' + canonical_headers + '\n' + signed_headers + '\n' + payload_hash#print(canonical_request)# ************* TASK 2: CREATE THE STRING TO SIGN*************# Match the algorithm to the hashing algorithm you use, either SHA-1 or# SHA-256 (recommended)algorithm = 'AWS4-HMAC-SHA256'credential_scope = datestamp + '/' + region + '/' + service + '/' + 'aws4_request'string_to_sign = algorithm + '\n' +  amzdate + '\n' +  credential_scope + '\n' +  hashlib.sha256(canonical_request.encode('utf-8')).hexdigest()# ************* TASK 3: CALCULATE THE SIGNATURE *************# Create the signing key using the function defined above.signing_key = getSignatureKey(secret_key, datestamp, region, service)# Sign the string_to_sign using the signing_keyprint(string_to_sign)signature = hmac.new(signing_key, (string_to_sign).encode('utf-8'), hashlib.sha256).hexdigest()signature_bis = sign(signing_key,string_to_sign)for i in range(0,len(signature_bis)):    print(signature_bis[i])    #print(signature)# ************* TASK 4: ADD SIGNING INFORMATION TO THE REQUEST *************# The signing information can be either in a query string value or in # a header named Authorization. This code shows how to use a header.# Create authorization header and add to request headersauthorization_header = algorithm + ' ' + 'Credential=' + access_key + '/' + credential_scope + ', ' +  'SignedHeaders=' + signed_headers + ', ' + 'Signature=' + signature# The request can include any headers, but MUST include "host", "x-amz-date", # and (for this scenario) "Authorization". "host" and "x-amz-date" must# be included in the canonical_headers and signed_headers, as noted# earlier. Order here is not significant.# Python note: The 'host' header is added automatically by the Python 'requests' library.headers = {'x-amz-date':amzdate, 'Authorization':authorization_header, 'x-amz-content-sha256':payload_hash, 'Content-Length': '7'}# ************* SEND THE REQUEST *************request_url = endpoint + '?' + canonical_querystringwith open('test_slicer.waypoints', 'rb') as data:    r = requests.put(request_url,headers=headers, data=request_parameters)print('\nBEGIN REQUEST++++++++++++++++++++++++++++++++++++')print('Request URL = ' + request_url)#r = requests.put(request_url, headers=headers)print(r.request.url)print(r.request.body)print(r.request.headers)data = dump.dump_all(r)print(data.decode('utf-8'))print('\nRESPONSE++++++++++++++++++++++++++++++++++++')print('Response code: %d\n' % r.status_code)print(r.text)print(signature)print(canonical_uri)print(sys.getsizeof(type(data)))FollowComment"

Answer: 0The first thing captured my sight is 'Content-Length': '7' in TASK 4. This header with value is in the request but never on the part of canonical_querystring. You can only add headers that were included in the signature of canonical query stringCommentShareVanswered a year ago


Question: How to fix EC2 Abuse Report

I have got email from AWS that one of my EC2 is infected with malware and may be part of botnet. Can someone please guide me on how to fix this ?Please investigate this reported activity from your AWS Resource.Destination IP: 194.145.227.21Destination Port: 5443Please Review - https://cujo.com/the-sysrv-botnet-and-how-it-evolved/FollowComment

Answer: 0Start here: Infrastructure Domain IncidentsCommentShareEXPERTkentradanswered a year agoSYZYGY1Media 10 months agoKind of an arrogant and lazy response. Not all of us are experts like you.Share


Question: Need to move or clone RDS Instance MS SQL with DB data to another region

"Hi, I have created an Initial RDS Instance with MS SQL and DB Data but it's too slow for me in the California region, I am planning to migrate RDS Instance with DB using a cloud formation template to the Mumbai region, can I anyone help me with the steps?FollowComment"

Answer: "2One solution [1] involves a source RDS DB instance running in the primary Region in its own VPC and subnet. The target RDS DB instance is running in a separate DR Region in its own VPC and subnet. Both the VPCs are accessible via VPC peering. The target database is created from a backup of the source database. The ongoing changes are then replicated from the source using MS-CDC. AWS DMS runs the database migration jobs that continuously replicate data from source to target. AWS DMS runs in a separate Amazon Elastic Compute Cloud (Amazon EC2) instance in the same VPC in the secondary Region.You can also use cross-Region snapshot and restore [2]Note : Depending on the AWS Regions involved and the amount of data to be copied, a cross-Region snapshot copy can take hours to complete.https://aws.amazon.com/blogs/database/set-up-a-cross-region-disaster-recovery-site-for-amazon-rds-for-sql-server/https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CopySnapshot.htmlCommentShareEXPERTAWS-User-Nitinanswered 6 months ago"


Question: Some Redshift questions

"Hi @Everyone,Could someone enlighten me?What is the difference between a clustered index and a SORTKEY?In redshift the concept of index has been substituted by SORTKEY, right?Can I partition tables like in transactional DB in RedShift?What consideration I should take when it comes to selecting between a SORTKEY or DISTKEY?Sorry for asking several questions at the same time.Highly appreciate the clarificationsFollowComment"

Answer: "2Accepted AnswerHi Amy,Thank you for reaching out.Please find the answers to your questions below.What is the difference between a clustered index and a SORTKEY?Answer: Redshift does not support clustered indexes. I understand you are trying to compare the SORT KEY with a CLUSTERED INDEX in some other relational databases. To understand the difference, you will need to understand the columnar nature of data storage in Redshift. This page in the Redshift documentation will help you understand that.In a database system that stores data in rows, the clustered index would physically order the row-level data according to the indexed column. In Redshift, the data on disk is ordered according to the sort key for that column.In Redshift the concept of index has been substituted by SORTKEY, right?Answer: Sort keys in Redshift provide similar benefits a clustered  indexes, that is, order data at storage level to reduce table scans and serve better performing queries.Can I partition tables like in transactional DB in Redshift?Answer: You do not partition tables in Redshift. It stores columnar data in 1 MB disk blocks ordered  by the SORT KEY. The min and max values for each block are stored as part of the metadata. If a query uses a data ranges (say last year or last month or between customer dates), the query processor can use the min and max values in the metadata to rapidly skip over large numbers of blocks during table scans.For example, suppose that a table stores five years of data sorted by date and a query specifies a date range of one month. In this case, you can eliminate up to 98 percent of the disk blocks from the scan.When you query EXTERNAL TABLES (for data stored in Amazon S3) in Redshift using Redshift Spectrum queries, you can restrict the amount of data that Redshift Spectrum scans by filtering on the partition key. You can partition your data by any key on EXTERNAL TABLES. Refer to this documentation.What consideration I should take when it comes to selecting between a SORTKEY or DISTKEY?Answer: Firstly, considering using automatic table optimization, so you don't need to choose the sort key or distribution key of your table.If you want to select them manually, you would have ti understand the patterns of the queries hitting the table. For instance, if recent data is queried most frequently, specify the timestamp column as the leading column for the sort key. Refer to this page.For choosing the right DISTRIBUTION STYLE, refer to the guidelines provided in this page.Again, working with automatic table optimization is recommended so you do not need to worry about choosing the right SORT KEY or DISTRIBUTION KEY.If you have further questions, please feel free to ask.CommentSharebhaumsanswered 4 months agoAmy 4 months agoThank you very much for your answers @bhaums. Really appreciate. Have a nice day!Share"


Question: Shared account App Mesh and Cloudmap - What's the service discovery behaviour?

"My customer is looking at implementing a multi-account/multi-VPC microservice architecture by sharing their App Mesh across accounts.They want to use Cloud Map as a service discovery mechanism and what's not clear to me is how service discovery works in a multi-account scenario.For example, Team X has an account where they deploy their services in ECS and the CloudMap namespace is managed there.How can services in other accounts (in the same mesh) discover services if the namespace is in another account?FollowComment"

Answer: 0Accepted AnswerYou can create a VirtualNode in the target account using AWS Cloud Map as service discovery mechanism pointing to the existing ECS services - look at [1] and [2]. When sharing the mesh across accounts using the AWS Resource Access Manager [3] this virtual node becomes available in the other account and can be accessed like a regular VirtualNode and will automatically route the requests to the services defined via Cloud Map in the target account.You can check out https://github.com/aws/aws-app-mesh-examples/tree/master/walkthroughs/howto-cross-account for an example.[1] https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_nodes.html[2] https://aws.amazon.com/about-aws/whats-new/2019/06/aws-app-mesh-service-discovery-with-aws-cloud-map-generally-available/[3] https://docs.aws.amazon.com/app-mesh/latest/userguide/sharing.htmlCommentShareAWS-User-0788181answered 3 years ago


Question: Amazon EC2 Auto Scaling based on memory utilization

Does the newly scaled up server in aws auto-scaling on basis on memory utilisation support the tomcat8 jvm because our appliacation is running on tomcat8 jvm ?FollowComment

Answer: 0You can scale on memory metric(s). Please check out this other answer: https://repost.aws/questions/QUtRfHUviYSly1N12qyx0KkA/amazon-ec-2-auto-scaling-based-on-memory-utilizationIf you wish to scale on Tomcat memory usage specifically you'll need to extract that metric specifically and send it to CloudWatch metric.sCommentShareEXPERTBrettski-AWSanswered a year agoAWS-User-4628301 a year agohow do we extract tomcat memory usage metric and send it to cloudwatch?ShareBrettski-AWS EXPERTa year agoYou'll need to look at the Tomcat documentation to figure out how to extract the appropriate metric. Once you've done that you can create a custom CloudWatch metric: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/publishingMetrics.htmlShare


Question: How to setup Subdomain for S3 Bucket

"Hi everyone,I have an existing website that resides on a non-aws cpanel server. My domain is registered with godaddy. I created an S3 bucket and would like it to be a subdomain of my main site (ie library.mainsite.com).I've looked through the documentation and help docs. Unfortunately most of the writers assume prior experience and thus omit important steps. Can someone please point me to good beginner documentation for this. I'm getting conflicting information even within the AWS community. Some people are saying create a cname entry. Other people are saying it's nameservers. I'm very confused.ThanksFollowComment"

Answer: 0If you want ssl on your S3 site then note you can't use S3's static website hosting option as ssl isn't supported.  The best way is to use CloudFront with your S3 bucket as the origin.  Have a look at https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/GettingStarted.html.CommentShareEXPERTskinsmananswered a year ago


Question: Private Connectivity Options: AWS Commercial VPC to GovCloud VPC

"Since GovCloud regions are isolated from Commercial regions, vpc peering is not supported.  What (if any) options are there for establishing private VPC connection between Commercial and GovCloud VPCs?FollowComment"

Answer: "0Accepted AnswerGovCloud has physical and logical (network) isolation from the rest of the regions for compliance reasons (mentioned here), so native solutions like VPC peering or TGW attachments aren't available. You can implement S2S VPN over the Internet to establish connectivity.Another option might be to build separate private VIFs/VPN tunnels to a VPC in each region (GovCloud and non-GovCloud) and then route traffic via the on-premises network, but that may not be ideal from a latency perspective.CommentShareEXPERTTushar_Janswered 6 months ago"


Question: IAM role ARN value is invalid or does not include the required permissions for: AWS_ROLE_INTEGRATION ???

"I'm trying to associate a role with an Aurora DB instance, and I'm getting the errorIAM role ARN value is invalid or does not include the required permissions for: AWS_ROLE_INTEGRATIONI can't find an reference to AWS_ROLE_INTEGRATION in the documentation, and the single Google result referring to this "AWS_ROLE_INTEGRATION" leads to a user asking the same question but never getting a response.FollowCommentrpbiwer a year agoHi, did you ever find a solution for this?Share"

Answer: "0Did the role you create have the required policy as described in the following links?https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Authorizing.IAM.S3CreatePolicy.htmlhttps://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Authorizing.IAM.LambdaCreatePolicy.htmlhttps://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Authorizing.IAM.CWCreatePolicy.htmlhttps://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Authorizing.IAM.KMSCreatePolicy.htmlThese might also help:https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Authorizing.IAM.CreateRole.htmlhttps://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Authorizing.IAM.AddRoleToDBCluster.htmlCommentShareKishananswered a year ago0YMMV, but the problem for me was that the "aws:SourceArn" condition on my role's trust policy was set to the wrong ARN. Setting it to the ARN of the resource that needed to assume the role fixed it.CommentSharerpbiweranswered a year ago"


Question: Using AWS Organizations can you create a Cloudtrail Lake in a different account than the Management account

"Looking at the user guide, it seems to imply you can only create the datalake in the management account; which seems counter-intutive since using Control Tower they used to create the combined Cloudtail log in a seperate Log Archive account. Ideally, I'd like to place it in a Security account which seems like where it would belong. Am I missing anything?https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-event-data-store.htmlTo have your event data store collect events from all accounts in an AWS Organizations organization, select Enable for all accounts in my organization. You must be signed in to the management account for the organization to create an event data store that collects events for an organization.FollowComment"

Answer: "0Accepted AnswerCloudTrail now supports Delegated admin capability. You may create an organization level Lake now from the designated Delegated admin account. https://aws.amazon.com/about-aws/whats-new/2022/11/aws-cloudtrail-delegated-account-support-aws-organizations/CommentShareGokultnanswered 5 months ago0Correct, it must be created from the management account as it's for centralized management collecting events from all of the AWS Account in an AWS Org setup.  In terms of support for this feature, there'e an open feature enhancement requesting this for future releases.CommentSharenaelanswered 7 months ago0hey @gokultn trying to create an Org Lake in a delegated admin account but still get messaging saying I must be signed in from management account when I hit create button after selecting include all org events. Is any particular IAM permission also needed?CommentShareaxaanswered 2 months ago0actually I think its a bug, you cannot change an existing event data store to capture events from all accounts after becoming a delegated admin (even tho console gives you the option to). you can create a new event data store that does capture from all accounts though.CommentShareaxaanswered 2 months ago"


Question: "Is there a serverless, codeless way I can send an email with an attachment?"

"Is there a serverless, codeless way I can send an email with an attachment?Is there a way I can do this with Step Functions?The SES v2 API SendEmail action requires building the entire properly formatted and encoded MIME message. Is there any to build such a MIME message codelessly and serverlessly?Is my only option to drop the codeless requirement and use Lambda?FollowComment"

Answer: 0Have you looked into using Amazon Pinpoint? It might be able to support what you are doing.CommentShareRollerblade7answered a year ago


Question: AWS BACKUP - Internal Failure.

We are unable to copy resource tags to your backup because of the Internal Failure.I have an error in an instance that does not generate the backup. Other instances in the same account work normally.FollowCommentWinnie a year agoWhat error are you getting?Share

Answer: 0Troubleshooting AWS Backup https://docs.aws.amazon.com/aws-backup/latest/devguide/troubleshooting.htmlCommentShareVan Hoang Khaanswered 10 months ago


Question: All emails are bouncing for Amazon SES

All the emails are bouncing from Amazon SES. The send and bounce count are same. 2 days back account was under review. Now none of the emails are delivering. Can some one help to debug this.I am getting response id after pushing email.FollowComment

Answer: "0Soft bounce or hard bounce?For soft bounce, check the following items.The recipient's mailbox is full.The recipient's mailbox is temporarily unavailable.Server limits are exceeded.The server is overloaded.For hard bounce, please check the following items.Does the destination email address exist?Is the recipient rejecting the email?CommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: AWS SSO Access for Linux?

"Looking to determine best method to access AWS Linux (RHEL 8) EC2 Instances via SSO.  I have found this resource [here] (https://aws.amazon.com/blogs/security/configure-aws-sso-abac-for-ec2-instances-and-systems-manager-session-manager/), but it still requires the creation of local user’s in each target instance.  Windows handles the incoming SSO users well via Systems Manager, but not Linux.FollowComment"

Answer: "0Why cant you use AWS SSM Session manager to access linux servers?https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/session-manager.htmlCommentShareEXPERTVaibhav_Sanswered a year agoAWS-User-1457068 a year agoI can, but would like to authenticate using SSO - like you can using Windows via Systems Manage and SSO.ShareRodney Lester a year agoYou can use SSO to federate into AWS, with the permission for SSO.ShareAWS-User-1457068 a year ago@Rodney Lester, yes I am using SSO to login to the subordinate AWS account console.  After which, I can login to a Windows EC2 Instance using the same federated account by using the SSO option in Session Manager.  Unfortunately, this option is not available for Linux.How can I login using this federated user into the Linux EC2 Instance?ShareRodney Lester a year agoSee here for how to add session manager permissions to your IAM Role: https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-add-permissions-to-existing-profile.htmlShare"


Question: GameLift Realtime SDK protobuf definitions

"Is it possible to get a copy of the .proto files used by the Realtime client SDKs? I want to port the SDK to JVM, but I am having trouble decompiling the protobuf generated code from the C# SDK.FollowComment"

Answer: "1Hi @gearstache,I've responded to this question on awsgametech: https://forums.awsgametech.com/t/differences-between-c-and-c-aws-gamelift-server-sdk/10812/6Good luck with your project!CommentShareJamesM_AWSanswered a year agoCalumHall a year agoFor anyone looking for the .proto files, they can be found herehttps://pastebin.com/tKkX90jVhttps://pastebin.com/FWFf7SxYhttps://pastebin.com/34PJahDnShare"


Question: Multiple Channels Example

"Hi there,We're trying to understand what the best approach in this case, but we couldn't find any documentation on the matter. Basically, the main question is: should channels reuse some of the resources, or create everything for each channel?For example, CloudFront seems like something that can be reused. However, all examples simply create a new distribution per channel, is it intended?FollowComment"

Answer: 0Seems like we found the answer here: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-limits.htmlLimits will not allow too many channels to exist within a single distribution.CommentShareAleksei Balchunasanswered 2 years ago


Question: [ECS] Blue/Green Not Deploying (Primary taskset tg must be behind listener)

"Hello,I'm using ECS (Fargate) and blue/green deployment.Our last successful deployment was on Jan 28, 2020 12:05 PM (UTC-8:00). An attempt to deploy was made last night at Jan 30, 2020 6:56 PM (UTC-8:00) which failed due to the following error:The ELB could not be updated due to the following error: Primary taskset target group must be behind listener <elb arn>  This ALB has multiple listeners and services and has had no changes and no issues recently. This deployment configuration hasn't been changed in months and deployments have been routine. Since this began all of my deployment steps just say Skipped and i cannot get new code to production. Luckily, the current ecs task is healthy and fine, but this means i cannot get new code out right now which is not good at all.I think this is a bug in ALB or CodeDeploy and i think it might be related to this post https://forums.aws.amazon.com/thread.jspa?threadID=316241.Any help would be great! Thank youRegardsEdited by: kenndel on Jan 31, 2020 11:10 AMFollowComment"

Answer: "0Hi kenndel,I am sorry you are experiencing this issue. We are aware of the problem and some regions are resolved. Could you please share what region your application is running on?Thanks,CommentShareKia-AWSanswered 3 years ago0We are in us-east-1.CommentSharekenndelanswered 3 years ago0Thank you for providing your region. As I am looking into the error message further it seems you're green target group is serving traffic before your deployment takes place.When performing a blue/green deployment, CodeDeploy is expecting to update the traffic on your green target group from 0% to 100%. Thus the production listener for your primary (blue) target group should be the only one receiving traffic before you execute the blue/green deployment. It is failing because it has determined traffic already exists.Can you confirm if this is your setup and if that was intentional?Thanks,KiaCommentShareKia-AWSanswered 3 years ago0Thanks for your response! I can confirm that this is my setup but it was not intentional. This configuration was set up several months ago and we haven't really touched it since then, besides adding a few more listeners to the load balancer itself. Typically, codedeploy will be responsible for shifting the traffic between blue and green and i've never manually adjusted it, i'm not even sure how i'd do that without codedeploy! Any solutions to this would be greatly appreciated, thank you!CommentSharekenndelanswered 3 years ago0Hi kenndelThank you for letting me know, the following link can help walk you through Load Balancer Set Up, Target Groups, and Listeners for blue/green ECS Deployments:https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-groups-create-load-balancer-for-ecs.htmlLet me know if you still need, I am happy to setup a call to walk you through the changes.ThanksKiaCommentShareKia-AWSanswered 3 years ago0Hi Kia, I've reviewed those docs again and i don't think they help my situation. I also have a support ticket in for this issue but I'd love to hop on a call to discuss the fix!CommentSharekenndelanswered 3 years ago0Please check your Private Messages so I can connect with you directly and help you resolve your configuration.CommentShareKia-AWSanswered 3 years ago0This issue has been resolved via a support ticket. I'll be posting the resolution here if anyone comes across it. The problem was, at some point during a deployment, traffic was moved 100% to my Green TG, my Blue TG was set to 0% traffic, but Blue TG was not removed from the load balancer rule. As a result, when i began a new deployment it noticed i had rules for both TGs and backed down. Pretty simple fix but, as i've never looked at the LB for this reason since getting Blue/Green deployments set up i never noticed that the blue TG at 0% was actually a problem, i assumed it just scaled them back and forth from 0 to 100 as needed. I hope this helps someone in the future, here are the steps:Next StepsAs a workaround, please consider to make modifications on load balancer listener rules by following the below steps.1. Modify the load balancer listener rules "lb rule arn" and "other lb rule arn" to point to **target group "green tg name" only and also delete the weight value for target group.**  2. Modify the load balancer listener default rule "lb default rule arn" to point to target group "green tg name".    3. Create a new deployment based on the same deployment group.  Edited by: kenndel on Feb 11, 2020 12:43 PMCommentSharekenndelanswered 3 years ago0The ELB could not be updated due to the following error: Green taskset target group cannot have non-zero weight prior to traffic shifting on listener.80 and 443 ports are listeners and the target groups both are forwarding to port number 80. listener 80 is forwarding to tg-2 and 443 is forwarding to tg-1 in ecs(blue/green) deployment.while updating with new revision number in ecs the revision number is not updating .the deploy stays in blue task set only not moving to green oneCommentShareprathapanswered 2 years ago"


Question: AWS IoT Secure Tunnel Fails to Install

"Context:Installing AWS IoT Greengrass Secure Tunnel Component 1.0.14 to an ubuntu-based device. Previous versions installed correctly. This most recent version triggers with a Java Runtime Environment error, which I can attach if required, though it will exceed the character limit.Question is, where to report this as a bug ? I don't see a separate repo for the secure tunneling component - whats the appropriate reporting avenue for this bug to the iot/greengrass team ?FollowComment"


Question: How do I get console access to a container from ECR launched on App Runner?

"And if this is not possible, how do I run basic commands like php artisan config:cache or other commands that aren't possible in the build for a variety of reasons (such as limitations in docker, etc)?FollowComment"

Answer: "0As of now, using App Runner you don't have access to the running container.You should run those commands as part of your docker file, or consider other container orchestration platforms.CommentShareJason_Sanswered a year agoHooHost a year agoAs noted, this is not always possible because of limitations within Docker, not to mention the headaches that zero access presents when trying to do meaningful debugging. Heroku has a shell feature, why would anyone use App Runner when it is lacking this really basic capability?ShareJason_S a year agoGenerally speaking if you need shell access to do debugging, it's not a good sign. There are other observability options in App Runner such as x-ray. Also it's always the case that you lose some flexibility to get less management overhead. Like I noted, if you need more flexibility such as shell access, choose another container orchestration platform. App Runner offers good amount of value for many usecases, but not for every usecase.ShareHooHost a year agoWell, it's certainly not a good sign for App Runner. If it worked, there wouldn't be any need for this - but it very often does not, in ways that are not observable through any of the mechanisms that are provided (including x-ray). Suggesting we just switch is a fairly naive idea that utterly ignores the delays, costs, and risks involved (not to mention sunk costs), and makes me wonder how much experience you actually have with deploying production-scale images to App Runner or anywhere else (and why you're weighing in, considering this).ShareJason_S a year agoLike I said, generally in any CSP you always trade flexibility for easy of use. App Runner is capable of running some production workload and can scale well in many cases. That does not mean it's for every use case. If shell access is something you have to have, then clearly App Runner is not for you (as of now). For example, ECS has been running large scale production applications for a long time, and yet similar capabilities (ECS Exec) was only added last year.ShareJason_S a year agoYour question specifically asked is whether App Runner supports shell access, and I provided you answer. As matter of fact, many production grade deployment of containers limit shell access, it's an exception rather than the norm. You should be focusing on finding ways to run the init commands within the container image itself, or if there are any limitation you see, state as such. It's not the case that you have to shell into each container to start your application. that's not how containers should scale.ShareShow 2 more comments"


Question: SNS service on Spain region

"I'm trying to configure the SNS service under my account to test sending SMS from Spain region.When I'm on the spain region I don't see the option to configure text messages, but if change to Frankfurt for example, then I see the options on the console menu.What do I need to do to enable SMS for the spain region under my account?ThanksVicençFollowComment"

Answer: "0At the time of writing this, SNS doesn't currently support SMS in the Spain (eu-south-2) region yetSee : https://docs.aws.amazon.com/sns/latest/dg/sns-supported-regions-countries.html for a list of SMS via SNS supported regions.New functionality is being added all the time to regions based on customer feedback. I can tell you this has already been requested, however I can't share any details on when it will be made availableCommentSharerobbradanswered 5 months ago"


Question: Workmail redirect rule not working for Gmail address

Hi there. I've had a redirect rule in place for months to forward my Workmail email to my Gmail account. This was all working fine until yesterday morning when it just stopped working. I'm getting error messages saying 'Local address contains control or whitespace' but I haven't changed anything. How can I resolve this?FollowComment

Answer: "0Hello,Thank you for reaching out with the issue.This error means that the email has a space somewhere in the "to/from email address" or there was a comma or extra character in the to/From line.The error below would show:Amazon.Runtime.Internal.HttpErrorResponseExceptionHandler.HandleException(IExecutionContext executionContext, HttpErrorResponseException exception) Local address contains control or whitespace.So review the sender and destination domain and addressesIf you want to specify the display name ('friendly name') that contains spaces, you should put that sender name in double quotes. Do not forget to escape them:From: "Andrew" <andrew@example.com>;To: "Bob" <bob@example.com>Working with email rulesCommentShareChibuike_Aanswered a year ago"


Question: Amplify does not clean up after app deletion

"I've created and deleted Amplify apps several times.  Regarding deletion, I noticed that Amplify does not clean up the resources it auto-creates.  It left out Cognito user pools with names starting with 'amplify_backend_manager' and a few lambda functions.  Is this normal behaviour, and is there a reason why it does that?FollowComment"

Answer: "1Accepted AnswerIs this normal behaviourYes, it is normal.is there a reason why it does that?The reason for this is unclear, but we assume it is probably due to the split functionality between Amplify Hosting and Amplify Studio.Cognito user pools beginning with amplify_backend_manager and Lambda functions with the following names are automatically created when Amplify Studio is activated. [1]・amplify-login-create-auth-challenge-SHORT_CODE・amplify-login-custom-message-SHORT_CODE・amplify-login-define-auth-challenge-SHORT_CODE・amplify-login-verify-auth-challenge-SHORT_CODE[1] Basics - Manage team access - AWS Amplify Docshttps://docs.amplify.aws/console/adminui/access-management/The above resources will be automatically removed by disabling Amplify Studio before removing the Amplify app.Therefore, if you have been deleting the above resources yourself, we recommend that you disable Amplify Studio before deleting the Amplify application.CommentSharemn87answered 8 months ago"


Question: is it possible to transfer a lightsail instance to another account ?

"Hello,I have 2 accounts ( 1 per compagny ) is it possible to transfer a complete instance from one aws account to the other ?thank you :)FollowComment"

Answer: "0It's currently not possible to transfer an instance from one account to another.Your best course of action would be to download all your content from one instance and upload it to the other (configuration, database, code, assets, etc).CommentShareDavid Ganswered 2 years ago0Ok thank youCommentSharecrealeanswered 2 years ago"


Question: Google Pixel - Play Protect warning blocks test execution

Due to Google Play Protect Warning selenium WebDriver failed to start the application.https://drive.corp.amazon.com/documents/zinnak@/Screen%20Shot%202022-05-05%20at%208.13.09%20PM.pngError:selenium.common.exceptions.WebDriverException: Message: An unknown server-side error occurred while processing the command. Original error: Cannot start the 'com.ambient.escapes.mobile.dev' application. Issue is NOT observed on Samsung devices.FollowComment


Question: PHP-Imagick Enable and Increase MAX Size of php.ini on AWS App Runner

"How to enable php-imagick on AWS App Runner (PHP 8.1) and increase post_max_size, upload_max_filesize, and memory_limit on it?FollowComment"

Answer: "0This is my build.sh file.I tried to enable imagick but no luck yet.How to enable imagick on aws app runner PHP 8.1 runtime?#!/usr/bin/env bashecho "build"sudo yum list installed | grep phpsudo yum remove php*sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpmsudo yum install https://rpms.remirepo.net/enterprise/remi-release-7.rpmsudo yum-config-manager --enable remi-php81sudo yum install php81ln -s /usr/bin/php81 /usr/bin/php# Install Composer & necessary packagesEXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')"php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]then    >&2 echo 'ERROR: Invalid installer checksum'    rm composer-setup.php    exit 1fiphp composer-setup.phprm composer-setup.phpsudo yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpmsudo yum -y install https://rpms.remirepo.net/enterprise/remi-release-8.rpmsudo yum -y updatesudo yum-config-manager --enable remi-php81sudo yum -y install --enablerepo=remi-php81 php81 php81-php php81-php-common php81-php-mbstring php81-php-mysqlnd php81-php-xml php81-php-bcmath php81-php-gd php81-php-intl php81-php-pecl-mcryptsudo yum -y install --enablerepo=remi-php81 --disablerepo=amzn2-core php81-php-pecl-zipsudo yum -y install --enablerepo=remi-php81 php81-php-pecl-imagick-im7sudo yum -y install --enablerepo=remi-php81 php81-php-fpm php81-php-pecl-apcu php81-php-opcacheyum install nginx -y# Install dependenciesphp composer.phar installcp -p .env.staging .envphp artisan key:generatephp artisan config:cachephp artisan config:clearsudo chmod -R 755 ./storage# Install PHP Imagickecho "Installing imagick packages--------------------------------------------------------------------->>>>>"yum install -y libpng-devel libjpeg-devel openjpeg2-devel libtiff-devel libwebp-devel giflib-develyum install -y gcc gcc-c++ autoconf automakepecl install Xdebugsudo service httpd restartyum groupinstall "Development Tools" -yyum install build-essential -yyum install -y tarcurl -OL https://www.imagemagick.org/download/ImageMagick.tar.gztar -vxf ImageMagick.tar.gzcd ImageMagick*./configure --prefix=/ \    --with-bzlib=yes \    --with-fontconfig=yes --with-freetype=yes \    --with-gslib=yes --with-gvc=yes \    --with-jpeg=yes --with-openjp2=yes \    --with-png=yes \    --with-tiff=yes \    --disable-dependency-trackingmake && sudo yum install -y ImageMagick-devel & sudo make installsudo service nginx stopsudo service php-fpm stopyum -y install yum-utilsyum-config-manager --disable 'remi-php*'yum-config-manager --enable remi-php81yum repolistecho 'php devel install----------------------------->'yum install -y php-cliyum install -y php-pearyum install -y php-dev php81-php-devel php-devel pcre-devel makeln -s /usr/bin/phpize81 /usr/bin/phpizeln -s /usr/bin/pecl81 /usr/bin/peclsudo /usr/bin/pecl install imagicksudo echo "extension=imagick.so" > /etc/php.d/imagick.inisudo /etc/init.d/httpd restartsudo service php-fpm startsudo service nginx startecho 'Check imagick installed status'php -m|grep imagickecho "Finish imagick packages--------------------------------------------------------------------->>>>>"# Nginx And PHP-FPM Configurationcp -p /app/scripts/resources/nginx.conf /etc/nginx/nginx.confcp -p /app/scripts/resources/www.conf /etc/php-fpm.d/www.conf# Directory Permissionchown -R :nginx /app/storagechown -R :nginx /app/bootstrap/cachechown -R :nginx /app/publicfind /app/storage -type d -exec chmod 775 {} \;find /app/storage -type f -exec chmod 664 {} \;find /app/bootstrap/cache -type d -exec chmod 775 {} \;find /app/bootstrap/cache -type f -exec chmod 664 {} \;find /app/storage -type d -exec chmod g+s {} \;find /app/bootstrap/cache -type d -exec chmod g+s {} \;setfacl -R -d -m g::rwx /app/storagesetfacl -R -d -m g::rwx /app/bootstrap/cache# Log Configurationln -s /dev/stdout /var/log/nginx/error.logln -s /dev/stdout /var/log/nginx/access.logln -s /dev/stdout /var/log/php-fpm/error.logln -s /dev/stdout /var/log/php-fpm/www-access.logln -s /dev/stdout /var/log/php-fpm/www-error.log# NPM Buildecho "node js, npm install"curl -fsSL https://rpm.nodesource.com/setup_16.x | bash - && yum -y install nodejsyum install gcc-c++ make -yecho "npm install"npm installecho "npm build"npm run buildCommentShareMichaelanswered 15 days ago"


Question: Failure to register V.1.1 AWS deeplens camera on Ubuntu 20.4 LTS

"The problem is related to registering a AWS DeepLens v1.1 CameraI am failing to register a AWS Deeplens camera using machines running Ubuntu 20.4 (focal) and Mint 19.3 (tessa) or ubuntu bionic, with the error:Device not detected.  This is when  trying to follow the *Register an AWS DeepLens v1.1 device * steps on the AWS web console.Trying to go via other forums, I am made to  believe that there is a need to have the awscam package installed on the linux machines. I ama failing to install the package as well, with the error below. Is the a awscam package for debian distributions, and more precisely for Ubuntu 20.4?sudo apt-get install awscamsudo apt-get install awscamReading package lists... DoneBuilding dependency tree       Reading state information... DoneE: Unable to locate package awscamlsb_release -alsb_release -aNo LSB modules are available.Distributor ID:UbuntuDescription:Ubuntu 20.04.4 LTSRelease:20.04Codename:focalFollowComment"

Answer: "0Hi,We do not support Ubuntu 20.04 OS on DeepLens. Are you referring to DeepRacer device?CommentShareAWS-User-5066560answered a year ago"


Question: Need guidance for the next step in my learning process

"Hello Forum.Question: What course or steps do I need to take next in order to learn how to host my websites in the cloud?Below is the experience level I would estimate for myself:PHP, intermediate level, can write code for websites.MySQL, intermediate level, can assemble functional databases.AWS courses I have completed:Pre-Training Questionnaire | duration 1 minuteIntroduction to Amazon Virtual Private Cloud (VPC) | duration: 7 minutesAWS Cloud Practitioner Essentials | duration: 6.0 hoursIntroduction to AWS Identity and Access Management (IAM) | duration: 7 minutesThe AWS Cloud Practitioner Essentials is a great course. It has quite a bit of information. It took me about three (3) days for completion.I have created a root account for AWS. I have also created a IAM account for myself under the root account.I would appreciate any guidance or information that may be provided.Thank you in advance.FollowComment"

Answer: "1Accepted AnswerAWS is vast and to understand different aspects of how to build modern web applications on the cloud, the following would be good to learnFor the front-end, you need to learn the followinghttps://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteHosting.htmlhttps://aws.amazon.com/amplify/https://www.honeycode.aws/For your backend APIs, you should read up abouthttps://aws.amazon.com/api-gateway/https://aws.amazon.com/appsync/https://aws.amazon.com/lambda/https://aws.amazon.com/ecs/https://aws.amazon.com/eks/Apart from this, AWS has a number of other services that can be used in building your web applications.Databases (relational as well as non-relational) - https://aws.amazon.com/free/database/Messaging - https://aws.amazon.com/messaging/ and https://aws.amazon.com/eventbridge/Orchestration - https://aws.amazon.com/step-functions/Load Balancers - https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html and https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.htmlCDN - https://aws.amazon.com/cloudfront/Certificate Management - https://aws.amazon.com/certificate-manager/DNS - https://aws.amazon.com/route53/You should definitely try to get the AWS Solutions Architect Associate and Developer Associate certifications as those will be good starting points to help you better understand how to build modern web applications on the cloud.CommentShareEXPERTIndranil Banerjee AWSanswered a year ago"


Question: "Can't delete EBS volume, not even with the force option"

"Hi Amazon,EBS volume vol-7bd8af0b appears as "in-use" in my account since 2013-03-10, and I cannot delete it, not even with the force option. Although it appears to be in use, I have no EC2 instances running right now.Please help. Thanks.FollowComment"

Answer: "0Accepted AnswerHello! Please take a look at this similar question, it might help you https://repost.aws/questions/QUGwkiBP0XQXGya8gHNsNB7Q/cannot-detach-volumes#ANEYuVFpmlRyKYW0OgQ3DzOgSometimes a volume shows being "in-use" even if you don't have any instances. If this your case (and you don't have a snapshot or AMI associated with that volume), I recommend creating a support case, and they should be able to modify the state to "available" so that you can delete it. If you are unable to create a support case, please mention which region this volume is on.CommentShareSUPPORT ENGINEERFrancisco_Lanswered a year ago"


Question: Create Strategy to alert from email deadlocks in database

Hi.we have the Mysql database with Saas in AWS and I need to know how I do an alert that after a 1minute alarm to me from email with the deadlock?FollowComment

Answer: "0Accepted Answermarcoborges wrote:Hi.we have the Mysql database with Saas in AWS and I need to know how I do an alert that after a 1minute alarm to me from email with the deadlock?Currently there is no support for for lock alerts.For deadlocks the engine should detect them and cancel one of the transactions.For lock waits , something like the following can be run.SELECT trx_id,trx_state,trx_wait_started,trx_requested_lock_id,time_to_sec(timediff(now(),trx_started)) AS time_in_state,lock_type,lock_table,lock_index,lock_dataFROM       information_schema.innodb_trxLEFT JOIN  information_schema.innodb_locksON trx_requested_lock_id=lock_id;KyleCommentShareAWS-User-1731424answered 2 years ago"


Question: Query for S3 objects requested on a specific day - Athena?

"Hi,We sometimes experience a large increase in GET requests to our production S3 bucket. This bucket contains customer assets that are frequently requested. Usually, these assets are requested via CloudFront but sometimes, in this instance, that doesn't look likely as the GET request rate via CloudFront is not correlative to the number of GET requests from the bucket. When this happens, I want to query for the objects that are requested on that specific day so I can find the remoteip requesting.The anatomy of an object key is: public/asset/raw/<accountId>/<hash>/<timestamp>/<assetId>. This bucket was created back in 2017 & thus contains over 40TBs data. I was previously using Athena console to get this information. An example query, if I was looking for the requests from 18/07/2022, would be:SELECT remoteip,    requestdatetime,    requester,    requestid,    operation,    key,    request_uriFROM "s3_access_logs_db"."mybucket_logs"WHERE operation='REST.GET.OBJECT'AND key LIKE 'public/asset/raw/<accountId>/%'AND bucket_name = '<bucketName>AND bucketowner = '<bucketOwner>'AND httpstatus = '200'AND date(parse_datetime(requestdatetime, 'dd/MMM/yyyy:HH:mm:ss Z')) = date '2022-07-18'ORDER BY requestdatetime DESCHowever, due to the bucket being so large & how Athena queries, I will always get a "Please reduce your request rate" error message. I can't find a way to implement exponential backoff in Athena. I thought about adding another condition to only query objects that were created in a specific period but the issue with that is you may miss some object requests. For example, someone, still today, might be requesting an object that was created in 2018 & if I had a condition whereby I only got the requests for objects from 2019-2022, that would be missed. Even if I set the key condition to be an exact match (=) instead of a LIKE, the query still fails as the request rate is too high.Is there a better way to do this rather than Athena or is that my only option &, if so, what is a better way to go about this?FollowComment"

Answer: "0Ideally partitions can be used to only query the information you are interested in saving time and cost by limiting the data to search. With S3 access logs this is made more difficult due to no prefix's being used (solutions discussed https://repost.aws/questions/QUjQHGAO_nQd-PsIKsvfH3HA/partitioning-s-3-access-logs-to-optimize-athena-queries). You could enable data events for this bucket in CloudTrail to then export out to S3 and query with Athena which has better support for partitions so will be possible to scan over a larger data set although this is more expensive due to CloudTrail being involved, information about setting that up here https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#logging-data-events-examplesIf that bucket is public for the purpose of being behind a Cloudfront distribution, access to the bucket can be setup so that only Cloudfront can access the objects and thus preventing any direct access bypassing Cloudfront https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html. If you have any applications that also access the bucket, the policy can be configured so that there access is still allowed.CommentSharelp901answered 9 months ago"


Question: Running a sample application with ROS Melodic and Gazebo 9

"I am following this tutorial in the RoboMaker Developer Guide. After building the base image, the robot image and the simulation one, I have runned the robot application with the following command:$ docker run -it -e DISPLAY -v /tmp/.X11-unix/:/tmp/.X11-unix/ -u robomaker -e ROBOMAKER_GAZEBO_MASTER_URI=http://localhost:5555 -e ROBOMAKER_ROS_MASTER_URI=http://localhost:11311 helloworldsampleapprosmelodicgazebo9robotapp:latestand the simulation application with this other:$ export DISPLAY=:0$ xhost +$docker run -it -e DISPLAY -v /tmp/.X11-unix/:/tmp/.X11-unix/ -u robomaker -e ROBOMAKER_GAZEBO_MASTER_URI=http://localhost:5555 -e ROBOMAKER_ROS_MASTER_URI=http://localhost:11311 helloworldsampleapprosmelodicgazebo9simapp:latestIn order to visualize the simulation application in Gazebo9 I have entered into the simapp image and run the gazebo client with the following commands:$ docker exec -it bold_babbage bash$ cd /home/robomaker/workspace/aws-robomaker-sample-application-helloworld-ros1/simulation_ws$ source /opt/ros/melodic/setup.bash$ source /usr/share/gazebo-9/setup.sh$ source ./install/setup.sh$ rosrun gazebo_ros gzclientThe Gazebo GUI opens inside the Virtual Desktop but the robot stands still instead rotating around the z axis with angular velocity 0.1 rad/s.I obtain the following messagge:[[ INFO]] [[1654096062.809673647]]: Finished loading Gazebo ROS API Plugin.[[ INFO]] [[1654096062.821667855]]: waitForService: Service [/gazebo/set_physics_properties] has not been advertised, waiting...Do you know what could be the cause of this problem?FollowComment"


Question: "how does AWS batch works, how or when does it scale?"

"I have been reading about AWS batch but I cant seem to figure out how it scales,I cant see any settings in AWS Batch console on the trigger of when it should scale or launch a new EC2 instance or something..So please help me understand how it works,say if i created my job queue, job definitions, compute environment, etc. All what is needed to make AWS batch in the dashboard,When i submit a job from an application say a python script, i create a job definition, with job queue name in boto3 and submit.What will happen next? when AWS received the job, it will insert in the queue and launch a single EC2 instance right? Say if I have 2 compute environment setup in my queue, so i Assume it launch a single instance from that compute environment correct?The job queue decides on which of the two compute instance will execute the job?so if I have 2 compute instance in my queue does that mean only these two are used on every job?so what happen if I submit say 100 jobs altogether, is it queued and executed one at a time by either the two EC2 instance until the resources of that instance runs out?How or when does it decide to scale and launch another instance?I need help understanding it please.FollowComment"

Answer: "1AWS Batch is a fully managed service that lets you run batch computing workloads on the AWS Cloud. It automatically provisions the required compute resources, including EC2 instances, and provides you with a simple way to execute batch jobs on those resources.When you submit a job to AWS Batch, the job is placed in a job queue. The job queue determines the order in which the jobs are executed, and can be configured to use either a First In, First Out (FIFO) or a Round Robin scheduling algorithm.The compute resources that are used to execute the jobs are managed in a separate compute environment. A compute environment is a logical grouping of EC2 instances that are used to execute the jobs in a job queue. You can create multiple compute environments and associate them with different job queues, depending on your needs.When you submit a job to a job queue, AWS Batch will check the status of the associated compute environment to determine whether there are any available resources to execute the job. If there are available resources, AWS Batch will start executing the job on one of those resources. If there are no available resources, AWS Batch will wait until a resource becomes available or until you specify a timeout for the job.You can specify the minimum and maximum number of EC2 instances that you want to use in a compute environment. AWS Batch will automatically scale the number of instances up or down to meet your workload needs, based on the number of pending jobs and the defined capacity constraints. You can also use Amazon EC2 Auto Scaling to fine-tune the scaling process and to add additional custom logic to the scaling process.CommentShareSeanSianswered 5 months agoAWS-User-1548652 5 months agoOK, thank you for your answer.How do I make sure that my AWS batch is scalable, as you mentioned in your answer, if there are no resources available, it will wait until a a resources is available.Our requirement is to prevent waiting but instead, if there are no available resources, it will make one to speed up process. How can we acheive that?Share0If i got you correctly, AWS engineers have you covered, dont know about your exact system, but you can do thisUse Amazon EC2 Spot Instances for your compute resources. Spot Instances allow you to take advantage of spare EC2 capacity at a significantly lower price than On-Demand Instances.Use Amazon EC2 Auto Scaling to automatically scale your compute resources up or down based on the workload. You can set up a policy to scale out when the number of queued or running jobs increases beyond a certain threshold, and scale in when the workload decreases.Use Amazon EC2 Fleet to automate the management of your compute resources. EC2 Fleet allows you to specify a target capacity and automatically launches the required number of Spot Instances or On-Demand Instances to meet your capacity needs.Use Amazon CloudWatch alarms to monitor the queue size and the number of running jobs, and trigger an automatic scaling action based on the threshold that you set.As always AWS is a business, there will be additional costs involved and many of the the products are structured to segment and get marginal value from different customer groupsCommentShareSeanSianswered 5 months agoAWS-User-1548652 5 months agoThank you for your answer.My Job queue is already using a Spot instance for compute environment, does this mean I am good to go and I dont need to worry as this will scale by its own?Also from your comment "We can set up a policy to scale out when the number of queued or running jobs increases beyond a certain threshold, and scale in when the workload decreases."I cant seem to find where in the AWS dashboard i can find the scale out settings to set the job threshold, can you point me please? :)Share"


Question: Compute Optimizer is no longer able to read CloudWatch memory metrics ?

"I have installed CloudWatch agent in several EC2s in several accounts in different regions but from a more than a month ago Compute Optimizer is unable to read the Memory Metrics, has AWS changed something on the permissions?The CloudWatch agent is generating the metrics:Am I missing something ?Kind regards.FollowComment"

Answer: "0Hello! There are a number of different permissions which are required for Compute Optimizer to access the metrics and then also for those recommendation to be viewable to you. To view EC2 metrics in Compute Optimizer, the user/role you are logged in with would need the ec2:DescribeInstances permission. To view CloudWatch metrics in Compute Optimizer, you would need the cloudwatch:GetMetricData permission. (Source: https://docs.aws.amazon.com/compute-optimizer/latest/ug/security-iam.html)From a Compute Optimizer perspective, I recommend you leverage a service-linked role (if you aren't already). This will ensure that Compute Optimizer has all of the permissions it requires to interact with other services. I've included a link to how to recreate the role if it has been inadvertently removed. https://docs.aws.amazon.com/compute-optimizer/latest/ug/using-service-linked-roles.htmlHope this is helpful!CommentShareMVR-060709answered 25 days ago0Hello @MVR-060709,Thanks for your input. I have checked again the configuration and nothing has change from my side:And as I said before, is happening in several accounts accros several regions.Kind regards.CommentShareHigheranswered 25 days ago"


Question: Concurrency scaling with Redshift Serverless

"Concurrency scaling is supported even with Redshift Serverless? seems like there is no documentation around this for AWS Reshift Serverless.If I have configured the base RPU, will it be changed automatically based on the workload?What happens when I am at Max RPU & there is more workload / more number of users accessing the data warehouse?FollowComment"

Answer: "0With Redshift Serverless there is no Concurrency Scaling charges as you see with Redshift Provisioned. In Redshift Serverless you do not provision nodes. Instead you start with Base RPU, which is Redshift Processing Units. You can go as high as 512 RPU's. Redshift Serverless handles the provisioning and scaling of compute for you. The serverless instance can scale higher from the Base RPU to accommodate more workloads as they come in automatically up to the usage limit you specify in Max RPU's. If you are at maximum RPU's then Redshift will queue up user queries for execution.CommentShareMilindOkeanswered 3 months ago"


Question: How to block internet access for S3 buckets?

"I have many ECS instances distributed in different vpcs, according to https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies-vpc-endpoint.html, I can restrict the access source of bucket by using sourceVPC condition. However, this brings some problems. One is that the bucket policy needs to be modified when adding a new VPC, and the other is that my bucket cannot be accessed through the AWS Console/other AWS Services. My goal is to want to prevent internet access to objects in the bucket, but based on Amazon S3 documentation I didn't find a proper solution.FollowComment"

Answer: "1Could specify the ecs-task role in the bucket policy as the only allowed principle and deny all others. Then in the trust policy of the ecs-task role only allow the ecs-tasks service to assume the role. See: How to Restrict Amazon S3 Bucket Access to a Specific IAM Role.CommentShareEXPERTkentradanswered 10 months ago0The short answer is: Use a bucket policy. But if you could expand the question and talk to what sort of access (and from where - in terms of networking) you'd like to have that would make it possible to provide a more relevant answer.CommentShareEXPERTBrettski-AWSanswered 10 months agoAWS-User-5536133 10 months agoI have many ECS instances distributed in different vpcs, according to https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies-vpc-endpoint.html, I can restrict the access source of bucket by using sourceVPC condition. However, this brings some problems. One is that the bucket policy needs to be modified when adding a new VPC, and the other is that my bucket cannot be accessed through the AWS Console/other AWS Services. My goal is to want to prevent internet access to objects in the bucket, but based on Amazon S3 documentation I didn't find a proper solution.ShareBrettski-AWS EXPERT10 months agoYou have conflicting goals then: Because the AWS console is only accessible via the Internet and other AWS services that use that bucket may not be VPC-based. And if you choose to restrict access to specific VPCs then you will need to update the bucket policy as you add more VPCs. You might consider an automated deployment process that creates the VPCs and updates the bucket policy at the same time. The other answer from kentrad is probably the better way to go here because you can choose "who" is accessing the bucket rather then restricting the "where from".Share"


Question: Changing EFS filesystems from General Performance to Max I/O

"Hi Experts,I need to to change an EFS filesystem from General Performance to Max I/O. The only way to do this is to create a new FS and use DataSync to copy the data. EFS is the underlying storage for my EKS cluster.My approach is to:create the new FS.copy the data with DataSync.Stop services on the EKS cluster.Change the mount points on the CSI Driver.Restart application services.Is the best approach? Or are there other documented steps to change EFS filesystems with an EKS cluster.Thanks in advance.FollowComment"

Answer: "0Accepted AnswerToday, the approach you have outlined with DataSync is likely best. EFS Replication would be a perfect fit for this, but it currently doesn't support replicating to a filesystem with a different Performance Mode.You can also use a client that has both filesystems mounted and rsync the data over, but then you will need to perform an initial transfer and then do an incremental sync during the cutover. DataSync will do this automatically.CommentSharekdavydanswered a year agokav9 a year agoInvestigating this further, I have over 26 million files in my current FS. DataSync will not work, it has a quota limit of 25 million files when copying between AWS services.I'll look into using R-Sync. But this might require more downtime!!Share0The option is to create a new EFS file system with the desired performance mode and then you can migrate data. Approaches in migrating data include using traditional copy, using AWS Datasync or using AWS Backup to perform a Backup and then restore it to a newer filesystem with performance mode desired.References:https://docs.aws.amazon.com/efs/latest/ug/performance.html#performancemodeshttps://docs.aws.amazon.com/efs/latest/ug/trnsfr-data-using-datasync.html https://docs.aws.amazon.com/efs/latest/ug/awsbackup.htmlCommentShareRam_AWSanswered a year ago"


Question: Root Account Hacked

"Hi All,I'm a student and opened my account for learning purpose a year back and suddenly last week I got a mail from amazon of suspicious activity and they have created a ticket .Since then my billing has been around 14k dollars .I keep on following with amazon customer support they provide some h*ll lot of documents to go through before they take any action .I'm really worried about the billing and I don't want this account as well.Can anyone help me with solving this like closing this account will help as my bill hasn't been paidThanksFollowCommentJohn Rotenstein a year agoInteresting! Did you use the same password on AWS as you did for another website? If so, you should change your passwords immediately, since that's probably how somebody discovered your password.Share"

Answer: "1This is one of the reasons you should ALWAYS enable MFA on the root account the first thing you opened an AWS account.That said, now that it already happened, you should change your credential, remove access keys/IAM users and enable MFA.Then delete all resources you are not using in the accounts. You can see what is costing you money in the Billing Dashboard.Only then should you close the account.As to the existing charge, you best course of action is following instructions of the customer service and go through the documents as soon as you can.Here are some details items you should do in such scenarios.CommentShareJason_Sanswered a year ago"


Question: What is the best way to import data to an existing DynamoDB table?

"Let's say I have an existing DynamoDB table and the data is deleted for some reason. I have a backup of the table in AWS Backups as well as an export of the table data in S3 in DynamoDB JSON or Amazon ION format. How can I import this data to the existing DynamoDB table? And what is the easiest and cheapest solution to this? Thanks!PD: I am new to AWS and I have looked at bulk upload data options provided by the knowledge center and an AWS blog for importing data via Lambda. They both require to load a json or csv to s3, but what if I want to use the existing AWS Backup or the DynamoDB JSON to re-populate this existing table? Thanks! Maybe I am complicating myself a bitFollowComment"

Answer: "1Based on your situation you have 2 options to import the data without having to write any code:DynamoDB Import From S3 (Newly Released)Using this approach you can import your data stored on S3 in DDB JSON, ION or even CSVThe cost of running an import is based on the uncompressed size of the source data in S3, multiplied by a per-GB cost, which is $0.15 per GB in the US East (Northern Virginia) Region. Tables with one or more global secondary indexes (GSIs) defined incur no additional cost, but the size of any failed records adds to the total cost.More reading here: blogUse AWS Backup restore optionUsing this approach you can easily restore your backed up data from AWS Backup ServiceThe cost for restoring from a warm back up is $0.15 per GB n the US East (Northern Virginia) RegionCommentShareEXPERTLeeroy Hannigananswered 9 months agojesusER 9 months agoThank you for the information, this creates a new table in DynamoDB right? I am new to AWS and I am currently building a web app in Amplify, do you know how to edit the AppSync schema or CloudFormation template to point to this new restored table?I've tried deleting a table after backing it up and then restore it with the same name but amplify push will not work and return errors like 'Resource is not in the state stackUpdateComplete'Sharecode-bode 6 months agoDynamoDB Import From S3 does not let you import data to existing DynamoDB table. You have to create new table. It would be great if they let you import to existing table too.Share0Accepted AnswerI forgot to update this post with the approach I took. I created a Lambda function that** lists the data from a source table**, transforms it into 'PutRequest' batches of 25, and uses to batchWriteItem method of DynamoDB to upload the data into a destination tableCommentSharejesusERanswered 6 months ago-2You can restore from backup. Take a look at this - https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Restore.Tutorial.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 9 months ago"


Question: Elastic Transcoder - Error In X-TIMESTAMP-MAP Output

"When you use AWS Elastic Transcoder and add a caption file, you'll get a line like this in the m3u8:X-TIMESTAMP-MAP=MPEGTS:0, LOCAL:00:00:00.000Note the space in front of LOCAL - video.js and other players can't deal with this and do not display the captions. Editing the file manually to remove the space, ex:X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000Makes the captions work. Please update the X-TIMESTAMP-MAP routine to correctly remove the space or add an option to remove it in the transcode process.FollowComment"


Question: How to get FQDN of an instance without having an associated elastic IP

"Hi,I'm currently working with a client to replace multiple instances of a wordpress site(one for each location) with a new web app I've been working on and I want to know how I can get the FQDN without an elastic IP? I need to get it without one as there will be more instances of the web app than the current limit of 5 Elastic IPs per account and I am unable to use a single IP for remapping as the sites already exist through another DNS provider(they are not ready to be changed yet) so that I can not create a hosted zone for the domain name.Thanks.FollowComment"

Answer: "0You can get the FQDN of any IP address using standard tools nslookup or dig.  They are also shown in the AWS Console.  You can also use a free service like xip.io to make up hostnames pointing to any IP address, for example, 203.0.113.55 could be www.mysite.203.0.113.55.xip.io.  No configuration needed, you just create a hostname and as long as your IP appears immediately to the left of "xip.io" this just works.  I assume there are others like it.It isn't clear why exactly you would need the FQDN of a public IP address for what you are describing... intuition suggests that perhaps you are trying to solve the wrong problem.  Can you clarify this need?Also, 5 Elastic IP addresses is only the default limit per region.  All you have to do is write a brief explanation of why you need more, and as long as the description includes a reasonable use case, support will increase the limit.https://docs.aws.amazon.com/general/latest/gr/aws_service_limits.htmlCommentSharesqlb0tanswered 5 years ago"


Question: Downgrade db.t3.large instance to db.t3.small

"Hello TeamIs it possible to downgrade my Aurora Postgres instance from db.t3.large to db.t3.small , im not getting the option to choose the smaller instance when i try to modify the instance.regardsFollowComment"

Answer: "1Accepted AnswerHi,Aurora PostgreSQL is not supported on db.t3.small. Please refer here https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Concepts.DBInstanceClass.html#Concepts.DBInstanceClass.SupportAurora for the supported instance classes vs the DB Engines. On the db.t3 – burstable-performance instance classes, only db.t3.large and db.t3.medium are supported for Aurora PostgreSQL, on versions 14.3 and higher, 13.3 and higher, 12.7 and higher, 11.12 and higher.Hope this helps.Thanks,ArunCommentShareArunanswered 3 months agoEXPERTkentradreviewed 3 months ago"


Question: ECS Task Groups

"I'm trying to set some anti-affinity for my tasks, and looking at the AWS docs and this nifty article, task groups is the way to go:https://aws.amazon.com/blogs/compute/amazon-ecs-task-placement/Trouble is, I can't seem to find my task groups. According to the docs, if my tasks were launched by the service scheduler, the task group name is the same as the service:https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-placement-constraints.html#task-groupshttps://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-query-language.htmlHowever, if I query for instances that match that particular task group, I'm returned with 0 instances:aws ecs list-container-instances --cluster dev --filter "task:group == workflow"{    "containerInstanceArns": []}Even though I'm quite certain I have that service, and that there are multiple instances of that task running:aws ecs list-services --cluster dev{    "serviceArns": [        "arn:aws:ecs:eu-west-1:1234567890123:service/dev/workflow",        ...    ]}What am I missing?FollowComment"

Answer: "0HiThe only thing I think you're missing is that the default task group for an ECS service is in fact service:<service name>.So for your example, you would need to provide the filter as follows:aws ecs list-container-instances \      --cluster dev \      --filter "task:group == service:workflow"On top of that, I would also double check that you do indeed have tasks running in that service. Otherwise, you'll see the above give the same empty list as an output.Once you get a hang of the query languge, anti-affinity can be found using the not keyword as follows:aws ecs list-container-instances \      --cluster dev \      --filter "not(task:group == service:workflow)"Additionally, the task group for a single task can be overidden when running the task via the RunTask API. In the case where no task group set with RunTask, the default is family:<task definition family>.Hope this helps. Let me know if you have any further questions.CommentShareAWS-User-6197918answered 4 years ago0Thanks @fortejas-amazon, that was exactly it. Re-reading the documentation it makes perfect sense now.When you launch a task using the RunTask or StartTask action, you can specify the name of the task group for the task. If you don't specify a task group for the task, the default name is the family name of the task definition (for example, family:my-task-definition).For tasks launched by the service scheduler, the task group name is the name of the service (for example, service:my-service-name).I was confused by the examples which show this:"placementConstraints": [    {        "expression": "task:group == databases",        "type": "memberOf"    }]Which I understand now, would be for explicitly named task groups.CommentShareanarcheranswered 4 years ago"


Question: Postgres RDS Proxy stopped working at 5am

"At around 05:00 RDS Proxy for Postgres suddenly stopped functioning after working seamlessly since June. Doing a describe on the CLI against the RDS Proxy target it said it had failed due to an internal error. Wondering if anyone else has seen similar in eu-west-1 this morning?We tried destroying the proxy and recreating it, and while the console and CLI show the proxy target as available, it doesn't work. We can see in Wireshark and application logs that the Proxy is returning an 08000 error "Timed-out waiting to acquire database connect". Occasionally if you spam the proxy enough you will get a connection through. The RDS proxy is in the same security group as the database itself, and for now we have the applications bypassing the RDS Proxy and just going straight to the databases as a workaround and that's fine.Also worth mentioning that other accounts provisioned in the same way are working okay.FollowComment"


Question: Major version upgrade from 14.7 to 15.2 fails due to PostGIS Extension

"This document indicates that PostGIS needs to be updated before a major version upgrade. And, this list shows the supported PostGIS version under PostgreSQL 15.2 is 3.3.2.However, the latest PostGIS version available on RDS under PostgreSQL 14.7 appears to be 3.1.7. Indeed, after running this:SELECT postgis_extensions_upgrade();Then, attempting the upgrade, I get the following:------------------------------------------------------------------Upgrade could not be run on ...------------------------------------------------------------------The instance could not be upgraded from 14.7.R1 to 15.2.R1 because of following reasons. Please take appropriate action on databases that have usages incompatible with requested major engine version upgrade and try again.- Following usages in database 'postgres' need to be corrected before upgrade:-- The instance could not be upgraded because there are one or more databases with an older version of PostGIS extension or its dependent extensions (address_standardizer, address_standardizer_data_us, postgis_tiger_geocoder, postgis_topology, postgis_raster) installed. Please upgrade all installations of PostGIS and drop its dependent extensions and try again.----------------------- END OF LOG ----------------------Trying the specific target version also fails:ALTER EXTENSION postgis UPDATE TO '3.3.2';ERROR:  extension "postgis" has no update path from version "3.1.7" to version "3.3.2"SQL state: 22023Any suggestions?FollowCommentBrandon SUPPORT ENGINEER2 months agoHi there,Do you have any of the follow dependant extensions installed on your instance: address_standardizer, address_standardizer_data_us, postgis_tiger_geocoder, postgis_topology, postgis_raster?If so, can you ensure they are upgraded to the latest for 14.7, or drop these dependant extensions. Then try the upgrade again and see.ShareAndre 2 months ago@Brandon. I have the same issue as Original Poster. I don't have any of these dependent extensions installed on. It is indeed incompatible migrating from 14.7 to 15.2 because of PostGIS. This also came up in Stack Overflow: https://stackoverflow.com/questions/75612704/how-to-upgrade-aws-rds-postgres-instance-from-14-to-15-with-postgisShareBrandon SUPPORT ENGINEER2 months agoHi Andre,I have replicated this situation in my environment. I've raised this with our dev team as a potential bug which they are now investigating. I'll let you know once that has been completed.ThanksShareAndre 2 months agoThank you Brandon. I will wait your reply, then. Looking forward to test PostgreSQL 15 in AWS RDS. Tks.SharerePost-User-6605032 a month agoJust want to note that we've also been awaiting this fix. It's not currently possible to upgrade to 15.2 from 14.7 without dumping and restoring which is not an option for us.ShareShow 4 more comments"

Answer: "2Accepted AnswerHey guys,Thanks heaps for your patience. A new version of 15.2 has been released named 15.2-R2 as well as 15.3-R1 which has the fix in it.Please up vote this answer if it works for you.Thanks :)CommentShareSUPPORT ENGINEERBrandonanswered 8 days ago"


Question: Creating AWS DMS endpoint for PostgreSQL version 14.0 and 14.1?

When will AWS enable creating Database Migration Service (DMS) endpoint for PostgreSQL version 14.0 and 14.1?FollowComment

Answer: "0Hello,I don't think you will find a dire answer to this question.  AWS announces new technologies when they are ready and tested, but does not provide dates for when this will happen.  It probably will soonThanksJoelCommentShareJoelanswered a year ago0Postgresql 14.X has some new features related to how changes are being processes and replicated. I do see service team is working towards certifying PG14.x as source/target.  Currently PG14.x is not officially supported. But you should be able to use it for full load as source endpoint and as target endpoint (in any config). For cdc if you run into issues do open a support case so that bugs can be timely reported and resolved.CommentShareAWS-User-8174525-subhashanswered a year ago0I can't test the endpoint, I get this as a response:Test Endpoint failed: Application-Status: 1020912, Application-Message: Failure in resolving database version. The database version is not supported., Application-Detailed-Message: Supported major version numbers range is [9..13]. Source database version number is not supported: 140002 PostgreSQL 14.2, compiled by Visual C++ build 1914, 64-bitThis is an issue even for full builds because when you go to run a replication task you get this as an error:Test connection for replication instance name-of-your-instance and endpoint name-of-your-endpoint should be successful for starting the replication task.So, because I can't successfully test my connection (in the logs of the pgsql database, you can see it connecting just fine), I can't create a full rebuild replication task.CommentSharerePost-User-9165108answered a year ago"


Question: internal server error- tried to follow the suggested solutions but cannot really proceed

"Dear Community,while I tried to set up serverless I encountered the following screen:https://b3pe6tfdal.execute-api.eu-central-1.amazonaws.com/dev/api/get-auth-urlI am fairly new to serverless and AWS therefore I have been trying to reach anyone who could rather better understand explain what might not be working.I created a OAuth consumer and it seems to be find.I set up serverless the following way:npm install -g serverlessserverless create --template aws-nodejs --path auth-servercd auth-servernpm initAfterwards I created a key, downloaded and executed:serverless config credentials --provider aws --key ACCESS_KEY_ID --secret SECRET_ACCESS_KEY(I did replace the examples-Access_Key_id & Access_key).Now if I run this URL:https://accounts.google.com/o/oauth2/v2/auth?access_type=offline&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcalendar.readonly&response_type=code&client_id=MY_CLIENT_ID&redirect_uri=https%3A%2F%2Fherra17.github.io%2Fmeet%2FI get this-> https://herra17.github.io/meet/?code=4/0AVHEtk7XivdkSnIIzX9SMhFXBtPCvbXYExk8PpDA-sE1mtG4HxiYz-Wp6j6Fn1ls2FKCog&scope=https://www.googleapis.com/auth/calendar.readonly(I am not sure that I can share a screen).Know locally if I do serverless invoke local --function getAuthURL I get:{"statusCode": 200,"headers": {"Access-Control-Allow-Origin": "*","Access-Control-Allow-Credentials": true},"body": {"authUrl": "https://accounts.google.com/o/oauth2/v2/auth?access_type=offline&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcalendar.readonly&response_type=code&client_id=MY_CLIENT_ID&redirect_uri=https%3A%2F%2Fherra17.github.io%2Fmeet%2F"}},as well if I test it in Lambda console: I get a status of 200,serverless info returnsservice: auth-serverstage: devregion: eu-central-1stack: auth-server-devconsole: https://console.serverless.com/herra17/metrics/awsLambda?globalEnvironments=dev&globalNamespace=auth-server&globalRegions=eu-central-1&globalScope=awsLambda&globalTimeFrame=15mendpoints:GET - https://b3pe6tfdal.execute-api.eu-central-1.amazonaws.com/dev/api/get-auth-urlGET - https://b3pe6tfdal.execute-api.eu-central-1.amazonaws.com/dev/api/token/{code}functions:getAuthURL: auth-server-dev-getAuthURLgetAccessToken: auth-server-dev-getAccessToken,Anyhow the endpoint for the get-auth-url throws me the internal server error.Specifically a screen with ://numbers which I am not sure they represent important data// https://b3pe6tfdal.execute-api.eu-central-1.amazonaws.com/dev/api/get-auth-url{"message": "Internal server error"}I have tried to follow along the following Resource but I do not seem to have the Monitor option under the selected HTTP API, hence I can not proceed.https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-troubleshooting-lambda.htmlAny thoughtsI am using Node.js, Express as Lambda, React.FollowComment"