Question: Storing sensitive information in dynamodb

"I have a requirement to store sensitive information in a dynamodb table.The information is entered in client application which sends data to api gateway which then forwards the data to the table.Cognito users for the client app each have a number of entries with different sensitive data in each.I want to minimise access to this information for people who are not cognito users, for example I do not want to be able to go to the dynamodb console and access the actual value of the data when I look at the table as a developer.Ideally I would like to have the client app perform some actions so that when the data is sent to aws, it is already not human readable but when the client app gets the data back again it can be made readable again.Is it possible to hide some columns or a whole table from IAM users but have lambda functions still able to access it?Is it possible to encrypt the data using a kms key such that only the client app or cognito users can access that key to encrypt and decrypt the data clientside?The current solution is to generate a data key for each item and store it alongside the data so that the data is unreadable and users are not responsible for storing and handling the key. However this only leaves one step of separation between the sensitive data with an IAM user able to decrypt the data using the key and view the data.Is there a better solution than this that doesn't result in cognito users being responsible for remembering the encryption key for their data but also prevents IAM users from taking simple steps to view it?I have seen the response to this post https://repost.aws/questions/QUtBzzrw0jQmGwmPpkeAQLYw/data-redaction-or-mask-in-dynamodb which is about the same issue.FollowComment"

Answer: "3Accepted AnswerIs it possible to hide some columns or a whole table from IAM users but have lambda functions still able to access it?Yes, you can use Fine Grained Access ControlIs it possible to encrypt the data using a kms key such that only the client app or cognito users can access that key to encrypt and decrypt the data clientside?Each KMS key can have its own access policy, which you can define who has access to what key. You can use the Encryption Client in combination with KMS to encrypt/decrypt sensitive data.CommentShareEXPERTLeeroy Hannigananswered 20 days agoEXPERTalatechreviewed 20 days ago1I believe that DDB Encryption client allowing client-side encryption is what you're looking for:https://docs.aws.amazon.com/dynamodb-encryption-client/latest/devguide/what-is-ddb-encrypt.htmlThe DynamoDB Encryption Client is designed to be implemented in new, unpopulated databases. Encrypting your sensitive data in transit and at rest helps ensure that your plaintext data isn’t available to any third party, including AWS. The DynamoDB Encryption Client is provided free of charge under the Apache 2.0 license.CommentShareDidier_AWSanswered 20 days agorePost-User-0817544 20 days agoThank you for your answer, I have been looking at the encryption client and it does seem to do what I want in terms of encrypting data. However, it seems as though it is using a key (for example from kms) which I will have access to as a developer. This means that I am still able to decrypt the data using that key to view the sensitive information. Do you know if it is possible to solve that problem without forcing the user to be responsible for their encryption key? Can I hide the encryption key from developers?ShareDidier_AWS 20 days agoNo, if you managed the keys properly with KMS, even the developer won't see the content in the production database. Each KMS key can  have its own access policy, where you restrict which principals can use the key or not.Share"


Question: AWS LoRaWAN LNS - Downlink support

"Does the AWS LoRaWAN Network Server support sending downlink messages to an end node?  I can't seem to find a way to do this, but maybe I'm just missing something simple.FollowComment"

Answer: "0Accepted AnswerYes, the sending data downlink to a device is supported. It is not on the console right now. You can use CLI to make that happen. The reference can be found via this link, https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_SendDataToWirelessDevice.html.CommentShareAWS-User-Russanswered 2 years ago0Great, thanks!What happens if I send a downlink message to a Class A device?  Does it get sent to the Gateway, and the Gateway sends it to the node the next time the node sends an uplink?CommentShareda66enanswered 2 years agoKathy_H a year agoClass A devices sleep most of the time. They listen for downlink messages (from gateway to device) only for a short period after transmitting. If a cloud-hosted application sends a command to this device, a significant delay may take place until the messages is received by the device. Because of that, class A devices are typically battery-powered sensors, having a battery time of up to 10 years.Share0Thanks.Is this documented anywere?  I can't find it.I have a device that has a Class C device profile (US915-C-OTAA) and when I use SendDataToWirelessDevice to send data to it, it doesn't get sent right away.  It's only getting sent after an uplink.  Since it's a Class C I would have expected to be sent right away.  Am I doing something wrong?CommentShareda66enanswered 2 years ago0For Class A devices, the downlink packets will be held in AIL until an uplink is seen.Edited by: russ-awsiot on Mar 14, 2021 10:22 AMCommentShareAWS-User-Russanswered 2 years ago0The most possible cause for this issue might be that you are using TransmitMode=1 for the DL. If the device is not acking back in time, the next DL packet cannot get sent until the previous one is time-out. If you need further diagnosis, you can provide more information here and we can further investigate.CommentShareAWS-User-Russanswered 2 years ago0Regarding the documentation, I think it is not that detailed regarding the downlink handling yet. The API reference can be found here, https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_SendDataToWirelessDevice.html. But I guess you already know it. We will keep updating the documentation to have all possible details reflected. Thanks for the feedback.CommentShareAWS-User-Russanswered 2 years ago"


Question: service xxx was unable to place a task because your account is currently blocked.

"Hi everyone !During one deploying in our Dev environment, we were unable to launch a task in my ECS service .Tests that I already made :Check my Service QuotasCheck my Bills in Billing ConsoleTried to Re-Deploy all my Cluster in another RegionCan anyone help us ?Regards,FollowComment"

Answer: "0To answer your question, we require details that are non-public information. Please open a billing support case with AWS using the following linkCommentShareSUPPORT ENGINEERcontainerisedanswered 8 months ago"


Question: Increase encrypted volume size

"Hello!Can I increase a volume size if it is encrypted, without stopping it?I can do it on unencrypted volumes, and then extend the partition on the fly, but what if it is encrypted and in use?FollowComment"

Answer: 0Yes. Same process applies.CommentShareAWSJoeanswered a year ago0HelloI tested a scenario in my account where a linux host had a 1GB gp2 volume encrypted using EBS KMS key mounted at a mount point. I first expanded the volume through console and then extended filesystem using xfs_growfs utility while the volume was mounted. I was running a small bash script that was adding a line to a text file.As always please try out it in a sandbox with your exact setup by using a test volume with your instance/os before doing it on the main production server.CommentSharerePostfanclubanswered a year ago


Question: Can Amazon Rekognition recognize a person if they go out of the camera frame and come back in?

"If a person that Amazon Rekognition Video recognizes leaves the camera frame and then comes back into the frame, does Amazon Rekognition recognize them as the same person?FollowComment"

Answer: "0Accepted AnswerYes, there are two ways that you can configure Amazon Rekognition Video to recognize the same person if they leave the camera frame and then come back in: The StartPersonTracking and GetPersonTracking APIs, or the StartFaceSearch and GetFaceSearch APIs.Note: The GetFaceSearch and GetPersonTracking APIs have an index field within the "Person" structure that uniquely identifies each person in a video.CommentShareAWS-Shubhanswered 3 years ago"


Question: FSX - IP allocation

"Hello,Is normal that FSX allocates a new IP always data sync run?I've been checking and most of these IPs are 'available'.FollowComment"

Answer: "0Hello,By definition, FSx would get one or two ENIs assigned with one IP each depending on the deployment (single AZ or multi AZ). The IP allocation per se happens when you create a Subnet within a VPC and assigned a IP CDIR range (see references 1 - 3).I hope this helps, please do feel free yo share the steps you are following if necessary.Obtaining the correct file system IP addresses to use for DNS - https://docs.aws.amazon.com/fsx/latest/WindowsGuide/file-system-ip-addresses-for-dns.htmlVPCs and subnets - Subnet basics - https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html#subnet-basicsWork with VPCs and subnets - Create a subnet in your VPC - https://docs.aws.amazon.com/vpc/latest/userguide/working-with-vpcs.html#AddaSubnetCommentShareSUPPORT ENGINEERJosueAWSanswered a year ago0When you create a DataSync task to read from FSx or write to FSx, DataSync will create 4 ENIs in the VPC and Subnet where your primary FSx server is located.  Each ENI consumes one IP address from the Subnet IP range.  These ENIs persist until the DataSync task is deleted.  For more information, see https://docs.aws.amazon.com/datasync/latest/userguide/datasync-in-vpc.html.CommentShareJeff_Banswered a year agoEXPERTHernitoreviewed a year ago"


Question: Linear Learner - Multiclass classification - Prediction Scores

"Hi,I am using the linear learner algo for multiclass classification with 5 classes and 9 featuresI'm trying to figure out what the scores relate to? After getting the predicted_label result I get 5 scores....eg....{"score": [0.0003054474655073136, 0.8110334873199463, 0.0521857813000679, 0.1320497989654541, 0.004425559192895889], "predicted_label": 1.0}or{"score": [0.0001415203878423199, 0.11968196928501129, 0.8732749223709106, 0.006143826059997082, 0.0007577905780635774], "predicted_label": 2.0}Does each score relate to a class? I have tried searching the internet for an explanation but so far cannot find anything, hopefully someone can enlighten meRegardsFollowComment"

Answer: "0Thanks for using SageMaker. The scores returned by multiclass models are the predicted probabilites for each class.In your first example, the model is predicting class 1 with 81% confidence, and in your second example, the model is predicting class 2 with 87% confidence.In general, to interpret the score from classification models, you have to consider the loss function. If the loss is logistic for binary classification or softmax_loss for multiclass classification, then the score can be interpreted as a probability. These are the default losses used by Linear Learner. But if the loss is hinge_loss, then the score cannot be interpreted as a probability. This is because hinge loss corresponds to a Support Vector Classifier, which does not produce probability estimates.CommentShareAWS-User-7153803answered 4 years ago0Great, many thanks for the explanationCommentSharebadders84answered 4 years ago"


Question: Add field to the Cognito access token

Is it possible to modify the JWT access token so that it includes the username and/or a custom D as well as the sub? The user pool is configured with an optional custom ID attribute. We use Amplify to log in.FollowComment

Answer: 0Accepted AnswerThe only modification possible now are user groups.CommentShareRajarshi_Danswered 6 months ago


Question: How to use Request Templates in API Gateway Websocket Integration?

"I cannot get the Velocity RequestTemplates in my Websocket API integration to transform my input before sending my request to the integration.Specifically I have created an AWS integration to Step Functions and need to transform the request to be {"input": { actual input }, "stateMachineArn": "arn of statemachine"}I have tested with wscat specifying --header "Content-Type: application: json".  My Request Template is mapped to "application/json".  The CloudWatch logs for the Stage show the connection with the Content-Type header correct and also shows the routed request being routed properly.  But the input before and after mapping is the same, so the Step Functions StartExecution call is returning 400.Using the aws apigatewayv2 get-integrations I can confirm the RequestTemplates is set properly.What is a simple of example of a Websocket API using RequestTemplates properly?FollowComment"


Question: MediaLive input loss behavior triggered by still images in stream

"I have been testing livestreaming with MediaLive to YouTube and Facebook and in the course of the stream we occasionally put up still images (e.g. some text for audience to read, or photographs to view) which is causing MediaLive to invoke the Input Loss Behavior - we get black or repeated frame (as configured) and lose audio though we are sending continual audio throughout.On CloudWatch I am able to see InputVideoFrameRate drops that appear to correlate.Changing the channel general settings Global Configuration to Support Low Framerate Inputs = ENABLED seems to have helped greatly. With this the problem is avoided sometimes but other times we still lose audio behind the repeated frame for a few seconds before it resumes.Input path is from OBS Studio via RIST to MediaConnect to MediaLive using SINGLE_PIPELINE rather than STANDARD.Is there any way to avoid MediaLive detecting still images in a stream as input loss?FollowComment"

Answer: "0OK. The next thing to check is theInputVideoFrameRatemetric for your channel. This can be seen in the health tab of the channel detail page, or in CloudWatch metrics. Does it drop during the still image portion of your stream? If so OBS is varying the frame rate of the stream, which can cause problems if MediaLive is expecting a fixed frame rate source. You can also enable logging in the channel config (General Settings -> Channel Logging) which when set to WARNING, INFO, or DEBUG (least verbose to most) may provide useful insight into what is causing the input loss detection.Regards,SteveCommentShareSteve_Wanswered a year agojdt a year agoYes, as noted in the question, the InputVideoFrameRate (CloudWatch dashboard) does appear to drop when this problem happens in the still image portion of the stream, so that is a reasonable hypothesis. I don't know how to make OBS (or is it really libx264?) preserve the frame rate. Thanks for the tip about channel logging which I can try to see if it sheds any light.Sharejdt a year agoHere are channel log entries when problem occurs (I am excluding log entries about failure to connect to a Facebook Destination that I know is not properly configured so these are noise)First when problem occurs:2022-07-09 19:09:51.000{"channel_arn": "arn:aws:medialive:us-west-2:434221060529:channel:3565940", "encoder_pipeline": 0, "logger_name": "", "message": "Setting alert [5101] [1.1] [5101-1.1] [[1.1] Audio not detected: Check input signal]", "severity": "W", "timestamp": "2022-07-09T19:09:51.997116"}2022-07-09 19:09:51.000{"channel_arn": "arn:aws:medialive:us-west-2:434221060529:channel:3565940", "encoder_pipeline": 0, "logger_name": "", "message": "Setting alert [5101] [2.1] [5101-2.1] [[2.1] Audio not detected: Check input signal]", "severity": "W", "timestamp": "2022-07-09T19:09:51.997218"}2022-07-09 19:09:50.000{"channel_arn": "arn:aws:medialive:us-west-2:434221060529:channel:3565940", "encoder_pipeline": 0, "logger_name": "", "message": "Setting alert [5302] [sam://localhost:5030/eth2] [5302-sam://localhost:5030/eth2] [Stopped receiving network data on [sam://localhost:5030]]", "severity": "W", "timestamp": "2022-07-09T19:09:50.287563"}Then 8 seconds later these alerts clear, with continuity errors, but don't seem to be able to put enough text in this comment. There is mention of SDT data not received. The still image is sent for longer than this, and loss detection drops out and restores stream after some seconds while still image remains the output.Sharejdt a year agoI have found reference to say that MediaConnect suppresses null packets which "can result in a fluctuating bitrate on the subscriber's flow, or a difference between the bitrate of the content originator's flow and the subscriber’s flow". Could it be that MediaConnect is suppressing null packets sent when image is not changing in video stream? Also, OBS stats show no indication of FPS dropping from OBS during such test.Share0Hi jdt,Check and see if you have configured a key frame interval in OBS. 2 seconds is a common value to use. What may be happening is if you use the default configuration "Auto" then OBS may slow the key frame interval during the still image portion of your stream.Regards,SteveCommentShareSteve_Wanswered a year agojdt a year agoThank you Steve. I had already configured key frame interval to 2 in OBS.Share0Stripping null packets from the stream is a feature of several protocols, including RTMP and Zixi, so I don't think that's the issue here. I was able to find some references online to OBS continuing to use VFR even when configured with a fixed frame rate, including a video clip illustrating the flags needed to be passed to x.264 in order to force it to maintain CFR. I used the search terms "obs constant frame rate" for this search.CommentShareSteve_Wanswered a year agojdt a year agoIf you are referring to the video that shows force-cfr=1, I spent a lot of time going down this road without success. The specific instructions in that video generate an error message from OBS today (and don't make sense since x264 is not a muxer AFAICT), but I translated this into video encoder settings with error message guidance and it did not help. libx264 clearly does have this parameter (I see it in the source) but hard to confirm it is actually getting set by OBS, and if so it did not make a difference. I will try to repeat this test to be sure.  OBS live stats do not show any decline in frame rate with this problem, though I have seen a decline in other circumstances on different machine (GPU contention I believe) so it can show up there.Also have started looking at file write of sample encode (rather than transmission to AWS) and it does not appear that there are null packets included in the first place when still image is presented.Share0It might be worth trying SRT to MediaConnect instead of RIST to see if it is something unique to that protocol.CommentShareSteve_Wanswered a year agojdt a year agoThanks for the suggestion - I have not tried that because I have had trouble with SRT to another service. Congestion on our Internet service is what pushed me to try RIST after SRT could not handle it well either. The RIST test here went really well, except for this anomaly with some stills. My last test with force-cfr was a little inconclusive: it was not completely successful but things were better, and one failure might have been unrelated rendering loss. We're trying yet another service in meantime.Share"


Question: pandas requires version '0.7.4' or newer of 'fsspec' (version '0.6.2' currently installed)

I develope program via Glue Jupyter Notebook.AWS Glue only support fsspec 0.6.2 version. However I have "pandas requires version '0.7.4' or newer of 'fsspec' (version '0.6.2' currently installed)" version issue.How to update fsspec in GLUE JUPYTER NOTEBOOKFollowComment

Answer: "0If you are running the Jupyter Notebook using interactive sessions of AWS Glue, then you can easily upgrade the version of any package by using the %additional_python_modules magic command before starting your session.Now in your case, if you require 0.7.4 version of fsspec, then try running this command:%additional_python_modules fsspec==0.7.4Please note that you have to run this command before creating the spark session such that this particular package of the required version will be used while creating the session.CommentShareSUPPORT ENGINEERChaituanswered 10 months ago"


Question: AWS Fortigate S2S directionality issue...

I have an AWS to on-premise Fortigate site-to-site tunnel (static routing) configured and up. I could only pass traffic in the AWS-to-Fortigate direction after sending traffic in the Fortigate-to-AWS direction. Why is this? Is there a tunnel activity timeout involved?FollowComment

Answer: "0Hello,Suggest checking the troubleshooting steps listed in the below Knowledge center article:https://aws.amazon.com/premiumsupport/knowledge-center/vpn-cgw-vpg-traffic/CommentShareEXPERTTushar_Janswered 10 months ago0When I see this is says to me "NAT is happening in the Fortigate firewall". Make sure that you've disabling any address translation on the VPN connection or for the IP ranges in question.The other common issue is that the AWS side is not configured to initiate the VPN connection which means it must be created from the Fortigate side. Our documentation talks to how to configure tunnel initiation: https://docs.aws.amazon.com/vpn/latest/s2svpn/initiate-vpn-tunnels.htmlCommentShareEXPERTBrettski-AWSanswered 10 months ago0hello, review the rule of security group in the interface to internet. this could be have allow trafic explicity. I was have something like that.best regardsCommentSharemiller casablancaanswered 7 months ago"


Question: Configure Amazon EC2

"Hi,I'm developing a Java web application, based on Spring boot, which stores data in a MySql DB instance (single instance). It's a "light" application, in terms of use of resources.I'm looking for a Linux virtual machine that hosts my application and which also acts as ftp server.I think a T3 EC2 instance could be the best option for my needs.I used the pricing calculator, in order to have an idea about costs, but what I don't really understand is Amazon Elastic Block Store (EBS): is it the hard disk drive?Moreover, if i want to publish my application, in order to make it accessible from Internet, what can I do? Do I need to buy an extra "service"?Thank you,AndreaFollowComment"

Answer: "1Accepted AnswerHi,EBS is a network drive ie not local to the hardware on which EC2 runs. You would have alteast one volume attached to an EC2 instance. It has a cost beyond usage of 30 GB under free tier.Moreover, if i want to publish my application, in order to make it accessible from Internet, what can I do? Do I need to buy an extra "service"?It depends. If all you need is to have it accessible from the internet, make sure the instance is launched in the public subnet, assign it a static IP ie Elastic IP and configure security groups to allow only necessary traffic. There is no cost incurred for this unless the Elastic IP is not associated with the instance / or assigned to an instance which is stopped. You can have an Ephemeral Public IP dynamically assigned on launch of an instance but that changes on stop / start, hence I suggested EIP to keep the IP constantSince you have a public facing service, you incur Data Transfer charges.The other good to have feature might be to have a domain and FQDN pointing to the instance so that you can access via domain name rather than IP, configuring the instance behind load balancers when you have multiple instance. This would also incur additional cost but is not an immediate necessity.--SydCommentShareSydanswered 2 months agoA 2 months agoHi Syd, in the pricing calculator I can't find local hard drives, so I can't understand what I have to pay for 40 GB HD.How can I verify that Elastic IP is not associated with the instance or assigned to an instance which is stopped?How can I define a domain and FQDN?Thank youShareSyd 2 months agoIn Pricing calculator search for EBS or Amazon Elastic Block Store. The pricing calculator does not take in account free tier storage, so if you are sure have only one EC2 with 40 GB, you can check the pricing for 10GB (ie. 40-30)To verify that the Elastic IP is associated with an EC2 instance, go to AWS -> EC2 -> Elastic IP you should see something mentioned for the selected IP in the associated instance ID / private IP fields. Check the associated instance ID to confirm it's status ie running / stoppedYou can use Route53 for domain and FQDN. AWS documentation should help you to get started in this. Basically you need to buy a domain, and then created DNS records as required.ShareA 2 months agoHi Syd,thank you for the clarification.So, EBS is a network drive, but is there the option to have a locale drive?Thank youShareSyd 2 months agoThere is an option for local drive which is termed instance store but that volume cannot be the OS volume (root volume). It's ephemeral in nature so only save data that you dont mind losing if the underlying hardware fails for some reason. Depending on the instance type you use, you may get the option to allocate multiple drives or maybe none. More details are available at - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.htmlShare"


Question: "Kubernetes pods are being evicted and their node crashing all of a sudden, and not sure why?"

"Hi everyone,We've been using EKS for about a year now, and last week we started seeing pods evicted from some of our nodes -- to the point where no pods were available to service our clients-- and we can't figure out why.This happens every other day or so, and takes us down from anywhere from 2-15 minutes.If you see the screenshot below you'll notice a lot of failed 'api' pods.  If you look at the logs you'll see messages like this:"status": {    "phase": "Failed",    "message": "The node was low on resource: memory. Container api was using 459860Ki, which exceeds its request of 256Mi. ",    "reason": "Evicted",    "startTime": "2022-07-26T12:31:37Z"To the best of our knowledge the code in those pods hasn't changed recently, and so we're not sure why the memory is running low all  of a sudden; nor are we sure why they appear to be sticking around when they've failed / been evicted, as can also be seen in the screenshot.We're really most interested in keeping our service up when something like this happens and were wondering what we can do to prevent all pods from being down for the count, and the node maxxed out and unable to create new ones for a period of time.  Any suggestions on how we can diagnose this further, and / or lessen the chances of being completely out of luck when it does happen,  would be greatly appreciated.(Our AMI release on the node is 1.21.2-20210830)Thanks!FollowComment"

Answer: "0Hello,Your kubelet is evicting your pod to reclaim memory on your node to prevent memory starvation for other processes on the node.The node pressure eviction process is selecting this particular pod for eviction because the pod's current memory usage at that particular time was more than the memory request specified in the container spec.According to this doc, the kubelet uses the following parameters to determine the pod eviction order during the eviction process:Whether the pod's resource usage exceeds requestsPod PriorityThe pod's resource usage relative to requestsTo remediate this problem, you could request for additional memory during the pod creation to make sure that your pod memory utilization stays below the memory request value.You can also set memory limits for all of the containers in your cluster to stop them from taking up more memory than they should. If you are unsure about the right requests/limits, VPA can be helpful.You will have to monitor all the processes running in your nodes to find out what processes are taking up excessive memory in your nodes.I hope this is helpful. Please comment if you have any further questions. Thanks!CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered 10 months ago"


Question: URGENT: UUID is not being set for connected slave; replication fails

"This is causing two of my slaves to have a blank UUID field and as such they are considered a duplicate.  You can see one of the blanks in the 'show slave hosts' output here.mysql> show slave hosts;+------------+------+------+-----------+--------------------------------------+| Server_id  | Host | Port | Master_id | Slave_UUID                           |+------------+------+------+-----------+--------------------------------------+|  651168699 |      | 3306 | 706684217 | 85bddaad-2f97-11e7-9b3c-02b50d934997 || 1110976164 |      | 3306 | 706684217 | 172fc2bb-7322-11e7-bc2a-067f0dd1e340 ||  491358223 |      | 3306 | 706684217 |                                      |+------------+------+------+-----------+--------------------------------------+3 rows in set (0.03 sec)There is a 4th slave that is getting an error b/c when it connects it also gets a blank UUID and thus is considered a duplicate host.Here are the list of server_UUID/server_ids from my group.name    server_uuid                              server_idmaster  9cd972d1-2f78-11e7-8f84-069be90e42fb     706684217shard1: dc911309-2f96-11e7-b0d6-06be9eee759d    491358223shard2: 85bddaad-2f97-11e7-9b3c-02b50d934997    651168699shard3: 87f7b13a-52d8-11e7-b8fe-065087710422     1076311080shard4: 172fc2bb-7322-11e7-bc2a-067f0dd1e340      1110976164shard1 and shard3 connect but always get a blank UUID in the master's show slave hosts command.  Shards2 and shard4 behave normally.The slaves are connected as remote hosts using the (CALL mysql.rds_set_external_master) but all databases are hosted RDS databases.  We do this so the slave databases can have 'extra' schemas that are not replicated from the host.The end result is the following error in the 'show slave status' output on whichever of the two problem slaves is started last:              Last_IO_Error: Got fatal error 1236 from master when reading data from binary log: 'A slave with the same server_uuid/server_id as this slave has connected to the master; the first event 'mysql-bin-changelog.157797' at 169188, the last event read from '/rdsdbdata/log/binlog/mysql-bin-changelog.157797' at 538718, the last byte read from '/rdsdbdata/log/binlog/mysql-bin-changelog.157797' at 538718.'The mysql servers are all running mysql: Server version:5.7.19-log MySQL Community Server (GPL)This had been working for a long long time, for over a year...  Other then mysql minor version upgrades, I don't think anything has changed.Edited by: jeffwrule on Jun 17, 2019 6:30 PMEdited by: jeffwrule on Jun 17, 2019 6:30 PMEdited by: jeffwrule on Jun 17, 2019 6:32 PMEdited by: jeffwrule on Jun 17, 2019 6:32 PMFollowComment"

Answer: "0Hello AWS can I get a little love on this?   My replication is down and the normal things I would do to fix this are not available to me.  The first would be to re-generate a new UUID by deleting the auto.cnf, not really possible with RDS.  This needs to be looked at by the RDS team.CommentSharejeffwruleanswered 4 years ago0The forums are for community discussion and do not function well for individualized technical support. Occasionally AWS personnel will respond to things here, but most of the time you need to open a support case.Edited by: HalTemp on Jun 20, 2019 5:32 AMCommentShareHalTempanswered 4 years ago0It looks like you are running self-managed read replicas to "have 'extra' schemas that are not replicated from the host." Are you aware that with RDS managed read replicas you can change the read-only flag to false in order to write data to replica slave and have 'extra' schema objects that do not conflict with the schema objects being replicated from the master?I don't know how to answer the server-id question. Is it possible that you created duplicate UUID from restoring the same snapshot to different read replicas?Perhaps you can consider using RDS managed read replicas. If you do you will need to be careful to avoid creating any conflicts that break replication.-PhilCommentShareMODERATORphilawsanswered 4 years ago0The UUID's are all unique and posted in the orig note.   Gathered by connecting to each database and using the "show variables like '%server%' " command.   We are sharding data across multiple databases with a common part of the database coming from a common (master) database.   In fact they start out as read-replicas briefly and then I promote them add the new schema and make them a slave of the original database.  Since the new schemas are not part of that database the only data that gets replicated is the orig common schemas.I was not aware that you could continue to be a 'read replica' and set the read-only flag off.  An interesting option.  Any other side effects from doing this around backups etc?   The data is important so can I schedule back-ups separately on each read replica?  Need to be able to recover them individually.All the options for AWS support models that I know of for RDS are too expensive for our startup.It still makes no sense that the database is getting connected with a blank UUID from the masters perspective, and it works for 2 of the for databases but not the other 2.Thanks for the feedback and any help/advice you can give is appreciated.Edited by: jeffwrule on Jun 21, 2019 12:01 PMCommentSharejeffwruleanswered 4 years ago0Yes, you can backup read replicas just as with any other RDS database. You can even convert them to multi-az and/or create chained read replicas from them.But as I said, be careful when turning off read-only, you need to avoid changes on the read replica that conflict with the source master. As long as you only write to schema objects that do not exist on the source master you should be fine.-PhilCommentShareMODERATORphilawsanswered 4 years ago0This was fixed by rebooting the master server.  The master had been up for 300+ days.   I was not getting any specific error message, but something went wrong internally.Rebooting the master and then restarting the slaves restored the correct UUID in the 'show slave hosts' from the master, and allowed the multiple slaves to run again in parallel.   That is the master no longer saw all 4 slaves as having the same UUID (blank).  They each have a unique UUID and things work as expected.CommentSharejeffwruleanswered 4 years ago"


Question: Trouble Removing ENIs eni-0ab2e473c30b113d2 and eni-02985b14cbc402722

"It appears that these network interfaces are "stuck" and I'm unable to remove them, therefore can't free (delete) the resources (VPCs, subnets, etc.) that are using them.  We've been unable to track down what might still be using them.  Can you confirm they are (or aren't) stuck, and if not, point us in the right direction on what's using them?  Thank you.FollowComment"

Answer: 0We were able to address this by deleting the RDS instances this VPC was connected to.  No further assistance is required.CommentShareAWS-User-7785973answered a year ago


Question: Greengrass MQTT Bridge component to listen only topics specific for the thing

"Hi,It seems currently we are only allowed to use wildcard (+), or hard coded thing names in MQTT Bridge mqttTopicMapping.For example I can do as follows and it works;mqttTopicMapping: {              HelloWorldIotCore: {                topic: 'clients/+/hello/world',                source: 'LocalMqtt',                target: 'IotCore',              },              IotCoreToDevice: {                topic: 'clients/+/iotcore/to/device',                source: 'IotCore',                target: 'LocalMqtt',              }}This one works too;mqttTopicMapping: {              HelloWorldIotCore: {                topic: 'clients/hardcoded_thing_name/hello/world',                source: 'LocalMqtt',                target: 'IotCore',              },              IotCoreToDevice: {                topic: 'clients/hardcoded_thing_name/iotcore/to/device',                source: 'IotCore',                target: 'LocalMqtt',              }}But this one does not work. I want this to work because I want to apply the same deployment to multiple devices (or thing group) and I want each device to receive topic messages specific for itself.mqttTopicMapping: {              HelloWorldIotCore: {                topic: 'clients/{iot:thingName}/hello/world',                source: 'LocalMqtt',                target: 'IotCore',              },              IotCoreToDevice: {                topic: 'clients/{iot:thingName}/iotcore/to/device',                source: 'IotCore',                target: 'LocalMqtt',              }}Any solution for this problem?ThanksFollowComment"

Answer: "0Accepted AnswerHi,I found the problem and posting here in case anybody suffers from the same problem.In order to be able to {iot:thingName} in component configurations I had to enable interpolateComponentConfiguration on Nucleus configuration like below:configurationUpdate: {          merge: JSON.stringify({            interpolateComponentConfiguration: true,          }),        },More details here -> https://docs.aws.amazon.com/greengrass/v2/developerguide/greengrass-nucleus-component.html#greengrass-nucleus-component-configuration-interpolate-component-configurationCommentSharesavcuogluanswered 23 days ago"


Question: Why Can I not connect to my website running on EC2 with https?

"The web service is running in a container. The following is part of my docker-compose.yml.services:  webService:    ports:      - 80:8080      - 443:8080I also created a certificate for my domain name, and configure the inbound rules for both https with port 443 and http with port 80.Currently I can open my website through http://my_domain_name successfully, but can not through https://my_domain_nameThe following is the response after I run "telnet my_domain_name 443" with my local laptop.Trying <my elastic IP>...Connected to my_domain_name.Escape character is '^]'.What is the reason? How can I check it and fix it? Thanks.FollowCommentGary Mclean a month agoWhere did you create the certificate?Share"

Answer: "1You can’t have http and https on the same port. Your docker configuration has port 80 and 443 going to port 8080.You’ll need ssl running on its own port on the web server side.What you could do is have an alb with ssl setup on it and this ec2 in the target group forwarding to port 80.Https will run on load balancer.If you don’t want an alb, you’ll need to install the ssl cert in the container and setup a 2nd port for httpsCommentShareGary Mcleananswered a month agoPost-User-7527369 a month agoHi Gary,Thanks for your answer. Thanks for your knowledge sharing. Actually I did not know this knowledge point.I created an application load balancer for the VPC of my EC2 instance, but still the same error I can't visit my website through https. Can you give me more suggestions? Do I need configure more? Thanks. I am newcomer of AWS, know almost nothing about AWS, at the same time, I also feel the document of AWS is too difficult to grasp the critical point.ShareGary Mclean a month agoNo worries.You will need an internet facing load balancer in a public subnet. This has a route to an internet gateway.You’ll need a acm certificate and assigned to the load balancer on port 443You will need a target group with your ec2 as and instance using port 80 as the health check.A rule will need to be created on the load balancer to send  traffic to the target groupYou’ll need a security group on the load balancer allowing 0.0.0.0/0 to port 443You’ll need a security group on the ec2 allowing access to port 80 from the load balancer security groupDns will need to point to your load balancer.Aws is very granular and you have to setupEverything you’ll need.SharePost-User-7527369 a month agoThanks for your reply in details. According to my understanding, I think I have done all these steps. "Health check" of my load balancer is also OK. But still I can't access my website running on EC2. Probably there is a configuration error somewhere.Share"


Question: AWS Lambda & S3 Integration | Automatic trigger Amazon Lambda function on s3 event

How to  write Kotlin for AWS Lambda & S3 Integration | Automatic trigger Amazon Lambda function on s3 event using CDK.FollowComment

Answer: 0CDK reference for triggering lambda on S3 events.CDK reference for creating a lambda function.Write lambda function handler in Kotlin - Sample.Sample S3 notification which will be received as event parameter in the handler. Read the event as per use case and perform the required actions in the handler.You will also need to create the required IAM roles / policies. This is an example of doing it via the console. You can refer cdk documentation to create these roles via code.CommentShareAWS-User-3835359answered a year ago


Question: VPC Endpoint for AWS Account Factory for Terraform Management Account

"Can anyone explain why do we have so many VPC Endpoints in the AWS Account Factory for Terraform Management Account. It is incurring me cost, can I remove them and still operate AFT?FollowComment"

Answer: "1Hi, many customers have the requirement that no network traffic leaves their VPC and transits to the internet. This feature provides all the endpoints the AFT solution may need to connect to AWS services privately (without hitting the public endpoints).You can turn the endpoints off by adding this variable to your AFT module deployment, aft_vpc_endpoints = falseCommentShareJimmy_Manswered a year agoEXPERTMatt-Breviewed 7 months ago"


Question: Connecting RDS to an external server for replication issues

"Hi all,We're going to be moving to AWS soon, and I am wanting to setup replication to an external main server . I have followed this guide:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/MySQL.Procedural.Importing.External.Repl.htmlSteps I took:Made a user on the Main server mocking what was in the write-upI flushed privileges'I then set the main server on our AWS databaseCALL mysql.rds_set_external server ('XX.XX.XX.XX', 3528, 'repl_user', 'MYSQL_PASSWORD_Main', 'mysql-bin-changelog.008401', 14545731, 0);I am presented with the errors below. The MySQL port is not 3528 and not the default 3306 and although I set it differently it seems its trying to connect to that port still. Just a note we have this server replicating to another dedicated server as well so replication is working on the machine.2021-12-13 18:30:00 2889 [Note] Error reading relay log event: SQL thread was killed2021-12-13 18:30:00 2889 [Note] SQL thread exiting, replication stopped in log 'mysql-bin-changelog.008386' at position 536519812021-12-13 18:30:00 2889 [Note] was XX.XX.XX.XX:33062021-12-13 18:30:00 2888 [ERROR] I/O: error connecting to 'repl_user@XX.XX.XX.XX:3306' - retry-time: 60 maximum-retries: 86400 message: Can't connect to server on 'XX.XX.XX.XX' (4 "Interrupted system call"), Internal MariaDB error code: 20032021-12-13 18:30:00 2888 [Note] I/O thread killed while connecting to2021-12-13 18:30:00 2888 [Note] I/O thread exiting, read up to log 'mysql-bin-changelog.008386', position 536519812021-12-13 18:30:00 2888 [Note] was XX.XX.XX.XX:3306----------------------- END OF LOG ----------------------Any other things someone could suggest please?FollowComment"

Answer: "0Have you considered AWS Database Migration Service (AWS DMS) which helps you migrate databases to AWS quickly and securely. The source database remains fully operational during the migration, minimizing downtime to applications that rely on the database. At a high levelCreate a replication instanceCreate target and source endpointsRefresh the source endpoint schemasCreate a migration taskMonitor your migration taskFurther links for reference:AWS Prescriptive Guidance for DatabasesMigrating your on-premises SQL databases to AWS RDS SQL Server using AWS DMSCommentShareRoBanswered a year ago"


Question: Question about writing a Cognito post-auth lambda in go

"I wrote a really simple post-auth lambda for cognito like this:func HandleRequest(ctx context.Context, e events.CognitoEventUserPoolsPostAuthentication ) error {eventJson, _ := json.MarshalIndent(e, "", "  ")eventString := strings.ReplaceAll(string(eventJson), "\n", "\r")log.Printf("EVENT: %s", eventString)return nil}func main() {lambda.Start(HandleRequest)}It's only there - for now - to log activity.  But when I actually attach it to the user pool as a post-authentication trigger it makes OAuth2 not work.  The error message is "contact administrator."I'm thinking that I need to actually do something besides return error = nil.  I'm not having much luck finding any examples of this in go, though.The javascript example ends with:    // Return to Amazon Cognito    callback(null, event);Is that what the expectation is in 'go' as well - that I return (events.CognitoEventUserPoolsPostAuthentication, error) and just send it back the original event?FollowComment"

Answer: "0Accepted AnswerI figured this out.  I want more control over things so I'm using this:func HandleRequest(ctx context.Context, request events.APIGatewayV2HTTPRequest) (events.APIGatewayV2HTTPResponse, error) { ... }which works great.  It was kind of nice before that it would take care of marshaling/unmarshaling and now I have to do it myself, but that's not bad.  I do kind of wish the Response "Body" was just interface{} and that it would automatically marshal/unmarshal based on Content-Type but it's fine.One thing I do miss from doing this in Kotlin and Spring is the ability to just throw an Exception, and write an ExceptionMapper that would set the appropriate http status code.CommentSharewz2banswered a year ago0I tried followingpackage mainimport ("fmt""github.com/aws/aws-lambda-go/events""github.com/aws/aws-lambda-go/lambda")func handler(event events.CognitoEventUserPoolsPostAuthentication) (events.CognitoEventUserPoolsPostAuthentication, error) {fmt.Printf("PreAuthentication of user: %s\n", event.UserName)// Return to Amazon Cognitoreturn event, nil// Try raising an error// return event, fmt.Errorf("TESTING LAMBDA ERRORS WITH GOLANG")}func main() {lambda.Start(handler)}CommentShareADI-Ashishanswered 10 months ago"


Question: Reprocessing a file in EMR

"While processing a file through EMR, if the cluster is terminated, few records were only updated. While processing it again should we delete the file at target location, so we can process the file without any duplicates at target location or is there any way to do it?FollowComment"

Answer: "0Hello Rohith,Thank you raising this question in re:Post.To give you an accurate answer to this, I would need more details on what you are using to process this file, how you are writing it to the target, what is your target etc.In general, non-text file output formats(Parquet as an example) are known to have better handling of this scenario in application frameworks like Spark & Hive, among others. While Text file formats are prone to leave partial files at the target during abrupt exit or failure of the application.On a high level I believe if you write an application to overwrite the target, it should take care of this and not leave any duplicates. Having said that there are multiple variables at play here, hence I'll not be able to confirm if it would be the case for your use case.Please elaborate more on the output file format, the execution engine(Hive/Spark etc.), target location(RDBMS/S3 or something else) you would be using so that I could review this again and answer your questions. The more details you share the easier it would be to answer.CommentShareSUPPORT ENGINEERKrishnadas Manswered 5 months agoRohith Pagadala 5 months agoOutput format will be parquet and target location can be S3 or Redshift. Execution engine is SparkShare"


Question: Container health check for ECS task with awsvpc network mode

"Hi,I'd like to create an ECS task with network mode "awsvpc". The container in the task should have a health check command calling a REST endpoint in the container via curl.With bridge network mode I'd add the health check command as "CMD,curl,--fail,http://localhost:8080/health/check/endpoint".However with awsvpc mode, it seems that the container is not reachable via localhost.How does a healthcheck work if the network mode is "awsvpc"?Cheers,MarkusFollowComment"

Answer: "0Hi,According to the documentation here: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#container_definition_healthcheckYou should be using CMD-SHELL instead of CMDCommentShareOlekanswered 3 years ago0Looks like I had to use localhost to connect to the instance.CommentSharemksplganswered 2 years ago"


Question: AWS Management console short url

"this is not exactly an issue but an idea I am pretty sure will be considered at leastso I was in this new browser and it annoys me I need to google the console url, usually I write "console" and suggestion appears ... this time I wrote console.aws ... then I remember AWS owns this top level domain like this repost.aws , can you make https://console.aws resolve the console management main pageFollowComment"

Answer: "0As you mention AWS owns this top level domain, you can not use it for your purpose .but you can modify the login URL by creating alias for what you want like https://abc.amazon.com/console .you can follow below pagehttps://docs.aws.amazon.com/singlesignon/latest/userguide/howtochangeURL.htmlCommentShareSachinanswered 3 months ago0with your "I clearly didn't understand" answer you actually gave me an idea to use "hosts" on my Mac and "own" every domain I wantThank youCommentSharearpecopanswered 3 months ago0you can also make a host entry in you windows machine to get it donePlease accept the answer if it help.CommentShareSachinanswered 3 months ago"


Question: Default Lambda VPC - DNS Resolving fails for dynamodb.us-east-1.amazonaws.com

"Hey,In the last 24 hours we see some of our lambda's that interact with DynamoDB fail due to DNS resolving error:{"errno":-3008,"code":"ENOTFOUND","syscall":"getaddrinfo","hostname":"dynamodb.us-east-1.amazonaws.com","$metadata":{"attempts":1,"totalRetryDelay":0}}Did somebody encounter this issue or have any leads? it doesn't seem to be a DNS throttling as the invocation count of this lambda during the time when the error occurred was very low.FollowComment"

Answer: "0It's not clear from the question but: Is the Lambda running in the context of a VPC? If so, are you using the VPC Route 53 DNS resolver?If the answer to the second question is "yes" I'd suggest creating a support ticket because there is some other issue there that isn't obvious.If you're using your own DNS resolver within the VPC then I would check the logs on that and see if it is experiencing any issues.If the answer to the first question is "no" then I'd also suggest creating a support ticket.CommentShareEXPERTBrettski-AWSanswered 4 months agoGuy 4 months agoHey, thanks for your response!The lambda is running under the default VPC (the one that is created with each AWS Account) that allows internet access etc, no custom DNS resolver is running under this VPC.ShareBrettski-AWS EXPERT4 months agoThe default VPC generally has public subnets only; if you launch a Lambda function into a public subnet it does not get a public/elastic IP. In order to allow the Lambda function to communicate with public resources you will need to create private subnets, a NAT Gateway and use those private subnets for Lambda.Share0Hi there!My hunch is your facing some sort of DNS quota issue since its intermittent.Have you looked at this troubleshooting guide? https://aws.amazon.com/premiumsupport/knowledge-center/vpc-find-cause-of-failed-dns-queries/CommentSharearnasinhanswered 4 months agoGuy 4 months agoThat what I found online as well but it doesn’t make sense as those failing dns queries are not during peak lambda executions. So weird…Share"


Question: End of file unexpectedly reached before all data was read

"Hello,Today I was installing beta 1.12 and ran into an issue. The first time I opened the editor, it was fine and was in the process of importing all the assets for the starter map. Half way through this, my computer blue screened and screwed things up. Now, I can't open the editor at all as it presents me with the below error.I click "Ok" over and over...but the popup reappears.There doesn't appear to be a repair option with the installer. I've tried uninstalling and installing again but that made no difference.How do I fix this?CheersREMOVEDUPLOADREMOVEDUPLOADFollow"

Answer: "0Accepted AnswerResolved the issue by:Uninstalling LYIn the previous install directory, delete all remaining filesInstall LY againOpen the editor and allow the startup jobs to finishWhat I found interesting was that I let the editor go while it was running the Pending Jobs. When I came back to my computer, it appeared to have rebooted/crashed again. This time I received a slightly different error:I was able to continue opening the editor and finish the Pending Jobs.Unfortunately there were no errors in my Windows Event viewer under Application or System. If any of the developers would like me to provide specific logs, please let me know.SharerePost-User-0178076answered 5 years ago0Thanks for the response. I tried your suggestion but it didn't help unfortunately.I did end up finding a solution which I just posted separately then.CheersSharerePost-User-0178076answered 5 years ago0Sorry to hear about your blue screen and editor problem! Does the error popup also occur if you open just AssetProcessor.exe or does it only happen from Editor.exe? This would help me figure out if it's an AssetProcessor issue.If uninstalling and reinstalling didn't work, it might also be worth resetting the registry...To edit the Windows registryOn your Windows desktop, click Start and type regedit in the search box.In the Registry Editor, go to HKEY_CURRENT_USER\Software\Amazon\Lumberyard.Right-click on Lumberyard folder icons and choose Delete. This deletes custom layout settings that you have for Lumberyard Editor.The default settings are restored the next time you start Lumberyard Editor.SharerePost-User-4556816answered 5 years ago0I seem to be getting the same error. I added to gems Boids and Clouds I believe. Editor work fine before this. I get...end of file unexpectedly reached before all data was read.... I removed the two gems and save the settings but I still get the message and If I hold enter it will keep cycling the ok button but just loop back to message. Tried this but didn't fix the problem. I get this message right after the editor goes into "Initializing RenderD3D11......" on the startup ScreenSharerePost-User-8555080answered 5 years ago"


Question: How do you tell the difference Level entity and other entities

"I am currently trying to work on this SC graph that raycast to hit the level or another entity, and do something based on that entity. I am assuming that the Level is itself an entity, because I get entityId for an entity that does not match any of the entityid of entities in the entity outliner. My questions is how can you tell from SC that from the entityid, how to tell the Level Entity from others entities?I tried to use Find Component Of Type and see if that entity has the PhysX Terrain component but cant create a Uuid in SC.Follow"

Answer: "0Accepted AnswerSo we went with a using tags; however, we found two problems with this solution: support for querying tag in SC/lua and not able to have a drop down for tags. We came up with a gem that adds a few a new window to the editor that allows our designers to create tags, very similar to UE4 GameplayTags.SharerePost-User-3292008answered 3 years ago0you could group your entities in collision groups and raycast to get specific collisions only.SharerePost-User-8147840answered 3 years ago0Well i would have to include the level terrian into that group because if it hits only the level, than move to that point, it hits an enemy move to the enemy and start hitting it, if it hits an pickup, run to the item and pick it up etcSharerePost-User-3292008answered 3 years ago0You could create collision groups and use collision layers to group the collisions.https://docs.aws.amazon.com/lumberyard/latest/userguide/physx-configuration-collision-groups.htmlExample Collision Group ConfigurationThe following example defines Player, Enemy, Bullet, Foliage, and Terrain  layers, and the following collision groups:PlayerBullet  – Collides with Enemy  and Terrain.EnemyBullet  – Collides with Player  and Terrain.TerrainCollision  – Collides with Player, Enemy, Bullet, and Terrain.PlayerCollision  – Collides with Enemy, Bullet, and Terrain.SharerePost-User-8147840answered 3 years ago0Thinking about it, maybe you could do a raycast, get the first entity hit. Then you fetch this entity (EntityId), and check the Entity type (could be some values you defined) and decide the action. Get the next entity if the first is not usable, and so on. Then you get entity position (may have to walk to the entity), then you act on what flag the entity has. Slash at entity if it is enemy or pick up if it is pick up entity. There are several ways to do this, you have to decide which is better for your game.SharerePost-User-8147840answered 3 years ago0There are a couple of ways, the collision group path is good because it leverages information that's already part of the physics system, giving you finer contact filtering abilities. I have also seen the Tag system used, you set a Tag component to the entity you want to filter against and then on the raycast result you check if the entity returned has that Tag. This works, but it could be more cumbersome to work with as you'd have to test for that in every raycast.SharerePost-User-2322203answered 3 years ago"


Question: Issue restraining access to a single environment on AppConfig using IAM Policy

"Hello,For a while now I'm trying to restrict write access to a specific environment under AppConfig but it doesn't seem to work. I get access denied on "dev" environment. I have checked with the reference for appconfig (https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappconfig.html). I want to allow developers to be able to start a deployment only on dev environment but not on prod. Here is the policy I am using.{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": "appconfig:StartDeployment",            "Resource": [                "arn:aws:appconfig:*:ACCOUNT-ID:deploymentstrategy/*",                "arn:aws:appconfig:*:ACCOUNT-ID:application/*/environment/*",                "arn:aws:appconfig:*:ACCOUNT-ID:application/*/configurationprofile/*"            ],            "Condition": {                "StringEquals": {                    "aws:ResourceTag/environment": "dev"                }            }        }    ]}FollowComment"


Question: Why is HTTPD failing to start? Why is TLS failing to start? Missing certificate key is not missing!


Question: "S3, does default encryption require any action to 'trigger' flag showing encryption status in the CLI output?"

"Since AWS now applies SSE to all new object uploads to S3 buckets (since 1/5/23), how should this impact testing of S3 encryption via the CLI, such as using ‘get-bucket-encryption’?  https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.htmlIf an S3 bucket was previously unencrypted, it should now show up in our CLI results as having SSE, correct? Mainly, my question is, if a existing S3 bucket just sat there with no actions occurring, would the SSE automatically trigger and therefore any CLI output would reflect this new SSE status? Or is it possible the CLI would incorrectly show the bucket as unencrypted until some kind of put or get type action was run on the S3 bucket?In some earlier testing of S3 CLI that is dated no **earlier **than 1/26 the results included a lot of unencrypted buckets. However, since everything now has SSE because of this change from AWS and we randomly selected 2 buckets shown as not encrypted and re-ran the CLI, now the CLI output indicates that they have SSE. Just not sure what happened here.FollowComment"

Answer: "0From: Amazon S3 now automatically encrypts all new objectsWith this update, Amazon S3 will automatically apply SSE-S3 as the base level of Default Encryption setting for all new buckets and for existing buckets without any customer configured encryption setting. Existing buckets currently using S3 Default Encryption configuration will not change.So, even an empty bucket will have the Default Encryption set to SSE-S3.CommentShareEXPERTkentradanswered 3 months ago"


Question: How to automate sagemaker batch transform?

"does cloudformation support sagemaker batch transform? if yes, can the jobs be triggered/run automatically once the stack is created?FollowComment"

Answer: "1Accepted AnswerWhile CloudFormation doesn't currently offer a resource for a SageMaker Batch Transform (resource list here in the docs), there are plenty of other integration points to automate running these jobs.CloudFormationI'd actually argue that CloudFormation is probably not a great fit for this anyway because CloudFormation defines resources which can be created, updated, and deleted. I could maybe see a correspondence between "Create" = "Run a job", maybe "Delete" = "Delete job outputs", and possibly "Update" = "Re-run the job"? But these are opinionated choices that might not make sense in every case.If you really wanted, you could create a Custom CloudFormation resource backed by an AWS Lambda function using the CreateTransformJob API (via whatever language you prefer e.g. boto3 in Python).Note that:If you wanted to use the SageMaker Python SDK (import sagemaker, Transformer, etc) instead of the low-level boto3 interface in Python - you'd need to install this extra library in your Lambda function. Tools like AWS SAM and CDK can help with this.The maximum Lambda timeout is 15 minutes, you may not want to keep your Lambda function running (billable) just waiting for the transform to complete anyway, and even the overall Custom Resource will have a longer max timeout within which it must stabilize after a create/update/delete request... So additional orchestration may be required beyond a single synchronous Lambda function call.Other (better?) optionsAs mentioned above, you can create, describe and stop SageMaker Batch Transform jobs from any environment where you're able to call AWS APIs / use AWS SDKs... And you can even use the high-level open-source sagemaker SDK from anywhere you install it. Interesting options might include:Amazon SageMaker Pipelines: SageMaker Pipelines have native "steps" for a range of SageMaker processes, including transform jobs but also training, pre-processing and more. You can define a multi-step pipeline from the SageMaker Python SDK (in your notebook or elsewhere) and then start it running on-demand (with parameters) by calling the StartPipelineExecution API.AWS Step Functions: Step Functions provides general-purpose serverless orchestration so while the orchestration for SageMaker jobs in particular might be a little more complex (one step to start the job, then a polling check to check wait for completion) - the visual workflow editor and range of integrations to other services may be useful.Amazon S3 Lambda integrations can trigger an event automatically (to start your transform job) when new data is uploaded to Amazon S3.Scheduled EventBridge Rules can run actions on a regular schedule (such as calling Lambda functions, kicking off these pipelines, etc) - in case you need a schedule-based execution rather than in response to some event.The choice will depend on what the initial trigger for your workflow would be (schedule? Data upload? Some other AWS event? An API call from outside AWS?) and what other steps need to be orchestrated as well as your transform job in the overall flow.CommentShareEXPERTAlex_Tanswered a year agoclouduser a year ago@Alex_T - thanks. I agree cloudformation might not be a good fit. I was trying to see if there was any other way to create the jobs itself, define bunch of parameters and push/build stack via cloudformation or something similar and then trigger the jobs with ways like you suggested. but sounds like the creating jobs part is also possible only via sdkShare"


Question: VPN Log enabled but no logs are generated

"Hi y'all,Recently i enabled this new feature in one of our VPN (for both Tunnels), using delagated admin account, we already create the log group but even when the tunnel its UP or when its failed for any OnPrem issue, doesnt record any activity:https://aws.amazon.com/es/about-aws/whats-new/2022/08/aws-site-vpn-connection-logs-amazon-cloudwatch/This feature just record logs for any special condition in both tunnels (Static or BGP protocol used) ? or i miss something ?Thanks and regards in advance,FollowComment"

Answer: "1Accepted AnswerFor this issue its need to create a Support case asking for Update software version for each Tunnel Endpoints, seems its not automatically update after saved without change in tunnel Options workaorund.CommentShareKarlosanswered 9 months ago0Hello,Did you follow the steps outlined here; specifically the IAM section?CommentShareEXPERTTushar_Janswered 9 months agoKarlos 9 months agoeven when the role that i used if AdministratorAccess ? i need to create a new role and attach it to my user ?Share0Hello,The IAM permissions should have the below permissions, despite the admin access. Can you double check on the same ?{"Version": "2012-10-17","Statement": [{"Action": ["logs:CreateLogDelivery","logs:GetLogDelivery","logs:UpdateLogDelivery","logs:DeleteLogDelivery","logs:ListLogDeliveries"],"Resource": ["*"],"Effect": "Allow","Sid": "S2SVPNLogging"},{"Sid": "S2SVPNLoggingCWL","Action": ["logs:PutResourcePolicy","logs:DescribeResourcePolicies","logs:DescribeLogGroups"],"Resource": ["CloudWatch Logs log group ARN"],"Effect": "Allow"}]}More Importantly: Please note that the VPN endpoints need to be upgraded to enable the feature and be on the latest software version. Please use Modify VPN connections on the console and click save without changing anything on the tunnel, so that the software can be updated for the feature to be enabled. please note that doing the same, will hamper VPN tunnel connectivity for the time the software is being updated, hence do the same action on the tunnels one by one.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months agoKarlos 9 months agoAlready check both, IAM attached is right and refresh Tunnel options by save without changing anything on the tunnel, but still doesnt write on the log group.Share0Facing the same issue, Please let me know if you got to resolve this ?CommentShareChanderanswered 9 months agoKarlos 9 months agostill persists same issue with different accounts btw.Share0Indeed, i have same policy attached to my user (admin one), and after that i refresh the endpoint as you mentioned but i doesnt see any new log created yet. btw, the only log created was  this:"Permissions are set correctly to allow AWS CloudWatch Logs to write into your logs while creating a subscription."but anyone realted to the endpointsCommentShareKarlosanswered 9 months ago"


Question: Can log destination work with KMS encrypted kinesis streams

"I am following AWS CloudWatch Logs - Setting up a new cross-account subscription and I been able to get WAF logs from Account A to flow through to my Opensearch Cluster in Account B using the Documentation.But I want to extend it so that everything is doing Encryption at Rest or Server Side Encryption, but I am having an issue when I try to create a log destination where I get an error saying "Check if the destination is valid".I have the following setup:Data stream with Server-side encryption using KMS managed keyIAM role called CWLtoKinesisRole with the following trusted Policy:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "",            "Effect": "Allow",            "Principal": {                "Service": "logs.us-east-1.amazonaws.com"            },            "Action": "sts:AssumeRole",            "Condition": {                "StringEquals": {                    "aws:PrincipalOrgID": "o-12345"                }            }        }    ]}and the following policy:{    "Statement": [        {            "Action": "kinesis:PutRecord",            "Effect": "Allow",            "Resource": "arn:aws:kinesis:us-east-1:123456789123:stream/logs-recipient",            "Sid": ""        },        {            "Action": [                "kms:GenerateDataKey",                "kms:Encrypt",                "kms:Decrypt"            ],            "Effect": "Allow",            "Resource": "arn:aws:kms:*:123456789123:key/*",            "Sid": ""        }    ],    "Version": "2012-10-17"}Then when I run:aws logs put-destination \    --destination-name "testDestination" \    --target-arn "arn:aws:kinesis:region:123456789123:stream/logs-recipient" \    --role-arn "arn:aws:iam::123456789123:role/CWLtoKinesisRole"I get cloudwatch log destination: InvalidParameterException: Could not deliver test message to specified destination. Check if the destination is validAny direction on what I am missing here would be great,thanksPhilFollowComment"

Answer: "0Accepted AnswerSo I figured it out, while the trusted policy allows for you to have:"StringEquals": {                    "aws:PrincipalOrgID": "o-12345"                }PrincipalOrgID isn't allowed for  "Service": "logs.us-east-1.amazonaws.com"Which is less then great, so I have to have the following and update everytime a new account is added to our Org:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "",            "Effect": "Allow",            "Principal": {                "Service": "logs.us-east-1.amazonaws.com"            },            "Action": "sts:AssumeRole",            "Condition": {                "StringLike": {                    "aws:SourceArn": [                        "arn:aws:logs:*:11111111064:*",                        "arn:aws:logs:*:11111111608:*",                        "arn:aws:logs:*:11111111423:*",                        "arn:aws:logs:*:11111111580:*",                        "arn:aws:logs:*:11111111684:*",                        "arn:aws:logs:*:11111111264:*",                        "arn:aws:logs:*:11111111864:*",                        "arn:aws:logs:*:11111111735:*",                        "arn:aws:logs:*:11111111215:*",                        "arn:aws:logs:*:11111111760:*",                        "arn:aws:logs:*:11111111466:*",                        "arn:aws:logs:*:11111111704:*",                        "arn:aws:logs:*:11111111395:*",                        "arn:aws:logs:*:11111111653:*",                        "arn:aws:logs:*:11111111392:*",                        "arn:aws:logs:*:11111111413:*",                        "arn:aws:logs:*:11111111796:*",                        "arn:aws:logs:*:11111111914:*",                        "arn:aws:logs:*:11111111446:*",                        "arn:aws:logs:*:11111111690:*",                        "arn:aws:logs:*:11111111199:*",                        "arn:aws:logs:*:11111111136:*",                        "arn:aws:logs:*:11111111667:*",                        "arn:aws:logs:*:11111111731:*",                        "arn:aws:logs:*:11111111723:*",                        "arn:aws:logs:*:11111111459:*",                        "arn:aws:logs:*:11111111365:*",                        "arn:aws:logs:*:11111111270:*",                        "arn:aws:logs:*:11111111879:*",                        "arn:aws:logs:*:11111111658:*",                        "arn:aws:logs:*:11111111744:*",                        "arn:aws:logs:*:11111111601:*",                        "arn:aws:logs:*:11111111804:*",                        "arn:aws:logs:*:11111111462:*",                        "arn:aws:logs:*:11111111339:*",                        "arn:aws:logs:*:11111111975:*"                    ]                }            }        }    ]}Which you can see a lot of accounts.CommentShareWonderPhilanswered 8 months ago"


Question: "Lambda function throwing : TooManyRequestsException, Rate exceeded"

"When the Lambda function is invoked, occasionally I see the following error for the function even though there is no Load running or not many lambda functions running. While the throttling and quota requests are set to default running in the Mumbai region, but this error is observed even when no load is running.. How do I determine with configuration needs to be increased to address this problem ?2022-05-17T10:01:13.555Z84379818-c8b8-44a3-b353-2c9f7f8f5e48ERRORInvoke Error{"errorType": "TooManyRequestsException","errorMessage": "Rate exceeded","code": "TooManyRequestsException","message": "Rate exceeded","time": "2022-05-17T10:01:13.553Z","requestId": "c3dc9f1b-d7c3-40d5-bec7-78e19dc2e033","statusCode": 400,"retryable": true,"stack": ["TooManyRequestsException: Rate exceeded","    at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/json.js:52:27)","    at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:106:20)","    at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:78:10)","    at Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:686:14)","    at Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10)","    at AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12)","    at /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10","    at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9)","    at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:688:12)","    at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:116:18)"]}FollowComment"

Answer: "1"Rate exceeded" is often due to calling some service's API too frequently.  It might be a service your Lambda is calling, not anything to do with Lambda per se.  See https://aws.amazon.com/premiumsupport/knowledge-center/lambda-troubleshoot-throttling/ for example.CommentShareEXPERTskinsmananswered a year agoAWS-User-7049860 a year agoI would have agreed if this was reported due to calling some services API too frequently. In this case when the error was reported, there was no other service running, nor my lambda was invoking too many APIs either, it was reported on the first API call itself. And this I have observed many time being reported. I am clueless at this time why though.Share"


Question: "dynamodb import from s3 does not support LocalSecondaryIndexes, bug or intended behaviour?"

"AWS dynamodb released a "new" feature named import from s3 available in the console or using aws client sdk aws dynamodb --import-table. This operation also creates the dynamodb table before importing the data, thus it requires the specification of typical attributes to create a dynamodb table: table name, key schema (hash, range), billing mode, and a couple more. Although, it does not allow the specification of LocalSecondaryIndexes (LSI).Why not? It's a known fact that these cannot be added after the table has been created. So if i want to import a table with LSI i cannot use this feature. Is there is a reason behind this decision? Is it a bug? Are there plans for this to be allowed in a very short-term future? Thanks!FollowComment"

Answer: "0According to AWS Document, Your data will be imported into a new DynamoDB table, which will be created when you initiate the import request. You can create this table with secondary indexes, then query and update your data across all primary and secondary indexes as soon as the import is complete. You can also add a global table replica after the import is complete.https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/S3DataImport.HowItWorks.htmlCommentShareGautam Kumaranswered 6 months agoPedro 6 months agoThank you very much for your quick reply! Both the documentation link and the video in it mention "secondary indexes" and do not distinguish between Global Secondary Indexes (GSIs) and Local Secondary Indexes (LSIs). I know for a fact that the import operation allows the specification of GSIs. Although, it does not seem to allow LSIs. Does this means that i should not be using LSIs at all and should be using GSIs instead? ThanksShare"


Question: ThrottlingException when calling IoT SearchIndex

"HiI have just implemented an api to get the online status for our IoT devices using the SearchIndex operation in AWS IoT. This worked fine during testing, but when it was put into production it failed immediately. I tried manually doing a SearchIndex from the console at the time and got the following error:> aws iot search-index --index-name "AWS_Things" --query-string "thingName:xxx" --profile yyyAn error occurred (ThrottlingException) when calling the SearchIndex operation (reached max retries: 2): Rate exceededHow can I find out what the current throttling limit is for this operation?I found a list of throttling limits in the documentation, but can't see anything that concerns the IoT Index:https://docs.aws.amazon.com/general/latest/gr/iot-core.html#throttling-limitsFrom our logs found that the API was hit about 90 times per second at the time. We currently have around 430K devices.We could reduce the load by doing some caching on our side, but without knowing what the limits are, it is difficult to know if that will be sufficient.Is there perhaps a better way to query the online status of a device?FollowComment"

Answer: "1Accepted AnswerHi,the SearchIndex API is part of AWS IoT Device Management. You can find the quotas at https://docs.aws.amazon.com/general/latest/gr/iot_device_management.html. The quota is adjustable according to the documentation.KR,P.CommentSharePhilipp Sanswered a year agoAWS-User-9486041 a year agoThank you.Share"


Question: Elasticache redis Upgrade from 6.0 to 6.2 | Cache loss

I have recently upgraded my elasticache cluster with single node from 6.0 to 6.2 engine version and I have lost all keys stored during this upgrade.Please let me why this happened?FollowComment

Answer: 0Quoting from AWS documentation "The Amazon ElastiCache for Redis engine upgrade process is designed to make a best effort to retain your existing data and requires successful Redis replication." Since you had a single node you can expect data loss--SydCommentShareSydanswered 10 months ago0Two Questions -What is the process you used for upgrading EC Redis? are you running in Cluster mode disabled/enabled? do you have any replicas?What instance type are you using? Did instance change instance type during upgrade?CommentShareMahee Gunturuanswered 10 months ago


Question: Update on Multi-GPU Support?

"Hello,I understand that Lumberyard will be getting Directx12 support, but I would be grateful to know how well that will support multi-gpus, or if we can request more direct multi-gpu support?In short, we're 100% focused on cloud gaming and want to design our game to leverage Amazon's G2 instances, specifically the 8xlarge instance. This instance has 4 GPUs, but most game engines cannot leverage them. We just tested Ark: Survival Evolved in both G2 instances, and the performance was about the same (Unreal 4 does not support SLI or multi-gpu). Multi-gpu support is scheduled to come to CryEngine in April, but given their current budget issues, may not actually happen.Thank you for your time and consideration!Follow"

Answer: "0Kinda important to me as well. I would like to have multiple GPU supported for VR projects. VR is kinda resource heavy and we need as many resources to develop with :)SharerePost-User-5263425answered 6 years ago0Great question. I'll try to get you an answer.SharerePost-User-8353690answered 6 years ago0Thank you! We've just contacted RealtimeUK, the company that made the "Lost" Lumberyard demo, to inquire about making a Dragonpunk demo. This demo would highlight the capabilities of Cloud Gaming on AWS. The only catch is that they'll need multi-gpu support to leverage the 4 gpu's in the large G2 instance.SharerePost-User-2250218answered 6 years ago0Just read this article and got excited, but it unfortunately didn't provide a date for multi-GPU support. http://www.pcgamer.com/nvidia-talks-dx12-including-gameworks-support/SharerePost-User-2250218answered 6 years ago0I'm also interested in this. We switched from Unreal to Unity because of the Nvidia VRworks support with native SLI capability. We'd love to transition to Lumberyard, but for the work we're doing it's make or break to us to have SLI support. Either Nvidia VRworks, DX12 with multi-gpu support included, or native multi-gpu support needs to be implemented.SharerePost-User-8932878answered 6 years ago0Thanks for that info @REDACTEDUSERSharerePost-User-8353690answered 6 years ago"


Question: Cannot make my website live

I cannot make my website live. The instance is running perfectly. I've followed all the necessary steps but couldn't find the problem. Is there something in the settings to make it public?FollowComment

Answer: "0Check the ec2 security group and allow the port to access publicly.CommentSharefaizulhaqueanswered 3 months ago0Definitely, you should check out your security groups of the ec2 instance.CommentShareKanavpreet Singhanswered 3 months ago0Hi,There are some other considerations to check.  Assuming that your instance is in a public subnet, verify the following:Verify Elastic IP address for public access - This should be a publicly routable IP on the internetAn internet gateway is necessary for the internet communicationVerify your associated route tables to confirm your default route (0.0.0.0/0) points to your internet gatewayCheck that Security Groups will allow the appropriate level of accessCheck that VPC NACLs will allow communication (NACLs are stateless, so you need to check these for bi-directional traffic)Reference Diagram:Please let us know what you find, hope this helps!CommentShareAWS-User-0357409answered 3 months ago"


Question: S3 Object locking and eventual consistency?

"Hi,According to the S3 documentation then S3 offers eventual consistency for DELETES.Thus you may be able to down the content of a key shortly after it has been deleted.But, what if you set object locking on a key by using setObjectRetention.If setObjectRetention succeeds, can it then be assumed that no delete on the key (or a versionid of they key) was in progress being propagated through out S3?Best regardsThomasFollowComment"

Answer: "0Hi Thomas,S3 Object Lock is different from object locking in the context of consistency.The former is an S3 feature that allows you to store objects using a write-once-read-many (WORM) model. S3 Object Lock prevent an object from being deleted or overwritten for a fixed amount of time or indefinitely. See documentation here. This is different from object locking in the context of consistency i.e. if two PUT requests are simultaneously made to the same key, the request with the latest time stamp wins. Amazon S3 does not currently support Object Locking. See documentation here.Just like delete requests, Object Lock requests are also eventually consistent. As a result, an object lock request submitted at about the same time as a delete request, may not block that delete from occurring.I hope this answers your question.Edited by: ruhi-aws on Aug 14, 2019 10:50 AMEdited by: ruhi-aws on Aug 14, 2019 10:51 AMCommentShareAWS-User-4335394answered 4 years ago0Thanks for the answer.Best regardsThomasCommentShareThomashyldgaardanswered 4 years ago"


Question: How to visually create frontend for Amplify

"Hi all,I´m new to Amplify (even to AWS) and I feel life is easier for non coders with some integrated services as Amplify->GraphQL->Lambda Functions->DynamoDB. I´m making some tries with these services working together and my question is:In all examples found, I can create a simple website but frontend code is always given in the tutorials or videos, and they don´t go deeper on how that code was created. Maybe javascript frameworks or others. As I want to create business logic on server side (GraphQL, Lambda, DynamoDB), I only need to make a simple visual frontend for using components (maybe created with Figma) and no need to code more than minimum.Is there a service (inside or outside AWS) to visually create a frontend interface without coding as building blocks to be integrated with Amplify? I thought Amplify Studio could be my tool but I couldn´t find how.Thanks in advance,FollowComment"

Answer: "0Is there a service (inside or outside AWS) to visually create a frontend interface without coding as building blocks to be integrated with Amplify? I thought Amplify Studio could be my tool but I couldn´t find how.I think as close as you'll get within AWS is the new Amplify Studio UI Library which allows you to import visual "blocks" from Figma as React components.https://docs.amplify.aws/console/tutorial/buildui/CommentShareJohn Voldanswered a year ago0Thank you John for your response.I created a React project and got the components from Figma. Now editing app.js with the component code will paste it into my app, right? Is it the correct way if I´m not reliable in React?Thanks again and best regards,CommentShareToniGilanswered a year ago"


Question: Connecting AppSync with Redshift via Data API

"Hi,I'm looking for reasources that exaplin how to connect AppSync with Redshift via Data API.According to this, it should be supported: https://docs.aws.amazon.com/redshift/latest/mgmt/data-api.htmlHowever, I did not see Redshift as an option when defining a Data Source in AppSync.Do you know if we need to use a Lambda to bridge between AppSync and Redshift, or is there support for a direct connection?Thanks,IlanFollowComment"

Answer: "0I reached out to AWS Support and received this response:"As of now, AppSync is not able to integrate with Redshift directly and you would need to have a Lambda function to bridge between AppSync and Redshift. A list of the supported Datasources and operations can be found here [2]. However, since this is documentation [1] is mentioning that it is possible, I will reach out to the service team to confirm if this is an issue with the documentations and will get back to you as soon as I hear back from them."And this followup:"I have reached out the AppSync service team and confirmed that there is no direct way to integrate with Data API of Redshift, there is currently a feature request regarding that, but we do not have any ETA on when this feature will be released."CommentShareIlanZilberanswered 2 years ago"


Question: Aws Cloud Directory Policies on DynamicObjectFacet

"Hi all. I'm working with Aws Cloud Directory using the managed schema and through the GO API, so far so good with objects, links, search, queries; but, when I try to create a policy object with dynamic faced I get the error: "Missing required node values: [policy_type, policy_document]"I tried adding two more elements to the AttribuKeyAndValue but still got the error.var keysAndValues []types.AttributeKeyAndValuepolicyType := types.AttributeKeyAndValue{Key: &types.AttributeKey{SchemaArn: aws.String(APPLIED_SCHEMA_ARN),FacetName: aws.String("DynamicObjectFacet"),Name:      aws.String("policy_type"),},Value: &types.TypedAttributeValueMemberStringValue{Value: "AppUser",},}bina, _ := json.Marshal(obj)policyDoc := types.AttributeKeyAndValue{Key: &types.AttributeKey{SchemaArn: aws.String(APPLIED_SCHEMA_ARN),FacetName: aws.String("DynamicObjectFacet"),Name:      aws.String("policy_document"),},Value: &types.TypedAttributeValueMemberBinaryValue{Value: bina,},}keysAndValues = append(keysAndValues, policyType)keysAndValues = append(keysAndValues, policyDoc)I would be grateful if someone gives me a light on how to create policy objects using the dynamic schema.FollowComment"


Question: CloudWatch disk_used_percent alerts for multiple volumes on Nitro instance

"With Nitro instanaces, attached EBS volumes are not given a predictable device name (i.e. an ec2 instanace with two attached EBS volumes, the first volume might be nvme0n1 or nvme1n1)I'm using CloudFormation to build linux ec2 instances, each with a root volume and an additional EBS volume (mounted to /mnt/data for example.)  I want CloudWatch disk_used_percent alerts for both volumes.I was able to use the information from https://forums.aws.amazon.com/thread.jspa?messageID=896255 to configure a CloudWatch disk_used_percent alert for the root volume (/), but I can't figure out how to also add a disk_used_percent alert for the other volume (/mnt/data)Here is my amazon-cloudwatch-agent.json:{  "metrics": {    "append_dimensions": {      "AutoScalingGroupName": "${!aws:AutoScalingGroupName}",      "ImageId": "${!aws:ImageId}",      "InstanceId": "${!aws:InstanceId}",      "InstanceType": "${!aws:InstanceType}"    },    "aggregation_dimensions" : [["InstanceId","fstype","path"]],    "metrics_collected": {      "disk": {        "measurement": [          "disk_used_percent"        ],        "append_dimensions": {          "fstype": "ext4",          "path": "/"        }      }    }  }}Here is the relevant portion of my CloudFormation Template  RootDiskUsedPercentAlarm:    Type: AWS::CloudWatch::Alarm    Properties:      AlarmActions:        - !Sub arn:aws:sns:${AWS::Region}:xxxxxxxxxxxx:RootDiskUsedPercentAlarm      AlarmDescription: disk_used_percent alarm for root volume of EC2 instance      MetricName: disk_used_percent      Namespace: CWAgent      Statistic: Average      Period: 300      EvaluationPeriods: 1      Threshold: 90      ComparisonOperator: GreaterThanThreshold      Dimensions:        - Name: InstanceId          Value: !Ref EC2Instance        - Name: fstype          Value: ext4        - Name: path          Value: /FollowComment"

Answer: "0Accepted AnswerThe "append_dimensions" inside "disk" section is not needed.If you want disk metrics aggregated per EC2 Instance(across all path and fstype), you can specify \["InstanceId"] in the "aggregation_dimensions". If you want disk metrics per path, fstype and EC2 Instance, you can specify \["InstanceId","fstype","path"] in the "aggregation_dimensions". If you want both, please specify the aggregation_dimensions as following:"aggregation_dimensions": \[\["InstanceId"], \["InstanceId","fstype","path"]]CommentShareshunli0410answered 3 years ago0Thank you.  That worked.  Looks like I was over complicating it.CommentSharea-ronanswered 3 years ago0Thanks for this. Any idea if it is possible to monitor multiple disks on one/all EC2 instances (Windows for instance)?I basically want to monitor all my disks for < 10% free across the whole environment.At the moment I need to specify an Alarm for C: and D: and E:, etc...Instead of being able to specify A - Z for instance, or only C, D, E, R in one Alarm.CommentShareTsaanswered 2 years ago"


Question: How to upgrade Lightsail Postgres instance? (minor version upgrade)

"According to the RDS docs, it's possible to manually trigger minor version upgrades for PostgreSQL or even have it upgrade automatically once a new version is approved.I currently have a database instance in Lightsail, running version 12.8. When creating a new instance, the dropdown offers version 12.11, so I'm assuming I should also be able to upgrade my current instance to 12.11.Where do I find the manual / auto upgrade options in the Lightsail interface?FollowComment"

Answer: "0According to the following Lightsail documentation, the specification seems to be that minor database upgrades in Lightsail are performed automatically during maintenance periods. [1][1] Changing the preferred maintenance and backup windows for your database in Amazon Lightsail | Lightsail Documentationhttps://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-changing-preferred-maintenance-and-backup-windows----- excerpt -----Minor version upgrades, and other database maintenance tasks, are performed automatically during the preferred maintenance window for your database.----- excerpt -----The above documentation does not appear to mention manual upgrades, so we assume that only automatic upgrades are supported.I hope this helps.CommentSharemn87answered 8 months agoAWS-User-6449199 8 months agoThank you for the pointer to the relevant docs!When I list my relational databases via the AWS cli, here is part of the output I get:"engine": "postgres","engineVersion": "12.8","preferredMaintenanceWindow": "mon:22:55-mon:23:25","pendingMaintenanceActions": [  {    "action": "system-update",    "description": "New Operating System update is available"  }],It looks looks like the system knows there is a pending update, but it doesn't install the new version (even though a maintenance window is set).Share"


Question: RI or savings plan for aws mq

Can I purchase RIs or a Savings Plan for AWS MQ service?  Not finding this here or anywhere in the docsFollowComment

Answer: "1Accepted AnswerNo, there is no RI/Savings Plan for Amazon MQ.CommentShareEXPERTkentradanswered 19 days agoEXPERTRiku_Kobayashireviewed 19 days ago"


Question: Clarification Regarding usage of EKS with Fargate in GovCloud regions

"Hello,We are investigating AWS Fargate using Amazon EKS.When reading this document: https://docs.aws.amazon.com/eks/latest/userguide/fargate-getting-started.htmlIt is stated AWS Fargate with Amazon EKS is available in all Amazon EKS Regions except AWS GovCloud (US-East) and AWS GovCloud (US-West). However, when looking at this document: https://aws.amazon.com/compliance/services-in-scope/DoD_CC_SRG/The table indicates that the feature is available in the Gov cloud regions.Could we please have clarification on whether or not the feature is available in the GovCloud regions?When attempting to create a Fargate profile with in our GovCloud subscription we get the following error; Error: error creating EKS Fargate Profile (fargate-test:default): AccessDeniedException: Account <aws-gov-acct-number> is not authorized to use this serviceThank you,Robert BatsonFollowComment"

Answer: "1Accepted AnswerHi,As the GovCloud (US) page clarifies 'Amazon EKS on Fargate is not available in AWS GovCloud (US).'. This may change in the future where the feature is made available in the region.Thanks for pointing out that the Services in Scope page for the DoD CC SRG indicates the ATO for Amazon EKS on AWS Fargate for the GovCloud (US) regions. I will reach out to the internal teams to have the page updated to avoid any confusion.CommentShareRajarshi_Danswered 9 months ago"


Question: neuron compiling bert model for inferentia on tf2

"Hi,This link https://awsdocs-neuron.readthedocs-hosted.com/en/latest/frameworks/tensorflow/tensorflow-neuron/tutorials/bert_demo/bert_demo.html mentions how to compile using tensorflow 1. Can anyone let me know the steps to neuron compile a BERT large model for running inference on inferentia using tensorflow v2??Thanks in advance AjayP.S This is what my log looks like while compiling on tf1 INFO:tensorflow:fusing subgraph {subgraph neuron_op_e76ab3d9bc74f09f with input tensors ["<tf.Tensor 'bert/encoder/ones0/_0:0' shape=(1, 512, 1) dtype=float32>", "<tf.Tensor 'bert/encoder/Cast0/_1:0' shape=(1, 1, 512) dtype=float32>", "<tf.Tensor 'bert/embeddings/LayerNorm/batchnorm/add_10/_2:0' shape=(1, 512, 1024) dtype=float32>"], output tensors ["<tf.Tensor 'bert/pooler/dense/Tanh:0' shape=(1, 1024) dtype=float32>", "<tf.Tensor 'bert/encoder/layer_23/output/LayerNorm/batchnorm/add_1:0' shape=(1, 512, 1024) dtype=float32>"]} with neuron-cc . Compiler status ERROR WARNING:tensorflow:11/03/2022 04:28:48 AM ERROR 9932 [neuron-cc]: Failed to parse model /tmp/tmpbyvnmr6h/neuron_op_e76ab3d9bc74f09f/graph_def.pb: The following operators are not implemented: {'Einsum'} (NotImplementedError)INFO:tensorflow:Number of operations in TensorFlow session: 7427 INFO:tensorflow:Number of operations after tf.neuron optimizations: 2901 INFO:tensorflow:Number of operations placed on Neuron runtime: 0WARNING:tensorflow:Converted /home/ubuntu/bert_repo/patent_model/ to ./bert-saved-model-neuron_tf1.15 but no operator will be running on AWS machine learning accelerators. This is probably not what you want. Please refer to https://github.com/aws/aws-neuron-sdk for current limitations of the AWS Neuron SDK. We are actively improving (and hiring)! {'OnNeuronRatio': 0.0}---I assume the OnNeuronRatio being 0 means that I wont be able to make use of Inferentia hardware acceleration. Is that correct?FollowComment"

Answer: "0Have you taken a look at the tensorflow-neuron TF2 HuggingFace tutorial? This tutorial demonstrates how to compile and run TF2 HuggingFace models on Inf1. You can also take a look at the tensorflow-neuron TF2 API documentation for additional information about the compilation process.You are correct that 0 operations placed on the Neuron runtime means the Inferentia NeuronCores (the main compute engines on inf1) will not be used.Please let us know if you have any additional questions!CommentSharejoshamazonanswered 7 months agorePost-User-6132983 7 months agoHi Josh, thanks for your answer. However Im facing other issues related to the code on the link you posted. Please check my new question ...https://repost.aws/questions/QUEtWfa_1PRmqAf7NrFL8Zfw/issue-with-loading-neuron-modelShare"


Question: Pinpoint 10DLC Campaign rejected downstream

Campaign was rejected with the reason: "Use case and sample messages are inconsistent."Our selected use case was TWO_FACTOR_AUTHENTICATIONOur sample message was: "Your SYSTEMNAME verification code is 123456. ..."Am I misunderstanding the TWO_FACTOR_AUTHENTICATION use case? It seems like our sample message perfectly fits the definition to me.ThanksFollowComment