Question: AWS::CloudFormation::Interface metadata ignored

"Hello,I've followed documentation here: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-interface.html#cfn-cloudformation-interface-parameterlabels to set up parameter groups and labels for a stack. And everything was just fine for the last 5 (five) years in several regions (us-east-1, eu-west-1 and eu-central-1). However from today it doesn't seem to be working anymore: all my labels and groups are completely ignored and are not displayed during stack update.Assuming this is not a bug, there might be some changes in the template format made which are not reflected in the documentation.So, my questions are :What is the right way to set up parameter groups and labels ?Or in the case if this is just a bug, is it considered to be safe to perform stack updates ?Best Regards, Alex.UPD: Parameter labels are back, but still no names of ParameterGroups.I hope this is just a temporary issue.FollowComment"

Answer: "1Accepted AnswerHello Alex,I have tested locally in my AWS account with very basic template and I can see both ParameterGroups and ParameterLabels are getting displayed on AWS Console as mentioned in the template. I have also deployed in many regions (us-east-1, eu-west-1 and eu-central-1) and it seems to be working.Metadata:   AWS::CloudFormation::Interface:   ParameterGroups:      -       Label:         default: "S3 Configuration"      Parameters:         - Bucketname  ParameterLabels:     Bucketname:       default: "Give your Bucket Name here"Parameters:  Bucketname:    Type: StringResources:  S3:    Type: AWS::S3::Bucket    Properties:        BucketName: !Ref BucketnameSee the above template for your reference.Since ParameterGroups and ParameterLabels are just used to group and sort parameters in the AWS CloudFormation console using Metadata section, there will not be any issue during Update operation.You can refer to AWS::CloudFormation::Interface  document for more information.I hope things are working as expected at your end as well.CommentShareSUPPORT ENGINEERSatyam_Ganswered a year agoAWS-User-5890268 a year agoHello Satayam,I have tested locally in my AWS account with very basic template and I can see both ParameterGroups and ParameterLabels are getting displayed on AWS ConsoleYes, you're right. After a couple of weeks all the labels and groups were back with no changes from my side. Thanks for fixing that!Since ParameterGroups and ParameterLabels are just used to group and sort parameters in the AWS CloudFormation console using Metadata section, there will not be any issue during Update operation.Thank you for the answer! Have a nice day!All the best, Alex.Share"


Question: My website is down

HiI received the below error on my app:"Service UnavailableThe server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later."I checked the AWS health dashboard and saw the "No recent issues". I have also increased the instance size but issue not fixed. Please check and let me know about the issue.This is my app URLhttp://app.proprompter.com/FollowComment

Answer: 0That error message is being produced by the web server (Apache) running on your instance. The instance is running fine; the Apache process is running but it is producing that error message. You'll need to troubleshoot why Apache is not operating correctly and serving up your application page(s).CommentShareEXPERTBrettski-AWSanswered 10 months ago


Question: "Unable to unmarshall error response ( 500, Internal Server Error )"

"We get this Internal Server Error when we use AmazonSNSClient to subscribe to a topic and it fails only very few times. The exception doesn't have too much of details. We have updated proguard as well (https://github.com/aws/aws-sdk-android/blob/master/Proguard.md). We don't have the request ID as AmazonSNSClient.getCachedResponseMetadata is deprecated. How do we find the cause?Non-fatal Exception: com.amazonaws.AmazonClientException: Unable to unmarshall error response (<init> [class java.lang.String]). Response Code: 500, Response Text: Internal Server Errorat com.amazonaws.http.AmazonHttpClient.handleErrorResponse(AmazonHttpClient.java:706)at com.amazonaws.http.AmazonHttpClient.executeHelper(AmazonHttpClient.java:388)at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:199)at com.amazonaws.services.sns.AmazonSNSClient.invoke(AmazonSNSClient.java:2262)at com.amazonaws.services.sns.AmazonSNSClient.subscribe(AmazonSNSClient.java:1256)at com.amazonaws.services.sns.AmazonSNSClient.subscribe(AmazonSNSClient.java:2107)...Caused by java.lang.NoSuchMethodException: <init> [class java.lang.String]at java.lang.Class.getConstructor0(Class.java:2204)at java.lang.Class.getConstructor(Class.java:1683)at com.amazonaws.transform.AbstractErrorUnmarshaller.newException(AbstractErrorUnmarshaller.java:63)at com.amazonaws.transform.StandardErrorUnmarshaller.unmarshall(StandardErrorUnmarshaller.java:62)at com.amazonaws.services.sns.model.transform.InternalErrorExceptionUnmarshaller.unmarshall(InternalErrorExceptionUnmarshaller.java:38)at com.amazonaws.services.sns.model.transform.InternalErrorExceptionUnmarshaller.unmarshall(InternalErrorExceptionUnmarshaller.java:25)at com.amazonaws.http.DefaultErrorResponseHandler.handle(DefaultErrorResponseHandler.java:95)at com.amazonaws.http.DefaultErrorResponseHandler.handle(DefaultErrorResponseHandler.java:41)at com.amazonaws.http.AmazonHttpClient.handleErrorResponse(AmazonHttpClient.java:682)at com.amazonaws.http.AmazonHttpClient.executeHelper(AmazonHttpClient.java:388)at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:199)at com.amazonaws.services.sns.AmazonSNSClient.invoke(AmazonSNSClient.java:2262)at com.amazonaws.services.sns.AmazonSNSClient.subscribe(AmazonSNSClient.java:1256)at com.amazonaws.services.sns.AmazonSNSClient.subscribe(AmazonSNSClient.java:2107)...FollowComment"

Answer: "0SNS SDK usage needs some good documentation. This error happens only in the release build and is because of missing proguard rule. Adding the following resolves it,-keep class com.amazonaws.services.sns.** { *; }CommentShareEthan1983answered 6 years ago"


Question: EKS migration from 1.21 to 1.22

This is in EKS 1.21 yaml filespec:rules:- http:paths:- path: /*backend:serviceName: ssl-redirectservicePort: use-annotationHow can i migrate into EKS 1.22 yaml file**Because latest ingress controller port is only int. please help how can i translate into 1.22 EKSFollowComment

Answer: "0Update kubernetes  ingress api version in ingress object before migrating should resolve the issue.CommentShareNitin Goyalanswered 6 months ago0Hi,--> Please update the ingress api version to networking.k8s.io/v1--> If you want to use "use-annotation" field as port number then first add below example annotation and then modify spec(pathType is required).alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'spec:rules:host: www.example.comhttp:paths:path: /pathType: Prefixbackend:service:name: ssl-redirectport:name: use-annotationbackend:service:name: exampleport:number: <port number {int}>pathType: ImplementationSpecific--> To verify the values then please execute below command and see the possible values required for ingress object,kubectl explain ingress.spec.rules.http.paths.backend.service --api-version=networking.k8s.io/v1--> Ingress and IngressClass resources have graduated to networking.k8s.io/v1. Ingress and IngressClass types in the extensions/v1beta1 and networking.k8s.io/v1beta1 API versions are deprecated and will no longer be served in 1.22+. Persisted objects can be accessed via the networking.k8s.io/v1 API. Notable changes in v1 Ingress objects (v1beta1 field names are unchanged):spec.backend -> spec.defaultBackendserviceName -> service.nameservicePort -> service.port.name (for string values)servicePort -> service.port.number (for numeric values)pathType no longer has a default value in v1; "Exact", "Prefix", or "ImplementationSpecific" must be specifiedOther Ingress API updates:backends can now be resource or service backendspath is no longer required to be a valid regular expressionPlease refer this for more information - https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/1846I hope the above information is useful. Thank you.CommentShareSUPPORT ENGINEERrePost-User-9634908answered 6 months ago"


Question: Unable to create Inbound rule

"I'm using powershell to create inbound IP rules for an EC2 Instance sec group.I'm running the following code. $IpRange = New-Object -TypeName Amazon.EC2.Model.IpRange $IpRange.CidrIp = "<IPAddr>/32" $IpRange.Description = "Sean" $IpPermission = New-Object Amazon.EC2.Model.IpPermission $IpPermission.IpProtocol = "tcp" $IpPermission.ToPort = 3389 $IpPermission.FromPort = 3389 $IpPermission.Ipv4Ranges = $IpRange Grant-EC2SecurityGroupIngress -GroupId sg-00xxxx -IpPermission $IpPermissionIt seems to work just fine at the cmdline, but nothing gets pushed to AWS.Is there something else I need to do?FollowComment"

Answer: "0Hi,Use the below link for guidance to setup your security group using powershell[1]https://docs.aws.amazon.com/powershell/latest/userguide/pstools-ec2-sg.htmlWhen viewing the security group please make sure you are in the correct region, consider using DescribeSecurityGroups API call to view your security group if it was created succesfullly[1]https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroups.htmlsecondly you can use cloudtrail to check the api call when you create a security group[2]https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSecurityGroup.htmlAnd if you are using Powershell you need to have AWS powershell tools installed[3]https://aws.amazon.com/powershell/you can also try using Systems Manager Run Command AWS-RunPowerShellScript document[4]https://docs.aws.amazon.com/systems-manager/latest/userguide/run-command.htmlCommentSharerePost-User-9017359answered a year ago"


Question: dig eastcutlabs.com = status: SERVFAIL

"I've been using route53-purchased domains with netlify to point to their webapps successfully for several apps.I recently created a second hosted zone (eastcutlabs.com) via terraform that was the same domain name as a previously working domain of the same name. I deleted both of them and tried to recreate just one domain of the same name and reconfigured the A and CNAME records that makes it point to my netlify webapp, but it does not work no matter how many times I delete the hosted zone and try again. I ran a dig eastcutlabs.com and it shows status: SERVFAIL. I did a dig eastcutlabs.com _trace and it does not return the A record that exists in route53. You can find my route53 config the dig and dig_trace below.I subsequently purchased another domain (eastcutlab.com - note: "lab" instead of "labs") and pointed it to the same webapp as I'm trying with eastcutlabs.com and it worked (config also below).For eastcutlabs.com (non-working domain) I also tried flushing the DNS cache from: https://developers.google.com/speed/public-dns/cache.tldr:eastcutlabs.com (plural: returns a SERVFAIL)eastcutlab.com (singular: works)====================================eastcutlabs.com (not working)resource "aws_route53_record" "Z1H2B5E0B5U9QA_eastcutlabs--com--_A_" {    name    = "eastcutlabs.com"    records = \["104.198.14.52"]    ttl     = "300"    type    = "A"    zone_id = "${aws_route53_zone.Z1H2B5E0B5U9QA_eastcutlabs--com.zone_id}"  }    resource "aws_route53_record" "Z1H2B5E0B5U9QA_eastcutlabs--com--_NS_" {    name    = "eastcutlabs.com"    records = \["ns-770.awsdns-32.net.", "ns-1166.awsdns-17.org.", "ns-127.awsdns-15.com.", "ns-2018.awsdns-60.co.uk."]    ttl     = "172800"    type    = "NS"    zone_id = "${aws_route53_zone.Z1H2B5E0B5U9QA_eastcutlabs--com.zone_id}"  }    resource "aws_route53_record" "Z1H2B5E0B5U9QA_eastcutlabs--com--_SOA_" {    name    = "eastcutlabs.com"    records = \["ns-2018.awsdns-60.co.uk. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400"]    ttl     = "900"    type    = "SOA"    zone_id = "${aws_route53_zone.Z1H2B5E0B5U9QA_eastcutlabs--com.zone_id}"  }    resource "aws_route53_record" "Z1H2B5E0B5U9QA_www--eastcutlabs--com--_CNAME_" {    name    = "www.eastcutlabs.com"    records = \["optimistic-wiles-20fec5.netlify.com"]    ttl     = "300"    type    = "CNAME"    zone_id = "${aws_route53_zone.Z1H2B5E0B5U9QA_eastcutlabs--com.zone_id}"  }  eastcutlab.com (working)resource "aws_route53_record" "Z1ZRGWFIEUH3F5_eastcutlab--com--_A_" {    name    = "eastcutlab.com"    records = \["104.198.14.52"]    ttl     = "300"    type    = "A"    zone_id = "${aws_route53_zone.Z1ZRGWFIEUH3F5_eastcutlab--com.zone_id}"  }    resource "aws_route53_record" "Z1ZRGWFIEUH3F5_eastcutlab--com--_NS_" {    name    = "eastcutlab.com"    records = \["ns-45.awsdns-05.com.", "ns-1994.awsdns-57.co.uk.", "ns-1046.awsdns-02.org.", "ns-948.awsdns-54.net."]    ttl     = "172800"    type    = "NS"    zone_id = "${aws_route53_zone.Z1ZRGWFIEUH3F5_eastcutlab--com.zone_id}"  }    resource "aws_route53_record" "Z1ZRGWFIEUH3F5_eastcutlab--com--_SOA_" {    name    = "eastcutlab.com"    records = \["ns-948.awsdns-54.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400"]    ttl     = "900"    type    = "SOA"    zone_id = "${aws_route53_zone.Z1ZRGWFIEUH3F5_eastcutlab--com.zone_id}"  }    resource "aws_route53_record" "Z1ZRGWFIEUH3F5_www--eastcutlab--com--_CNAME_" {    name    = "www.eastcutlab.com"    records = \["optimistic-wiles-20fec5.netlify.com"]    ttl     = "300"    type    = "CNAME"    zone_id = "${aws_route53_zone.Z1ZRGWFIEUH3F5_eastcutlab--com.zone_id}"  }  dig eastcutlabs.com (not working); <<>> DiG 9.10.6 <<>> eastcutlabs.com  ;; global options: +cmd  ;; Got answer:  ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 7554  ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1    ;; OPT PSEUDOSECTION:  ; EDNS: version: 0, flags:; udp: 4096  ;; QUESTION SECTION:  ;eastcutlabs.com.INA    ;; Query time: 99 msec  ;; SERVER: 192.168.0.1#53(192.168.0.1)  ;; WHEN: Mon Sep 23 19:20:22 PDT 2019  ;; MSG SIZE  rcvd: 44  dig eastcutlabs.com +trace (not working)...  eastcutlabs.com.172800INNSns-127.awsdns-15.com.  eastcutlabs.com.172800INNSns-770.awsdns-32.net.  eastcutlabs.com.172800INNSns-1166.awsdns-17.org.  eastcutlabs.com.172800INNSns-2018.awsdns-60.co.uk.  CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A  NS SOA RRSIG DNSKEY NSEC3PARAM  CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20190928044441 20190921033441 17708 com. G131mLtsBTVuH1wpOFbRs0/voaY_V7rxVJHc9XWhCelqZkbFiB6tVxKw oqpWdiXL_p4V40G3Koo8Y7y/Qd2M+hV4edC0nal1RrNt97hkRLQAcTJ/ wHZcMl84JbDtZT44UY1iHWv4GUxlxyaQiew/YceADjSzNtqG8mU1zNhC P1g=  HHEA290R8BPOIQQR30IRSVVI46C9B0HV.com. 86400 IN NSEC3 1 1 0 - HHEALMV137V9EQO2DK68KA3F9MVS0D32  NS DS RRSIG  HHEA290R8BPOIQQR30IRSVVI46C9B0HV.com. 86400 IN RRSIG NSEC3 8 2 86400 20190929051624 20190922040624 17708 com. pFc2boy242bdH_MGS/l_aAk_xjQ5BlplgNjmEWeIAMqObTSo7XgqCxtS 47XNGsRW2uxjT8sfZXEkysTYcHcfPvFWydDez8u6/T_uJjx5L2wRSHpJ 9tzyILeKubVEZmNDYn79Wj3DBVuiADOnyYlI6gh1dfd3tagS9XSG9XPk h3U=  ;; Received 682 bytes from 192.26.92.30#53(c.gtld-servers.net) in 45 ms    ;; Received 33 bytes from 205.251.196.142#53(ns-1166.awsdns-17.org) in 21 ms  dig eastcutlab.com (working); <<>> DiG 9.10.6 <<>> eastcutlab.com  ;; global options: +cmd  ;; Got answer:  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64743  ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1    ;; OPT PSEUDOSECTION:  ; EDNS: version: 0, flags:; udp: 4096  ;; QUESTION SECTION:  ;eastcutlab.com.INA    ;; ANSWER SECTION:  eastcutlab.com.300INA104.198.14.52    ;; Query time: 21 msec  ;; SERVER: 192.168.0.1#53(192.168.0.1)  ;; WHEN: Mon Sep 23 19:24:39 PDT 2019  ;; MSG SIZE  rcvd: 59  dig eastcutlab.com +trace (working)...  eastcutlab.com.172800INNSns-948.awsdns-54.net.  eastcutlab.com.172800INNSns-1046.awsdns-02.org.  eastcutlab.com.172800INNSns-1994.awsdns-57.co.uk.  eastcutlab.com.172800INNSns-45.awsdns-05.com.  CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A  NS SOA RRSIG DNSKEY NSEC3PARAM  CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20190928044441 20190921033441 17708 com. G131mLtsBTVuH1wpOFbRs0/voaY_V7rxVJHc9XWhCelqZkbFiB6tVxKw oqpWdiXL_p4V40G3Koo8Y7y/Qd2M+hV4edC0nal1RrNt97hkRLQAcTJ/ wHZcMl84JbDtZT44UY1iHWv4GUxlxyaQiew/YceADjSzNtqG8mU1zNhC P1g=  GL38I96QK11041TE88Q6CO1V4LOSIRCK.com. 86400 IN NSEC3 1 1 0 - GL3B3M8MBCJM4GS4D8D5OI5PPIBLOTMN  NS DS RRSIG  GL38I96QK11041TE88Q6CO1V4LOSIRCK.com. 86400 IN RRSIG NSEC3 8 2 86400 20190930042015 20190923031015 17708 com. w/D5rSb5jeBTdj8ObyfFCrHfqf1v6JktHHbQei06jIrXRIeVhSdgB9wL iQXgl9pd7YaYEcAuOlCsuhp0AQiFVrQ0dxDh6ugG/OittIFHAXHiptYk fF4wpInlo8NNV0DPtNFu_uIt4YKwu5ZjfxysY2odfBueG3HAugU0Xe9a _iQ=  ;; Received 680 bytes from 192.26.92.30#53(c.gtld-servers.net) in 45 ms    eastcutlab.com.300INA104.198.14.52  eastcutlab.com.172800INNSns-1046.awsdns-02.org.  eastcutlab.com.172800INNSns-1994.awsdns-57.co.uk.  eastcutlab.com.172800INNSns-45.awsdns-05.com.  eastcutlab.com.172800INNSns-948.awsdns-54.net.  ;; Received 195 bytes from 205.251.192.45#53(ns-45.awsdns-05.com) in 22 ms  Edited by: tomkit on Sep 23, 2019 8:00 PMFollowComment"

Answer: "0Hi,When you create a hosted zone, Route 53 assigns a unique set of four name servers to the hosted zone and creates an NS record that uses those same four name servers. When you create another hosted zone, Route 53 assigns another unique set of four name servers to the hosted zone. When you created a new hosted zone for eastcutlabs.com, you got four name servers that don't match the name servers in the configuration for your domain registration.Here's how you fix it:Get the four name servers that Route 53 assigned to your hosted zone. See "Getting the Name Servers for a Public Hosted Zone" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlUpdate the NS record in the hosted zone to use the four name servers that you got in step 1. See "Editing Records":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-editing.htmlUpdate the domain registration to use the four name servers that you got in step 1. See "Adding or Changing Name Servers and Glue Records for a Domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.htmlAfter you make the change, it'll take a couple of days for you to be able to access eastcutlabs.com again because the DNS resolver that you're using has cached the wrong name servers, and the default cache duration is typically 48 hours.ScottCommentShareEXPERTAWS-User-6179575answered 4 years ago"


Question: WordPress issue after clone to larger instance

Just wondering if anyone else has had issues with WordPress after cloning a snapshot to a larger instance.So far I've had to repair the database and my forms plugin won't submit - any thoughts??FollowComment

Answer: 0I've cloned instances to expand resources many times without a problem.Have you checked the server logs to see if any errors are showing up?CommentShareDavid Ganswered 2 years ago0Yes - I found that I had to re-enable NGIXN and it solved the issueCommentShareSFLWAanswered 2 years ago


Question: Does AWS Service Connect encrypt in transit

"Hello,I am considering using the new ECS feature Service Connect to do service-to-service communication.  However, we have a requirement that all traffic be encrypted end-to-end.  Does AWS Service Connect encrypt traffic between two service connect proxies?  I am not able to find anything in the documentation stating anything about encryption with service connect.Thank you,-JeffFollowComment"

Answer: "0Accepted AnswerIf end-to-end encryption is required today, you can start with AppMesh (https://docs.aws.amazon.com/app-mesh/latest/userguide/tls.html).  End-to-end encryption is on the roadmap for AWS Service Connect.CommentShareRolyanswered 4 months agoFage88 4 months agoThank you for answering my question Roly.Can I take this as confirmation that end-to-end encryption is not available for AWS Service Connect?Share"


Question: Deployment fail after restarting the core device using bootstrap exit code

"During the deployment of the components one of the components requires the restart the core device(raspberrypi) so we're using the bootstrap exit 101 inside the component script  to accomplish that task but after the device restarted  the  deployment status is getting failed.We have tried the deployment without the restart option in that case the deployment is getting successfully completed.Below is the link to the logs files to the failure deployment : https://pastebin.com/vNCXvPwnThanks,MadhavFollowComment"

Answer: "0Accepted AnswerHi Madhav,Thanks for reporting this issue. There is a bug in all released versions of greengrass where the exit code 101 may not work when used in a bootstrap script to signal that the device should restart. Apparently it 'may' work depending on timing of when the loader script executes, but it is "mostly broken".We have already fixed this issue (link below) which will be released as part of 2.5. For all the released versions this will be fixed with the next patch version.Pull request that fixes the issue: https://github.com/aws-greengrass/aws-greengrass-nucleus/pull/1041Best,FahadCommentShareAWS-User-3001960answered 2 years ago0Hi Fahad,Thanks for the reply.Best,MadhavCommentShareMadhavanswered 2 years ago"


Question: localhost:8080 Connection refused

while working on the kubernetes open source the problem that is localhost:8080 connection refused on ubuntu ec2 instance.FollowCommentAWS-Harrison a month agoSubstantially more details will be need to answer this question. Is Ubuntu the operating system of an EC2 instance that you are using as a node in a Kubernetes cluster? Have you used netstat to validate that port 8080 is listening? What is being accessed over port 8080?Share


Question: Restart MWAA environment programmatically

"Hi,We use custom packages as dependencies of some of our PythonOperators. Therefore, when we update these packages, we'd like to reflect this update when used by a PythonOperator in MWAA.The current solution today is to "restart" the MWAA in the UI (by simply editing anything in the MWAA environment configuration).But we wondered if there was any solution in order to trigger this restart of the MWAA env programmatically, so it is possible to integrate this an extra step of a CodePipeline for instance.ThanksFollowComment"

Answer: "0Hi!You can call update-environment, either with the new S3 version ID for your new plugins/requirements.txt or with an additional configuration override, such as custom.lastupdate = "<current time>", as part of your CI/CD pipeline that will force MWAA to restart.Thanks!CommentShareJohn_Janswered 2 years agorePost-User-0377898 a month agoNot sure how to use the configuration override. I triedaws mwaa update-environment --name dev custom.lastupdate = "<current time>"but got an error 'Unknown options: =, <current time>, custom.lastupdate'Share0Note that, as of Airflow 2.0, you do not need to package custom operators as plugins and should simply place them somewhere in your S3 dags folder.  These will be synced automatically by MWAA to each container and no restart is required.  See https://airflow.apache.org/docs/apache-airflow/stable/plugins.html .CommentShareJohn_Janswered 5 months ago"


Question: Inspector EC2 Performance Considerations

"We have a big fleet of EC2 instances in our production account and we would like to know if we should be worried about any performance issues should we go ahead and enable inspector, since we can't exclude instances and once enabled will cover all instances, running the SSM agent. Is there any documentation that explains how the scanning and reporting mechanism works ?For example, using the Guardduty malware scanning it will take a snapshot and do an offline scanning rather on the EC2 itself. So, knowing that the inspector scanning leverages the SSM agent running on the EC2, should there be any concerns at all, when we decide to go ahead and enable inspector in a production environment ?FollowComment"

Answer: "0Amazon Inspector should have minimum impact on your EC2 fleet. See extract from documentation at https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html.For more details about how Inspector scan the resources, please refers to https://docs.aws.amazon.com/inspector/latest/user/scanning-resources.html===Extracted ===Unlike traditional security scanning software, Amazon Inspector has minimal impact on the performance of your fleet.CommentShareronald_lanswered 5 months ago"


Question: DynamoDB - KMS - What is the impact on running services back to Default from AWS Managed CMK

Customer wants to know the following:For some tables in DynamoDB encryption is changed from "Default" to "KMS - AWS Managed CMK". There is an extra cost associated for using KMS which they want to avoid.Are all the charges from KMS coming from these DynamoDB tables? How to identify that?What is the impact of changing encryption for these tables back to "Default" from console? How to change this without service interruption?FollowComment

Answer: 0Accepted AnswerAre all the charges from KMS coming from these DynamoDB tables? How to identify that?All KMS activity is recorded in CloudTrail logs. See our docs on how DDB uses KMS for more information on how to identify DDB intertion with KMS.https://docs.aws.amazon.com/kms/latest/developerguide/services-dynamodb.html#dynamodb-cmk-trailWhat is the impact of changing encryption for these tables back to "Default" from console? How to change this without service interruption?The default encryption type uses an AWS owned CMK for DDB server-side encryption.The impact of changing from an AWS managed CMK to the default (AWS owned CMK) is that the table will no longer be protected by a CMK in the customer's account.Changing the CMK used to protect a table will not cause a service interruption: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/encryption.tutorial.html#encryption.tutorial-updatePlease see the DDB Encryption docs for more details on how DDB server-side encryption works:https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.htmlPlease see the KMS docs for more details on the different kinds of CMKs:https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keysCommentShareAWS-User-2193511answered 3 years ago


Question: "Hi guys, Deployed the datasync agent on-premised (Vmware environment) successfully and did the "Test Network Connectivity" to AWS DataSync which is also successful."

"Hi guys,Deployed the datasync agent on-premised (Vmware environment) successfully and did the "Test Network Connectivity" to AWS DataSync which is also successful. I saw forum "https://forums.aws.amazon.com/thread.jspa?threadID=302863&start=25&tstart=0" , but somehow I dont see any answer to fix it as all messages are sent by PM. Can anyone help me on this?I am having issue with DataSync agent, I have deployed agent machine in ESXi environment but and all connectivity tests have been been passed, but somehow whenever I clicked on Get Key, it will try to connect but eventually nothing appears and page cannot be displayed... anyone face same issue. pls help on this as I have Data migration today/tomorrowFollowComment"

Answer: "0You can get an activation key directly from the local console on the VM itself, following the instructions here: https://docs.aws.amazon.com/datasync/latest/userguide/local-console-vm.html#get-activation-key.  You can then use this activation key when creating your agent in the AWS Management Console for DataSync.CommentShareJeff_Banswered a year ago0Can you verify the followingCheck that host has the correct time and that host is configured to synchronize its time automatically to a Network Time Protocol(NTP) server and that VM has the correct time. For information about synchronizing the time see https://docs.aws.amazon.com/datasync/latest/userguide/local-console-vm.html#time-managementCheck if there is an existing VPCE endpoint. If yes then it will give this error when trying to activate using public endpoint.Check that there is no SSL or deep packet inspection within on-prem firewall as this can also cause activation to fail even though network connectivity tests show as PASSED.You can also check the connectivity on below endpoint using telnet or any another connectivity command.telnet d3dvvaliwoko8h.cloudfront.net  443telnet activation.datasync.<region>.amazonaws.com  443telnet activation-sync.<region>.amazonaws.com  443CommentShareSUPPORT ENGINEERAWS-User-7131632answered a year ago"


Question: How to setup Cloudtrail to audit a microservice architecture?

Can someone please share any example implementation of setting up Cloudtrail to audit a microservice architecture in AWS.FollowComment


Question: Amazon Lex V2: How to identify slack user-id in lambda connected to Amazon Lex v2 bot

"With amazon Lex v1 there was "userid" attribute as part of intent request but I do not see "userid" as part of V2 intent request.If I have integrated Lex v2 with slack, I would like to find username in lambda.FollowComment"


Question: Running multiple container using single EC2 instances in ECS

"Hi, guys.We are recently want to test on the AWS ECS service. Currently there are a total of 10 containers running on an EC2 which we deploy manually using composer. However, we would like to know if we use ECS service, can we still share the same EC2 or we need to provisioning instances for every services? If possible, we would like to share the similar EC2 across 10 containers. Is that possible?Besides, we would also like to know how the load balancing would work if we deploy using the similar EC2 instance.Thanks in advance.FollowComment"

Answer: "1Hi!So if you register the EC2 instance to join the ECS Cluster (and therefore also be an ECS Instance), you can create services that the cluster will then deploy in the available pool of ECS instances.You can create deployment constraints, which are rules to say "deploy this service, in that way, on nodes that have these properties", which means it will try only create tasks if there are ECS instances, with available capacity, that match these rules to deploy the containers to.If you prefer to not have to manage EC2 instances anymore, you can go down the Fargate route. If your use-case is simple enough, that's my go-to recommendation, as the (for on-demand) the maybe extra costs, IMHO, are outweight by simplicity. In that case each service' tasks gets their own host, which further ensures isolation.If you want to scale in the same or similar way as Fargate does but not have to worry about provisioning the EC2 instances, you can create an Autoscaling Group and give that as a Capacity provider to your ECS cluster. ECS will then drive the autoscaling based on the number of needed containers for your services, and still allows to respect placement rules (strategies) as mentioned above.When creating your service, you can specify which target groups of a load balancer you would like to register. ECS and ELB then communicate together to automatically register new containers, send traffic to them, or de-register these if unhealthy.If you want to deploy with something docker-compose compatible which deals with creating all your services definitions, IAM rules, permissions etc, and lots more, try out ECS Compose-X | the labs.CommentShareJohnPrestonanswered 10 months agoSky 10 months agoSo, does this mean that if I have a t3.medium instances. I can run all containers inside this instance without provisioning other instances?ShareJohnPreston 10 months agoTechnically, yes, if that is the only instance you have. But now, know that the ECS agent will report the CPU/RAM available to the containers. So if you have 10 tasks which require a minimum of .5GB of RAM and .25 CvPUs, then would that all fit in the instance type ? You might run out of space really quickly.If you want HA with failover, running a cluster with a single instance is not quite the way to go.Share"


Question: Would like help in determining the cost for deleting all objects in a bucket

"We have a bucket of data / objects that are no longer needed / viable. Before we delete we'd like to know how much it will cost us to do so. The bucket can remain and may get re-used in the future, but all the data inside of it needs to be wiped out.The formulas seem a bit convoluted as the data / objects are spread in Standard S3 and in Glacier S3. Is there an easy formula to plug in our values?There are approximately 21M objects in the bucket. I don't see a way to correlate objects to storage type (Standard / Glacier).FollowComment"

Answer: "0There is no cost to delete objects in S3, but the method you use to delete 21M objects may incur cost. Assuming we want to delete all objects within this specific bucket, and that versioning is not enabled on this bucket, the simplest method would likely be to use an S3 Lifecycle Rule to purge all of the objects.When using S3 Lifecycle Rules, we are not charged for API operations in S3 (such as a LIST operation), but we are charged for the lifecycle transition. When using S3 Standard, lifecycle transitions are actually free, but there is a charge associated with lifecycle transitions when using an S3 Glacier storage class see here.The exact charge to use S3 Lifecycle Rules for this delete operation will depend on how many objects we're storing in S3 Standard vs. S3 Glacier, and you may also want to consider that S3 Glacier has a minimum storage duration that we will be billed for, assuming there are newly stored objects within this storage class.Alternatively, you could also leverage S3 Inventory and S3 Batch Operations to obtain a list of those objects and their associated storage class, while using S3 Batch Operations to remove them.CommentShareDarren Ranswered 3 months agoITManager 3 months agoThank you Darren. We'll look at S3 Inventory and S3 Batch to determine how many objects in each storage class to better determine costs for deleting. We believe that the objects are "old enough" to not incur "early withdrawal" penalties, but will check on that as well. Appreciate the thoughts / ideas!Share"


Question: Using AWS Glue to transform data from DynamoDB to Redshift.

"Hello everyone,I'm new with AWS Glue. I'm doing a lab to move data from DynamoDB to Redshift with AWS Glue and my job does not succeed.I test several times but none of them works (assume that IAM roles are correct).With Dynamodb:Do I need to create a connection to dynamodb using JDBC ? (It's weird because at connection access there is no username or password to fill in).I need to create the data target first or just create it while add job?With Redshift:After creating cluster, should I add table into public schema or just leave it as default?Do I need a S3 Endpoint to complete the lab? ( because It requires a S3 endpoint to test connection successfully)Any suggestions about this case is a big help for me.Thanks,natuanFollowComment"

Answer: "0I figured it out, in my case I created a data target but not the same database name, just create new job with right database name.CommentSharenatuananswered 4 years ago0Need a S3 Endpoint (S3 Gateway)CommentSharenatuananswered 4 years ago"


Question: Amazon Connect Chat - is it possible to have the GUI only in french ?

Some parts of the Chat Widget seem to be always in English. How could we have that GUI only in French ?ThanksFollowComment

Answer: "0The out-of-box chat widget does not currently support localization, but you can deploy a custom chat widget to allow for localization of the UI.  Check out this github for an example UI that you can customize and deply: https://github.com/amazon-connect/amazon-connect-chat-interfaceCommentSharegthomasanswered a year ago"


Question: Backend hosted on EC2 refuses connection

"I have launched EC2 instance and cloned my backend (Node.js) from GitHub, but i cannot connect to it neither via EC2 Console link (public IPv4 adress/public IPv4 DNS) nor via fetch from my front-end app (hosted on another service) i have the same error: ERR_CONNECTION_REFUSED. Instance is running, both status checks passed. Saw a similar question, unfortunately without a solution to the problem, it was advised to run a command wget http://localhost to check if application is working, and here's my output:Resolving localhost (localhost)... 127.0.0.1Connecting to localhost (localhost)|127.0.0.1|:80... failed: Connection refused..It might be useful:Network ACL has 2 inbound rules:default (rule number *), which denies all traffici added rule with number 1, which allows all trafficAlso i have 2 security groups:default, which i believe directs all traffic at itself? (it's source is self ID)second group was generated on instance initialization and i added my own rules later, which allows all traffic (e.g. rule type HTTPS, protocol TCP, port range 443, source 0.0.0.0/0)FollowComment"

Answer: "0Access on localhost also appears to be failing.Is the web server running in EC2?Run the following command to find the process listening on port 80.sudo lsof -i :80If nothing is displayed, start the web server.CommentShareEXPERTRiku_Kobayashianswered 9 days agoKuskov 8 days agoI'm not sure where exactly should i run this command. Tryed this in EC2 Instance Connect, nothing happend. Then i executed 'npm run start' and tryed again, and still nothing.ShareRiku_Kobayashi EXPERT8 days agoThis command is executed on the EC2 that is used as the backend.How do you envision accessing the back-end application?If you use HTTP as the protocol, you would need to start a web server.ShareKuskov 8 days agoWell, this is exaxtly what i did.ShareRiku_Kobayashi EXPERT8 days agoIf you run this command and nothing is displayed, it is likely that the web server is not running on EC2.We are not sure which web server you are using on your EC2, but we will describe an example for Nginx.The following is an example command to start Nginx.This command must be changed depending on the web server installed on your EC2.sudo systemctl start nginxsudo systemctl enable nginxShareKuskov 5 days agoI'm not using Nginx/Apace/etc on my backend project. I only have Express and Cors libraries installed and configured to listen requests. Is this not enough? Should i try Nginx?ShareShow 1 more comment"


Question: Request more than question

"I have the answer already, but I'm annoyed that I took the error message at face value and spent clock cycles trying to figure out whether there really was a problem somewhere (other than my stupid fingers and thick brain).I had tried to add a route to a peering connection and typed in a CIDR of 10.100.0.0/0, and was presented with a message:The route identified by 10.100.0.0/0 already exists.Thankfully before I spent too much time examining the myriad routes in our setup to find the duplicate, I had the presence of my co-worker to look over my shoulder and he caught right away that I should have typed 10.100.0.0/16, which resolved the issue.  I'd been typing 0.0.0.0/0 too much lately.I went to a CIDR calculator as a reference and much more clear:Invalid CIDR formatI would appreciate it if you would change the error message to something more accurate.  The route identified by 10.100.0.0/0 CAN'T EXISTFollowComment"

Answer: 1Probably best to open a support ticket to provide this sort of feedback.CommentShareIsaac Behrensanswered a year ago


Question: How to cancel saving plan

"Hi,We had procured AWS RI (1-year plan) for EC2 to save costs for the long term. However, due to changes in the business landscape, we don't need the EC2 instance for time being. Do you have any contact with AWS India to stop the commitment plan or defer it for a few months?saving plan id - 6cbe4553-87e5-4419-b84d-1ceb26e87c03FollowComment"

Answer: 0Generally speaking savings plan cannot be canceled / deferred once purchased unless it's made in error.However your best bet is to contact AWS customer support by creating a ticket in the support center.CommentShareJason_Sanswered a year ago


Question: How to know if a specific user is verified using the amazon-cognito-identity-js module if the type of the verification message is a link?

"I'm building a mobile app with React Native that manages user registration and authentication with AWS Cognito. In order to integrate Cognito with my project I use amazon-cognito-identity-js. In order to verify the email of the recently added user I send a verification link (not verification code) that verifies the user if he clicks on it. After the user clicks the link, the confirmation status of the user changes from Unconfirmed to Confirmed inside the AWS Cognito console, and that's great, but I need to know from the JavaScript code if the user is indeed verified. What i'm supposed to do?I already know that if I send a verification code and not a link there's no problem because inside the app the user inputs the verification code previously received and then I just have to call the CognitoUser.confirmRegistration(code: string, ...) method in order to allow the user to continue with the registration process inside my app. If I Use a verification link I can't use that method because it takes a code as an argument. Checking the only ressource available for amazon-cognito-identity-js I found that there's not an attribute or method that let's you know if an specific user is verified or not, and if I'm not able to know if the user is verified or not I can't let him go to the following screens of the app.Thanks guys and I hope that there's a solution for this problem.FollowComment"


Question: launch templates and AWS image builder using old user-data

"I'm using AMI image builder to build the base image for an AMI, when the AMI is released it updates the AMI on a launch template however, if I try to update the User data script which is on the LT, there's a weird issue where the LT user-data gets updated but it doesn't select the new AMI, it just blank which makes the launch template using the old version of the template with the older AMI.When I run the AMI builder it'll update the Launch template but will use the old version of the user data script.FollowComment"

Answer: "0It seems like the issue might be due to the order of operations during the updating of the Launch Template. When you're updating the Launch Template with the new AMI, make sure you're also specifying the updated user-data script at the same time.Here's an example of how you might do this using the AWS CLI:aws ec2 create-launch-template-version --launch-template-id lt-0abcd1234ef56789a --source-version $old_version --launch-template-data file://launch-template-data.jsonIn this command, lt-0abcd1234ef56789a is the ID of the launch template you're updating and $old_version is the version of the launch template you're using as a base. The launch-template-data.json file should include the ID of the new AMI and the updated user-data script.The launch-template-data.json file would look something like this:{    "ImageId": "ami-0abcd1234ef56789a",    "UserData": "IyEvYmluL2Jhc2gKCnN1ZG8gYXB0LWdldCB1cGRhdGUgLXkKc3VkbyBhcHQtZ2V0IHVwZ3JhZGUgLXkKc3VkbyBhcHQtZ2V0IGluc3RhbGwgLXkgZ2l0"}In this file, ami-0abcd1234ef56789a is the ID of the new AMI and IyEvYmluL2Jhc2gKCnN1ZG8gYXB0LWdldCB1cGRhdGUgLXkKc3VkbyBhcHQtZ2V0IHVwZ3JhZGUgLXkKc3VkbyBhcHQtZ2V0IGluc3RhbGwgLXkgZ2l0 is the Base64-encoded user-data script.Remember to replace the above details with your own AMI ID, Launch Template ID and UserData script. The UserData script should be Base64 encoded.It's also important to note that when you create a new version of a launch template, the default version of the launch template doesn't automatically update to the new version. You can set the new version as the default using the modify-launch-template command:aws ec2 modify-launch-template --launch-template-id lt-0abcd1234ef56789a --default-version $new_versionIn this command, lt-0abcd1234ef56789a is the ID of the launch template and $new_version is the version number of the new version you just created.CommentShareEXPERTsedat_salmananswered 23 days agojoet 21 days agoI'm doing this in terraform, can't seem to find 'source-version' under launch template?Share"


Question: What is the main differences between an load balancer and a autoscaling group

What is the main differences between an load balancer and a autoscaling groupFollowComment

Answer: "3Load balancer - Think of it as a set of AWS-managed servers across Availability Zones (AZs) that front-end your instances and balance traffic to them.Autoscaling group - If you mean EC2 autoscaling, this helps you create a set of instances across AZs that will increase or decrease in number in response to conditions you define, e.g. CPU load on the running instances, or number of messages in an SQS queue the instances are reading from.Note the SQS example I mentioned - you may have autoscaling without load balancing for a "worker tier".  Or, often the two work together where a load balancer targets the instances in an autoscale group, balancing traffic to them.CommentShareEXPERTskinsmananswered 10 months ago1Accepted AnswerLoad Balancer distributes the application traffic across multiple targets such as EC2 instances, IP addresses and containers. If I have two running instances and N number of members are requesting for access their data. Then load balancer will distribute those N requests evenly between two running instances. Load balancer decreases the load on the individual instance and increases the overall performance of the application.There are few load balancer choices on AWS:Application Load Balancer: Operates at layer 7. Targets IP instances, Lambda, containers. Supported protocols are HTTP, HTTPS, gRPCNetwork Load balancer: Operates at layer 4. Targets IP, instances, ALB, containers. Supported protocols are TCP, UDP, TLSGateway Load Balancer: Pass through load balancer that operates as layer 3 gateway and layer 4 load balancer. Targets IP, instances. Supported protocols are IP.Classic Load Balancer: Operates at layer 4/7. Targets EC2-Classic. Supported protocols are TCP, SSL/TLS, HTTP, HTTPS. Classic load balancer isn't actively developed.AWS Global Accelerator: Acts like a load balancer. Operates at TCP/UDP. Targets IP, ALB, NLB. Supported protocols are TCP, UDPAutoscaling is used to automatically increase and decrease the number of instances based on the application requirement. It ensures that you have the correct number of instances available to handle the load for your application.For example, an Auto Scaling group has a minimum size of 1 instance, a desired capacity of 2 instances, and a maximum size of 4 instances. The scaling policies that you define adjust the number of instances, within your minimum and maximum number of instances, based on the criteria that you specify.The goal of an Auto Scaling Group is to:Scale out (add EC2 instances) to match an increased loadscale in (remove EC2 instances) to match a decreased loadEnsure we have a minimum and a maximum number of machines runningAutomatically register new instances to a load balancerCommentSharePiyushMattooanswered 10 months ago1From an AWS services point of view:Load Balancing as it sounds is related to balancing out the traffic to multiple targets to achieve stability. It is also referred to as Elastic Load balancing.Elastic Load Balancing (ELB) automatically distributes incoming application traffic across multiple targets and virtual appliances in one or more Availability Zones (AZs).vs ASG or an auto-scaling group enables you to use Amazon EC2 Auto Scaling features such as health check replacements and scaling policies. The size of your auto scaling group is maintained according to a pre-defined number of instances, which you configure as the required capacity. You can use manual or automatic sizing to resize groups according to application requirements.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months ago0Thanks very much for all them who answered my query, i have got a better understanding now.CommentShareJagadishanswered 9 months ago"


Question: Using Hyperparameter Tuning Jobs over Training and Preprocessing

Some data science teams want to tune the hyperparameters of their preprocessing jobs alongside ML model training jobs.Does AWS have a recommended approach to establish this using Sagemaker Hyperparameter tuning?FollowComment

Answer: "0Accepted AnswerIt depends on the dataset and the question for ML to answer.Yes, it is feasible to do HPO with preprocessing. However, to run a HPO job, it is required to define to a specific target to achieve, e.g. maximize/minimize certain values during the whole HPO process. Thus, it is important to understand what is the target during preprocessing.  If the answer is yes, they should be able to leverage Hyperparameter Tuning Jobs.Here is how HPO works in SageMaker. Firstly, we define each training Job with output in a container and specify the hyperparameters in  /opt/ml/input/config/hyperparameters.json. When we run the pipeline using HyperparameterTuner in SageMaker,  the initial Job can pass the hyperparameters to the Pipeline for HPO, and return the model with highest score.Option 1, if there is a clear defined target for preprocessing to achieve,  we can also do HPO separately for data preprocessing through defining the function and outputs in a container and use HyperparameterTuner fit to tune the preprocessing.Option 2.   include the preprocessing + training code in the whole SageMaker Training Job. But then you can't use separate infrastructure for training and preprocessing.So it depends on what exactly they are looking for, but they can likely use SageMaker HPO.CommentShareAWS-User-4760880answered 2 years ago"


Question: Lightsail web portal throwing 400 error

"When I log into https://lightsail.aws.amazon.com/It's throwing this error:400 Bad RequestRequest Header Or Cookie Too LargeServerWhat's going on with LightSail? How do I fix this access the server configurations?On the same note, I've seen other errors in the past when logging into LightSail (including something about API limit exceeded??) Is LightSail a reliable option to run servers?OS: Windows 10 64bit 20H2Browser: Chrome 64bit latest versionEdited by: rboy on Apr 30, 2021 5:05 PMFollowComment"

Answer: "0I don't know why it happened, but clearing the cookies seem to resolve this issue. If anyone has any insight into this (and my other question about reliability API limits error when logging into the web portal) it would be appreciated.CommentShareRBoyanswered 2 years ago0Heh, flashback to my days as a volunteer on AOL telling everyone to clear their cash and delete cookies.CommentShareDavid Ganswered 2 years ago0Regarding the "Request Header Or Cookie Too Large" issue: we've verified the problem and are currently working on a fix. In the meantime, you can clear your cookies or switch to another browser if you continue to experience this issue.Regarding the "API limit exceeded" errors: this error may occur if you rapidly refresh the page (assuming you're seeing this error on the Lightsail console). This error happens when your API request rate exceeds the rate allowed by Lightsail, and does not mean that the service is unavailable.CommentSharetanbriananswered 2 years ago0Thanks for the clarification.The APi error happened as soon as I logged into the lightsail console web portal. I didn’t refresh the page.Edited by: rboy on May 4, 2021 10:42 AMCommentShareRBoyanswered 2 years ago"


Question: Coding study

"Good morning, I don't have programming compentencies, but I'm very keen in tts. I use Polly with SSML. I'm considering to start a web developer course and would like to ask you if php7 can be used for Amazon Polly with good results. Moreover, what is the most useful programming language I could study to get the best out of text to speech? Thank you so much.FollowComment"

Answer: "0Accepted AnswerHi LBajard!There are Amazon Polly SDKs available in many languages. You can check the full list of officially supported there: https://aws.amazon.com/polly/developers/There are also code examples for each, including PHP, which are quite simple, so you can start using them with minimum of coding experience.I wish you many successes in your pursue of web development skills and have a lot of fun and satisfaction with adding Text-to-Speech features to your applications!Best Regards,Patryk from Amazon Polly teamCommentShareAWS-User-2529203answered 3 years ago0Thank you so much :)CommentShareLBajardanswered 2 years ago"


Question: "AWS Amplify, GraphQL endpoint, the Introspection call is authenticated?"

"Hi,Next, a quote from this article https://docs.amplify.aws/lib/graphqlapi/getting-started/q/platform/js/#using-graphql-transformersThe CLI automatically downloads GraphQL Introspection Schemas from the defined GraphQL endpoint and generates TypeScript or Flow classes for youI was wondering if the HTTP call to the defined GraphQL is authenticated or not.Thanks in advanceFollowComment"

Answer: "0You just need to add the rules like this hereCommentSharejthornes-awsanswered 10 months ago0Maybe I didn't explain well, my point is, when anybody uses the CLI to retrieve the introspection schema, this request is made using credentials? is it authenticated?CommentSharerePost-User-8044460answered 10 months ago"


Question: ACM certificate validation pending with Route 53 hosted zone with parent domain in other DNS service

"Hi, I'm trying to validate a public certificate requested from ACM with CNAMEs dev-application.customer.com and *.dev-application.customer.com.In this case DNS-name customer.com is registered outside of Route53. I created Public hosted zone on Route53.For certificate validation I was able to add records to  Hosted zone with AWS Console, after few hours validation is still pending.I'm able to make http-requests to dev-application.customer.com after adding IP for one of mentioned NS-records into my /etc/resolv.conf.Without this dev-application.customer.com can't be resolved.Might that actually be the reason why certificate validation is pending - ACM's doesn't resolve the hosted zone as it isn't available at customer.com DNS?FollowComment"

Answer: "0Accepted AnswerOn your external registrar, you must set nameservers to the values given by route53 in the NS records. It may take some times...You can check with a whois request: https://whois.domaintools.com/CommentSharebacattaanswered 10 months ago"


Question: Configuring End-to-End Encryption

"I've been having issues setting up End-to-End Encryption using the provided guidance:https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https-endtoend.htmlI have a ASP.NET Core 2.2 Web application, and I need End-to-End configured to meet requirements regarding PHI. Right now, I have HTTPS enabled, but I can wireshark on an EC2 instance and see unencrypted traffic.When I go through the guidance, all requests to my site end up failing. Is there something obvious I'm missing?I've attempted using a Classic Load Balancer and an Application Load Balancer.Edited by: acaivano-smd on Jan 20, 2020 5:09 AMFollowComment"

Answer: "0I still have not been able to configure this, any guidance?CommentShareacaivano-smdanswered 3 years ago0Bumping this again, still having issues.CommentShareacaivano-smdanswered 3 years ago0I ended up upgrading my support package, and I got some support from Amazon support.For those in the future trying to configure this:Add a 443 -> 443 listener to your Load BalancerFollow this guidance: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/SSLNET.SingleInstance.htmlCommentShareacaivano-smdanswered 3 years ago"


Question: "AWS MQTT Push Not working, what is SVCUID"

"I can't seem to get mqtt pushing to work. Trying to run a lambda at the edge. I put in the topic name when creating the component, I've attached a policy to the cert. Component upload successfully. When I run the script I getTraceback (most recent call last):File "main.py", line 54, in <module>connection = ipc_utils.connect()File "main.py", line 47, in connectconnect_future = connection.connect(self.lifecycle_handler)File "/greengrass/v2/packages/artifacts/MqttTestGGCv2/4.0.0/awsiot/eventstreamrpc.py", line 440, in connectraise eFile "/greengrass/v2/packages/artifacts/MqttTestGGCv2/4.0.0/awsiot/eventstreamrpc.py", line 434, in connecttls_connection_options=self._tls_connection_options)File "/greengrass/v2/packages/artifacts/MqttTestGGCv2/4.0.0/awscrt/eventstream/rpc.py", line 307, in connectconnection)RuntimeError: 1047 (AWS_IO_SOCKET_CONNECTION_REFUSED): socket connection refused.I believe the error is:amender = MessageAmendment.create_static_authtoken_amender(os.getenv("SVCUID"))I don't know what SVCUID is?Full python code:from awsiot.greengrasscoreipc.model import (PublishToTopicRequest,PublishMessage,BinaryMessage)import osimport awsiot.greengrasscoreipc.client as clientimport timefrom awsiot.greengrasscoreipc.model import (QOS,PublishToIoTCoreRequest)from awscrt.io import (ClientBootstrap,DefaultHostResolver,EventLoopGroup,SocketDomain,SocketOptions,)from awsiot.eventstreamrpc import Connection, LifecycleHandler, MessageAmendmentTIMEOUT = 15class IPCUtils:def connect(self):elg = EventLoopGroup()resolver = DefaultHostResolver(elg)bootstrap = ClientBootstrap(elg, resolver)socket_options = SocketOptions()socket_options.domain = SocketDomain.Localamender = MessageAmendment.create_static_authtoken_amender(os.getenv("SVCUID"))#amender = MessageAmendment.create_static_authtoken_amender(100061)#hostname = os.getenv("AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT")hostname = "/greengrass/v2/ipc.socket"connection = Connection(host_name=hostname,port=8033,bootstrap=bootstrap,socket_options=socket_options,connect_message_amender=amender,)self.lifecycle_handler = LifecycleHandler()connect_future = connection.connect(self.lifecycle_handler)connect_future.result(TIMEOUT)return connectionwhile True:ipc_utils = IPCUtils()connection = ipc_utils.connect()ipc_client = client.GreengrassCoreIPCClient(connection)topic = "my/topic"  message = "Hello, World!"  request = PublishToTopicRequest()  request.topic = topic  request.qos = QOS.AT_LEAST_ONCE  publish_message = PublishMessage()  publish_message.binary_message = BinaryMessage()  publish_message.binary_message.message = bytes(message, "utf-8")  request.publish_message = publish_message  #try:  operation = ipc_client.new_publish_to_topic()  #except Exception as e:  #   print("ERRORRRR: " + str(e))  #operation.activate(request)  #future = operation.get_response()  #future.result(TIMEOUT)  time.sleep(5)  Attached Policy:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": "iot:Connect","Resource": ""},{"Effect": "Allow","Action": "iot:Publish","Resource": ""}]}Edited by: brayden on Feb 11, 2021 2:45 PMFollowComment"

Answer: "0Hi,SVCUID is a secret token provided to your component by Greengrass. In order to run using IPC, your component must be started by Greengrass, not by you on the command line.Your code is creating the IPC client and connecting inside of the while true, which is going to make it create more and more clients. You should take this out of the while loop so that you only create a single connection and connect once.Using the python SDK version 1.5.4 or later you can now simply useimport awsiot.greengrasscoreipcipc_client = awsiot.greengrasscoreipc.connect()Prior to that version, please make sure that you are using the IPCUtils exactly as it is provided from https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html, otherwise you may run into trouble.If you're still having problems, please provide your full component log file as well as the greengrass log file.Cheers,Michael DombrowskiCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0I'm getting (when using a lambda):2021-02-16T18:03:22.674Z [INFO] (Thread-7) com.aws.greengrass.builtin.services.mqttproxy.MqttProxyIPCAgent: Not Authorized. {error=Principal MqttTestGGCv2 is not authorized to perform aws.greengrass.ipc.mqttproxy:aws.greengrass#PublishToIoTCore on resource my/topic}I attached a policy to the cert to allow pub/sub all topics, when creating component I specified the topic for the cloud and localI get (when using recipe):component log2021-02-16T20:58:57.336Z [INFO] (Copier) com.example.HelloWorld: stdout. DEBUG:awsiot.eventstreamrpc:<awsiot.greengrasscoreipc.client.PublishToIoTCoreOperation object at 0x7fc88eb42a90> received #1 APPLICATION_ERROR [Header(':content-type', 'application/json', <HeaderType.STRING: 7>), Header('service-model-type', 'aws.greengrass#UnauthorizedError', <HeaderType.STRING: 7>), Header(':message-type', 1, <HeaderType.INT32: 4>), Header(':message-flags', 2, <HeaderType.INT32: 4>), Header(':stream-id', 1, <HeaderType.INT32: 4>)] b'{"message":"Not Authorized","_service":"aws.greengrass#GreengrassCoreIPC","_message":"Not Authorized","_errorCode":"UnauthorizedError","detailMessage":"UnauthorizedError[aws.greengrass#GreengrassCoreIPC]: Not Authorized","stackTrace":[],"suppressedExceptions":[]}'. {scriptName=services.com.example.HelloWorld.lifecycle.Run, serviceName=com.example.HelloWorld, currentState=RUNNING}greengrass log2021-02-16T20:58:57.335Z [INFO] (Thread-4) com.aws.greengrass.builtin.services.mqttproxy.MqttProxyIPCAgent: Not Authorized. {error=Principal com.example.HelloWorld is not authorized to perform aws.greengrass.ipc.mqttproxy:aws.greengrass#PublishToIoTCore on resource my/topic}Recipe:"ComponentConfiguration": {"DefaultConfiguration": {"accessControl": {"aws.greengrass.ipc.pubsub": {"com.example.HelloWorld:pubsub:1": {"policyDescription": "Allows access to publish to test/topic.","operations": "aws.greengrass#PublishToTopic","resources": "my/topic"}}}}},I also tried (got same error):"accessControl": {"aws.greengrass.ipc.pubsub": {"com.example.HelloWorld:pubsub:1": {"policyDescription": "Allows access to publish to test/topic.","operations": "aws.greengrass#PublishToIoTCore","resources": "my/topic"}}}Edited by: brayden on Feb 16, 2021 1:19 PMCommentSharebraydenanswered 2 years ago0Since you are trying to use MQTT, follow this guide: https://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-iot-core-mqtt.html.Your access control policies are not proper for allowing IoT Core messaging. The service identifier needs to be "aws.greengrass.ipc.mqttproxy" and not "aws.greengrass.ipc.pubsub" and the operation must be "aws.greengrass#PublishToIoTCore"When you make a change, if you are making the change through a deployment using the "MERGE" option, then that will work fine. However, if you are editing the default in the recipe you must useRESET: [""]in the deployment configuration for the component. That way it will use the default configuration from your recipe instead of the existing configuration which is present in the Nucleus. Read https://docs.aws.amazon.com/greengrass/v2/developerguide/update-component-configurations.html for more information on this topic.Cheers,Michael DombrowskiCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Policy"accessControl": {"aws.greengrass.ipc.mqttproxy": {"com.example.HelloWorld:pubsub:1": {"policyDescription": "Allows access to publish to my/topic.","operations": ["aws.greengrass#PublishToTopic","aws.greengrass#PublishToIoTCore","aws.greengrass#GreengrassCoreIPC"],"resources": ["my/topic"]}}}}configuration update (I'm not using the cli, using console){"reset": [],"merge": {"accessControl": {"aws.greengrass.ipc.mqttproxy": {"com.example.HelloWorld:pubsub:1": {"policyDescription": "Allows access to publish to my/topic.","operations": ["aws.greengrass#PublishToTopic","aws.greengrass#PublishToIoTCore","aws.greengrass#GreengrassCoreIPC"],"resources": ["my/topic"]}}}}}CommentSharebraydenanswered 2 years ago0Your update seems to be correct. That should now allow your component to publish to the topic.If not, please provide update logs showing the failure.Cheers,Michael DombrowskiCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0grep "error" logs/greengrass.log2021-02-18T17:26:35.272Z [ERROR] (main) com.aws.greengrass.authorization.AuthorizationPolicyParser: load-authorization-config-deserialization-error. Unable to deserialize access control map services.com.example.HelloWorld.configuration.accessControl:{aws.greengrass.ipc.pubsub=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.pubsub:{com.example.HelloWorld:pubsub:1=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.pubsub.com.example.HelloWorld:pubsub:1:{operations=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.pubsub.com.example.HelloWorld:pubsub:1.operations:aws.greengrass#PublishToTopic, policyDescription=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.pubsub.com.example.HelloWorld:pubsub:1.policyDescription:Allows access to publish to test/topic., resources=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.pubsub.com.example.HelloWorld:pubsub:1.resources:my/topic}}, aws.greengrass.ipc.mqttproxy=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy:{com.example.HelloWorld:pubsub:1=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:1:{operations=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:1.operations:[aws.greengrass#PublishToTopic, aws.greengrass#PublishToIoTCore, aws.greengrass#GreengrassCoreIPC], policyDescription=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:1.policyDescription:Allows access to publish to my/topic., resources=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:1.resources:[my/topic]}}} for com.example.HelloWorld. {}2021-02-18T17:26:37.715Z [INFO] (Thread-4) com.aws.greengrass.builtin.services.mqttproxy.MqttProxyIPCAgent: Not Authorized. {error=Principal com.example.HelloWorld is not authorized to perform aws.greengrass.ipc.mqttproxy:aws.greengrass#PublishToIoTCore on resource my/topic}2021-02-18T17:26:37.831Z [INFO] (Thread-4) com.aws.greengrass.builtin.services.mqttproxy.MqttProxyIPCAgent: Not Authorized. {error=Principal com.example.HelloWorld is not authorized to perform aws.greengrass.ipc.mqttproxy:aws.greengrass#PublishToIoTCore on resource my/topic}2021-02-18T17:26:37.938Z [INFO] (Thread-4) com.aws.greengrass.builtin.services.mqttproxy.MqttProxyIPCAgent: Not Authorized. {error=Principal com.example.HelloWorld is not authorized to perform aws.greengrass.ipc.mqttproxy:aws.greengrass#PublishToIoTCore on resource my/topic}2021-02-18T17:26:54.348Z [INFO] (Thread-4) com.aws.greengrass.builtin.services.mqttproxy.MqttProxyIPCAgent: Not Authorized. {error=Principal com.example.HelloWorld is not authorized to perform aws.greengrass.ipc.mqttproxy:aws.greengrass#PublishToIoTCore on resource my/topic}2021-02-18T17:26:54.448Z [INFO] (Thread-4) com.aws.greengrass.builtin.services.mqttproxy.MqttProxyIPCAgent: Not Authorized. {error=Principal com.example.HelloWorld is not authorized to perform aws.greengrass.ipc.mqttproxy:aws.greengrass#PublishToIoTCore on resource my/topic}2021-02-18T17:26:54.558Z [INFO] (Thread-4) com.aws.greengrass.builtin.services.mqttproxy.MqttProxyIPCAgent: Not Authorized. {error=Principal com.example.HelloWorld is not authorized to perform aws.greengrass.ipc.mqttproxy:aws.greengrass#PublishToIoTCore on resource my/topic}grep "error" logs/com.example.HelloWorld.log2021-02-18T17:26:37.722Z [INFO] (Copier) com.example.HelloWorld: stdout. DEBUG:awsiot.eventstreamrpc:<awsiot.greengrasscoreipc.client.PublishToIoTCoreOperation object at 0x7fbd1efabb00> received #1 APPLICATION_ERROR [Header(':content-type', 'application/json', <HeaderType.STRING: 7>), Header('service-model-type', 'aws.greengrass#UnauthorizedError', <HeaderType.STRING: 7>), Header(':message-type', 1, <HeaderType.INT32: 4>), Header(':message-flags', 2, <HeaderType.INT32: 4>), Header(':stream-id', 1, <HeaderType.INT32: 4>)] b'{"message":"Not Authorized","_service":"aws.greengrass#GreengrassCoreIPC","_message":"Not Authorized","_errorCode":"UnauthorizedError","detailMessage":"UnauthorizedError[aws.greengrass#GreengrassCoreIPC]: Not Authorized","stackTrace":[],"suppressedExceptions":[]}'. {scriptName=services.com.example.HelloWorld.lifecycle.Run, serviceName=com.example.HelloWorld, currentState=RUNNING}2021-02-18T17:26:37.832Z [INFO] (Copier) com.example.HelloWorld: stdout. DEBUG:awsiot.eventstreamrpc:<awsiot.greengrasscoreipc.client.PublishToIoTCoreOperation object at 0x7fc12de0eb00> received #1 APPLICATION_ERROR [Header(':content-type', 'application/json', <HeaderType.STRING: 7>), Header('service-model-type', 'aws.greengrass#UnauthorizedError', <HeaderType.STRING: 7>), Header(':message-type', 1, <HeaderType.INT32: 4>), Header(':message-flags', 2, <HeaderType.INT32: 4>), Header(':stream-id', 1, <HeaderType.INT32: 4>)] b'{"message":"Not Authorized","_service":"aws.greengrass#GreengrassCoreIPC","_message":"Not Authorized","_errorCode":"UnauthorizedError","detailMessage":"UnauthorizedError[aws.greengrass#GreengrassCoreIPC]: Not Authorized","stackTrace":[],"suppressedExceptions":[]}'. {scriptName=services.com.example.HelloWorld.lifecycle.Run, serviceName=com.example.HelloWorld, currentState=RUNNING}2021-02-18T17:26:37.939Z [INFO] (Copier) com.example.HelloWorld: stdout. DEBUG:awsiot.eventstreamrpc:<awsiot.greengrasscoreipc.client.PublishToIoTCoreOperation object at 0x7f5bb45a0b00> received #1 APPLICATION_ERROR [Header(':content-type', 'application/json', <HeaderType.STRING: 7>), Header('service-model-type', 'aws.greengrass#UnauthorizedError', <HeaderType.STRING: 7>), Header(':message-type', 1, <HeaderType.INT32: 4>), Header(':message-flags', 2, <HeaderType.INT32: 4>), Header(':stream-id', 1, <HeaderType.INT32: 4>)] b'{"message":"Not Authorized","_service":"aws.greengrass#GreengrassCoreIPC","_message":"Not Authorized","_errorCode":"UnauthorizedError","detailMessage":"UnauthorizedError[aws.greengrass#GreengrassCoreIPC]: Not Authorized","stackTrace":[],"suppressedExceptions":[]}'. {scriptName=services.com.example.HelloWorld.lifecycle.Run, serviceName=com.example.HelloWorld, currentState=RUNNING}2021-02-18T17:26:54.349Z [INFO] (Copier) com.example.HelloWorld: stdout. DEBUG:awsiot.eventstreamrpc:<awsiot.greengrasscoreipc.client.PublishToIoTCoreOperation object at 0x7f8fc3279b00> received #1 APPLICATION_ERROR [Header(':content-type', 'application/json', <HeaderType.STRING: 7>), Header('service-model-type', 'aws.greengrass#UnauthorizedError', <HeaderType.STRING: 7>), Header(':message-type', 1, <HeaderType.INT32: 4>), Header(':message-flags', 2, <HeaderType.INT32: 4>), Header(':stream-id', 1, <HeaderType.INT32: 4>)] b'{"message":"Not Authorized","_service":"aws.greengrass#GreengrassCoreIPC","_message":"Not Authorized","_errorCode":"UnauthorizedError","detailMessage":"UnauthorizedError[aws.greengrass#GreengrassCoreIPC]: Not Authorized","stackTrace":[],"suppressedExceptions":[]}'. {scriptName=services.com.example.HelloWorld.lifecycle.Run, serviceName=com.example.HelloWorld, currentState=RUNNING}2021-02-18T17:26:54.449Z [INFO] (Copier) com.example.HelloWorld: stdout. DEBUG:awsiot.eventstreamrpc:<awsiot.greengrasscoreipc.client.PublishToIoTCoreOperation object at 0x7f7c83996b00> received #1 APPLICATION_ERROR [Header(':content-type', 'application/json', <HeaderType.STRING: 7>), Header('service-model-type', 'aws.greengrass#UnauthorizedError', <HeaderType.STRING: 7>), Header(':message-type', 1, <HeaderType.INT32: 4>), Header(':message-flags', 2, <HeaderType.INT32: 4>), Header(':stream-id', 1, <HeaderType.INT32: 4>)] b'{"message":"Not Authorized","_service":"aws.greengrass#GreengrassCoreIPC","_message":"Not Authorized","_errorCode":"UnauthorizedError","detailMessage":"UnauthorizedError[aws.greengrass#GreengrassCoreIPC]: Not Authorized","stackTrace":[],"suppressedExceptions":[]}'. {scriptName=services.com.example.HelloWorld.lifecycle.Run, serviceName=com.example.HelloWorld, currentState=RUNNING}2021-02-18T17:26:54.559Z [INFO] (Copier) com.example.HelloWorld: stdout. DEBUG:awsiot.eventstreamrpc:<awsiot.greengrasscoreipc.client.PublishToIoTCoreOperation object at 0x7f0dcb677b00> received #1 APPLICATION_ERROR [Header(':content-type', 'application/json', <HeaderType.STRING: 7>), Header('service-model-type', 'aws.greengrass#UnauthorizedError', <HeaderType.STRING: 7>), Header(':message-type', 1, <HeaderType.INT32: 4>), Header(':message-flags', 2, <HeaderType.INT32: 4>), Header(':stream-id', 1, <HeaderType.INT32: 4>)] b'{"message":"Not Authorized","_service":"aws.greengrass#GreengrassCoreIPC","_message":"Not Authorized","_errorCode":"UnauthorizedError","detailMessage":"UnauthorizedError[aws.greengrass#GreengrassCoreIPC]: Not Authorized","stackTrace":[],"suppressedExceptions":[]}'. {scriptName=services.com.example.HelloWorld.lifecycle.Run, serviceName=com.example.HelloWorld, currentState=RUNNING}PS thanks so much for the help!CommentSharebraydenanswered 2 years ago0One issue you have is a malformed accessControl policy. Seems that the policy for mqttproxy, com.example.HelloWorld:pubsub:1 has "operations" which must be an array, but is just a single string. You then have a duplicated policy with the same name under pubsub. This is not allowed. The names must be unique.I'd suggest resetting the configuration and only merging the mqttproxy related access control policy. The operation that you need is only aws.greengrass#PublishToIoTCore.CommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0I think there's something I'm not understanding correctly. Seems like its attempting to load past policies, but as I understand because I have that reset parameter in there those should go away on deployment.recipe"ComponentConfiguration": {"DefaultConfiguration": {"reset": [""],"accessControl": {"aws.greengrass.ipc.mqttproxy": {"com.example.HelloWorld:pubsub:4": {"policyDescription": "Allows access to publish to my/topic.","operations": ["aws.greengrass#PublishToIoTCore"],"resources": ["my/topic"]}}}}}error message2021-02-18T19:01:30.197Z [ERROR] (Serialized listener processor) com.aws.greengrass.authorization.AuthorizationPolicyParser: load-authorization-config-deserialization-error. Unable to deserialize access control map services.com.example.HelloWorld.configuration.accessControl:{aws.greengrass.ipc.pubsub=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.pubsub:{com.example.HelloWorld:pubsub:1=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.pubsub.com.example.HelloWorld:pubsub:1:{operations=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.pubsub.com.example.HelloWorld:pubsub:1.operations:aws.greengrass#PublishToTopic, policyDescription=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.pubsub.com.example.HelloWorld:pubsub:1.policyDescription:Allows access to publish to test/topic., resources=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.pubsub.com.example.HelloWorld:pubsub:1.resources:my/topic}}, aws.greengrass.ipc.mqttproxy=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy:{com.example.HelloWorld:pubsub:3=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:3:{operations=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:3.operations:[aws.greengrass#PublishToTopic, aws.greengrass#PublishToIoTCore, aws.greengrass#GreengrassCoreIPC], policyDescription=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:3.policyDescription:Allows access to publish to my/topic., resources=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:3.resources:[my/topic]}, com.example.HelloWorld:pubsub:4=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:4:{operations=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:4.operations:[aws.greengrass#PublishToIoTCore], policyDescription=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:4.policyDescription:Allows access to publish to my/topic., resources=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:4.resources:[my/topic]}, com.example.HelloWorld:pubsub:1=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:1:{operations=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:1.operations:[aws.greengrass#PublishToTopic, aws.greengrass#PublishToIoTCore, aws.greengrass#GreengrassCoreIPC], policyDescription=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:1.policyDescription:Allows access to publish to my/topic., resources=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:1.resources:[my/topic]}, com.example.HelloWorld:pubsub:2=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:2:{operations=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:2.operations:[aws.greengrass#PublishToTopic, aws.greengrass#PublishToIoTCore, aws.greengrass#GreengrassCoreIPC], policyDescription=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:2.policyDescription:Allows access to publish to my/topic., resources=services.com.example.HelloWorld.configuration.accessControl.aws.greengrass.ipc.mqttproxy.com.example.HelloWorld:pubsub:2.resources:[my/topic]}}} for com.example.HelloWorld. {}CommentSharebraydenanswered 2 years ago0Got it working! But doesn't make sense. I deployed 0 components and then deployed the mqtt component (hello world). Seems like the reset param isn't working as expected.CommentSharebraydenanswered 2 years ago0Putting reset into the component recipe does not do anything. Have a look at https://docs.aws.amazon.com/greengrass/v2/developerguide/update-component-configurations.html#reset-configuration-update for information about resetting deployments.CommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0I read that but still unclear were that config is located (docs are for CLI but I'm using the console). I thought it brought over the settings from component config to deployment config but now thinking it is the "Reset paths" under "Configuration update".Thanks so much for your help!!CommentSharebraydenanswered 2 years ago"


Question: Code Build Failed

"Hello,I create a new pipeline for my application and the pipeline failed in the Build parts.the error is :Error calling startBuild: Cannot have more than 0 builds in queue for the account (Service: AWSCodeBuild; Status Code: 400; Error Code: AccountLimitExceededException;Thank you for helping me.FollowComment"

Answer: "0The error does seem to be relating to account serviced quota.Not sure how many Codepipline and CodeBuild projects you have but can you check here to see if you are exceeding the Concurrently running builds quota, among other service quotas?CommentShareJason_Sanswered a year ago0There are various account level quotas that AWS sets for new and existing accounts. Some of the quotas protect you from unpredicted cost skyrocketing when you just start the cloud journey, the other ones might be applied if AWS detects something unusual in your accounts (e.g. an open vulnerability, an expired credit card, ...)The best way to resolve this issue is contacting AWS Support and requesting the quota increase for the number of concurrent builds in AWS CodeBuild in that account. If there are some things than need to be fixed in your account first, you will be informed about that. Otherwise, the quota will be increased, so you can run your builds in AWS CodeBuild.CommentShareDmitry Balabanovanswered a year ago"


Question: Creating an Organization under a sub-account

"Hi, I wanted if it's possible to create a whole Organization (and accounts) in an account which is already a part of a parent Organization.Will look something like this:ROOT-ACCOUNTOU 1SubAccount_1 (Another Tower Control?)OU_2SubSubAccount_1FollowComment"

Answer: "2Accepted AnswerNo unfortunately not. An AWS Organization cannot have another Organization underneath it. Control Tower is tied to the root AWS Organization and Management Account (or Billing Account as it is also known).CommentShareJimmy_Manswered a year agoJDorfsman a year agoYeah, I guessed that would be the answer but needed to confirm it. Thanks!Share"


Question: How to move DocumentDB to a private subnet

"I created a DocumentDB cluster that is now connected to a few EC2s in a ASG.I know that for security reasons this should stay in a private subnet, is that really important? How can I check if my cluster is in a public subnet or a private one?And if it is in a public subnet, how can I move it to a private one?thanksMFollowComment"

Answer: "0Hello,Amazon DocumentDB clusters are deployed within an Amazon Virtual Private Cloud (Amazon VPC). They can be accessed directly by Amazon EC2 instances or other AWS services that are deployed in the same Amazon VPC. Additionally, Amazon DocumentDB can be accessed by EC2 instances or other AWS services in different VPCs in the same AWS Region or other Regions via VPC peering [1].On the Amazon DocumentDB management console find your cluster and link on the VPC. Maybe you created one or choose at creation[2].Securityis the top priority. To identify if your VPC is public or private lies in what it means in AWS for a subnet of a VPC to be 'public' vs. 'private'.Public subnets have a default route to an Internet Gateway; private subnets do not.So, to determine if a given subnet is public or private, you need to describe the route table that is associated with that subnet. That will tell you the routes and you can test for a 0.0.0.0/0 route with a gateway ID of igw-xxxxxxxxxxxxxxxxx (as opposed to local), this confirms that you are looking at a public subnet [3].References:[1] https://docs.aws.amazon.com/documentdb/latest/developerguide/connect-from-outside-a-vpc.html[2] https://docs.aws.amazon.com/documentdb/latest/developerguide/get-started-guide.html#cloud9-cluster[3] https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.htmlCommentShareIbrahim Cesaranswered 4 months agorePost-User-3116220 4 months agoThanks for your reply.I am in a situation with DocumentDB and EC2s instances in the same VPC. EC2s can access DocumentDB.Then I have a lambda function in the same VPC but it can't access My DocumentDB cluster.I know how to check if a subnet is public or private, I would like to check if documentDB is on a public one, as I can only see the link to the VPC, and my VPC has both private and public subnets.ShareIbrahim Cesar 3 months agoIf your VPC has both private and public subnets., then is a public VPC. Review the documentation for Lambda  to access resources in a VPC [1]. The logs for the Lambda in the Clouwatch returns what type of result?[1] https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.htmlShare"


Question: Pod not scheduled due to FARGATE_CONCURRENT_POD_LIMIT_EXCEEDED

"I have just deployed an EKS cluster as described here: https://docs.aws.amazon.com/eks/latest/userguide/getting-started-console.htmlIn the cluster I have created a Fargate profile with the namespace name "eks-sample-app" and no other tags.I then attempted to deploy the sample application following this: https://docs.aws.amazon.com/eks/latest/userguide/sample-deployment.html .  The yaml file is included below.I created the cluster with an IAM user  in "System Administrator" group and since I did not modify ~/.kube/config at all , I am using that same IAM user with  the "kubectl apply" command.This is in us-east-2The "kubectl apply -f " command works but when I check in the AWS console, I can see that the pods are not getting scheduled due to FARGATE_CONCURRENT_POD_LIMIT_EXCEEDED .When I check for Fargate related service quotas I see that there are 2 (spot and regular) and both show an applied value of "50".  The backplane of the cluster appears to be using 2 and there is nothing else running in my account.   As far as I can tell, the pod limit has not been exceeded.  I am looking for advice on what the real problem is or on how to troubleshoot this issue.Here is my deployment.apiVersion: apps/v1kind: Deploymentmetadata:  name: eks-sample-linux-deployment  namespace: eks-sample-app  labels:    app: eks-sample-linux-appspec:  replicas: 2  selector:    matchLabels:      app: eks-sample-linux-app  template:    metadata:      labels:        app: eks-sample-linux-app    spec:      affinity:        nodeAffinity:          requiredDuringSchedulingIgnoredDuringExecution:            nodeSelectorTerms:            - matchExpressions:              - key: kubernetes.io/arch                operator: In                values:                - amd64                - arm64      containers:      - name: nginx        image: public.ecr.aws/nginx/nginx:1.21        ports:        - name: http          containerPort: 80        imagePullPolicy: IfNotPresent      nodeSelector:        kubernetes.io/os: linuxFollowComment"

Answer: "0I resolved this issue by briefly starting a (t2.micro) instance in the region where I was trying to deploy the EKS cluster.  It appears there is some account specific initialization that needs to happen.  I found a post suggesting this as a solution to a similar, but slightly different problem: https://repost.aws/questions/QUHp9PA5wIQuG-8FLz-W4pmQ/cannot-deploy-to-fargate-with-4-tasks-limit-reached-for-concurrent-tasksCommentSharewilliamrmayanswered a year ago"


Question: How to setup SMTP for sending emails using SES?

"HI,I am trying to setup SMTP configuration for sending emails using SES. Under airflow configuration I can setup almost all smtp configs, except smtp_user and smtp_password for authentication.Then of course I get an error when trying to send an emailsmtplib.SMTPSenderRefused: (530, b'Authentication required', 'mymail@test.com')I cannot find any documentation about how to setup the email backend in MWAA.... How is supposed to be configured? Should we pass access key and secret  for a smtp user? or should use the IAM Role configured for Airflow somehow?I am curious specially about passing a secret value as plain text there... and I see that secrets manager backend is not fully operational.Thanks in advanceFollowComment"

Answer: "0Hi!Please see the attached example configuration overrides using Gmail smtp as an example.Thanks!CommentShareJohn_Janswered 2 years ago0Hi,Thank you for your answer.So for using SES, should I create an IAM user with SES credentials and then feed in the config the Access Key and Secret? Any way to protect the secrets?ThanksEdited by: paj-zj-99 on Feb 1, 2021 1:37 AMCommentSharepaj-zj-99answered 2 years ago0Just for the records in case helps others.Setting the access key in smtp.smtp_user and the associated ses password into the smtp.smtp_password works.The main issue for me is passing the password as a plain text config... I hope soon we get a way of securely passing such secretsCommentSharepaj-zj-99answered 2 years ago0In my case, the value of smtp_user option is 'apikey' and the smtp_password is 'SG.-rXXXXXXXXXXXXXXXXXXX2U'. I tried setting these values but they are not being considered. When I checked the Airflow configuration options in my environment, it did not have the smtp_user and smtp_password options. Please help me fix this.FYI, the above options and their values work fine to send an email in an EC2 setup of Airflow but not in managed Airflow environment.Edited by: ArjunAnaji on May 17, 2021 8:01 AMCommentShareArjunAnajianswered 2 years ago0It worked somehow when I set the smtp_user and smtp_password arguments again in my environment. I'm not sure whether the issue has been fixed recently.CommentShareArjunAnajianswered 2 years ago0You all should try using AWS Secrets Manager to store and retrieve your SES credentials.CommentShareklarsonanswered 2 years ago"


Question: Run a CLI inside a GreenGrass docker image

"I have a few greengrass (docker) components that listen to IPC local topics.I now want to test to see if they are actually responding to messages on the local topics so i've written a greengrass_pub application (similar to mosquitto_pub) so i can call:greengrass_pub --topic "local/topic" --payload "{ \"do_some\" : \"stuff\" } " to check if the other components pick this up.I have also installed this greengrass_pub application in the docker image, so i should be able to start up another docker image.Can i startup a docker image to run under the greengrass credentials so I have access to IPC in an interactive way AND have a command prompt where I can try different calls ?How could I start this up ? ( like a docker interactive (-it) session ? )note: this is only for development as a tool to check.(i have the greengrass cli installed)FollowComment"

Answer: "0Accepted AnswerRun your docker container as a docker component in Greengrass following the instructions in Use interprocess communication in Docker container components.Then, from the shell on the host where Greengrass is running, find the container name or id via docker ps and run docker exec -it <container name/id> /bin/shNow you can run greengrass_pub --topic "local/topic" --payload "{ \"do_some\" : \"stuff\" } "Is your command open source? Could you share the repo?CommentShareEXPERTMassimilianoAWSanswered a year ago0Thank you for that suggestion Massimiliano,I have followed the instructions to start the docker that runs the program that listens to ipc  already and the container can happily listen to IoT-Core topics  so i think the permissions are alright. I've also added the accessControl to allow access to local topics.{  "Run": "docker run --name=abcd --cap-add=SYS_PTRACE --runtime=nvidia -e DISPLAY=$DISPLAY --privileged --volume /tmp/.X11-unix:/tmp/.X11-unix --net=host -e NVIDIA_VISIBLE_DEVICES=all -v $HOME/.Xauthority:/root/.Xauthority -v /run/udev/control:/run/udev/control -v /greengrass/v2:/greengrass/v2 -e SVCUID -e AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT -v /dev:/dev -v /sys/firmware/devicetree/base/serial-number:/sys/firmware/devicetree/base/serial-number -v /data:/data -e NVIDIA_DRIVER_CAPABILITIES=compute,utility,graphics   xxxxxxxxxx.dkr.ecr.ap-southeast-2.amazonaws.com/smartdvr:dev3 runscript.sh"}runscript.sh looks like:#!/bin/shret=0while [ $ret -eq 0 ]; doexec /usr/sbin/my_application_that_listens_to_ipcret=$?sleep 30donewhen i rundocker exec -it abcd /bin/shit shows a command prompt ( # ) but as soon as i try to use the command prompt it hangs..i think that is because it only runs my_application_that_listens_to_ipc .. and i'm not sure that exec can start another 'session' ?CommentShareclogwoganswered a year agoclogwog a year agoI had to change the exec to something else, and then it allowed me to docker exec -it into it.thank youShare"


Question: check best pratices ans security compliance for AWs accounts

"Hi team,we want to do some audits on all our projects using AWS accounts,Are there any first items to start checking or any specific checklist to go over when doing the audit to make sure that best practices and security are implemented?Thank you!FollowComment"

Answer: "1In addition to what Matt-B said in his answer, we also offer the AWS Well-Architected Tool -- which will allow you to run through the six pillars (which includes a Secuirty pillar) of our Well-Architected Framework for your workloads.  This tool will generate actionable findings for you and your team to prioritize and tackle and is closer to a "checklist" style.CommentShareMiguelUTanswered 8 months ago0I would start by looking at The AWS Foundational Security Best Practices standard. The AWS Foundational Security Best Practices standard is a set of controls that detect when your deployed accounts and resources deviate from security best practices.  See https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp.htmlYou can enable this control in Security Hub and start to get a good idea of how your environment fairs against AWS Foundational best practices.  See https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-finding-generation.htmlCommentShareEXPERTMatt-Banswered 8 months ago"


Question: AWS not responding within 144! hours on technical support ticket

"Hi everyone, Has anyone had experience with AWS not responding technically (apart from asking for more info within the first 24hrs once) within several days for a technical case? Do you have suggestions on what to do in such a case as it is blocking me (+I think this is really nok)? In case the AWS team sees this question, the number of my case is XXXXXXXXX. Please help.Edit: Removed Case ID — Ben G.FollowComment"

Answer: "0Accepted AnswerThanks all. In the end my request was transferred/ excallated to , Daniel D., who did an amazing job and solved the case. Thanks!CommentSharerePost-User-2935309answered a month ago0Which support plan do you use?Developer support can take up to 3 days depending on the time you submit your question.The following document is in Japanese but explains it.https://aws.amazon.com/jp/premiumsupport/sla-dev-support-jp/CommentShareEXPERTRiku_Kobayashianswered 2 months ago0Thanks for the reply!plan: "developer".Article: submissions ~1hr before the weekend starts can take up to Tuestday 11:00 for a reply.My situation: submission wednesday 10:00, request for more info at 14:00 (great!) which I provided at 14:15. then for 3.5 working! days no technical response anymore (only once: im replicating the issue...) (bad!)Do you have tips on how to handle these situations? As in my opinion this is really taking too long for a blocking issue on a payed support planthanks :)CommentSharerePost-User-2935309answered 2 months ago0Technical investigations may take time.I have waited 5 days in the past.CommentShareEXPERTRiku_Kobayashianswered 2 months ago"