Question: Installing AWS CLI v2 on Raspberry Pi 4B with Raspbian OS

"Is it possible to install AWS CLI v2 on a Raspberry Pi 4B? I am on Raspbian OS.I tried going through the steps here and here, but was unable to install AWS CLI v2 on a Raspberry Pi:curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip" -o "awscliv2.zip"unzip awscliv2.zipsudo ./aws/installError message as follows:./aws/install: 78: ./aws/install: /home/pi/aws/dist/aws: Exec format errorFound preexisting AWS CLI installation: /usr/local/aws-cli/v2/current. Please rerun install script with --update flag.I finally succeeded with the first option in the instructions here (via git clone https://github.com/aws/aws-cli.git) and installing the dependencies (CMake and Rust), but when I run aws --version I get the following error:ImportError: cannot import name 'register_dynamodb_paginator_fix' from 'awscli.customizations.dynamodb' (/home/pi/.local/lib/python3.8/site-packages/awscli/customizations/dynamodb/__init__.py)FollowComment"

Answer: "2Accepted AnswerHello,It looks like you have multiple versions of the AWS CLI installed per your original error message.  I recommend uninstalling the older version located in /usr/local/aws-cli/v2/current.I followed the instructions you gave and was able to install the AWS CLI on a Raspberry Pi 4B with no error messages.  Logs below for reference.  This was a brand new install of Raspbian OS.curl -O 'https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip'unzip awscli-exe-linux-aarch64.ziproot@kube-worker1:/home/pi# sudo ./aws/installYou can now run: /usr/local/bin/aws --versionroot@kube-worker1:/home/pi# /usr/local/bin/aws --versionaws-cli/2.7.22 Python/3.9.11 Linux/5.10.63-v8+ exe/aarch64.debian.11 prompt/offCommentShareEXPERTChris_Ganswered 10 months agoNathaniel Ng 10 months agoAt the install step, I get an "Exec format error":pi@raspberrypi:~$ curl -O 'https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip'pi@raspberrypi:~$ unzip awscli-exe-linux-aarch64.zippi@raspberrypi:~$ sudo ./aws/install./aws/install: 78: ./aws/install: /home/pi/aws/dist/aws: Exec format errorYou can now run: /usr/local/bin/aws --versionShareChris_G EXPERT9 months ago@Nathanial that's odd considering an Exec format error means the operating system is not compatible.  Are you running on 32bit RaspbianOS or 64bit?  This AWS CLI package is only compatible with the 64bit OS.  Can you check your OS version using uname -a?root@kube-worker1:~# uname -maarch64ShareNathaniel Ng 9 months agoOkay, got it. I realize I am on a 32-bit Raspbian OS, and perhaps I should switch to a 64-bit OS:pi@raspberrypi:~$ uname -marmv7lShare"


Question: Secondary network interface can't be pinged with Amazon Linux 2 AMI

"Instance ID: i-0da64bfed94b696d1Instance Region: US-Gov-EastShort story: both private IP addresses on primary network interface can be pinged, but both private IP addresses on secondary network interface cannot be pinged.Long story:Based on  https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/MultipleIP.html#StepTwoConfigOS , using Amazon Linux 2 AMI, it will automatically configure additional network interfaces and IP addresses.With a micro ec2 instance, theoretically it can have 4 private IP addresses (2 network interfaces, 2 IP addresses on each network interface).My steps to create the 4 IP addresses:Create an ec2 instance from Amazon Linux 2 AMI, set two private IP addresses during creationAssociate an elastic IP addressAfter creation, attach a secondary network interface with 2 private IP addresses (same subnet and same security group as primary NIC).Login the instance, restart network interface using the command from the documentation: sudo service network restart"ip a" output:1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00inet 127.0.0.1/8 scope host lovalid_lft forever preferred_lft foreverinet6 ::1/128 scope hostvalid_lft forever preferred_lft forever2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc mq state UP group default qlen 1000link/ether 0e:31:86:22:95:b4 brd ff:ff:ff:ff:ff:ffinet 172.31.1.101/20 brd 172.31.15.255 scope global dynamic eth0valid_lft 2509sec preferred_lft 2509secinet 172.31.1.102/20 brd 172.31.15.255 scope global secondary eth0valid_lft forever preferred_lft foreverinet6 fe80::c31:86ff:fe22:95b4/64 scope linkvalid_lft forever preferred_lft forever3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc mq state UP group default qlen 1000link/ether 0e:ff:4a:aa:cb:66 brd ff:ff:ff:ff:ff:ffinet 172.31.2.201/20 brd 172.31.15.255 scope global dynamic eth1valid_lft 2325sec preferred_lft 2325secinet 172.31.2.202/20 brd 172.31.15.255 scope global secondary eth1valid_lft forever preferred_lft foreverinet6 fe80::cff:4aff:feaa:cb66/64 scope linkvalid_lft forever preferred_lft forever"ip r" output:default via 172.31.0.1 dev eth0default via 172.31.0.1 dev eth1 metric 10001169.254.169.254 dev eth0172.31.0.0/20 dev eth0 proto kernel scope link src 172.31.1.101172.31.0.0/20 dev eth1 proto kernel scope link src 172.31.2.201"ip rule" output:0:      from all lookup local32764:  from 172.31.2.202 lookup 1000132765:  from 172.31.2.201 lookup 1000132766:  from all lookup main32767:  from all lookup defaultWith all above configuration, both private IP addresses on primary network interface can be pinged (from another ec2 instance). But both IP on secondary network interface CANNOT be pinged (Destination Host Unreachable)."ip route show table 10001" output:default via 172.31.0.1 dev eth1172.31.0.0/20 dev eth1 proto kernel scope link src 172.31.2.201"sysctl -ar 'conf.eth..arp_'" output:net.ipv4.conf.eth0.arp_accept = 0net.ipv4.conf.eth0.arp_announce = 0net.ipv4.conf.eth0.arp_filter = 0net.ipv4.conf.eth0.arp_ignore = 0net.ipv4.conf.eth0.arp_notify = 0net.ipv4.conf.eth1.arp_accept = 0net.ipv4.conf.eth1.arp_announce = 0net.ipv4.conf.eth1.arp_filter = 0net.ipv4.conf.eth1.arp_ignore = 0net.ipv4.conf.eth1.arp_notify = 0Also, setting the security group to open to all traffic from all sources, does not help.Would you check to see what is missing? Thanks.Edited by: yahasoft on Jun 15, 2021 2:44 PMFollowComment"

Answer: 0There was a misconfiguration on my side. The guide is good. It's working now. Thanks.CommentShareyahasoftanswered 2 years ago


Question: Unable to use X-Http-Method-Override header with Lambda Function URL

"When trying to invoke a Lambda function through its function URL issuing a POST request with "X-Http-Method-Override" header set, the response is always HTTP 403 Forbidden with body:<AccessDeniedException>  <Message>Unable to determine service/operation name to be authorized</Message></AccessDeniedException>Is there anything I can do to use this header to change the HTTP method? Alternatively, can I pass it to the function?FollowComment"

Answer: "-1The link below provides details for accessing header info associated with Lambda function URLs.  It has sample code to parse the passed header info, similar to how it is passed from API Gateway via the event structure when Lambdas are invoked in that manner.  Your function URL Lambda can then invoke subsequent methods as needed.Function Lambda URL HeadersCommentShareAWSdaveanswered 5 months agoalekitto 5 months agoMaybe it's not clear, but I cannot reach the function if I set that request header. I don't need to know how to retrieve its value, but how to execute the function with that header set.ShareAWSdave 5 months agoCan you verify that the Auth Type is set to None on the Lambda?Sharealekitto 5 months agoYes, the auth type is set to NONEShare"


Question: access denied on CopyObject

"I have written a simple script to move some redshift logs to a different location as they are written to the default location. When I test the script by copying the logs into the directory manually it works. However, when redshift dumps the logs into the directory my script fails with this:botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the CopyObject operation: Access DeniedSo I know there must be something different between how redshift writes the logs and how I write them but I can't for the life of me figure out what that difference is. Any help?Here is my code. I've set this up with a role that has full s3 permissions. It's pretty straightforward but I can't figure out why it's failing outside of "it's permissions related" but I can't figure out why or what to change.import boto3def lambda_handler(event, context):    s3 = boto3.resource('s3')    for record in event['Records']:        bucket = record['s3']['bucket']['name']        key = record['s3']['object']['key']        log_file = key.split('/')[-1]        log_type = log_file.split('_')[-2]        log_env = log_file.split('_')[-3]        new_key = 'redshift/{}/{}/{}'.format(log_type, log_env, log_file)        print(key)        print(new_key)                s3.Object(bucket, new_key).copy_from(CopySource={'Bucket': bucket, 'Key': key})        s3.Object(bucket, key).delete()FollowComment"

Answer: "0I'm completely stuck here. I just gave my bucket full public permissions and it's still failing with Access Denied.The policy attached to my job grants "s3:*" permissions and I know it works because if I drop a file in the bucket it copies correctly.This problem only exists with the files created by redshift.Any help?CommentShareneufpasanswered 6 years ago0I figured out the problem. It ended up being related to a bad key. It turns out that the key string passed in by the s3 event trigger is urlencoded. These urlencoded strings appear as normal strings when the error message appears in the lambda window but adding debug logging to my script let me see the actual string.I'm not entirely sure why this was causing an Access Denied error, but adding a call to urlib.parse.unquote fixed the issue.CommentShareneufpasanswered 6 years ago"


Question: "Codepipeline/deploy, application revision onto EC2"

"I have deployed codepipeline and codedeploy to take my code from a zip file in S3 and to deploy it into an EC2 autoscale farm. An external process updates EC2, CWE then triggers the pipeline.When it works it works fine. But if there is ever a failure to deploy onto EC2 eg, an error with the application stop script, the latest revision appears to be lost. If an autoscale event is triggered the previous revision is deployed. It would appear that a revision is only marked as good once a successful deployment has occured. This makes it very difficult to fix any issues as I have to rely on the old revision deploying successfully before I can release the new. I would prefer that I could fix the code, deploy/trigger a new revision, then terminate all machines and let them build now.Is there a codepipeline step I can use that will create a new application revision without having to deploy it to EC2 for it to be made active?FollowComment"


Question: Textract Throttling

So I just had my get document text increased to 35 but they kept everything else the same...Here is the error I still get: An error occurred (ProvisionedThroughputExceededException) when calling the GetDocumentTextDetection operation (reached max retries: 4): Provisioned rate exceededMy documents are 1-3 pages long and im only using detect text funtionality. I don't understand why it takes 5 minutes to literally get 15 documents that are 1-3 pages long individually OCR'dFollowComment

Answer: "0Hi,If you're processing just 15 documents, but hitting 35+ TPS on GetDocumentTextDetection, I would think maybe you're polling for job completion and the polling retry configuration is a bit off?In my experience yes, you should be able to achieve higher throughput than the 5min, 15doc, 1-3 pages you mention. But it's worth mentioning that response time through the async APIs can vary, and high throughput for many documents is a different topic from end-to-end response time for one small doc.The more docs you process in parallel (the default quota limit for that is in the hundreds), the less appropriate polling will be as a strategy for fetching the results: Using SNS callbacks via Lambda will ensure you only try to fetch each result as it becomes available... And in that Lambda function you should still check your AWS SDK retry configuration (e.g. docs here for Python boto3), to try and avoid issues if e.g. many jobs happen to finish at once.Code samples like the Amazon-Textract-Caller (not sure if you're using this?) try to offer a helpful utility for small-scale projects, but have to make a trade-off between keeping to a simple client-only solution, versus being scalable for bigger workloads.Stacks like Large scale document processing with Amazon Textract optimize more for scalability, but it means you need to deploy some cloud components too (SNS, Lambda, SQS, etc).For CDK infrastructure-as-code, you could check out the patterns in amazon-textract-idp-stack-samples or maybe (a bit more complex because it combines with post-processing models) amazon-textract-transformer-pipeline.CommentShareEXPERTAlex_Tanswered 9 months ago"


Question: Signing CloudFront URLs with KMS

"CloudFront uses RSA/PKCS-1.5/SHA1 algorithm for its signatures.KMS, for signing, requires minimum SHA2.That sounds like a serious gap (plus use of SHA1 is questionable all together)Is there a way to make CloudFront accept signatures of a different algorithm, or have KMS sign SHA1 digests?P.S. This is different than https://repost.aws/questions/QUcCvy-SqtRQC3xfTbl_RXQQ/signing-cloud-front-ur-ls-with-aws-kms-encryption, I have my own code that I want to sign URLs with, and I want to use KMS, instead of disclosing private key to that code directly.FollowComment"


Question: What is "Service IPv4 range" in EKS console?

The help page in the console describes it asThe IP address range from which cluster services will receive IP addresses.So what are "cluster services"? Is that the control plane or something else?FollowComment

Answer: "1https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-servicehttps://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxiesThe range listed is used for the virtual IPs for the services. For example:kubectl get svc -A -o=custom-columns='DATA:spec.clusterIP'DATA172.20.74.199172.20.0.1172.20.123.203172.20.0.10CommentSharejimmyrayanswered a year agoritchie a year agoThanks, that's helpful. So if I understand it right, this range is used for ClusterIP services which are only accessible to containers running in the cluster. Packets addressed to them are intercepted by iptables rules and redirected. That means that they never make it to an actual network interface which is why the addresses can and should be outside of the CIDR range used by the VPC.Share1This is the IP address range used by Kubernetes services, see the launch announcement and the relevant documentation (click "AWS Management Console" tab and scroll down to the relevant description).CommentShareandsklianswered a year ago"


Question: Existing application running on a fleet of EC2 spot instances

"Hello,Can somebody tell me the right option for the below question?The customer has an existing application running on a fleet of EC2 spot instances. This application processes millions of messages from SQS and generates CSV to be stored in s3. Customer is considering to move to ECS farget. What changes will be needed?a. Continue to use spot instances and bundle the app as a docker image.b. moving to containers is not recommended because containers will add overheadsc. consider using the self-launch mode to migrate the existing ec2 instances to farget launch moded. use DMS service to port the applicationFollowComment"

Answer: "1The correct option is (a) Continue to use spot instances and bundle the app as a docker image. The customer can migrate their application to ECS Fargate by packaging their application into a Docker container image, which can be run on Fargate instances. This will allow the customer to take advantage of Fargate's managed infrastructure and eliminate the need to manage EC2 instances.CommentShareAWS_Guyanswered 2 months ago"


Question: Retrieve identityID given userpool ID_token in lambda@edge

"Hi,I have a CloudFront viewer request lambda@edge function that returns a custom cloudfront policy after verifying a cognito userpool id_token. The custom policy would grant access to read files from a user directory of the form /users/<identityID> where the identityID is based on the cognito identity pool. I have the following in my lambda function to get the identityID associated with a userpool id_token.      AWS.config.credentials = new AWS.CognitoIdentityCredentials({        IdentityPoolId: <identityPoolID>,        Logins: {                <UserPoolID>: id_token            }     });      await AWS.config.credentials.getPromise();      identityId = AWS.config.credentials.identityId;      console.log(identityId)This seems to work, but I ran across an issue where the lambda@edge function was spun up in us-west-1, while my identity pool (and user pool) are in us-west-2. For some reason, I get an error that the identity pool can not be found. Are these region specific? I have no issues when the lambda function is run in us-west-2. Is there another way to get the identityID from the id_token?FollowComment"

Answer: "1Yes, Amazon Cognito is a regional service, see https://docs.aws.amazon.com/general/latest/gr/cognito_identity.html#cognito_identity_region. You may need to use the full Arn or specify the endpoint in your code even though the the region is part of Identity Pool Id.CommentShareAWS-Everettanswered 6 months agorrrpdx 6 months agoSorry, I may not have been clear... The values I am using look like the following:AWS.config.credentials = new AWS.CognitoIdentityCredentials({IdentityPoolId: 'us-west-2:xxxx-xxxx-xxxx-xxxx-xxxx',Logins: {'cognito-idp.us-west-2.amazonaws.com/us-west-2_xxxx': params.id_token}});Share0Did that work or are you still getting an error?CommentShareAWS-Everettanswered 6 months agorrrpdx 6 months agoI'm not 100% sure... I havent' seen the issue pop up, but cloudfront has not routed any of my recent login attempts to a different region. Are there any best practices for how to test cloudfront against different regions? I only came across the issue because cloudfront randomly routed me to us-west-1 instead of us-west-2.ShareAWS-Everett 6 months agoYou could set up a VDI in Amazon Workspaces in a region like us-east-2 and test with a web browser. The web browser accessing CloudFront should default to the local region.Share0Have you set the "region" in the SDK? If you don't do this lambda will send the call to in-region endpoint anyway.CommentShareAWS-Everettanswered 6 months agorrrpdx 6 months agoThanks, I think this is what I missed... I ended up doing the following:  AWS.config.credentials = new AWS.CognitoIdentityCredentials({    IdentityPoolId: 'us-west-2:e0e662ee-4037-41fa-9e47-adafc9ae6ef7',    Logins: {            'cognito-idp.us-west-2.amazonaws.com/us-west-2_nB7Uc8Zjn': params.id_token        } },   {     region:'us-west-2'   });I'm assuming this would work correctly.Share"


Question: remote windows Server local Admin cant Login.

i was demote my previous domain name & restarted. so now i connect the RDP & cant login local Administrator account.it says""the security database on the server does not have a computer account for this workstation trust Relationship"please acknowledge thisFollowComment

Answer: "0It could be any issue with AD or Network, pls find the link from Mircrosoft and if you still have troubles pls let me knowhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee849847(v=ws.10)?redirectedfrom=MSDNCommentShareGKanswered 3 months ago"


Question: Mobile app status

I want to find out a status of a mobile app we are currently paying for and is it still activeFollowComment

Answer: "0Hi,I understand that you want to know what the status of your mobile app, running on AWS, is. Such mobile app is currently active and you are being billed by AWS. Please, let me know if my understanding is incorrect.Because there are multiple AWS services and features for building mobile apps on AWS, I’ll assume you may be referring to our most popular solutions including AWS Amplify and AWS AppSync services, as per [1].In such case, you may use Amazon CloudWatch to monitor the logs and status information generated by your mobile app, and the AWS Billing Console [2] to review the charges incurred. Please, make sure that you select the AWS region where the mobile app is deployed in your AWS Account when doing so.Hope it helps. If not, please provide me with further information and details about what AWS services does your mobile app use and I’ll be happy to help.Kind regards,Rochak from AWSReferences:[1] Building a Mobile Application - https://aws.amazon.com/startups/start-building/how-to-build-a-mobile-app/[2] AWS Billing Console - https://aws.amazon.com/aws-cost-management/aws-billing/CommentShareAWS-Rochakanswered 3 months ago"


Question: CNAME for webflow subdomain not resolving

"Here is a link to a screenshot of all the records in the hosted zone.After adding a new CNAME record, the record will not resolveThe new record:Record name: outreachRecord type: CNAMEValue: proxy-ssl.webflow.comNOTE: I am only concerned with the CNAME record for outreach. I have been trying to get this subdomain to work for weeks now. The way I have added the record is exactly what webflow support has directed me to do.I also noticed some other records that are set do not resolve. For example, links: links.charliehealth.com.Meanwhile, www does resolve.Is there some kind of cacheing/flushing I can do? Or A possible misconfiguration?FollowCommentAWS-User-0357409 2 months agoCould have been DNS propagation after a recent change.  I'm showing this resolving just like you mentioned above - to proxy-ssl.webflow.comShare"


Question: Instance stuck "stopping"

"us-east-1, instance-id  i-0b3d3e295b1e33745Stuck on stopping for 30 minutes, please help.  tried forcing and tried via cli as well.Edited by: mattbarb on Aug 13, 2019 2:54 PMFollowComment"

Answer: "0fixedCommentSharemattbarbanswered 4 years ago0Hi mattbarb,I am glad to hear that the issue has been solved.Regards,awstomasCommentShareAWS-User-3892169answered 4 years ago"


Question: Maximum limit on concurrent jobs

"Hi,Is there there anywhere I can find out what the maximum number of concurrent jobs is in Textract when using the async API?ThanksFollowComment"

Answer: "0Today the maximum number of asynchronous jobs per account that can simultaneously exist in each Region that Amazon Textract supports is 2. This limit can easily be raised depending on your use case by reaching out to AWS support. Details on how to manage AWS service limits: https://aws.amazon.com/premiumsupport/knowledge-center/manage-service-limits/https://docs.aws.amazon.com/general/latest/gr/aws_service_limits.html has more details about different AWS service limits.CommentSharedarwaishxanswered 4 years ago0I try to use Amazon Textract UI where if I give 11 pages pdf then it shows its limit 10 pages.How can I overcome this problem?CommentSharesabyanswered 2 years ago0Hi,Thank you for using Textract! https://docs.aws.amazon.com/textract/latest/dg/limits.html shows the limits for our SDK (https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Textract.html).Can you try our SDK and let us know if the problem still exist?Thanks,CommentShareAWS-User-3852616answered 2 years ago"


Question: Receiving some emails but not all emails

"I sent an invitation through Quickbooks to a workmail account.  I have tested this account from my personal gmail account to ensure it was working as expected.  However, Quickbook emails will not get delivered to me.  I had this same problem in a previous Workmail account with another vendor and just had them redirect to my personal account.  I would really like to figure out how to fix it instead of redirecting vendor emails to my personal account.  Any thoughts?My domain and DNS are external to AWS but as mentioned I am receiving some emails.FollowComment"

Answer: "0Hi,I'm sorry to hear you're experiencing problems with receiving mail. The issue sound like you have multiple services listed in your MX record. Resulting in some emails going to WorkMail and others to another service.Please make sure WorkMail is the only service in your MX record and has the highest priority (lowest number).Kind regards,RobinCommentShareMODERATORrobinkawsanswered 10 months agorePost-User-9862183 10 months agoThere is only one mx recordSharerobinkaws MODERATOR10 months agoDo you have any inbound SES rules that perform other actions than deliver to WorkMail?Share"


Question: Handling of target IP addresses in rule for outbound endpoint

"I have some rules for forwarding domains using outbound endpoints in the Route 53 resolver.  I specify multiple target IP addresses in each one.I can find no documentation on the handling of the list of IP addresses.  Does the resolver start at the top of the list and fail-over only as needed, round-robin over all the addresses, or....?   This behavior does have some implications for how I optimize the list of targets.Thanks.FollowComment"

Answer: "0Hi,I updated the doc. In the section "Values That You Specify When You Create or Edit Outbound Endpoints," see "Order of IP addresses":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-forwarding-outbound-queries.html#resolver-forwarding-outbound-queries-endpoint-valuesThanks for raising the question.ScottCommentShareEXPERTAWS-User-6179575answered 3 years agojiaying 10 months agoHi Scott, the question is about the "ip address in rule for outbound endpoint" but the response in the docs is for configuring of outbound endpoints, instead of configuring of target IP in rule section.  Would like to check if the order of IP in rule have an effect? Thank you.Share0Hi,I checked with the devs, and they said, "The order of the IP addresses has no effect on which target Resolver chooses." I'll add that to the doc.ScottCommentShareEXPERTAWS-User-6179575answered 3 years ago0Thanks.CommentSharejradelanswered 3 years ago"


Question: Stop matchmaking for all tickets in potential match if any tickets reject acceptance

"The problemMy project requires all tickets in the potential match to stop matchmaking once some tickets reject acceptance. I dug through all the documentations but haven't found any related settings.What I can think ofOne work-around option could be to manually stop matchmaking in code for all tickets when someone rejects, but this is not viable because before our system even receives the "AcceptMatchCompleted" event, the tickets that did not reject acceptance are already put back to matchmaking searching. The request that stops matchmaking may not be able to be sent out before another round of potential match is created for those tickets.Wanted behaviorWhen some tickets reject acceptance, all the tickets in the potential match stop matchmakingFollowComment"

Answer: "0Sorry the late reply. FlexMatch's current design does indeed return the players that accepted the match back into the ticket pool. As you have mentioned, you could make an attempt to make an attempt to track and cancel player matchmaking tickets in batches but you don't have enough control.I have pinged the GameLift service team with your request and hopefully they can take it into their backlog and/or provide a better workaround.CommentSharerePost-User-5332620answered 4 years ago"


Question: How to list Enabled Guardrails

"I am trying to find a way within the AWS management console, of viewing currently enabled guardrails.On the dashboard page under the section 'Enabled control summary'  there is  a number count advising on the currently enabled controls for each of the three types. One would expect when you click on these numbers it would display a page of only those enabled controls. However clicking on either it appears to just direct you to the entire list of controls.Is there a way to list only the enabled controls on the organization?FollowComment"

Answer: 1Accepted AnswerControls (guardrails) are enabled by OU. So you won't be able to see the enabled controls from the Control Library page. But you can view enabled controls on each account by navigating to -- Control Tower > Organization > MyOU > MyAccount CommentShareJED007answered 5 months ago


Question: How do I reverse Workspace disk performance from deteriorating?

"I've had a workspace I've used for the better part of 5 years, and over time I've noticed the disk performance deteriorating to the point of being unusable.  For example, I have a piece of software that starts up in 10s under normal disk performance, but has drifted out towards 2,000s because of disk performance being so slow!  I'm using the Power Pro bundle AWS Workspace 2.3 GHZ 16GB Windows 10 VM with a 1TB encrypted user volume.  When the workspace was new the disk performance was good roughly being comparable to my desktop.  However, as time has gone on it has slowly degraded the point of of being unusable.  My drives are currently 9% and 7% fragmented, but even after optimizing them it doesn't dramatically change the performance of the disks.  I experience more frequent lockups where the client just freezes and doesn't repaint, but if I check my network connection it's sub 10ms which leads me to believe the disk is holding up the OS and the Amazon Workspace client is waiting on it to respond.  What can be done to restore the performance back to what I had in the beginning?FollowComment"

Answer: "0You should absolutely open a support case for this question. Amazon WorkSpaces being a managed service, allows support to look at the AWS managed account and see if there are any issues beyond the OS layer.CommentShareEXPERTStevieStetsanswered a year agochubbsondubs a year agoThanks Stevie for the reply, but what should people on basic support plan who can't open up cases for technical issues do?Share"


Question: AWS cloudformation - Redshift Cluster subnet group

"HiIs there a possibility to provide Cluster subnet group name.it allow for other services like DMS and RDS, is there way to provide Cluster subnet group name for Redshift. Please let know.Type: AWS::Redshift::ClusterSubnetGroupProperties:   Description: String  SubnetIds:     - String  Tags:     - TagFollowComment"

Answer: "0Looks like there is currently no way to set a custom name natively with CloudFormation. You can get the auto-generated name value, though, by calling Ref.You could also open an issue on the CloudFormation roadmap to get this supported -> https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues?q=is%3Aissue+is%3Aopen+redshiftCheersCommentShareSoenke Ruempleranswered a year ago"


Question: interactive glue job %magic command to configure Libraries

How do I assign Python library path and dependent JARs path when configuring a glue job using a Interactive Sessions Notebook?FollowComment

Answer: "0Hello, As mentioned in [1] you can use %extra_py_files and %extra_jars for adding “Comma separated list of additional Python files from Amazon S3” and “Comma-separated list of additional jars to include in the cluster.” respectively to assign Python library path and dependent JARs path to a glue interactive session. Please note that you have to add this commands at the start of the interactive session.————————Reference:[1] https://docs.aws.amazon.com/glue/latest/dg/interactive-sessions-magics.html================ Have a nice day!CommentShareSUPPORT ENGINEERArunanswered 10 months ago"


Question: AWS Free Tier: Pricing Estimate if non-free

"Hi,I have been building a product using AWS free tier. To understand its economic viability, I wanted to get an estimate what charges would I incur basis my current usage if I was not under free tier. There is a separate pricing calculator which provides an estimate but what I need is some way to get monthly non-free tier charge estimate based on my current free-tier usage.  Is there a simple way to get this data?Thanks,DbeingsFollowComment"

Answer: "0Hello Dbeings,Thank you for reaching out to us. Please note that there aren't any direct ways to arrive at this costs using the current usage. Having said that; I have two alternatives for you :Option 1 :  You can track your usage with the Top AWS Free Tier Services by Usage table on the dashboard of the Billing and Cost Management console.The Top AWS Free Tier Service by Usage table is grouped by service limit and shows the AWS Free Tier usage limit for your top five most-used Free Tier service measurements, along with your current usage amount. A service might have multiple lines, enabling you to track each AWS Free Tier limit closely. The table shows usage as both a percentage of the AWS Free Tier limit and a ratio of the AWS Free Tier limit.For example, each month you get 2,000 Amazon S3 Put operations and 5 GB of Amazon S3 storage. The AWS Free Tier usage table has two lines, one for S3 - Puts and one for S3 - Storage. If you use 2,000 of the Free Tier S3 - Puts operations, the table shows 2,000.00/2,000 Requests and 100 percent, and if you use 0.55 GB of the AWS Free Tier S3 - Storage, the table shows 0.55/5 GB and 11 percent, as shown in the following screenshot.Screenshot of the top free tier services by usage table, with service, usage limit, and month-to-date usage columns appearing.To see more details about your AWS Free Tier usage, including all of your active Free Tier services, choose View All in the Top AWS Free Tier Services by Usage table. The detailed table includes additional information such as the forecast of your usage for the month and a status icon to alert you if you have exceeded the limits or are predicted to exceed the limitsUsing these values - You can use the pricing calculator to arrive at the estimates.Option 2: AWS enables you to track how much you used AWS Free Tier services and what service usage types you used. Usage types are the specific type of usage that AWS tracks. For example, the usage type Global-BoxUsage:freetier.micro means that you used an Amazon EC2 micro instance.Please see : [Tracking your AWS Free Tier usage - Trackable AWS Free Tier services] (https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/tracking-free-tier-usage.html#free-tier-services) .Using these Usage type and Usage type group filter types along with the Group By option of Charge type in Cost Explorer feature --> You'll be able to get the details of free-tier usage.Please let me know if you face any issues, We'd be glad to be of assistance.Thanks.CommentShareNithin Chandran Ranswered a year agoAdam 4 months agoI use to be able to select a free tier option under cost explorer that added my free tier amounts to my billing as if they were not free tier. I would like to be able to do this. I need to be able to tell my clients what a free tier service will cost if it comes out of free tier or if they want to bill someone on services rendered via free tier.Share"


Question: ec2密钥对丢失，按照官方办法无法解决

"https://aws.amazon.com/cn/premiumsupport/knowledge-center/user-data-replace-key-pair-ec2/Content-Type: multipart/mixed; boundary="//"MIME-Version: 1.0--//Content-Type: text/cloud-config; charset="us-ascii"MIME-Version: 1.0Content-Transfer-Encoding: 7bitContent-Disposition: attachment; filename="cloud-config.txt"#cloud-configcloud_final_modules:- [users-groups, always]users:  - name: ubuntu    ssh-authorized-keys:     - ssh-rsa AAAAB3NzaC1yc2EAAAADxxxxxFollowComment"


Question: Aurora 5.7.mysql_aurora.2.11.0 Too Many Connections

"I have read most, all?, of the AWS troubleshooting guides on RDS/Aurora and we tried a bunch of things. We have a cluster with one reader and one writer. About two days ago they failed over and flipped automatically. Not sure why, not even sure it's related, but it happened and we didn't notice because things kept humming along. This morning, however, our apps, and IDEs started receiving too many connection errors when trying to connect. We could connect directly to the read instance, but couldn't write. Rebooted both, waited for the writer instance to recover, and same issue. Failed over to flip the instances, no real change. Flipped back, no change. Rebooted the writer again, no change. As we finally gave up and started restoring a snapshot, write connections just resumed on their own. There was about a half hour gap between the previous reboot and no additional event logs that would indicate it just took a while to reboot or failover.This feels like there was an AWS issue, but of course I don't see anything mentioned in the health dashboard. Our max connection param was set to the default for this version of MySQL and worked out to 90 for the db.t2.medium's we're running on. According to Cloudwatch we have never seen much more than about 15, so it seems odd that we were even receiving too many connection errors.It would be great to know what changed to break things and then how they were resolved because right now I have a working instance but no real clue as to what may have changed this morning. Any ideas?FollowCommentjbgorski 3 months agoIf you have confirmed that this is not a problem with too many connections on the application side, the only thing you can do is report this issue to AWS Support.  In the case of such situations, I create new environment from backup and I leave the old instance for problem analysis, for AWS Support. I met with such situation that the problem stopped appearing on new environment and I could continue my work with new instance. Unfortunately AWS Support wasn't able to find root cause then.Share"


Question: Data loss while MSK is in an HEALING state.

"Hi there,We had about 10 mins downtime today while MSK was in a HEALING state. But according to the doc available online. A healing state should not affect the cluster to produce or consume. Is there a reason why we had downtime? Below is our cluster configurationauto.create.topics.enable=truedefault.replication.factor=3min.insync.replicas=2num.io.threads=8num.network.threads=5num.partitions=1num.replica.fetchers=2replica.lag.time.max.ms=30000socket.receive.buffer.bytes=102400socket.request.max.bytes=104857600socket.send.buffer.bytes=102400unclean.leader.election.enable=truezookeeper.session.timeout.ms=18000log.retention.hours=-1I found these logs on the consumer side."error":"Messages are rejected since there are fewer in-sync replicas than required","correlationId":5,"size":57}Kindly advise if anything is wrong with the configuration. ThanksFollowComment"

Answer: "0Hi there, how many brokers you have? If the following best practices are followed (1) it wouldn't cause any downtime when one broker is down. When one broker is down it is possible a partition will have one less replica then it is configured to have. So that is the reason replication factor should be greater than min.insync.replicas by 1 i.e RF = minISR+1. Based on the above error, it seems you have acks=ALL which requires atleast 2 replicas to be insync (based on min.insync.replicas=2 in your config) but seems less than 2 replicas were in sync at the time so the error.Even though default.replication.factor=3, it only applies to auto created topics. If you create topics manually you will have to specify replication factor while topic creation. Please make sure RF for topics is 3 if it is 3AZ cluster. If it is 2AZ cluster please decrease the value of min.insync.replicas to 1.(1) https://docs.aws.amazon.com/msk/latest/developerguide/bestpractices.html#ensure-high-availabilityCommentShareSUPPORT ENGINEERHarshith_Manswered a year ago"


Question: I could not deleve namespace on Cloudmap

"Hi all,I could not delete a namespace:Unable to delete the namespaceError 400 DuplicateRequest: Another operation of type DeleteNamespace and id wrvanopb4bgbyquwbmpitzb5pyafwnk4-5c8n16xv is in progressIs there any problem about the service?Thank you!FollowComment"


Question: No Internet access after migration of Workspace from Server 2016 to 2019

"We migrated a Workspace from "Server 2016 based" to "Server 2019 based", the migration completed "successfully" and we can access the Workspace with the AWS client and also RDP -- and we can access the vpc resources including Intranet web sites but we have no Internet access from the client.(trying to access www.google.com with Chrome or IE results in "Can’t reach this page").We had Internet access on this Workspace before the migrationThe other Workspaces on the same subnet (they are still "Server 2016 based" ) have Internet accessWe compared the networks settings with the other machines on that subnet (including ipconfig, routing table, firewall rules, etc...), no differenceThe only visible change in network settings from the migration is the new IP address (but it is within the subnet range, that should no have any impact, the VPC is set correctly)DNS is working, but it seems the  tcp connections are blockedrunning traceroute on a public IP or domain name (ie www.google.com again) show it goes nowhere (not a single hop) -- a normal traceroute would show a compute.amazonaws.com machine on the first hop...According to the network troubleshooter:Problems foundYour computer appears to be correctly configured, but the device or resource (www.microsoft.com) is not respondingIt looks like the AWS router is rejecting the connections!Did that happen to anyone?  Can you please let me know how you fixed it?FollowComment"

Answer: "0Accepted AnswerIn case anyone runs into the same issue:the Worskpace loses the association to the Elastic IP during the migrationit needs to be re-associated to the (any) Elastic IP to restores Internet access, dah.I suggested to AWS to inform about the Elastic IP been de-associated in the Administration Guide...CommentShareAWS-H-Tanswered a year agoMuraliAtAWS EXPERTa year agoAppreciate the follow up on resolving the issue - the best practice for providing internet access to WorkSpaces instances is to use a NAT gateway.ShareMayank_J a year agoIn addition to what "MuraliAtAWS" stated. You can refer to this best practices guide for more details. https://docs.aws.amazon.com/whitepapers/latest/best-practices-deploying-amazon-workspaces/best-practices-deploying-amazon-workspaces.htmlShare"


Question: WorkDocs invitation not received by external user

"I am a WorkDocs administrator and invited a user outside my organization to a WorkDocs instance. The user has not received the invitation, and I've resent the invitation multiple times, as well as deleted and added back the user. Other users at the same person's organization/domain have received WorkDocs invitations, so it's unclear what's preventing the invitation from getting through. How can I troubleshoot this?FollowCommentAWS-User-3269117 a year agoMy customer is having the same issue, one of the managers on client side has not received the invitation to WorkDocs folder. Forgot password is showing 'Server Error'. How can I resolve this issue asap, as its delaying the SOW getting executedShare"

Answer: "0Although I suspect the problem is on the receiving domain side (because other users receive invitations) I would raise a case with the AWS support team just to make sure that the invitation email is being sent correctly. Otherwise, the only guidance is to check the anti-virus and anti-spam filtering on the receiving end as well as check the user's spam folder.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: How many email aliases per user account?

I would like to know how many email aliases I can have per user account.Kind regards.FollowComment

Answer: "0HI,As per the documentation of WorkMail: https://docs.aws.amazon.com/workmail/latest/adminguide/workmail_limits.html The limit of aliases per user is 100.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 4 years ago0Thank you!CommentShareSosadinhoanswered 4 years ago"


Question: Could not connect to the endpoint URL: "https://s3.local.amazonaws.com/"

I am trying to run the command "aws s3 ls" and I'm getting the following response:Could not connect to the endpoint URL: "https://s3.local.amazonaws.com/"I have verified that the credentials I have set up in my credentials file have programmatic access.My config file is set up with the following values:[default]region = us-east-1output = jsonI have tried setting up a new user and creating new credentials.I have tried uninstalling and reinstalling the cli.Ping request could not find host s3.local.amazonaws.com.I did get a response from ping s3.us-east-1.amazonaws.com.Does anyone know what I am doing wrong or what else I can try?FollowComment

Answer: 0Just after I posted this I noticed that I had an environment variable set up causing the region to be set as "local".I removed the AWS_DEFAULT_REGION environment variable and it is now connecting to the correct endpoint URL using the region from my config file.CommentSharemjh1975answered 2 years ago


Question: Mediapackage Endpoint

"I am using MediaPackage, MediaLive, and S3 for live streaming. I am using MediaPackage for broadcasting and S3 for storing the data coming form Medialive channel input and share it to the users again.After creating every necessity form node js backend, i am starting the channel from my backend. Channel is running  but the data is not coming to the endpoint and S3 bucket. Interesting point is that, when i enter the aws console and open the Medialive channel which i have created from backend, and go to the update section and click update button  WITHOUT CHANGING ANYTHING and start it again it is working perfectly.  I tried to update it from backend as it is working when i have updated from aws console, but updating from backend did not help. I know it is strange that it is not working unless it is updated with no change, but this is the case.FollowComment"

Answer: "0Can you provide a clarification of the workflow? Is AWS MediaLive sending HLS streams to AWS MediaPackage and to S3, or just to S3? Also, are you using the Harvest Job function in AWS MediaPackage?Typical live streaming has MediaLive sending HLS to MediaPackage, then a CDN, such as CloudFront, will pull the stream renditions from MediaPackage. Endpoints in MediaPackage need to be defined for CloudFront to pull from.An alternative is MediaLive writing HLS to S3 and CloudFront pulling from S3.In this scenario, MediaPackage can ingest the captured stream from S3, after the live event, and create an asset that can be pulled from a MediaPackage endpoint.As to issues of controlling the channel from the API vs AWS console, something could be missing from the API based orchestration.CommentShareMike-MEanswered 5 months agoApplr 5 months agoI have attached 2 output groups to medialive. In the output group 1 the destination is Mediapackage(for broadcasting). In the output group 2 the destination is S3 bucket(for storing live). I am not using Harvest Job function in aws Mediapackage. And i am not using CloudFront, should I use it?ShareApplr 5 months agoAfter this comment I also implemented cloudfront, it is also working prefectly but only after updating medialive channel without any change.Share0Perhaps there is something missing from the backend (API) process. A configuration or a procedure. You may want to review the Channel Start and Channel Stop in the MediaLive API documents, along with reviewing interfacing through the AWS APIhttps://docs.aws.amazon.com/medialive/latest/apireference/channels-channelid-start.htmlhttps://docs.aws.amazon.com/medialive/latest/apireference/channels-channelid-stop.htmlhttps://aws.amazon.com/api-gateway/AWS MediaPackage should not be used for supplying streams directly to live streaming viewers. It is designed as an origin server, with Just-In-Time Packaging, that sources a CDN, such as CloudFront. Without a CDN, MediaPackage will be overloaded by direct viewer requests.The same is true for accessing the stored streams in S3. It should be done through a CDN for both load distribution and safety reasons.If the issue being experienced is not resolved, it may be helpful to use the Workflow Wizard in MediaLive's console. This will create an end-to-end channel, along with a CloudFormation template, which could be used for a configuration base. The individual AWS services could then be modified for the specific application and needs.CommentShareMike-MEanswered 5 months ago0Thank you for your answer,For starting and stopping channel i am already using these apis' javascript sdk:https://docs.aws.amazon.com/medialive/latest/apireference/channels-channelid-start.html https://docs.aws.amazon.com/medialive/latest/apireference/channels-channelid-stop.htmlAnd you also advised testing creation of stream using Workflow Wizard. I tested Workflow Wizard too. In my api i am doing the same steps with workflow wizard, but still need to update. Isn't it a little strange that updating a channel to be able to run it, without any change? What else could you suggest me to try?CommentShareApplranswered 4 months ago"


Question: Endless Login Loop Cycle

"Hi there,So my card expired and my account was suspended without me realising. I would like to pay my bill and regain access. Upon login I'm redirected to a page (below) telling me that I must visit the "Payments" section to pay my outstanding debt to regain access to my account. When clicking the link I am redirected and asked to login again. I'm then redirected to this page again. And so begins the cycle.I've contacted the customer service agents via: https://support.aws.amazon.com/#/contacts/aws-account-supportI've had multiple generic responses like "I see you're having problems accessing your account, visit x link to reset your password" or "please visit x link (which requires you sign in) to fill out this form and we will get back to you".And yes, before you suggest it, I've tried troubleshooting on my end.. clearing the cache, cookies, using another browser/device. It seems its a bug with my account or the aws system.console log of the error is here:It doesn't matter the route, seems it enters me into the login loop cycle.I only managed to get access to this resource by creating a "Builder Profile". But I'm unable to get any help from other means on this issue. Not sure where else to go.Any help would be appreciated.FollowComment"

Answer: "0Hello,I'm sorry for the frustration this must have caused.Please note that you cannot reopen or access your account if it's been suspended for more than 90 days. If your account has been suspended for less than 90 days, I'd strongly advise that you reach out using the contact form one more time. Be sure to state in detail the issues you're facing as well as the error messages you're receiving:https://support.aws.amazon.com/#/contacts/aws-account-support.Our Support team can then take a closer look to see if there are any issues on our end.Regards,- Craig M.CommentShareEXPERTAWS Support - Craiganswered 5 months ago"


Question: "Anomaly Detection's band spikes, triggering false alarms"

"I have an Aurora Serverless database, which I like to be notified whenever it scales. I've been using a band to do this, and it's fine 99% of the time. But sometimes, it triggers, and the database capacity hasn't changed. Digging into it in cloudwatch, I see this:It looks like the band itself bounces around instead of remaining stable. Can anyone explain this? For now I've switched to a static alarm, so i stop getting 5 messages every night, but this isn't sufficient for longer term and our high load periods.FollowComment"

Answer: "1Hi, Is it possible for you to share the metric last 2 week and last month behavior. If the patter is stable in the last 2 weeks, can you try to delete and recreate the anomaly detection bands to retrain the model. Here is the information for creation and deletion: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Create_Anomaly_Detection_Alarm.htmlIf the issue still persist, we can dive deep into it.CommentSharejunejagaanswered 2 months ago0As you can see, this has been going on for a while. Before this 2 week period, we did have some actual scaling fluctuation, but in this two weeks, not at all. Does the band take historical data into account for its prediction? I thought it just did some beizer-esque curve fitting.I will try delete it and recreate it and see if that helps.CommentShareDavid Goemansanswered 2 months ago0No that didn't help, still happening last night. Similar sort of pattern, spiking band, stable value.Note that since i recreated this alarm, the value has not changed at all from 2, so the band spiking cannot be because of the value changing historically.CommentShareDavid Goemansanswered 2 months ago0this was triggering all day yesterday, so i've switched it back to a threshold alarm. The band is totally unusable for a stable value for me.CommentShareDavid Goemansanswered 2 months ago"


Question: How to change light color in response of an event?

"I am trying to change the color of a light after a HttpResponse or after a broadcast event.In 1.9 or 1.8.1 I have the same issue. I am using this command in Lua:LightComponentRequestBus.Event.SetColor(self.entityId, Vector3(0,200,0))And the error is the same in 1.9 and 1.8.1:C3DEngine:RegisterEntity should only be called on main thread. Save Level Before Exiting the Editor?Thank you!Follow"

Answer: "0Accepted AnswerHello @REDACTEDUSERI was able to reproduce the issue you were experiencing. For some reason changing the light color seems to destroy the light render and then recreate it and as such seems to happen on the wrong thread. I've informed the team about this. In the meantime, I'd recommend having two lights set up with the colors that you need and switch them on/off based on what you want to accomplish.Edit: Alternatively, you can apply the following changes to HttpClientComponent.cpp which would execute the callback on the main thread:Add the following include:#include <AzCore/Component/TickBus.h>Replace MakeHttpRequest function with the following:     /** HttpClientComponentRequestBus::Handler*/void HttpClientComponent::MakeHttpRequest(AZStd::string url, AZStd::string method, AZStd::string jsonBody){#if defined(PLATFORM_SUPPORTS_AWS_NATIVE_SDK)auto job = aznew HttpRequestJob(true, ServiceJob::GetDefaultConfig(),[this](int responseCode, AZStd::string content){AZ::EntityId entityId = m_entity->GetId();AZStd::function<void()> requestCallback = [entityId, responseCode, content]() {EBUS_EVENT_ID(entityId, HttpClientComponentNotificationBus, OnHttpRequestSuccess, responseCode, content);};EBUS_QUEUE_FUNCTION(AZ::TickBus, requestCallback);},[this](int responseCode){AZ::EntityId entityId = m_entity->GetId();AZStd::function<void()> requestCallback = [entityId, responseCode]() {EBUS_EVENT_ID(entityId, HttpClientComponentNotificationBus, OnHttpRequestFailure, responseCode);};EBUS_QUEUE_FUNCTION(AZ::TickBus, requestCallback);});job->SetUrl(url.c_str());job->SetHttpMethod(method);job->SetJsonBody(jsonBody.c_str());job->Start();#endif // #if defined(PLATFORM_SUPPORTS_AWS_NATIVE_SDK)}Hope that helps.SharerePost-User-5162062answered 6 years ago0I'm checking with a tech to see if they know can help you out.SharerePost-User-8353690answered 6 years ago0@REDACTEDUSERtks a lot!SharerePost-User-4308601answered 6 years ago0@REDACTEDUSERSharerePost-User-4308601answered 6 years ago0Hello @REDACTEDUSERCan you post your Lua code? We'd like to investigate which Bus or API call is causing this.Thank you.SharerePost-User-5162062answered 6 years ago0GameplayNotificationBus.Broadcast.OnEventBegin("q1p2-change-color")LightComponentRequestBus.Event.SetColor(self.Properties.Light, Vector3(200,0,0))still in version 1.8.1SharerePost-User-4308601answered 6 years ago"


Question: Managed databases - encrypted?

"Hi,does anyone know whether Lightsail managed databases (and specifically PostgreSQL) use encrypted storage (i.e. encryption at rest)?I can't find any information about that in the docs, and our client requires encryption at rest.Thanks,M.FollowComment"

Answer: "0Accepted AnswerHello,Thanks for using Lightsail!Except the smallest database bundle, Lightsail automatically encrypts your data at rest and in motion for increased security by using keys that Lightsail manages on your behalf.Best,YiranCommentShareYiran-AT-AWSanswered 4 years ago0I looked at the available documentation and couldn't find anything that specifically indicated that the databases were encrypted at rest.That said ...Lightsail databases are probably using the same infrastructure that the rest of Lightsail is using ... and, according to the FAQ (https://aws.amazon.com/lightsail/faq/)...Does Lightsail block storage offer encryption?Yes, to help keep your data secure, all Lightsail attached disks and disk snapshots are encrypted at rest by default, using keys that Lightsail manages on your behalf. Lightsail also provides encryption of data as it moves between Lightsail instances and attached disks.CommentShareDavid Ganswered 4 years ago0Great, thank you!CommentSharemvdammeanswered 4 years ago0Hi David,thank you for your reply!Do take care however, because according to another thread on this forum the root volume (i.e. your machine's own disk) is not encrypted. Only attached disks and snapshots are. See: {message:id=881826}This is the reason I'll also be using an attached disk, even though the root volume has more than enough space for my needs.CommentSharemvdammeanswered 4 years ago0mvdamme wrote:Do take care however, because according to another thread on this forum the root volume (i.e. your machine's own disk) is not encrypted. Only attached disks and snapshots are. See: {message:id=881826}Ah, thanks for pointing that out ... I missed that bit.Filed for future reference.CommentShareDavid Ganswered 4 years ago"


Question: [DDB] Is there batch update like batchWrite?

"Hi,There seems to be batchGet() and batchWrite() functions.However, there doesn't seem to be batchUpdate() function in DDB.References:https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/DynamoDB/DocumentClient.html#batchWrite-propertyhttps://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/DynamoDB.html#batchWriteItem-propertyNote: BatchWriteItem cannot update items. To update items, use the UpdateItem action.Is this correct? If I want to update multiple rows, I cannot do in batch fashion. Or am I wrong?FollowComment"

Answer: "1Accepted AnswerTake a look at the new PartiQL support in DynamoDB.  The BatchExecuteStatement API action allows up to 25 item reads or 25 item writes.  The writes can be inserts, updates, or deletes - and you can also apply conditions.https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_BatchExecuteStatement.htmlCommentShareAWS-User-9190687answered 2 years ago"


Question: Does Git-LFS (Large File Storage) have support in Code Commit?

Does AWS Code Commit have support for git-lfs?There are many modern day use cases where committing large files to git makes sense. These are all explained on the official site: git-lfsMany of the other code repository services support this. It feels well overdue for Code Commit to catch up.There is an old AWS forum post that explains the history of this request: forumA useful and intuitive approach would be to use an S3 bucket as the actual backing store so that costs can be controlled. Linking the repo to S3 that way would make sense.FollowComment


Question: Problem adding nodegroup in EKS cluster with GW NAT

"HelloI am having difficulties in bringing an EKS cluster back into complianceCluster:I have an eks cluster with :6 EKS Plane Control Networks (network 1-6)i. Network 1/2/3 are in a RA routing table with a 0.0.0.0/0 which refers to an Internet Gatewayii. Network 4/5/6 are in an RB routing table with a 0.0.0.0/0 that refers to a NAT Gateway (+ other routes to my company network)4 cluster nodegroupe with networks 4/5/6 used for worker nodesMy EKS cluster has a Public and Private API ( => From a node, when I do a DNS resolution I do see a private IP)Target:EKS cluster with :6 EKS Plane Control Networks (network 1-6)i. Network 1/2/3 in a RA routing table with a 0.0.0.0/0 that refers to an Internet Gatewayii. Network 4/5/6 also in the RA routing table4 cluster nodegroupei. Nodegroupe 1 : Use networks 10 and should be in the RC routing table with 0.0.0.0/0 which refers to a new NAT Gateway (+ other routes to my company network)ii. Nodegroupe 2 : Use networks 11 and should be in the RC routing table with 0.0.0.0/0 which refers to a new NAT Gateway (+ other routes to my company network)iii. Nodegroupe 3 : Use networks 12 and should be in the RC routing table with 0.0.0.0/0 which refers to a new NAT Gateway (+ other routes to my company network)iiii. Nodegroupe 4 : Use networks 13 and should be in the RC routing table with 0.0.0.0/0 which refers to a new NAT Gateway (+ other routes to my company network)ProblemWhen creating a new nodegroup to replace an existing one, I indicate network 10/11/12 or 13The RC routing table is OK with the NAT GatewayProblem: the node can't join the cluster (error message: Instances failed to join the kubernetes cluster)I can see the EC2 instance being created in the right network 10/11/12 or 13I don't understand the problem, why the nodes in this network 10/11/12 or 13 can't join the API cluster through the ENI in network 1-6?When I create a new nodegroup and I indicate a network 1-6 (network on route table RA or RB) it works without problemSincerelyFollowComment"


Question: AWS Cognito automatic emails are sometimes not been sent

"Hello,I'm using AWS Cognito as an authentication provider. I'm using AWS SES account to send cognito automatic emails.When creating a user account, i send custom emails on my side (using AWS SES api), and cognito should automatically send welcome emails.Some users told me that they received my custom emails but not emails with their credentials ... (event after checking on spam folder). I don't have dedicated IP address for my AWS SES account.What would you recommend to me ? Go for a dedicated IP address ? (Will it really solve my problem ?)My application will only send emails when users are created (and users and imported by hundreds at same time), so that means lot of emails are sent at the same time. I set up a backoff algorithm on AWS SES API to avoid overloaded issues.I already ask my AWS SES quota te be increased to 20 per seconds.Thank you in advance.FollowComment"


Question: [FlexMatch] Can we define comparison rule expansions by comparing attribute across player ?

"Hello Flexmatch Team,I didn't see anywhere mention that we could define relaxations on the comparison rule type by comparing the attributes of the players between them. For instance, in the rule DifferentCharacter in example 6, i would like to authorize an amount of duplicated characters according to the waiting time , like described below :{        "target": "rules[DifferentCharacter].maxCount",        "steps": [{            "waitTimeSeconds": 30,            "value": 1        }, {            "waitTimeSeconds": 60,            "value": 2        }]}Thank you  !FollowComment"


Question: Understanding RDS Billing

"I had mistakenly launched a db.r6g.large PostgreSQL instance and deleted it instantly while under Free Tier. I also deleted all the snapshots as well. Yet, I see daily increase in the bill by a few cents. Anyone knows what to do there?FollowComment"

Answer: 0Can you please check if you are still being charged using Cost Explorer - Group by Usage Type as shown in https://aws.amazon.com/blogs/aws-cloud-financial-management/getting-started-with-aws-cost-explorer-part-1/?CommentShareEXPERTAWS-User-Nitinanswered 5 months ago


Question: Issue launching EC2 free tier instance

"I am attempting to launch an EC2 instance of Ubuntu on the free tier in US East (Ohio)However, when attempting to do so, I get this errorInstance launch failedThis account is currently blocked and not recognized as a valid account. Please contact aws-verification@amazon.com if you have questions.FollowComment"

Answer: "0Hi,just follow the instruction as you mentioned. I have heardt that that verification team May take some time before answering, so I would also try to contact Support to speed things up.Hope it helps ;)CommentShareEXPERTalatechanswered 2 months agorePost-User-5376371 2 months agoI tried contacting them for technical support but it said that I don't have access to technical support for my account. what contact method would you recommend?Sharealatech EXPERT2 months agoHere: https://aws.amazon.com/contact-us/ try billing and account supportShare"


Question: How to access SES inbox to open verification email?

"Hi, I'm trying to verify my email identity admin@braindocacademy.com.auI was following instructions here https://docs.aws.amazon.com/ses/latest/dg/creating-identities.html#verify-email-addresses-procedure and it says to open inbox to receive verification email.My issue is, how do I open that inbox in the first place? I don't know how to open my inbox so that I can open the verification email. I've tried gmail, outlook, etc, and various options but none worked.Any help is much appreciated!Thank you,CarlFollowComment"

Answer: "0Are you trying to use SES to receive emails? If so, please take a look at Email receiving with Amazon SES documentation. You can deliver emails to S3, for example, and you can view the email content there in S3. See How can I use Amazon SES to receive inbound emails, and then store those emails on Amazon S3?CommentShareTaka_Manswered 7 months ago"


Question: Connecting to Kafka MSK serverless from another VPC

"I'm trying to set up a connection between my EKS cluster running in its own VPC and a serverless Kafka cluster (MSK) which is running in a default VPC. I have established VPC peering, with DNS resolving options enabled both ways. DNS hostnames and DNS resolution is enabled in the corresponding VPCs as well.But DNS resolution for the Kafka endpoint (boot-xxxxx.c1.kafka-serverless.us-east-1.amazonaws.com) is not working from the EKS VPC. I checked and re-checked all possible configurations including security groups and everything but cannot find a solution. I also made sure that peering works but connecting to the actual IP address of kafka is not viable because kafka redirects to other endpoints which again are not resolvable.FollowComment"

Answer: "0Routing works and internal name resolving (instance names) also works between VPCs, however the endpoint name (which seems to be a public entry: ".amazonaws.com") is notCommentSharerePost-User-3708223answered a month agoRiku_Kobayashi EXPERTa month agoBy the way, what error do you get when you try to access MSK from EKS?Can you please share the original text of the error?Share0Can I use nslookup to resolve the DNS name of the Kafka cluster from EC2, etc. in an EKS VPC?Have you configured the route table after VPC peering?CommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: Updating CFN stack over multiple accounts

"A customer is implementing a multi-account deployment strategy (account 1 for DEVO, account 2 for UAT, account 3 for Production) using CFN templates to provision their infra as codeThe deployment process includes the typical deploy/validate/promote workflow where a new version of the CFN template should be validated in a DEVO environment before promoting it to UAT and so onMy initial approach was using CFN StackSets and it works nice on stack creation time but when it comes to stack update, it seems to be impossible to control when/where to deploy the new version of the template (i.e. "Updating a stack set always touches all stack instances") so I can not validate a stage deployment before promoting to the next stage (probably target account gates lambdas can make the trick but looks to me like a lot of additional complexity)I would expect having something like update-stack-set without updating the existing stack instances and allowing me to perform an account by account update of the stack after proper validation is performedThe alternative solution I am exploring is using cross-account roles to target individual accounts using CFN update-stack (hence ignoring stacksets)Any experience on similar requirement?FollowComment"

Answer: "0Accepted AnswerYup, for now you can only attach a single template to a StackSet -- when you check a new template in, it will being pushing out to the accounts and only stop of you cross your fault tolerance threshold.The most common approach I've seen with the current tools available is CodePipeline chaining -- trigger the pipeline in DEVO, when it completes successfully use a custom action to copy the template into a bucket in the next account, similar to this model: https://aws.amazon.com/blogs/devops/building-a-cross-regioncross-account-code-deployment-solution-on-aws/I've had several customers ask for more complex deployment patterns for StackSets -- what would you prefer here?CommentShareAWS-User-0317806answered 5 years ago"


Question: Unable to execute HTTP request: timeout

"In cloudwatch logs, while pushing logs from Android platform app. Sometimes, I am receiving this error as non fatal exception in crashlytics (Note: Mostly, This error throws in release build)Non fatal exception: com.amazonaws.AmazonClientException: Unable to execute HTTP request: timeoutFollowComment"

Answer: "0If the logs are coming from an Android application, it is possible the device was offline (not connected to internet), when it tried to communicate with destination.CommentShareRobert Loveanswered a month ago"


Question: Can not login to my account

I have been billed for some unknown service and I can not login to my account to see what it is for. I think my account has also been suspended.  I need help getting into my account so I can get support and correct this problemFollowComment

Answer: 0I would try these optionsCommentSharejthornes-awsanswered 10 months ago


Question: How to associate a IAM Role with the container execution like ECS does?

"I would like to use something like AWS.ECSCredentials inside my container running on App Runner in other to use AWS services with a provided configured role.AWS.config.credentials = new AWS.ECSCredentials({ httpOptions: { timeout: 5000 }, maxRetries: 10 });I found out that there is a InstanceRoleArn property on InstanceConfiguration settings but I have already tried many roles I created and none of them seems to be accepted by App Runner.FollowComment"

Answer: "1The trick part is the Allow sts:assumeRole for service tasks.apprunner.amazonaws.comResources:    InstanceRole:      Type: AWS::IAM::Role      Properties:        RoleName: AppRunnerExecutionRole        MaxSessionDuration: 28800 # 8h        ManagedPolicyArns:            - arn:aws:iam::aws:policy/AmazonS3FullAccess        AssumeRolePolicyDocument:          Statement:            - Effect: Allow              Action: sts:AssumeRole              Principal:                Service: tasks.apprunner.amazonaws.com    AppRunnerService:      Type: AWS::AppRunner::Service      Properties:        ServiceName: service        SourceConfiguration:          AuthenticationConfiguration:            AccessRoleArn: "arn:aws:iam::xxx:role/service-role/AppRunnerECRAccessRole"          AutoDeploymentsEnabled: true          ImageRepository:            ImageIdentifier: "xxx.dkr.ecr.us-east-1.amazonaws.com/xxx:latest"            ImageRepositoryType: ECR            ImageConfiguration:              Port: 8080        InstanceConfiguration:          Cpu: 2048          Memory: 4096          InstanceRoleArn:            Fn::GetAtt: [ InstanceRole, Arn ]CommentShareonhateanswered 2 years ago"


Question: How to transform HTTP requests to Lambda events exactly as AWS API Gateway does as an HTTP proxy?

"I'm developing a Lambda service behind an API Gateway as an HTTP proxy[1].As the docs say, API Gateway basically transforms the HTTP request into a JSON Lambda Event.In order to support the development process, I wonder if there is a library I could use to do that: transform an HTTP request into a JSON Lambda Event.That way I could develop locally, wrapping my lambda implementation in a dummy web server whose work would be to transform and pass the event to my code.[1] https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-lambda.htmlFollowComment"

Answer: "1I recommends that you use SAM CLI for local testing. Using SAM CLI you can invoke your functions locally using the sam local start-api command, that will start also a local API gateway and will invoke your code when you CURL the local end-point. You could also use sam local generate-event to create the event object that is used by API Gateway and use it when invoking the function directly using sam local invoke.CommentShareEXPERTUrianswered 4 months ago"


Question: HTTP API Gateway: Specifying Different Lambda Version per Stage

"Hello, I'm trying to create multiple stages for the same HTTP API Gateway (corresponding to Test and Production environments) and make the same Routes point to the same Lambda functions (Integrations) but different versions thereof. I'm trying to do this using CDK, but I think it's not yet supported there. However, I cannot even seem to be able to do this using the console. Any ideas?FollowComment"

Answer: "2Accepted AnswerHello there,you can accomplish this using stage variables. After deploying your HTTP API, go to one of the stages, edit, and go down to Stage variables.Add a key (i.e. lambda_function_version) and as value, the version number of the lambda function you prefer.Go to the Integration details of your API endpoint and in the Integration target section, use the ARN of the lambda function with the variable you setup previously:arn:aws:lambda:us-east-1:xxxxxxxxxxxx:function:MyDearLambdaFunction:${stageVariables.lambda_function_version}Repeat the process for other stages of your API.Remember that Stage variables don't support cross-account Lambda functions.Here's the documentation with more details. Hope this helps.CommentSharehernangarciaanswered a year agoNetbizUp a year agoThank you very much! Do you confirm that none of the above is (yet) doable using CDK2? Not even the part where I can set the stage variable in the Route Integration?SharerePost-User-0187256 6 months agoThis does not work anymore. It's shown "AWS ARN for integration must contain path or action" on UI. May be a bug? Please help.Share0Sadly this does not work anymore. Whenever you put a stageVariable into integration target (if integration type is "Lambda function") it fails with "1 validation error detected: Value <arn> at 'functionName' failed to satisfy constraint: Member must satisfy regular expression pattern: <regex>"CommentSharerePost-User-4497321answered 6 months ago"


Question: Is there a way to add a step between other steps in a recipe with the UI?

"It seems like the only option when adding a new step to a recipe with the visual UI is to add it to the end, as the last step.There are cases where I'd like to modify a recipe and add a step between existing steps.The workaround I have found is to add whatever step i wanted to insert at the end, download the recipe as a JSON file, reorder the steps, then re-upload the recipe. This is a bit of a pain though.Is there any way to do this w/o that workaround? ^Or are there any plans to add in this functionality?FollowComment"

Answer: "0Coming soon! We are currently working on adding step re-ordering directly in the Project workspace UI. Will keep you posted when this feature is released.For now, your workaround makes sense - the alternate is to undo your steps up until that index, apply the missing step, then reapply, but I suspect your approach will work better for longer recipes.CommentShareAWS-User-8125078answered 2 years ago0Awesome! Is there a way I can stay updated on the changes made to DataBrew?CommentShareRagingWontonanswered 2 years ago0Absolutely, I recommend subscribing to AWS What's New posts - we'll announce all of our larger features there. https://aws.amazon.com/new/CommentShareAWS-User-8125078answered 2 years ago0The time has come :) DataBrew now supports re-ordering recipe steps within the project workspace.Open a project, and you'll find the "Reorder steps" icon in the right hand recipe panel (note that the button is enabled only if you have two or more steps).CommentShareAWS-User-8125078answered 2 years ago"


Question: Restrict downloading profile picture form S3 bucket through Cloud Front

"I have a CloudFront Distribution and a S3 bucket , I have allowed s3:GetObject from the CloudFront OAI , So that I can use those in my websites. I am also storing profile pictures of the user in S3 Bucket . Now using my cloudfront if anyone knows my bucket name , they will be able to download the profile picture right.If am editing the bucket policy no deny the folder containing the profile picture , it wont show up in the website . How to solve this issue?The profile picture should be got from the S3 bucket, but the folder should be accessed using the S3 bucketFollowComment"

Answer: "0You can limit access to the file only from your website by adding a condition to your S3 bucket policy which would filter against the referer header in the request. This would allow you to limit your files being access only by a specific domain or subdomains. See here for a sample policy - https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-use-case-4You can also use signed URLs/cookies to further restrict access based on client and time - https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-choosing-signed-urls-cookies.htmlHowever, you can't really prevent downloads as such. If your users can see your image in their browser, that basically means the image has already been transferred to their device. There are ways to capture and save the image from there (such as developer tools on the browser)  regardless of any limitations you try to impose.CommentShareChamalanswered 6 months ago"


Question: Unable to create new OpsItems from EventBridge when using Input Transformer for deduplication and adding category and severity values

"I’m able to generate a new OpsItem for any EC2, SecurityGroup, or VPC configuration change using an EventBridge rule with the following event pattern.{"source": ["aws.config"],"detail-type": ["Config Configuration Item Change"],"detail": {"messageType": ["ConfigurationItemChangeNotification"],"configurationItem": {"resourceType": ["AWS::EC2::Instance", "AWS::EC2::SecurityGroup", "AWS::EC2::VPC"]}}}The rule and target work great when using Matched event for the Input but I noticed that launching one EC2 using the AWS wizard creates at least three OpsItems, one for each resourceType.  Therefore I’d like to implement a deduplication string to cut down on the number of OpsItems generated to one if possible and I’d also like to attach a category and severity to the new OpsItem.  I’m trying to use an Input Transformer as recommended by the AWS documentation but even the most simplest of Input Transformers when applied prevent any new OpsItems from being generated.  When I've tested, I've also ensured that all previous OpsItems were resolved.  Can anyone tell me what might be blocking the creation of any new OpsItems when using this Input Transformer configuration?Here’s what I have configured now.Input path{"awsAccountId": "$.detail.configurationItem.awsAccountId","awsRegion": "$.detail.configurationItem.awsRegion","configurationItemCaptureTime": "$.detail.configurationItem.configurationItemCaptureTime","detail-type": "$.detail-type","messageType": "$.detail.messageType","notificationCreationTime": "$.detail.notificationCreationTime","region": "$.region","resourceId": "$.detail.configurationItem.resourceId","resourceType": "$.detail.configurationItem.resourceType","resources": "$.resources","source": "$.source","time": "$.time"}Input template{"awsAccountId": "<awsAccountId>","awsRegion": "<awsRegion>","configurationItemCaptureTime": "<configurationItemCaptureTime>","resourceId": "<resourceId>","resourceType": "<resourceType>","title": "Template under ConfigDrift-EC2-Dedup4","description": "Configuration Drift Detected.","category": "Security","severity": "3","origination": "EventBridge Rule - ConfigDrift-EC2-Dedup","detail-type": "<detail-type>","source": "<source>","time": "<time>","region": "<region>","resources": "<resources>","messageType": "<messageType>","notificationCreationTime": "<notificationCreationTime>","operationalData": {"/aws/dedup": {"type": "SearchableString","value": "{"dedupString":"ConfigurationItemChangeNotification"}"}}}Output when using the AWS supplied Sample event called “Config Configuration Item Change”{"awsAccountId": "123456789012","awsRegion": "us-east-1","configurationItemCaptureTime": "2022-03-16T01:10:50.837Z","resourceId": "fs-01f0d526165b57f95","resourceType": "AWS::EFS::FileSystem","title": "Template under ConfigDrift-EC2-Dedup4","description": "Configuration Drift Detected.","category": "Security","severity": "3","origination": "EventBridge Rule - ConfigDrift-EC2-Dedup","detail-type": "Config Configuration Item Change","source": "aws.config","time": "2022-03-16T01:10:51Z","region": "us-east-1","resources": "arn:aws:elasticfilesystem:us-east-1:123456789012:file-system/fs-01f0d526165b57f95","messageType": "ConfigurationItemChangeNotification","notificationCreationTime": "2022-03-16T01:10:51.976Z","operationalData": {"/aws/dedup": {"type": "SearchableString","value": "{"dedupString":"ConfigurationItemChangeNotification"}"}}}FollowComment"


Question: Unauthenticated MQTT devices to communicate with IoT Core though Greengrass and MQTT Bridge

I am looking to deploy an Greengrass IoT Core device with a MQTT bridge to send messages to the IoT core as an aggregation point. I can find many examples where the remote Things are authenticated with certificates but i would like to use unauthenticated MQTT devices to send in on specific topics.FollowComment

Answer: "0Hi. You can bring your own MQTT broker: https://catalog.us-east-1.prod.workshops.aws/workshops/5ecc2416-f956-4273-b729-d0d30556013f/en-US/chapter6-mqtt-broker/20-step1 . But I suggest you re-consider your plan to use unauthenticated devices. Although Mosquitto can be configured without authentication, it's still recommended: https://mosquitto.org/documentation/authentication-methods/CommentShareEXPERTGreg_Banswered 6 months ago"


Question: CDK Route 53 zone lookup brings back wrong zone ID

"We are attempt to update our IaC code base to CDK v2. Prior to that we're deploy entire stacks of our system in another test environment. One part of a stack creates a TLS certificate for use with our load balancer.var hostedZone = HostedZone.FromLookup(this, $"{config.ProductName}-dns-zone", new HostedZoneProviderProps{DomainName = config.RootDomainName});DnsValidatedCertificate certificate = new DnsValidatedCertificate(this, $"{config.ProductName}-webELBCertificate-{config.Environment}", new DnsValidatedCertificateProps{HostedZone = hostedZone,DomainName = config.AppDomainName,// Used to implement ValidationMethod = ValidationMethod.DNSValidation = CertificateValidation.FromDns(hostedZone)});For some reason, the synthesised template defines the hosted zone ID for that AWS::CloudFormation::CustomResource has something else other than the actual zone ID in that account. That causes the certificate request validation process to fail - thus the whole cdk deploy - since it cannot find the real zone to place the validation records in.If looking at the individual pending certificate requests in Certificate Manager page, they can be approved by manually pressing the [[Create records in Route 53]] button, which finds the correct zone to do so.Not sure where exactly CDK is finding this mysterious zone ID that does not belong to us?    "AppwebELBCertificatetestCertificateRequestorResource68D095F7": {      "Type": "AWS::CloudFormation::CustomResource",      "Properties": {        "ServiceToken": {          "Fn::GetAtt": [            "AppwebELBCertificatetestCertificateRequestorFunctionCFE32764",            "Arn"          ]        },        "DomainName": "root.domain",        "HostedZoneId": "NON-EXISTENT ZONE ID"      },      "UpdateReplacePolicy": "Delete",      "DeletionPolicy": "Delete",      "Metadata": {        "aws:cdk:path": "App-webELBStack-test/App-webELBCertificate-test/CertificateRequestorResource/Default"      }    }FollowComment"

Answer: 0Accepted AnswerSo apparently CDK has a file cdk.context.json that cached the (non-existent) zone ID of the old zone of the same name that was deleted a long time ago. Deleting the file allowed CDK to refresh to the new zone ID.CommentShareicelavaanswered a year ago


Question: Starting point and tutorial for simple IoT project  with Microcontroller and GSM

"Hy there,I would have expected that this is a simple task but apparently it is not: we need to create a proof of concept for a very simple IoT device. It shall control 3 digital outputs and 3 digital inputs and is connected via GSM modem. The device needs to be updatable over the air. We purchased a STM32 based evalboard with BG96 (L496G-CELL02) and a 1nce data SIM. Also we created an AWS account and run some basic PC based examples. But now we are missing a good starting point for our hardware. All ST documentation seems to be outdated, AWS is a jungle. Individually compile FreeRTOS seems too low-level.Any hints about a good starting point? Sample code? Tutorial?Best regardsHaraldFollowComment"

Answer: "0Hi Harald. ST provide the X-CUBE-AWS package for some of their evaluation boards, but unfortunately not the one you have. X-CUBE-AWS is a reference integration of FreeRTOS and AWS IoT Core features on the supported boards.I'm not aware of a reference integration for this board. Assuming I'm correct, then some software engineering will be required. I suggest the following approach:Use STM32CubeIDE to generate an example project, that includes the FreeRTOS kernel, for your board.Extend that example to add the coreMQTT, coreMqttAgent, Cellular Interface and backoffAlgorithm libraries to the project, and then get basic MQTT pubsub working with IoT Core. The MQTT Agent Demo tutorial is probably your best guide. I recommend you do it with the mutual authentication option. You can publish the state of the I/O, and potentially subscribe to a topic to receive any state change requests for the outputs.You may consider to also add the AWS IoT Device Shadow library to report the I/O state and/or to control the outputs.With the I/O handled, then you could look to add the AWS IoT Jobs and AWS IoT OTA libraries to build out OTA capability. The OTA library needs to be ported to your device using the Platform Abstraction Layer to integrate it with the underlying hardware and ST's drivers and bootloader. The OTA demo tutorial can guide you. You can also find a full OTA implementation in X-CUBE-AWS.For reference, some (deprecated but still useful) OTA ports to other microcontrollers:https://github.com/aws/amazon-freertos/tree/main/vendors/nordic/boards/nrf52840-dk/ports/ota_pal_for_awshttps://github.com/aws/amazon-freertos/tree/main/vendors/espressif/boards/ports/ota_pal_for_awshttps://github.com/aws/amazon-freertos/tree/main/vendors/ti/boards/cc3220_launchpad/ports/ota_pal_for_awsAn OTA PAL implementation for POSIX: https://github.com/aws/aws-iot-device-sdk-embedded-C/blob/main/platform/posix/ota_pal/source/ota_pal_posix.cExample implementation of the OTA OS interface for FreeRTOS: https://github.com/aws/ota-for-aws-iot-embedded-sdk/blob/main/source/portable/os/ota_os_freertos.c(Non-embedded) C-SDK and FreeRTOS demos:https://github.com/FreeRTOS/FreeRTOS/tree/main/FreeRTOS-Plus/Demohttps://github.com/aws/aws-iot-device-sdk-embedded-C/tree/main/demosUPDATE: There's also this reference integration: https://github.com/FreeRTOS/iot-reference-stm32u5 for the STM32U5. This is what's in X-CUBE-AWS 3.0. It uses FreeRTOS LTS: https://github.com/FreeRTOS/iot-reference-stm32u5/tree/main/Middleware/FreeRTOS. And uses jobs and OTA: https://github.com/FreeRTOS/iot-reference-stm32u5/tree/main/Middleware/AWS. OTA PAL here: https://github.com/FreeRTOS/iot-reference-stm32u5/tree/main/Projects/b_u585i_iot02a_ntz/Src/ota_pal.CommentShareEXPERTGreg_Banswered a month ago-1Here are a few suggestions:AWS IoT Device SDK: The AWS IoT Device SDK provides libraries in multiple programming languages to help you connect your devices to AWS IoT Core. It includes a library for C that can run on your STM32 evalboard with BG96. You can find the SDK and documentation at https://docs.aws.amazon.com/iot/latest/developerguide/sdk-c.html.AWS IoT Device Defender: AWS IoT Device Defender is a service that helps you secure your IoT fleet by continuously auditing security policies and detecting anomalies. It can also help with OTA updates. You can find more information and tutorials at https://aws.amazon.com/iot-device-defender/.AWS Greengrass: AWS Greengrass is a service that extends AWS to your devices, allowing you to run AWS Lambda functions locally on your devices. It includes OTA updates and is compatible with STM32 devices. You can find more information and tutorials at https://aws.amazon.com/greengrass/.AWS IoT 1-Click: AWS IoT 1-Click is a service that simplifies the process of triggering AWS Lambda functions from simple IoT devices like buttons or sensors. You can find more information and tutorials at https://aws.amazon.com/iot-1-click/.AWS IoT Analytics: AWS IoT Analytics is a service that provides advanced analytics for IoT data. It can help you process and analyze data from your devices, including OTA updates. You can find more information and tutorials at https://aws.amazon.com/iot-analytics/.In terms of sample code and tutorials, the AWS documentation provides many examples and step-by-step guides. You can also find tutorials and code samples on GitHub and other developer communities.CommentSharehashanswered a month agoGreg_B EXPERTa month agoThis answer has a lot of incorrect information.Share"


Question: Instructions to add another AWS account/user to my AWS account

I have the one main user account but want to add an additional user ID for my developer to use to log in and do work. How do I do this? I didn't see it when I searched.FollowComment

Answer: 2Here is a great step by step video showing "How do I set up an IAM user and sign in to the AWS Management Console using IAM credentials?"https://www.youtube.com/watch?v=wRzzBb18qUwAnd a knowledge-center article as wellhttps://aws.amazon.com/premiumsupport/knowledge-center/create-new-iam-user/CommentShareEXPERTMatt-Banswered 10 months ago0Is this what you are looking for - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 10 months ago


Question: Quicksight - Best way to shift time by timezone and assign to shift?

I have a timestream table that has timestamps in GMT. I need to do two things with this time:Shift it to my timezone.Determine what shift the timestamp happened in.It looks like there is an Excel like ifelse() statement. I have 22 different shifts to examine for. Those cascading ifelse() will get quite complicated. Is there a better way of doing this?FollowComment


Question: Mac M1 instance still not stopped after 1 hour

"i-0993d98984d969125Issued stop commandwaited 15 minutesIssued force stop commandstatus changed to "stopping"40 mins later, still stoppingFollowComment"

Answer: "0Hello,While a Mac Instance does typically take 15 minutes to stop, if you are not seeing the Mac Instance stop after 110 minutes, please submit a support ticket for our support engineers to inspect the instance.Per the documentation, there is a scrubbing workflow that takes place after stopping a Mac instance that can take up to 110 minutes on an M1 Mac instance.Relevant documentation: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-mac-instances.html#mac-instance-stopCommentShareEXPERTChris_Ganswered a year ago"


Question: EKS AWS Load Balancer Controller - ingress created but the ALB is not

"I installed AWS Load Balancer Controller through Helm.The ingress is created but the ALB is not and I am getting an error.I followed the guide below.-> https://docs.aws.amazon.com/ko_kr/eks/latest/userguide/aws-load-balancer-controller.htmlDeployment / Service - logs ERROR{"level":"error","ts":1674024616.2905765,"logger":"controller.ingress","msg":"Reconciler error","name":...,"namespace":...,"error":"UnauthorizedOperation: You are not authorized to perform this operation.\n\tstatus code: 403}ingress ERRORWarning  FailedBuildModel  19s  ingress  Failed build model due to UnauthorizedOperation: You are not authorized to perform this operation.status code: 403FollowComment"

Answer: "0At the first glance, this seems like permission error. Have You checked Your IAM policies and IAM roles if they are set up correctly?Is Your cluster in US-East or US-West region or other region (step 1.a. and 1.b. of provided link)?Is the service account created correctly (step 2. of the provided link)?Can You provide the exact helm command that You've run - without sensitive information?CommentSharemc2609answered 4 months agoari 4 months ago[Region] ap-northeast-21.a => curl -o iam_policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.4.4/docs/install/iam_policy.json1.b => aws iam create-policy --policy-name AWSLoadBalancerControllerIAMPolicy --policy-document file://iam_policy.json[Policy]AWSLoadBalancerControllerIAMPolicy=> https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.4.4/docs/install/iam_policy.jsonNode Groupd Role, Kluster Role=> EC2 Full, IAM Full, CloudFormation Full, ElasticLoadBalancing Full, EKS Full ..[Service Account]Name:                aws-load-balancer-controllerNamespace:           XXXXXXLabels:              app.kubernetes.io/managed-by=eksctlAnnotations:         eks.amazonaws.com/role-arn: arn:aws:iam::XXXXXX:role/eksctl-XXXXXX-addon-iamserviceacc-Role1-XXXXXXImage pull secrets:  <none>Mountable secrets:   <none>Tokens:              <none>Events:              <none>[Helm]$helm install aws-load-balancer-controller eks/aws-load-balancer-controller -n XXXXXX --set clusterName=XXXXXX --set serviceAccount.create=false --set serviceAccount.name=aws-load-balancer-controller --set image.repository=602401143452.dkr.ecr.ap-northeast-2.amazonaws.com/amazon/aws-load-balancer-controllerThank YouShare0Everything You provided seems correct.If the role created - eksctl-XXXXXX-addon-iamserviceacc-Role1-XXXXXX - has AWSLoadBalancerControllerIAMPolicy attached,, You can check this by running:aws iam list-attached-role-policies --role-name eksctl-XXXXXX-addon-iamserviceacc-Role1-XXXXXXIf it is attached and I believe it is, try steps mentioned in comment above by Ahmad Ul Islam.CommentSharemc2609answered 4 months agoari 4 months agoyes it is already attached...{"AttachedPolicies": [{"PolicyName": "AWSLoadBalancerControllerIAMPolicy","PolicyArn": "arn:aws:iam::XXXXXX:policy/AWSLoadBalancerControllerIAMPolicy"}]}ㅠㅠ...it's difficult ..Thank you for replying!Share0The error message "UnauthorizedOperation: You are not authorized to perform this operation. status code: 403" typically indicates that the AWS Load Balancer Controller does not have the necessary permissions to create or modify resources in your AWS account.Here are a few things you can check to troubleshoot the issue:Verify that the AWS credentials you are using to authenticate the Load Balancer Controller have the necessary permissions to create and modify resources in your AWS account.Ensure that the IAM role associated with the Load Balancer Controller has the necessary permissions to create and modify resources in your AWS account.Make sure that the Load Balancer Controller has the necessary permissions to access the resources specified in the Ingress resource.If you are using an IAM Role for Service Accounts (IRSA) for authentication, check if the role is correctly associated with the LoadBalancer controllerVerify that you are running the Load Balancer Controller in the same AWS account and region as the resources it is trying to access.Check the AWS Load Balancer Controller log for more information about the error.If you are still having issues after going through these steps, you might want to refer to the AWS Load Balancer Controller documentation or AWS Support for further assistance.CommentShareAhmad Ul Islamanswered 4 months ago0I Solved!!!!!!https://docs.aws.amazon.com/ko_kr/eks/latest/userguide/aws-load-balancer-controller.html => v2.4.4I changed v2.2.0 (curl -o iam_policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.2.0/docs/install/iam_policy.json)It works!!!!!!But I can't understand why the official website version is not available...CommentSharearianswered 4 months ago"


Question: Is Amazon Personalize relevant for non-session based activities ?

"Is Amazon Personalize relevant for non-session based activities ?Let's say for example that I have a dataset consisting of a list of products used by customers. Egcustomer 1 consumes product A, B, Ccustomer 2 consumes product A and CetcThis does not represent sessions. Is Amazon Personalize HRNN still relevant for this?FollowComment"

Answer: "0Accepted AnswerAs long as you have User-Item-Timestamp records, you should be able to create a model. Event Type will allow you to differentiate the actions the user took against the items. For example, a user ET:Applied_for_A, or a user ET:Cancelled_B.Additional information on the service are available in this GitHub Cheatsheet for Personalize.CommentShareMODERATORAWS-User-7645135answered 3 years ago"


Question: table creation on serverless deployment - RDS Aurora PostgreSQL

is it possible to create and migrate the db automatically during deployment using "serverless deploy" like when we did when create a db using sequelize db:create and db:migrate on non serverless development? Thank you very much.FollowComment