Question: What are cloud best practices for installing software on many EC2 instances that can be configured many ways?

"I have a large piece of server software (3 GB of files pre-install) that is running on an EC2. The software installs a full app server or interface server that communicates with the front-end desktop GUIs and database. The software was originally designed years ago to be installed through a visual step-by-step installer off a USB drive on premises. This installer ensures that the software is set up with proper configuration, networking, connection to the database, etc. Every client gets 1 or more EC2 instances dedicated to handle their workload.Moving into a cloud-minded paradigm, what is a better way to handle creating many servers, for many clients, all with different configurations of this software? When a server goes down, or another is needed for load, what's a "cloud" practice to spin up a new server and install the same configuration of software on this server?I have multiple ideas including:Store software files in S3 bucket and pull them to the EC2 instances as necessary. A config file for each customer will also be updated and stored on S3. The EC2 will then start the software from a PowerShell script to create proper configurations.Store the software in the AMI of EC2 exactly as configured. This means any time a server is created with a new client configuration, we create a new AMI after installation.Create a Lambda function that can handle all the different configuration parameters. When invoked, it will take care of spinning up a server, moving the software to the server, and installing the software with proper configuration.Any guidance or references to white papers would be appreciated.Thank you!FollowComment"

Answer: "0Hi - You can consider to look into the following. One from an auto scaling standpoint and one from bringing up the infrastructure.A launch template is similar to a launch configuration, in that it specifies instance configuration information. It includes the ID of the Amazon Machine Image (AMI), the instance type, a key pair, security groups, and other parameters used to launch EC2 instances. For example, you can create a launch template that defines a base configuration without an AMI or user data script. After you create your launch template, you can create a new version and add the AMI and user data that has the latest version of your application for testing . More Reference : https://docs.aws.amazon.com/autoscaling/ec2/userguide/launch-templates.htmlDeploying applications on Amazon EC2 with AWS CloudFormation - CloudFormation includes a set of helper scripts (cfn-init, cfn-signal, cfn-get-metadata, and cfn-hup) that are based on cloud-init. You call these helper scripts from your CloudFormation templates to install, configure, and update applications on Amazon EC2 instances that are in the same template. Reference : https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/deploying.applications.htmlWith the software you mentioned , yes there would some sort of script or helper to do the configurations for but above ideas may also help.You can also check Distributor, a capability of AWS Systems Manager, helps you package and publish software to AWS Systems Manager managed nodes. Reference :  https://docs.aws.amazon.com/systems-manager/latest/userguide/distributor.htmlCommentShareEXPERTAWS-User-Nitinanswered 8 months ago"


Question: Getting API Error in Ohio and N. Carolina

I am not able access my resource in two regions and I ma getting API error for emarly any operation.What is the reason?FollowComment

Answer: "0Hello!This can be caused by a few things, but primarily revolves around access denied or active event.You can check for active events by checking the Service Health Dashboard https://health.aws.amazon.com/health/homeIf it is a permissions issue it is likely IAM policy [1] or SCP related. If possible (if you have access), a good way to troubleshoot this is to go to your CloudWatch console event history. Here you may filter recent events to EventSource "ec2.amazonaws.com". The API calls from your screenshot will be listed there with their error messages. As an example, one of the API calls is likely "DescribeInstances". If this event error message is AccessDenied, consult your AWS administrator or check your user/role IAM policies and SCPs in your Organizational Unit if you are in an organization. If you are unable to view CloudTrail events either, it is likely a regional Deny policy being applied to either your IAM user/role or the OU.[1] https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html[2] https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.htmlCommentSharerePost-User-1886289answered 12 days ago"


Question: Cognito email_verified gets set to false

"I've got an interesting issue where occasionally a user is able to create an account with email and get verified with the one time passcode and then loses the email_verified prop.  I can prove this is happening with a subsequent call to our api (deconstructed auth token jwt below).  Strange thing is, later when we check in on this user we find their email_verified is set to false in the console.  Has anyone experienced this before with Cognito?FollowComment"


Question: At random times connection from ec2 machine to api gateway returns Could not create SSL/TLS secure channel

"Hi!,I post this question regarding an issue that happens to us at random times. Maybe someone experienced similar situation or can give us a clue.We have three windows ec2 running inside vpc with internet access that make requests to some public api gateways. We have noticed that at random times (the last issue was April 26 and the previous time was on April 4), all the requests made from the three instances within a range of 5 minutes failed with the message "The request was aborted: Could not create SSL/TLS secure channel"These requests happens almost every minute every day during 12 o 14 hours so it didn´t fail before or after those 5-10 minutes lapse. Its like something happening at api gateway at random times. Can it be that updating api definition with swagger file or deploying to stage may cause this issue? One of the dates matches.We use us-east-1 region and use as endpoint https://xxxxxx.execute-api.us-east-1.amazonaws.com/stagexxxThe status page doesn´t show any issues on those days for api gateway service.Thanks in advanceFollowComment"


Question: How to Make a Game Server Activate Itself?

"Hi,I am wondering if there is any way that a game server can activate itself without receiving the onStartGameSession event?The scenario I am looking at is roughly like this: I am using a 3rd part matchmaking library; This library allows the game server starts a session and wait for the players. I am planning to make the stand-by game servers create their sessions and wait until a player connects to them; At this point I want to make a call to a GameLift api like ActivateGameSession to tell the GameLift the server is activated so that it adds another game server to stand-by pool.The problem I have here is that in the documentation it is mentioned that the ActivateGameSession should be called in response to the onStartGameSession event.Is the scenario I described possible to implement with the GameLift? If it is, how could I do it? Are there any caveats?Look forward to hearing from you.Regards,AydinFollowComment"

Answer: "0Hi Aydin,It sounds like your use case is to have a holding pool of game servers ready to place matches as soon as the matchmaking library returns a match, is that correct? Have you considered using fleet auto-scaling to scale up your fleet based on utilization?Reference: https://docs.aws.amazon.com/gamelift/latest/developerguide/fleets-autoscaling.htmlCommentShareShashankJ_AWSanswered a year agoEXPERTToni_Sreviewed a year ago"


Question: AWS Connect: create queues and routing profiles

"It doesn't look like we have the ability to create queues, routing profiles for AWS connect via CFT and CDK. Is that true?  Is it possible to call createQueue, createRoutingProfile APIs from CDK to achieve this? Is it necessary to use a custom resource or can the API be called from CDK?Thanks!FollowComment"

Answer: "2Hi there!As we do not have API's available for deleting queues or routing profiles, they are not supported in CFT or CDK. You could use a custom resource to manage queues as you described, with your own logic for deletion (a rename is a good pattern).Our API's to create queues and routing profiles could be called from the stack directly, but this means the state of the resource will not be managed by CloudFormation. A Custom Resource is the suggested approach as you identified above. Happy building!CommentShareEXPERTAWS-samfredanswered 2 months ago1You can call those Create APIs in CDK as Custom Resources, https://catalog.us-east-1.prod.workshops.aws/workshops/d93fec4c-fb0f-4813-ac90-758cb5527f2f/en-US/walkthrough/typescript/sample/source-construct/custom-resourceCommentShareClarenceChoianswered 2 months ago0Is support for delete API on the roadmap? Any timeline for it?CommentSharerePost-User-2260698answered 2 months agoAWS-samfred EXPERT2 months agoHi there, you can reach out to your AWS Account team for discussions about items on the roadmap.Share0Hello,Currently creating queues and routing profile using Cloudformation or calling the API in CDK is not supported in Amazon Connect. As mentioned by you the only way to do so is using a custom resource.Also, the AWS Connect team currently has an active feature request for enabling the capability of deleting a queue/routing profile. However, there is no ETA on when this will be available. That being said, I can assure you that our team takes customer feedback very seriously and work meticulously to provide a good customer experience. Further, you could keep an eye on our what's new blog for information regarding new feature releases [1][2][3].[1] AWS Blog - https://aws.amazon.com/blogs/aws/[2] What's New with AWS : https://aws.amazon.com/about-aws/whats-new/customer-engagement/?whats-new-content.sort-by=item.additionalFields.postDateTime&whats-new-content.sort-order=desc&awsf.whats-new-products=general-products%23amazon-connect[3] Connect Announcements : https://forums.aws.amazon.com/forum.jspa?forumID=249CommentSharerePost-User-1233745answered 2 months ago"


Question: Grafana to send mqtt messages through aws iot core

"How can I send a message to my IOT device which is connected to AWS IOT core, through Grafana?I am already receiving data from my IOT device:IOT device ---> IOT core --->Amazon message rule-----> Amazon DataStream --->Amazon GRAFANAHow can I reverse this operation;Amazon Grafana---> IOT rule ---->send Mqtt message to IOT deviceFollowComment"

Answer: "0Amazon Managed Grafana is a fully managed data visualization service, and while I don't want to say it's not possible to send data from Grafana to AWS IoT devices, I think I'd like to better understand the use case.Can you describe the outcome you're looking to achieve in this scenario? What type of message would you want to source from Grafana and send to your IoT device? Is this IoT device running FreeRTOS or AWS IoT Greengrass (or using the AWS IoT SDK)?CommentShareDarren Ranswered 3 months agorePost-User-6095414 3 months agoI just want to send command to start and stop a motor , and to reset alarmsShare0Hi.Amazon Grafana---> IOT rule ---->send MqttThe rules engine would not likely be involved for downlink. More likely you would use an SDK and call the HTTP iot-data publish API. For example, with boto3: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iot-data/client/publish.htmlAmazon Managed Grafana doesn't yet support third party plugins so you, can't for example, install a button panel like this: https://grafana.com/grafana/plugins/cloudspout-button-panel/. If you would like to see this supported, please make your voice heard here: https://github.com/aws/amazon-managed-grafana-roadmap/issues. A workaround is to perhaps spin up your own Grafana in EC2 and install a button panel.It should be possible however to use AMG to send automated messages in response to alarm conditions. If an AMG alert triggers a notification on SNS, a Lambda could be used to process the SNS message and publish back to the device.CommentShareEXPERTGreg_Banswered 3 months ago"


Question: Disable/Enable APIs on AWS Codepipeline for test automation runs

"Hi,We are noticing an issue where our automated UI tests are failing on AWS Codepipeline because a table on one of our application webpages fails to load ONLY on AWS codepipeline. The same tests pass on local where the table loads without any issues. Upon investigating, it looks like the API that needs to be called for the table to load is being blocked on AWS codepipeline. Is there a way to disable/enable APIs on Codepipeline? We would greatly appreciate it if someone could please point us to the AWS settings to enable/disable APIs as it would help us further investigate and resolve this issue.Thanks,UmairFollowComment"

Answer: "0Hello Umair,Thank you for your query.Regarding your issue, can you please let me know which API call are you talking about. If this API call is for any IAM related permission, you can ALLOW/DENY it using the Code Pipeline service role from the IAM console.[] Identity and access management for AWS CodePipeline - https://docs.aws.amazon.com/codepipeline/latest/userguide/security-iam.htmlFurther, if the permission is needed at the user level, you can follow below link.[] Grant approval permissions to an IAM user in CodePipeline - https://docs.aws.amazon.com/codepipeline/latest/userguide/approvals-iam-permissions.htmlAlso, since you mentioned that the API call was for loading the table which is failing, can you please let us know if this API call is a web API call? If it is, then we do not need to make changes as suggested above regarding IAM permissions. For a web API call, I would like to mention that CodePipeline does not block web API calls. Therefore you need to check either your build or deploy stage where this API call is getting executed.Further, for troubleshooting specific to your pipeline, I would request you to please reach out to us via AWS Support case so that we can better assist you.Thank you.CommentShareSUPPORT ENGINEERAWS-User-arpitanswered 12 days ago"


Question: FreeRtos sample for STM32_L475E_IOT01A cannot establish connection

"I'm using STM32 L475E_IOT01A2 and I tried to run the sample "Connect to AWS IoT - STM32-B-L475E-IOT01A", however, it always failed to establish the connection.Actually, it always returned secureSocketStatus=-1.Actual message observed on the screen is attached below.1 535 [Tmr Svc] Waiting for 180 seconds before generating key-pair2 180541 [Tmr Svc] WiFi firmware version is: C3.5.2.7.STM3 180546 [Tmr Svc] WiFi firmware is up-to-date.4 180552 [iot_thread] [INFO ][DEMO][180552] ---------STARTING DEMO---------                          5 180560 [iot_thread] [INFO ][INIT][180559] SDK successfully initialized.6 185637 [iot_thread] [INFO ][DEMO][185637] Successfully initialized the demo. Network type for the demo: 17 185647 [iot_thread] [INFO] Creating a TLS connection to a26800ryr2bs98-ats.iot.ap-northeast-1.amazonaws.com:8883.8 185739 [iot_thread] [ERROR] Failed to establish new connection. secureSocketStatus=-1.9 185753 [iot_thread] [WARN] Connection to the broker failed. Attempting connection retry after backoff delay.10 186056 [iot_thread] [INFO] Retry attempt 2 out of maximum retry attempts 5.(I omit following message just indicating repetitions.)I think configuration for aws_clienetcredential_keys.h and aws_clientcredential.h is ok.In aws_clienetcredential_keys.h,  keyCLIENT_CERTIFICATE_PEM and keyCLIENT_PRIVATE_KEY_PEM are provided as created by CertificateConfigurator.In aws_clientcredential.h, BROKER_ENDPOINT, IOT_THING_NAME, wifi address and password are set properly.In aws_demo_config, CONFIG_CORE_MQTT_MUTUAL_AUTH_DEMO_ENABLED is defined.Further, I checked and found the problem may exist the handshake of ES_WIFI_StartClientConnection. (Observed handshake sequence is below.)Cmd:P0=0 -> ret=0,Cmd:P1=3 -> ret=0,Cmd:P2=0 -> ret=0,Cmd:P3=(remote IP address) -> ret=0,Now, ES_WIFI_STATUS & TCP_SSL_CONNECTION are ok.Cmd:P9=2 -> ret=0,Cmd:P6=1 -> ret=5, which I think means UNEXPECTED_CLOSED_SOCKETI think it leads to ecureSocketStatus=-1.I repeated many times, however, the result was always the same.Please let me know how to solve this.As I'm really a beginner, your instruction would be highly appreciated.regards,CKAdditonal Information:I downloaded latest sample module from AWS site.Also, I updated wifi firmware module(SPI_C3.5.2.7) through Inventek website.FollowComment"

Answer: "0Hi CK. I have this particular board. Yes, the WiFi socket connection is being closed unexpectedly. What have you setup in IoT Core? I suspect the issue is probably in the cloud configuration. Is the device certificate registered and activated? Do you have an IoT policy attached to it that permits connection? Could you perhaps share the policy here?I'm not clear what instructions you're following from the name "Connect to AWS IoT - STM32-B-L475E-IOT01A". Can you please paste the link?UPDATE: the logs show that a new cert/key is being auto provisioned after 180s. These values will be used in preference to the values configured in aws_clientcredential_keys.h. Therefore the device is attempting connection with a different certificate than the one that has been registered in IoT Core. Hence the failure. I tested the demo on my board - it works fine and does not do the auto provisioning by default. Please check your build settings (as detailed in the comments) and re-build your binary.CommentShareEXPERTGreg_Banswered 10 months agockpinetree 10 months agoHi, Greg_B,Thank you for your comment.I actually followed below.https://ap-northeast-1.console.aws.amazon.com/iot/home?region=ap-northeast-1#/freertos/clone/Connect_to_AWS_IoT_-_STM32-B-L475E-IOT01A/predefinedI think my device certificate is ok.I attached very simple policy as below.{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": "iot:","Resource": ""}]}If you need further information, please let me know.Thanking you,CKShareGreg_B EXPERT9 months agoThanks CK. Some asterisks are missing, but I think that might just be a re:Post formatting issue. So I think it's good.I just noticed the "Waiting for 180 seconds before generating key-pair" line in the log. This indicates developer mode provisioning is enabled (meaning you have keyprovisioningFORCE_GENERATE_NEW_KEY_PAIR set to 1). What option did you use? Option 1 or option 2 (or maybe a bit of both)? https://docs.aws.amazon.com/freertos/latest/userguide/dev-mode-key-provisioning.htmlShareckpinetree 9 months agoHi, Greg_B,I followed Option 1.I imported private key from AWS IoT and configure aws_clienetcredential_keys.h by CertificateConfigurator.Also, I checked the file: aws_dev_mode_key_provisioning.c, as below.#define keyprovisioningFORCE_GENERATE_NEW_KEY_PAIR    0I think it remains as default setting, not choosing option 2.I'm not sure why the message indicates as if option 2 is chosen.Pls let me know if any other setting is required.Regards,CKShareGreg_B EXPERT9 months agoHi CK. Please see here: https://github.com/aws/amazon-freertos/blob/747f07402a744ec839ed9950e841142408abd6b0/demos/dev_mode_key_provisioning/src/aws_dev_mode_key_provisioning.c#L1188-L1217This is why I said what I said. Can you please also check the value of pkcs11configIMPORT_PRIVATE_KEYS_SUPPORTED. It should be 1.ShareGreg_B EXPERT9 months agoBased on the logs, the code is also built with USE_OFFLOAD_SSL. This means the key and certificate are stored in the WiFi module (via PKCS11). See here: https://github.com/aws/amazon-freertos/blob/747f07402a744ec839ed9950e841142408abd6b0/demos/dev_mode_key_provisioning/src/aws_dev_mode_key_provisioning.c#L1320It should use the key and cert from aws_clientcredential_keys.h when configured. However, automatic provisioning is seemingly occurring after 180s and this overwrites the key and cert in the WiFi module. So they don't match the cert in IoT Core when you try to connect.ShareShow 3 more comments"


Question: Is it possible to maintain the shape of a pdf using textract? and translate docs with translate?

"Hi, good evening. I would like to ask if there is a way to maintain the visual structure or shape of a pdf file (whether it is a text-only file or with tables) using only the 'ocr' function of the textract service? I would need to translate large quantities of documents that are not always printed well or digitized well later. I tried to do some tests and the text extraction is very precise and using 'Translate', I would be able to speed up the work a lot. So I'd like to ask if there's a way to keep the PDF a bit integrated? Or if i can do it in a second time with some functions?second question: is it possible to translate documents in PDF or Word format with the translate service?Thanks in advance for your reply.Btw, happy new year :)FollowComment"

Answer: "0Hi,If you want to extract the structure of the document, the best way would be to use the AnalyzeDocument API, it will extract the different relations and structural element such as Table, Key Value pair, ...However if you want to only use the DetectText Apis, you will get the bounding box coordinate for each of the WORD or LINE detected, which you can use to reconstruct the document by placing the text in it's original position. (https://docs.aws.amazon.com/textract/latest/dg/how-it-works-document-layout.html the information is in Geometry) With this you will just have the text and no information regarding the Table structured or any other information that was previously in the document.Regarding your second question, Textract doesn't do document conversion, we are extracting text and structure information from the document, but we are not recreating a document similar to the one that you sent.I hope it helps.Happy New Year to you as well :)CommentShareCyprien_Danswered 5 months agorePost-User-4069813 5 months agoNot being a developer, it's a bit complicated for me. May I ask where you have to put the Json code? I thought there was a link where you put the pdf file to get the ocr. Thanks for the answer though :)Share"


Question: PermissionError: [Errno 13] Permission denied aws ec2

"I am using AWS EC2 for my final year project, and I am starting to set up Python and spark to do the big data analysis.I am following this website: Jupyter Notebooks on AWS EC2 in 15 (mostly easy) stepsWhen I did step 13 and type jupyter notebook in my terminal, I cannot access the website? And this error occurs:PermissionError: [Errno 13] Permission deniedAny idea what could be causing this?FollowComment"

Answer: 0Accepted Answerthis OS error i thinkif somewhere you were specifying path and that path have "/" infront OR you have to change the directory permission use this commandchown -R user-id:group-id /path/to/the/directorychange the permission so web server can access the directoryto check which user of your server own the ownership of web server you can try this commandps aux | grep httpd | grep -v grepCommentShareharshmanvaranswered 4 years ago


Question: Can a network load balancer front an API Gateway?

"We're an IPv6 shop using the AWS Direct Connect (Private VIF). Since API Gateway is not a dual-stack service, we need a workaround to be able to access it over the Direct Connect. We cannot use Cloudfront. Ideally, we'd like to use a Network Load Balancer (dual stack) to forward the API Gateway, but will consider any other ideas or experiences that others might have. In all instances of tutorials I've studied, it seems that the coin is flipped...in that API Gateway can contact the Network Load Balancer via execute-api endpoints. ...but we need the visa-versa. My ask here is can it be done, and if so, how?FollowComment"

Answer: "3You can place an NLB in front of a Private API. The target group for the NLB needs to be IPs and you will need to use the IP addresses that are listed in the VPC Endpoint ENIs for the Private API.CommentShareEXPERTUrianswered a year agohezron a year agoHi Uri. Thank you for your reply.  I've done just as you outlined. Private REST API (petstore) and have confirmed that I'm referencing the correct vpce within it. I have created an IP Target group with the internal IP addresses assigned to the endpoint ENIs. Once it was all wired up, it's time to test. In the web browser, when I hit the DNS for my NLB, it churns a bit then attempts to download a DMS file (Database migration?). That's progress... I'm definitely not getting through to my API tho. Am I missing something?ShareUri EXPERTa year agoYou probably need to do the TLS termination on the NLB and for that you will need to use a certificate there. Are you using it? Try it with curl -v to see what is going on.Share"


Question: AMI not found error in Terraform

"HI,I wanted to created EC2 instance in EU-WEST-1 region in Terraform. When I use official AMI  ami-0d71ea30463e0ff8d I see the below error?Error launching source instance: InvalidAMIID.NotFound: The image id '[ami-0d71ea30463e0ff8d]' does not exist.I tried different AMIs and different Regions, but error is always the same.FollowComment"

Answer: "2Accepted AnswerHi thereFrom the note I understand you wanted to created EC2 instance in EU-WEST-1 region in Terraform. When you use official AMI ami-0d71ea30463e0ff8d you see the below error? Error launching source instance: InvalidAMIID.NotFound: The image id '[ami-0d71ea30463e0ff8d]' does not exist. Please correct me if my understanding is wrong.Please note this can be cause by working in different region. Check if the AMI is in the same region where you want to create an instance.This allows you to more easily specify the type of AMI you want and have Terraform automatically use that AMI, including the option to have it automatically update the AMI in use when newer AMIs matching your criteria are available. It will also make it easier to manage using the same AMI in different regions as the AMI ID is different for each region it is copied to.Referencehttps://aws.amazon.com/premiumsupport/knowledge-center/ec2-ami-error-not-public/https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-launch-copied-ami/CommentShareNonkululekoanswered a year agoEXPERTBrettski-AWSreviewed a year ago0Hi, it fixed, it was a region problem!CommentSharemyronix88answered a year ago"


Question: www.miniaturelovers.com not working.

"computer was formatted and s-3 browser was re-installed. But sit was not to be seen. Therefore I reloaded the web site again from our back up. But site www.miniaturelovers.com is partially down. I can see few pages but majority of pages cannot be seen. Why. ? Urgent reply awaited.FollowCommentskinsman EXPERT3 months agoHi, you need to clarify a few things to get help. What's the architecture of your website?  You mention s3 but what other components?  How is content split across those components?  Which did you reload from backups?  What does formatting your compouter and reinstalling an S3 browser have to do with whether your public website was working or not?Share"

Answer: "1I saw your web pages are behind Cloudfront and maybe the pages are located in S3. If yes, you can try to setup OAC (Origin Access Control) to provide the access control from CloudFront to S3 by following links.https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/s3-website-cloudfront-error-403/If the issue is not caused by OAC, then you can check the troubleshooting suggestions: https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-troubleshoot-403-errors/CommentShareBard Lananswered 3 months ago"


Question: Windows Ec2 instance seamless domain join

"I have a AWS Managed AD directory service. I am not able to seamlessly join the Windows Ec2 instance to Domain. If i RDP into the instance and try to join the domain manually it works.I am also able to join domain by running the following  command in running EC2 instance: AWS-JoinDirectoryServiceDomain and AWS-JoinDirectoryServiceDomainHere is the error message that i am getting:Execution Summary: XXXXXXXX-XXXX-XXXX-XXX-XXXXXXXX1 out of 1 plugin processed, 0 success, 1 failed, 0 timedout, 0 skipped. The operation aws:domainJoin failed because Domain join failed with exception: Domain Join failed exit status 1.I have already confirmed all the required ports are open. Infact i have allow everything in both SG and ACL.FollowComment"

Answer: 0When you launch the EC2 instance are you choosing to join the domain? If you are using the new EC2 launch wizard you will find this option at the bottom of the screen under "Advanced details" - you get to pick which domain it will join.Opening security groups is not the right path to making this work. You MUST make sure that the EC2 has an IAM instance role that has at least the following permission:arn:aws:iam::aws:policy/AmazonSSMDirectoryServiceAccessFor example here is an IAM instance role definition in CloudFormation that grants Domain join permission and also SSM managed instance permission:EC2SsmIamRole:    Type: AWS::IAM::Role    Properties:       AssumeRolePolicyDocument:         Statement:          - Effect: Allow            Principal:              Service: [ec2.amazonaws.com]            Action: ['sts:AssumeRole']      Path: /      ManagedPolicyArns:        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore        - arn:aws:iam::aws:policy/AmazonSSMDirectoryServiceAccessCommentShareAlex_AWSanswered 10 months ago


Question: Unavailable Serverless Db Engine Mode Error

"I'm facing following issue when creating Serverless Aurora Postgres 14.5 Cluster using AWS CDK. I've also tested out different versions such as 15.2, 14.6, 14.7.Error:"The engine mode serverless you requested is currently unavailable. "self.aurora_serverless_db = rds.ServerlessCluster(            self,            "AuroraServerlessCluster",            engine=rds.DatabaseClusterEngine.aurora_postgres(version=rds.AuroraPostgresEngineVersion.VER_14_5),            vpc=self.vpc,            vpc_subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PRIVATE_ISOLATED),            default_database_name="serverless_db",            backup_retention=Duration.days(1),             deletion_protection=True,            enable_data_api=True,             parameter_group=rds.ParameterGroup.from_parameter_group_name(                 self,                "AuroraDBParameterGroup",                "default.aurora-postgresql14"              ),            scaling=rds.ServerlessScalingOptions(                auto_pause=Duration.minutes(30),                # Shutdown after minutes of inactivity to save costs                min_capacity=rds.AuroraCapacityUnit.ACU_2,                max_capacity=rds.AuroraCapacityUnit.ACU_4            ),        )All is working well with engine = rds.DatabaseClusterEngine.AURORA_POSTGRES and parameter_group ="default.aurora-postgresql10"FollowComment"

Answer: "0Accepted AnswerServerlessCluster(), I think Aurora Serverless V1 is running.With Aurora Serverless V1, only Aurora PostgreSQL 10 and 11 compatible versions can be configured.https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.relnotes.htmlTo use Aurora Postgres 14.5 compatible version, you must use Aurora Serverless V2.I think you have to force it to Aurora Serverless V2 with rds.DatabaseCluster() as described in the Issues here.https://github.com/aws/aws-cdk/issues/20197CommentShareEXPERTRiku_Kobayashianswered 9 days ago"


Question: AWS Workspaces: Problem that uploaded package doesn't appear on validation instance

"Hello,I created a new packaging instance to build a new version of my application that I want to deploy (as I always did). I used the Amazon WorkSpaces Application Manager Studio, chose my application and clicked "Update". After my changes I used "Upload". After uploading the status of my application version on "Dashboard" becomes "Upload complete". Then I started my EC2 validation instance and connected to it. In the Amazon WorkSpaces Application Manager I went to "Pending Apps" and clicked "Refresh" but my new version didn't appear. I waited now for more than 1,5 hours and it's still not visible.In my packaging instance I checked the log files but the last steps seemed to be successful:2022-05-30  07.06.51.944  Info:    Writing final package data...2022-05-30  07.06.51.944  Info:    Packaging application...2022-05-30  07.06.52.382  Info:    Writing project file "C:\Users\ADMINI~1\AppData\Local\Temp\2\EBC567BD-A637-4603-AF2C-31D1D7837E4A_15.stw"2022-05-30  07.06.52.382  Info:    Done writing project file "C:\Users\ADMINI~1\AppData\Local\Temp\2\EBC567BD-A637-4603-AF2C-31D1D7837E4A_15.stw"2022-05-30  07.06.55.415  Info:    Done patching in 4.2s2022-05-30  07.06.55.462  Info:    Successfully created package.2022-05-30  07.06.55.462  Info:    Successfully created package.For testing I created another new packaging instance, chose my application in the Amazon WorkSpaces Application Manager Studio and create "Update". I got the following error message:Failed to extract application from the specified appset. Appset file might be invalid.So what went wrong and what can I do to continue?Do you need further information to help me?Thanks a lot in advance,MichaelaFollowComment"

Answer: "0Hello Michaela! Looking at your question I believe you have done everything correctly. In WAM Studio Dashboard, the app should have been shown as "Upload Complete" and then as "Pending Testing".Please confirm that the validation instance was launched from the WAM Player AMI, in the same VPC and Public Subnet as the WAM Studio packaging instance and that it has the same role attached to it (AmazonWamAppPackaging that has the managed policy AmazonWorkSpacesApplicationManagerAdminAccess attached to it)If you still have issues I suggest to open a new support case with us and to provide the logs from WAM Studio (C:\Program Files\Amazon\WAM Studio\wamstudio.log) and WAM Player (File and Options -  Log tab - choose View Log, along with the instance ID's for each instance.References:https://docs.aws.amazon.com/wam/latest/adminguide/application_packaging.html#cant_get_appshttps://docs.aws.amazon.com/wam/latest/adminguide/iam.html#app_package_rolehttps://docs.aws.amazon.com/wam/latest/adminguide/application_log_files.htmlCommentShareSUPPORT ENGINEERFrancisco_Lanswered a year agoAWS-User-3937196 a year agoHello,I can confirm that the validation instance was launched from the WAM Player AMI, in the same VPC and Public Subnet as the WAM Studio packing instance and that it has the same role AmazonWamAppPacking attached to it .But the app never change to "Pending Testing". As a workaround I created a new application (instead of creating a new version of the existing application) and this works fine.I will then open a support case.Thanks a lot for your answer!Share"


Question: ECS and CDK: Trouble placing tasks on the correct nodes

"I have a CDK process that creates a cluster with 1 t3a.medium and 3 t3a.micro instances running.  The process creates those instances and registers them with the cluster.  I can also click on the cluster in the AWS console and see instances under the infrastructure tab.  So I know that there are instances registered with the cluster.  I can also look at instances in the CLI doing:aws ecs list-container-instances --filter "attribute:ecs.instance-type == t3a.micro" --cluster Cluster0F4AFB82-9XhtVavw8Lz1{    "containerInstanceArns": [        "arn:aws:ecs:us-east-1:xxx:container-instance/Cluster0F4AFB82-9XhtVavw8Lz1/9c016f70e7b74b09a9ece93c7d84b465",        "arn:aws:ecs:us-east-1:xxx:container-instance/Cluster0F4AFB82-9XhtVavw8Lz1/ffcbd6f70e7b74b09a9ece93c7d846754",        "arn:aws:ecs:us-east-1:xxx:container-instance/Cluster0F4AFB82-9XhtVavw8Lz1/e4ce4a7378bf42a0bcac8a2c5463e34a"    ]}Or looking at all of the instances:[cloudshell-user@ip-10-2-36-180 ~]$ aws ecs list-container-instances --cluster Cluster0F4AFB82-9XhtVavw8Lz1{    "containerInstanceArns": [        "arn:aws:ecs:us-east-1:xxx:container-instance/Cluster0F4AFB82-9XhtVavw8Lz1/60dff172513d4e609a2ad0f9f8ba6abd",        "arn:aws:ecs:us-east-1:xxx:container-instance/Cluster0F4AFB82-9XhtVavw8Lz1/ffcbd6f70e7b74b09a9ece93c7d846754",        "arn:aws:ecs:us-east-1:xxx:container-instance/Cluster0F4AFB82-9XhtVavw8Lz1/9c016f70e7b74b09a9ece93c7d84b465",        "arn:aws:ecs:us-east-1:xxx:container-instance/Cluster0F4AFB82-9XhtVavw8Lz1/e4ce4a7378bf42a0bcac8a2c5463e34a"    ]}However, when I run my tasks I get Reason: No Container Instances were found in your cluster.  for the all tasks. I do have placement constraints on the tasks I'm attempting to run on the t3a.micros.  But you can see above from the CLI  --filter AWS returns the instances that I expect.If I run ecs-cli check-attributes I get:ecs-cli check-attributes --task-def solrNode --container-instances abe6a20b4a5543a784a4ae36cfddcb1a  --cluster Cluster0F4AFB82-OaQPQblRfm8DContainer Instance                                                    Missing AttributesCluster0F4AFB82-OaQPQblRfm8D  NoneHere is my cluster code:        Cluster solrCluster = Cluster.Builder.create(this, appId("Solr:Cluster"))                .containerInsights(true)                .vpc(vpc)                .capacity(AddCapacityOptions.builder()                        .autoScalingGroupName("solr")                        .vpcSubnets(getSubnetSelection(NetworkStack.STORAGE_SUBNET))                        .minCapacity(1)                        .maxCapacity(4)                        .instanceType(settings.getInstanceType("solr.image.type"))  // settings returns t3a.medium                        .machineImage(EcsOptimizedImage.amazonLinux2())                        .updatePolicy(UpdatePolicy.rollingUpdate())                        .keyName(settings.get("ssh.key.name"))                        .blockDevices(listOf(BlockDevice.builder()                                .deviceName("/dev/xvda")                                .volume(BlockDeviceVolume.ebs(settings.getInt("solr.hdd.gb"), EbsDeviceOptions.builder()                                        .deleteOnTermination(false)                                        .volumeType(EbsDeviceVolumeType.GP2)                                        .encrypted(true)                                        .build()))                                .build()                        ))                        .build()                )                .build();        solrCluster.addCapacity(appId("Zookeeper"), AddCapacityOptions.builder()                .autoScalingGroupName("zookeeper")                .vpcSubnets(getSubnetSelection(NetworkStack.STORAGE_SUBNET))                .minCapacity(3)                .maxCapacity(3)                .instanceType(InstanceType.of(InstanceClass.T3A, InstanceSize.MICRO))                .machineImage(EcsOptimizedImage.amazonLinux2())                .updatePolicy(UpdatePolicy.rollingUpdate())                .keyName(settings.get("ssh.key.name"))                .build()        );My task is:        ContainerDefinition container = solrTask.addContainer( "Solr:Container", ContainerDefinitionOptions.builder()                .image(ContainerImage.fromRegistry("docker.io/solr:9.2"))                .containerName("Solr9")                .essential(true)                .cpu(2048)                .memoryReservationMiB(settings.getInt("solr.memory.reserve")) // returns 2048                .environment(mapOf(                        "SOLR_HEAP", settings.get("solr.jvm.max"),                        "ZK_HOST", "zoo1.solr.cloud:2181,zoo2.solr.cloud:2181,zoo3.solr.cloud:2181"                ))                .portMappings(listOf(                        portMapping(8983,8983)                ))                .ulimits(listOf(Ulimit.builder().name(UlimitName.NOFILE).softLimit(65000).hardLimit(65000).build()))                .logging(LogDriver.awsLogs(AwsLogDriverProps.builder()                        .logGroup(appLogGroup)                        .streamPrefix("solr-" + settings.getEnv() + "-")                        .build()))        container.addMountPoints(MountPoint.builder()                .sourceVolume(efsVolumeName)                .readOnly(false)                .containerPath("/opt/solr/backup")                .build());And for the other tasks                    ContainerDefinition container = pair.left.addContainer( appId("Zookeeper:Container:id"+pair.right), ContainerDefinitionOptions.builder()                            .image(ContainerImage.fromRegistry("docker.io/zookeeper:3.8"))                            .containerName("zookeeper_" + pair.right)                            .essential(true)                            .cpu(2048)                            .memoryReservationMiB(384)                            .portMappings(listOf(                                    portMapping(2181, 2181),                                    portMapping(2888, 2888),                                    portMapping(3888, 3888),                                    portMapping(8080, 8080)                            ))                            .environment(mapOf(                                    "ZOO_MY_ID", pair.right.toString(),                                    "ZOO_SERVERS", "server.1=zoo1.solr.cloud:2888:3888" +                                            " server.2=zoo2.solr.cloud:2888:3888" +                                            " server.3=zoo3.solr.cloud:2888:3888"                            ))                            .logging(LogDriver.awsLogs(AwsLogDriverProps.builder()                                    .streamPrefix("zookeeper-" + settings.getEnv())                                    .logGroup(appLogGroup)                                    .build()))                            .build()                    );                    Ec2Service service = Ec2Service.Builder.create(this, "Zookeeper:Service:" + pair.right)                            .taskDefinition(pair.left)                            .vpcSubnets(getSubnetSelection(NetworkStack.STORAGE_SUBNET))                            .placementConstraints(listOf(PlacementConstraint.memberOf("attribute:ecs.instance-type == t3a.micro")))                            .cluster(solrCluster)                            .securityGroups(listOf(storageAccessGroup))                            .cloudMapOptions(CloudMapOptions.builder()                                    .name("zoo" + pair.right)                                    .cloudMapNamespace(privateDns)                                    .dnsRecordType(DnsRecordType.A)                                    .container(container)                                    .dnsTtl(Duration.seconds(10))                                    .build())                            .build();So I clearly have instances attached to my cluster.  And those instance stats match.  And my placement constraints show that there are instances that match those as well for those services.  So why is it not working?!FollowComment"

Answer: "0Thank you for posting the query.To answer your question, we require details that are non-public information. Please open a support case with AWS using the following linkhttps://console.aws.amazon.com/support/home#/case/createCommentShareSUPPORT ENGINEERKalyan_Manswered 17 days ago"


Question: CloudShell: Unable to start the environment - CREATION_FAILED

"I am a new AWS user. This is the first time I tried starting the CloudShell. I get the following error:Unable to start the environment. To retry, refresh the browser or restart by selecting Actions, Restart AWS CloudShell. System error: Environment was in state: CREATION_FAILED. Expected environment to be in state: RUNNING. To retry, refresh the browser or restart by selecting Actions, Restart AWS CloudShell.I tried to run CloudShell while logged in as the root user as well as a non-root user with AdministratorAccess . I tried the policy simulator and it says that the user should have access to CloudShell. I tried to run CloudShell on Firefox and Chrome. I also tried changing regions but I get the same error every time.I've seen several similar posts here and none of them seem to be resolved:https://repost.aws/questions/QUe4pWoMP2TqGDW6f4CXomvA/can-not-start-cloud-shellhttps://repost.aws/questions/QUPaqlvTw2RHi7OTrPVCzLsg/cloudshell-wont-starthttps://repost.aws/questions/QUufc-elFvSvqYlbJw95RI6Q/unable-to-start-the-environment-to-retry-refresh-the-browser-or-restart-by-selecting-actions-restart-aws-cloud-shellhttps://repost.aws/questions/QUH54A371dRvej5J1G_yZogw/error-when-launching-aws-cloud-shell-unable-to-start-the-environmenthttps://repost.aws/questions/QUl4tcVsElQZGEpnJ7JaCJfw/unable-to-start-cloudshellDoes anyone know what could be causing this?FollowComment"

Answer: "2Accepted AnswerIf anyone else encounters this issue, there's nothing you can do on your end, you have to talk to AWS support. Even though this was a technical issue and I am on a basic plan that doesn't include technical support, I managed to get the issue resolved by selecting creating a case under:Service: AccountCategory: Other account issuesThe support was very helpful and I got the issue sorted out within 12 hours or so.CommentSharerePost-User-5174146answered 7 months agoJamison Tuesday 4 months agoI've tried this, and they were fast to respond, but nothing that they suggested seemed to help, it was was all of the same suggestions that I've found everywhere else unfortunately.Share0Have you created a support case to report the issue? I recommend opening the support case especially if you have a brand-new AWS account.CommentShareTaka_Manswered 7 months agorePost-User-5174146 7 months agoYes, the issue has been resolved.Share"


Question: How to get the outcome of an endpoint entered in the amazon pinpoint journey?

"I have created a dynamic segment in amazon pinpoint with criteria and it fetched the endpoints matched with the criteria and then used this segment in my journey.Journey use contact center (Amazon Connect) for delivering the msg (Voice), journey runs and endpoints/numbers start being dialed. perfect!Now I want to check/see the outcome of endpoints entered in the journey as how many endpoints/contacts dialed and what are the outcomes for every endpoint/contact e.g. status Connected when customers picked the call, status Missed when customers missed the call.Any API? or why out? can we set a variable as a metric or user attribute in a segment and then use it later for checking the outcome?FollowComment"

Answer: "0Hi,Thanks for your patience as we worked with the Pinpoint team regarding your query. You can use Journey metrics. In this page, the Contact center metrics can be found under "Activity-Level Engagement Metrics" -> "Contact Center Activity"You can also follow the documentation here in our blog post to configure Eventbridge to log Amazon Connect Contact Events and send it to a target. In the blog the Contact event is sent to the Cloudwatch but you can also configure a different target to process the log event such as a Lambda function which can further process the event.In the above blog post, please check under Step 6: Setting up Amazon EventBridge to log events in Amazon CloudWatch for tracking the calls that are handled by Amazon Connect.. You can use the campaignId as your reference when searching the events. Please check Step 9: Tracking Amazon Connect outbound calls in Amazon CloudWatch Logs for the sample events.I hope this information helps. Please let us know if you may have any other questions. We will be happy to help you.CommentShareSUPPORT ENGINEERRyan_Aanswered 9 months ago"


Question: Suspicious Billing with SageMaker

"Hi, I'm being charged up to USD 16,000 with AWS SageMaker when I'm not using anything. I keep receiving suspicious activity notification with my account. What should I do to terminate this SageMaker billing? Should I close my account?FollowComment"

Answer: "-1If you identify suspicious activity on your account, you shouldIdentify any unauthorized actions taken by the AWS Identity and Access Management (IAM) identities in your account.Identify any unauthorized access or changes to your account.Identify the creation of any unauthorized resources or IAM users.Steps to perform these activities can be found here:https://aws.amazon.com/premiumsupport/knowledge-center/potential-account-compromise/You should as well look at all the resources in your account and identify/terminate the ones that are not legitimate.AWS cost explorer can help you identify where these Sagemaker charges are and you can terminate them:https://aws.amazon.com/aws-cost-management/aws-cost-explorer/Open a case with support if you have any question. Whatever support level you currently have you can always create a Billing/account case to understand any past or upcoming charges.Once this is done, make sure you apply security best practices to protect your aws account :https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/CommentShareJean Malhaanswered 10 months ago"


Question: How to share notebooks in Redshift Editor?

"HiI would like to create a Notebook to be shared with the team.And I followed this link to configure my user with required roles: AmazonRedshiftQueryEditor and AmazonRedshiftReadOnlyAccesshttps://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-identity-based.html#redshift-policy-resources.required-permissions.query-editor-v2But, I can't add policies to this role I am using to login...Is there any other way, I can do this?thanksCKFollowComment"

Answer: "1Accepted AnswerThere are different ways to set up policies as described in this document.https://docs.aws.amazon.com/singlesignon/latest/userguide/troubleshooting.html#issue4Open the IAM Identity Center in the AWS Organizations parent account and add the policy to the permission set or follow the steps below to create a permission set.https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.htmlIf this answer leads to a resolution, please approve the answer for the betterment of the community.CommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: How to get Cognito SAML integration to sign AuthnRequest?

"I have confirmed the metadata loaded for the integration specifies<md:IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">However, the generated AuthnRequest from cognito is not signed.FollowComment"

Answer: "1Accepted AnswerHi,Cognito doesn't support AuthnRequest signing at this time. The assertion consumer endpoint for Cognito user pool doesn't change for the user pool (unless you change the user pool domain), so is the SP entity Id. These values must be per-configured in the IdP and usually if the AuthnRequest has any different values the request will be rejected by the IdP.More details on federating to SAML IdP from Cognito user pool.CommentShareEXPERTMahmoud Matoukanswered a year ago13ogrammer 9 months agoHi Mahmoud,Is "AuthnRequest signing" in the Cognito User Pool roadmap? If yes, when is it likely to be released?Cheers!Share"


Question: AWS Backup IAM Issue Error on Cloudtrail InvalidParameterValueException

"Hello,I would like to backup my instances and s3 buckets completely. I attached the needed permision for AWSBackupDefaultServiceRole role. Still there is a problem and i can not figure it out. Any guess?ROLECLOUDTRAILFollowComment"

Answer: "0Hi there,There wasn't a lot of details in your post, but I'll make a few assumptions.I tried what I think is the same thing you tried: with an on-demand backup (EC2), and also got the error the first time.  Then a few minutes later, I tried it a second time (same on-demand/EC2) and was successful.Reading in the AWS documentation (https://docs.aws.amazon.com/aws-backup/latest/devguide/iam-service-roles.html), it says under "Creating the default Service Role"... "3. Verify that you have created the AWSBackupDefaultServiceRole in your account by following these steps: a. Wait a few minutes...."It appears there is a delay the first time the role is created.Also, I noticed that after creating the role in an EC2 backup, it doesn't add the S3 permissions thereafter.  After EC2, I tried an initial S3 backup which failed.  I manually added the AWSBackupServiceRolePolicyForS3Backup (and AWS...S3Restores) policies (as you show in your screenshot), and then ran an S3 backup.  It's been running for 15 minutes, whereas the initial backup failed almost immediately.  I assume this one will be successful.Hope this helps!CommentShareRob_Elanswered 9 months ago"


Question: Amazon cognito - user attributes in ID Token

"Setting user attributes values in cognito user pool, causes those attributes to be present in the IDToken.How can I select which user attributes actually go into the ID Token? Via lambda trigger and no UI or API operation for that definition?Tks,DDFollowComment"

Answer: "1Hello,In order to stop an attribute from being present in the ID token, you need to unselect that attribute from the list of readable attributes for the app client.Please expand the "Attribute permissions and scopes" section in document [1] for reference to attribute read/write settings in an Cognito user pool app client. You need to modify the "Set attribute read and write permissions" settings (if you are using old Cognito console) or the "Edit attribute read and write permissions" settings (if you are using new Cognito console).After you unselect an attribute from this list, that attribute will no longer be present in the ID token.I believe the information is helpful to you. In case you have any further queries/concerns then please let me know.--References--[1] https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.htmlCommentShareSUPPORT ENGINEERTarit_Ganswered 6 months ago"


Question: Ec2 instance Windows server 2019 upgrade

"I performed a windows server upgrade from server 2012 r2 Standard to server 2019 standard on a EC2 instance type t2 Large and now i am unable to launch / reboot / start the instance as i get the error "The instance 'i-02fxxx' is not in a state from which it can be started". This was an in-place upgrade which suppose to have all files intact and Windows server 2019 Std (desktop experience) installed, during the upgrade the last captured screenshot showed  "Applying updates 91% completed"Instance status checks"Instance reachability check failed" ------logs ----"2022/06/04 07:32:34Z: Still waiting for meta-data accessibility...2022/06/04 07:34:24Z: Still waiting for meta-data accessibility..."any one experienced the same issue here ? any help would be greatly appreciated. thanksFollowComment"

Answer: "0Hello,I'm sorry for the frustration this must have caused.Please check out these troubleshooting guide that may helps:https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/os-upgrade-trbl.htmlhttps://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/common-messages.html#metadata-unavailableRegards,Franky ChenCommentShareFranky Chenanswered a year ago"


Question: Cloudformation Import of RDS resources modifying settings

"Hi! I'm trying to import a number of existing resources into new Cloudformation stacks. I've been able to successfully import EC2 resources, VPC resources, etc. AFAIK, one of the defining features of a CloudFormation import is that the resources are left unchanged, they're only added to the stack. It pretty much says so in the AWS Console CF Import:"During this import, you need to provide a template that describes the entire stack, including the target resources. If existing stack resources are modified in the prepared template, the import fails."The thing is, when I try to import an RDS resource, it requires me to add several parameters, such as DBInstanceClass, AllocationStorage, MasterUsername, MasterPassword, etc. Two things here:1.I've seen the CF import modify RDS settings such as MultiAZ and, more troublesome, MasterPassword, both from CLI and console.2.If no modification is done to a resource when importing it, why is it asking for a number of parameters that have already been defined for the resource? I haven't seen EC2 import do it that way; EC2 only asks you for the Instance ID, Deletion Policy and that's it.Am I doing anything wrong here? What I would like to do is to add those RDS resources without making any changes at all to them, just like I do with EC2.I know I could add the existing RDS resources to the template with the exact same settings that the resource already has and it shouldn't be a problem, but still, it doesn't look that polished to me, and I'm thinking I may be doing something wrong here.Thanks!FollowComment"


Question: Formatting Lex output String

Formatting Lex output StringI'm using the C# implementation for Lambda and my code looks like this:Step1: string response = "Hi.. I'm Jenie your virtual assistant.'\n'Test";Step2: string response = "Hi.. I'm Jenie your virtual assistant.\nTest";FollowComment

Answer: "0Hi Rakesh,Amazon Lex requires a very specific JSON output response from Lambda. Please look at the following Lex documentation to see the expected response, and make sure your C# code formats the output in a JSON format.Link: https://docs.aws.amazon.com/lex/latest/dg/lambda-input-response-format.html#using-lambda-response-formatCommentShareLukas_Aanswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: Handel custom header in AWS API Gateway  ?

"I have used API gateway to build business logic for my app that invokes lambda function. For security assurance, I have generated a VAT report of the base URL of API from my cyber security expert. A total of 9 Vulnerabilities have been detected including Four Medium, three low-level, and two informational-level vulnerabilities have been identified.(CSP) Wild Card DirectiveContent Security Policy (CSP) Header Not SetCross-Domain MisconfigurationMissing Anti-clickjacking HeaderServer Leaks Information via “X-Powered-By” HTTP Response Header Field(s)Timestamp Disclosure – UnixX-Content-Type-Options Header MissingCharset MismatchRe-examine Cache Directiveshow can remove these all Vulnerability ?is there a need to set or define custom headers? ( if yes then where and how I can do that, either be in API Gateway console  or lambda script or in my client or app side code where this API Gateway base URL is invoking ) ?FollowComment"

Answer: "1Accepted AnswerIt depends on your requirements and whether you expect the headers to be sent as part of the client request or need to add the headers before the request hits the API Gateway.If you need to block client requests if some headers are missing, you can associate a WAF ACL with the API Gateway and define rules to block requests without mandatory headersLook at these two for guidancehttps://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/waf-block-http-requests-no-user-agent/If the requirement is that the headers need to be added to the request before the request reaches the API Gateway even if the client did not send the headers, you can do so using Lambda@Edge with a Cloudfront distribution in front of your API Gateway.Look at these for guidancehttps://aws.amazon.com/blogs/networking-and-content-delivery/adding-http-security-headers-using-lambdaedge-and-amazon-cloudfront/ (this example shows response headers but you can use similar concepts to the request headers with some changes)https://docs.amazonaws.cn/en_us/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-how-it-works-tutorial.htmlSome examples of Lambda@Edge functions - https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-examples.htmlCommentShareEXPERTIndranil Banerjee AWSanswered a year ago0Lambda@Edge functions with CloudFront work fine for my scenario.I have added up one additional thing that may more the easiest way to remove security headers vulnerabilities. I have created and deployed the Express app to LambdaBy default, Express.js sends the X-Powered-By response header banner. This can be disabled using the app.disable() method:app.disable('x-powered-by')and also apply headers on the express appapp.use(function(req, res, next) {  res.header('Strict-Transport-Security', `max-age=63072000`);  res.header('Access-Control-Allow-Origin', `null`);  res.header('Referrer-Policy', `no-referrer`);  res.header('Permissions-Policy', `microphone 'none'; geolocation 'none'`);  res.header('x-frame-options', `DENY`);  res.header('Content-type', `application/json; charset=UTF-8`);  res.header('Cache-Control', `no-store`);  res.header('X-Content-Type-Options', `nosniff`);  return next();});CommentSharerePost-User-8228753answered a year ago"


Question: "Glue crawler creating a table only with 'Crawl all sub-folders' option, but not with 'Crawl new sub-folders only'"

"I have a .csv file in s3://<bucket-name>/SRC1/TBL1/2022/10/04/.Created a crawler on this bucket with the following configuration optionsCrawl new sub-folders onlyCreate a single schema for each S3 pathTable level - 3teaget data base 'sample-db'When I trigger my crawler, expectation was to create a new table 'TBL1' in 'sample-db'. But it did not create the new table.Then I updated the config option to 'Crawl all sub-folders', then the table was created.Question: Can we make crawler to create the table with option Crawl new sub-folders onlyTIAFollowComment"


Question: Inter-region BGP route failover

"I have one Global DXGW. One VIF each in us-east-1, us-east-2, eu-west-1, ap-northeast-1 and eu-central-1. I also have VPC's in each of the regions. I want to engineer the BGP routes in such a way that if us-east-1 is not available, all routes will use us-east-2. if eu-west-1 is not available, all routes will use eu-central-1is it possible to achieve this failover scenario with one global direct connect gatewayus-east-1 = primaryus-east-2 = secondaryeu-west-1 = primaryeu-central-1 = secondaryap-northeast-1 = primaryus-east-2 = secondary.FollowComment"

Answer: "0I think from your question that you have physical Direct Connect circuits in us-east-1 and us-east-2; and another pair in eu-west-1 and eu-central-1. If that's correct:Short answer: Yes, you can absolutely do this. There might be a catch though.For each pair of Direct Connect circuits, you advertise the same prefixes on both; on the secondary link you use AS-Path prepending to make it a longer path and therefore less attractive; but should the primary link fail then the secondary will be active as it is the only path available.The catch: It's not clear from the question how your on premises network is structured.Here I'm assuming you have a specific set of networks in your North America locations; and another set of networks in your European locations.If you only need the AWS North America regions to reach the North America locations and the same for Europe then you're good to go - no issues.If you have a global WAN and you want to use (say) the European connections as a backup should the two Direct Connect services in North America fail then you can do this: But you must ensure that you only select a single primary link for each on premises network. You don't want to advertise the North America networks to AWS with the same cost in Europe as you do in North America - by using a single Direct Connect Gateway it will be difficult to ensure that the North America links are preferred.To put this another way: In North America you should advertise the on premises networks to AWS as above; one primary and one secondary. In Europe you should advertise the North America networks to AWS with even more AS-Path prepending so that the North America links are preferred. The reverse is true for the European links.Again, I'm assuming quite a lot here about your network outside of AWS.CommentShareEXPERTBrettski-AWSanswered a year agoSonet a year agoThere is only one global DXGW. All the VIFs from the 4 regions are connected to the same DXGW. Same prefix is advertised from all the 4 regions. There is one data center in all the regions and one VPC in each region in AWS. There is no primary or secondary. One VIF per region. So, if us-east-1 fails, us-east-2 will become available. in North America. us-east-1 will be primary. us-east-2 secondary. In EU, eu-west-1 is primary, if it fails, eu-central-1 will become available. So I don't think this failover request can be done with one global DXGW. once you modify the route in this one global DXGW. it will affect all the routes both in the America's and Europe.Share"


Question: Broken soft keyboard on Samsung Galaxy J7 (2018)

"Dear Amazon Team,Can you please fix the "Samsung Galaxy J7 (2018)"? There is some fullscreen overlay whenever EditText gets focus and it shows this text on white screen:"Uma imagem vale mais que 1000 palavras"Please check:https://us-west-2.console.aws.amazon.com/devicefarm/home?#/projects/dc2068f7-4b09-417c-9909-b77f559c9641/runs/8d328dfd-fcef-4c36-9417-edc9e9ab22af/jobs/00002/suites/00002/tests/00000https://us-west-2.console.aws.amazon.com/devicefarm/home?#/projects/dc2068f7-4b09-417c-9909-b77f559c9641/runs/8d328dfd-fcef-4c36-9417-edc9e9ab22af/jobs/00002/suites/00002/tests/00000Thank you.Regards,DraganFollowComment"

Answer: "0Hi,The issue was resolved for the device. Please check.Thanks,ShreyansCommentSharesktdfanswered 4 years ago"


Question: My instance LightSail crash - Connexion failed on my https websites

"Hello,I had configured my instance with two website and two environment for them, everything worked and today my instance is not working anymore.http://35.181.49.244/ redirect to apache page now.Websites :https://ec2022.mozvox.com/https://www.mozvox.com/have a connexion failed.When I try to restart services with ssh :sudo /opt/bitnami/ctlscript.sh restartRestarting services..System has not been booted with systemd as init system (PID 1). Can't operate.Failed to connect to bus: Host is downWhen I try to enable sshd :sudo systemctl enable sshdCreated symlink sshd.service → (null).Failed to enable: Too many levels of symbolic links.My hard disk is not empty :df -hT /dev/xvda1Filesystem     Type  Size  Used Avail Use% Mounted on/dev/xvda1     ext4   20G  4.6G   15G  25% /What can be the problem ?Thanks for your reply.FollowComment"

Answer: "0Hello Customer,It seems like you installed an additional Apache package on top of your Bitnami image. Bitnami already includes a version of Apache, and when users manually install Apache via the OS package Manager, the Apache package will run on the same port 80 as the Bitnami image, hence the reason you are getting redirected to the Apache page. To resolve this, you would need to uninstall any additional Apache packages that are present in your system and then you can try to run the Bitnami again by using the following command: /opt/bitnami/ctlscript.sh start.Hope this Helps!CommentShareHanzla_Yanswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months agoEl Pollo 10 months agoThanks for reply but I haven't installed an additional Apache...At the time, I reinstalled all the websites... But it gave me the problem again after a while without me doing any manipulation... I still have the same problem on my new instances...I don't renew my certificates with let's encrypt because I thought it was automatic.I restart apache and it's fixed now for "connexion failed" but i had always the error :sudo /opt/bitnami/ctlscript.sh restart apachesudo /opt/bitnami/ctlscript.sh stopStoping services..System has not been booted with systemd as init system (PID 1). Can't operate.Failed to connect to bus: Host is downI can't renew my certificates...[mozvox.com] [mozvox.com] acme: error presenting token: could not start HTTPS server for challenge: listen tcp :443: bind: address already in useI don't understandShare0I do a bitnami dianostic with integrated tool :01fba2e5-d9e7-f630-3dba-5f28983213fcCommentShareEl Polloanswered 10 months ago0Hello, the error messages you are receiving when using the /opt/bitnami/ctlscript.sh script indicate that the system is not using systemd. This may mean that you installed your Bitnami application on a Linux operating system that predates systemd and uses SysVinit, or Windows Subsystem for Linux. Without visibility into your resources, I am not able to determine exactly why this is occurring. I encourage you to open a support case so that our AWS Support Engineers can investigate this and assist you further.CommentShareSUPPORT ENGINEERAWS_SamManswered 10 months ago"


Question: Cannot interact with my REST API

"I have created a REST API on Amazon API Gateway. When in my dashboard I try to click on the API I have created , in the APIs page, first the screen becomes white, and then it goes back to the APIs page, without letting me configure the API I have created.Do you know if I have to add a policy and which one eventually?FollowComment"

Answer: "0It seems like your ID might need API gateway as a trusted entity. Please try these stepsOpen the IAM console.On the navigation pane, choose Roles.Choose Create role.In the Select type of trusted entity section, choose AWS service.In the Choose a use case section, choose API Gateway.In the Select your use case section, choose API Gateway.Choose Next: Permissions. Just Click NextAdd tags (optional), and then choose Next: Review.For Role name, enter a name for your policy. For example: api-gateway-rest-apiChoose Create roleAdd role to your User ID.CommentShareAnanth Tirumanuranswered 8 months agoMatteo Sartoni 8 months agoWhat do you mean with "Add role to your User ID"? I have asked the administrator of my account and he attached the role to a Policy linked to my account, but the problem is still thereShare"


Question: Need help troubleshooting Athena/ODBC error

"I have a customer who is trying to use ODBC to connect to Athena. They have followed this documentation for "Configuring ODBC Connections on a NonWindows Machine" setup: https://s3.amazonaws.com/athena-downloads/drivers/ODBC/SimbaAthenaODBC_1.0.5/Simba+Athena+ODBC+Install+and+Configuration+Guide.pdfConnectivity works fine on macOS when AuthenticationType=IAM credentials.Have issues getting it to work with AuthenticationType=IAM Profile as suggested here https://www.simba.com/products/Athena/doc/ODBC_InstallGuide/mac/content/odbc/ath/configuring/authenticating/iamprofile.htmI have re-produced Customer setup. The following is the error that I get while using AuthenticationType=IAM Profile08S01[Simba] [DriverIAMSupport] (8600) Connection Error: No AWS profile found: defaultHas anyone come across this error ? Kindly help, thanks.FollowComment"

Answer: "0Accepted AnswerThis error occurs when the profile set in the ODBC AwsProfile keyword is missing from .aws/credentials.  In this particular case you've either set AwsProfile=default or didn't specify a profile and its its looking for the profile named default in the credentials file.You should configure the credentials in the in .aws/ credentials files according the cli documentation here.then setup or odbc.ini similar to:[ODBC Data Sources]Athena=Simba Athena ODBC Driver[Athena]Driver=/Library/simba/athenaodbc/lib/libathenaodbc_sbu.dylibAwsRegion=us-west-2S3OutputLocation=s3://query-results-bucket/testfolder-1AuthenticationType=IAM ProfileAwsProfile=someprofilenameUPDATEWhile the information above is correct, in this particular instance the issue was with Excel and the MacOS Application Sandboxes.  Microsoft Excel is Sandboxed and is unable to read the path ~/.aws/credentials to retrieve the profile credentials.   A work around is to create a .aws directory inside the Excel sandbox directory and then hard link the credentials file.  This will work around the issue and still use the original credentials file.mkdir  ~/Library/Containers/com.microsoft.Excel/Data/.awsln ~/.aws/credentials  ~/Library/Containers/com.microsoft.Excel/Data/.aws/CommentShareAWS-User-8643885answered 3 years ago"


Question: How to efficiently perform streaming of large zip files?

We have a use case where in we have to bulk download data of around 50Gbs from S3 to users' local.We have planned of using a ECS to pick up files till we fetch around 10Gbs from the source S3 and zip them and then upload that zip to another S3 bucket.We would have to perform this operation multiple times till we generate all the zips.Is there a way by which we can generate the zip of the whole data in one go?Also how do we then stream this large zip file from our destination S3 to users' local?FollowComment

Answer: "0If you create an EC2 instance with enough memory then it should be possible to copy the files onto the instance and compress them into a single file. However, if speed is the goal then parallelizing the compression of sets of the files would probably be faster and your ECS approach (perhaps with smaller chunks and more containers) would work well.If this is an ongoing process then perhaps a Lambda function could be used to compress all new files and transfer them directly?CommentShareAlex_Kanswered 3 months agorePost-User-2099128 3 months agoAlso to fetch the zip to clients' local i believe we can use S3 transfer manager of AWS SDK. But any idea around how much data can be transferred in a go using transfer manager?Share0Hi,For your question: Is there a way by which we can generate the zip of the whole data in one go?Currently there is no S3 provided functionality to do this. This must be handled via individually the objects from S3 and creating a ZIP archive. If you want to do it within the AWS Cloud, as an example, you could use Lambda (if within the timeout) or ECS or EC2 or AWS BatchFor your question: How do we then stream this large zip file from our destination S3 to users' local?It is possible to download large files from Amazon S3 using a browser by using the AWS SDKPlease refer to these articles for understanding/examples:https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/s3-browser-examples.htmlhttps://docs.aws.amazon.com/AmazonS3/latest/userguide/example_s3_Scenario_UsingLargeFiles_section.htmlThanksCommentShareRamaanswered 3 months ago"


Question: network connectivity us-west and us-east

"About 12:45 eastern time, connectivity between our servers had issues. HTTP connections started timing-out, about 4% of the time. Now (around 13:00), servers are becoming unreachable via ping, ssh, and http. Interestingly, udp seems to be working (mosh).I booted a new server, same problems.Connectivity within us-west, and us-east is a problem, as well as connectivity between them. I've had problems with connecting from outside aws as well.Connectivity seems worse on us-west.FollowComment"

Answer: "0Turns out it was the DNS SOA. register.com switched us to ztomy.com nameservers, and failed to completely switch us back. Of course it was "only sometimes". So, every 5 minutes or so, we'd get the wrong DNS resolution. So, nothing to do with AWS networking.CommentSharec2agroveranswered 3 years ago"


Question: Step Functions Local update?

"I noticed the last version of StepFunctionsLocal is 1.12.0 (~ 5 months ago) which included support for the new Intrinsic Functions.Will the service be updated to include new futures like the distributed map states?FollowCommentThabo_M SUPPORT ENGINEERa month agoWe greatly value your feedback as it is the primary catalyst for improving our services. I have noted the feature request with the service team. However,  I am unable to give you a precise timeline for when this feature will be considered or implemented. Any updates to our services can be found on our "AWS What's New" page (https://aws.amazon.com/blogs/aws/), which tracks new additions to the services.ShareEmma Moinat a month agoWould also like to know when this would be getting an update. It is getting quite out of date now. Certain things will be deprecated soon from step functions but their replacements are not even available in the local image!Share"


Question: AWS WAF CAPTCHA Customizing

Hello!I'm trying to find a way to change the default styling for the Captcha page but can not find any way to do that. Is there a way at least to change the color palette?Thank youFollowComment

Answer: "0Hi, with the Captcha action, you can add custom headers to the web request. AWS WAF prefixes your custom header names with x-amzn-waf- when it inserts them. For the CAPTCHA action, AWS WAF only applies the customization if the request passes the CAPTCHA inspection.You can refer this document https://docs.aws.amazon.com/waf/latest/developerguide/waf-captcha-how-it-works.htmlCommentSharesouravanswered a year agorePost-User-3437456 a year agoI've read this article and unfortunately I don't see any options to change CAPTCHA page styling. Are there any specific custom headers that I need to add to change styles/colors?Share0AWS Web Application Firewall customers can now use the AWS WAF Captcha JavaScript API for enhanced control over the Captcha workflowshttps://aws.amazon.com/about-aws/whats-new/2023/04/aws-waf-captcha-javascript-api-support/This will allow you to improve the Captcha customer experience by embedding Captcha problems in your existing webpagesCommentShareAWS-User-3413787answered 21 days ago"


Question: DLAMI  does not have CUDA/NVIDIA (and cannot access cuda from pytorch)

"I running on :Deep Learning AMI (Ubuntu 18.04) Version 56.0 - ami-083abc80c473f5d88, but I have tried several similar DLAMI.I am unable to access CUDA from pytorch to train my models.See here:$ apt list --installed | grep -i "nvidia"WARNING: apt does not have a stable CLI interface. Use with caution in scripts.libnvidia-compute-460-server/bionic-updates,bionic-security,now 460.106.00-0ubuntu0.18.04.2 amd64 [installed,automatic]libnvidia-container-tools/bionic,now 1.7.0-1 amd64 [installed,automatic]libnvidia-container1/bionic,now 1.7.0-1 amd64 [installed,automatic]nvidia-container-toolkit/bionic,now 1.7.0-1 amd64 [installed]nvidia-cuda-dev/bionic,now 9.1.85-3ubuntu1 amd64 [installed,automatic]nvidia-cuda-doc/bionic,now 9.1.85-3ubuntu1 all [installed,automatic]nvidia-cuda-gdb/bionic,now 9.1.85-3ubuntu1 amd64 [installed,automatic]nvidia-cuda-toolkit/bionic,now 9.1.85-3ubuntu1 amd64 [installed]nvidia-docker2/bionic,now 2.8.0-1 all [installed]nvidia-fabricmanager-450/now 450.142.00-1 amd64 [installed,upgradable to: 450.156.00-0ubuntu0.18.04.1]nvidia-opencl-dev/bionic,now 9.1.85-3ubuntu1 amd64 [installed,automatic]nvidia-profiler/bionic,now 9.1.85-3ubuntu1 amd64 [installed,automatic]nvidia-visual-profiler/bionic,now 9.1.85-3ubuntu1 amd64 [installed,automatic]And it shows I have Nvidia. However, when I run python:~$ bpythonbpython version 0.22.1 on top of Python 3.8.12 /home/ubuntu/anaconda3/envs/pytorch_p38/bin/python3.8>>> import torch.nn as nn>>> import torch>>> torch.cuda.is_available()FalseEven after I re-install nvidiasudo apt install nvidia-driver-455I get this:(pytorch_p38) ubuntu@ip-172-31-95-17:~$ nvcc --versionnvcc: NVIDIA (R) Cuda compiler driverCopyright (c) 2005-2020 NVIDIA CorporationBuilt on Mon_Oct_12_20:09:46_PDT_2020Cuda compilation tools, release 11.1, V11.1.105Build cuda_11.1.TC455_06.29190527_0(pytorch_p38) ubuntu@ip-172-31-95-17:~$ bpythonbpython version 0.22.1 on top of Python 3.8.12 /home/ubuntu/anaconda3/envs/pytorch_p38/bin/python3.8>>> import torch>>> torch.cuda.is_available()FalseDoes anyone know how to get pytorch to be able to access cuda? Any help is greatly appreciatedFollowCommentChris Pollard a year agoWhat instance type are you using?ShareNathaniel Ng a year agoWhich AMI version are you using, and are you by any chance using a g5-series instance?Share"


Question: "Python Flask: OpenCV library does not work, produces HTTP code 502 Bad Gateway when trying to compare images"

"Hello,I'm having trouble with Python OpenCV library, running on AWS Lightsail container instance.Some information:It is running on python:3.7 Docker image.Python Flask appAWS Lightsail container instanceUsing following packages: linkUses opencv-contrib-python-headless==4.5.4.60 for OpenCV.Error image: linkWhen trying to compare two images, I'm receiving HTTP status code of 502 Bad Gateway, which is very strange.Seems to work perfectly on my Windows machine locally, but on this Linux image it does not work.`from cv2 import cv2import logginglogger = logging.getLogger()def compare_two_images(image_to_compare_file, image_to_compare_against_file):# Image imports# Featureslogger.warning("image_to_compare_file " + image_to_compare_file)logger.warning("image_to_compare_against_file " + image_to_compare_against_file)sift = cv2.SIFT_create() logger.warning("SIFT created " + str(sift is None))# QueryImageimg1 = cv2.imread(image_to_compare_file, cv2.IMREAD_GRAYSCALE)   logger.warning("IMG1 read created " + str(img1 is None))# Find the key points and descriptors with SIFTkp1, desc1 = sift.detectAndCompute(img1, None)logger.warning("DETECT AND COMPUTE " + str(kp1 is None) + " " + str(desc1 is None))    img2 = cv2.imread(image_to_compare_against_file, cv2.IMREAD_GRAYSCALE)logger.warning("IMG2 read created " + str(img2 is None))kp2, desc2 = sift.detectAndCompute(img2, None)logger.warning("DETECT AND COMPUTE " + str(kp2 == None) + " " + str(desc2 is None))# BFMatcher with default paramsbf = cv2.BFMatcher()matches = bf.knnMatch(desc1, desc2, k=2)# Apply ratio testgood = []for m, n in matches:    if m.distance < 0.55 * n.distance:        good.append([m])`It crashes on kp1, desc1 = sift.detectAndCompute(img1, None) and produces 502 Bad Gateway.Then, on some other endpoints I have in my Python Flask app, it produces 503 Service Temporarily Unavailable for a very times.After that, I can see that images were deleted.Any help is appreciated.FollowCommentben-from-aws a year agoI think you accidentally submitted the question twice? See https://repost.aws/questions/QUHTcwJWsnTimBF6fduWK3Hg/python-flask-open-cv-library-does-not-work-produces-http-code-502-bad-gateway-when-trying-to-compare-imagesShare"

Answer: "0Based on the error, it seems like you ALB is unsure how to process the connection.  How is your ALB configured?While 5XX errors do appear to be commonplace for this library, I believe your issue is related to load balancer configuration more than anything.CommentShareDan_Fanswered a year agoAWS-User-4298801 a year agoTo be honest, I don't have anything configured on ALB side, using this tutorial:https://aws.amazon.com/getting-started/hands-on/serve-a-flask-app/Share"


Question: Marketplace: Need to Subscribe to Software using Java SDK

"For our automation flow I need to find and then subscribe to software in Marketplace. I would much rather find appropriate service library (something similar to AmazonCloudFormation, AmazonRDS etc). Is there such library and if not what other options to subscribe?Also I wanted to avoid managing token http requests myself, hence the use of libraries.FollowComment"

Answer: "0There is not an API available for AWS Marketplace for automating subscriptions to products today.  Since subscriptions can have costs and associated EULAs, they must be manually subscribed to by a principal with the appropriate IAM permissions to subscribe from a given account.CommentSharethat_mikeanswered 9 months ago"


Question: greengrass v2 ml component

"helloI created aws greengrass v2 ml component.I want to run the ml model on Raspberry Pi with greengrass installed.So I wrote the ml component and deployed it.The result I expect is that the ml code I wrote is executed on Raspberry Pi.This is a custom component.I referred to https://docs.aws.amazon.com/greengrass/v2/developerguide/ml-customization.html this link.But there is a problem.If I deployed the components, say that the Deploy is complete. But there's an error.Looking at the log, it seems that there is a problem opening the virtual environment(venv), or it is because the tensorflow is not downloadedI want to write a script that opens the virtual environment properly in the recipe of the component.The recipe I wrote looks like this.{"RecipeFormatVersion": "2020-01-25","ComponentName": "com.example.jamesML","ComponentVersion": "1.0.5","ComponentType": "aws.greengrass.generic","ComponentDescription": "Capstone Design james machine learning.","ComponentPublisher": "Me","ComponentConfiguration": {"DefaultConfiguration": {"accessControl": {"aws.greengrass.ipc.mqttproxy": {"com.example.jamesML:mqttproxy:1": {"policyDescription": "Allows access to publish via topic ml/dlr/image-classification.","operations": ["aws.greengrass#PublishToIoTCore"],"resources": ["ml/dlr/image-classification"]}}}}},"Manifests": [{"Platform": {"os": "linux","architecture": "arm"},"Lifecycle": {"setEnv": {"Script": "cd venv&&activate venv"},"run": {"RequiresPrivilege": "true","script": "pip install opencv-python;pip install tensorflow==2.3;python3 james.py"}},"Artifacts": [{"Uri": "s3://greengrass-sagemaker-0930/james_ml.zip","Digest": "CY6f7pUyMRrgbxbKoDMig3GWQCJ4LvKyA5xnhGWGhlY=","Algorithm": "SHA-256","Unarchive": "ZIP","Permission": {"Read": "OWNER","Execute": "NONE"}}]}],"Lifecycle": {}}Can you solve the problem here?Is this part I wrote wrong?"setEnv": {"Script": "cd venv&&activate venv"},I want to know the answer. Please. Please.This is my greengrass v2 component log (Raspberry Pi)2022-10-13T10:01:44.004Z [INFO] (pool-2-thread-28) com.example.jamesML: shell-runner-start. {scriptName=services.com.example.jamesML.lifecycle.run.script, serviceName=com.example.jamesML, currentState=STARTING, command=["pip install opencv-python;pip install tensorflow==2.3;python3 james.py"]}2022-10-13T10:01:45.326Z [INFO] (Copier) com.example.jamesML: stdout. Looking in indexes: https://pypi.org/simple, https://www.piwheels.org/simple. {scriptName=services.com.example.jamesML.lifecycle.run.script, serviceName=com.example.jamesML, currentState=RUNNING}2022-10-13T10:01:45.329Z [INFO] (Copier) com.example.jamesML: stdout. Requirement already satisfied: opencv-python in /usr/local/lib/python3.9/dist-packages (4.6.0.66). {scriptName=services.com.example.jamesML.lifecycle.run.script, serviceName=com.example.jamesML, currentState=RUNNING}2022-10-13T10:01:45.373Z [INFO] (Copier) com.example.jamesML: stdout. Requirement already satisfied: numpy>=1.14.5 in /usr/local/lib/python3.9/dist-packages (from opencv-python) (1.23.4). {scriptName=services.com.example.jamesML.lifecycle.run.script, serviceName=com.example.jamesML, currentState=RUNNING}2022-10-13T10:01:45.901Z [WARN] (Copier) com.example.jamesML: stderr. WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv. {scriptName=services.com.example.jamesML.lifecycle.run.script, serviceName=com.example.jamesML, currentState=RUNNING}2022-10-13T10:01:47.470Z [INFO] (Copier) com.example.jamesML: stdout. Looking in indexes: https://pypi.org/simple, https://www.piwheels.org/simple. {scriptName=services.com.example.jamesML.lifecycle.run.script, serviceName=com.example.jamesML, currentState=RUNNING}2022-10-13T10:01:48.909Z [WARN] (Copier) com.example.jamesML: stderr. ERROR: Could not find a version that satisfies the requirement tensorflow==2.3 (from versions: none). {scriptName=services.com.example.jamesML.lifecycle.run.script, serviceName=com.example.jamesML, currentState=RUNNING}2022-10-13T10:01:48.910Z [WARN] (Copier) com.example.jamesML: stderr. ERROR: No matching distribution found for tensorflow==2.3. {scriptName=services.com.example.jamesML.lifecycle.run.script, serviceName=com.example.jamesML, currentState=RUNNING}2022-10-13T10:01:49.161Z [WARN] (Copier) com.example.jamesML: stderr. python3: can't open file 'james.py': [Errno 2] No such file or directory. {scriptName=services.com.example.jamesML.lifecycle.run.script, serviceName=com.example.jamesML, currentState=RUNNING}2022-10-13T10:01:49.169Z [INFO] (Copier) com.example.jamesML: Run script exited. {exitCode=2, serviceName=com.example.jamesML, currentState=RUNNING}FollowComment"

Answer: "1Accepted AnswerHi,your recipe seems wrong. setenv is used to set environment variables and in your case you are creating a variable named Script with value cd venv&&activate venv. Move the cd venv&&activate venv inside the Run lifecycle script. You should also avoid using  "RequiresPrivilege": "true" and instead assign the correct permission to the the user executing the script (eg ggcuser).The fact that tensorflow is not found might be related to the fact that the virtualenv is not activated.MassimilianoCommentShareEXPERTMassimilianoAWSanswered 8 months agohyorim 8 months agoThank you for answering me!I did it as you told me.{"RecipeFormatVersion": "2020-01-25","ComponentName": "com.example.jamesML","ComponentVersion": "1.0.6","ComponentType": "aws.greengrass.generic","ComponentDescription": "Capstone Design james machine learning.","ComponentPublisher": "Me","ComponentConfiguration": {"DefaultConfiguration": {"accessControl": {"aws.greengrass.ipc.mqttproxy": {"com.example.jamesML:mqttproxy:1": {"policyDescription": "Allows access to publish via topic ml/dlr/image-classification.","operations": ["aws.greengrass#PublishToIoTCore"],"resources": ["ml/dlr/image-classification"]}}}}},"Manifests": [{"Platform": {"os": "linux","architecture": "arm"},"Lifecycle": {"run": {"script": "cd venv&&activate venv&&pip install opencv-python&&pip install tensorflow==2.3&&python3 james.py"}},"Artifacts": [{"Uri": "s3://greengrass-sagemaker-0930/james_ml.zip","Digest": "CY6f7pUyMRrgbxbKoDMig3GWQCJ4LvKyA5xnhGWGhlY=","Algorithm": "SHA-256","Unarchive": "ZIP","Permission": {"Read": "OWNER","Execute": "NONE"}}]}],"Lifecycle": {}}Is this how you told me to do it?Sharehyorim 8 months agoEven so, I have an error again.2022-10-13T12:33:21.675Z [INFO] (pool-2-thread-33) com.example.jamesML: shell-runner-start. {scriptName=services.com.example.jamesML.lifecycle.run.script, serviceName=com.example.jamesML, currentState=STARTING, command=["cd venv&&activate venv&&pip install opencv-python&&pip install tensorflow==2.3..."]}2022-10-13T12:33:21.755Z [WARN] (Copier) com.example.jamesML: stderr. sh: 1: cd: can't cd to venv. {scriptName=services.com.example.jamesML.lifecycle.run.script, serviceName=com.example.jamesML, currentState=RUNNING}2022-10-13T12:33:21.762Z [INFO] (Copier) com.example.jamesML: Run script exited. {exitCode=2, serviceName=com.example.jamesML, currentState=RUNNING}2022-10-13T12:33:23.308Z [INFO] (pool-2-thread-32) com.example.jamesML: shell-runner-start. {scriptName=services.com.example.jamesML.lifecycle.run.script, serviceName=com.example.jamesML, currentState=STARTING, command=["cd venv&&activate venv&&pip install opencv-python&&pip install tensorflow==2.3..."]}2022-10-13T12:33:23.329Z [WARN] (Copier) com.example.jamesML: stderr. sh: 1: cd: can't cd to venv. {scriptName=services.com.example.jamesML.lifecycle.run.script, serviceName=com.example.jamesML, currentState=RUNNING}2022-10-13T12:33:23.334Z [INFO] (Copier) com.example.jamesML: Run script exited. {exitCode=2, serviceName=com.example.jamesML, currentState=RUNNING}Sharehyorim 8 months ago2022-10-13T12:33:25Z [INFO] (pool-2-thread-32) com.example.jamesML: shell-runner-start. {scriptName=services.com.example.jamesML.lifecycle.run.script, serviceName=com.example.jamesML, currentState=STARTING, command=["cd venv&&activate venv&&pip install opencv-python&&pip install tensorflow==2.3..."]}2022-10-13T12:33:25.022Z [WARN] (Copier) com.example.jamesML: stderr. sh: 1: cd: can't cd to venv. {scriptName=services.com.example.jamesML.lifecycle.run.script, serviceName=com.example.jamesML, currentState=RUNNING}2022-10-13T12:33:25.026Z [INFO] (Copier) com.example.jamesML: Run script exited. {exitCode=2, serviceName=com.example.jamesML, currentState=RUNNING}This is my raspberry pie log.Could you answer this, too?I'm begging you.ShareGreg_B EXPERT8 months agoHi. What is creating the virtual environment? It seems it has not been created, hence you can't change directory into it. Typically it would be created in the Install lifecycle. Massimiliano has an example here: https://github.com/awslabs/aws-greengrass-labs-jupyterlab/blob/main/recipes/aws.greengrass.labs.jupyterlab.yamlShareMassimilianoAWS EXPERT8 months agoPlease note that to activate a virtual environment you should use . venv/bin/activate. Do not use source venv/bin/activate in a component recipe since the commands are run via /bin/sh by default which doesn't have the source command.Share"


Question: IoT Core API with Java

"Hi everyone,I am looking for information on how to disable or revoke the certificate of a thing in IoT Core and I have only found that it can be done from its API.Is it possible to modify the state of a thing from the java sdk?How can I, from java, communicate with the IoT Core API?Regards.FollowComment"

Answer: "0Hi. In general, for any given API operation, there's a matching CLI operation and matching methods in each of our SDKs. For example, for the IoT UpdateCertificate API operation:CLI: https://docs.aws.amazon.com/cli/latest/reference/iot/update-certificate.htmlPython boto3: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iot.html#IoT.Client.update_certificateJava: https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/services/iot/AWSIotClient.html#updateCertificate-com.amazonaws.services.iot.model.UpdateCertificateRequest-JS: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Iot.html#updateCertificate-propertyAnd so onYou can see all of the Java control plane methods here: https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/services/iot/AWSIot.htmlDeveloper guide: https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/home.htmlCommentShareEXPERTGreg_Banswered a year ago"


Question: my ec2 (ubuntu-20.04) instnace having abusive attack in an intermittent manner

"few days back my instance have got an abusive attack, I have taken security measures, but this time again it happend. also i don't know how automatically ssh-key removed from authorized_key file, and another key have taken place, each time my instance showing "server key refused" when trying to ssh into it using putty.any help will be appreciated.FollowComment"

Answer: "0A security best practice is to limit the CIDR that you can access port 22 on. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.htmlAlternatively, and current best practice, you can use Systems Manager Session Manager, where access is managed through IAM: https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.htmlCommentShareRodney Lesteranswered a year ago"


Question: how to push only error and warning logs to cloudwatch

"I am using awslogs to push the logs to cloudwatch log groups, how ever it is pushing everything. Is there a way where i push only error and warning messages from awslogs conf file?FollowComment"

Answer: "1If you don't have large amounts of log data, you may simply continue sending all data and filter it directly in CloudWatchs, for example via Logs Insights. This has the advantage that you don't lose any of your log data (such as Info or Debug messages) and still can query for relevant information at a later point, for example for troubleshooting.If you want to filter data at the source, you should look at alternative log drivers, for example Firelens. Firelens can also send logs to CloudWatch, but supports more advanced features such as using regular expressions.CommentShareDanielanswered 10 months ago0Hello,The awslogs agent is deprecated and will not receive any new updates. While you can continue to use it, we strongly recommend you to upgrading to the new unified CloudWatch agent.[1]In the new unified CloudWatch agent, you can consider the filter field in the logs section[2] of the CW Agent configuration to exclude logs matching a certain criteria.From [2],For example, the following excerpt of the CloudWatch agent configuration file publishes logs that are PUT and POST requests to CloudWatch Logs, but excluding logs that come from Firefox."collect_list": [   {    "file_path": "/opt/aws/amazon-cloudwatch-agent/logs/test.log",     "log_group_name": "test.log",     "log_stream_name": "test.log",    "filters": [      {        "type": "exclude",        "expression": "Firefox"      },      {        "type": "include",        "expression": "P(UT|OST)"      }    ]  },  .....][1] https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AgentReference.html[2] https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html#CloudWatch-Agent-Configuration-File-LogssectionCommentShareSUPPORT ENGINEERAshish_Kanswered 4 months ago"


Question: Migrate on-prem object storage to S3 - Snowball + DataSync

"A customer wants to move its IPV installation (with data) from on-prem to AWS.The storage layer on premise relies on their own object storage solution which has an S3 compatible API (https://docs.ceph.com/en/latest/radosgw/s3/). Now the customer wants to move 70 TB of content to AWS together with the whole IPV suite.While the compute related part has been solved (they have been in contact with IPV and sized accordingly to their needs) the migration of the data is still open. We have discussed both DataSync and SnowBall.DataSync can support on prem object store as source and keep the metadata intact and it could work for a full migration and eventually scheduled syncs until the cut-over happens, but moving 70TB takes 8-9 days with a dedicated 1Gbit/s connection. I assume he also needs to purchase a Direct Connect too to ensure this expected speed.My preferred option for this customer however would be to use SnowBall for the initial heavy bulky migration and then use DataSync to keep the data in sync later on. Does SnowBall allow to copy the on-prem object store with their metadata and move them to S3?FollowComment"

Answer: "0Accepted AnswerWith regards to moving data from an on-prem Ceph to AWS, the following are some considerations:(1) Which version / release of Ceph is this?(2) Are you trying to move data from rbd, rgw, and cephfs or just rgw?(3) You can certainly use DataSync to transfer data from rgw but having a reasonably decent connection to move 70 TB would be required if you have a timeline that needs to be met.(4) You can use Snowball Edge to transfer data from Ceph onto Snowball for the bulk migration, but it will not be able to retain the metadata if you use S3 for the data transfer (you can retain POSIX metadata if you use the File Interface/NFS though that will be quite a lot slower than using the S3 endpoint); with this method, you can use DataSync after the data has been imported into S3 to synchronize the metadata and any updates.  Note: S3 on Snowball Edge supports a subset of the S3 API/CLI, so this would need to be tested.CommentShareMODERATORAWS-User-2697939answered 3 years ago"