Question: AWS Credentials not passed in ecs task with dynamodb nodejs

"Hi,There is a weird problem statement. So I have a ECS Task attached with RoleName called MyRole . This ECS Tasks has a nodejs script which queries a dynamodb Table.Nodejs script:const AWS = require('aws-sdk');async function GetCredentials(){var docClient = new AWS.DynamoDB.DocumentClient({region: 'us-east-2'});var identifier = "test-asassa";var params3 = {  TableName: 'MyTable',  ExpressionAttributeNames: { '#var1': 'var1' },  KeyConditionExpression: '#var1 = :var1',  ExpressionAttributeValues: {    ':var1': 'ValueToBeQueried'  }}await docClient.query(params3,( () => {    })).promise().then(async (data1) => {console.log(data1);});};GetCredentials().then(data => {            console.log(data);});This code when ran simply in docker container doesnt fetch the AWS credentials from Role and errors out saying ValidationException. At same time, if I export the credentials as AWS_ACCESS_KEY_ID , AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN, the script works.Can anyone help me understand wth is going on here? How do i make sure code takes the role attached to the ECS Task?Trust relationship and all other misc are correct. The query is also correct. To reproduce this, you can create a table called "MyTable" with primary key as "var1" . Now use the same code as shared above and in the same terminal, export the AWS access keys. The code will work. Now, in any ecs task, attach iam role to the task with sufficient permissions and it will not work and error out saying ValidationException: One or more parameter values were invalid: Condition parameter type does not match schema type which is completely mis-leading error.FollowCommentAWS-User-9549462 a year agoI dont wanna use User access keys, I would prefer to use the Role CredentialsShare"

Answer: "2Accepted AnswerIt is YOUR code that is faulty.If you run as is in nodejs v16.13.2 in EC2 with instance profile, it through the exact same error.The issue with your code lies in you use both callback function in its own wired closure and somehow you then chained a promise.You should not use both callback and promise as the function signature does not match.Please clean up your code, remove unnecessary await, async, most importantly remove your callback closure and I recommend you add error handling logic otherwise it might crash your application.docClient.query(params3).promise().then((data1) => {console.log(data1);}, (err) => {    console.error((err));});You can refer how to properly use promise in AWS SDK here.Laslty, I recommend you take the time and read about Promise. Because even if you fixed the issue I pointed out, your code still won't function because you make an API call to GetCredentials() which you seem to expect returning an promise, but you failed to do so.If you expect to call GetCredentials().then(), you should do this within your GetCredentials function instead of the previous code block -return docClient.query(params3).promise();For your reference, your code should look like this (I did not fix your naming, which you should also do)const AWS = require('aws-sdk');var docClient = new AWS.DynamoDB.DocumentClient({region: 'us-east-1'});async function GetCredentials(){//var identifier = "test-asassa";var params3 = {  TableName: 'MyTable',  ExpressionAttributeNames: { '#var1': 'var1' },  KeyConditionExpression: '#var1 = :var1',  ExpressionAttributeValues: {    ':var1': 'test'  }}return docClient.query(params3).promise();};GetCredentials().then( (data) => {    console.log(data);}, (err) => {    console.error(err);});CommentShareJason_Sanswered a year ago1First of all, lets narrow down the issue. Lets understand which credentials are being picked up by the client. Run the below code snippet before you interact with DynamoDB:const sts = new AWS.STS();sts.getCallerIdentity().promise().then(data =>{    console.log(data);})CommentShareEXPERTLeeroy Hannigananswered a year ago0Did you specify the correct trust relationship for your IAM role?{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "",      "Effect": "Allow",      "Principal": {        "Service": "ecs-tasks.amazonaws.com"      },      "Action": "sts:AssumeRole"    }  ]}Also what exactly the "ValidationException" message say??CommentShareJason_Sanswered a year agoAWS-User-9549462 a year agoYes, Trust relationship is correct. Exact error isValidationException: One or more parameter values were invalid: Condition parameter type does not match schema typeDont let the error make u think that schema is wrong in query. That is not the case. You can literally copy the same query and run it and it will work. The error is mis-leading.    at Request.extractError (/backend/node_modules/aws-sdk/lib/protocol/json.js:52:27)    at Request.callListeners (/backend/node_modules/aws-sdk/lib/sequential_executor.js:106:20)    at Request.emit (/backend/node_modules/aws-sdk/lib/sequential_executor.js:78:10)    at Request.emit (/backend/node_modules/aws-sdk/lib/request.js:686:14)    at Request.transition (/backend/node_modules/aws-sdk/lib/request.js:22:10)    at AcceptorStateMachine.runTo (/backend/node_modules/aws-sdk/lib/state_machine.js:14:12)    at /backend/node_modules/aws-sdk/lib/state_machine.js:26:10    at Request.<anonymous> (/backend/node_modules/aws-sdk/lib/request.js:38:9)    at Request.<anonymous> (/backend/node_modules/aws-sdk/lib/request.js:688:12)    at Request.callListeners (/backend/node_modules/aws-sdk/lib/sequential_executor.js:116:18) {ShareJason_S a year agoUnfortunately if you keep down voting best-efforts answers that the author volunteer their time helping you with clarification questions, it's not being respectful for their time or incentivize the community.That said, if you can execute the command within the container and validate you can get the role credentials, by query the credential endpoint, it should be clear the IAM role has been successfully passed on to the task from ECS standpoint.This is also helpful to ensure the correct role is being passed on.It could either be issue with your code, or nodejs SDK if IAM role is indeed passed to ECS task.Share0That error has nothing to do with credentials. It's about DynamoDB query problem. most likely type passed in query doesn't match with type of attribute definition. E.g. in your example above you have 'ValueToBeQueried' as string, but is your var1 defined as string in table attribute definition?CommentShareA-Shevchenkoanswered a year ago"


Question: EC2 instance stuck in stopping state

"This morning our instance become unreachable. We tried a reboot, but this did not fix. When we tried to stop the instance we are now stuck in the "Stopping" state. We have tried to "Force stop" the instance but it is still not working/in the "Stopping" state.Can we please get someone to look it over and assist?Instance ID:  i-002e049393e50eae6Thank you,ThomasFollowComment"

Answer: "0Hello Thomas,I can see the Instance is running healthy since 1 month ago. Are you still having the issue?If yes, try stopping the Instance using the AWS CLI command belowaws ec2 stop-instances --instance-ids i-002e049393e50eae6Note that you can use AWS CloudShell to run AWS CLI commands via the Console. See Working with AWS CloudShellIf the issue persists, reach out to AWS Premium SupportCommentShareChibuike_Aanswered a year ago"


Question: Accessing SageMaker model after registering it

"I can easily create and version a model using SM model registry: https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-version.htmlAfter registering the model, it is also possible to access the metadata: https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-details.html but I do not understand how to programmatically access the internal of the model.For example, I would like to manually inspect the weights of the last layer of my neural network. A model that I registered last week but that I do not have available on my machine anymore.FollowComment"

Answer: "1Accepted AnswerYou can use describe_model_package to get the description of the specified model package.In the response, in ModelDataUrl  parameter you'll find the Amazon S3 path where the model artifacts, which result from model training, are stored. This path must point to a single gzip compressed tar archive (.tar.gz suffix).You can download this file and unzip it. Inside will be the model files, as output of the training.You can check this example notebook in which we show how to use Amazon SageMaker to train a Scikit-learn Random Forest model, register it in Model Registry, and run a Batch Transform Job.CommentShareEitan Selaanswered a year agomyname a year agoThis sounds great. Is there any documentation regarding the internal structure of the gzip file?Share"


Question: How do I properly format a lexicon for proper pronunciation? (Beginner)

"Hello,Trying to format a proper Lexicon pronunciation for a word. Tried transferring what was explained in AWS Polly beginner video to no avail; source: https://www.youtube.com/watch?v=B2XSU22ilmQThe word I'm trying to translate is below. The voice I am using is en-GB (Amy), however the pronunciation sounds are strictly from the perspective of: en-US.Word/Term: Mans Milias,Native Spelling: Mans Mīļais,Native Lang: Latvian,Pronunciation: Maans.mEE.yaisMy script:<lexicon version="1.0"       xmlns="http://www.w3.org/2005/01/pronunciation-lexicon"      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"       xsi:schemaLocation="http://www.w3.org/2005/01/pronunciation-lexicon         http://www.w3.org/TR/2007/CR-pronunciation-lexicon-20071212/pls.xsd"      alphabet="ipa"       xml:lang="en-US">  <lexeme>    <grapheme>Mans Milias</grapheme>    <grapheme>mans milias</grapheme>    <grapheme>MANS MILIAS</grapheme>    <phoneme>"Maans.mEE.yais</phoneme>  </lexeme></lexicon>Thanks for any assistance! Advice welcomed! Brand new user to this software.VFollowComment"

Answer: "0I was able to find the answers myself with a few hours of probing and studying.To anyone interested in the same question I will include a few links and a general explanation on how it works.Answer:Revolves around understanding the IPA  (International Phonetic Alphabet). You can understand it with tutorial videos or like myself,  just reading it. Pretty straightforward, it plays on sounds made when creating a word. And then apply the symbol matching the correct/similar sound made to create the new word.Ex:Breaking down the word(s): Mans Milias, the sounds are as follows; "Ma-nz.ME.Y-Ais"Phonetically, the symbols matching these sets of sounds are as follows; "mɑ:nz.mi:.aaɪs"When you look at the graphs/charts/examples it becomes clearer and easier to grasp. Of course, there are also a few small other, details to consider when getting into this program for the first time also.Concluding thoughts, again, I'm a complete noob when it comes to AWS Polly SSML, and its good just to read and understand the program more. Links for my success are included below.Links to my success:https://www.internationalphoneticassociation.org/sites/default/files/IPA_Kiel_2015.pdfhttps://www.londonschool.com/blog/phonetic-alphabet/https://www.google.com* <Google: "IPA symbols for [insert word sound/vowel/consonant you want to find] sound"> works wonders also.>https://docs.aws.amazon.com/polly/latest/dg/supportedtags.html* <Since you're this far, learning to edit directly via SSML is helpful also>CommentShareVaughnanswered 9 months ago"


Question: "AWS OpenSearch Service recommended JVM heap size is often set to 50% of system RAM. If JVM heap size is limited to 32GB, does that mean there is no point in using node types with more than 64GB RAM?"

"AWS OpenSearch Service recommended JVM heap size is often set to 50% of system RAM. If JVM heap size is limited to 32GB, does that mean there is no point in using machine types with more than 64GB RAM?If there is a point in having node types with +64GB (ie. 128GB) why? What is the use of the remaining 32GB for a 64GB RAM/ 96GB for a 128GB RAM after the 32GB has been committed to java heap in a node?May be we can assume that the operating system and other system tasks uses the remaining memory, but how much of that is really needed by the system tasks or OS?In a nutshell is there any relevance of having huge memory after 32GB of RAM has been committed to java heap for nodes in an OpenSearch cluster?Please assist if you can. Thanks.References:https://docs.amazonaws.cn/en_us/opensearch-service/latest/developerguide/auto-tune.htmlhttps://aws.amazon.com/blogs/big-data/understanding-the-jvmmemorypressure-metric-changes-in-amazon-opensearch-service/FollowComment"

Answer: "2Accepted Answerin general, after 64GB it is indeed makes more sense to scale out rather that up, however the extra memory is always useful as it will be used for OS cache which in turn will speed up queries if relevant segments are cached by operating system.CommentShareAlex_Tanswered 10 months agojude-aws SUPPORT ENGINEER10 months agoThanks for the feedback @Alext_T. That makes sense.Share0Hi,I'm looking for the same answer, then I found the below post on the knowledge center. I believe this can make things clear.[Why is the SysMemoryUtilization so high on my Amazon OpenSearch Service cluster?]https://aws.amazon.com/premiumsupport/knowledge-center/opensearch-high-sysmemoryutilization/Most of the memory used by OpenSearch Service is for in-memory data structures. OpenSearch Service uses off-heap buffers for efficient and fast access to files. The Java virtual machine (JVM) also requires some memory.CommentShareNguyen Huy Tananswered 5 months ago"


Question: Can an AWS RDS SQL Server Audit File be encypted with a kms key prior to upload to S3?

"Hi - I am using an RDS SQL Server and have enabled SQL Audit so the audit files can be uploaded to s3 by following this documentation:SQL Server AuditThis mentions that theThe audit log files are automatically uploaded from the DB instance to your S3 bucket.In my environment there is a policy in place however where uploads need to be encrypted with a kms key for uploads to s3 and at present the audit files are failing to be uploaded:{      "Effect": "Deny",      "Action": "s3:PutObject",      "Resource": "*",      "Condition": {        "StringNotEquals": {          "s3:x-amz-server-side-encryption": "aws:kms"        }      }}Is there a way to pass a kms key to the audit files before RDS automatically uploads the audit files to s3?FollowComment"

Answer: "0I think there's no way for RDS to automatically pass KMS key ID while uploading SQL Server Audit Logs to S3 bucket. But you can do one of the following:You can create a new S3 bucket and enable "Default Encryption" using AWS KMS with your custom KMS CMK. Then, update your S3 bucket policy to restrict uploads only from the IAM role for RDS SQL Server Audit.{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam::123456789012:role/role_name"            },            "Action": "s3:PutObject",            "Resource": "*"        }    ]}If you already have an S3 bucket, enable "Default Encryption" using AWS KMS with your custom KMS CMK. Then, update your S3 bucket policy to customize the "Resource" attribute to all key prefixes except the one used to upload the SQL Server Audit files.{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Deny",            "Principal": "*",            "Action": "s3:PutObject",            "Resource": "arn:aws:s3:::my_bucket/all_prefixes/*",            "Condition": {                "StringNotEquals": {                    "s3:x-amz-server-side-encryption": "aws:kms"                }            }        },        {            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam::123456789012:role/role_name"            },            "Action": "s3:PutObject",            "Resource": "arn:aws:s3:::my_bucket/rds_log_prefix/*"        }    ]}I hope that helps.CommentShareHossam ELMansyanswered 2 years ago"


Question: Can App Runner support an architecture where one system depends on many systems?

"Background is that I am aiming:to hypothetically work with 10+ servers/backend API systems that have high traffictowards as serverless as possiblefor container-based solutions (for reasons of moving systems)where (hypothetically) one of those backend systems depends on the other 10+ systems/services.I looked at many different AWS solutions such as Elastic Beanstalk, ECS with Fargate, and App Runner. From what I read, Elastic Beanstalk doesn’t work well with an architecture topology with many dependencies between systems.Question: Can App Runner be used in a situation where you have a private API system that depends on many other API systems as described above?An excellent related AWS video: AWS re:Invent 2022 - A close look at AWS Fargate and AWS App Runner CON406FollowComment"

Answer: "1Accepted AnswerHi @FinneyCanHelp,You can very well use App Runner for this usecase, there is no direct way of defining dependencies between services both in ECS or App Runner. But you can use environment variables to specify the downstream/dependent URL's which can get used by the source service to invoke these services.The team has recently introduced support for private services that allows you to keep the service private and route the traffic within VPC, please refer to these blogs for more details:Inbound private servicesOutput privateLet us know if you have any further questions regarding this. ThanksCommentShareHarianswered 5 months agoFinneyCanHelp 5 months agoThank you for your thorough and thoughtful response. If I have further questions, I will do as you suggest. Thanks so much!Share0Hi, @FinneyCanHelp.I think you can use App Runner.First, Elastic Beanstalk is not an option if you want to go serverless.You can also adopt App Runner with ECS on Fargate.App Runner is more AWS managed than ECS on Fargate. And it's easy to get started.This is also mentioned in session CON406.However, you may face limitations if you want to achieve complex requirements.App Runner is essentially a public service that runs outside of your VPC.Therefore, I think that I will make full use of VPC Connector and VPC Endpoint to access private APIs.I think ECS on Fargate is a good choice if you want to manage flexible orchestrations and microservices, or if you have a lot of traffic and want control over autoscaling and his WAF.CommentShareEXPERTiwasaanswered 5 months ago"


Question: DataSync Task unavailable : mount.nfs: access denied by server while mounting

"I am consistently unable to start a Datasync task to transfer from a local NAS (Synology) to s3.Tried dozen of times with slight changes, NFS versions, squash options, agent reboot, etc... with no success.The tasks all have the unavailable status, with an error message "mount.nfs: access denied by server while mounting..."Setup:DataSync agent running as a KVM VM on ubuntu 20.04 LTSDataSync agent connectedNFS share on a Synology NAS on the local networkNFS share permissions provided for the agent IP (and even for the local network)DataSync agent connectivity and NFS connectivity tests are all successfulmounting the NFS share on ubuntu 20.04 LTS works perfectlyCould you please help? What is going on?FollowComment"

Answer: "0DataSync mounts NFS servers as the root user (UID and GID = 0).  It is recommended to enable no_root_squash on your NFS server to avoid permission issues.  Relevant links:https://docs.aws.amazon.com/datasync/latest/userguide/create-nfs-location.htmlhttps://docs.aws.amazon.com/datasync/latest/userguide/troubleshooting-datasync.html#onpremise-location-stuck-mountingCommentShareJeff_Banswered a year ago0SOLVED!FYI the issue was a combination of factors in the NFS share permissions, this config finally worked:you have to allow the DataSync agent host IP, not the agent VM IPnon privileged ports (>1024) are necessary for the DataSync agent (although not necessary for ubuntu clients)Squash : no mappingSynology NAS NFS permissions behave strangely if there are IP overlaps accross permissions, avoid overlapsCommentShareAWS-User-1619863answered a year ago0Hi there,I am trying the same scenario. Thanks for the configuration tips on Synology DSM. But I am still missing something.Still getting the error "mount.nfs: access denied by server while mounting"Please, any other relevant configuration on DSM or DataSync Agent to access the mounted shared folder in Synology?CommentSharerePost-User-8636071answered 21 days ago"


Question: Elastic scale and auto-deploy

"Hello folks, I have been a AWS EC2 user for some time and looking for some guidance on a large project that I am embarking on. I am looking to deploy a cluster of few 100s of EC2 instances within a VPC, where each instance will be created off a private image with all the software that I need is already available. The part that I am seeking help on is - how to start application automatically as soon as the instance is created. Are there any tools that can help with such deployment? Any pointers, documentation or a link to it would be immensely helpful.I am looking to avoid EKS and any other Kubernetes based options at this stage.Thanks for your time on my question above.FollowComment"

Answer: "2Accepted AnswerThere are many options available here but ultimately depends on how you plan to deploy the instances, eg will you use Infrastructure as code using cloudformation/terraform or some other method. All methods  support using a userdata script to run commands for your bootstrap.If using cloudformation I recommend using cfn-init to bootstrap your instances as this offers a well defined structure to the bootstrapAnother important consideration is signalling that your instances are ready within your bootstrap. You should use cfn-signal if using cloudformation or lifecycle hooks within autoscale groups so you can be sure your bootstrap has completed successfully and the instance is ready for serviceCommentShareEXPERTPeter_Ganswered a year agowildnez a year agoThank you @Peter_GShare"


Question: How to change RDS T2 to unlimited

"I would like to change my RDS t2 instance of my website to unlimited mode, but could not find any instructions on how to do it. I was able to find this link for EC2 but it does not seem to apply to RDS: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/burstable-performance-instances-how-to.html#modify-burstable-performance-instancesFollowComment"

Answer: "1HelloAmazon RDS T4g and T3 DB instances run in Unlimited mode, which means that you will be charged if your average CPU utilization over a rolling 24-hour period exceeds the baseline of the instance. CPU Credits are charged at $0.075 per vCPU-Hour. The CPU Credit pricing is the same for all T4g and T3 instance sizes across all regions and is not covered by Reserved Instances.Check information here https://aws.amazon.com/rds/mysql/pricing/ThanksCommentShareGKanswered a year ago"


Question: SES Templates do not support specific resources or conditions

"Hello AWS Community,I am setting up IAM permissions to isolate each developer's stack in my organization. However, shared resources are problematic when it comes to applying the least-privilege access principle.I want to delegate SES template management to the developers of the team. This means each developer has a CloudFormation stack with email templates and I need to prevent a developer from interacting with templates which he/she does not own.According to  https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonses.html , this is impossible. The only possible resource for the action ses:UpdateTemplate is "*" and no condition is supported. This means that an attacker using a developer's credentials could update a template used in production and insert malicious content. This seems like a huge security oversight from Amazon.Is it not possible to delegate SES template management in a secure way or am I missing something?Looking forward to your answers,Thank you!Edited by: ArielGadboisRoy on Apr 9, 2021 1:11 PMFollowComment"

Answer: "0The answer is to use the SES v2 API, because it supports template resources in IAM policies.https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsimpleemailservicev2.htmlCommentShareArielGadboisRoyanswered 2 years ago"


Question: NLB stops responding on one IP

"Hi everyone,We've seen this happen a couple of times now.  I was wondering if anyone has insights on why this happens, and/or what we can do to prevent or fix it.Basically, One of the IPs in the network loadbalancer stops responding.   We check to make sure the IPs didn't change in DNS or there was another DNS caching issue.   I can see no errors or warnings in the target group settings or NLB settings....$ dig NV-SFTP-LB-489fe716f98a2088.elb.us-east-1.amazonaws.com @ns-1286.awsdns-32.org.; <<>> DiG 9.11.3-1ubuntu1.13-Ubuntu <<>> NV-SFTP-LB-489fe716f98a2088.elb.us-east-1.amazonaws.com @ns-1286.awsdns-32.org.;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50240;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 4, ADDITIONAL: 1;; WARNING: recursion requested but not available;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 4096;; QUESTION SECTION:;NV-SFTP-LB-489fe716f98a2088.elb.us-east-1.amazonaws.com. IN A;; ANSWER SECTION:NV-SFTP-LB-489fe716f98a2088.elb.us-east-1.amazonaws.com. 60 IN A 172.16.1.85NV-SFTP-LB-489fe716f98a2088.elb.us-east-1.amazonaws.com. 60 IN A 172.16.0.212But, 172.16.1.85 is not responding while 172.16.0.212 does:$ telnet 172.16.1.85 22Trying 172.16.1.85...telnet: Unable to connect to remote host: Connection timed out$ telnet 172.16.0.212 22Trying 172.16.0.212...Connected to 172.16.0.212.Escape character is '^]'.SSH-2.0-srtSSHServer_11.00Edited by: dh42 on Feb 15, 2021 9:36 AMEdited by: dh42 on Feb 15, 2021 12:08 PMFollowComment"

Answer: "0Accepted AnswerHello,As you are not able to connect to one of the NLB IP for this NLB, I would request you check that there should be backend target present in the same AZ as of this NLB node then only the connection will be successful.If you only have one target then make sure that NLB attribute cross-zone is enable for this NLB, so that both node can connect to the same target. If there is target present for the NLB node than only we can connect to that NLB node.[] Network Load Balancers - Availability Zones - https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html#availability-zones"After you enable an Availability Zone, the load balancer starts routing requests to the registered targets in that Availability Zone. Your load balancer is most effective if you ensure that each enabled Availability Zone has at least one registered target."ThanksCommentShareSUPPORT ENGINEERAWS-User-7728313answered 2 years ago0Thanks.  For this particular scenario, we have 1 target behind the NLB, but the NLB is provisioned to multiple AZs.   Enabling the cross-zone feature on the NLB allows this to work again.CommentSharedh42answered 2 years ago"


Question: Does enabling open tracking in deliverability dashboard manager change domain settings?

"Hello team, I went to ‘Virtual Deliverability Manager’ in the AWS Console, and it is asking me to “Turn on engagement tracking” at the account level. We have Click tracking and Open tracking enabled already.  Does ‘Virtual Deliverability Manager’ change anything with our current set-up if we choose the “Turn on” or “Turn off” options?FollowComment"

Answer: "0Hi.We have Click tracking and Open tracking enabled already.Do you use Configuration Set ?If you use Configuration Set to set some tracking, so you can overwrite Virtual Deliverability Manager Setting using Configuration Set.It does not affect existing settings.https://docs.aws.amazon.com/ses/latest/dg/vdm-settings.htmlCommentShareEXPERTiwasaanswered 6 months agoAWS-User-8949122 5 months agoCan you provide more details? For example, how would VDM work in the context of a custom Configuration Set? And what about for a Configuration Set that already includes tracked links?Share"


Question: Route 53 cname entries not working

"I have a domain in route 53 for my organization.  It's a new domain and uses WorkMail successfully.  However, I would like to set up two redirects, one for www.xxx.xyx to redirect to my old web domain and pages, and another call webmail.xxx.xyz to redirect to the webmail application in WorkMail.When I make the changes, they don't seem to be propagating or be useable at all.  Some of the cname entries have been in there more than 72 hours, but yet when I call up the domain using the web service nslookup.io none of the cname entries appear.  The NS records for the domain are set to:NS recordsName serverRevalidate inns-115.awsdns-14.com.48hns-1240.awsdns-27.org.48hns-2041.awsdns-63.co.uk.48hns-731.awsdns-27.net.48hSo the AWS DNS servers are the master for the domain.   What could be happening here?  What have I missed?  I have not had this issue with other services, particularly the service I'm moving from.FollowComment"

Answer: "0Private zones will not be resolvable over the internet. Are you running public,private zone or split horizon where you have the same domain as private and public?The records need to be in a public zone for internet resolution.Also the record the cname points too also has to be resolvable over the internet if this is being tested externally.You can't do a "redirect" with a cname, its only an alias to another dns records. The webserver would have to have the HOST set to be that of the requested HTTP Domain being requested by the browser.Its not clear if the Zones and the A records the CNAME resolves to are internal or external (Public) domainsCommentShareGary Mcleananswered 3 months agoNorm 3 months agoThis is configured as a public zone so should be available outside to the Internet.ShareGary Mclean 3 months agoAnd the A records the CNAME point too are also in a public zone?Share"


Question: CpuUtilization target for AWS CDK QueueProcessingFargateService

"Dear colleagues,I've created SQS processing service using QueueProcessingFargateService.I can adjust scaling using scalingSteps? based on information from SQS ApproximateNumberOfMessagesVisibleHowever, according to what I can see CpuUtilization target is set to 50% by default.My processing is very CPU consuming and it is totally OK to run it on 100% load.Unfortunately I can't find the way for changing CpuUtilization target from 50% to 100%.This cause permanent scale up to maxScalingCapacity.Would appreciate any ideas.FollowComment"

Answer: "0For some reason, QueueProcessingFargateService sets CPU scaling targets as well as queue processing targets.I had the same situation and the solution was to delete the corresponding alarms in CloudWatch manually. Go to CloudWatch -> All Alarms and find the one for your service.There is a bug report for this in GitHub: https://github.com/aws/aws-cdk/issues/20706 so this will hopefully be fixed soon.CommentShareKnutanswered 10 months ago"


Question: Redshift serverless data api sql calls

"Hi,I am new to Redshift serverless and working on a Lambda function to connect to serverless database using Python redshift Data API and execute bunch of SQL and stored procedures that are stored in a Nexus repository artifact. I am seeing errors when I try to execute SQL statements read from a file as a string. Here is an example of a DDL from one of the scripts.-- Table Definitions-- test1 -----------------------DROP TABLE IF EXISTS test1;CREATE TABLE test1 (id varchar(32),name varchar(64) DEFAULT NULL,grade varchar(64) DEFAULT NULL,zip varchar(5) DEFAULT NULL-- test2 --------------------------DROP TABLE IF EXISTS test2;CREATE TABLE test2(id varchar(32),user_id varchar(32) DEFAULT NULL,hnum varchar(6),ts_created timestamp DEFAULT NULL,ts_updated timestamp DEFAULT NULL-- and few other tables in the same scriptThe function runs fine if I hard code the sql query in the code and I don't see any syntax or other errors with the sql file contents since I could run those using Redshift query editor by manually copy n pasting all the DDLs.Am I missing anything or using data API is not the right approach for this use case?Error and Traceback from the lambda function execution:During handling of the above exception, another exception occurred:Traceback (most recent call last):File "/var/runtime/bootstrap.py", line 60, in <module>main()File "/var/runtime/bootstrap.py", line 57, in mainawslambdaricmain.main([os.environ["LAMBDA_TASK_ROOT"], os.environ["_HANDLER"]])File "/var/runtime/awslambdaric/main.py", line 21, in mainbootstrap.run(app_root, handler, lambda_runtime_api_addr)File "/var/runtime/awslambdaric/bootstrap.py", line 405, in runhandle_event_request(File "/var/runtime/awslambdaric/bootstrap.py", line 165, in handle_event_requestxray_fault = make_xray_fault(etype.name, str(value), os.getcwd(), tb_tuples)FileNotFoundError: [Errno 2] No such file or directoryFollowComment"

Answer: "0Hello,Thank you for writing on re:PostKindly know that “FileNotFoundError” error could be caused due to the following reasons:The path of .SQL files in Nexus repository is not correct.It could also be due to a python module missing that the function is trying to connect.Also, if you are using Boto3, Python SDK, please note that the "execute_statement" API, which helps to run SQL statement, is not yet supported with Boto3 for Redshift-Serverless. So, we would recommend connecting to Redshift Serverless cluster, from Lambda, using redshift-connector.The Amazon Redshift Connector module in python can help in connecting to Redshift-Serverless cluster and it also easily integrates with pandas and numpy. The connector supports numerous Amazon Redshift specific features that helps you get the most out of your data.Kindly find below the steps to make the connection to cluster using Redshift Connector:In order to connect to Redshift Serverless, from a Lambda Function, you would first require to add the Redshift connector and the AWSDataWrangler-Python39 layers for the AWS Lambda Function as the Redshift Connector module is not an in-built module.Required Layers:a) Redshift Connector : This has to be downloaded in the form of a zip file and added as a layer.  You can download the zip file from the following GitHub page: https://github.com/aws/amazon-redshift-python-driverb) AWSDataWrangler-Python39 which is an AWS layer (a layer from a list of layers provided by AWS). Data Wrangler is built on top of other open-source projects like pandas, apache, arrow and boto3, it offers abstracted functions to execute usual ETL tasks like load/unload data from Data Lakes, Data Warehouse and Databases.Below is a sample code to connect to Redshift Serverless using a python script in AWS Lambda Service.import redshift_connectordef lambda_handler(event, context):conn = redshift_connector.connect(     host='HOST_NAME', database='DATABASE_NAME',     user='DATABASE_USER',     SecretArn: '',     port=5439)cursor=conn.cursor()cursor.execute("YOUR SQL STATEMENT")result: tuple = cursor.fetchall()print(result)Note: HOST_NAME in the format : workgroup-name.account-ID.region.redshift-serverless.amazonaws.com  . Also, please note that this sample code has been shared on a best-effort basis and we would request that you test the code thoroughly before deploying to your production environment, if you decide to use this code snippet.Kindly try the above suggestions. Hope they will improve your experience. However, if the issue persists and you would like us to investigate the issue further then please create a technical support case with Amazon RedShift team or AWS Lambda team.In order to open a Technical Support Case, you will need to have a Developer, Business or Enterprise Support Plan. If you do not have a Support Plan in place, please kindly visit the link provided below on how to sign up for one: https://aws.amazon.com/premiumsupport/knowledge-center/sign-up-support/CommentShareArbaaz_Kanswered 6 months ago"


Question: SES Email identity not verifying after verifying the Domain identity

"First, I have verified the domain identity called example.com with DKIM authenticity and sign length (RSA_2048_BIT) in the Mumbai region. Then I raised a support case for production access to SE by remove from the out of the sandbox. The support team helped us to give production accessThen, I move forward to verify the Email identity called test@example.com. Email identity verification is getting failed with the error "Unverified - To verify this email address, open the verification email from no-reply-aws@amazon.com and select the verification link"Why do I need to verify by mail inbox ? I have verified my main domain example.comFollowComment"

Answer: "0Hello,There could be multiple reasons for email verification failures. It is difficult to troubleshoot without sharing more specific details.I recommend you follow this troubleshooting guide first: https://docs.aws.amazon.com/ses/latest/dg/troubleshoot-verification.htmlIf the problem persists, please open a support case with AWS Support. This way, you can securely share information about the domain and problem details.CommentShareFadi Almasrianswered 10 months agoDaniyal-Faseeh 4 months agoAlready taking help from them for last 14 days but the issue was not resolved. Maybe the issue is the region as my all clients are in Bahrain region and my SES is in N.Virgenia.Share"


Question: Check which ebextensions have run

"I'm trying to check which ebextensions have run because there is an oddity where I see a logrotate conf file created but the contents are not what I've written.Does anyone know which log file I can find that information in? I've tried /var/log/eb-engine.log but that doesn't seem to have anything about running ebextensions.EDIT: These two logs do not exist either: /var/log/eb-activity.log, /var/log/eb-commandprocessor.log.Thanks,JamesPlatform: Ruby 2.6 running on 64bit Amazon Linux 2/3.0.3Edited by: JSmith on Aug 11, 2020 7:58 AMFollowComment"

Answer: 0The commands are listed in /var/log/cfn-init.logCommentShareAWS-James-1034055answered 3 years ago


Question: Price difference between DynamoDB and MongoDB for Video on Demand App

My developer wants to use MongoDB as a Database for my Video on Demand App. We are startup and trying to save money. My question is: would it be a big difference in price compare to DynamoDB? Does the Database for Video on Demand apps need much resourses?  What would you suggest?FollowComment

Answer: "0The main costs for video storage will not be MongoDB or DynamoDB. In a typical AWS VOD workflow, video is encoded and stored in S3 (Pricing: https://aws.amazon.com/s3/pricing/) while only lightweight metadata about the video is stored in a database. When looking up metadata about a video, you typically have a key and DynamoDB excels at key-value lookups. Also, DynamoDB is serverless, so you only pay for what you use. With a MongoDB, you will pay monthly regardless of how much data or traffic it handles and unless using Atlas, you'll have to manage the EC2 instance, patching, etc. which is an operational cost to keep in mind.AWS provides solution architectures that help jumpstart your VOD project, so you can follow best practices automatically and simply focus on providing new features for your customers. Here's the AWS VOD Solution: https://aws.amazon.com/solutions/implementations/video-on-demand-on-aws/CommentShareJason_Wanswered a year ago0Hey Jason, thank you very much for such a good reply. One more question would I have: Is there a template for the full backend for aws incl admin panel?CommentShareAWS-User-2831799answered a year ago"


Question: EMR 5.x status and security updates

"We are running an application based on EMR 5.36.0, and our security scans note several "high" impact Tomcat vulnerabilities (used internally by EMR).The last 5.x release was July 2022, and Tomcat was last updated as part of EMR in 5.35. Two questions arise:Is AWS EMR 5.x officially EOL, or otherwise nearing it? (based on the long delay between releases)Is there any official AWS documentation on whether the EMR cluster is affected by the specified CVEs? Or, is there a supported path to hotfix?It appears that Tomcat is used by two features in hadoop, both of which are (apparently) running by default on our EMR cluster.Open CVEs for Tomcat 8.5.75 include:(high) CVE-2022-25762 (websockets)(high) CVE-2022-42252 (request smuggling)(high) CVE-2023-24998 (DoS)(others)FollowComment"

Answer: "1Hello,➤ To begin with your query for "Is AWS EMR 5.x officially EOL, or otherwise nearing it"I would like you to know that we don't remove any EMR versions and all EMR versions are available on the console, so that the customers who are working with older versions do not get impacted. Please note that Support team is not aware of timelines and the EOL of the EMR versions. However, if any of the versions is deprecated, you will be notified and it is updated on the documentation. You can check the links [1,2] for updates in EMR and EMR 5.x respectively.➤ Further adding to the query, "Is there any official AWS documentation on whether the EMR cluster is affected by the specified CVEs? Or, is there a supported path to hotfix"CVE-2022-25762EMR clusters run in the customer account, and customers have full control to add or change software and configuration settings on their EMR cluster instances. When you run software provided by EMR with EMR’s default configuration settings, the issues discussed CVE-2022-25762 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25762) do not impact EMR, for more information refer links [3a,3b].CVE-2022-42252Regarding CVE-2022-42252 impact on EMR. Hadoop team has investigated on the below application paths as there were no application paths specified on this vulberability, for more information refer links [4a,4b].path : /usr/lib/bigtop-tomcat/lib/path : /usr/lib/hadoop-kms/share/hadoop/kms/tomcat/lib/CVE-2023-24998Fixes are still pending on this issue, and on the link[5] you can find out the status on more information.you can check the official AWS documentation where the EMR cluster is affected by the specified CVEs in the below link;[*] https://alas.aws.amazon.com/alas2.htmlReferences:[1] https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-whatsnew.html[2] https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-release-5x.html[3a] CVE-2022-25762  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25762[3b] CVE-2022-25762  - https://alas.aws.amazon.com/cve/html/CVE-2022-25762.html[4a] CVE-2022-42252  - https://www.tenable.com/plugins/nessus/166807[4b] CVE-2022-42252  - https://alas.aws.amazon.com/cve/html/CVE-2022-42252.html[5] CVE-2023-24998 - https://explore.alas.aws.amazon.com/CVE-2023-24998.htmlCommentShareLtlakshanswered a month ago0Good morning,We are running an application based on EMR 5.36.0, and our security scans note a high impact finding (CVE 2023-26464) in regard to using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7. Based on the documentation: https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-log4j-vulnerability.html, I understand that Amazon EMR does not set up Log4j Chainsaw, that leaves the socketappender part of the CVE. Is there any indication in the available materials as to whether this feature is used by EMR?In addition, our security scans note a high impact finding (CVE 2022-29885) Is there any official AWS documentation on whether the EMR cluster is affected by the specified CVEs? Or is there a supported path to hotfix?CommentShareQudusanswered 4 days ago"


Question: Changing pg_trgm.similarity_threshold in RDS

"Hello, I would like to reduce the threshold from 0.3 to 0.1.The parameter pg_trgm.similarity_threshold doesn't exist in any parameter group and due to superuser issues I can't alter the database and change this parameter permanently.I can see that the pg_trgm extension is installed but the parameter is missing.FollowComment"

Answer:
"0Hello AWS Customer,As you know, the parameters for the 'pgtrgm' extension are non-standard i.e. they are not part of a standard postgresq.conf file. In RDS, we provide parameter group to enable PostgreSQL parameters, however, at present, 'pg_trgm' extension GUC parameters (given below), are not part of default parameter group of RDS PostgreSQL instance: pg_trgm.similarity_threshold, pg_trgm.word_similarity_threshold, pg_trgm.strict_word_similarity_thresholdSo, you will not be able to change the values of these parameters at global level for the RDS instance.But workaround here would be to set this parameter value at the database session level using the below set command:"set pg_trgm.similarity_threshold=0.1;
"However, the changed parameter value is valid only for the session executing the query. When a new session connects to the DB, the "pg_trgm.similarity_threshold" parameter value is set to "0.3" by default.The internal team is already working towards incorporating this feature in RDS PostgreSQL but I don't have any ETA on its availability. Please follow the AWSblog for new feature announcementsHope the information helps.CommentShareKunal_Manswered a year ago"


Question: Codebuild won't run more than 1 build concurrently

"Same question was asked here but the answer does not apply to my case: https://repost.aws/questions/QUxsq-Hv5GSPa_Pth-5ZVckQ/cannot-get-code-build-to-build-more-than-1-concurrent-buildWe've got 2 pipelines, each with a Codebuild, making a total of 2 Codebuilds. I've noticed that the Codebuilds spend most of their time in the QUEUING status, sometimes remaining there for as long as 10 minutes. The only explanation I have for this is that each time this happens, there's 1 other Codebuild running. We have not set any limits and are running using the SMALL compute type.I've read the quote limits and we certainly are not even close to those limits, maybe running the pipelines a total of 5-10 times per day, meaning 5-10 Codebuild invocations per day, maybe 10-20 Codebuild invocations per day on a busy day.What could be causing this? Please don't say we must have a concurrency limit set somewhere and not know about it because everything was created via CDK and no stack has drift.FollowComment"

Answer: "0I can see that it is not reaching the account/region level limit for concurrent builds. Can you please confirm that it is not a consistent behavior but rather sporadic?Please be noted that customers may experience a long queue delay or provisioning time occasionally, since CodeBuild provides on-demand build service and queue times may vary based on fleet availability.  If capacity is not immediately available, CodeBuild tries to queue the builds for additional capacity to be available in the build fleet.CommentShareTaka_Manswered 5 months ago"


Question: [COMPREHENSIVE REFERENCE] Tutorial Links for Lumberyard Compiled just for you!.

"Hi guys! so I've seen alot of post asking for tutorials on certain subjects with some subjects being covered but never pointed to. So, I figured i'd compile video links and whatever else to get a central area for newbies and everyone to view.Maybe this can get pinned @REDACTEDUSERIll also be making a separate thread with all my tutorials thus far!If you see a resource(also important tutorial post that are sprinkled about the forums) that i have missed out on, please let me know and i'll add it!.YOUTUBE CHANNELS1.AMAZON GAME TECH (Obviously lol) - tuts on Amzn gamedev eco-System (LY, AWS etc)2.COGNITIVE STUDIOS CHANNEL (Me) - lumberyard tuts & video series as well as game dev vidsCODE SPANNER CHANNEL - non-specific LY tuts, digs into components(C++) fairly new channel on LY.4.BRIAN BURTON CHANNEL - script canvas, general setups as well as some lua tutorials, he also has LY books available.BLOGS AND WEBSITESLY on REDDIT - didnt know we had one, wish it was more active, no you know it exist make it happen :-) .BRAIN56 - Worded breakdown tutorials on different thing in LY, such as player controller creation & more.THIRD KIND GAMES - serveral worded tuts on alot of LY things mainly using C++, which is always welcomed they also have a released game called "THE DRG INITIATIVE"NOT UPDATED, But USEFUL (as of 9/30/2018)below are channels that have multiple video but havent uploaded in 6+ months to year(s). or cover older version of the engine only.WRITTEN TUTS by AMAZON - updated last on ver 1.10 i believe.AMAZON GAMEDEV CHANNEL - assortment of starter videos on older version of engine (created before amazon game Tech took over)MISTERTOOLBOX CHANNEL - tuts on different topics such as UI, setup, creating components etcDOUGLAS BUZZELL - tuts on things like Version control, and basic setupsSAMUEL DASSLER - non-specific tuts on older versions of the engine.AHMAD KARAMI - several diffferent vids on LY, seems to have moved on to Cryengine.Follow"

Answer: "0No problem!SharerePost-User-9018410answered 5 years ago0[Pinned] Love this — thanks for putting it together @REDACTEDUSERSharerePost-User-5738838answered 5 years ago0Thanks for the list!I'm going to bump this as it is the only consolidated resource I've been able to find. I'm hoping we can get this updated and additional content added?For example, Brain56 hasn't been updated in a year, maybe move to the "NOT UPDATED" section? A few broken links and the other older "NOT UPDATED" stuff I didn't really check out as the first link "WRITTEN TUTS" just redirects to the forum homepage.I found a bunch of old docs in places like this:  https://forums.awsgametech.com/t/new-and-updated-tutorials-now-available-january-2017/2151But I didn't see anywhere that is all aggregated, it's outdated anyway, but worth mentioning.I'm just getting started with Lumberyard, well game dev in general, so I've been trying to collect all the resources I can.SharerePost-User-5740230answered 4 years ago0Yea I definitely need to update the list, with the new forums we just got some links are broken and point to nowhere.SharerePost-User-9018410answered 4 years ago0For the coders out there you won't want to miss Game Programming with Amazon Lumberyard by our very own @REDACTEDUSERAlso the Amazon GameDev Channel has been relaunched as a dedicated Amazon Lumberyard channel that is active and updated weekly (my goal). Please make sure to subscribe and post.I'm going to start moving the video comments and answers to individual posts here on the forums tagged with +tutorials and /or +tutorialsconverstationSharerePost-User-8914159answered 4 years ago0Hey john! would of definitely added the current channel and Olex to the page, seems I've lost access to edit my old post though.SharerePost-User-9018410answered 4 years ago"


Question: Disabling access to non AWS services via VPC endpoints

Is there a way we can prevent creation of VPC Endpoints in AWS PrivateLink for non AWS Services?. Customer looking to whitelist PrivateLink and want to make sure that no one can connect to non AWS services using PrivateLink. The condition key in the IAM policy ec2:VpceServiceName should work but wouldn't that prevent even the Admin to create any endpoint for non AWS Services?.FollowComment

Answer: 0Accepted AnswerYou could add a condition on the permissions on "CreateVpcEndpoint" endpoint where the ServiceName does not contains "com.amazonaws.vpce" which would block creating endpoints for customer created endpoint services.CommentShareAWS-James-Devineanswered 3 years ago


Question: AWS Texract using AnalyzeExpense captures only one table and miss items in Summary fields

"Hi,This is to inform that AWS Texract using AnalyzeExpense captures only one table and miss items in Summary fields when we scan a receipt.The following attach sample receipt contains 2 tables with different line items with qty and amount.However, after scanning the result display only the first table(please refer to pic)http://drnko.rs-technology.co.in/aws/Capture.PNGhttp://drnko.rs-technology.co.in/aws/Capture1.PNGPlease resolve this ASAP, since this is causing to us ACCURACY problem and we could not proceed further with our business solution.Regards,ZahidFollowComment"

Answer: "0Thank you for using Amazon Textract. I am sorry to hear to that you are seeing issues with our service. It would be helpful if you could provide us with original input file for which you're seeing issues, AWS account ID, and region you are operating in. You could contact AWS support to share the details. This will help us in identifying the issue.CommentSharehyuno-awsanswered a year agoZakhid a year agoHi,Thanks for the quick reply.As per the request following are the details: AWS account ID: 501378533059 Region: ap-south-1Original file: Please follow the link below: http://drnko.rs-technology.co.in/aws/receipt16.jpgHowever, after scanning the result display only the first table(please refer to pic) http://drnko.rs-technology.co.in/aws/Capture.PNGhttp://drnko.rs-technology.co.in/aws/Capture1.PNGI hoe the above information is sufficient to resolve the AWS Textract AnalyzeExpense issue.Regards,ZahidShare0Hi,Thanks for the quick reply.As per the request following are the details:AWS account ID: 501378533059Region: ap-south-1Original file: Please follow the link below:http://drnko.rs-technology.co.in/aws/receipt16.jpgHowever, after scanning the result display only the first table(please refer to pic)http://drnko.rs-technology.co.in/aws/Capture.PNGhttp://drnko.rs-technology.co.in/aws/Capture1.PNGI hoe the above information is sufficient to resolve the AWS Textract AnalyzeExpense issue.Regards,ZahidCommentShareZakhidanswered a year ago0Thank you for providing customer feedback and the sample document(s). Unfortunately current analyze expense model can't reslove your issue. We are forwarding your feedback to the right team to evaluate and make improvements. And you may use Analyze Document to extract tables instead of Analyze Expense.CommentSharehyuno-awsanswered a year ago"


Question: Does Lex have already Pre built Industry domain or situation domains  ( ordering in a restaurant) or  weather per industry smarts. The answers are not found here in RePost

Other bots have quick easy  canned situations that you can edit per industry called knowledge domains -- is there an alacarte we can pick for Lex to make itr easy for us to just editFollowComment

Answer: 0Accepted AnswerThere are 5 pre-built solutions for specific industries that can be used to bootstrap a solutionAmazon Lex for Financial ServicesAmazon Lex for InsuranceAmazon Lex for RetailAmazon Lex for TelecomAmazon Lex for TravelI hope these help you get started with your bot development. All the best!CommentShareSaketanswered 7 months ago


Question: Is supported Timestamptz datatype in DMS postgres replication?

"https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.PostgreSQL.html#CHAP_Source.PostgreSQL.DataTypesThis document shows that timestamps with timezone is not supported in DMS postgres.But I tried to replicate a database whose table which includes timestamptz column and it replicated correctly.Could you tell me why replication was successful?This is my configuration of this task.*DMS replication instanceengine version: 3.1.4*Endpoint(source)RDS PostgreSQL 9.4The source table schema is like this:Table "public.source_table"Column    |           Type           | Modifiers--------------------------------------------------set_time    | timestamp with time zone | not nullchannel_1   | numeric(24,8)            |channel_2   | numeric(24,8)            |channel_3   | numeric(24,8)            |...Indexes:"source_table_pkey" PRIMARY KEY, btree (set_time)*Endpoint(target)Aurora PostgreSQL 10.7The target table which has timestamptz was created in advance and use "TargetTablePrepMode":"TRUNCATE_BEFORE_LOAD" mode.*Replication taskMigrationType: full-load-and-cdcTableMappings: '{"rules":[{"rule-type":"selection","rule-id":"1","rule-name":"1","object-locator":{"schema-name":"public","table-name":"%"},"rule-action":"include","filters":[]}]}'Edited by: sabmeua on Aug 29, 2019 7:42 PMEdited by: sabmeua on Sep 4, 2019 9:06 PMFollowComment"

Answer: "0Hi @sabmeua,Did you manage to find an answer to your question? We have the same question. It would be great to know how you resolved this.Thanks.CommentShareVS007answered 3 years ago0Thanks for replying.Unfortunately, I haven't gotten clear answer yet.But, currently timestamptz is written that partially migrable in the document.This is my case, the migration from version 9.4 to 10.7 involved a logical replication is used.For logical replication, if the time zone between the subscriber and the source are the same, the migration of timestamptz is possible.If the time zones are different, pglogical will not be able to reflect the time zone correctly.I believe that "partially" means that.Edited by: sabmeua on Apr 16, 2020 6:21 PMCommentSharesabmeuaanswered 3 years ago"


Question: Customizing  user invitation messages on a per user basis

"Fellow AWS devs,I have a question about modifying the invitation emails sent out by Cognito after creating users with the adminCreateUser method.For the email verification messages I managed to adjust the mails using a custom lambda method that is checking forevent.triggerSource === "CustomMessage_ForgotPassword". I set this lambda to be triggered under triggers in the Cognito console under Custom message entry.When adminCreateUser is called for a new user, I do see the same lambda method being trigger, just this time withevent.triggerSource === "CustomMessage_AdminCreateUser".But when I adjust the text with   event.response.emailMessage = htmlBody;, the email received is still the static text setup in the cognito console, not the modified one. Modifying the response.emailMessage for the verification mails works though.Whats the trick getting user-invitation emails modified?PS: the static email text in the cognito console is unfortunately not enough, as I have different clients using the same cognito pool and want to modify the emails on a per-client basis.Edited by: Bersaelor on Apr 29, 2020 3:59 PMFollowComment"

Answer: "0I figured it out myself:Since I hadn't adjusted the file with the html body being loaded, theevent.response.emailMessage = htmlBodywas being set with the verification email text in both cases.And the verification email text didn't contain a {username} placeholder. Once I had this placeholder in a proper user-welcome email the modified email was sent out instead of the static one in the cognito console. So, all solved.CommentShareBersaeloranswered 3 years ago"


Question: How to retrieve missing folders or deleted folders in Amazon Workdocs?

Few folders got missing or deleted unknowingly. Is there any chance to retrieve those folders back?FollowComment

Answer: 0Have you tried the below steps?thenCommentShareArun_PCanswered 10 months agoGnana Sai Vattikonda 10 months agoThanks for your response. But I'm not the Owner of the folders which got deleted and Admin control panel option is not showing for me.Share


Question: Why only have 3 Availability Zones in Tokyo region (ap-northeast-1) ?

Why only have 3 Availability Zones in Tokyo region (ap-northeast-1) ?But aws say have 4 zone in tokyo region in docs.https://aws.amazon.com/about-aws/global-infrastructure/?nc1=h_lsFollowComment

Answer: "0I think this is because the old AWS account shows "ap-northeast-1b", but the new account only shows "ap-northeast-1a", "ap-northeast-1c" and "ap-northeast-1d".CommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: AWS Kinesis Video Stream and Greengrass Core Device : High Availability Architecture

"I'm attempting to stream 50+ on-prem RTSP cameras to AWS Kinesis Video Streams. Given that the Edge connector for KVS must be deployed on an on-prem  Linux machine, how can I ensure high availability and avoid single point of failure in this case, so that if the on-prem Linux machine fails for whatever reason, the camera streaming continues? Please share your thoughts and ideas; they will be greatly useful to me.FollowComment"

Answer: "0Here is the reference architecture for AWS hosted high availability architecture for Kinesis video streams.https://aws.amazon.com/blogs/big-data/build-highly-available-streams-with-amazon-kinesis-data-streams/In your case, since it is on prem, you can create a replicator and store it in Amazon DynamoDB per the architecture recommendations. This way one stream goes to linux box in on-prem, the replicator stream is sent to Amazon DynamoDB, providing high availability necessary.CommentSharerePost-User-venkyanswered 3 months ago"


Question: Quicksight Athena -  analysis error: "HIVE_UNSUPPORTED_FORMAT: Unable to create input format"

"Hello.I'm trying to create an analysis from my DocumentDB instance. I'm using the aws services Glue, Athena and Quicksight.In Glue I have created a connection to the DocumentDB and a crawler for auto creating tables. This works as expected and tables are created and displayed in glue.  Even though I specify that the crawler should not give the tables any prefixes, it does add the database name as a prefix. When I look at the Glue catalog in Athena (the default AwsDataCatalog) I do see the database that was created in glue, however it does not show any tables. If I click on edit, it takes me to the correct database in glue which displays the tables that have been created by the previously mentioned crawler. So my first question is Why doesn't the tables show up in Athena?This is blocking me from performing queries in Athena.When I go to QuickSight and select the default Athena glue catalog ("AwsDataCatalog") I DO get the tables created by the crawler, and I can create datasets. However, when I try to create an analysis using these datasets, I get the error:sourceErrorCode: 100071sourceErrorMessage: [Simba][AthenaJDBC](100071) An error has been thrown from the AWS Athena client. HIVE_UNSUPPORTED_FORMAT: Unable to create input formatI have looked a bit around and some people said that this error is due to the table properties "Input format" and "Output format" being empty (which they indeed are for me). I have tried entering almost all the different formats to the table, but I keep on getting the Quicksight error above only now it has the input format at the endHIVE_UNSUPPORTED_FORMAT: Unable to create input format jsonSo my second questions isI do not see anywhere in the crawler where I can specify input or output format. Does it have to be done manually? And What are the correct input and output formats for my setup?FollowComment"


Question: Are there any cases lead to "Query condition missed key schema element : sort key" ?

"I met a really weird question when I was using DynamoDB in the project (with JAVA SDK).We created a DynamoDB table with a Primary Partition Key 'id', and a Sort Key 'create_time'. And I used query operation in my source code with both Partition Key and Sort Key,   but I get a exception while queryingcom.amazonaws.services.dynamodbv2.model.AmazonDynamoDBException: Query condition missed key schema element: create_time  (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: ValidationException; Request ID: K9B8K5DU0CQ1BQA9VJIPTI6EIJVV4KQNSO5AEMVJF66Q9ASUAAJG)I have researched for a day, and almost all the results for searching "Query condition missed key schema element" from google told me that I'm not using the Partition Key or GSI in KeyConditionExpression , but I'm sure that we had set up correct Partition Key and Sort key with correct names and used correct in source code, by the way we didn't create any GSI in out DynamoDB.So I just want to know that are there any situations which might cause this exception - Query condition missed key schema element with a Sort Key rather than a Partition Key.**BACKGROUND STATEMENT **This query operation worked in my develop environment well, but not worked in the production environment. The source code is exactly the same.This table is new created in production environment. (I ever suspected that there must be something wrong while creating the table in the production environment. But I have confirmed for several times, the Partition Key and Sort Key are all correctly named and we do not create any GSI.)The differences between develop and production might be the DynamoDB regions. Develop is created in ap-southeast-1 and the production is in us-west-1.FollowComment"

Answer: "1HI Zeko,Looks like your keys do not match those of the table that you are querying, I can assert this from the RequestId in the exception you shared. Without revealing any resource information in a public forum, I kindly suggest that you ensure your keys match the table which you are querying:Check you are querying the table you believe it to be in the region you believe it resides.If the table is correct, check that the keys match, as mentioned keys which you described do not match the table in question.Please feel free to reach out to AWS Premium Support should the above not assist you, we would be happy to discuss in detail there.CommentShareEXPERTLeeroy Hannigananswered a year ago"


Question: Data Wrangler costs in Cost Explorer?

"Is there a way to separate out Notebook from Data Wrangler costs in Cost Explorer? I've narrowed it down by service to SageMaker, but I'm not sure if I'm looking for the right thing by searching for "wrangler" in the other filters ("usage type", etc).FollowComment"

Answer: "0Yes, you can separate out the costs of Amazon SageMaker Notebook instances and Amazon SageMaker Data Wrangler in the AWS Cost Explorer by filtering on the "Usage Type" dimension. The Usage Type for SageMaker Notebook instances typically starts with "AmazonSageMaker:NotebookInstance" and the Usage Type for SageMaker Data Wrangler starts with "AmazonSageMaker:DataWrangler".CommentShareGabriel Olaleyeanswered 4 months agoyann_stoneman 4 months agoI got the information by doing a Group By of Usage Type, and then I was able to see how much cost there was for like EU-Notebk:ml.r5.xlarge vs for USE1-Studio:KernelGateway-ml.g4dn.xlarge. Studio:KernelGateway can never mean Data Wrangler usage, right? That's definitely notebook usage?Share"


Question: Do Organizations Tag Policies support Principal references

"Hello, I need to write an Organizations Tag Policy that carves out an exception for a particular AWS Principal - in this case an IAM role. Is this possible? It's not clear from the documentation https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_example-tag-policies.html ... simply because it doesn't mention Principals, I am thinking they aren't supported.FollowComment"

Answer: 0From my reading I do not think making an exception for a particular Principal is supported with Tag PolicyYou may though be able to achieve similar with an SCP which does allow Principal exceptionCommentShareEXPERTPeter_Ganswered a year ago


Question: Sample example for msk 3rd party openid connect(from PRODUCER AND CONSUMER)

"Not able to find a proper documentation on 3rd party openid connect integration with msk iam role identity provider. It would be helpful if someone point to right documents or example.We are registering 3rd party on prem identity provider, but not sure how to connect to msk cluster with these options. below project doesn't have proper documentation.https://github.com/aws/aws-msk-iam-authFollowComment"


Question: Do Textract DetectDocumentText support PDF format?

"I was checking the javascript @aws-sdk/client-textract documentation.In the DetectDocumentTextCommand docs page, it claimed that supports JPEG, PNG, PDF, or TIFF format.But in the DetectDocumentTextCommandInput docs page, it claimed that only supports JPEG or PNG format.I tried the command with PDF file in S3 and also BLOB format, it throws UnsupportedDocumentException. Just trying to figure out whether it doesn't support PDF format, or there's some bug right here.DetectDocumentTextCommand docs page:https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-textract/classes/detectdocumenttextcommand.htmlDetectDocumentTextCommandInput docs page:https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-textract/interfaces/detectdocumenttextcommandinput.htmlFollowComment"

Answer: "1Accepted AnswerYes, the synchronous DetectText API does support PDF documents. However, the document must have maximum 1 page and cannot be larger than 10MB (source). These limits are in place because the API is synchronous and there is an expectation that the result will be returned quickly. A multi-page PDF document takes longer to process and can only be done with the asynchronous StartDocumentTextDetection API.I agree that the documentation you link in your question is unclear on this, so I will report this to the Textract documentation team and ask to have this updated.CommentShareS_Mooseanswered 2 months ago0Hi Moose, thanks for the clarification. I was trying on a multi page PDF, no wonder it doesn't work. Will check out the async solution. But ideally I need a synchronous solution, mayb I have to do it with step functions.CommentShareAustinanswered 2 months agoS_Moose 2 months agoI have seen customers use a Lambda function (or other compute) to split the document into individual pages, then make several synchronous calls for each page, and merge the results together afterwards. Just make sure you check the quotas applied to your account for Textract, because you may see a throttling error if you hit the quota. Most quotas can be increased if you request it.Share"


Question: Exposing .NET Core Web API on IIS on EC2 instance

"I have setup a .NET Core Web API on EC2 instance on IISI Have been able to invoke from within the EC2 instance, it worksWhat are the steps required to expose an API that can be invoked from outside AWS Environment like say Python running on my local laptopFollowComment"

Answer: "0You want to expose your web API to the Internet so that users can call that API. In your setup, you have a web server (IIS) running on an EC2 instance and listening for incoming requests.Please refer to this knowledge center article that explains how to allow inbound traffic on port 80 and/or 443 for an EC2 instance. It is recommended to only allow traffic for HTTPS (port 433) because it is more secure.If you want to understand in detail how the Security Groups described in that article work, please refer to the Virtual Private Cloud documentation.Note that you do not necessary need an EC2 instance for hosting a web API implemented using the .NET platform. Depending on your requirements, you might want to consider to host your application on AWS Lambda. In this blog post, you can read about the differences and advantages of both approaches.Another option for hosting a web API is containerizing your application and using a container orchestration framework for running it. Here, Linux-based containers offer more advantages than Windows-based containers. Since you build your application on .NET Core which supports cross-platform targets, you might want to consider using Linux as your platform. AWS offers multiple ways to run containerized applications. In this blog post, you can read about running a .NET based web API using AWS App Runner.  If you want to use Kubernetes, there is also a way for that - using Amazon EKS. Another (easier) option is to use Amazon ECS and AWS Fargate - you can read this blog post for details and advantages of this approach.Now you can make an informed decision what option fits your requirements - a classic server-based model, a modern container app, or even a serverless architecture.CommentShareDmitry Balabanovanswered 10 months agorajaws 10 months agoI totally agree with your approach of lambda etc. For the same reason, I created an AWS API Gateway and was able to invoke Sample API's and able to get the response from a browser outside AWS. Attached the Lambda function to API Gateway. Sample API's used in the Lambda Code is https://reqres.in/api/usersBut moment I use the .NET Core API hosted on EC2 instance (on Port 5050) ,  withing the lambda function it stops working. The .NET Core API is hosted on IIS. I have setup the Security Groups on the Inbound rules of the Security Group associated with the EC2 instance. All TCP allowed for 0.0.0.0./0. To look up further I tried to access directly the .NET Core API From another EC2 instances withing the same subnet and VPC, even that doesn't Work. But the same .NET Core API works within the EC2 instance where the API is hosted. On the EC2 API Server i have also configured the hosts file too.Do I have to configure anything else?ShareDmitry Balabanov 10 months agoIf you cannot reach your API from within the same subnet, then there has to be something blocking the network traffic. You can use the VPC Reachability Analyzer or VPC Flow Logs to ensure the traffic is not blocked on the subnet level. Also, make sure the Windows firewall on the instance does not block the incoming requests.Share"


Question: Regarding TLS termination on Network Load Balancers is fully integrated with AWS PrivateLink

"HiBelow is query posted by my Customer. Can someone provide more details regarding this query?"TLS termination on Network Load Balancers is fully integrated with AWS PrivateLink"Can you get more information on what this means and how to use it for privatelink? PrivateLink docs haven't been updated, and it still seems like we have the challenge of not knowing the privatelink endpoint dns name at the time we need to deploy a certificatenot to mention, not being able to create ACM certs for amazonaws.com addresses anyway.ThanksFollowComment"

Answer: "0Accepted AnswerYou can use PrivateLink with your own domain name, by creating an alias record set as documented here: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.htmlThis way you can validate the ACM certificate attached to your NLB.CommentShareEXPERTFabiananswered 4 years ago"


Question: Email Feedback Reports (Complaints) for Live.com / Hotmail.com / Yahoo.com

"We use SES for transactional emails. We do send a high volume of these emails - we run a fantasy football platform and users receive an email each time a draft pick is made, so at this time of year there are many such notifications (users can opt in and out). We started receiving Email Feedback Reports (Complaints) related to Yahoo email addresses.  We then received the complaints from our users with Hotmail and Live.com email addresses. Our users are unaware of these reports being issued and have not submitted complaints, so it appears that it's something on Yahoo & Microsoft's side. We have since reached out to Yahoo and they have confirmed that it isn't a report that is being generated by their system.Does anyone have experience & guidance for this?FollowComment"


Question: Fuota Session error: FragmentationIndexUnsupported

"We're facing some issues on the FUOTA session, specifically on the FragSessionSetupReq command which AWS IoT Core issues from the Fragmented Data Block Transportation Specification.Once the multicast setup is ready for a multicast group which include just a single device, we schedule a FUOTA task for that group.Unfortunately, we always get the FragmentationIndexUnsupported error: the FragSession field we get is "0x1F" (FragIndex: 1)Is there any way to set the FragIndex on AWS? Still, how can we set the FragMaxSize, NbFrag and the FragMaxRedundancy? We uploaded several firmware images of different size, and it seems that AWS IoT Core always splits them in fragments of 48 bytes.FollowComment"

Answer: "0Hi OroN. What device are you using? Does it support only a single fragmentation session and hence an index of 1 exceeds its capacity (in other words, are you saying AWS IoT Core for LoRaWAN sends an index of 1 but you think it should be 0)?In regards to the fragment and number of fragments, these settings are not currently exposed to the user. However, they change based on the DR inherited from the multicast group.UPDATE: AWS IoT Core for LoRaWAN uses fragmentation index 0 for unicast FUOTA and fragmentation index 1 for multicast FUOTA.CommentShareEXPERTGreg_Banswered 6 months agoOroN 6 months agoYes we use an embedded device with a Lorawan stack library supporting only one multicast session. The multicast index value is zero due to the following requirements in "Lorawan Remote Multicast Setup specification v1.0.0". Is it possible to set the AWS lorawan multicast index to zero to be compliant to the requirement?ShareGreg_B EXPERT6 months agoYou said in your question that the error is FragmentationIndexUnsupported. This relates to fragmentation index and session, not multicast. If your device is using LoRaMAC-node, then the error comes from here: https://github.com/Lora-net/LoRaMac-node/blob/master/src/apps/LoRaMac/common/LmHandler/packages/LmhpFragmentation.c#L373 . I re-tested FUOTA. AWS IoT Core for LoRaWAN correctly used multicast index 0. However, the fragmentation index is 1 when I think it should be 0 for the first session. I have reported it. I will keep you posted.ShareGreg_B EXPERT6 months agoAre you able to modify the device firmware? If so, you could increase FRAGMENTATION_MAX_SESSIONS to get un-blocked for the time being.ShareGreg_B EXPERT6 months agoOK, AWS IoT Core for LoRaWAN uses fragmentation index 0 for unicast FUOTA and fragmentation index 1 for multicast FUOTA.Share0Yes we use an embedded device with a Lorawan stack library supporting only one multicast session. The multicast index value is zero due to the following requirements in "Lorawan Remote Multicast Setup specification v1.0.0"Is it possible to set the AWS lorawan multicast index to zero to be compliant to the requirement?CommentShareOroNanswered 6 months agoGreg_B EXPERT6 months agoAs per my other comment, the issue is the fragmentation session and index, not multicast.Share"


Question: AWS EC2 Instance Stop and Start IP Address Changed

One of my EC2 Instance Stop and Start but after start instance ip address changed by which all urls of website stopped.My Data loggers using old ip address.Is there any solutions for getting old ip address again or any way to change this ip address to old one.FollowComment

Answer: "3This is expected behavior in EC2. Public IPs are released when an instance is stopped and a new one is assigned when you start it again. The IP is assigned at random from a pool and you can't specify the public IP you want. Because of this, unfortunately it's not possible to reuse the same public IP you had before. If you want to keep the same IP, assign an Elastic IP to your instance.The private IP of the instance on the other hand will stay the same until you terminate the instance. You can also assign a private secondary IP address to your instance, which you can reuse but limited to within the CIDR block of your VPC.CommentShareChamalanswered 7 months agoEXPERTTushar_Jreviewed 7 months agoEXPERTToni_Sreviewed 7 months ago"


Question: caps lock automatically in AWS Workspaces

How to fix caps lock automatically in AWS Workspaces?FollowComment

Answer: "1HelloTo help understand your problem and offer more specific, can you share the following?Are you running the latest Amazon WorkSpaces client? You can download the latest client from https://clients.amazonworkspaces.comDoe this issue impact one user or multiple?Does this issue happen on a custom Windows Image/Bundle you created? Does it happen on a standard image/bundle?Can you check if Sticky Key is enabled on the OS?CommentShareEXPERTDzung_Nanswered a year ago"


Question: Issues with some clients displaying Workmail calendars in the browser

"We have a couple of folks who are using the web client to access Workmail, and they have issues with the entries on the calendar not displaying properly, unless they do some exact resizing of their windows.   Here is an example:One of them is on a Mac using Brave, and the other Windows using Chrome.   Any one else run into an issue like this with their web clients?FollowComment"

Answer: "0Hi,I'm sorry to hear you're experiencing problems with displaying appointment subjects in the Web Client. The issue has been escalated to the service team for investigation.Can you share some details on how these appointments where created and if possible share 1 of the subjects? This might help the service team in resolving the issue faster.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 10 months ago"


Question: Cross Account ECR Image Sharing

"Hello,I have a docker container in my ECR. I have adjusted access to this so that a specific root account (X) can use it to instantiate a lambda instance with a specific name. So once X instantiates the lambda, is there any way that he can view the content of my docker container?This is the access policy in my ECR{"Version": "2008-10-17","Statement": [{"Sid": "AllowPushForLambda","Effect": "Allow","Principal": {"AWS": "arn:aws:iam::<ExtAccountID1>:root","AWS": "arn:aws:iam::<ExtAccountID2>:root"},"Action": "ecr:GetImage","Condition": {"StringLike": {"aws:Referer": ["arn:aws:lambda:<region>:<ExtAccountID1>:function:ExpectedLambdaFunctionName","arn:aws:lambda:<region>:<ExtAccountID2>:function:ExpectedLambdaFunctionName"]}},"Resource": "arn:aws:ecr:<region>:<MyAccountID>:repository/<repository-name>"}]}FollowComment"

Answer: "0Hi Avishka-Perera,From my pov, to do cross-account access and pull images from ECR, you could allow it using AWS Account IDs.Please refer to my testing image below. I tried to pull it from the local machine or EKS cluster.CommentShareMinh Leanswered 16 days agoAvishka-Perera 16 days agoHi Minh,Thank you for your response. Noted!By doing that, will the person with account id 435854034491 be able to download the docker container in my ECR? Is it possible to restrict them to using my docker container only to instantiate lambda functions and nothing more? I want to hide the content of my docker container, but allow them only to utilize the functionality.Share"


Question: RDS volume - Latency & I/O spikes

"we are experiencing sudden spikes in read/write latency and queue depth on a production PostgreSQL instance.There is no increase in connections, workloads, web layer traffic, cronjobs, etc.We saw the physical device read/write IOs plummet on Enhanced Monitoring.We think there to be a degradation issue with volume.we found that it will return to normal every 5mins in our web apps apm monitor.Can someone from AWS please look into this ASAP?FollowComment"

Answer: "0This may require other details , so we would recommend to open a support case so that it can be looked/troubleshooted in more detail. In the meantime, you can also checkhttps://aws.amazon.com/premiumsupport/knowledge-center/rds-write-latency-spikes/https://aws.amazon.com/premiumsupport/knowledge-center/rds-latency-ebs-iops-bottleneck/CommentShareEXPERTAWS-User-Nitinanswered 6 months ago0Check the database, to see what is causing the spikes. Performance Insights would help.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.html.  With Postgres, Vacuum can be causing unexpected I/O .CommentShareAWS-User-2452977answered 6 months ago"


Question: Handling null array types in Athena

"I am using an Athena table sourced from parquet files in s3. The table consists mostly of columns of type array<double>. To create the files, I am converting pandas dataframes into the parquet files. When I try to query the table, I am receiving a HIVE error that states:"HIVE_CANNOT_OPEN_SPLIT: Error opening Hive split s3://<bucket>/<key>.parquet (offset=0, length=1700612): org.apache.parquet.io.PrimitiveColumnIO cannot be cast to org.apache.parquet.io.GroupColumnIO"I have narrowed down the issue to being one of the array<double> column that includes Python None values. I believe Athena is trying to convert those empty values to an array, and that is where the issue arises. I am able to resolve this by using empty an empty list [] instead of None in the pandas column. However, we would prefer for these values to show up as null in Athena rather than as an empty list. Is there any way to have the empty values work with Athena while being null rather than an empty list?Thank youFollowComment"

Answer: "1LazySimpleSerDe will interpret only '\N' as NULL by default, but you can configure it to use other strings with the serialization.null.format serde property. Use NULL DEFINED AS '' i.e an <EMPTY STRING>CommentShareAnanth Tirumanuranswered 8 months ago"


Question: AWS Timestream query: How to extrapolate latest value

"I have a number of devices that are pushing their measured values to AWS TS only when the values has changed.   When I pull a graph of my devices history, I want to see all the values up until NOW... Which I don't have because the time series stop at the latest value that was recorded.  Is there a way to extrapolate (with a query) the value at now() based on the last value?FollowComment"

Answer: "0Accepted AnswerI solved my problem by adding the last known value at the end of the time series, before interpolating.CommentShareAWS-User-8812558answered a year ago0Timestream query does not support extrapolation. Please check https://docs.aws.amazon.com/timestream/latest/developerguide/timeseries-specific-constructs.functions.interpolation.html to see if you can use the interpolation functions to help you get the data.CommentShareRajesh Iyer - AWSanswered a year ago"


Question: What is the IP address of my AWS website so I can add the A record on Cloudflare?

"I've bought a web domain with AWS Route 53 and set up the S3 buckets required, followed the AWS guide and got my site all working without cloudflare. Then I wanted to get my site to be secured with HTTPS and so I applied for the certificate on AWS Certificate Manager, giving me the CNAME and value which I put into cloudflare.. Now it's all setup, but the site won't resolve. I have the certificates on AWS issued, BUT cloudflare is still saying this:Add an A, AAAA, or CNAME record for www so that www.mysite.com will resolve.Add an A, AAAA, or CNAME record for your root domain so that mysite.com will resolve.I only have the two CNAME records and TXT record on cloudflare. The problem is, I have no idea how to get the IPv4 address for my AWS site, which is required to add an A record on cloudflare:| Type A | Name (required), Use @ for root | IPv4 address (required) |I should also add I have done this before somehow on my other basic AWS S3 site and there is an IPv4 address on the cloudflare for that, and I don't think I remember ever finding it or adding it manually. How did it get there? And how can I get this A record IP address on cloudflare for my new site?FollowComment"

Answer: "2Accepted AnswerHi ThereYou do not need to create an A record.  You create CNAME records to point to the bucket endpoint.  Have you checked the bucket public acces and bucket policy to ensure Cloudflare has access to it?See https://support.cloudflare.com/hc/en-us/articles/360037983412-Configuring-an-Amazon-Web-Services-static-site-to-use-CloudflareI applied for the certificate on AWS Certificate Manager, giving me the CNAME and value which I put into cloudflareThe CNAME that you were given when you generated the certificate in ACM was for validation of domain ownership only.  It does not route traffic for your website.  See https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.htmlCommentShareEXPERTMatt-Banswered 7 months agoEXPERTTushar_Jreviewed 7 months agocodemeasandwich 7 months agolegend! i've got it workingShare"


Question: Storage Gateway Recycle Bin

"Has anyone found an easier way to recover accidentally deleted objects in Storage Gateway? Our organization uses Storage Gateway as network storage drive and I'm anticipating someone will unintentionally delete a folder or files. What might be the easiest way to recover that data without using CLI or other scripting?My thought was to create another mirror S3 bucket that is a one way backup of the production storage gateway S3 bucket. I'd include intelligent-tiering to move objects older than say 90 days to cold storage or outright delete them. This bucket would be used as the recycle bin in case objects or folders were deleted in the production bucket. This would allow me a clean and user friendly window to recover these objects/folders.You might ask why not recover the objects or folders using CLI or other methods? Well, I'm not a pro AWS admin and only superficially support the services for data storage and management for my company.Also, flipping the versioning view on does allow me to see delete markered objects in AWS console, but it's messy and recovering deeply nested objects or folders seem to be difficult with the console.FollowComment"

Answer: "0Versioning is the easiest and most straightforward option.  Since you already evaluated and chose not to use versioning, your approach is a good next option.  One other possible solution would be considering a switch from S3 FGW to FSx file gateway, which has a better integration of versioning, especially if your users are operating in Windows environments.CommentShareAWSBobSanswered a year ago"


Question: Component version doesn't exist in the AWS cloud

"I have deleted the component from AWS cloud, from local device, and built another device in another region as well, but it shows device unhealthy, and showing error like this.... . Can anyone tell the reason behind this.Thank youNikFollowComment"

Answer: "0Accepted AnswerHi Nik,did you create your component in the other AWS Region? Greengrass components are regional resources that must be created in every region where you want to use them.Is your component showing up under My components? You can also use list-components and list-component-versions with the AWS CLI.Cheers,PhilippCommentSharePhilipp Sanswered 3 months agoNik 3 months agoCan you tell me that how can I delete this components using aws-cliThank you PhilippSharePhilipp S 3 months agoYou can use the delete-component API. To delete a component you provide the component arn. You can find the arns of your components with the list-components command.ShareNik 3 months agoThank you Philipp, but I think, it’s different error because it has no ARN, so how can i delete it, I tried but it shows…..is not a valid ARN.SharePhilipp S 3 months agoCan you find your component with list-components? As arn you need to provide the arn including version, for exampel arn:aws:greengrass:AWS_REGION:AWS_ACCOUNT:components:com.example.learndevice:versions:YOUR_VERSIONShareNik 3 months agoNo, I cannot find because it has no ARN. That's because I confused about this error.Share0Hey Nik,It shows that error because you deleted the component on Iot Core (hence it tells you it can not find it because it was deleted). If your device is unhealthy, use the aws.greengress.Cli greengrass-cli component list and check which component is broken or failing which would cause it to report to Iot core as unhealthy, also check the logs on your device which will give you more insights as to what might have gone wrong. Try creating a new deployment adding or removing the components you want it to have and the device status should update.Cheers,NelsonCommentShareochoanelanswered 3 months ago"


Question: I'm trying to do a partial string match on a inner join

"Hii,I'm trying to do an innor join on a substring in athena. The substring of the barcode (example: 3SOLGH3413663) is the partycode. And in the partycodelijst_nanette there is a corresponding name (partycode = OLGH klantnaam = OLGHEXAMPLE). So I want to join those databases. But I can't figure out how to use the like operator in this way. Could somebody help me?SELECT"week"("a"."waarneming_waarndt") "week", "a"."barcd" "barcode", SUBSTRING("a"."barcd", 3, 4) AS "partycode", "b"."first_klantnaam" "klantnaam"FROM(("collo_bup_nrs"."nrs" "a"LEFT JOIN "retaildcc"."partycodelijst_nanette" "b" ON ("b"."partycode" LIKE '%' + "a"."barcd" LIKE '%'+"b"."partycode"+'%')FollowComment"

Answer: "1Accepted AnswerAs far as I understood, your use case is to join two tables where in the condition for join is only if a part of the column's data is equal to the data of another column in the other table. If this is what you wanted to achieve, then I think you can directly make use of the substr() string function. Please note that the the correct string function supported by Athena is SUBSTR() but not SUBSTRING(). As you might already know, Athena uses presto in the backend so the supported string functions can be found here.If you already know the position of the partycode in your barcode, then I think you can directly make use of the SUBSTR() method instead of LIKE. By this I mean that, in the ON clause of your statement you can make use of SUBSTR() to get the partycode and then compare it directly with the partycode column data of the other table. Your ON clause would look something like this:SUBSTR("a"."barcd", 3, 4) = "b"."partycode"If you need, you can find the other presto functions here.I hope that this will be able to help your use case.CommentShareSUPPORT ENGINEERChaituanswered 8 months agoEXPERTFabrizio@AWSreviewed 8 months ago0The first thing I'd like to mention and the most important is that you shouldn't do (A like B like C).  You should do ((A like B) and (B like C)).  I don't think stringing likes is a good practice.The second thing I'd like to mention, and it may not be a problem at all since you are using aliases, is that maybe you should rename partycode when you use it here:  SUBSTRING("a"."barcd", 3, 4) AS "partycode".  Maybe call it partycode2 so it's unique.  Just a thought.CommentSharejschwar313answered 8 months ago"


Question: Sign in into re:Post from a CLI assumed session

"Would be great if re:Post team could provide docs for how to sign in from CLI into re:Post with an automatic redirect.I'm using aws-vault which can assume a role, and create a valid session. And I know the pre-signed AWS console URLs have the redirect capability.So I think this should be possible?I just want to execute:aws-vault login repostAnd be taken to this site, with a logged-in session.FollowComment"


Question: Using aws cli and boto3 we were not able to get the details of schedule in crawlers which is of type on demand or any other

While using aws cli or boto3 python for get crawlers we were not able to get schedule details which is on demand or scheduled detailsFollowComment

Answer: 0You will only receive schedule if your crawler is of type scheduledCommentSharerePost-Azamanswered 7 months ago


Question: SCIM known limitations roadmap

"Currently, the IAM Identity Center SCIM implementation supports only a subset of the SCIM specifications (known limitations).Is there any roadmap on providing a full compliant SCIM service?There are several scim libraries which can not be used with AWS SCIM due to these limitations.Desired short term actions:groups cannot be specified with createUser request. This blocks a lot of integrationsadd putGroup apiWhen adding some standard fields like display when using api, violates the AWS SCIM schema, and requests fail.ThanksFollowComment"


Question: Linux OS networking bug in Elastic Beanstalk AMI with Tomcat & Corretto

"We use AWS Elastic Beanstalk with an Amazon AMI with Tomcat & Corretto running on Amazon Linux 2  (aws-elasticbeanstalk-amzn-2.0.20220316.64bit-eb_tomcat85corretto8_amazon_linux_2-hvm-2022-03-29T20-48) and are running into an OS networking bug when Tomcat is under load.  The result of this bug are that TCP connections from clients connect but timeout while the server is under load.The networking bug is due to a race condition in the TCP stack which is fixed in Linux 5.10 kernels.  A description and diff of the bug can be found in this commit.  From the description of this bug it looks like this race condition affects all TCP networking and is not specific to Tomcat, but manifests more often under load.Currently, as far as I can tell, all the latest Amazon AMIs for Elastic Beanstalk for Tomcat or Corretto are using a 4.14 kernel. The AMI which we are using has a kernel of 4.14.268-205.500.amzn2.x86_64.  I have been able to reproduce the bug on this AMI using the sample server code in the Ubuntu bug report, which is independent of Tomcat.I have also tried reproing the bug on newer versions of Amazon Linux 2 (AMI amzn2-ami-kernel-5.10-hvm-2.0.20220419.0-x86_64-gp2) which are using a 5.10.109-104.500.amzn2.x86_64 kernel, but have not been able to repro the bug on this kernel.We would prefer not to have to create our own AMI for using Elastic Beanstalk, but were wondering if and when there will be an update to the Amazon Elastic Beanstalk AMI's which incorporate this OS bug fix since this is affecting the reliability of networking under load?FollowComment"

Answer: "0Hi,you can use a .ebextension or hooks to install the 5.10 kernel through the AL2 extra repos, while keeping the standard AMI.see: https://aws.amazon.com/premiumsupport/knowledge-center/amazon-linux-2-kernel-upgrade/CommentShareDanielanswered 8 months ago"


Question: Granting permissions in AWS lake formation

Im not able grant permission even after adding all the required permissions to role in aws lakeformation.FollowComment