Question: No value to graph for a metric filter which should match hundreds of lines based on pattern test

"Hi,I find results in log insights using the following query:fields @timestamp, @message | filter log like "GET /espace-client/selfcare" | sort @timestamp desc | limit 20The results I find are like:172.17.82.30 - - [29/Mar/2022:17:08:54 +0200] "GET /espace-client/selfcare/contract/<redacted> HTTP/1.1" 200 4891 "<redacted referrer>" "Mozilla/5.0 (Linux; Android 11; SM-A515F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.88 Mobile Safari/537.36"The pattern I use in my metric is:[remote_addr, user, remote_user, timestamp, location="GET /espace-client/selfcare/contract/*", response_code=2*, body_bytes_sent, referrer, user_agent]When I use the Test pattern feature in the metric filter creation, the above log line is matched correctly yet, when I try to create a line graph widget (metric value = 1 and default value = 0, no use of dimensions). The graph is definitely flat on a value of zero. I can tell that I have hundreds of match in log insights during one hour though. I looked for previous questions but to no avail.What is wrong with what I am doing?Thank you for your help.FollowComment"

Answer: "1Accepted AnswerHi Vina,Ah! Yeah, the space delimited log data being embedded as a JSON field would render the space delimited metric filter being used previously as unworkable. CloudWatch Logs will just see the log data in the "log" JSON field as one long string that would not be able to be parsed any further, as you found in your own test.But luckily, we can do some simple string matching against the JSON field using wildcards! I set up and tested the following metric filter and tested revised log data based on what you've provided:{$.log = "*GET /espace-client/selfcare/contract/*" && $.log = "* 200 *"}This metric filter will behave similarly to the previous metric filter, in that it will look at the log field string and match only log data that contain the specific URI path as well as a "200" response. Note that a space is necessary before and after the "200" term in order to not inadvertently match against the UTC + 2 timezone the logs appear to be generated in. It is also technically possible that if a term of " 200 " appears elsewhere in the log for a request going to the "GET /espace-client/selfcare/contract/*" location, it could trigger this metric filter, but overall, I believe this should be specific enough to fit your use case.Below are the sample logs I sent to the log group and the results:Match{"log":"172.17.82.30 - - [29/Mar/2022:17:08:55 +0200] \"GET /espace-client/selfcare/contract/URIPath HTTP/1.1\" 200 4891 \"http://www.google.com\" \"Mozilla/5.0 (Linux; Android 11; SM-A515F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.88 Mobile Safari/537.36\""}Did not match due to response{"log":"172.17.82.30 - - [29/Mar/2022:17:08:56 +0200] \"GET /espace-client/selfcare/contract/URIPath HTTP/1.1\" 301 4891 \"http://www.google.com\" \"Mozilla/5.0 (Linux; Android 11; SM-A515F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.88 Mobile Safari/537.36\""}Did not match due to URI{"log":"172.17.82.30 - - [29/Mar/2022:17:08:57 +0200] \"GET /espace-client/selfcare/URIPath HTTP/1.1\" 200 4891 \"http://www.google.com\" \"Mozilla/5.0 (Linux; Android 11; SM-A515F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.88 Mobile Safari/537.36\""}Match{"log":"172.17.82.30 - - [29/Mar/2022:17:08:58 +0200] \"GET /espace-client/selfcare/contract/URIPath/URIPath2 HTTP/1.1\" 200 4891 \"http://www.google.com\" \"Mozilla/5.0 (Linux; Android 11; SM-A515F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.88 Mobile Safari/537.36\""}Hope this helps!CommentShareSUPPORT ENGINEERJustin_Banswered a year ago0Hi there, thanks for reaching out!So, one thing I'd like to clarify is that when it comes to both Logs Insights queries, and when testing metric filter patterns in the process of creating a metric filter on a log group, the queries and the filter tests against log data are performed against log data that is already present in the log group. But after the metric filter is created, the metric filter pattern will only match against new incoming logs. Metrics won't be generated for past log data already in the log group.You did note that the metric filter metric graph does report a series of 0's, indicating that it detects incoming log data to the log group, but none of the new log data that has been received since the creation of the metric filter has matched your filter pattern of:[remote_addr, user, remote_user, timestamp, location="GET /espace-client/selfcare/contract/*", response_code=2*, body_bytes_sent, referrer, user_agent]To be sure, I used the above metric filter on a test log group and sent log data to that log group based on the sample log you provided. I found that the metric filter did match the log data and successfully generated metric data values of 1 per log message. Otherwise, it did not match log data I sent that contained a non-matching location value or response code.With regard to the discrepancy between the metric filter values and the results you get in Logs Insights, I see that your query against the log data is somewhat more broad than the metric filter pattern. The Insights query used will match any log message that contains the string "GET /espace-client/selfcare" whereas the metric filter pattern will only match log message that matches location value "GET /espace-client/selfcare/contract/*" AND has a response code of "2XX".One thing you can test to verify that log data that has arrived AFTER the creation of your metric filter is indeed not matching the metric filter is to use an Insights query that would match the same log messages as the metric filter. An example of such an Insights query is:fields @timestamp | parse @message "* * * [*] \"*\" * * \"*\" \"*\"" as remote_addr, user, remote_user, timestamp, location, response_code, body_bytes_sent, referrer, user_agent| filter location like /GET \/espace-client\/selfcare\/contract*/ and response_code like /2*/| sort @timestamp desc When running this query, set the time frame being searched to a range of time after the creation of the metric filter. If you receive no matches, it's possible that the incoming requests contain either a different location value or are receiving a response code other than 2XX.CommentShareSUPPORT ENGINEERJustin_Banswered a year ago0Hi Justin,Thanks a lot for your answer. Yes I know that the filter is not matching logs retroactively. it has been created two days ago and still no match :)The search on log insight does not give any result. Yet, from your log insight test example I might have understood that the filter expects @message to be a flat space delimited string (?) but in my case it seems to be a json object so maybe that's the catch. Below is an example of event that is returned by a broader log insight search:@message {"log":"172.17.82.30 - - [31/Mar/2022:15:14:44 +0200] \"GET /espace-client/selfcare/contract/<redacted> HTTP/1.1\" 200 8618 \"<redacted>\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Safari/605.1.15\"\n" <rest of messsage is redacted> If its the case, I dont know how to target the @message.log property of the event in a custom metric filter which should parse one property (the log property of @message) of the json only. Something like below does not work though:{$.log = [remote_addr, user, remote_user, timestamp, location="GET /espace-client/selfcare/contract/*", response_code=2*, body_bytes_sent, referrer, user_agent]} AFAIK, this is a complete standard log event coming from EKS, we did not do anything to customize the event format.Thanks again for helping!Vina.CommentShareAWS-User-1535876answered a year ago0Hi Justin,Thank you. The following pattern works (I have added a "\"<space>" in your suggestion in order to make sure not to match requests which request byte size is 200 :) ) {$.log = "*GET /espace-client/selfcare/contract/*" && $.log = "*\" 200 *"}Cheers,Vina.CommentShareAWS-User-1535876answered a year ago"


Question: CloudFront - Internal ELB Origin

"Hi all,By Documentation to be able to use ELB as an Origin for a CloudFront Distribution it should be internet-facing.the question is why CloudFront is showing also Internal Load Balancers between the list of possibile Origin Domains that can be selected during the creation of a new Origin ?there is a way to use CloudFront with Private resources ?FollowComment"

Answer: "0Accepted AnswerNo, you can't use an internal-only load balancer as an origin for CloudFront.Why does it show in the list? Because the console is retrieving a list of all load balancers but there's no particular flag that says "this is an internal load balancer" versus "this is an internet-facing load balancer". That's determined by the subnet, route tables and public IP address assignment.CommentShareEXPERTBrettski-AWSanswered 6 months agoEXPERTAWS-User-Nitinreviewed 6 months ago"


Question: HOWTO make sure EFA is setup correctly

"I follow the guide https://www.hpcworkshops.com/07-efa/01-create-efa-cluster.html to create a HPC cluster, and running the MPI hello world application(git clone https://github.com/mpitutorial/mpitutorial).  I would like to make sure EFA is setup correctly, then I follow the steps in https://www.youtube.com/watch?v=Wq8EMMXsvyo&t=9s to verify EFA with OpenMPi and IntelMPI.The output of IntelMPI looks fine, it indicates EFA is running:[ec2-user@ip]$ cat hello-world-job_1.outLoading intelmpi version 2021.4.0[0] MPI startup(): Intel(R) MPI Library, Version 2021.4 Build 20210831 (id: 758087adf)[0] MPI startup(): Copyright (C) 2003-2021 Intel Corporation. All rights reserved.[0] MPI startup(): library kind: release[0] MPI startup(): libfabric version: 1.13.0-impi[0] MPI startup(): libfabric provider: efa[0] MPI startup(): File "/opt/intel/mpi/2021.4.0/etc/tuning_skx_shm-ofi_efa_100.dat" not found[0] MPI startup(): Load tuning file: "/opt/intel/mpi/2021.4.0/etc/tuning_skx_shm-ofi_efa.dat"[0] MPI startup(): Rank Pid Node name Pin cpu[0] MPI startup(): 0 10425 libhe-dy-c5n18xlarge-1 {0}[0] MPI startup(): 1 10404 libhe-dy-c5n18xlarge-2 {0}Hello world from processor libhe-dy-c5n18xlarge-2, rank 1 out of 2 processorsHello world from processor libhe-dy-c5n18xlarge-1, rank 0 out of 2 processorsHowever, the output of OpenMPI job doesn't indicate EFA is running:[ec2-user@ip]$ cat hello-world-job_2.out[libhe-dy-c5n18xlarge-1:11319] mca: base: components_register: registering framework mtl components[libhe-dy-c5n18xlarge-1:11319] mca: base: components_register: found loaded component ofi[libhe-dy-c5n18xlarge-1:11319] mca: base: components_register: component ofi register function successful[libhe-dy-c5n18xlarge-1:11319] mca: base: components_open: opening mtl components[libhe-dy-c5n18xlarge-1:11319] mca: base: components_open: found loaded component ofi[libhe-dy-c5n18xlarge-1:11319] mca: base: components_open: component ofi open function successful[libhe-dy-c5n18xlarge-2:11203] mca: base: components_register: registering framework mtl components[libhe-dy-c5n18xlarge-2:11203] mca: base: components_register: found loaded component ofi[libhe-dy-c5n18xlarge-2:11203] mca: base: components_register: component ofi register function successful[libhe-dy-c5n18xlarge-2:11203] mca: base: components_open: opening mtl components[libhe-dy-c5n18xlarge-2:11203] mca: base: components_open: found loaded component ofi[libhe-dy-c5n18xlarge-2:11203] mca: base: components_open: component ofi open function successful[libhe-dy-c5n18xlarge-1:11319] mca:base:select: Auto-selecting mtl components[libhe-dy-c5n18xlarge-1:11319] mca:base:select:(  mtl) Querying component [ofi][libhe-dy-c5n18xlarge-1:11319] mca:base:select:(  mtl) Query of component [ofi] set priority to 25[libhe-dy-c5n18xlarge-1:11319] mca:base:select:(  mtl) Selected component [ofi][libhe-dy-c5n18xlarge-1:11319] select: initializing mtl component ofi[libhe-dy-c5n18xlarge-1:11319] mtl_ofi_component.c:366: mtl:ofi:provider: rdmap0s6-rdm[libhe-dy-c5n18xlarge-2:11203] mca:base:select: Auto-selecting mtl components[libhe-dy-c5n18xlarge-2:11203] mca:base:select:(  mtl) Querying component [ofi][libhe-dy-c5n18xlarge-2:11203] mca:base:select:(  mtl) Query of component [ofi] set priority to 25[libhe-dy-c5n18xlarge-2:11203] mca:base:select:(  mtl) Selected component [ofi][libhe-dy-c5n18xlarge-2:11203] select: initializing mtl component ofi[libhe-dy-c5n18xlarge-2:11203] mtl_ofi_component.c:366: mtl:ofi:provider: rdmap0s6-rdm[libhe-dy-c5n18xlarge-1:11319] select: init returned success[libhe-dy-c5n18xlarge-1:11319] select: component ofi selected[libhe-dy-c5n18xlarge-2:11203] select: init returned success[libhe-dy-c5n18xlarge-2:11203] select: component ofi selectedHello world from processor libhe-dy-c5n18xlarge-1, rank 0 out of 2 processorsHello world from processor libhe-dy-c5n18xlarge-2, rank 1 out of 2 processors[libhe-dy-c5n18xlarge-1:11319] mca: base: close: component ofi closed[libhe-dy-c5n18xlarge-1:11319] mca: base: close: unloading component ofi[libhe-dy-c5n18xlarge-2:11203] mca: base: close: component ofi closed[libhe-dy-c5n18xlarge-2:11203] mca: base: close: unloading component ofiBelow is the openmpi job details:[ec2-user@ip]$ which mpirun/opt/amazon/openmpi/bin/mpirun[ec2-user@ip]$ cat openmpi_job#!/bin/bash#SBATCH --job-name=hello-world-job#SBATCH --ntasks=2 --nodes=2#SBATCH --output=%x_%j.outmpirun ./mpi_hello_world[ec2-user@ip]$export OMPI_MCA_mtl_base_verbose=100[ec2-user@ip]$sbatch openmpi_jobAny suggestions why running OpenMPI job doesn't indicate EFA is running?FollowComment"

Answer: "0Hello, thank you for your post. Before you run the mpirun command, please make sure you have add the EFA library to the path. Depending upon which operating sytem you are using, you may use one of the following commands[1].Amazon Linux, Amazon Linux 2, RHEL , and CentOS$ export LD_LIBRARY_PATH=/opt/amazon/efa/lib64:$LD_LIBRARY_PATHUbuntu 18.04/20.04$ export LD_LIBRARY_PATH=/opt/amazon/efa/lib:$LD_LIBRARY_PATHReferences:[1] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/efa-start-nccl-base.html#nccl-start-base-testsCommentShareSUPPORT ENGINEERAWS_SamManswered a year agorePost-User-2721712 a year agoThanks for your reply@AWS_SamMI am using Amazon Linux 2, the output is still same without EFA indicate after set LD_LIBRARY_PATH=/opt/amazon/efa/lib64:$LD_LIBRARY_PATH[ec2-user@ip code]$ export LD_LIBRARY_PATH=/opt/amazon/efa/lib64:$LD_LIBRARY_PATH[ec2-user@ip]$ export OMPI_MCA_mtl_base_verbose=100[ec2-user@ip]$ sbatch submit_job_openmpiSubmitted batch job 5[ec2-user@ip]$ cat hello-world-job_5.out[libhe-dy-c5n18xlarge-2:11589] mca: base: components_register: registering framework mtl components[libhe-dy-c5n18xlarge-2:11589] mca: base: components_register: found loaded component ofi[libhe-dy-c5n18xlarge-2:11589] mca: base: components_register: component ofi register function successful[libhe-dy-c5n18xlarge-2:11589] mca: base: components_open: opening mtl components[libhe-dy-c5n18xlarge-2:11589] mca: base: components_open: found loaded component ofi[libhe-dy-c5n18xlarge-2:11589] mca: base: components_open: component ofi open function successfulShare0Thanks for your reply@AWS_SamMThe output is still same without EFA indicate after set LD_LIBRARY_PATH=/opt/amazon/efa/lib64:$LD_LIBRARY_PATH[ec2-user@ip code]$ export LD_LIBRARY_PATH=/opt/amazon/efa/lib64:$LD_LIBRARY_PATH[ec2-user@ip]$ export OMPI_MCA_mtl_base_verbose=100[ec2-user@ip]$ sbatch submit_job_openmpiSubmitted batch job 5[ec2-user@ip]$ cat hello-world-job_5.out[libhe-dy-c5n18xlarge-2:11589] mca: base: components_register: registering framework mtl components[libhe-dy-c5n18xlarge-2:11589] mca: base: components_register: found loaded component ofi[libhe-dy-c5n18xlarge-2:11589] mca: base: components_register: component ofi register function successful[libhe-dy-c5n18xlarge-2:11589] mca: base: components_open: opening mtl components[libhe-dy-c5n18xlarge-2:11589] mca: base: components_open: found loaded component ofi[libhe-dy-c5n18xlarge-2:11589] mca: base: components_open: component ofi open function successful[libhe-dy-c5n18xlarge-1:11601] mca: base: components_register: registering framework mtl components[libhe-dy-c5n18xlarge-1:11601] mca: base: components_register: found loaded component ofi[libhe-dy-c5n18xlarge-1:11601] mca: base: components_register: component ofi register function successful[libhe-dy-c5n18xlarge-1:11601] mca: base: components_open: opening mtl components[libhe-dy-c5n18xlarge-1:11601] mca: base: components_open: found loaded component ofi[libhe-dy-c5n18xlarge-1:11601] mca: base: components_open: component ofi open function successful[libhe-dy-c5n18xlarge-2:11589] mca:base:select: Auto-selecting mtl components[libhe-dy-c5n18xlarge-2:11589] mca:base:select:(  mtl) Querying component [ofi][libhe-dy-c5n18xlarge-2:11589] mca:base:select:(  mtl) Query of component [ofi] set priority to 25[libhe-dy-c5n18xlarge-2:11589] mca:base:select:(  mtl) Selected component [ofi][libhe-dy-c5n18xlarge-2:11589] select: initializing mtl component ofi[libhe-dy-c5n18xlarge-2:11589] mtl_ofi_component.c:366: mtl:ofi:provider: rdmap0s6-rdm[libhe-dy-c5n18xlarge-1:11601] mca:base:select: Auto-selecting mtl components[libhe-dy-c5n18xlarge-1:11601] mca:base:select:(  mtl) Querying component [ofi][libhe-dy-c5n18xlarge-1:11601] mca:base:select:(  mtl) Query of component [ofi] set priority to 25[libhe-dy-c5n18xlarge-1:11601] mca:base:select:(  mtl) Selected component [ofi][libhe-dy-c5n18xlarge-1:11601] select: initializing mtl component ofi[libhe-dy-c5n18xlarge-1:11601] mtl_ofi_component.c:366: mtl:ofi:provider: rdmap0s6-rdm[libhe-dy-c5n18xlarge-2:11589] select: init returned success[libhe-dy-c5n18xlarge-2:11589] select: component ofi selected[libhe-dy-c5n18xlarge-1:11601] select: init returned success[libhe-dy-c5n18xlarge-1:11601] select: component ofi selectedHello world from processor libhe-dy-c5n18xlarge-1, rank 0 out of 2 processorsHello world from processor libhe-dy-c5n18xlarge-2, rank 1 out of 2 processors[libhe-dy-c5n18xlarge-2:11589] mca: base: close: component ofi closed[libhe-dy-c5n18xlarge-2:11589] mca: base: close: unloading component ofi[libhe-dy-c5n18xlarge-1:11601] mca: base: close: component ofi closed[libhe-dy-c5n18xlarge-1:11601] mca: base: close: unloading component ofiCommentSharerePost-User-2721712answered a year ago"


Question: Assistance with CloudFormation and CloudWatch Agent

"Working on some CloudFormation to install and configure the CloudWatch Agent. However, I'm having trouble writing this literal file that includes variables so I can use it for CloudWatch. Towards the bottom of the code, I need the ${aws:ImageId} written as is and not replaced by a value in CloudFormation.I've tried removing !Sub, but it results in an empty string. I've tried using $!{aws:ImageId} and ${!aws:ImageId} but CloudFormation removes the $, resulting in a string with {aws:ImageId} or it results in a blank value.Two other thoughts - save this on a public S3 bucket and pull it down or create a new image with the file and CloudWatch already installed. This is for a hands-on lab where I ONLY have access to CloudFormation and other AWS services,*** and the accounts are ephemeral.***Running out of ideas, so I'm posting here for some help.  Step03EC2Instance:    Type: AWS::EC2::Instance    Properties:      InstanceType: t3.micro      IamInstanceProfile:        Ref: InstanceProfile      ImageId:        Ref: LatestAmiId      SecurityGroupIds:        - Ref: ProductionSecurityGroup      SubnetId:         Ref: PrivateSubnetAz2      UserData:        Fn::Base64:          !Sub |            #!/bin/bash            sudo hostname prd-app-cache-002            yum update -y            yum install -y amazon-cloudwatch-agent            echo "Writing CloudWatch Agent configuration file"            sudo cat << EOF > /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json            {              "agent": {                "metrics_collection_interval": 10,                "run_as_user": "cwagent"              },              "metrics": {                "namespace": "prd-app-cache-002",                "aggregation_dimensions": [["InstanceId"]],                "append_dimensions": {                  "ImageId": "${aws:ImageId}",                  "InstanceId": "${aws:InstanceId}",                  "InstanceType": "${aws:InstanceType}"                },FollowComment"

Answer: "0You can either place amazon-cloudwatch-agent.json in S3 and get it from aws s3 cp, etc., or you can set it in the Systems Manager parameter store and get the configuration.https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-on-EC2-Instance-fleet.html#start-CloudWatch-Agent-EC2-fleetIncidentally, if you store the data in the Systems Manager parameter store, you can start CloudWatch Agent with the following command.sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c ssm:configuration-parameter-store-nameCommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: What are some caveats when considering the choice of creating a separate DynamoDB table versus a GSI on the original table?

"I have a use-case for a custom ecommerce website where only 5% of the products are in stock at a given time, and in-stock is the most popular search, but users can also search for out-of-stock items to be notified when they become in stock. (If this sounds weird to you, think about a site like Zillow where most of the homes that exist in the world are not currently for sale)I want to push the envelope on this and see if I can use Dynamodb despite not being the best fit-for-purpose because (reasons).I considered creating a GSI where "InStock" is a nullable field, so the index queries for the most popular use-case will only look at a fraction of the data.Then I realized GSI's can't do ConsistentReads and they cost the same as a Table.So why bother with a GSI, should I create a separate table for InStock items?There is the complexity of having to delete items from the other table as they change status. Is that the only reason to avoid it?FollowComment"

Answer: "0Well avoiding duplicate redundant data is always a thing :-) Why? Because when there are updates to data you have to maintain the redundant copies.If you use the attribute projections ALL on the GSI you let DynamoDB worry about the housekeeping.ConsistentReads are mainly a worry when you write and immediately read back data from the table/index.So the case to worry about:You write InStock=false to a recordYou read all items with inStock=true from the GSIThere could be a short period of time where you could get an item that is actually out of stock. Does not have to be a problem.In single table design you could add separate records to the same table:PartitionKey - InStockSortKey - UniqueIdOfItemThese records would never be updated but only inserted/deleted.You query them to get (a page) the UniqueIdOfItem if the items in stock.Using that list of ids you can fetch the details of the itemsRegards, JaccoCommentShareJaccoPKanswered 4 months ago"


Question: Can't SSH to EC2 instance

"Hello, I'm encountering an issue with an SSH to EC2 instance that I was unable to resolve. When trying the Private IPv4 addresses I'm getting  "Connection timed out." When trying the Public IPv4 address I'm getting "Permission denied (publickey)." The instances' security group has an inbound rule permitting SSH access using TCP protocol through my IP address and I tried also with a rule allowing access via 0.0.0.0/0. My laptop's firewall should allow for outgoing calls ("Default outgoing policy changed to 'allow'"). I've checked the network gateway connectivity as instructed here and used a user data script as instructed here. I did not experience any such issues in the past but did not use my account since March this year. I'm unable to connect via my laptop (Ubuntu 22.04.1 LTS) or via "EC2 Instance Connect."Is there any idea that I did not try which may help me connect to the instance?FollowComment"

Answer: "2Hi,The private ipv4 address is limited to be used with the AWS VPC where your instance resides, we cannot connect to that IP directly from outside the AWS network hence the timeout error. To connect to an instance we need to use the public IP address.Assuming that you have created a key pair during the EC2 instance creation. The error "Permission denied (publickey)" indicates that the connection was denied due to the authentication failure with the private key file provided while trying to connect to the instance.First, check if you are using the correct key file to authenticate the SSH connection and try connecting to the network -> https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstancesLinux.htmlAdditionally, for EC2-Connect to work properly you need to allow inbound SSH traffic from the EC2 Instance Connect IP range in addition to your IP address. Please refer to the Configure network access to an instance section -> https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-set-up.htmlCommentShareBisinaanswered 14 days agorePost-User-2017171 13 days agoMany thanks Bisina, I've set up a new instance and key pair to test your suggestion and can now SSH to my instanceSharerePost-User-2017171 12 days agoUnfortunately, I'm still getting permission issues. I was able connect to a new instances with a new set of key pairs, install software, but when trying to connect later, via my laptop or CloudShell I got:ssh -i ~/.aws/kp.pem ubuntu@ec2-xx-xxx-xxx-xxx.compute-1.amazonaws.comubuntu@ec2-xx-xxx-xxx-xxx.compute-1.amazonaws.com: Permission denied (publickey).[cloudshell-user@ip-10-6-111-134 ~]$ ssh -i kp.pem ubuntu@ec2-54-146-178-153.compute-1.amazonaws.comssh: connect to host ec2-xx-xxx-xxx-xxx.compute-1.amazonaws.com port 22: Connection timed outThe Inbound rules allow for access from anywhere for testing purposes.When launching yet another machine with another key pair, I am able to connect.Incidentally, even when I was able to access the machine, I was frequently disconnected with a "broken pipe" message.Share1In addition to the two docs that you have linnked to, and the docs linked in other answers, there is this one that deals exactly with the error message that you are getting - Permission denied (publickey) https://repost.aws/knowledge-center/ec2-linux-fix-permission-denied-errorsIs any of the advice in this document of any assistance?CommentShareRWCanswered 13 days agorePost-User-2017171 12 days agoHi RWC, I checked the methods proposed in the issue you referred me to and tried method 4 which is more readily accessible than the others. I was able to repair SSH permissions with a user data script but when I deleted it (to prevent data deletion in the next reboot), the issue resumed. The other methods are more complex than trying a different a different cloud provider.Share1Can you try connecting with CloudShell?  It's the little prompt icon in the top right:https://aws.amazon.com/cloudshell/CommentSharejurajfoxanswered 14 days ago"


Question: How to use bolt protocol in java to directly execute cypher query in AWS Neptune Service

"I am following the following article to query cypher query on the Neptune instance:- Cypher Using BoltI want to execute the cypher query directly on the AWS Neptune Instance without translating it to the gremlin.Following is the error I am getting, despite following the code as shown in the documentation."""Exception in thread "main" org.neo4j.driver.exceptions.ServiceUnavailableException: Failed to establish connection with the serverat org.neo4j.driver.internal.util.Futures.blockingGet(Futures.java:143)Caused by: org.neo4j.driver.internal.shaded.io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 485454502f312e31203430302042616420526571756573740d0a5365727665723a20617773656c622f322e30 (trimmed)"""I am also putting the sample java code for your reference:-public class TestImpl {    private static final String ACCESS_KEY = "XYZ";    private static final String SECRET_KEY = "ABC";    private static final String SERVICE_REGION = "AAAA";    private static final Gson GSON = new Gson();    public static void main(String[] args) {        String URL = "bolt://URL:PORT";        final Driver driver =            GraphDatabase.driver(URL, AuthTokens.basic("username", getSignedHeader()), getDefaultConfig());        String query = "MATCH (ruleSet:RULE_SET) " +            "WHERE ruleSet.refId = \"aws-iam-best-practices\" " +            "RETURN ruleSet.refId as refId, ruleSet.name as name, collect(ruleSet.ruleIds) as ruleIds";        System.out.println(query);        final Record rec = driver.session().run(query).list().get(0);        System.out.println(rec.get("refId").asNode().toString());    }    private static Config getDefaultConfig() {        return Config.builder()            .withConnectionTimeout(30, TimeUnit.SECONDS)            .withMaxConnectionPoolSize(1000)            .withDriverMetrics()            .withLeakedSessionsLogging()            .withEncryption()            .withTrustStrategy(Config.TrustStrategy.trustSystemCertificates())            .build();    }    private static String getSignedHeader() {        // If you are using permanent credentials, use the BasicAWSCredentials access key and secret key        final BasicAWSCredentials permanentCreds = new BasicAWSCredentials(ACCESS_KEY, SECRET_KEY);        final AWSCredentialsProvider creds = new AWSStaticCredentialsProvider(permanentCreds);        // Or, if you are using temporary credentials, use the BasicSessionCredentials to        // pass the access key, secret key, and session token, like this:        //   final BasicSessionCredentials temporaryCredentials = new BasicSessionCredentials(ACCESS_KEY, SECRET_KEY, AWS_SESSION_TOKEN);        //   final AWSCredentialsProvider tempCreds = new AWSStaticCredentialsProvider(temporaryCredentials);        String signedHeader = "";        final Request<Void> request = new DefaultRequest<Void>("neptune-db"); // Request to neptune        request.setHttpMethod(HttpMethodName.GET);        request.setEndpoint(URI.create("https://NeptuneServiceURL"));        // Comment out the following line if you're using an engine version older than 1.2.0.0        request.setResourcePath("/openCypher");        final AWS4Signer signer = new AWS4Signer();        signer.setRegionName(SERVICE_REGION);        signer.setServiceName(request.getServiceName());        signer.sign(request, creds.getCredentials());        signedHeader = getAuthInfoJson(request);        return signedHeader;    }    private static String getAuthInfoJson(final Request<Void> request) {        final Map<String, Object> obj = new HashMap<>();        obj.put("Authorization", request.getHeaders().get("Authorization"));        obj.put("HttpMethod", request.getHttpMethod());        obj.put("X-Amz-Date", request.getHeaders().get("X-Amz-Date"));        obj.put("Host", request.getEndpoint().getHost());        // If temporary credentials are used, include the security token in        // the request, like this:        //   obj.put("X-Amz-Security-Token", request.getHeaders().get("X-Amz-Security-Token"));        final String json = GSON.toJson(obj);        return json;    }}Please guide me on what is my mistake in this process. Thanking you in advance for it :).FollowComment"

Answer: 0Hi! It looks like you are trying to use IAM authentication but not following the correct steps for that. BOLT is complaining because the connect is requiring TLS but you aren't hitting a TLS endpoint. Try looking at the example for connecting with IAM here (https://docs.aws.amazon.com/neptune/latest/userguide/access-graph-opencypher-bolt.html#access-graph-opencypher-bolt-java-iam-auth) and see if that helps.CommentShareClarkRicheyanswered 8 months ago


Question: Appstream User pool - Increase Quota

HiHow long does it take for AWS to approve the quota increase for Appstream users? (Basic support plan)ThanksFollowComment

Answer: "2Accepted AnswerIt takes a couple days.User Pools max out at 50 users, and are not recommended for production environments. You should consider using SAML 2.0. There are instructions for many SAML providers.CommentShareJeremy_Sanswered 5 months ago"


Question: Deny EFS actions to all but specific user

"I'm trying to deny EFS actions to all users, except for one specific user(s).When attaching a file system policy to my EFS, using a deny entry with NotPrincipal, I'm not able to access the EFS as I would have expected to.Example file system policy:{    "Sid": "Limit to deployer/CI",    "Effect": "Deny",    "NotPrincipal": {        "AWS": [            "arn:aws:sts::account_id:assumed-role/role_name/my_email@my_domain.com"        ]    },    "Action": [        "elasticfilesystem:DescribeMountTargets",    ],    "Resource": "arn:aws:elasticfilesystem:eu-west-2:account_id:file-system/efs_id"}My expectation would be that my role session would have access to the listed action, but no one else would have access. However, when testing this, even my user is denied access. https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/ suggests that both the  role ARN and assumed-role ARN should be used in this scenario, however when testing this, it does not function.Following the logic used within the blog post, I can create the following:{    "Sid": "Limit to deployer",    "Effect": "Deny",    "Principal": {        "AWS": "*"    },    "Action": [        "elasticfilesystem:DescribeMountTargets"    ],    "Resource": "arn:aws:elasticfilesystem:eu-west-2:account_id:file-system/efs_id",    "Condition": {        "StringNotLike": {            "aws:userId": [                "role_principal_id:my_email@my_domain.com",                "account_id"            ]        }    }}This does appear to work as I intend, however I'd like to understand the reasoning behind the first example not working, because it is much more usable and easily understandable.FollowComment"

Answer: "1Accepted AnswerHi!  This is a good question that goes through the nuances of using a combination of a DENY action with a NotPrincipal.  As an AWS best practice, when using Deny with the NotPrincipal element - if the NotPrincipal elemnt was missing teh ARN of the aWS account that the role belongs to, the policy may explicitly deny access to the AWS account and all entities in that account, which would include your role session and the role.  In some cases as well, assumed-role users cannot have more permissions than their parent role, and roles cannot have more permissions than their parent AWS account.In the bottom example you give, since you are using the aws:userId, the AWS Account ID represents the AWS Account root user and the  "role_principal_id:my_email@my_domain.com" represents the Role Session, which is slightly different than the above.That most likely is why you are seeing unexpected results with the first policy, because it is possible the policy denies access to the AWS account and all entities in that account.  It's not completely clear from AWS documentation.CommentSharejsoncanswered a year agoMattPalmer-HS a year agoThanks - https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notprincipal.html#specifying-notprincipal Actually makes this clear but I guess this is a case of needing to read more.Best practice is to include the account ARN also, otherwise the entire account may be denied. Additionally, if you are attempting to allow a role session, you must also allow the ARN of the role itself - As the order of validation may cause you be denied access.Share0If you wants to allow one specific IAM Role using Role ARN, you should specify the Role ARN as following."Principal": { "AWS": "arn:aws:iam::AWS-account-ID:role/role-name" }The ARN you used in your first policy is not for IAM Role but for Assumed-role session principals. And you missed role-session-name in the ARN. If you wants to specify role session name, you should add role session name as following."Principal": { "AWS": "arn:aws:sts::AWS-account-ID:assumed-role/role-name/role-session-name" }Please refer to AWS docs blow.https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.htmlCommentShareEunsu_Shinanswered a year agoMattPalmer-HS a year agoThanks for the response. I believe in my first example, I am using the role session name - arn:aws:sts::account_id:assumed-role/role_name/my_email@my_domain.com is in this form as my_email@my_domain.com is the name of my session. Looking through the CloudTrail events shows my ARN as this, so I believe I am including the session name, however it does not work as expected.Share0If an IAM policy associated with the user session or with the resource with does not have an explicit ALLOW then it may not work - the IAM policy evaluation logic you have will result in an implicit DENY as the explicit DENY in the policy does not apply. See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallowCommentShareAlex_AWSanswered a year agoMattPalmer-HS a year agoThe IAM policy associated with the role session uses the AdministratorAccess permission policy, so an explicit allow exists. I think if this were the cause of the issue, removing the file system policy would result in my role session being unable to complete the elasticfilesystem:DescribeMountTargets action, whereas this is this is possible following the removal of the file system policyShare"


Question: Client VPN Endpoint Creation - Not Detecting Client Certificate in ACM

"Hi,Running in to an issue where a certificate in ACM is not being recognized as available for usage as a client certificate when attempting to create a client VPN endpoint.Steps to recreate:I followed the directions to create a client and server certificate per this link: https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/authentication-authrization.html#mutualThe steps above seemed to work; there are two new certificates visible in the ACM console.On the Create Client VPN Endpoint console screen under Authentication Information, I select the ARN of the previously imported ACM server certificate as the "Server certificate ARN".Check the "Use mutual authentication" checkboxIn the dropdown for the "Client certificate ARN", the only ACM certificate visible is the server certificate from Step 3. I expected to see and use the client certificate that was uploaded to ACM but it does not appear in the drop-down.Any guidance would be much appreciated.FollowComment"

Answer: "0Accepted AnswerFrom what I recall - this issues comes when "Domain Name" on certificates is empty. Can you please confirm in your ACM if your certificates have appropriate Domain Name ?Edit: To fix it, you need to use FQDN e.g.  ./easyrsa build-client-full client2.example.com nopassThis will generate certificate with correct domain i.e. client2.example.com and that should make it visible in the Client VPN console. I'll provide feedback to the service team as well on this as we should clarify our documentation bit more.CommentShareEXPERTShakeel_Aanswered 4 years ago"


Question: My IAM role is not listed when trying to create a new EC2 instance

"Hi there, I have created an AWS Active Directory and am now trying to create an EC2 Window Server 2012 to connect to the directory/domain. On the configure instance details, I can select the directory quite fine. I then created an IAM role which contained the two managed policies specified. However, no matter what I do, that IAM role will not appear on the list to select! Any ideas please. Thank you kindlyFollowComment"

Answer: "1Okay. I also faced the same issue and the issue seems to be the below,Previously when I create IAM Role from the Console by selecting EC2 or ECS, IAM will create both IAM role and an IAM instance profile.Now ( After new IAM Console, may be from Jan 2022), when I create IAM Role from the Console, it is only creating the IAM role and not the instance profile.I did below from CLI, to overcome this,aws iam create-instance-profile --instance-profile-name ecsInstanceRole --profile <my_profile>aws iam add-role-to-instance-profile --instance-profile-name ecsInstanceRole --role-name  ecsInstanceRole --profile <my_profile>CommentShareKarthikeyan Sundararajananswered a year ago0Does you role have an EC2 service principal listed within the trust policy?Refer to I created an IAM role, but the role doesn't appear in the dropdown list when I launch an instance. What do I do? CommentShareRoBanswered a year agomsutherland25 a year agoThanks, I already looked at this link which just gets even more complicated with commnd line stuff! Surely it is possible to assign the correct managed policies without resorting to command line? It says that you must assign two specific managed policies but gives no clue as to what other managed policies are needed? I am just trying to create a windows server EC2 that can be attached to the AWS Active Directory domain so that I can then manage groups and users. Must it be so complicated? ThanksShareRoB a year agoLook at the Trust Relationships tab on your role. Does it list ec2 as an identity provider?Sharemsutherland25 a year agoI have followed this link:https://docs.aws.amazon.com/directoryservice/latest/admin-guide/launching_instance.htmlbut it just doesn't work! It is my AWS account and I'm logged-in with full permissions. It only says to add these two managed policies?Sharemsutherland25 a year agoRob, under Trust Relationships it hasTrusted entitiesThe identity provider(s) ssm.amazonaws.comSharemsutherland25 a year agoAfter endlessly going round in circles, I followed this guide:https://aws-labs.net/winlab0-buildinfra/adminad.htmlIf does not require any IAM instance profile and the trick seems to be the "name" of the role. Very silly, but using the name they use works! Thanks for your help, I just felt it could not be so complicated!Share0Hi, good question.There are a few components that will need to be configured for an EC2 to use IAM.The proper permissions via IAM Policies (like the 2 Managed Policies you have).The proper trust relationship for what can use the IAM Role (See Role Trust Policy).  This is not a Managed Policy.  See https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html.  This will need to trust ec2.amazonaws.comLastly, if you're using EC2, an IAM Instance Profile as well.  See https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html for how to manage Instance Profiles.Some of these steps don't need to be via CLI - there are instructions for how to do the steps above via console as well.CommentSharejsoncanswered a year agomsutherland25 a year agoThanks, think I got the trust relationship correct by replacing ssm.amazonaws.com with ec2.amazonaws.com, but the steps relating to instance profile are just well beyond me! Surely it can be done by console? Since I haven't even created the EC2 instance yet (won't go past selection of IAM role), perhaps I can start again so that it creates an instance as well with the same name? Not sure why it didn't do this anyway?Sharemsutherland25 a year agoAfter endlessly going round in circles, I followed this guide:https://aws-labs.net/winlab0-buildinfra/adminad.htmlIf does not require any IAM instance profile and the trick seems to be the "name" of the role. Very silly, but using the name they use works! Thanks for your help, I just felt it could not be so complicated!Share0WTF, the last hint by msutherland25 also helped in my case. The role did finally show up in the console after I chose a role name that ends with 'EC2'... Is this a feature or a bug??CommentShareggebhardtanswered 10 months ago"


Question: Redshift ran out of storage during data Copy

"Customer had 5000 parquet/snappy files in S3 - total size 500GB, the copy command error out after 9 hrs since Redshift ran out of 5 TB space just for this table. Dist is not specified so AUTO should kick in and eventually due to the table size EVEN should kick in. Is Redshift uncompressing all this data inside its storage first before applying encoding? I can’t image why 10x storage got chewed upFollowComment"

Answer: "0Accepted AnswerYes, it is possible.Briefly when using DISTSTYLE ALL (as in the initial stageof AUTO), Redshift needs to make a replica of the table on the 1st slice of each node (NOT on all slices).  If you have 2 nodes, the spacewill be 2x, etc.  Yes, during COPY, all the data files need to be uncompressed, columns need to be encoded/compressed (using temp space) andoften sorted (more temp space) before they can be written out to disks.  Assuming a Parquet/Snappy compression ratio of 3, this is an extra 3x factor, etc.It is useful to keep a key metric in mind:  A single Redshift slice can easily load >5MB/sec/slice or ~18 GB/sec/slice (regardless of node type).  Data size is RAW!  For large node types with 16 slices, you should expect ~200 GB/node at a minimum.  If your COPY time becomes significantly longer (than expected), it is a good indication that something bad (like space problem) has occurred.  Here is a useful query that you can use to help troubleshooting "DISK FULL" issues:select '2000-01-01'::timestamp + (currenttime/1000000.0)* interval '1 second' as currenttime,node_num,query_id,temp_blocks from pg_catalog.stl_disk_full_diag;Recommendations:Change DISTSTYLE to EVEN or KEY (if a good DISTKEY can be found).  Starting with EVEN is fine.Load a small set of files into the target table.  Objective is to get a better idea of snappy compression and also performance.To speed things up, use a bigger cluster (Classic Resize).  Another quicker option is to Elastic Resize (ER) 2x of your cluster.  When done and validated, you can ER back.Two useful references:Loading data from Amazon S3:  https://docs.aws.amazon.com/redshift/latest/dg/t_Loading-data-from-S3.htmlHow can I troubleshoot high or full disk usage with Amazon Redshift?:  https://aws.amazon.com/premiumsupport/knowledge-center/redshift-high-disk-usage/CommentShareEXPERTAWS-User-2618129answered 3 years ago"


Question: Unknown charges

"Hello,I have my aws account for a while and I made sure all instances were down and no resources were being used, it’s been over an year but I got an email today stating there will be  charge for services when I haven’t even used the account for over an year. When I click on the link for the detailed billing information it shows no resources used and the amount payable is $0. So I am not sure why I have received the email saying there will charge of services , if anyone has received this email or know what this is about?Thanks,AbhiFollowComment"

Answer: 0Hi - You can open a support ticket or submit this form https://support.aws.amazon.com/#/contacts/aws-account-support/CommentShareEXPERTAWS-User-Nitinanswered 2 months ago


Question: Workspace date & time whilst having the instance open

"Hello.Having the Amazon Workspace application open on my running ( 24/7 ) machine, shows the right time in Excel formula =NOW(), however, if I do not have the application open, the time inside excel shows 1 hour behind, each time my script is running on the virtual machine, although the published sheets ( as html ) time save shows the right one.Any idea what's going on or why is this happening?Pictures attached to see the time when the script was running, what excel file shows inside of =NOW() and time & date of saved files from excel.Any help is appreciated! I need the time to show right even if I m logged in on my personal laptop to that application and if I m not.FollowComment"

Answer: "0Accepted AnswerHello. Apparently, virtual machine has group policy to update the timezone to the one on my local machine and even if I change the date & time or the timezone on the AWS, once I close the application it's forced to go back to default, then back to my local one once logged in.My workaround was trough registry files:HKEYLOCALMACHINE\SOFTWARE\Teradici\PCoIPAgent\ConsoleTimeZone & changed it to what I wanted.CommentSharestudorieanswered 9 months ago"


Question: Which AWS solution is the closest to PI AF?

"I'm looking for an AWS solution as close as possible as PI AF by Osisoft.The solutions needs to:Allow old data ingestion (could be of few years old);Allow aggregation on data (could be summing two timeseries sensor values);Allow aggregation on old data and on the upcoming one.I've already done some research and I came out with a couple of solutions, but they still don't satisfy me completly.AWS IoT SiteWise has assets concept and it could possibly be the best choice, but we have found that we couldn't ingest data that is older than 7 days, and it's unacceptable since we'd like to upload all the old data.Amazon Timestream with some SQL queries could do all the aggregation we needed but just to sum two series it's needed a pretty long query, and in case of dozens of series it would require a very long, not much manteinable and hard to write query.Thanks in advance.FollowComment"

Answer: "0AWS IoT SiteWise is likely part of the solution, even with the 7-day limitation. SiteWise supports hot and cold data tiers. Your historical data is essentially cold tier data; most likely you should look to bulk stream it to S3 and focus only on your new data being ingested to the SiteWise hot tier.After your data is sent to the cold tier, you can use the following AWS services to create historical reports or analyze and query your data:Run SQL queries on your data by using Amazon Athena.Perform big data analysis by using Amazon EMR.Search and analyze your data by using Amazon OpenSearch Service.CommentShareEXPERTGreg_Banswered a year ago"


Question: Best way to deploy microservices using codepipeline

"Hello, I have a single repository in codecommit holding 5 microservices(separate projects in solution). I build the AWS code pipeline Taking codecommit as source and then build(using Jenkins build) the image and push to ECR. Later the oodedeploy pull the image and deploy using revised task defination.The problem here is if developer do changes in any one of the service, the pipeline builds the image and deploying to all services. I am not sure how to identify the commit happens to specific service.Is there any way to identify this at time of Build ?FollowComment"

Answer: "0Accepted AnswerHello!Sorry for taking so long to reply.I don't think there's a reasonable way to do this. Even if you could figure it out in a CodeBuild step, how would you stop the pipeline? Mark the build as failed? That would make it hard to figure out if the build actually failed or it just failed to stop the pipeline.If you're using event based pipelines (and you should be) you might be able to use something in the Cloudwatch event (https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/EventTypes.html#codecommit_event_type) used by your Cloudwatch Event rule to cause your pipeline to start. For example, you could put each service on a different branch, or have a git tag for each service. More information is here: https://docs.aws.amazon.com/codepipeline/latest/userguide/triggering.htmlHowever, I would recommend putting each micro-service in a different repository. That way you won't have to solve this problem. I think you might be doing this because you have some shared libraries used across multiple micro-services. I would recommend putting those in their own repositories too, and combining the micro-service package with the library packages using CodePipeline and CodeBuild.So for example, in micro-service A's pipeline, you'd have a source action for micro-service-a-repo, and a source action for shared-library-1-repo, and have them both as a input artifacts for CodeBuild step that would build them into a single output artifact.Let me know if you have any more questions!MatthewCommentShareAWS-User-3346008answered 4 years ago"


Question: is there an equivalent library for neptune like APOC for Neo4j ?

Neo4j supports APOC procedures which are abstract and easy to work with. Are there any open source libraries or plans to create libraries similar to apoc?FollowComment

Answer: "2Hello and thanks for the question. Currently, Amazon Neptune implements openCypher which does not include support for APOC libraries. However, we are interested in the features and capabilities that people would like to see provided. Do you have specific APOC libraries and/or other capabilities that you are interested in using along with openCypher on Amazon Neptune?As a side note, Amazon Neptune supports both openCypher and Apache TinkerPop Gremlin queries over the same data. This gives you additional capabilities by being able to mix and match query languages as needed.CommentShareAWS-KRLanswered a year agoSelva a year agoHi Thanks for the answer. We already use cypher quite a lot and it would be difficult to migrate that to Gremlin but I'll definitely consider the option of mix and match. We specifically use CALL apoc.path.subgraphNodes, apoc.create.uuid() . If we have to use Neptune, we need to find a way to do what these procedures do. Is there any possibility of that?SharerePost-User-4775278 7 months agoHi, We also are considering AWS Neptune however we use this library.https://github.com/neo4j/graphql/tree/dev which requires APOC supportShare"


Question: "AWS Identity Centre with Azure AD. IAM identity centre is enabled for US N.Virginia, how to get the correct metadata if resources and users are in a different region?"

"I want to integrate Azure AD with my AWS organization account. But the IAM Identity Centre of the account is enabled for N. Virginia Region. All my member aws accounts under that particular organization have resources and users with the roles and policies in Singapore region. Azure AD requires metadata from the organization account. Even though the metadata primarily contains configuration information (IdP's entity ID, SSO service URL, certificate info etc.), my primary concern is how to retrieve the right metadata where there aren't any loss of data for this multi-region specific configuration.FollowComment"

Answer: "1Azure Active Directory (Azure AD) integration with AWS can be done regardless of the regions where your AWS resources and users are located. AWS's IAM Identity Provider (IdP) and its SAML metadata are not region-specific. The IAM service, and thus IAM roles and Identity Providers, are global, and not tied to a specific regionyou can check from this linkhttps://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.htmlAzure AD side:Create a new non-gallery application in Azure AD, you may name it AWS SSO.In the AWS SSO app, go to Single sign-on and select SAML.You will see a section called SAML Signing Certificate. Download the Federation Metadata XML from there.AWS IAM side:In the IAM console, go to Identity Providers, and choose Create Provider.For Provider Type, choose SAML. For Provider Name, you might choose AzureAD.For Metadata Document, upload the Federation Metadata XML you downloaded from Azure AD.Map AWS Roles to Azure AD users or groups:In the Azure AD console, under the AWS SSO app, go to Users and groups and add the users or groups that you want to have access to AWS console.Then, in the Single sign-on section, under User Attributes & Claims, you can map Azure AD user attributes to AWS roles.CommentShareEXPERTsedat_salmananswered 19 days ago"


Question: Signed Cookies for Cloudfront not working

"Since this is keeping me busy since 3 months now, my last hope is this forum before I give up trying to solve this via AWS.Problem descriptionI have a couple of S3 buckets with files I want to distribute to my frontend application via Cloudfront. To keep things simple, I try with only two buckets at the moment:a video bucket, which is supposed to stream video files via HLSan asset bucket for all sorts of assets which are used in the frontend application.Since one requirement is streaming videos - and thus I need to allow access to an entire folder on the bucket - I need to use signed cookies to do so. To retrieve my signed cookies, I have created an API Gateway which allows to set custom headers. However, this all seems to work fine as long as I do not try to use the cookies! As soon as they come into play I receive an Access Denied error.The set-upOver time I have followed quite a number of tutorials (official and unofficial) and therefore I skip listing all the links.S3I have set the permissions to work with my Cloudfront Distribution{  "Sid": "AllowCloudFrontServicePrincipalReadOnly",  "Effect": "Allow",  "Principal": {    "Service": "cloudfront.amazonaws.com"  },   "Action": "s3:GetObject",   "Resource": "arn:aws:s3:::XXX/*",   "Condition": {   "StringEquals": {     "AWS:SourceArn": "arn:aws:cloudfront::XXX:distribution/XXX"    }  }}Furthermore, currently the access is set to public on this bucket for testing reasons.CloudfrontI have set up a Cloudfront distribution with a custom SSL certificate to avoid CORS issues.I've also created an origin group which include the two buckets from earlier.The default behaviour restricts viewer access via public ssh key.The Cache key and origin requests are set to custom policies to make sure we allow the required headers for CORS and cookies.Access-Control-Request-MethodAccess-Control-Allow-OriginAccess-Control-Request-HeadersI get access to my files without any errors if I disable the viewer access via PUB key. So I'm pretty sure there is something wrong with my cookies.API GatewayI have set up an API gateway with custom domain to avoid CORS issues.I have a proxy which redirects the request to a custom lambda, which again signs the cookies and returns the Set-Cookie header.This all works fine, I get the cookies returned and they get send with the (file) request if available.Custom lambdaSo far, it's a very easy lambda written in Node.js which signed the cookies for a requested file. I'm using the getSignedCookies method from the Cloudfront Signer V3.  Cookies are signed like this:const signedCookie = getSignedCookies({    keyPairId: awsCloudfrontKeyPairId,    privateKey: awsCloudfrontPrivateKey,    url: url,    dateLessThan: getExpTime,});This is how I return the cookie headers:const response = {      statusCode: 200,      isBase64Encoded: false,      body: JSON.stringify({ url: url, bucket: bucket, key: key }),      headers: {        "Content-Type": "application/json",        "Access-Control-Allow-Origin": "https://my-custom-forntend-domain.com",        "Access-Control-Allow-Credentials": true,        "Access-Control-Allow-Headers": "Content-Type",        "Access-Control-Allow-Methods": "OPTIONS,POST,GET",      },      multiValueHeaders: {        "Set-Cookie": [          `CloudFront-Expires=${signedCookie["CloudFront-Expires"]}; Domain=my-custom-forntend-domain.com; Path=/; Max-Age=86400`,          `CloudFront-Signature=${signedCookie["CloudFront-Signature"]}; Domain=my-custom-forntend-domain.com; Path=/; Max-Age=86400`,          `CloudFront-Key-Pair-Id=${signedCookie["CloudFront-Key-Pair-Id"]}; Domain=my-custom-forntend-domain.com; Path=/; Max-Age=86400`,        ],      },    };Like mentioned earlier, this works and the cookies get submitted on the file request. I just end up wit getting the Access Denied error every single time.Any help appreciated! 🙌FollowComment"

Answer: "0You may need to verify the Domain and Path attributes in Set-cookie response headers.CloudFront returns a 403 Access Denied error if cookies are returned from CloudFront but weren't included in following requests to the same domain. In this case, check the cookie attributes Domain and Path in the Set-Cookie response header.The Domain value is the domain name for the requested file.The Path value is the path for the requested file.*To use an alternate domain name (such as example.com) in URLs, add an alternate domain name to your distribution.CommentShareJED007answered 5 months ago0Hi @JED007,thanks for your response!I have had time to play around with this but unfortunately with no luck. Just to be clear, I'm signing the cookie like so:const signedCookie = getSignedCookies({      keyPairId: awsCloudfrontKeyPairId,      privateKey: awsCloudfrontPrivateKey,      url: url,      dateLessThan: getExpTime,});where url=https://cloudfront.custom-domain.com/path-to-file/*.The lambda response is set to:const response = {      statusCode: 200,      isBase64Encoded: false,      body: JSON.stringify({ url: url, bucket: bucket, key: key }),      headers: {        "Content-Type": "application/json",        "Access-Control-Allow-Origin": "*",        "Access-Control-Allow-Credentials": true,        "Access-Control-Allow-Methods": "OPTIONS,POST,GET",      },      multiValueHeaders: {        "Set-Cookie": [          `CloudFront-Expires=${signedCookie["CloudFront-Expires"]}; Domain=cloudfront.custom-domain.com; Path=/`,          `CloudFront-Signature=${signedCookie["CloudFront-Signature"]}; Domain=cloudfront.custom-domain.com; Path=/`,          `CloudFront-Key-Pair-Id=${signedCookie["CloudFront-Key-Pair-Id"]}; Domain=cloudfront.custom-domain.com; Path=/`,        ],      },};If I then request a file from https://cloudfront.custom-domain.com/path-to-file/video.m3u8, the cookies are sent with the request but resulting in the 403 error. However, if I set Path=/path-to-file/*, no cookies get sent on the request and I get the Missing Key error.CommentShareFloRaganswered 5 months ago"


Question: Can I practice for free with my own AWS account

"Hi teamAs AWS Technical Essentials (Japanese)(日本語実写版)https://explore.skillbuilder.aws/learn/course/13153/play/67448/aws-technical-essentials-japanese-ri-ben-yu-shi-xie-banI want to practice employee directory application hosting(従業員ディレクトリアプリケーションホスティング) on my own AWS account,(for example, all of application construction such as instance creation, DB creation, connection)Can I practice for free with my own AWS account?Thanks!FollowComment"

Answer: "0Hi,When you create a new AWS account you get access to a Free tier https://aws.amazon.com/free/?all-free-tier.sort-by=item.additionalFields.SortRank&all-free-tier.sort-order=asc&awsf.Free%20Tier%20Types=*all&awsf.Free%20Tier%20Categories=*all. Depending on what you want to learn you can check previous link.You should be careful thought because it is easy to think that something is free and then ending up paying, so you need certain alarms to prevent that to happen so that you do not pay more than you wish.Check below to find out what exceeded and how to prevent it:https://repost.aws/knowledge-center/stop-future-free-tier-chargeshttps://repost.aws/knowledge-center/free-tier-chargesHope it helps and if does, I would appreciate answer to be accepted so that community can benefit for clarity, thanks ;)CommentShareEXPERTalatechanswered 2 months ago"


Question: Voice output alters when using tag <say-as interpret-as="characters"> in POLLY

"Amazon Polly question.I have a sentence, such as "it will be OK."When I change the script to"It will be <say-as interpret-as="characters">OK</say-as>. "or to"It will be O K. "The output sounds muffled for that sentence only, then goes back to how it sounded in the rest of the script.I'm using:Neural engineEnglish, US languageMatthew, Male voiceSSML turned onThe same thing happens when I use any 'interpret as=' tagsIs anyone else running into this issue? It's very distracting and I can't figure out why it is happening.Thanks for any help you can give me.FollowComment"

Answer: "0The neural voices don't support the say-as tags, so for that sentence AWS shifts to the standard voice.  Per the documentation, "This option is not currently supported using neural voices. If this SSML code is encountered by Amazon Polly at run-time, the affected sentence will be synthesized using the related standard voice. "CommentSharesharonhustonanswered 10 months ago"


Question: Conflict between Velocity in eMotion and game logic Velocity

"Hi All:I tried to use EmotionX， I found a problem about physics. In ActorComponent::OnTickEntity requests update Velocity every frame. If I want to SetVelocity in my game logic, what should I do?eg: If I want to Jump or fall from the mountain, How can I control the Velocity?Looking forward for your reply, thank you@REDACTEDUSERFollow"

Answer: "0Accepted AnswerHey @REDACTEDUSERHave you looked at this docs page yet regarding CryCharacterPhysicsRequestBus.Event.RequestVelocity ?https://docs.aws.amazon.com/lumberyard/latest/userguide/component-physics-character.html#component-physchar-ebusrequest-3This should help you layer the velocity of a jump/fall with your movement. StarterGame should also have an example under the Scripts/Jack/ directory in the MovementController.lua script too.SharerePost-User-7951591answered 5 years ago0Hi @REDACTEDUSERSharerePost-User-4963807answered 5 years ago0Hey @REDACTEDUSERSharerePost-User-5738838answered 5 years ago0Thank you ，look forward to your reply again.SharerePost-User-4963807answered 5 years ago0Hey @REDACTEDUSERSorry you are correct, that is the Mannequin one. The EMFX one is in the same location but called MovementControllerEFX.lua. We recently updated StarterGame to use EMFX, so make sure you're using 1.15 so your Jack player slice should look like this:REMOVEDUPLOADSharerePost-User-7951591answered 5 years ago0Thank you for your reply. I know RequestVelocity. But,my problem is RequestVelocity called by ActorComponent per frame, This causes the logic call RequestVelocity(or SetVelocity) to conflict with ActorComponent. And All the question based on emotionfx.StarterGame example under the Scripts/Jack/ directory in the MovementController.lua scrip is based on Mannequin.Do you have a good solution based on Emotionfx to solve this problem? Thank you again and look forward to your reply again.SharerePost-User-4963807answered 5 years ago0Hey @REDACTEDUSERYou are correct. At this moment, you do have to manually update the logic yourself, which you have discovered already.The current CryPhysics system does not actually work with the EMFX animation system because the focus has been more on getting PhysX up and running, which is why you're likely running into issues when using anything during the OnTick call.Apologies for all the back and forth on this. I realize that was the simplest answer to your question.SharerePost-User-7951591answered 5 years ago0thank you for your reply. I have already seen MovementControllerEFX.lua But I still have a problem. In MovementControllerEFX.lua The speed in the horizontal direction depends on the emotionfx itself, and the speed on the z-axis requires the logic layer to adjust each frame to offset the influence of the Z-axis in the emotionfx.Can I understand that the movement of the x y axis can be controlled by the action itself, the movement of the z axis requires logic to update the control speed per frame, and can not use the gravity acceleration of the physics engine?Thank you again and look forward to your reply again.SharerePost-User-4963807answered 5 years ago0Thank you for your all responses, Now I konw what should I do , Thank you angain for you answerSharerePost-User-4963807answered 5 years ago"


Question: Instance type support in availability zones in the same region

"Hey,If an instance type is supported in one availability zone in a particular region, is it supported in all availability zones in the same region?For example, let's say I checked that m5.xlarge is supported in region us-east-1, on availability zone us-east-1a.Can I assume m5.xlarge is supported on us-east-1b and us-east-1c as well?The support for instance type is per region scope or per availability zone?Thank you,Ori AdlerFollowComment"

Answer: "1Its not necessary the instance type would be available in all AZ's. You might run into error like "Your requested instance type is not supported in your requested Availability Zone" in that case--SydCommentShareSydanswered a year ago1You can determine which instance types are available in a specific availability zone by doing this:aws ec2 describe-instance-type-offerings --location-type "availability-zone" --filters Name=location,Values=<AZ name> --region <region name>For example:aws ec2 describe-instance-type-offerings --location-type "availability-zone" --filters Name=location,Values=us-east-1b --region us-east-1CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: Temporary connectivity issues from Win2019 EC2 Instance to metadata and other endpoints

"We experience irregular temporary connectivity issues on our Windows Server 2019 EC2 instances. Theses issues only occur on some instances (2 out of 12 machines) and are not specific to subnet/security groups (both machines are in different subnets/security groups, other machines in the same subnet/security groups do not experience the issues). The issues can be found in various logs:# Cloud Watch Agent Log (Excerpt)2022-11-03T11:34:17Z E! WriteToCloudWatch failure, err:  RequestError: send request failedcaused by: Post "https://monitoring.eu-central-1.amazonaws.com/": dial tcp 52.94.138.113:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.2022-11-03T11:35:15Z E! cloudwatch: code: RequestError, message: send request failed, original error: Post "https://monitoring.eu-central-1.amazonaws.com/": dial tcp 52.94.138.199:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.2022-11-03T11:35:15Z W! 4 retries, going to sleep 3.2s before retrying.2022-11-03T11:35:18Z E! WriteToCloudWatch failure, err:  RequestError: send request failedcaused by: Post "https://monitoring.eu-central-1.amazonaws.com/": dial tcp 52.94.138.199:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.2022-11-03T11:36:11Z W! [processors.ec2tagger] ec2tagger: Error refreshing EC2 tags, keeping old values : +RequestError: send request failedcaused by: Post "https://ec2.eu-central-1.amazonaws.com/": dial tcp 54.239.55.167:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.2022-11-03T11:36:11Z W! [processors.ec2tagger] ec2tagger: Error refreshing EC2 tags, keeping old values : +RequestError: send request failedcaused by: Post "https://ec2.eu-central-1.amazonaws.com/": dial tcp 54.239.55.167:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.2022-11-03T11:36:14Z E! cloudwatch: code: RequestError, message: send request failed, original error: Post "https://monitoring.eu-central-1.amazonaws.com/": dial tcp 52.94.136.226:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.2022-11-03T11:36:14Z W! 5 retries, going to sleep 6.4s before retrying.2022-11-03T11:36:20Z E! WriteToCloudWatch failure, err:  RequestError: send request failedcaused by: Post "https://monitoring.eu-central-1.amazonaws.com/": dial tcp 52.94.136.226:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.2022-11-03T11:37:15Z E! cloudwatch: code: RequestError, message: send request failed, original error: Post "https://monitoring.eu-central-1.amazonaws.com/": dial tcp 52.94.136.211:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.2022-11-03T11:37:15Z W! 6 retries, going to sleep 1m0s before retrying.2022-11-03T11:38:14Z E! cloudwatch: code: RequestError, message: send request failed, original error: Post "https://monitoring.eu-central-1.amazonaws.com/": dial tcp 52.94.136.211:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.2022-11-03T11:38:14Z W! 7 retries, going to sleep 1m0s before retrying.2022-11-03T11:38:15Z E! WriteToCloudWatch failure, err:  RequestError: send request failedcaused by: Post "https://monitoring.eu-central-1.amazonaws.com/": dial tcp 52.94.136.211:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.2022-11-03T11:39:14Z E! WriteToCloudWatch failure, err:  RequestError: send request failedcaused by: Post "https://monitoring.eu-central-1.amazonaws.com/": dial tcp 52.94.136.211:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.# SSM Agent Log (Excerpt)2022-11-03 12:22:59 ERROR [HandleAwsError @ awserr.go.49] [ssm-agent-worker] [MessageService] [MDSInteractor] error when calling AWS APIs. error details - GetMessages Error: EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": context deadline exceeded (Client.Timeout exceeded while awaiting headers)2022-11-03 12:23:02 ERROR [HandleAwsError @ awserr.go.49] [ssm-agent-worker] [MessageService] [MDSInteractor] error when calling AWS APIs. error details - GetMessages Error: EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": context deadline exceeded (Client.Timeout exceeded while awaiting headers)2022-11-03 12:23:05 ERROR [HandleAwsError @ awserr.go.49] [ssm-agent-worker] [MessageService] [MDSInteractor] error when calling AWS APIs. error details - GetMessages Error: EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": context deadline exceeded (Client.Timeout exceeded while awaiting headers)2022-11-03 12:23:08 ERROR [HandleAwsError @ awserr.go.49] [ssm-agent-worker] [MessageService] [MDSInteractor] error when calling AWS APIs. error details - GetMessages Error: EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": context deadline exceeded (Client.Timeout exceeded while awaiting headers)2022-11-03 12:23:11 ERROR [HandleAwsError @ awserr.go.49] [ssm-agent-worker] [MessageService] [MDSInteractor] error when calling AWS APIs. error details - GetMessages Error: EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": context deadline exceeded (Client.Timeout exceeded while awaiting headers)2022-11-03 12:23:11 ERROR [checkStopPolicy @ mdsinteractor.go.391] [ssm-agent-worker] [MessageService] [MDSInteractor] MDSInteractor stopped temporarily due to internal failure. We will retry automatically after 15 minutes2022-11-03 12:33:05 ERROR [HandleAwsError @ awserr.go.49] [ssm-agent-worker] [HealthCheck] error when calling AWS APIs. error details - RequestError: send request failedcaused by: Post "https://ssm.eu-central-1.amazonaws.com/": dial tcp 52.119.188.195:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.2022-11-03 12:33:05 ERROR [HandleAwsError @ awserr.go.49] [ssm-agent-worker] [HealthCheck] error when calling AWS APIs. error details - RequestError: send request failedcaused by: Post "https://ssm.eu-central-1.amazonaws.com/": dial tcp 52.119.188.195:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.2022-11-03 12:38:07 ERROR [HandleAwsError @ awserr.go.49] [ssm-agent-worker] [HealthCheck] error when calling AWS APIs. error details - RequestError: send request failedcaused by: Post "https://ssm.eu-central-1.amazonaws.com/": dial tcp 52.119.188.195:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.2022-11-03 12:38:07 ERROR [HandleAwsError @ awserr.go.49] [ssm-agent-worker] [HealthCheck] error when calling AWS APIs. error details - RequestError: send request failedcaused by: Post "https://ssm.eu-central-1.amazonaws.com/": dial tcp 52.119.188.195:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.2022-11-03 12:38:43 ERROR [HandleAwsError @ awserr.go.49] [ssm-agent-worker] [MessageService] [Association] error when calling AWS APIs. error details - RequestError: send request failedcaused by: Post "https://ssm.eu-central-1.amazonaws.com/": dial tcp 52.119.190.128:443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.We found out about these connectivity issues since our Cloud Watch Monitoring had gaps in some metrics provided by the Cloud Watch Agent. These gap seem to occur randomly and last for about 90 minutes.I could not find any related problems in the windows event log. Surprisingly, our windows docker workloads on the affected machines seem to work normal.Has anyone experienced similar network connectivity  problems? Any suggestions on how to further investigate the root for these issues?FollowComment"

Answer: "0In general intermittent connectivity issues are often noticeable when the EC2 instance is running out of hardware resources due to a long running task.How does the CPU and Memory utilization looks when the network drop is noticed? Open Windows Task Manager to have a quick glance when you notice the drop again.Also please check if you are able to ping the EC2 instance during this time.For more information about diagnosing high resource utilization on EC2, refer to article-https://aws.amazon.com/premiumsupport/knowledge-center/ec2-cpu-utilization-not-throttled/CommentShareSUPPORT ENGINEERRahul_AWSanswered 7 months agoinsiders-philipp 6 months agoThank you for your suggestions. I had a look at the hardware resources and they did not show any bottlenecks. They are essentially the same as before and after the drop. Since our workload works despite the drops and so far we only lose two metrics in our monitoring during these drops, we decided to accept these drops for now. We plan to switch to Win2022 Server with a different docker setup in the next months. Hopefully this will also fix these gaps in the metrics.Share"


Question: [Solved]download image from S3 to Endpoint(made by Sagemaker) with s3url(s3://~~)

"I try to download image(.jpg, .png.) from S3 to Endpoint(made by Sagemaker) with s3url(s3://~~)Because At the endpoint made by sagemaker, To send s3url is faster than to send image.I can download image at sagemaker notebook, from s3 to sagemaker local.but I can't download image from s3 to sagemaker endpoint.That local download code can not work.FollowComment"

Answer: 0Accepted AnswerI solve this! I try to download image at endpoint.but endpoint can not connect outside network except Lambda.I make request with s3urlDownload image from s3 to lambdaTransmit image from lambda to endpointCommentSharerePost-User-8794903answered 9 months ago


Question: WorkDrive not supported on Mac M1

There is a notification that WorkDocs Companion editor is going away and we should begin migrating to WorkDrive.When attempting to install WorkDrive on my Mac I get an error that WorkDrive is not supported with the Apple M1 Chip.What will be the edit options for complex editing if WorkDocs Companion goes away and I am unable to use WorkDrive?FollowComment

Answer: "0Hi, WorkDocs Drive is available on M1 macs. Visit https://amazonworkdocs.com/en/clients and install Drive for Apple silicon.CommentSharerePost-User-w6522502answered 5 months ago0Installed - thank you very much!!CommentSharehicherieanswered 5 months ago"