Question: mails failing to deliver when I send Amazon SES emails using the SendTemplatedEmail operation (Attribute 'vehicle' is not present in the rendering data)

"Our team is facing issues with dynamic templates on production with SES after successfully submitting a queue.Webhook returning error "failure":{"errorMessage":"Attribute 'vehicle' is not present in the rendering data." even the attribute and value is there.Template data you can find from "templateName":"Email_13122022_163112_c65a93f9-80e4-4cb6-8616-5370445fc5f7_8120"Given below from the sending queue two types of data. Please check and provide the resolution of this issue.It has the value "34344343443434" with the "vehicle" attribute.{"vehicle no":"","city":"","company":"","country":"","email":"pankaj@loyaltycommunication.com","firstname":"Pankaj","gender":"Male","home town":"Haryana","lastname":"Batra","municipal":"","numeric":"ghygg","mobilenumber":"919416399171","state":"Haryana","street":"","vehicle":"34344343443434","zip":"","1 oct hi new":"","14 dec":"","14 december (1)":"","14 december (2)":"","14 december (3)":"","14 december (4)":"","14 december (5)":"","23sept country name":"","28 september":"","7 mrch a":"","7 mrch":"","abc":"","add1":"","add2":"","age":"","age454":"","all":"","average":"","boolean value. ":"","boolean":"","campaignnotification":"","ccc":"","cf1":"","chckbox":"","cn":"","confirmkeyword":"","contact id":"","country 123":"","country 23":"","country 4":"","country a":"","country sept":"","custom ":"","custom 2":"","custom field include in all list":"","custpom":"","d":"","data type nummm":"","date 1 ":"","date 2":"","date 22":"","date 2222":"","date":"","devicetoken":"","devicetypeid":"","discountcode":"","dob":"","doubleemailoptin":"","doublesmsoptin":"","drop down":"","drop-down 1st october":"","emailoptindate":"","emailoptinoptout_time":"","emailoptoutdate":"","eventenddate":"","eventname":"","eventstartdate":"","exit contact iddd new":"","exit contact iddd":"","exte cv ":"","external contact id 8":"","external contact idv ":"","external cv ":"","external cv":"","externalcontactid":"","externalcontactid_old":"","extinfo1":"","extinfo10":"","extinfo11":"","extinfo12":"","extinfo13":"","extinfo14":"","extinfo15":"","extinfo16":"","extinfo17":"","extinfo18":"","extinfo19":"","extinfo2":"","extinfo20":"","extinfo3":"","extinfo4":"","extinfo5":"","extinfo6":"","extinfo7":"","extinfo8":"","extinfo9":"","extjson":"","fk_termsid":"","fullname  firstname  lastname":"","hello (ext con id- alpha-num)":"","hello":"","hi 234":"","hi new ":"","hi":"","image":"","interest":"","isdevicetokenvalid":"","islocationtrackingactive":"","keyword":"","latest":"","lc_dob":"","lc_old_contactid":"","list box":"","middlename":"","mobileappoptinoptout":"","mobileappoptinoptout_time":"","mobilenumber 3444":"","mobilenumber111111111":"","multile":"","multiple value":"","name check":"","new ":"","new 1":"","new 12":"","new 2":"","new 3":"","new check fields 4":"","new custom field":"","new field ":"","new list checks":"","new lsittt 1":"","new one":"","new sheet test":"","new sheet testhi 29 september":"","new":"","newly created ":"","nm":"","nmed country":"","Note":"","num string":"","numeric 1":"","numeric value.":"","numericcc":"","okokoko":"","olcd":"","old":"","predefined single":"","predefineddd":"","productid":"","registrationno":"","rollno":"","shortcode":"","singleemailoptin":"","singlesmsoptin":"","skypeid":"","smsoptinoptout_time":"","stopkeyword":"","SystemContactId":"","test abc":"","title":"","uniqueurl":"","unsubscribe:AllContacts":"","unsubscribe:New Group":"","unsubscribe":"","value":"","lc_campid":"a7fea776-d57a-ed11-abd7-029067118550","qid":"b758532f-c8a2-ed11-abd7-029067118550&lcuid=1035&email=pankaj%40loyaltycommunication.com&campid=a7fea776-d57a-ed11-abd7-029067118550&lc_contactid=22516132","lc_r":"in","emailurl":"https://sms.club/0ewZpoABcQ","email-address":"pankaj@loyaltycommunication.com","preHeader_tag":"live  919416399171  ghygg  Haryana","lc_contactid":"22516132","lc_recpientId":"13790010","emailuid":"b758532f-c8a2-ed11-abd7-029067118550","lc_qfw":"19","lc_qtempid":"89881","lc_kfwhcl":"","lc_qstarttime":"1675324562161","lc_qwhnewthread":"False","lc_whpriority":"high"}Webhook response:-{"eventType":"Rendering Failure","mail":{"timestamp":"2023-02-02T07:59:13.475Z","source":"noreply@loyaltycommunication.com","sourceArn":"arn:aws:ses:ap-south-1:664378509502:identity/loyaltycommunication.com","sendingAccountId":"664378509502","messageId":"010901861123059e-2a74f4f7-55da-493f-996d-daf9442bdeb3-000000","destination":["pankaj@loyaltycommunication.com"],"headersTruncated":false,"tags":{"lc_qstarttime":["1675324562161"],"ses:operation":["SendTemplatedEmail"],"emailuid":["b758532f-c8a2-ed11-abd7-029067118550"],"ses:caller-identity":["ses"],"lc_whpriority":["high"],"qid":["b758532f-c8a2-ed11-abd7-029067118550"],"lc_qtempid":["89881"],"lc_recpientId":["13790010"],"accountid":["1035"],"lc_qfw":["19"],"lc_contactid":["22516132"],"ses:configuration-set":["lcom-ses-in-dconfig"],"ses:source-ip":["112.196.49.130"],"ses:from-domain":["loyaltycommunication.com"],"lc_r":["in"],"lc_qwhnewthread":["False"],"lc_queuebatchid":["8046ab8d-5e8f-4549-a461-2add4c783661"]}},"failure":{"errorMessage":"Attribute 'vehicle' is not present in the rendering data.","templateName":"Email_13122022_163112_c65a93f9-80e4-4cb6-8616-5370445fc5f7_8120"}}It has the value empty "" with the "vehicle" attribute.{"vehicle no":"","city":"","company":"","country":"","email":"prabhjot@loyaltycommunication.com","firstname":"Prabhjot","gender":"Male","home town":"Punjab","lastname":"Khalsa","municipal":"","numeric":"ghfyhghh","mobilenumber":"919888802475","state":"Punajb","street":"","vehicle":"","zip":"","1 oct hi new":"","14 dec":"","14 december (1)":"","14 december (2)":"","14 december (3)":"","14 december (4)":"","14 december (5)":"","23sept country name":"","28 september":"","7 mrch a":"","7 mrch":"","abc":"","add1":"","add2":"","age":"","age454":"","all":"","average":"","boolean value. ":"","boolean":"","campaignnotification":"","ccc":"","cf1":"","chckbox":"","cn":"","confirmkeyword":"","contact id":"","country 123":"","country 23":"","country 4":"","country a":"","country sept":"","custom ":"","custom 2":"","custom field include in all list":"","custpom":"","d":"","data type nummm":"","date 1 ":"","date 2":"","date 22":"","date 2222":"","date":"","devicetoken":"","devicetypeid":"","discountcode":"","dob":"","doubleemailoptin":"","doublesmsoptin":"","drop down":"","drop-down 1st october":"","emailoptindate":"","emailoptinoptout_time":"","emailoptoutdate":"","eventenddate":"","eventname":"","eventstartdate":"","exit contact iddd new":"","exit contact iddd":"","exte cv ":"","external contact id 8":"","external contact idv ":"","external cv ":"","external cv":"","externalcontactid":"","externalcontactid_old":"","extinfo1":"","extinfo10":"","extinfo11":"","extinfo12":"","extinfo13":"","extinfo14":"","extinfo15":"","extinfo16":"","extinfo17":"","extinfo18":"","extinfo19":"","extinfo2":"","extinfo20":"","extinfo3":"","extinfo4":"","extinfo5":"","extinfo6":"","extinfo7":"","extinfo8":"","extinfo9":"","extjson":"","fk_termsid":"","fullname  firstname  lastname":"","hello (ext con id- alpha-num)":"","hello":"","hi 234":"","hi new ":"","hi":"","image":"","interest":"","isdevicetokenvalid":"","islocationtrackingactive":"","keyword":"","latest":"","lc_dob":"","lc_old_contactid":"","list box":"","middlename":"","mobileappoptinoptout":"","mobileappoptinoptout_time":"","mobilenumber 3444":"","mobilenumber111111111":"","multile":"","multiple value":"","name check":"","new ":"","new 1":"","new 12":"","new 2":"","new 3":"","new check fields 4":"","new custom field":"","new field ":"","new list checks":"","new lsittt 1":"","new one":"","new sheet test":"","new sheet testhi 29 september":"","new":"","newly created ":"","nm":"","nmed country":"","Note":"","num string":"","numeric 1":"","numeric value.":"","numericcc":"","okokoko":"","olcd":"","old":"","predefined single":"","predefineddd":"","productid":"","registrationno":"","rollno":"","shortcode":"","singleemailoptin":"","singlesmsoptin":"","skypeid":"","smsoptinoptout_time":"","stopkeyword":"","SystemContactId":"","test abc":"","title":"","uniqueurl":"","unsubscribe:AllContacts":"","unsubscribe:New Group":"","unsubscribe":"","value":"","lc_campid":"a7fea776-d57a-ed11-abd7-029067118550","qid":"b758532f-c8a2-ed11-abd7-029067118550&lcuid=1035&email=prabhjot%40loyaltycommunication.com&campid=a7fea776-d57a-ed11-abd7-029067118550&lc_contactid=22516133","lc_r":"in","emailurl":"https://sms.club/0ewZpoABcQ","email-address":"prabhjot@loyaltycommunication.com","preHeader_tag":"live  919888802475  ghfyhghh  Punjab","lc_contactid":"22516133","lc_recpientId":"13790011","emailuid":"b758532f-c8a2-ed11-abd7-029067118550","lc_qfw":"19","lc_qtempid":"89881","lc_kfwhcl":"","lc_qstarttime":"1675324562161","lc_qwhnewthread":"False","lc_whpriority":"high"}Webhook response:-{"eventType":"Rendering Failure","mail":{"timestamp":"2023-02-02T07:59:13.426Z","source":"noreply@loyaltycommunication.com","sourceArn":"arn:aws:ses:ap-south-1:664378509502:identity/loyaltycommunication.com","sendingAccountId":"664378509502","messageId":"010901861123059a-08f3a0d1-ee64-4c95-b03a-eea50db0fdb9-000000","destination":["prabhjot@loyaltycommunication.com"],"headersTruncated":false,"tags":{"lc_qstarttime":["1675324562161"],"ses:operation":["SendTemplatedEmail"],"emailuid":["b758532f-c8a2-ed11-abd7-029067118550"],"ses:caller-identity":["ses"],"lc_whpriority":["high"],"qid":["b758532f-c8a2-ed11-abd7-029067118550"],"lc_qtempid":["89881"],"lc_recpientId":["13790011"],"accountid":["1035"],"lc_qfw":["19"],"lc_contactid":["22516133"],"ses:configuration-set":["lcom-ses-in-dconfig"],"ses:source-ip":["112.196.49.130"],"ses:from-domain":["loyaltycommunication.com"],"lc_r":["in"],"lc_qwhnewthread":["False"],"lc_queuebatchid":["8046ab8d-5e8f-4549-a461-2add4c783661"]}},"failure":{"errorMessage":"Attribute 'vehicle' is not present in the rendering data.","templateName":"Email_13122022_163112_c65a93f9-80e4-4cb6-8616-5370445fc5f7_8120"}}FollowComment"

Answer: "0JSON parsing can be problematic with space in the attribute. Try the parsing as below:var vehicle = {"id": "555","vehicle no": "432432"}alert(func["vehicle no"]);CommentSharerePost-User-2054795answered 3 months ago"


Question: Can't launch instance - Server.InternalError: Internal error on launch

I've been trying to launch new instances based on a private AMI (ami-0835ad6f4492077da) but they keep failing with that error ("Internal error on launch"). Some recent instances:i-0f21584bd84e66240i-03ed9ab7ac04243cfi-06b85120bdbda12ebThey stay pending and then eventually shut down and terminate.Any idea what's causing this?FollowComment

Answer: "0Looks like this was an issue with EC2 that was fixed.CommentShareyosefanswered 4 years ago0Looks like this was an issue with EC2 that was fixed.CommentShareyosefanswered 4 years ago0I am also trying to launch instance using the option "Launch More Like This" for the existing running instance. But each time I launch the instance in US West (Oregon) / us-west-2a, I get error after the instance get launched it shows terminated status after few minutes with following error:State transition reason: Server.InternalErrorState transition reason message: Server.InternalError: Internal error on launchThe instance shows the status as: terminated. There is nothing reported on system log for the instance.Any suggestions why it is happening and how to find out the reason for this failure.Edited by: Muhammad on Sep 26, 2019 8:04 AMCommentShareMuhammadanswered 4 years ago"


Question: Error trying to create Comprehend Flywheel : ModelType field shouldn't be provided if ActiveModelArn is provided

"I've created a custom classifier from an S3 bucket.  I want to create a flywheel so I can introduce new datasets.  I'm using the console, not cli.  I created an empty bucket in S3 and I choose that bucket for the output.  For IAM new role I am Root.  Create goes through the IAM part and then back to Create with the error messageFLYWHEEL_UNEXPECTED_FIELDS_PROVIDED_WITH_ACTIVE_MODEL: ModelType field shouldn't be provided if ActiveModelArn is provided.I have not found that message on a google search or anywhere else.  My original input file was a csv file and I chose split to divide 10% as test.FollowCommentbgarr33434 2 months agoI was able to create the flywheel using the CLISharebgarr33434 2 months agoI think the error message is a red herring.  I've been able to start creating the flywheel using CLI, but it fails with the message NO_WRITE_ACCESS_TO_OUTPUT: The provided data access role does not have write access to the output S3 URI.  I created a policy to the bucket but that seems to not be enough.  I'm logged in as Root, so. thought I would have all rights to do this.Share"

Answer: 0Added a new policy with complete access to S3 and then added that policy to the role I had created for Comprehend that that worked.CommentSharebgarr33434answered 2 months ago


Question: How long before I can retake exam after Pearson Vue Proctor rubustly cancelled my exam ?

"My exam(SOA-C02 2/22 10 AM PST) was unfairly canceled by Pearson Vue Proctor for "leaning too much toward the screen", I obviously didn't do anything wrong, and I have taken the exam three times which was all fine, but I guess I am unlucky to meet a bad proctor this time, after contacting the Pearson Vue, they said they gonna email me soon, but I just wanted to know how long I can start to retake my exam again because I need my certs in a short time, and I don't care about refund or anything just want to take the exam again as quickly as possible.Did anyone encounter the same situation and know how long will this process go before we can retake our exam?FollowComment"

Answer: 0There is a 14-day retake policy in place before you can reschedule an exam.CommentShareNelliT-AWSanswered 2 months ago


Question: aws-sdk javascript s3  managedUpload CORS error caused by CacheControl Option

"If I upload this with the CacheControl option, upload works fine.But when I load it on the client side I get a CORS error.If I remove CachControl, obviously the CORS error doesn't come up.My Bucket has CORS-Policy like thisMy Upload code is following likeimport { FileUpload } from "../types/scalars/Upload.scalar"; new S3.ManagedUpload({        params: {            ACL: "public-read",            Bucket: process.env.AWS_BUCKETNAME || "",            Body: upload.createReadStream(),            Key: filename || upload.filename,            CacheControl: "max-age=604800,public,immutable",        },        // tags,    }).promise();My S3 CORS Policy is following like[    {        "AllowedHeaders": [            "*"        ],        "AllowedMethods": [            "GET",            "POST"        ],        "AllowedOrigins": [            "*"        ],        "ExposeHeaders": []    }]FollowComment"


Question: Download an object from S3 in a run document

"We have a role attached to a managed instance for ssm. It has rights to a private S3 bucket and it's contents.Do I have to do anything special in order to download a file using it's S3 url? Do I have to state in the run document to assume the role, or is it already implied?FollowComment"

Answer: "0Figured this out. The managed instance had the correct role, I just needed to install the awscli tools first, set the path so that powershell could use them, then issue the standard aws s3 cp command.Part of my run document looks like this. I'm using chocolatey to get the awscli tools installed.Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))choco install awscli -ysetx PATH "%PATH%;C:\Program Files\Amazon\AWSCLI"aws s3 cp s3://yadayadayada c:\then a line to remove the cli tool when donechoco uninstall awscli -yToo bad the ssm agent doesn't come with aws tools already installed for this kind of stuff, but that's ok.Edited by: kleinberger on Feb 13, 2019 2:13 PMCommentSharekleinbergeranswered 4 years ago"


Question: AWS Comprehend Custom Entity Recognition Error: The augmented manifest referenced in your InputDataConfig.AugmentedManifests at index 0 doesn't have any annotations.

"HelloI followed this page https://docs.aws.amazon.com/comprehend/latest/dg/cer-annotation-pdf.html to prepare data for the training.All data are collected in the dedicated S3 bucket.When I try to create a model if fails with this error message: *"The augmented manifest referenced in your InputDataConfig.AugmentedManifests at index 0 doesn't have any annotations.Check the AttributeNames you provided for this Augmented Manifest. The AttributeNames in the API must match the top-level keys containing the annotation json or reference in json lines of the manifest file. , exit code: 255" *I do not understand why it happens because I double checked the manifest file and it looks ok. For example sample line looks like this (here I used fake account id).    "source-ref":"s3://comprehend-semi-structured-docs-us-east-1-11111111111/src/I9-001f.pdf",    "page":"1",    "metadata":{        "pages":"3",        "use-textract-only":false,        "labels":[            "LastName",            "FirstName",            "DocumentNumber"        ]    },    "annotator-metadata":{        "info":"I hope it will work",        "Priority":"It has medium priority"    },    "first-job-for-Jacek-and-Matt-labeling-job-20230517T115059":{        "annotation-ref":"s3://comprehend-semi-structured-docs-us-east-1-11111111111/output/first-job-for-Jacek-and-Matt-labeling-job-20230517T115059/annotations/consolidated-annotation/consolidation-response/iteration-1/annotations/I9-001f-1-7a2216d3-ann.json"    },    "first-job-for-Jacek-and-Matt-labeling-job-20230517T115059-metadata":{        "type":"groundtruth/custom",        "job-name":"first-job-for-jacek-and-matt-labeling-job-20230517t115059",        "human-annotated":"yes",        "creation-date":"2023-05-17T12:26:54.162000"    }    }For model creation I use AWS Console with the following paths:SageMaker Ground Truth augmented manifest file S3 locations3://comprehend-semi-structured-docs-us-east-1-11111111111/output/first-job-for-Jacek-and-Matt-labeling-job-20230517T115059/manifests/output/output.manifestS3 prefix for Annotation data filess3://comprehend-semi-structured-docs-us-east-1-11111111111/output/first-job-for-Jacek-and-Matt-labeling-job-20230517T115059/annotations/consolidated-annotation/consolidation-response/iteration-1/annotations/S3 prefix for Source documentss3://comprehend-semi-structured-docs-us-east-1-11111111111/src/and the attribute name is first-job-for-Jacek-and-Matt-labeling-job-20230517T115059 - this attribute exists in the manifest file printed above.Any ideas what I am doing wrong? I already spent a lot of time on this without success. Maybe the error message is misleading and the problem is somewhere else? Maybe this name is too long or has invalid chars?-JacekFollowCommentkicaj29 14 days agoI thought that maybe the attribute name should not contain suffix with date time but I watched this https://youtu.be/oDk5aOd400c?t=366 and they use the attribute as it is together with the date time suffix.Share"

Answer: "0Hi JacekMay you please share the contents of the "annotation-ref" json from the sample line you have shared above. It is located at: "s3://comprehend-semi-structured-docs-us-east-1-11111111111/output/first-job-for-Jacek-and-Matt-labeling-job-20230517T115059/annotations/consolidated-annotation/consolidation-response/iteration-1/annotations/I9-001f-1-7a2216d3-ann.json"CommentShareSUPPORT ENGINEERNjabsanswered 12 days ago0In meantime I removed previous files but I am sharing new files even with less data but I still get the same error for these files when I use them to train a new model.output.manifest{"source-ref":"s3://comprehend-semi-structured-docs-us-east-1-111111111111/src_02/I-9_003.pdf","page":"1","metadata":{"pages":"1","use-textract-only":false,"labels":["LastName","FirstName"]},"annotator-metadata":{"info":"I hope it will work","Priority":"It has medium priority"},"job-for-labeling-02-labeling-job-20230518T063720":{"annotation-ref":"s3://comprehend-semi-structured-docs-us-east-1-111111111111/output/job-for-labeling-02-labeling-job-20230518T063720/annotations/consolidated-annotation/consolidation-response/iteration-1/annotations/I-9_003-1-1419c853-ann.json"},"job-for-labeling-02-labeling-job-20230518T063720-metadata":{"type":"groundtruth/custom","job-name":"job-for-labeling-02-labeling-job-20230518t063720","human-annotated":"yes","creation-date":"2023-05-18T06:41:59.467000"}}{"source-ref":"s3://comprehend-semi-structured-docs-us-east-1-111111111111/src_02/I-9_002.pdf","page":"1","metadata":{"pages":"1","use-textract-only":false,"labels":["LastName","FirstName"]},"annotator-metadata":{"info":"I hope it will work","Priority":"It has medium priority"},"job-for-labeling-02-labeling-job-20230518T063720":{"annotation-ref":"s3://comprehend-semi-structured-docs-us-east-1-111111111111/output/job-for-labeling-02-labeling-job-20230518T063720/annotations/consolidated-annotation/consolidation-response/iteration-1/annotations/I-9_002-1-5dc996bf-ann.json"},"job-for-labeling-02-labeling-job-20230518T063720-metadata":{"type":"groundtruth/custom","job-name":"job-for-labeling-02-labeling-job-20230518t063720","human-annotated":"yes","creation-date":"2023-05-18T06:41:59.504000"}}{"source-ref":"s3://comprehend-semi-structured-docs-us-east-1-111111111111/src_02/I-9_001.pdf","page":"1","metadata":{"pages":"1","use-textract-only":false,"labels":["LastName","FirstName"]},"annotator-metadata":{"info":"I hope it will work","Priority":"It has medium priority"},"job-for-labeling-02-labeling-job-20230518T063720":{"annotation-ref":"s3://comprehend-semi-structured-docs-us-east-1-111111111111/output/job-for-labeling-02-labeling-job-20230518T063720/annotations/consolidated-annotation/consolidation-response/iteration-1/annotations/I-9_001-1-5241949c-ann.json"},"job-for-labeling-02-labeling-job-20230518T063720-metadata":{"type":"groundtruth/custom","job-name":"job-for-labeling-02-labeling-job-20230518t063720","human-annotated":"yes","creation-date":"2023-05-18T06:43:05.079000"}}I-9_003-1-1419c853-ann.json{"Blocks": [{"BlockType": "LINE","Id": "6f1f5d4b-c5bd-4474-9bfd-1a4aab73dead","Text": "Employment Eligibility Verification USCIS","Geometry": {"BoundingBox": {"Width": 0.578890522875817,"Top": 0.03134469696969697,"Left": 0.32302287581699348,"Height": 0.016321969696969697},"Polygon": [{"X": 0.32302287581699348,"Y": 0.03134469696969697},{"X": 0.9019133986928105,"Y": 0.03134469696969697},{"X": 0.9019133986928105,"Y": 0.04766666666666666},{"X": 0.32302287581699348,"Y": 0.04766666666666666}]},"Relationships": [{"Ids": ["40893cf7-2e45-4e10-802a-c7c8b96dbe6b","1516182f-5b28-4dc3-904e-8411f42be966","96fca50a-f19f-40f0-8124-fcfacb999594","2fb46811-30e5-4b48-9e69-e75946dacb2a"],"Type": "CHILD"}],"Page": 1},{"BlockType": "WORD","Id": "40893cf7-2e45-4e10-802a-c7c8b96dbe6b","Text": "Employment","Geometry": {"BoundingBox": {"Width": 0.10801960784313726,"Top": 0.03251515151515151,"Left": 0.32302287581699348,"Height": 0.015151515151515152},"Polygon": [{"X": 0.32302287581699348,"Y": 0.03251515151515151},{"X": 0.4310424836601307,"Y": 0.03251515151515151},{"X": 0.4310424836601307,"Y": 0.04766666666666666},{"X": 0.32302287581699348,"Y": 0.04766666666666666}]},"Relationships": [],"Page": 1},{"BlockType": "WORD","Id": "1516182f-5b28-4dc3-904e-8411f42be966","Text": "Eligibility","Geometry": {"BoundingBox": {"Width": 0.08268627450980393,"Top": 0.03251515151515151,"Left": 0.43594444444444449,"Height": 0.015151515151515152},"Polygon": [{"X": 0.43594444444444449,"Y": 0.03251515151515151},{"X": 0.5186307189542484,"Y": 0.03251515151515151},{"X": 0.5186307189542484,"Y": 0.04766666666666666},{"X": 0.43594444444444449,"Y": 0.04766666666666666}]},"Relationships": [],"Page": 1},{"BlockType": "WORD","Id": "96fca50a-f19f-40f0-8124-fcfacb999594","Text": "Verification","Geometry": {"BoundingBox": {"Width": 0.10011764705882354,"Top": 0.03251515151515151,"Left": 0.5232777777777777,"Height": 0.015151515151515152},"Polygon": [{"X": 0.5232777777777777,"Y": 0.03251515151515151},{"X": 0.6233954248366013,"Y": 0.03251515151515151},{"X": 0.6233954248366013,"Y": 0.04766666666666666},{"X": 0.5232777777777777,"Y": 0.04766666666666666}]},"Relationships": [],"Page": 1},{"BlockType": "WORD","Id": "2fb46811-30e5-4b48-9e69-e75946dacb2a","Text": "USCIS","Geometry": {"BoundingBox": {"Width": 0.05292647058823529,"Top": 0.03134469696969697,"Left": 0.8489869281045752,"Height": 0.013939393939393939},"Polygon": [{"X": 0.8489869281045752,"Y": 0.03134469696969697},{"X": 0.9019133986928105,"Y": 0.03134469696969697},{"X": 0.9019133986928105,"Y": 0.045284090909090909},{"X": 0.8489869281045752,"Y": 0.045284090909090909}]},"Relationships": [],"Page": 1},{"BlockType": "LINE","Id": "89f02916-fe15-4221-b583-308e502dd7ed","Text": "Form I-9","Geometry": {"BoundingBox": {"Width": 0.0694117647058825,"Top": 0.04801136363636364,"Left": 0.8409477124183006,"Height": 0.013939393939393939},"Polygon": [{"X": 0.8409477124183006,"Y": 0.04801136363636364},{"X": 0.9103594771241831,"Y": 0.04801136363636364},{"X": 0.9103594771241831,"Y": 0.061950757575757579},{"X": 0.8409477124183006,"Y": 0.061950757575757579}]},"Relationships": [{"Ids": ["8c93cfde-2682-4a58-a72a-2956699f5f35","0aa40458-88cf-4244-944f-c2edf2bd12af"],"Type": "CHILD"}],"Page": 1},{"BlockType": "WORD","Id": "8c93cfde-2682-4a58-a72a-2956699f5f35","Text": "Form","Geometry": {"BoundingBox": {"Width": 0.04307843137254902,"Top": 0.04801136363636364,"Left": 0.8409477124183006,"Height": 0.013939393939393939},"Polygon": [{"X": 0.8409477124183006,"Y": 0.04801136363636364},{"X": 0.8840261437908497,"Y": 0.04801136363636364},{"X": 0.8840261437908497,"Y": 0.061950757575757579},{"X": 0.8409477124183006,"Y": 0.061950757575757579}]},"Relationships": [],"Page": 1},{"BlockType": "WORD","Id": "0aa40458-88cf-4244-944f-c2edf2bd12af","Text": "I-9","Geometry": {"BoundingBox": {"Width": 0.02215686274509804,"Top": 0.04801136363636364,"Left": 0.888202614379085,"Height": 0.013939393939393939},"Polygon": [{"X": 0.888202614379085,"Y": 0.04801136363636364},{"X": 0.9103594771241831,"Y": 0.04801136363636364},{"X": 0.9103594771241831,"Y": 0.061950757575757579},{"X": 0.888202614379085,"Y": 0.061950757575757579}]},"Relationships": [],"Page": 1},{"BlockType": "LINE","Id": "a676e7a0-71e5-4b6c-9ecb-30f0ac39a4aa","Text": "Department of Homeland Security","Geometry": {"BoundingBox": {"Width": 0.2651764705882353,"Top": 0.05422348484848485,"Left": 0.3379248366013072,"Height": 0.013939393939393939},"Polygon": [{"X": 0.3379248366013072,"Y": 0.05422348484848485},{"X": 0.6031013071895425,"Y": 0.05422348484848485},{"X": 0.6031013071895425,"Y": 0.06816287878787879},{"X": 0.3379248366013072,"Y": 0.06816287878787879}]},"Relationships": [{"Ids": ["34c1d0c0-b7b2-4b84-a6da-a0306eb18d54","adecd3fc-d54e-423d-80f4-5115fd76801f","c7135e9e-d61a-49ee-809a-5e167005a3fc","7658976a-32a0-4674-b257-97a6d83b2a8d"],"Type": "CHILD"}],"Page": 1},{"BlockType": "WORD","Id": "34c1d0c0-b7b2-4b84-a6da-a0306eb18d54","Text": "Department","Geometry": {"BoundingBox": {"Width": 0.09284803921568628,"Top": 0.05422348484848485,"Left": 0.3379248366013072,"Height": 0.013939393939393939},"Polygon": [{"X": 0.3379248366013072,"Y": 0.05422348484848485},{"X": 0.4307728758169935,"Y": 0.05422348484848485},{"X": 0.4307728758169935,"Y": 0.06816287878787879},{"X": 0.3379248366013072,"Y": 0.06816287878787879}]},"Relationships": [],"Page": 1},{"BlockType": "WORD","Id": "adecd3fc-d54e-423d-80f4-5115fd76801f","Text": "of","Geometry": {"BoundingBox": {"Width": 0.015026143790849673,"Top": 0.05422348484848485,"Left": 0.43533660130718956,"Height": 0.013939393939393939},"Polygon": [{"X": 0.43533660130718956,"Y": 0.05422348484848485},{"X": 0.4503627450980392,"Y": 0.05422348484848485},{"X": 0.4503627450980392,"Y": 0.06816287878787879},{"X": 0.43533660130718956,"Y": 0.06816287878787879}]},"Relationships": [],"Page": 1},{"BlockType": "WORD","Id": "c7135e9e-d61a-49ee-809a-5e167005a3fc","Text": "Homeland","Geometry": {"BoundingBox": {"Width": 0.08002124183006536,"Top": 0.05422348484848485,"Left": 0.45472875816993466,"Height": 0.013939393939393939},"Polygon": [{"X": 0.45472875816993466,"Y": 0.05422348484848485},{"X": 0.53475,"Y": 0.05422348484848485},{"X": 0.53475,"Y": 0.06816287878787879},{"X": 0.45472875816993466,"Y": 0.06816287878787879}]},"Relationships": [],"Page": 1},{"BlockType": "WORD","Id": "7658976a-32a0-4674-b257-97a6d83b2a8d","Text": "Security","Geometry": {"BoundingBox": {"Width": 0.06409313725490197,"Top": 0.05422348484848485,"Left": 0.5390081699346405,"Height": 0.013939393939393939},"Polygon": [{"X": 0.5390081699346405,"Y": 0.05422348484848485},{"X": 0.6031013071895425,"Y": 0.05422348484848485},{"X": 0.6031013071895425,"Y": 0.06816287878787879},{"X": 0.5390081699346405,"Y": 0.06816287878787879}]},"Relationships": [],"Page": 1},{"BlockType": "LINE","Id": "932b6392-79b7-4ebc-8c2c-308c27776c3a","Text": "OMB No. 1615-0047","Geometry": {"BoundingBox": {"Width": 0.11224836601307187,"Top": 0.06476893939393939,"Left": 0.8193790849673203,"Height": 0.010151515151515148},"Polygon": [{"X": 0.8193790849673203,"Y": 0.06476893939393939},{"X": 0.9316274509803921,"Y": 0.06476893939393939},{"X": 0.9316274509803921,"Y": 0.07492045454545454},{"X": 0.8193790849673203,"Y": 0.07492045454545454}]},"Relationships": [{"Ids": ["2ae600f4-2715-4c8f-af20-915ef9fcf1a8","a9f4d9a4-6ffe-4f8e-b2ab-6459350f7ce1","73f669bf-ecc4-4b75-9e7f-6fcf8fa030d8"],"Type": "CHILD"}],"Page": 1},{"BlockType": "WORD","Id": "2ae600f4-2715-4c8f-af20-915ef9fcf1a8","Text": "OMB","Geometry": {"BoundingBox": {"Width": 0.029926470588235299,"Top": 0.06476893939393939,"Left": 0.8193790849673203,"Height": 0.010151515151515151},"Polygon": [{"X": 0.8193790849673203,"Y": 0.06476893939393939},{"X": 0.8493055555555555,"Y": 0.06476893939393939},{"X": 0.8493055555555555,"Y": 0.07492045454545454},{"X": 0.8193790849673203,"Y": 0.07492045454545454}]},"Relationships": [],"Page": 1},{"BlockType": "WORD","Id": "a9f4d9a4-6ffe-4f8e-b2ab-6459350f7ce1","Text": "No.","Geometry": {"BoundingBox": {"Width": 0.019142156862745099,"Top": 0.06476893939393939,"Left": 0.8526813725490197,"Height": 0.010151515151515151},"Polygon": [{"X": 0.8526813725490197,"Y": 0.06476893939393939},{"X": 0.8718235294117648,"Y": 0.06476893939393939},{"X": 0.8718235294117648,"Y": 0.07492045454545454},{"X": 0.8526813725490197,"Y": 0.07492045454545454}]},"Relationships": [],"Page": 1},{"BlockType": "WORD","Id": "73f669bf-ecc4-4b75-9e7f-6fcf8fa030d8","Text": "1615-0047","Geometry": {"BoundingBox": {"Width": 0.056625816993464059,"Top": 0.06476893939393939,"Left": 0.8750016339869281,"Height": 0.010151515151515151},"Polygon": [{"X": 0.8750016339869281,"Y": 0.06476893939393939},{"X": 0.9316274509803921,"Y": 0.06476893939393939},{"X": 0.9316274509803921,"Y": 0.07492045454545454},{"X": 0.8750016339869281,"Y": 0.07492045454545454}]},"Relationships": [],"Page": 1},{"BlockType": "LINE","Id": "399fbd18-1ee5-47bc-ae34-ca318957f363","Text": "U.S. Citizenship and Immigration Services","Geometry": {"BoundingBox": {"Width": 0.3084346405228758,"Top": 0.07104166666666667,"LeCommentSharekicaj29answered 12 days ago0I see that the content of  file I-9_003-1-1419c853-ann.json has been cropped so I am adding here some lines from the bottom of the file.},"Relationships": [],"Page": 1},{"BlockType": "WORD","Id": "1a6b5a92-0ded-489c-a299-dd883b778179","Text": "3","Geometry": {"BoundingBox": {"Width": 0.007352941176470588,"Top": 0.9692727272727273,"Left": 0.9340653594771242,"Height": 0.011363636363636364},"Polygon": [{"X": 0.9340653594771242,"Y": 0.9692727272727273},{"X": 0.9414183006535948,"Y": 0.9692727272727273},{"X": 0.9414183006535948,"Y": 0.9806363636363636},{"X": 0.9340653594771242,"Y": 0.9806363636363636}]},"Relationships": [],"Page": 1}],"BlocksS3Ref": "s3://comprehend-semi-structured-docs-us-east-1-111111111111/comprehend-semi-structured-docs-intermediate-output/job-for-labeling-02-labeling-job-20230518t063720/I-9_003_1_blocks.json","DocumentMetadata": {"Pages": "1","PageNumber": "1"},"Version": "2021-04-30","DocumentType": "NativePDF","Entities": [{"BlockReferences": [{"BlockId": "3e4881f0-fa14-4a72-b31f-b3323817a36f","ChildBlocks": [{"BeginOffset": 0,"EndOffset": 35,"ChildBlockId": "94572034-c5d3-4b33-beec-9485d5ddcbeb"}],"BeginOffset": 0,"EndOffset": 35}],"Text": "Wolfeschlegelsteinhausenbergerdorff","Type": "LastName","Score": 1},{"BlockReferences": [{"BlockId": "3e4881f0-fa14-4a72-b31f-b3323817a36f","ChildBlocks": [{"BeginOffset": 0,"EndOffset": 6,"ChildBlockId": "025da007-2c08-4cc7-9b47-ee08e99b9a52"}],"BeginOffset": 36,"EndOffset": 42}],"Text": "Hubert","Type": "FirstName","Score": 1}],"File": "I-9_003-1-1419c853-ann.json"}CommentSharekicaj29answered 12 days ago"


Question: URISyntaxException when querying dynamodb using AWS Athena and AWS Glue Catalog: java.net.URISyntaxException: Relative path in absolute URI

"Any help to fix this error will be appreciated.. Thanks your your time..This was the error seen:GENERIC_INTERNAL_ERROR : java.net.URISyntaxException : Relative path in absolute URI: arn:aws:dynamodb:us-east-1:xyz:table/xyz-ServiceConf This query ran against the "" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: 555c323d-39c8-44ba-821a-8f507b446233This was the query:select * from "AwsDataCatalog"."ddb_glue_db"."xyz_serviceconf"This is the definition of the table in AWS Glue data catalog:Namexxx_serviceconfDescriptionDatabaseddb_glue_dbClassificationdynamodbLocationarn:aws:dynamodb:us-east-1:xyz:table/xyz-ServiceConfConnectionDeprecatedNoLast updatedWed Feb 02 13:27:24 GMT+530 2022Serde parameters-Table propertiessizeKey 606 hashKey configVersion UPDATED_BY_CRAWLER ddb_crawl_xxxx-xxx-server CrawlerSchemaSerializerVersion 1.0 recordCount 1 averageRecordSize 606 CrawlerSchemaDeserializerVersion 1.0 compressionType none typeOfData tableFollowComment"


Question: Possibility of having multiple API Gateways for API Versioning

"Let us say, I want to do versioning of APIs both for internal usage (client app) lambdas as well as for exposing some set of APIs (lambdas) for a third-party system. Before even starting to version, I want to enquire whether there is possibility of having multiple API Gateways for the same ? One for managing and deploying the internal APIs and another for deploying the APIs to expose to third-party system without cloud-front.Or can single API gateway can manage both flows ?What is the best method to manage this ?Any suggestion / approach would be appreciated.FollowComment"

Answer: "1It would depend on the security requirements you have for internal vs external.If the internal APIs should not be accessible to the public internet, then it would likely be best to setup different API Gateways with the internal one leveraging a private API Gateway. Instructions can be found here for setting this up.If only the authorization mode is different and the APIs can be exposed to the public internet, then you can potentially leverage one API and create separate authorizers for external vs internal.  This blog post walks through how these authorizers can be created and setup on a method level within API Gateway:CommentShareBrent Everman AWSanswered 2 months agoAshwin 2 months agoThanks for the reply. Let us assume that I go ahead with another API gateway to expose APIs for the external customers, is there any service / way in AWS which helps to create JWT Token and use it as API Key in API Gateway (rather than creating one) to send additional information for the customers ? In this case, there is no cloudfront. In API gateway there is an option to only create API key but how to generate JWT token and use it as API key ?Share1API Keys are mainly used to track who is using your API and/or creating usage plans.  Docs for setting this up.In the docs above its noted, "Don't use API keys for authentication or authorization for your APIs."Depending on your requirement, you can leverage Cognito or a Lambda custom authorizer if you have an custom authorization scheme.CommentShareBrent Everman AWSanswered 2 months agoAshwin 2 months agook thanks. And I have some more questions on extension to the above.If API key should not be used for authentication or authorization for the APIs, can we use some 'x' along with API Key for doing authentication or authorization using any auth services for (Machine 2 Machine) ? If so, can you provide some approach ?Let us say, If I am planning to use JWT, how do I perform authorization and authentication on top of API Gateway for server to server (M2M) communication for external systems to access my APIs ?Is there any possibility of using best of both worlds ? (API key along with 'x' and JWT for authentication and authorization)Could you please share some approach for the above scenarios / best practices to achieve this for server to server authentication and authorization ?Share1For machine to machine authentication/authorization, you would still want to leverage Cognito.  This example walks through how to setup the App Integration in Cognito with a client id/client secret.CommentShareBrent Everman AWSanswered 2 months agoAshwin a month agoAlright! Thanks for the answer. I have some questions. I wanted to know about the security and infrastructure challenges based on the below use case.  For example, Let us assume the following use case. I have a project containing 100 APIs in 1 codebase. Out of this, I want to expose 60 APIs for internal usage that can be deployed to API Gateway AG1. These APIs are already authorized by an existing authorizer AU1. Now, for the remaining 40 APIs I want to expose them to the 3rd party developers/clients who are not logged in with our application, and that can be deployed to API Gateway AG2. Now I want these APIs to be authorized by a new authorizer AU2.Is it possible to configure a lambda to point to multiple authorizers just in case the same API is exposed for internal as well as external usage?Can this project be split into 2 codebases, one for exposing internal APIs and another one for exposing APIs to 3rd party so that we can have one authorizer for each project. ?a) One codebase having multiple authorizers + multiple API Gateways or b) 2 Codebases (each with a separate authorizer and API Gateway). What is the recommended approach?In which approach it is easy to do API versioning, 3a) or 3b)?Share"


Question: Could not retrieve mirrorlist https://rhui3.ap-southeast-2.aws.ce.redhat.com/pulp/mirror/content/dist/rhel/rhui/server/7/7Server/x86_64/rh-common/os error was14: curl#35 - "Peer reports incompatible

Have a RHEL 7.1 server that I am trying to update. I was previously receiving 'Could not contact any CDS load balancers: https://rhui3.us-east-1.aws.ce.redhat.com/pulp/content/' when running yum update. So I followed the instructions in the below guidehttps://repost.aws/questions/QUIU2gj0WaRAGLqD20xyTXXg/rhel-7-yum-list-could-not-contact-any-cds-load-balancers-https-rhui-3-us-east-1-aws-ce-redhat-com-pulp-contentBut now I am getting the below errorLoaded plugins: amazon-idCould not retrieve mirrorlist https://rhui3.ap-southeast-2.aws.ce.redhat.com/pulp/mirror/content/dist/rhel/rhui/server/7/7Server/x86_64/rh-common/os error was14: curl#35 - "Peer reports incompatible or unsupported protocol version."FollowComment


Question: Accessing RDS in Private Isolated VPC using IAM Authentication

"Hello,I have a PostgreSQL RDS instance hosted in a Private Isolated VPC Subnet, and therefore is not accessible from the Internet. Besides creating a Bastion to access it, can I not allow connections to it using IAM Authentication or some other method?Thanks!FollowComment"

Answer: "0You can use VPC Interface Endpoints (PrivateLink) for this use-case. Basically, you'll get a private connection (that doesn't go over the internet) between your consumer VPC and your RDS VPC's API endpoint.This link explains it in detail: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/vpc-interface-endpoints.htmlCommentShareACanswered a year ago"


Question: Secured ISP to Lambda?

"Hi, I was wanting to "securely" stream data from a rack i have in an ISP to my AWS Lambda instance. I was wondering what the best solution might be? I thought of something sort of vpn and perhaps kinesis to lambda but not sure how i would initiate that from the on premises rack and that was a shot in the dark. Would appreciate any input. Thank you.FollowComment"

Answer: "0What types of data do you want to stream?In either case, there are different options. As you did mention stream then Kinesis Data Streams seems like an appropriate solution. The client (application running in the ISP) will need to send the data into Kinesis. For that you will need to give it AWS credentials that will allow it to write ti the stream. Another option is to send the data to API GW that will place it into Kinesis Data Streams. Your client will also need some credentials to auth with API GW.CommentShareEXPERTUrianswered a year ago0The answer will really depend on the type of data, the amount of data and if you want to have it streamed continuously. If you wanted to go the Kinesis route, then you can send via various methods https://docs.aws.amazon.com/streams/latest/dev/building-producers.htmlThe uploading and downloading of data to and from Kinesis is dine via SSL/TLS.You can also see the Security details here: https://aws.amazon.com/kinesis/data-streams/faqs/?nc=sn&loc=6CommentShareEXPERTShlomo Dubrowinanswered a year ago"


Question: Instance Stuck During Force Stop

"EC2 instance ID: i-0683386986f12766a (AWS Sydney)My instance has failed connections, and fails status check. I've tried a reboot, a stop and now a forced stop and it is stuck in Stopping state.Also console access and screenshots fail with a system error.How can this be fixed?FrankFollowComment"

Answer: "0Accepted AnswerAfter waiting for about 2 hours it finally stopped and I was able to restart it.CommentShareFrank-8442110answered 8 months ago0Instances might appear "stuck" in the stopping state when there is a problem with the underlying hardware hosting the instance. This can also occur when hibernating a hibernation-enabled instance.In future, you can refer to KC article: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-stuck-stopping-state/CommentShareVrapoluanswered 8 months ago"


Question: Unable to delete network interfaces attached to VPC Endpoint

"I have two Network Interfaces that are attached to a VPC Endpoint. When I try delete the VPC Endpoint I get the following error: Operation is not allowed for requester-managed VPC endpoints for the service. When I try detach the associated Network Interfaces I get: The network interface can't be detached (Network interface is in use by another service).After some googling and reading this forum, I have seen suggestions something is still using a Network Interface or the VPC Endpoint but I cannot figure out what.FollowComment"

Answer: "1Maybe this post will help to find a ressource attached to the interface: https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-dependency-error-delete-vpc/ and the CLI command describe-network-interfaces: https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-network-interfaces.htmlCommentSharerePost-User-5170769answered a year ago0I ended up answering my own question. I had an Aurora Serverless DB in a VPC, which creates a VPC endpoint and related network interfaces which are considered "requester-managed". Once I deleted the database, the above resources disappeared.CommentShareGarlicBoyMananswered 2 years ago0Though it had been 2 years ago. This is the question where Google search of ENI “Network interface is in use by another service” will bring at the top. Let me add some more information I found useful.I had the similar issue as the question. I could not figure out what held my ENI.Use this CLI (https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-network-interfaces.html) as rePost-User-5170769 pointed out.For example, if you search eni-123412341234 (I converted every unique values to 123412341234) in the below snippet of output of aws ec2 describe-network-interfaces, you see that Description: field has the hint.            “Description”: “EFS mount target for fs-123412341234 (fsmt-123412341234)”,  <=== this is a sample hint you want            “Groups”: [                {                    “GroupName”: “security-group-for-inbound-nfs-d-123412341234”,                    “GroupId”: “sg-123412341234”                }            ],            “InterfaceType”: “efs”,            “Ipv6Addresses”: [],            “MacAddress”: “<snip>“,            “NetworkInterfaceId”: “eni-123412341234”, <=== this is your search pointI deleted the unused EFS resources and then the VPC deletion was successful.CommentSharerePost-User-0511784answered a month ago"


Question: Need Help! The certificate validation email I usually receive to renew certificate is not being received via email. How do I request this be fixed?

"I have received emails when a certificate renewal is required in the past.  However, this time I have received notification that my cert needs renewal and is pending but I have not received the validation email.  I have requested a resend of the validation email many times through my ASW Certificate manager but the email is never received.  I have checked junk, quarantine and all of the usual items on my side to ensure the issues isn't with my end.  I have even gone to the length of changing the email with in my domain registrar to see if I receive it to another email but that is not working either.  How do I get this to work before my certificate expires?FollowComment"

Answer: "0Hi,When you request a certificate from ACM and choose email validation, domain validation email is sent to three contact addresses specified in WHOIS and five common administrative addresses. For more information, see Email validation. If you are experiencing problems receiving validation email, review the suggestions that follow.https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-email-validation.htmlHere are all troubleshooting steps for managed renewal - https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-renewal.htmlCommentShareAWS-CSinghanswered 4 months ago"


Question: AWS Root MFA: Alternate Method: Email verification link expired

"Customer tried "Troubleshooting MFA" and entered the email address as the first step. When they click on the link that they receive, they get that "Email is expired" (Even before 15 mins)FollowComment"

Answer: "0First, have the customer try resolving this concern using the self-service options. See To sign in using alternative factors of authentication as an AWS account root user at Recovering a root user MFA device. If they still need help, see Lost or unusable Multi-Factor Authentication (MFA) device.CommentShareBriNasAWSanswered a month ago"


Question: Properties are nill in new functions in lua script how to fix this?

"Ok this is my problem I created a new function and I try and use the variables in the properties in it but to the function they basically don't exist. I'm not sure how this is done but how do I make sure newly created functions can access the Properties that I create.This is my Code:REMOVEDUPLOADThese R my PropertiesREMOVEDUPLOADThis is where I Cause the function to to reload the ammoREMOVEDUPLOADThis is where I update the properites but in the console says they are all nill.Is there a method to pass variables to functions, am I missing something. Any Help would make me happy. :DFollow"

Answer: "0Accepted Answer@REDACTEDUSERThere are two questions/problems here:the nil issuepassing variables to a functionOn #1:I believe your problem is in your debug.log call to the self. It should be self.Properties.myAmno#2:Yes, you can pass values to your functions, but it's not required for this example. Just put the value you wish to pass in the () of the function call.Then in the function declaration, put the parameter name that you want to use in the function in the ().Hope that puts you on the right track!SharerePost-User-1395243answered 5 years ago0U r correct @REDACTEDUSERSharerePost-User-7620461answered 5 years ago0Errors are very unforgiving and cant tell there there till they hit u in the face. : ) well doneSharerePost-User-7620461answered 5 years ago0And in game engines doubly so!-)SharerePost-User-1395243answered 5 years ago"


Question: Rancher - Unable to import clusters

"I have installed rancher with helm chart approach on EKS cluster using this link. https://rancher.com/docs/rancher/v2.6/en/installation/install-rancher-on-k8s/#install-the-rancher-helm-chart with Rancher Generated TLS Certificate and manually had to edit Ingress to add IngressClass:nginx. As a pre-req, I also deployed ingress controller using Step 5, https://rancher.com/docs/rancher/v2.6/en/installation/resources/k8s-tutorials/amazon-eks/. I did not setup route53 , but using LoadBalancer Domain as is to login to rancher. Am able to login rancher, but unable to create/import existing clusters.  Goes into provision mode and on Condition tabs shows "But get message <[Disconnected] Cluster agent is not connected", "Waiting For API to be available", " [Error] Error while applying agent YAML, it will be retried automatically: exit status 1, Unable to connect to the server: remote error: tls: internal error"FollowComment"


Question: Route53 - TLD - .room Generic TLD domain

"Hi AWS Team,I would like to support TLD .roomWhy can't I handle Amazon's rights?Thanks in advance KouheiFollowComment"

Answer: "0Hi Kouhei,I believe you want to register a domain with Route 53 TLD .room.With Route 53 you can only register the TLD if it is support in below list [1]. As per the list, .room is unfortunately not supported.I trust the above is helpful. Please let me know if you have any further questions or concerns. Happy to help![1] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/registrar-tld-list.htmlCommentShareLwazianswered a year ago"


Question: How to use custom functions for a model in a Sagemaker pipeline?

"If I want to use a custom function transformer in preprocessing, how do I ensure that it's detected at both pipeline building and deployment?I'm building a sklearn pipeline, and in preprocessing I use a custom FunctionTransformer. In Sagemaker, I am able to train, evaluate, and register the model, but get the below error when I try to deploy it:AttributeError: Can't get attribute 'truncate_function' on <module '__main__' from '/miniconda3/bin/gunicorn'>I've tried putting the functions into a helper.py file, and including it as a dependency during training, but then get the following error when evaluating in a ProcessingStep: "ModuleNotFoundError: No module named 'helper'.FollowCommentyann_stoneman 7 months agoCould you please share the parts of the script responsible for creating the directory, files, and imports (only the parts relevant to your question, and removing anything sensitive)? I'll be looking out for a %%writefile magic, like: %%writefile folder/helper.py as described here: https://docs.aws.amazon.com/sagemaker/latest/dg/define-pipeline.htmlShare"


Question: I want to host videos on AWS and embed these videos in WordPress +

"Hello, I have a site that offers training courses. This site is built on WordPressI would like to host these videos on AWS and embed them on my WordPress site2.I want to enable a protection system on these videos so that they appear to users Dynamic Watermark with their IDFollowCommentrePost-User-0665211 2 days agoits possibleShare"

Answer: "0Accepted AnswerQuestion 1:You can store your vides in Amazon S3, the vast object storage. Depending on your application, the videos could be saved as MP4s, HLS, DASH, etc.Then create an Amazon CloudFront Distribution that allows reading of those videos. Along with this, use OAC (Origin Access Control) which configures the S3 Bucket(s) to allow reading to occur only from the CloudFront distribution. You may need to create several Origins in the distribution if multiple S3 bucket are used.Then place the CloudFront distribution + file reference URL links in your WordPress site.Question 2:Dynamic Watermarking for each viewer: Will this be viewable or a hidden watermark?This could be achieved using AWS Elemental MediaConvert to transcode the video on the fly, using a burned in ID number in the video. MediaConvert has a feature that allows for growing HLS manifests, for dynamic needs such as this.It would take some building and is not an available solution that exists to day. Also, it would require an authentication system for validating the user and providing an ID.Example: Videos are Stored as MP4 FilesAmazon Cognito for view authentication and IDLambda function to obtain ID and create an image of IDLambda function to create a MediaConvert transcode job with ID image into HLS, placed in S3 bucketCloudFront to retrieve the HLS stream from S3 and provide to the WordPress sight.This is a bit complex to build. There may be existing third party solutions for Dynamic Watermarking solutions.CommentShareMike-MEanswered 3 hours ago"


Question: Response code 400 when trying to set scale-in protection

"I want to to set scale-in protection as explained here via a PUT request to $ECS_AGENT_URI/task-protection/v1/state.However, I always get the following error: Response code 400 (Bad Request) .This is my code:const got = require("got");const SCALE_IN_PROTECTION_DURATION_MINUTES = 15;const TASK_PROTECTION_URI = `${process.env.ECS_AGENT_URI}/task-protection/v1/state`;try {  const minutes = SCALE_IN_PROTECTION_DURATION_MINUTES;  await got(TASK_PROTECTION_URI, {    method: "PUT",    json: { ProtectionEnabled: true, ExpiresInMinutes: minutes },  });} catch (error) {  logger.error(error);}process.env.ECS_AGENT_URI is set properly and the instance agent version is 1.70.0FollowComment"

Answer: 0Accepted AnswerThe code was correct. The solution was to add the ecs:UpdateTaskProtection permission to my ECS task as  described here.CommentSharefloanswered 2 months ago


Question: Files missing on EFS

"I have been using EFS for a while, one day I found all files are missing, except the root folder I created still there. When I look at the EFS properties, I can still see the size been used, I just can't see any files.  I can also create new files in it and can see these new files, just all the old files are missing. This is very strange. Could anyone help take a look?The file system id is fs-8098ce03.Edited by: KunZhuMoodys on Oct 26, 2020 12:28 AMFollowComment"

Answer: 0Turns out some one changed the security group. After change back it's OK now.CommentShareKunZhuMoodysanswered 3 years ago


Question: CONSTRAINT_VIOLATION: Query exceeded maximum columns or filters.

"Hi AllI have encountered a new error after the athena upgrade to V2. this error only happens when we load a columnar file (csv) that contains more than 200+ columns.the error message is:  This query ran against the "<db name>" database, unless qualified by the query. Please post the error message on our forum or contact customer support .....```     We have roll the engine version back to version 1 and it worked, its a pretty large breaking change, limiting column counts (and its not in release notes). does anyone know why v2 limit the column counts and what's the solution?    Regards  HZ    Edited by: hz-DCS on Jun 14, 2021 7:47 PMFollowComment"

Answer: "0Any update?I too have received the same error message.  In my case, I have only 1 column-- so I know the problem is likely not the number of columns. That said, seems to me that  the error message is misleading.The failing queries have a modest number of FILTER calls ( <= 20) but a large number of CONTAINS, 1050.CommentShareAWS-User-0247734answered 2 years ago"


Question: Increasing the limit of keys in a usage plan in AWS API Gateway

"I have some was api's deployed in AWS API Gateway, and there is a key named "x_key", Since keys can be added to multiple usage plans , this key is also added to 10 such plans. But when I try to add it onto the 11th usage plan it throws error similar to the followingAn error occurred: MyServiceKey - Resource handler returned message: "The Usage Plan limit for API Key x_key has been reached. The limit is 10 (Service: ApiGateway, Status Code: 400, Request ID: 2xxxxxd5-baxx-4xx6-rx00-dxxxxxxx65f)" (RequestToken: xxxx00a4-x0x0-0000-000x-f48xxxxxxx8, HandlerErrorCode: InvalidRequest).Before asking to the forum, I tried to find this limit in the console, but was unable to do so. Also, I checked the quota and limits documentation from the AWS but no help.FollowComment"

Answer: "0If you look at this - https://docs.aws.amazon.com/apigateway/latest/developerguide/limits.html#apigateway-account-level-limits-tableIt says Usage Plans Per API Key - 10[]CommentShareEXPERTIndranil Banerjee AWSanswered 10 months agorePost-User-9886551 10 months agoYes, but from where could I increase this quota, wasn't able to find that.  Thanks for answeringShareIndranil Banerjee AWS EXPERT10 months agohttps://docs.aws.amazon.com/general/latest/gr/aws_service_limits.htmlTo request a quota increase, you can use Service Quotas or contact the AWS Support CenterShare"


Question: Unable to override taskRoleArn when running ECS task from Lambda

"I have a Lambda function that is supposed to pass its own permissions to the code running in an ECS task. It looks like this:    ecs_parameters = {        "cluster": ...,        "launchType": "FARGATE",        "networkConfiguration": ...,        "overrides": {            "taskRoleArn": boto3.client("sts").get_caller_identity().get("Arn"),           ...        },        "platformVersion": "LATEST",        "taskDefinition": f"my-task-definition-{STAGE}",    }    response = ecs.run_task(**ecs_parameters)When I run this in Lambda, i get this error:"errorMessage": "An error occurred (ClientException) when calling the RunTask operation: ECS was unable to assume the role 'arn:aws:sts::787364832896:assumed-role/my-lambda-role...' that was provided for this task. Please verify that the role being passed has the proper trust relationship and permissions and that your IAM user has permissions to pass this role."If I change the task definition in ECS to use my-lambda-role as the task role, it works. It's specifically when I try to override the task role from Lambda that it breaks.The Lambda role has the AWSLambdaBasicExecutionRole policy and also an inline policy that grants it ecs:runTask and iam:PassRole. It has a trust relationship that looks like:"Effect": "Allow","Principal": {  "Service": [      "ecs.amazonaws.com",      "lambda.amazonaws.com",      "ecs-tasks.amazonaws.com"  ]},"Action": "sts:AssumeRole"The task definition has a policy that grants it sts:AssumeRole and iam:PassRole, and a trust relationship that looks like:"Effect": "Allow","Principal": {   "Service": "ecs-tasks.amazonaws.com",    "AWS": "arn:aws:iam::account-ID:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS"},"Action": "sts:AssumeRole"How do I allow the Lambda function to pass the role to ECS, and ECS to assume the role it's been given?P.S. - I know a lot of these permissions are overkill, so let me know if there are any I can get rid of :)Thanks!FollowCommentMichael_F EXPERTa year agoCan you supply the policy statements attached to the Lambda execution role?ShareAWS-User-4882383 a year agoI'm using the AWS-managed Lambda execution role (if that's what you were asking)."Effect": "Allow","Action": ["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],"Resource": "*"Share"

Answer: "0In order for your Lambda function to pass the role to RunTask, the function's execution role policy needs to allow both ecs:RunTask and iam:PassRole. The policy currently associated with the function does not allow these actions.Note: The ECS Task Role does not need these permissions. The Task Role only needs those permissions necessary for the functioning of the application itself.CommentShareEXPERTMichael_Fanswered a year agoAWS-User-4882383 a year agoThanks for the response! I think I might have been unclear. The Lambda function also has this inline policy:{    "Version": "2012-10-17",    "Statement": [        {            "Action": [                "ecs:runTask",                "iam:PassRole"            ],            "Resource": "*",            "Effect": "Allow"        }    ]}in addition to the AWSLambdaBasicExecutionRole and various other policies.ShareAWS-User-4882383 a year agoI should also note that when I try to run this locally, I get:botocore.errorfactory.ClientException: An error occurred (ClientException) when calling the RunTask operation: ECS was unable to assume the role 'arn:aws:iam::account-ARN:user/my-user' that was provided for this task. Please verify that the role being passed has the proper trust relationship and permissions and that your IAM user has permissions to pass this role.My user has Administrator Access, so I believe the problem is on the ECS side rather than on the Lambda side.Let me know if there's any more information I can provide. Thanks!Share0Hello,Thank you for clarifying that Lambda execution role has required proper permission to run ECS task and IAM PassRole. The trust relationship policy configuration also looks good, allowing ECS task to assume the role. Here is the general troubleshooting guideline to troubleshoot this issue:https://aws.amazon.com/premiumsupport/knowledge-center/ecs-unable-to-assume-role/For further troubleshooting, we will need to look into account specific details. Please reach out to AWS support to investigate the issue.CommentShareSUPPORT ENGINEERIsha_Kanswered a year ago"


Question: EBS Disk is full

"We are almost running out of 16 TiB space on a EBS disk. The application can only mount to a single mount. For example:  lets call it as appWe don't want to change the instance type. I was wondering if you could suggest how we can solve this?Would it be ideal to add another EBS disk, move some of the old data to the new disk and then make symlinks on the old EBS volume to the moved data on the new EBS volume?ThanksFollowComment"

Answer: "1Accepted AnswerI'm assuming that the application can only deal with one directory instead of one mount. Something like:/data - 16TB VolumeWhere something like this would not work:/data - 16TB Volume/data2 - 16TB VolumeHow about mounting the volumes in this manner:/data/current - 16TB Volume/data/old - 16TB VolumeYou could also look at using Amazon EFS.CommentShareEXPERTkentradanswered a year agoSri a year agoThank you. Our application can't cater /data/current and /data/old. The data is stored under /data/yyyy/mm and we can't mount 2 mount points as we need a single mount pointEFS would cause performance issues, So EBS would be the correct choice.Sharekentrad EXPERTa year agoBut the application does not mount the volumes, it is only dealing with paths into the file system, right? So, you could have each /data/yyyy mounted with a different volume. The application traversing the directory would be unaware that these are multiple volumes. It would be pretty easy to test.ShareSri a year agoYes, I agree. the application can't cater for different paths such as /data/current and /data/old. Let's say it uses the path like /app/data/yyyy/mmwe usually create sym links under /app to point to a diff pathSharekentrad EXPERTa year agoUsing sym links should work, but I'm not sure what additional benefit it gets you. You still have to mount the additional volumes. /app/data/2022 is the mount point for a 16TB volume. /app/data/2021 is the mount point for another 16TB volume. And so on.ShareSri a year agoThank you very much for all your help.Share1You can modify your volume and increase the size of your EBS Volume for details on how to do it see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/requesting-ebs-volume-modifications.htmlOnce the Volume is increased you can extend the File System after the volume has been resized, for details on how to resize the File System see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/recognize-expanded-volume-linux.htmlCommentShareNuno_Qanswered a year agoSri a year agoI agree but we have hit the max limit on a single EBS volume of 16TB, hence I would like to ask if we should create another volume. move some old data to the new volume and then sym linkShareSri a year agoThank you NunoShare1You can also attach multiple volumes and RAID them together: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/raid-config.htmlCommentShareRodney Lesteranswered a year agoSri a year agoThank you RodneyShare"


Question: Subscribe device shadows using mqtt bridge component

"Hi,I want to subscribe to the device shadow changes on IoTCore. For example if someone changes the device shadow via AWS Greengrass console, I want to get the change on my local mqtt broker on the device. For this purpose I made a deployment to the device with this aws.greengrass.clientdevices.mqtt.Bridge configuration.{  "reset": [],  "merge": {    "mqttTopicMapping": {      "HelloWorldIotCore": {        "topic": "clients/{iot:thingName}/hello/world",        "source": "LocalMqtt",        "target": "IotCore"      },      "IotCoreToDevice": {        "topic": "clients/{iot:thingName}/iotcore/to/device",        "source": "IotCore",        "target": "LocalMqtt"      },      "GetApplicationsShadowLocalMqttToIoTCore": {        "topic": "$aws/things/+/shadow/name/applications-shadow/get",        "source": "LocalMqtt",        "target": "IotCore"      },      "PublishApplicationsShadowLocalMqttToIoTCore": {        "topic": "$aws/things/+/shadow/name/applications-shadow/update",        "source": "LocalMqtt",        "target": "IotCore"      },      "GetApplicationsShadowAcceptedIotCoreToLocalMqtt": {        "topic": "$aws/things/+/shadow/name/applications-shadow/get/accepted",        "source": "IotCore",        "target": "LocalMqtt"      },      "UpdateApplicationsShadowAcceptedIotCoreToLocalMqtt": {        "topic": "$aws/things/+/shadow/name/applications-shadow/update/accepted",        "source": "IotCore",        "target": "LocalMqtt"      },    },    "brokerUri": "tcp://localhost:1883"  }}I can send a message using HelloWorldIoTCore topic from the local mqtt broker (localhost:1883) to cloud and receive a message from the cloud on local mqtt broker using IotCoreToDevice topic.But it seems if I make an update on the named shadow, applications-shadow, I can not get the change on local mqtt broker using $aws/things/+/shadow/name/applications-shadow/update/accepted topic.What am I missing here?ThanksFollowComment"

Answer: "0Good afternoon savcuoglu,Sorry for the issues you are going through.My initial piece of advice will be to check your Greengrass Core Device policy, and make sure it allows subscribing, sending and/or receiving to/from shadow topics.Policy should include something like:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "iot:Subscribe"      ],      "Resource": [        "arn:aws:iot:region:account:topicfilter/$aws/things/thingName/shadow/name/applications-shadow/update/accepted"      ]    },    {      "Effect": "Allow",      "Action": [        "iot:Receive"      ],      "Resource": [        "arn:aws:iot:region:account:topic/$aws/things/thingName/shadow/name/applications-shadow/update/accepted"      ]    }  ]}You can always refer to documentation here, to tailor your policy to the corresponding shadow topic you are willing to track.CommentShareCharlyscott237answered 14 days ago"


Question: AWS Architecture Support

"Hi, I'm an AWS customer and I have a Business support plan. How can I ask my questions about AWS architecture and get support from AWS support team? Which category should I choose when creating a new support case to ask for help with AWS architecture?FollowComment"

Answer: "4Accepted AnswerDon't stress too much about the category, its great you have a support plan - use it freely!  Have a think about the sort of architecture that might make sense and that will help frame your questions.  I'd advise choosing reposnse by Chat rather than email so you can get quicker response and have a more interactive discussion with the support engineer.CommentShareEXPERTskinsmananswered 2 months ago"


Question: Deepracer boot error

"The battery LED on the deepracer does not turn blue and remains yellow, preventing access to the device console.To solve this problem, when I refer to the existing re:post.aws/questions/QU6xQdw7W4Slio76usxR_WhA/what-to-do-if-deepracer-is-not-booting-up-to-blue-leaded-light-state text in the re:Post, the device fails to manually update the device.Also, referring to https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-ubuntu-update.html , we did manual update, but it is the same situation even after the update is completed.I think when you start the deepracer[FAILED] Faied to activate swap / swapfile[DEPEND] Dependency failed for swap[FAILED] Failed to start Load/Save Random Seed<The last line of the picture>Failed to register device with error -22.No matching machine driver foundI think it's because of that, but I don't know how to solve it. Please help me.FollowCommentRareOxO 15 days agoI have the same problem, did you solve it?Share"


Question: Eventbridge api destination using same connection with 0Auth receiving 403 (Using the same token without refresh)

I am using two api destinations with same connection for 0Auth. I checked the dlqueue and saw that the response is 403 which makes me think that the token in the connection is not getting refreshed. Anyone know what I need to do here. Tried search through internet but couldn't find any answers.FollowComment

Answer: 0Can you confirm you have followed the documentation properly to set up OAuth - https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-api-destinations.htmlCommentShareEXPERTIndranil Banerjee AWSanswered a year ago


Question: Force use of `--duration-seconds 900` for `sts` commands `get-session-token` and `assume-role`.

"Hi,So i need to make sure, that any sessions created are not longer than 15 mins.As far as i understood it is possible to "request" a 15 min session access keys using sts, but, is there a policy to force the user to provide this --duration-seconds 900?JoannFollowComment"

Answer: "1Accepted AnswerThere is currently no way to force this for an assume-role call.You can set the maximum session duration for a role, but not lower than 1h.There is no IAM condition key that allows you to force this either--max-session-duration (integer)The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default value of one hour is applied. This setting can have a value from 1 hour to 12 hours.CommentShareEXPERTBen Bridtsanswered 5 months ago"


Question: Upgrade ubuntu release from 16.04 to 18.04 on ec2 instance safely

"Hi there,I currently have some ec2 instances running with Ubuntu 16.04.2 LTS. I would like to upgrade them to the newer one. But I'm confused if it would take any risks. Is there a safe method to perform that?Regards,FollowComment"

Answer: "0It depends on what your definition is of "safely".If you define safely as zero downtime for your app, it may be better to reinstall the app in a new ec2 that uses 18.04 as a base and migrate traffic to the new instance.If you define safely as an in-place upgrade with expected downtime, then it may be better to create an AMI of your instance, spin up a new ec2 and try the upgrade. If the upgrade works then you can deprecate the old instance.Instead of 18.04 (Apr 2018), if possible, I would recommend using the latest Ubuntu which is 22.04 (Apr 2022) today. Both are LTS releases which have support for 5 years. The former will have support until 2023 and the latter will have support until 2027.CommentShareRBanswered 6 months ago"


Question: Migrate RDS in us-east-1a

"I'm trying to migrate a PostgresQL 10 RDS DB to version 14. No matter which instance type I try, it says that it's not available in our availability zone (us-east-1a). Types we've tried:db.r6g.largedb.r6i.largedb.r5.largedb.t4g.xlargedb.t3.xlargedb.r5b.largedb.m6g.xlargedb.x2g.largedb.m6i.xlargeWhat can we do?Best Regards,OrtwinFollowComment"

Answer: "2Accepted AnswerAll newer instance types are VPC only. The reason for this issue is that your instance is using Classic networking. You need to first move your instance into a VPC in order to use current instance types.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.Non-VPC2VPC.htmlHth,CommentShareMODERATORphilawsanswered 5 months agoEXPERTTushar_Jreviewed 5 months agofuturetap 5 months agoThanks Phil, that worked. Would be great if you could fix the error message to be more helpful.Share"


Question: How to get MONTHLY cpu metrics using AWS Lambda?

"Hi, I'm running EC2 instance and every month I get CPU usage when I need to. But from now on, I want get CPU usgage every month using AWS Lambda. and my question is, how to set up a monthly date to get monthly usage of CPU?appearently this is what I wrote at Lambda to get exact month for CPU usage."start": "2022-06-30T15:00:00.000Z","end": "2022-07-31T14:59:59.000Z",And I want to make it Monthly. How should I fix it?FollowComment"

Answer: "1Hello,You can make use of the EventBridge in order to schedule the lambda function to run every month using a cron expression.[+] https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-create-rule-schedule.html#eb-cron-expressionsYou can configure an event bridge rule that will schedule the lambda function to run every month to obtain the CPU metrics of your EC2 instance. This can be done by following the below steps:➞ Open the Functions page on the Lambda console and choose the lambda function.➞ Under Function Overview, click on Add trigger.➞ Set the trigger type to EventBridge (CloudWatch Events).➞ For Rule, select Create a new rule, and then provide the rule name and rule description.➞ For rule type, choose Schedule expression.➞ In the Schedule expression field, enter a cron expression. For example, to run the function at 8 AM UTC on the first day of every month, you can use cron(0 8 1 * ? *)[+] https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/scheduled-events-invoking-lambda-run.htmlYou can find more information on how to write cron expressions in the below document:[+] https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-create-rule-schedule.html#eb-cron-expressionsPlease note that you would have to configure the lambda function code such that it is able to obtain the CPU usages of the EC2 instance.CommentSharerePost-User-7482542answered 9 months ago"


Question: Lambda runtime - Permissio denied

"Hi,I've been playing with Greengrass Core for a while (installed on Nvidia Jetson Nano). I installed 1.11 version and deployed my lambda. Everything was working as expected.Yesterday new version showed up so I removed the previous GGC and installed V2 instead. I deployed my lambda (exactly the same) code to new GGC (V2) and code is not working. This is what I see in the logs:2020-12-16T13:50:10.509Z [ERROR] (pool-2-thread-41) Greengrass_HelloWorld: /usr/bin/python3.7: can't open file '/home/greengrass/v2/work/Greengrass_HelloWorld/work/worker/0/runtime/python/lambda_runtime.py': [Errno 13] Permission denied. {serviceInstance=0, serviceName=Greengrass_HelloWorld, currentState=RUNNING}When I'm checking the the file lambda_runtime.py it has 'r' (read) access for all (user/group/other). Any idea what is happening? As I understand I'm not controlling the runtime code so how can I fix it?FollowComment"

Answer: "0Hi Szymon999,Can you list the permissions on the following directories?/home/home/greengrass/home/greengrass/v2Is the lambda configured to run in NoContainer mode or GreengrassContainer mode?Greengrass manages the permissions of the directories within its installation directory. In order to run the processes as different users though, the user needs to have read + execute permission on the directory hierarchy up to the artifact that is being executed.I suspect that /home/greengrass needs be chmod og+rxCommentShareRobanswered 2 years ago0Hi Szymon999,Thanks for using Greengrass v2. Can you share some details about your GGC setup?What is the component-default-user in the initial setup? Did you configure the user while deploying the lambda component?Can you enable debug logging and provide more logs?Can you provide the config files at /home/greengrass/v2/config/config.tlog and /home/greengrass/v2/config/effectiveConfig.yaml? Make sure you mask out the sensitive information if any.Thanks,HuiCommentShareAWS-User-5233880answered 2 years ago0Hi,This problem was indeed caused by the permission issues. I found that components are executed by ggc_user (configured at the installation) and I had to grant /home/greengrass dir correct permissions.Thanks.CommentShareSzymon999answered 2 years ago0Hi,can you provide the command to do that?I have got the same issue, what is weird it is working on another core ....Hope it's the same issue ..ThanksCommentSharejujuz7777777answered 2 years ago0Yes, can you please provide a more verbose answer on this topic, thanks!CommentSharebnjmnanswered 2 years ago0I am also new to this greengrass v2.   So I may be wrong.I beileve that permissions are given to ggc_user and ggc_group as component-default-user if you don't explicitly specify other user name and group name when you create component.   So you have to add ggc_user as user and ggc_group as group as system like below.   I think that you have to do it every device manually.Log into your device by SSH and do the next both two lines sudo adduser and sudo addgroup as shown inhttps://docs.amazonaws.cn/en_us/greengrass/v1/developerguide/setup-filter.rpi.htmlsudo adduser --system ggc_usersudo addgroup --system ggc_groupFor the first core device, you might have done this but for the second one, you might have forgotten to do this again.Hope this helps you.CommentSharejx2900answered 2 years ago"


Question: SageMaker Groundtruth Named entity recognition Labeling Job Failure

"Hi!I'm unable to create a SageMaker Groundtruth Labeling Job for NER.Steps:Created a new bucket.Created folder for documents.Created folder for outputs.Added private work teamCreated labeling job - Created new Role for Labeling job.Have tried  multiple times, always receiving the same error:{    "labeling-job-name": "Labelling-job-18",    "event-name": "PRE_HUMAN_LAMBDA_FAILED",    "event-log-message": "ERROR: Pre-human task Lambda failed for line 1.ClientError: The label categories file located at s3://<my-bucket>/20221107/output/Labelling-job-18/annotation-tool/data.json can't be accessed. Make sure it exists in the us-east-1 region, that the role arn:aws:iam::<acct-id>:role/service-role/AmazonSageMaker-ExecutionRole-20221028T185408 has read permissions to it and try your request again."}How can I fix this? Is the role created in the labelling job missing some kind of lambda policy?FollowComment"

Answer: "0Hello,Thank you for using sagemaker Ground-Truth. Usually this exception occurs when the labeling job is not able to access the S3 bucket, Assuming that the bucket is located in the same region and sagemaker full access policy[1] is attached to the role. Please verify below points.Please check if any bucket policy is attached, which is blocking or restricting access[2]Verify if any organizational SCP(service control policy) is setting a permission boundary on this account to prevent S3 access.[3]Post checking these policies, please try to re-run the job. If you have any difficulty in verifying any of the above mentioned points or if you still run into issue, Please reach out to AWS Support[4] (Sagemaker), along with your issue/use case in detail and share relevant AWS resource names. We will troubleshoot accordingly by verifying relevant job logs.[1] https://docs.aws.amazon.com/sagemaker/latest/dg/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonSageMakerFullAccess[2] https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html[3] https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html[4]  https://docs.aws.amazon.com/awssupport/latest/user/case-management.html#creating-a-support-casehttps://docs.aws.amazon.com/awssupport/latest/user/case-management.html#creating-a-support-caseCommentShareSUPPORT ENGINEERRakeshanswered 7 months ago"


Question: How can I publish an application containing an AWS::Serverless::Function resource with a FunctionUrlConfig property?

"I have a SAM template with an AWS::Serverless::Function resource that has a FunctionUrlConfig property. It builds and deploys just fine using the SAM CLI, so the transform clearly works. But when I try to publish it to the Serverless Application Repository (either with sam publish or aws serverlessrepo create-application or via the AWS Serverless Application Repository Console), I get the following error:Invalid Serverless Application Specification document. Number of errors found: 1. Errors: Resource with id [IiifFunction] is invalid. property FunctionUrlConfig not defined for resource of type AWS::Serverless::FunctionIt seems like the Serverless Application Repository API simply isn't using an up-to-date schema to validate the template. Since FunctionUrlConfig is part of the documented AWS::Serverless::Function model, it seems like the app repository should accept it. Is there anything I can do to try to get past this? Or do I just have to wait until someone at AWS updates the API's template validator with the latest version of the model?FollowComment"

Answer: 0Accepted AnswerI've found an answer to my own question. It turns out that my suspicion was correct and that the latest version of the SAM code simply hasn't been deployed to SAR yet.CommentSharembkleinanswered a year ago


Question: Lightsail server offline

"Hi, I have Lightsail server (1 GB RAM, 1 vCPU, 40 GB SSD) with Blueprint Wordpress Multisite. Website has only 1k visitor per month.I would like to know why my lightsail server stops working and I need to restart it first to get it back to working. I do not understand what is happening. Help me please.FollowComment"

Answer: "2Accepted AnswerHello,The issue appears to be memory related based on the symptoms you have described, you can also reference this link [1] that covers the same remediation steps. "Reboot the instance to return it to a non-impaired status. The problem will probably occur again unless you change the instance type". Exhausted memory [1] When the memory is exhausted, the kernel doesn’t have enough memory to run. When this occurs, other processes are stopped to free memory, making the instance unresponsive. You can try to reboot or stop and start the instance. These procedures reduce memory usage.Unfortunately, AWS Cloudwatch does not natively monitor memory metrics on instance level, however you can configure the cloudwatch agent to report memory usage metrics to cloudwatch. I've linked this AWS blog [2] which covers a detailed walk-through on setting up memory monitoring.  You can also use linux tools like top, atop and even the free -m command to view memory usage whilst being connected to the instance via ssh.If the problem is indeed memory related you will need to upsize your lightsail [3] instance to a bigger instance.[1] Unresponsive Lightsail Troubleshooting: https://aws.amazon.com/premiumsupport/knowledge-center/lightsail-instance-failed-status-check/[2] Monitoring memory usage: https://aws.amazon.com/blogs/compute/monitoring-memory-usage-lightsail-instance/[3] Creating a larger instance: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/how-to-create-larger-instance-from-snapshot-using-consoleCommentShareSUPPORT ENGINEERLundianswered a year agorePost-User-4737068 10 months agoThank you so much.Share"


Question: "New (SSM-)Resource Groups vs Classic Resource Groups, and basic inventory"

"Hello,After this thread (https://forums.aws.amazon.com/thread.jspa?threadID=296462) and this one (https://forums.aws.amazon.com/message.jspa?messageID=820494#820494), I have two questions :is there not a regression between the Classic Resource Groups (close to Tag Editor) and the new Resource Groups, in SSM ? Is it indeed not possible to search for resources outside the region in this new SSM-Resource Groups, or I am mistaken somewhere ? As well as for the search menu in SSM (same section as Resource Groups), tags are mandatory for the search ; but if I want to find all resources (in fact, practically, all instances or all Load Balancers) ?is there any mean to find all resources, wherever they are in the account (regions), whatsoever tags they have, whatever the state of the instances is... I mean : is there a way to do a basic inventory of all resources of the account (or even of the Organization) ? The inventory in SSM is region-limited and needs the instances to be running...Tag Editor doesn't support eu-north-1 region nor new ELB (NLB or ALB)... :(Thank you !Edited by: acaitr on Jan 22, 2019 11:17 AMFollowComment"

Answer: "0Hello acaitr,AWS Resource Groups and Classic Resource Groups are two separate products - see https://docs.aws.amazon.com/ARG/latest/userguide/welcome.html#resource-groups-differences for a full list of differences. While AWS Resource Groups currently does not support cross-region groups, it for example has a public API and supports much more resource types than Classic resource groups.Both Classic and AWS Resource Groups require at least one tag key set to search, they do not support the use case you are describing. I will take note of your request and we will consider it for future improvements of AWS Resource Groups.Depending on your use case, AWS Config or AWS Systems Manager Inventory are able to accommodate what you are describing, but they both do not support all resource types.Yes, Tag Editor does not yet support the stockholm region or new ELB variants. We do have those improvements in our near term roadmap, tough. I will update here as soon as it is launched.Best,FlorianCommentShareflorian-awsanswered 4 years ago0Hello Florian,THank you very much for this complete answer. I will do as possible with Config and SSM (that is indeed the solution I am studying, even it uses two services and is not exactly what I'm looking for), and we will wait for the next evolutions.Thanks ! ;)CommentShareacaitranswered 4 years ago0Last week, the new version of Tag Editor has been launched, which now also supports the Stockholm region.Best,FlorianCommentShareflorian-awsanswered 4 years ago"


Question: Using Route 53 Domain with Squarespace

"Hello,I am trying to use a new Squarespace website with my existing Route 53 Domain. It's been a week and still not connecting and Squarespace has zero experience with Route 53.  They tell me all the info i entered is correct but today they asked my to add a text record to verify ownership.  A few questions, does anyone have a screenshot of what the DNS records in Route 53 should look like? They provided four A records which can only be entered in Route 53 as one entry, is this correct?  My previous website was an EC2 instance, lightsail and it worked immediately.  Thanks for your help in advance.FollowComment"

Answer: "0So the A records look correct, the only CNAME they want me to list is, wwwCNAMEext-cust.squarespace.comYou are stating this will not work?  Should I delete it and have no CNAME records and only the text.  this is the record,www.website.comCNAMESimple-Noext-cust.squarespace.com300CommentSharerePost-User-1232330answered a month agoJason Butz a month agoI updated my answer with a response to thisShare0I only have a few screenshots I can share, but I might be able to help with some info.In Route 53, if you have multiple items with the same record name and type, they will be shown together. That is not a problem. You can often enter them as separate records or with multiple in the textbox. I have screenshots of creating records below:It looks like Squarespace tries to verify things with CNAME entries first and then fallsback to TXT records. I don't have a Squarespace account so I don't know the details about what things look like but here are a few tips:If they provide you a full domain for the record name, for example _d3ef431f81d2.YOURDOMAIN.com, only enter the part before your domain name in the record name box in Route53.If you are trying to setup a CNAME record on the root of your domain, for example a CNAME record on YOURDOMAIN.COM to ext-cust.squarespace.com, it will not work. AWS does not support thisYou probably need to keep the Routing Policy set to simple for anything relating to validating your Squarespace accountYou can find more information about DNS record types AWS supports on their documentation page---- EDIT@rePost-User-1232330Yes, if they are telling you to add a CNAME record to ext-cust.squarespace.com on www then you will add www as the record name, CNAME as the record type, put ext-cust.squarespace.com as the value, and leave all other default settings.CommentShareJason Butzanswered a month agorePost-User-1232330 a month agoThanks for your help.  It appears I have everything correct and it's still not working.  Last option is to transfer domain or don't use squarespace.Share"


Question: authenticate users from 3 cognito user pools in single url domain

"We have 3 user personas as mentioned below,B2B ClientB2C UsersInternal Users.They have different web application to login with different urls and different set of use cases. So we have created a 3 different user pool and 3 different api gateway which will integrated with respective cognito user pool to validate the user login.New use case:We have built a use case where all these 3 users needs to get into video conference app.  We are planning to host in single domain like video.company.com. All 3 users can login into video app, we need to authorize each user with corresponding user pool.In backend we can have one api gateway and have 3 cognito user pools attached to it to validate the token.We use hosted cognito webapp for providing the login page to users. This hosted app will belong to only one cognito user pool.We are thinking of few waysIs there a way to use one hosted login page to authenticate and get token from the one of the user pool ?Assume #1 is not at all possible, then we are forced to build a simple custom login page, is it possible to evaluate the login credentials across all 3  cognito user pools ? Any support from amplify library ?Assume #2 is not possible, we will show the role of the user in page, when user select the role, we will navigate them to corresponding login page. how do we validate whether the user is logged in or not from different sub domain ? Any code samples here will be helpful ?FollowCommentCarlos del Castillo a month agoCouldn't you just have the user indicate which group they belong in at the login page and use that to route the credential check to the appropriate pool?Share"


Question: IoT Architecture recommendation  -  switch from Azure to AWS

"Hi guys,I rode a lot of articles and watch some videos about IoT Architect solutions, I did some proofs of concept too.Now i want to start building the real system but i'm not quite sure about the architecture.Hopefully the community can give me some tips and architecture advisesDevices number : 1000-2000 devices split between different customersSome devices are sending small messages with telemetry data like temperature,pressures,...  (every hour)Some devices are sending big binary files with raw data (50mb) (every 6hours)this big files are formated like that:device_id,published_at,[value,value,value,value,value,value,value,value,value,value,value,value,value,value,...]device_id,published_at,[value,value,value,value,value,value,value,value,value,value,value,value,value,value,...]device_id,published_at,[value,value,value,value,value,value,value,value,value,value,value,value,value,value,...]device_id,published_at,[value,value,value,value,value,value,value,value,value,value,value,value,value,value,...]device_id,published_at,[value,value,value,value,value,value,value,value,value,value,value,value,value,value,...].....I was previously working with Azure and i had this architecture that was working fine :-IoT Device Provisioning Service-IoT Hub for the small telemetry messages-Azure SQL DB to store my small telemetry messages-Stream Analytic Service to get the message from the IoT Hub and store in the SQL DB-Blob storage to store my big binary files with the right naming policy DeviceName/Date/Filename-Stream Analytic Service to read my newly uploaded blob and give an input to other jobsBut for some reasons we have to switch to AWS and since it's a different approach im asking for your knowledge.Here is what i have so far:-IoT Device Management (to manage my devices and groups)-S3 to store my binary files-DynamoDB-AWS LambdaThe flow :1 - IoT devices get registered through IoT Device Mangement2 - Devices send telemetry data every hour Telemetry data are stored in DynamoDB through Lambda3 - Devices send Big binary files every 6hours through MQTT protocol on S34 - When a big binary file upload is finish, Lambda gets triggerred and parse this file to store the data on DynamoDB (then delete the binary file?)5 - Then when i have all the data in DynamoDB  i can trigger  whatever cloud function...I do think that i am not getting it properly. If someone can give me some advice on how to do what i was doing on Azure on AWS?Any recommendation is really appreciated !Thank youEdited by: Doombqr on Jan 24, 2019 7:45 AMFollowComment"

Answer: "0Hey Doombqr,You are on the right track with AWS. Your telemetry should be going over MQTT via AWS IoT Core and then typically you send larger payloads directly to something like S3 for down-stream processing.Your flows would be:Device Management: AWS IoT Device Management etc (as you already had)Telemetry: Device->MQTT->IoT Core->Rule->Lambda->DDB or if you are not doing anything in the Lambda then go directly to DDB, so Device->IoT Core->Rule->DDB.Larger Files: Device->HTTPS->S3->Lambda->....The reason you want to send larger objects directly to S3 is so you don't exceed hard limits within IoT Core over MQTT such as 128k payload limits etc.Let me know if that helps!-cCommentSharetypemismatchanswered 4 years ago0Hi Craig!Thanks for the tip about MQTT payload !I'm gonna try what you said tonight !CommentShareDoombqranswered 4 years ago"


Question: Can I use Private AMI to create a base image for Appstream application ?

"Can I use   Private Windows server image (AWS AMI) for creating a base image for an Appstream application? Due to company security policy I do not  want to use 'standard' AWS Windows server images available in Appstream 2.0 to build the Appstream application but would like to use  secure Windows server images (AMI).ThanksSJEdited by: SJ on Aug 28, 2019 4:40 AMFollowComment"

Answer: "0SJ,AppStream 2.0 images cannot be based on private AMIs.  Due to the specialized nature of application streaming, AppStream 2.0 Fleets must be based on AppStream 2.0 Images.  It is possible to start an Image Builder from a publicly available AppStream 2.0 base Image, apply the security settings required by company security policy, and then create a private AppStream 2.0 Image to use as the base for future Image Builders.  Keep in mind that the private AppStream 2.0 Image will need to be maintained periodically to ensure adherence to patching standards outlined by the company security policy.Thank you,Kellie (AWS)CommentShareKellieatAWSanswered 4 years ago0Kellie,Thanks for your prompt response.  I have suggested Appstream 2.0 to an enterprise client.1.Is there a security deck or an AWS presentation (security focused) that I can use ? I have been asked my a large enterprise client about the security of using Appstream 2.0. This client uses its private Windows 2012 and 2016 images as EC2 Instances.Can I connect to my Appstream 2.0 server as an Admin and apply regular patches/settings etc that the security department  Admin would - Business As Usual?Thanks AgainSJEdited by: SJ on Aug 28, 2019 9:43 AMCommentShareSJanswered 4 years ago0SJ,I do not have any prepared presentations around security.  The AppStream 2.0 networking, access, and security documentation can be found here:https://docs.aws.amazon.com/appstream2/latest/developerguide/update-fleets-new-image.htmlAppStream 2.0 fleet instances are designed to be single use, so changes made directly to the instances would be lost after a user ends the session.  To make changes to AppStream 2.0 fleet instances, such as patching, you would create a new private image, either from an existing image builder, or from an image builder created from an existing image, that contains the updates required.  That image is then applied to a fleet, at which point new fleet instances will be created from that image.  Unused fleet instances are replaced periodically, while in use fleet instances terminated and replace, based on scaling policies, when the active user session ends.https://docs.aws.amazon.com/appstream2/latest/developerguide/update-fleets-new-image.htmlHopefully that helps,Kellie (AWS)CommentShareKellieatAWSanswered 4 years ago0Correction, the AppStream 2.0 networking, access, and security documentation can be found here:https://docs.aws.amazon.com/appstream2/latest/developerguide/managing-network.htmlKellie (AWS)CommentShareKellieatAWSanswered 4 years ago0Thanks, KellieI will go over the docs.RegardsSJCommentShareSJanswered 4 years ago"


Question: Where do I find the public IP of the server launched with ECS?

"Hello!I can't find a public IP or domain to access the service I launched with ECS.Okay, so I start with the guided setup:https://eu-central-1.console.aws.amazon.com/ecs/home?region=eu-central-1#/firstRunAnd I stick with every default setting - I don't change anything.I see the live monitoring of AWS spinning up the cluster. It finishes successful.What I would expect now is first of all a new EC2 instance in eu-central-1 and also a public IP or domain to admire the sample app. But nothing.I suppose I am fundamentally misunderstanding something here.Kind RegardsRaffaelEdited by: Raffael on Jan 6, 2019 9:19 AMEdited by: Raffael on Jan 6, 2019 9:19 AMFollowComment"

Answer: 0The EC2 instances in the cluster cannot be directly accessed. They are only indirectly accessible via the Elastic Network Interface. This ENI can be found either directly in the EC2-MC or a link in the information on the running cluster. The ENI features the necessary public IP.CommentShareRaffaelanswered 4 years ago