Question: How to export environment variables from a Lambda function.

"Hello,I have created a Lambda function that fetched the static/hash token from the environment variables in the Configuration section.When I try to export the Lambda function using the Action > Export function, a zip file is downloaded without any configuration-related data in it.Is there a way to export the environment variables from the Lambda functions?FollowComment"

Answer: "2As referred in this documentation, you can obtain all the configuration details for the function through the AWS CLI like this:aws lambda get-function-configuration --function-name <value> --output jsonYou can use the output to update the new function using this command:aws lambda update-function-configuration --function-name <value> --cli-input-json <output from previous command>You may need to change the output as needed before using it for the update-function-configuration invocation.CommentShareVictor_Panswered a year ago"


Question: CloudFormation says a IAM Role it just created does not exist

"Hi, a bunch of our stacks that did not change for a while are no longer working. It's like the dependencies between resources is no longer enforced, or else the IAM API experiences some delays.When creating a role and trying to reference to it in another resource (!Ref), it says the role does not exist.  The problematic role is pretty random, but it causes a rollback systematically.Those stacks templates were last updated over 2 months ago and they are just starting to fail now.Any idea?FollowComment"

Answer: "0I am inexplicably experiencing this as well. Searching shows that this typically happens when AWS APIs are experiencing increased latencies.I guess AWS doesn't know about it yet because it's not showing up in its status page.Burnt an entire morning on this, how annoying they don't know about an issue like this and can't report status on it for hours after it started.CommentShareMV0012answered 2 years ago0Having the same issue hereCommentSharePetruBanswered 2 years ago0The AWS status page now shows a RESOLVED event for this.  Will try again.CommentShareMvMviauanswered 2 years ago"


Question: Sagemaker Autopilot - unable to connect my data

"I'm trying to start an autopilot experiment. After specifying the S3 bucket and selecting my dataset file, I get the following message:"Unable to fetch column headers".I have used the same csv-file with no problem in Sagemaker Canvas. What could be the problem?FollowComment"

Answer: "0Hello! I am facing the same issue, did you figure it out?Thank you!CommentShareAWS-User-2055875answered a year ago"


Question: Aurora Global Database in af-south1 (Cape Town)

Is there any planning/roadmap to bring Aurora Global Database (as secondary region) to af-south1 - Cape Town?FollowComment

Answer: "0Unfortunately, I do not have any information about this at the moment. I urge you to keep an eye on the following.RDS blog: https://aws.amazon.com/blogs/aws/category/amazon-rds/RDS updates: https://aws.amazon.com/rds/whats-new/RDS Forum: https://forums.aws.amazon.com/forum.jspa?forumID=60CommentShareVetrivelanswered a year ago"


Question: Lamda functions are missing and not allowing me to create new functions

Suddenly my lamda functions are missing and not allowing me to create a new function as well.also strangely I can see fetch 53 years ago message.I can see the lamda's from API Gateway but it does not allow me to do anythingFollowComment

Answer: "0Is the time on your local machine correct? I've seen this problem before where a customer's laptop was a few minutes out and it caused all sorts of "interesting" problems. The issue is that API calls to AWS are signed and the time is part of the equation.CommentShareEXPERTBrettski-AWSanswered 4 months agorePost-Tishamal 4 months agoYes, I have tested this with 2 browsers and 2 laptops (windows machine and a mac)ShareBrettski-AWS EXPERT4 months agoI ask because 53 years ago is the beginning of the "epoch" as counted by Unix/Linux clocks. If your time is slightly in the future then it will be interpreted as being in the past and you'll see strange things like this. Make sure your time is properly synchronised with the internet - NTP is good for thise.Share"


Question: Use GlueContext.getSink for writing Apache Iceberg table to S3 bucket and Data Catalog

Is there a way to use GlueContext.getSink().writeFrame(...) to write Apache Iceberg tables? So far I only find the version GlueContext.write_dynamic_frame.from_options(...) working which is documented at the bottom of https://aws.amazon.com/de/blogs/big-data/implement-a-cdc-based-upsert-in-a-data-lake-using-apache-iceberg-and-aws-glue/. This version does not seem to provide an option to update the data catalog simultaneously.FollowComment

Answer: "0Hello,As per the doc there are only two ways to update the schema 1.getSink() and 2.from_catalog() automatically from an AWS Glue Job and your job needs to use the Iceberg connection or Iceberg jars.getSink() does not support market place connections. Referencefrom_catalog() needs to read the metadata like classification or connection from the existing iceberg table.  However, if you are creating iceberg tables from Athena as shown here . This method does not work as well. ReferenceSo, the only way I could see is to use from_options() method and use Spark dataframes to write to your Iceberg table.Schema evolution for Iceberg tables are documented here and using Athena hereCommentShareSUPPORT ENGINEERChiranjeevi_Nanswered 10 months ago"


Question: Can you run multiple programs inside one AWS Nitro Enclave at the same time?

"The AWS Nitro Enclave Concepts states that "An enclave is a virtual machine with its own kernel, memory, and CPUs" and "An enclave image file (.eif) includes a Linux operating system, libraries, and enclave applications that will be booted into an enclave when it is launched".So, if the Enclave is in fact a Linux VM, can we run multiple programs inside one Nitro Enclave instance at once (as opposed to creating separate Nitro Enclave instances for each program)? The documentation makes be believe this is possible, but I have not found an example illustrating how this would be done---the closest example creates multiple enclave instances.And if you can run multiple programs in one Enclave instance, do they have the same safety guarantees that programs would normally have (e.g., memory safety between programs)?FollowComment"

Answer: "0It is possible to run multiple programs in an enclave. But the question to ask is, why would you want to do that if you want isolation between those multiple programs to begin with? Package each program into a separate enclave if you want that isolation between them, most importantly run only trusted pieces of software inside the enclave, this is not a sand boxing solution.CommentShareSudhiranswered 11 days ago"


Question: Password is not available for custom AMI

"HelloWe had an instance with the pem file lost. Now I've generated a custom AMI from it following the guide.I've created a new instance  i-0ab5bce81b25cc541 from the AMI with all configs preserved as the original instance.Now trying to connect to the new instance it says "Please wait at least 4 minutes after launching an instance before trying to retrieve the auto-generated password.".After reading many docs and answers, it seems that the solution is to login with the original password, but as I said the pem file was lost.Basically I get a logical conflict situation - the guide says to generate a new instance with new pem file, but use the old password for login.ThanksFollowComment"

Answer: 0Was able to resolve the problem by following the "Reset the Windows administrator password using EC2Launch" guide.The EC2Rescue tool password reset didn't worked for first time - there was an error 'failed to prepare scripts' but after unloading and reloading the volume for second time and other retry it did work.CommentShareandymaksanswered 2 years ago


Question: AWS Instance scheduler not working as expected

"Hi everyone,I'm trying to optimize our EC2 usage using AWS Instance Scheduler. Our EC2 usage is monday to friday, from 07:50 to 19:00 for which I have a working Instance Scheduler configuration that I'd like to fine-tune.The goal is to avoid fixed bank holidays through the year, hence I was trying to apply multiple periods to a schedule, where each period models a month: a schedule s-office-hours with two periods office-hours-apr, office-hours-mayas shown below.Schedule  s-office-hoursscheduler-cli describe-schedules -s Instance-Scheduler --name "s-office-hours" {   "Schedules": [      {         "UseMaintenanceWindow": false,         "StopNewInstances": true,         "UseMetrics": false,         "Hibernate": false,         "Timezone": "Europe/Rome",         "Enforced": false,         "RetainRunning": false,         "Periods": [            "office-hours-apr",            "office-hours-may"         ],         "Name": "s-office-hours",         "Type": "schedule"      }   ]}Periods office-hours-aprscheduler-cli describe-periods -s Instance-Scheduler --name office-hours-apr{   "Periods": [      {         "Begintime": "07:50",         "Monthdays": [            "26-30",            "1-24"         ],         "Months": [            "4"         ],         "Endtime": "19:00",         "Weekdays": [            "mon-fri"         ],         "Name": "office-hours-apr",         "Type": "period"      }   ]}Period office-hours-mayscheduler-cli describe-periods -s Instance-Scheduler --name office-hours-may{   "Periods": [      {         "Begintime": "07:50",         "Monthdays": [            "2-3",            "5-31"         ],         "Months": [            "5"         ],         "Endtime": "19:00",         "Weekdays": [            "mon-fri"         ],         "Name": "office-hours-may",         "Type": "period"      }   ]}For some reason this configuration makes the scheduler not to work at all.What I was able to retrieve from cloudwatch logs is the following messageWARNING : Skipping instance EC2:i-xxxx (debug-scheduler) in region eu-north-1 for account 1234567, schedule name "s-office-hours" is unknownWhere actually "s-office-hours" exists and is not mispelled anywhere (not even in EC2 tags)I've googled a bit, and this message is shown when endtime comes before starttime, which does not apply to my case.I suspect that could be smth related to conditions over Weekdays and Monthdays.Can anyone help on this?FollowComment"


Question: Converting long text to audio with Polly using S3 systhesis - failure

"Hi, I am trying to convert a book in a word doc to audio using Polly. I paste chunks of the book under 100K characters into Polly and then hit save to S3. It schedules and then runs the task but then after a few minutes the S3 Synthesis task just says "failed".What am I doing wrong?  Perhaps something with naming/creation/location of an S3 output bucket?  I don't even know what that is, I am just writing in a name. Do I need to pre-create a bucket somewhere?  I am sure this is a totally basic question but thanks in advance for the help!FollowComment"

Answer: "1Accepted AnswerHi!If you go to Amazon Polly --> S3 synthesis tasks --> Select your task ID which failed, you should see a field named Task status reason which should give you an explanation about the fail status.To use S3 synthesis tasks you have to previously create an Amazon S3 bucket. Check out this guide!CommentShareDani Manswered 10 months agorePost-User-1538455 10 months agoThanks Dani!  The reason it gives is "Error occurred while trying to upload file to S3. Please verify that the bucket exists in this region and you have permission to write objects to the specified bucket."after I click "save to S3", I was just creating a name in the S3 output bucket field. Do i need to create a bucket in advance and then use that name? So, how/where do I create an S3 bucket?SharerePost-User-1538455 10 months agoOk, I figured out how to create a bucket! thanks for the help Dani...Sharecoffeesnob 5 months agoHi, I am having the exact same issue as the original poster of this topic. However in my case it was working perfectly and now it isn’t.The S3 bucket exists, and is set to private, however I have also tried setting it to public with no restrictions and I get exactly the same error.I have also tried deleting the S3 bucket and recreating a new one and it still doesn’t work. I have even tried saving a speech with 200 characters, just in case that was the issueThe error by the way is "Error occurred while trying to upload file to S3. Please verify that the bucket exists in this region and you have permission to write objects to the specified bucket. "Share"


Question: PrivateLink Matching AZ on Consumer/Provider

"In a scenario where the provider application extended via PrivateLink, is hosted in az1 and az2 in a particular region and the consumer only has subnets provisioned in az2 and az3, thus only have a single az2 in common and have the endpoint in it. What can the provider/consumer do to avoid any issues in case of az2 failure?FollowComment"

Answer: 0Accepted AnswerThe service provider can enable cross-zone load balancing on the NLB.  In that case the consumer could have an endpoint ENI in any az (i.e. az2 and az3). Even though there are no provider services in az3 traffic coming in on ENI in az3 would be sent to the provider VPC and then across AZs  to any live target (az2 or az1). The provider will pay for the cross-az data transfer. re:Invent talk is a good resource for this.CommentShareEXPERTAWS-User-7100868answered 3 years ago


Question: Unable to release Elastic IP - but there's no rDNS involved

"I am trying to release an Elastic IP address.  Under the Actions button, the Release, Associate, and Disassociate options are all grayed out.  How can I release this orphaned Elastic IP?  I tried the option to clear the Reverse DNS, but received the message 'Update is not required for Public IP Address 3.225.0.88', so apparently a Reverse DNS isn't involved.  Any suggestions?FollowComment"

Answer: "1Hello Mark,Check perhaps the EIP is associated with a NAT-Gateway? if so you will need to delete the NAT-gateway first.Also, take a look at the below KC article:https://aws.amazon.com/premiumsupport/knowledge-center/ec2-address-errors/?nc1=h_lsSpecifically see the below note from the article:Note: Removing the rDNS might take a few days to propagate through the system.If none of this helps then suggest opening a Support case.CommentShareEXPERTTushar_Janswered 10 months agoEXPERTChris_Greviewed 10 months ago"


Question: [boto3] An error occurred (UnrecognizedClientException) when calling the GenerateDataKeyPairWithoutPlaintext operation: The security token included in the request is invalid.

"Hi all, I am trying to use boto3 to do some KMS operation. I keeping getting an error that my security token is invalid. I've went through various posts I could find and was not able to find any resolution.Things I have checked so farI am not using any special region. Everything is just in standard us-east-1 nothing fancy.I have created a user that has AdministratorAccess and created security access credentials for this userHave tried putting these into credentials file + supplying through client() constructorMy code snippetimport boto3aws_access_key_id = "XXX"aws_secret_access_key = "XXX"client = boto3.client('sts',                      aws_access_key_id=aws_access_key_id,                      aws_secret_access_key=aws_secret_access_key,                      )resp = client.get_session_token()key = resp['Credentials']['AccessKeyId']secret = resp['Credentials']['SecretAccessKey']session_token = resp['Credentials']['SessionToken']client = boto3.client(    'kms',    aws_access_key_id="\"" + key + "\"",    aws_secret_access_key="\"" + secret + "\"",    aws_session_token="\"" + session_token + "\"")response = client.generate_data_key_pair_without_plaintext(    KeyId='XXX',    KeyPairSpec='ECC_NIST_P384',)My code fails on the last line...Traceback (most recent call last):File "C:\pathToTestScript.py", line 28, in <module>response = client.generate_data_key_pair_without_plaintext(File "C:\Users\benarnao\AppData\Roaming\Python\Python310\site-packages\botocore\client.py", line 530, in _api_callreturn self._make_api_call(operation_name, kwargs)File "C:\Users\benarnao\AppData\Roaming\Python\Python310\site-packages\botocore\client.py", line 961, in _make_api_callraise error_class(parsed_response, operation_name)botocore.exceptions.ClientError: An error occurred (UnrecognizedClientException) when calling the GenerateDataKeyPairWithoutPlaintext operation: The security token included in the request is invalid.I am able to get the session token from STS, and notice this returns a temporary key and secret as well. I have tried the new set of credentials as well the existing credentials + security token with no luck.For some reason the key and secret require surrounding quotes when supplying through client() constructor, I have tried this with and without for the session token parameter.Any ideas?FollowComment"

Answer: "0I think you have to wrap your credentials in a boto3 session object if you are explicitly passing credentials instead of using default Credentials Provider Chain like you mentioned.Can you try creating session object like this first -session = boto3.session.Session(    aws_access_key_id=resp['Credentials']['AccessKeyId'],    aws_secret_access_key=resp['Credentials']['SecretAccessKey'],    aws_session_token=resp['Credentials']['SessionToken'])Then you can create kms client like -kms = session.client('kms')CommentShareAritro Senanswered 2 months ago"


Question: AWS Amplify and AWS Cognito: Website subscription verification

"I have an Angular-based website in which users can subscribe to various services. In Cognito, I see that custom attributes can be associated with users, but I don't see how to verify those attributes on each API request. Would I use a trigger, for instance, to check the user's subscriptions? If so, could I get some guidance on how to do that? Thanks.FollowCommentTim_J 2 years agoThis is specific to amplify API/graphQL, but is this the type of this you are looking for? https://docs.amplify.aws/cli/graphql/authorization-rules/#configure-custom-identity-and-group-claims. If not, add a little more detail to your question, thanks.Share"

Answer: "4Hi, standard and custom attributes will be included in user's id-token. you will need to pass this token to your APIs or backend, verify token signature, decode the token and then manually verify the value of attributes (like subscriptions).If you are using API Gateway then you need a lambda authorzer, where you can do this token validation and verification of the claims. here is an example of lambda authorizer.CommentShareEXPERTMahmoud Matoukanswered 2 years ago"


Question: Set headers when sending emails with Cognito

How can I set specific email headers when sending emails through cognito custom emails system?More precisely I'd like to set the 'X-Entity-Ref-ID' header to avoir threading in recipient inboxes.CustomMessage lambdas has no header method in the response jsonCustomEmailSender could work but feels overkill.ThanksFollowCommentJaccoPK a year agoThis is not implemented in the triggers unfortunately.Share

Answer: "1With Amazon Cognito, Custom message Lambda trigger, you can only set the following:"smsMessage": "string","emailMessage": "string","emailSubject": "string"You cannot set the email headers as of now. However using a different subject line may allow you to not group emails from being shown as a threads without using "X-Entity-Ref-ID".CommentShareEXPERTParnabanswered 9 months ago0Accepted AnswerSo the only solution to this problem is to use a CustomEmailSender and add the header in that lambda. A lot more code to write to access SES but more control. A shame, access to settings headers on emails would simplify all this.CommentShareLouis Letourneauanswered 9 months ago"


Question: "Monthly cost of NAT Gateway when using a single Elastic IP, multiple Elastic IPs ?"

What would be the total monthly price for NAT Gateway when using a single Elastic IP and multiple Elastic IPs ? Does using multiple IPs will impact on NAT Gateway traffic and increase cost ?FollowComment

Answer: "1HiI don't believe there will be any difference, we are still using a single NAT gateway even with secondary IPs associated. However there will be the Elastic IP address cost for each address you associate with the NAT gateway.VPC (NAT Pricing) -> https://aws.amazon.com/vpc/pricing/CommentShareBisinaanswered 11 days ago"


Question: Increase vcpus to 15

Hello can i get access to c6a.4xlarge. i talked with assistant and he said i can. I'm doing history project for schoolFollowComment

Answer: 0please check the region and availability of the instance from limit section. Based on that you can play around with c6a.4xlarge instance types..CommentShareShashank Abhishekanswered 5 months ago


Question: CodePipeline Approval Stage Timeout Configuration

"Are there any plans to allow users to specify the timeout on approval stages on pipelines?Currently, I don’t believe it is possible.FollowComment"


Question: getting error HIVE_CURSOR_ERROR: Unexpected end of input stream

"HIVE_CURSOR_ERROR: Unexpected end of input streamThis query ran against the "covid_dataset" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: 4d5d4b1c-c377-4304-9698-ac61d20df887FollowComment"

Answer: "0There are multiple variants of the HIVE_CURSOR_ERROR.  If you are facing an exception like  HIVE_CURSOR_ERROR: Unexpected end of input stream, this means in the process of decompressing or trying to read your input file, we properly found a format that we could not understand. Possibly a data issue in my assessment. Remove some of your input files try to download file and see if you can read it in unix, it should be a UTF8 encoded file. If compressed, you can try do download and try to read it uncompressed locally.CommentShareEmananswered a year ago"


Question: grep output to file

"Greetings,I am trying to write the output from aws s3 ls to a .csv file.I get a broken pipe error??I tried the -f and --FILE==FILE optionsAny suggestions appreciatedaws s3 ls s3://summer-outputs/data/    --output text --human-readable --summarize --recursive  | grep > ./files.csv[Errno 32] Broken pipeException ignored in: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='utf-8'>BrokenPipeError: [Errno 32] Broken pipeFollowComment"

Answer: 1The "| grep " does not look correct since you are not looking for any string before redirecting the output to file.Try:aws s3 ls s3://summer-outputs/data/ --output text --human-readable --summarize --recursive > ./files.csvCommentShareSydanswered 6 months ago


Question: Transit Gateway Availability

"Hello,A customer recently asked me how highly available is Transit GW. It becomes a crucial element in an infrastructure, connecting multiple VPCs/VPNs together.I didn't find public documentation or FAQ entry on Transit GW being highly available or having a reliability engineering goal.I understand Transit GW leverages HyperPlane, perhaps I need to dig deeper here.FollowComment"

Answer: 0Accepted AnswerThe customer should leverage a subnet in each AZ for the TGW attachment for HA. When you compare TGW to keeping a traditional transit VPN up and running (and patched with vendor software) I'm sure customers will see much higher uptime. We remove the large single points of failure of EC2 instances doing routing.It is based on Hyperplane so you can point customers to the reinvent talk from last year. Also the sessions from reinvent:https://www.youtube.com/watch?v=ar6sLmJ45xshttps://www.youtube.com/watch?v=yQGxPEGt_-wCommentShareAWS-James-Devineanswered 4 years ago


Question: Can't Associate WebACL to API Gateway by CloudFormation

"I have an issue to use CloudFormation to add WAF to my API Gateway. My yaml is like:AWSTemplateFormatVersion: "2010-09-09"Transform: AWS::Serverless-2016-10-31Description: "Service"Resources:   WebACL:    Type: AWS::WAFv2::WebACL    Properties:      DefaultAction:        Allow: {}      Scope: REGIONAL      VisibilityConfig:        CloudWatchMetricsEnabled: true        MetricName: WafACL        SampledRequestsEnabled: true      Rules:        - Name: AWS-AWSManagedRulesCommonRuleSet          Priority: 0          Statement:            ManagedRuleGroupStatement:              VendorName: AWS              Name: AWSManagedRulesCommonRuleSet              ExcludedRules:                - Name: GenericRFI_BODY          OverrideAction:            None: {}          VisibilityConfig:            CloudWatchMetricsEnabled: true            MetricName: AWSManagedRulesCommonRuleSet            SampledRequestsEnabled: false  WebACLAssociation:    Type: AWS::WAFv2::WebACLAssociation    Properties:      ResourceArn: !Sub "arn:aws:apigateway:ap-northeast-1::/restapis/${ServerlessRestApi}/stages/${ServerlessRestApiProdStage}"      WebACLArn: !Ref WebACLThen the WebACL can create successfully. But the association will fail. The error message is:An error occurred (WAFInvalidParameterException) when calling the AssociateWebACL operation: Error reason: The ARN isn’t valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARNI also try to write the ARN directly without using Sub and confirmed it is same format as in the article: https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.htmlI found an question on StackOverflow is exactly same as my issue and he also use aws-cli to do the same job and got the same error:https://stackoverflow.com/questions/60955745/applying-webacl-to-api-gatewayEdited by: othree3 on Apr 6, 2020 11:37 PMFollowComment"

Answer: "0For CLI:WAFv2 has a different scheme for the ARN. WAF Classic uses UUID alone whereas WAFv2 uses full ARN.From: https://docs.aws.amazon.com/cli/latest/reference/wafv2/associate-web-acl.htmlaws wafv2 associate-web-acl \    --web-acl-arn arn:aws:wafv2:us-west-2:123456789012:regional/webacl/test-cli/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111 \    --resource-arn arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/waf-cli-alb/1ea17125f8b25a2a \    --region us-west-2For CFN:WAFv2 has multiple return attribute so you cannot just reference the entire web ACL:WebACLArn: !Ref <webacl>Thus, you will have to do the following:WebACLArn: !GetAtt <webacl>.ArnCommentSharekumo-hiyorianswered 3 years ago0Thank you KevinThis solves my issue. And it works now. Then I think the error message is not clear.The field: RESOURCE_ARN looks like the invalid parameter is ResourceArn. But what is invalid is WebACLArn. Is this is correct error message or I misunderstanding the message?CommentShareothree3answered 3 years ago0Thanks, Kevin. This solved a similar issue for me as well. A corresponding example in the documentation would help reducing headache for others ;-)CommentShareAFOanswered 2 years ago"


Question: Is there a way to authorize GGv2 core devices to interact with AWS services at the Thing Group level ?

I understand how attaching policies to the GreengrassV2TokenExchangeRole enables code running on your GG core devices to access AWS services by using the device  cert to obtain temporary credentials. The token exchange role is associated with the device in that case.  Is there a way to do something similar at the group level so that putting a device in a thing group would give it permission to access particular AWS services and resources ?FollowComment

Answer: "1Accepted AnswerHello,I'm sorry to say that no, there is no way to assign a role for Greengrass to use at a Thing Group level. The individual things will all need their own permission to assume the role. The permission to assume the role could be stored in one IoT Policy which is then attached to each Thing's certificate; that way at least you don't need to duplicate policies.CommentShareEXPERTMichaelDombrowski-AWSanswered a year agowilliamrmay a year agoThank you.  I guess one could emulate this by having one token exchange role per group and specifying the "group role" during the device install.ShareMichaelDombrowski-AWS EXPERTa year agoYes, if you have thing groups with unique access requirements, then you can have different roles for each. Note that you are limited to 100 IoT Role Aliases per region, so you can only do that with 100 groups.Share"


Question: Need help to start g4dn.8xlarge EC2

"Dear allI can not start my Ubuntu 20.4 g4dn.8xlarge EC2 because it's status is failed.The Ami I used is ami-088da9557aae42f39It's message is "Instance reachability check failed"When I check system log, I see my VM can not start mnvidia-powerd service.Anyone know how to fix this?ThanksFollowComment"

Answer: "0Hi thereAn instance reachability check indicates that something has gone wrong at the OS layer of your instance that is stopping it from responding to ARP probes designed to monitor reachability. It sounds like your instance is failing to boot because it cannot start a particular service. I suggested that this kind of thing could be caused by an absence of NVIDIA modules. You could try to fix this by launching a rescue instance[1] in the same AZ as your instance, stopping your instance, detaching its root volume and reattaching it to the rescue instance as /dev/svda1. Then, connect to the instance, mount the volume:$ mount -o nouuid /dev/xvdf1 /mntMount /dev, /run, /proc, and /sys of the rescue instance to the same paths as the newly mounted volume:$ for m in dev proc run sys; do  mount -o bind {,/mnt}/$m; doneCall the chroot function to change into the mount directory:$ chroot /mntThen update your kernel headers and drivers[2]. Once you are done, detach the volume and reattach it back to the original instance. Hopefully, this will have repaired the issue and the instance will boot successfully.Resources:How to build rescue instance:[1]https:https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-boot-issues/[2]https://forums.developer.nvidia.com/t/black-login-screen-when-nvidia-v470-103-01-drivers-are-installed-on-fedora-36-fresh-install/215643CommentShareNosiphiwoanswered a year ago"


Question: S3: Configure object lock with replication (CRR) on aws s3 buckets

"As per aws-docs, user can configure S3 object lock with replication. As mentioned in the link, there are two methods:1. Enable Object Lock first2. Set up replication firstI tried both the methods. However both of does not work via aws console.For option 1, I created source and destination buckets. During bucket creation,  I enabled bucket lock on both buckets. When I checked option to setup replication rules, It prompts "Because object lock was enabled for this bucket, you must contact AWS support to enable replication". It does not give any option to configure replication rules.For option 2, I created source and destination buckets. Then I enabled versioning on both and setup replication from source to destination bucket. When I checked option to setup object lock on source bucket, it prompts a message "Amazon S3 currently does not support enabling object lock after a bucket has been created. To enabled object lock for this bucket, contact AWS". It does not give any option to configure/ enable object lock on source bucket.Can some one help in configuring object lock with replication on aws buckets.FollowComment"

Answer: "0As per the requirements for S3 replication if the source bucket has S3 Object Lock enabled, the destination buckets must also have S3 Object Lock enabled. You can only enable Object Lock for new buckets. If you want to enable Object Lock for an existing bucket then you have to contact AWS Support. Hence you can either create a new destination bucket with object lock enabled or create a support case with AWS Support to enable object lock for an existing bucket.Also I would like to inform you that to enable replication on a bucket that has Object Lock enabled you have to raise a support case with AWS Support to enable replication on object lock enabled buckets.For more details refer to knowledge base article -> https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.htmlCommentShareSUPPORT ENGINEERSathyaanswered a year ago"


Question: Recursive clone from git repo in CodeCatalyst

"One of my repos uses git submodules - but I can't see any method to perform a recursive clone as part of a workflow, other than adding a step in the workflow to run git submodules init and then a git submodule update.Is there any method to define that a recursive clone is needed on checkout to the workflow?FollowComment"


Question: How to Create an AWS Kinesis Stream and Put Data into the Stream Using Python Boto3?

I've been working with AWS Kinesis and I want to automate the creation of a Kinesis stream and the insertion of data into the stream using Python and Boto3. I have setup AWS SDKs and have necessary access. Could someone provide me with a step-by-step code snippet on how to achieve this?FollowComment

Answer: "1Accepted AnswerThe examples in the following documentation may be helpful for creating a Kinesis Stream and writing records.https://docs.aws.amazon.com/code-library/latest/ug/python_3_kinesis_code_examples.htmlThe stream is created using create_stream() and the record is written using put_record().Also, although not mentioned in this document, put_records() can be used to register multiple records at once.https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/kinesis/client/create_stream.htmlhttps://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/kinesis/client/put_record.htmlhttps://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/kinesis/client/put_records.htmlCommentShareEXPERTRiku_Kobayashianswered 15 days ago1install boto3 then you can use the following code as an exampleimport timeimport boto3import json# Create a sessionsession = boto3.Session(    aws_access_key_id='YOUR_ACCESS_KEY',    aws_secret_access_key='YOUR_SECRET_KEY',    region_name='us-west-2'  # or your preferred region)# Create a Kinesis resourcekinesis = session.resource('kinesis')# Name of your streamstream_name = 'MyNewStream'# Create a streamstream = kinesis.create_stream(    StreamName=stream_name,    ShardCount=1  # Modify as per your requirements)# Waiting for the stream to become activewhile True:    stream.reload()  # Refresh stream status    if stream.status == 'ACTIVE':        break    print('Waiting for stream to become active...')    time.sleep(1)# Sample data to put into streamdata = {    'message': 'Hello from AWS Kinesis!'}# Convert data to JSON formatdata_as_json = json.dumps(data)# Put data into streamresponse = kinesis.meta.client.put_record(    StreamName=stream_name,    Data=data_as_json,    PartitionKey='partitionkey'  # Replace with your own partition key)print('Data inserted into stream: ', response)CommentShareEXPERTsedat_salmananswered 15 days ago"


Question: How eksctl assume a CloudFormation execution role?

"I created an EKS cluster using CloudFormation template, so a CloudFormation execution role is used to create the EKS cluster. Then I want to run eksctl to create service account from my terminal, however, it failed due to unauthorized. I think that this is because eksctl is not able to assume the CloudFormation execution role yet. In this case, how to let eksctl to assume a role?FollowComment"

Answer: -1https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.htmlCommentShareRWCanswered a month ago


Question: IOT File stream last block request on return error: The cache block with block id [1] does not exist.

"I suspect that this is a bug in AWS IOT:When I create a IOT file stream of 129024 bytes and request blocks size of 3456. (this should be in total 28 blocks where the last block only contain 1152 bytes.) When requesting the last block I get an error back via the reject topic:{"o": "InvalidRequest","m":"The cache block with block id [1] does not exist.","c": "....."}Find more block sizes around  3456 causing the same error.Block size 3490 (also resulting in 38 blocks) works fine.Has anyone else seen this behaviour?FollowComment"

Answer: "0Hi Roland.this should be in total 28 blocks where the last block only contain 1152 bytesIs this just a typo and you meant 38? I think so.Block size 3490 (also resulting in 38 blocks) works fineIt should be 37 blocks (129024 / 3490 = 36.97). It will change from 38 to 37 when you reach 3488. So I'm wondering if you have a small error in your block size and offset calculation?Are you using the AWS OTA library (https://github.com/aws/ota-for-aws-iot-embedded-sdk) or your own implementation? Are you using bitmaps?CommentShareEXPERTGreg_Banswered 4 months agoRoland J 4 months agoHi Greg, the 28 is indeed 38 (my bad), the block size of 3490 works fine and indeed it is 37 blocks.The problem is when I use block size 3456 => 37.3333 blocks. The last block request returns an error and I do not use bitmaps.  We cannot use the OTA library the os on our embedded devices does not support that,ShareGreg_B EXPERT4 months agoOK thanks. So I think it's significant that it starts working when you increase the block size such that the number of blocks reduces from 38 to 37 (when you increase block size to 3490). Have you investigated your code with that in mind?We cannot use the OTA library the os on our embedded devices does not support that,Just to be clear on this point, the OTA library I linked to is free of any OS dependencies.ShareRoland J 4 months agoYes I have investigated it with several different block sizes. And found that when the last block is < 0.5 * block size I get the error.Share"


Question: Error: During file upload to S3 from Angular app

"Hi,I am trying to upload a file to S3 using the aws-sdk for Angular. Following is the code snippet:const credentials = new AWS.CognitoIdentityCredentials({IdentityPoolId: 'xxxx-xxx'});AWS.config.update({region: 'xxxx',credentials: credentials});const params = {    Bucket: 'xxxx',    Key: file.name,    Body: file  };  const bucket = new S3({    apiVersion: '2006-03-01',  });  bucket.upload(params, function (err, data) {    if (err) {      console.log('Error uploading file: ', err);    } else {      console.log('Successfully uploaded file', data);    }  });  When I upload a file and click on submit, I encounter the following error:ERROR Error: Uncaught (in promise): TypeError: Cannot read property 'Stream' of undefinedTypeError: Cannot read property 'Stream' of undefinedat Object.computeSha256 (VM163 vendor.js:90869)at Request.COMPUTE_SHA256 (VM163 vendor.js:82274)at Request.callListeners (VM163 vendor.js:87118)at Request.emit (VM163 vendor.js:87094)at Request.emit (VM163 vendor.js:85728)at Request.transition (VM163 vendor.js:85067)at AcceptorStateMachine.runTo (VM163 vendor.js:90122)at VM163 vendor.js:90134at Request.<anonymous> (VM163 vendor.js:85083)at Request.<anonymous> (VM163 vendor.js:85730)at resolvePromise (VM161 polyfills.js:3170)at new ZoneAwarePromise (VM161 polyfills.js:3252)Can anyone help me out with this?FollowComment"

Answer: 0I figured out the issue. We need to add the following snippet to polyfills.ts(window as any).process = { browser: true };CommentShareGogoChachaanswered 4 years ago


Question: Trouble with AWS CLI for DRS

"I'm trying to get output of a list of Server Names and SourceID for Elastic Disaster Recovery.  When I run the following CLIaws drs describe-source-servers --region us-west-2 --query "items[*].{Name:Tags[?Key=='Name']|[0].Value,sourceID:sourceServerID}" --output textMy output ends up looking likeNone    s-5c0f204f1e0e1a397Any suggestions on how to get this to work?FollowComment"


Question: NICE DCV Client on MacOS (arm64) uses too much memory

"When using DCV Client Version 2022.1-4279 for macOS (arm64), the DCV Viewer process slowly consumes more and more system memory.For instance, when the application starts it uses a few hundred MB, but after an hour it's over 5 GB of memory. Eventually the OS complains it is out of memory, with DCV viewer consuming ~90GB of memory, which requires restarting the application.Running on an M1 Macbook Pro, macOS Monterey version 12.6 and connecting to a g4dn.xlarge instance.FollowComment"


Question: Data LifeCycle Management

We have created cross account backup with DLM policy From A account to B account. How we can restore snapshot From B account to A account by sitting in A account.FollowComment

Answer: 0I assume both Account A and B are in the same region? This should be easy. You may want to take a look at this blog post of cross account backup and cross region restore at https://aws.amazon.com/blogs/storage/secure-data-recovery-with-cross-account-backup-and-cross-region-copy-using-aws-backup/CommentShareronald_lanswered 9 months agoAWS-User-6176623 9 months agowe are using Data Life Cycle Management for cross copy.Share


Question: Network Cloudformation Template

"Just a basic thing here I am trying to do but keeps rolling back in CF.AWSTemplateFormatVersion: 2010-09-09Description: CF Template for creation of S3 Bucket.Parameters:EnvironmentName:Description: An environment name that is prefixed to resource namesType: StringVpcCIDR:Description: Please enter the IP range (CIDR notation) for this VPCType: StringDefault: 10.10.0.0/16PublicSubnet1CIDR:Description: Please enter the IP range (CIDR notation) for the public subnet in the first Availability ZoneType: StringDefault: 10.10.1.0/24PublicSubnet2CIDR:Description: Please enter the IP range (CIDR notation) for the public subnet in the second Availability ZoneType: StringDefault: 10.10.2.0/24PrivateSubnet1CIDR:Description: Please enter the IP range (CIDR notation) for the private subnet in the first Availability ZoneType: StringDefault: 10.10.11.0/24PrivateSubnet2CIDR:Description: Please enter the IP range (CIDR notation) for the private subnet in the second Availability ZoneType: StringDefault: 10.10.12.0/24Resources:VPCSJWVPC:Type: AWS::EC2::VPCProperties:CidrBlock: !Ref VpcCIDREnableDnsHostnames: trueEnableDnsSupport: trueInstanceTenancy: defaultTags:- Key: NameValue: SJWVPC-01SubnetsPublicSubnet01:Type: AWS::EC2::SubnetProperties:AssignIpv6AddressOnCreation: trueCidrBlock: 10.10.1.0/24AvailabilityZone: us-east-1aTags:- Key: NameValue: Public-Subnet-01VpcId: SJWVPCThis is just a small snippit, but in my VS code CF linter tells me to not hardcore the Availability zone? So what am I suppose to do about that?FollowComment"

Answer: "0The below CFT is a working example of creating a VPC. Please take a look at how AZs have been represented here in the following format - AvailabilityZone: !Select [ 0, !GetAZs '' ]Description:  This template deploys a VPC, with a pair of public and private subnets spreadacross two Availability Zones. It deploys an internet gateway, with a defaultroute on the public subnets. It deploys a pair of NAT gateways (one in each AZ),and default routes for them in the private subnets.Parameters:EnvironmentName:Description: An environment name that is prefixed to resource namesType: StringVpcCIDR:Description: Please enter the IP range (CIDR notation) for this VPCType: StringDefault: 10.192.0.0/16PublicSubnet1CIDR:Description: Please enter the IP range (CIDR notation) for the public subnet in the first Availability ZoneType: StringDefault: 10.192.10.0/24PublicSubnet2CIDR:Description: Please enter the IP range (CIDR notation) for the public subnet in the second Availability ZoneType: StringDefault: 10.192.11.0/24PrivateSubnet1CIDR:Description: Please enter the IP range (CIDR notation) for the private subnet in the first Availability ZoneType: StringDefault: 10.192.20.0/24PrivateSubnet2CIDR:Description: Please enter the IP range (CIDR notation) for the private subnet in the second Availability ZoneType: StringDefault: 10.192.21.0/24Resources:VPC:Type: AWS::EC2::VPCProperties:CidrBlock: !Ref VpcCIDREnableDnsSupport: trueEnableDnsHostnames: trueTags:- Key: NameValue: !Ref EnvironmentNameInternetGateway:Type: AWS::EC2::InternetGatewayProperties:Tags:- Key: NameValue: !Ref EnvironmentNameInternetGatewayAttachment:Type: AWS::EC2::VPCGatewayAttachmentProperties:InternetGatewayId: !Ref InternetGatewayVpcId: !Ref VPCPublicSubnet1:Type: AWS::EC2::SubnetProperties:VpcId: !Ref VPCAvailabilityZone: !Select [ 0, !GetAZs '' ]CidrBlock: !Ref PublicSubnet1CIDRMapPublicIpOnLaunch: trueTags:- Key: NameValue: !Sub ${EnvironmentName} Public Subnet (AZ1)PublicSubnet2:Type: AWS::EC2::SubnetProperties:VpcId: !Ref VPCAvailabilityZone: !Select [ 1, !GetAZs  '' ]CidrBlock: !Ref PublicSubnet2CIDRMapPublicIpOnLaunch: trueTags:- Key: NameValue: !Sub ${EnvironmentName} Public Subnet (AZ2)PrivateSubnet1:Type: AWS::EC2::SubnetProperties:VpcId: !Ref VPCAvailabilityZone: !Select [ 0, !GetAZs  '' ]CidrBlock: !Ref PrivateSubnet1CIDRMapPublicIpOnLaunch: falseTags:- Key: NameValue: !Sub ${EnvironmentName} Private Subnet (AZ1)PrivateSubnet2:Type: AWS::EC2::SubnetProperties:VpcId: !Ref VPCAvailabilityZone: !Select [ 1, !GetAZs  '' ]CidrBlock: !Ref PrivateSubnet2CIDRMapPublicIpOnLaunch: falseTags:- Key: NameValue: !Sub ${EnvironmentName} Private Subnet (AZ2)NatGateway1EIP:Type: AWS::EC2::EIPDependsOn: InternetGatewayAttachmentProperties:Domain: vpcNatGateway2EIP:Type: AWS::EC2::EIPDependsOn: InternetGatewayAttachmentProperties:Domain: vpcNatGateway1:Type: AWS::EC2::NatGatewayProperties:AllocationId: !GetAtt NatGateway1EIP.AllocationIdSubnetId: !Ref PublicSubnet1NatGateway2:Type: AWS::EC2::NatGatewayProperties:AllocationId: !GetAtt NatGateway2EIP.AllocationIdSubnetId: !Ref PublicSubnet2PublicRouteTable:Type: AWS::EC2::RouteTableProperties:VpcId: !Ref VPCTags:- Key: NameValue: !Sub ${EnvironmentName} Public RoutesDefaultPublicRoute:Type: AWS::EC2::RouteDependsOn: InternetGatewayAttachmentProperties:RouteTableId: !Ref PublicRouteTableDestinationCidrBlock: 0.0.0.0/0GatewayId: !Ref InternetGatewayPublicSubnet1RouteTableAssociation:Type: AWS::EC2::SubnetRouteTableAssociationProperties:RouteTableId: !Ref PublicRouteTableSubnetId: !Ref PublicSubnet1PublicSubnet2RouteTableAssociation:Type: AWS::EC2::SubnetRouteTableAssociationProperties:RouteTableId: !Ref PublicRouteTableSubnetId: !Ref PublicSubnet2PrivateRouteTable1:Type: AWS::EC2::RouteTableProperties:VpcId: !Ref VPCTags:- Key: NameValue: !Sub ${EnvironmentName} Private Routes (AZ1)DefaultPrivateRoute1:Type: AWS::EC2::RouteProperties:RouteTableId: !Ref PrivateRouteTable1DestinationCidrBlock: 0.0.0.0/0NatGatewayId: !Ref NatGateway1PrivateSubnet1RouteTableAssociation:Type: AWS::EC2::SubnetRouteTableAssociationProperties:RouteTableId: !Ref PrivateRouteTable1SubnetId: !Ref PrivateSubnet1PrivateRouteTable2:Type: AWS::EC2::RouteTableProperties:VpcId: !Ref VPCTags:- Key: NameValue: !Sub ${EnvironmentName} Private Routes (AZ2)DefaultPrivateRoute2:Type: AWS::EC2::RouteProperties:RouteTableId: !Ref PrivateRouteTable2DestinationCidrBlock: 0.0.0.0/0NatGatewayId: !Ref NatGateway2PrivateSubnet2RouteTableAssociation:Type: AWS::EC2::SubnetRouteTableAssociationProperties:RouteTableId: !Ref PrivateRouteTable2SubnetId: !Ref PrivateSubnet2NoIngressSecurityGroup:Type: AWS::EC2::SecurityGroupProperties:GroupName: "no-ingress-sg"GroupDescription: "Security group with no ingress rule"VpcId: !Ref VPCOutputs:VPC:Description: A reference to the created VPCValue: !Ref VPCPublicSubnets:Description: A list of the public subnetsValue: !Join [ ",", [ !Ref PublicSubnet1, !Ref PublicSubnet2 ]]PrivateSubnets:Description: A list of the private subnetsValue: !Join [ ",", [ !Ref PrivateSubnet1, !Ref PrivateSubnet2 ]]PublicSubnet1:Description: A reference to the public subnet in the 1st Availability ZoneValue: !Ref PublicSubnet1PublicSubnet2:Description: A reference to the public subnet in the 2nd Availability ZoneValue: !Ref PublicSubnet2PrivateSubnet1:Description: A reference to the private subnet in the 1st Availability ZoneValue: !Ref PrivateSubnet1PrivateSubnet2:Description: A reference to the private subnet in the 2nd Availability ZoneValue: !Ref PrivateSubnet2NoIngressSecurityGroup:Description: Security group with no ingress ruleValue: !Ref NoIngressSecurityGroupCommentShareEXPERTIndranil Banerjee AWSanswered 7 months agoIndranil Banerjee AWS EXPERT7 months agoThe formatting got messed up but I don't see a way to attach a file unfortunatelyShare"


Question: How to make CloudFront forward the Host or X-Forwarded-Host header to API Gateway

"My API implementation needs to read the Host header sent by the browser as part of its behaviour. However it seems that the Host header is overwritten by cloudfront when it is calling the API Gateway Origin.This post suggest that it is possible to configure the Host header to be forwarded, however doing so does not work, because the API gateway is no longer being called correctly afterwards (API gateway seems to depend on the value of this header).I would like to be able to configure this in CloudFront without using lambda@edge or CloudFront functions.FollowComment"

Answer: "0AWS CloudFront, by default, does not forward the Host header to the origin because it uses this header to route requests to the correct location. This is why your API Gateway is failing when you try to forward this header -- it relies on the Host header to determine where to send the request. you cannot directly forward the Host header or X-Forwarded-Host header to the API Gateway using CloudFront without using Lambda@Edge or CloudFront Functions. These services allow you to modify the headers between the client and CloudFront or between CloudFront and the origin server. If your API needs the original Host header to function correctly, and you can't use Lambda@Edge or CloudFront Functions, you might need to consider a different design approach. Instead of relying on the Host header, you could use a custom header to pass the necessary information. You would set this header in your client application and configure CloudFront to forward it to your origin. Depending on the nature of your API and the information you're trying to pass, it might be possible to include it in the request body (for POST requests) or the URL (as a query string or part of the path).CommentShareEXPERTsedat_salmananswered 10 days ago"


Question: Glue PyShell Python Version

There was recently Glue 3.0 released which indicates newer Spark version and same Python version compared to Glue 2.0. Now as I understood Glue 2.0 updated only Spark type jobs but did not include anything for PyShell type jobs.Does Glue 3.0. bring any updates for Glue PyShell? I.e. is PyShell still on python 3.6?FollowComment

Answer: "2Accepted AnswerHi ,AWS Glue 3.0 updated only Spark type jobs (introduced support for Spark 3.1.1 and Scala 2.1.12).UPDATE as of August 2022AWS Glue Python Shell currently support python 3.9 and has introduced additional libraries out of the box, and simplified the installation of libraries that are not included in the base engine.To learn more check this blog post.hope this helps,CommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: Advice for best database/datastorage for historical data

"Hi,I´m doing some reasearch to find the best place to centralize lots of data logs generated by my application considering pricing ,performance and scalabilty. Today all my application data including logs are stored on an Oracle database, but I´m thinking to move all the LOG related data outside it to reduce it´s size and not to worry about storage performance etc...Just put everything on a "infinite" storage apart from my actual database using CDC or a regular batch processBelow are some needs:Only inserts are necessary (no updates or deletes)Customers will need access to this historic dataWell defined pattern of access (one or two indexes at maximum)Latencies of few seconds is okAvoid infrastrucure, DBA, perfomance bottleneck  log term...Infinite Retentiton period (means I don´t want to worry about performance issues, storage size in long term. But something that can handle a few terabytes of data )**Use case example: **Historical Sales order by items ( id_item | id_customer | qty_sold |  date_inserted ... ), aprox 50 millions records per dayWhere I would need to see the historical data by item, and by customer for example (two dimensions)I´ve done some research with the options below**S3 + Athena **-> Put everthing on s3, no worries about infrastructure perfomance issues, however as I need query by item and customer, probably it´would be necessary to break files by item or customer , generate millions of partitions to avoid high costs searching on every file etc..Postgre  -> Not sure if could be performance bottleneck once tables gets too big even with partition strategies**DynamoDB **-> Not sure if it´s a good alternative to historical data regarding pricing once seconds latency is ok**MongoDB/ DocumentDB **-> Not very familiar with it (I´d prefer SQL language type) but I know it´s has a good scalabilityCassandra-> dont´know very muchTimeseries db as influxDB, timestream etc..-> dont´know very much, but it seems appropriate for timeseriesWhat option would you choose ?Sorry in advance if I saying something  wrong or impossible :)Thank you!FollowComment"

Answer: 0If it is logs then you may also want to consider https://aws.amazon.com/opensearch-service/along with https://aws.amazon.com/about-aws/whats-new/2020/05/aws-announces-amazon-elasticsearch-service-ultrawarm-general-availability/ and https://aws.amazon.com/blogs/big-data/introducing-cold-storage-for-amazon-opensearch-service/ to optimise your storage costs.CommentShareKishananswered a year ago


Question: How to get to root after switched to new user without being in ubuntu's sudoers

"This is frustrating when I added a new user, then su newuser, couldn't go back to root by all means.It says not in sudoers afterwards. I've no root password, neither able to login from putty, it said login as ubuntu which rejected key, but i can login as newuser into newuser account. I sent 3 emails to support, no response.Hope I can do something here since my website is down for days.FollowComment"

Answer: "3Try to fix the files by attaching the volume to another running instance. Basically, you stop the instance, detach the boot volume, attach the volume to the running instance, mount it to the OS, the fix the sudoers or /etc files. Then do the reverse. Also, you can attempt to connect to the Serial Console to fix the files.CommentShareEXPERTkentradanswered a year agoEXPERTBrettski-AWSreviewed a year agoAWS-User-7873832 a year agoHi, serial console still requires user login, but how do I get into the root? Could I assign password to root user or access Sudoers file directly?Share"


Question: Invalid Access Key ID

"I am currently using AWS CLI and for some reason I get this error. Eventhough my access key and secret keys was generated with S3BucketFullAccess policy to my user. When I tried doing aws s3 ls on the terminal after configuring of course, I got this error.ERROR:An error occurred (InvalidAccessKeyId) when calling the ListBuckets operation: The AWS Access Key ID you provided does not exist in our record.This happen even tho I configure it with the access and secret key I generated. PLEASE HELP !!!Follow"

Answer: "0Verify that the access key and secret access key are correct by using the following command.Also, try restarting the shell after changing the access key and secret access key settings.aws configure listThat error can also occur if the access key or secret access key is incorrect or if the region is spelled incorrectly, so please check.Also, check to see if there are any access keys, etc. set in the shell environment variables.If it is set in a shell environment variable, it has a higher priority to be read than the credential file and should be removed.echo $AWS_SECRET_ACCESS_KEYecho $AWS_ACCESS_KEY_IDDeletion can be done with the following command.unset AWS_ACCESS_KEY_IDunset AWS_SECRET_ACCESS_KEYShareEXPERTRiku_Kobayashianswered 20 days ago0First thing to do is verify the keys are current aws iam list-access-keys and confirm the status is active.Then aws configure list and you should be able to see the last four characters of the access key & the secret key. Do these match up with the key that you created?ShareRWCanswered 20 days ago"


Question: What should I use between MediaStore vs MediaPackage ?

"(I'm sorry about my English skill.)Hello. I'm wondering what should I use between MediaStore and MediaPackage. My demand is that when I stream live by (OBS -> MediaLive), AWS also store the stream to VOD.I was already implemented above things => MediaLive to MediaPackage and store to S3.But I recently know that MediaStore also can store the stream(i.e .m3u8 or .ts) and also can stream by live. However, I don't know exactly what difference of MediaStore/MediaPackage.As far as I know isScenario1: OBS -> MediaLive -> MediaPackage -> CDN -> HLS/VLC Playback                     (Live)OBS -> MediaLive -> S3 -> MediaConvert -> S3 -> CDN -> HLS/VLC Playback  (VOD)Scenario2: OBS -> MediaLive -> MediaStore -> CDN -> HLS/VLC Playback   (Live)OBS -> MediaLive -> MediaStore -> CDN -> HLS/VLC Playback   (VOD)Please recommend what media service suit for me.And please explain what difference MediaStore/MediaPackage.Thank you!!FollowComment"

Answer: "0Here are the AWS Media Services (all accessible from a set of interactive consoles as well as through a comprehensive set of APIs):AWS Elemental MediaConvert – File-based transcoding for OTT, broadcast, or archiving, with support for a long list of formats and codecs. Features include multi-channel audio, graphic overlays, closed captioning, and several DRM options.AWS Elemental MediaLive – Live encoding to deliver video streams in real time to both televisions and multiscreen devices. Allows you to deploy highly reliable live channels in minutes, with full control over encoding parameters. It supports ad insertion, multi-channel audio, graphic overlays, and closed captioning.AWS Elemental MediaPackage – Video origination and just-in-time packaging. Starting from a single input, produces output for multiple devices representing a long list of current and legacy formats. Supports multiple monetization models, time-shifted live streaming, ad insertion, DRM, and blackout management.AWS Elemental MediaStore – Media-optimized storage that enables high performance and low latency applications such as live streaming, while taking advantage of the scale and durability of Amazon Simple Storage Service (S3).AWS Elemental MediaTailor – Monetization service that supports ad serving and server-side ad insertion, a broad range of devices, transcoding, and accurate reporting of server-side and client-side ad insertion.I hope this helps you. Know more about OBS VPS with https://www.apps4rent.com/obs-open-broadcaster-software-streaming-hosting/Regards,AdrianCommentShareAdrianG001answered 4 years ago"


Question: AWS account compromised. Help stopping services

"I am hoping that someone can please help me.I signed up to AWS Free Tier in February to follow a AWS course. After not using AWS for many months, I received a notification of a charge for a service called Lightsail. I quickly located and deleted the instance (I never started this service). I notified support by logging a support ticket.I reset my Password and setup 2FA but new charges keep appearing on my account. In November it was only Lightsail but in December, every 2 days there is a new charge on my Bill. At the moment, these charges other than Lightsail are showing up as $0. Unlike Lightsail I cannot find any other services running and I am unable to stop them. Everyday there are new requests and new API requests for Services such as CodeArtifact, Data Transfer, Service Catalog from multiple Regions but I do not know how to stop them. I have contacted Support but there are waiting to hear back from the service team. So far, after few days I have been told that my account was compromised. Can someone please help me stop these.Here is the bill:DetailsAWS Service Charges$7.91$0.00CodeArtifact$0.00Asia Pacific (Mumbai)AWS CodeArtifact APS3-Requests$0.00$0.0 per Request - request under the monthly free tier8.000 Requests$0.00$0.00Asia Pacific (Singapore)AWS CodeArtifact APS1-Requests$0.00$0.0 per Request - request under the monthly free tier6.000 Requests$0.00$0.00Asia Pacific (Sydney)AWS CodeArtifact APS2-Requests$0.00$0.0 per Request - request under the monthly free tier6.000 Requests$0.00$0.00Asia Pacific (Tokyo)AWS CodeArtifact APN1-Requests$0.00$0.0 per Request - request under the monthly free tier6.000 Requests$0.00$0.00EU (Frankfurt)AWS CodeArtifact EUC1-Requests$0.00$0.0 per Request - request under the monthly free tier4.000 Requests$0.00$0.00EU (Ireland)AWS CodeArtifact EU-Requests$0.00$0.0 per Request - request under the monthly free tier4.000 Requests$0.00$0.00EU (London)AWS CodeArtifact EUW2-Requests$0.00$0.0 per Request - request under the monthly free tier7.000 Requests$0.00$0.00EU (Paris)AWS CodeArtifact EUW3-Requests$0.00$0.0 per Request - request under the monthly free tier4.000 Requests$0.00$0.00EU (Stockholm)AWS CodeArtifact EUN1-Requests$0.00$0.0 per Request - request under the monthly free tier4.000 Requests$0.00$0.00US East (N. Virginia)AWS CodeArtifact USE1-Requests$0.00$0.0 per Request - request under the monthly free tier7.000 Requests$0.00$0.00US East (Ohio)AWS CodeArtifact USE2-Requests$0.00$0.0 per Request - request under the monthly free tier6.000 Requests$0.00$0.00US West (Oregon)AWS CodeArtifact USW2-Requests$0.00$0.0 per Request - request under the monthly free tier6.000 Requests$0.00$0.00Data Transfer$0.00Asia Pacific (Mumbai)Bandwidth$0.00$0.000 per GB - data transfer out under the monthly global free tier0.000000030 GB$0.00$0.00EU (London)Bandwidth$0.00$0.000 per GB - data transfer out under the monthly global free tier0.000000020 GB$0.00$0.00US East (N. Virginia)AWS Data Transfer USE1-CAN1-AWS-Out-Bytes$0.00$0.02 per GB - US East (Northern Virginia) data transfer to Canada (Central)0.000000220 GB$0.00AWS Data Transfer USE1-EUC1-AWS-Out-Bytes$0.00$0.02 per GB - US East (Northern Virginia) data transfer to EU (Germany)0.000000220 GB$0.00AWS Data Transfer USE1-EUN1-AWS-Out-Bytes$0.00USD 0.02 per GB for EUN1-AWS-Out-Bytes in EU (Stockholm)0.000000220 GB$0.00AWS Data Transfer USE1-EUW2-AWS-Out-Bytes$0.00$0.02 per GB - US East (Northern Virginia) data transfer to EU (London)0.000000220 GB$0.00AWS Data Transfer USE1-EUW3-AWS-Out-Bytes$0.00$0.02 per GB - US East (Northern Virginia) data transfer to EU (Paris)0.000000220 GB$0.00AWS Data Transfer USE1-SAE1-AWS-Out-Bytes$0.00$0.02 per GB - US East (Northern Virginia) data transfer to South America (Sao Paulo)0.000000260 GB$0.00AWS Data Transfer USE1-USW1-AWS-Out-Bytes$0.00$0.02 per GB - US East (Northern Virginia) data transfer to US West (Northern California)0.000000260 GB$0.00Bandwidth$0.00$0.000 per GB - data transfer out under the monthly global free tier0.000000020 GB$0.00$0.00Key Management Service$0.00Asia Pacific (Mumbai)AWS Key Management Service ap-south-1-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests1.000 Requests$0.00$0.00Asia Pacific (Seoul)AWS Key Management Service ap-northeast-2-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests1.000 Requests$0.00$0.00Asia Pacific (Singapore)AWS Key Management Service ap-southeast-1-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests1.000 Requests$0.00$0.00Asia Pacific (Sydney)AWS Key Management Service ap-southeast-2-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests1.000 Requests$0.00$0.00Asia Pacific (Tokyo)AWS Key Management Service ap-northeast-1-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests1.000 Requests$0.00$0.00Canada (Central)AWS Key Management Service ca-central-1-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests1.000 Requests$0.00$0.00EU (Frankfurt)AWS Key Management Service eu-central-1-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests1.000 Requests$0.00$0.00EU (Ireland)AWS Key Management Service eu-west-1-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests1.000 Requests$0.00$0.00EU (London)AWS Key Management Service eu-west-2-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests1.000 Requests$0.00$0.00EU (Paris)AWS Key Management Service eu-west-3-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests1.000 Requests$0.00$0.00EU (Stockholm)AWS Key Management Service eu-north-1-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests1.000 Requests$0.00$0.00South America (Sao Paulo)AWS Key Management Service sa-east-1-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests1.000 Requests$0.00$0.00US East (N. Virginia)AWS Key Management Service us-east-1-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests2.000 Requests$0.00$0.00US East (Ohio)AWS Key Management Service us-east-2-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests1.000 Requests$0.00$0.00US West (N. California)AWS Key Management Service us-west-1-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests1.000 Requests$0.00$0.00US West (Oregon)AWS Key Management Service us-west-2-KMS-Requests$0.00$0.00 per request - Monthly Global Free Tier for KMS requests1.000 Requests$0.00$6.59Lightsail$0.00GlobalAmazon Lightsail USE1-TotalDataXfer-In-Bytes$0.00$0.00 / GB - data transfer in35.431 GB$0.00$6.59US East (N. Virginia)Amazon Lightsail Bundle:16GB$6.59$0.1613 / Hour of 16GB bundle Instance (Windows)40.844 Hrs$6.59Amazon Lightsail USE1-TotalDataXfer-Out-Bytes$0.00$0.00 / GB - data transfer out for US East (N. Virginia)1.484 GB$0.00$0.00Secrets Manager$0.00Asia Pacific (Mumbai)AWS Secrets Manager APS3-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests1.000 API Requests$0.00$0.00Asia Pacific (Osaka)AWS Secrets Manager APN3-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests1.000 API Requests$0.00$0.00Asia Pacific (Seoul)AWS Secrets Manager APN2-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests1.000 API Requests$0.00$0.00Asia Pacific (Singapore)AWS Secrets Manager APS1-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests1.000 API Requests$0.00$0.00Asia Pacific (Sydney)AWS Secrets Manager APS2-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests1.000 API Requests$0.00$0.00Asia Pacific (Tokyo)AWS Secrets Manager APN1-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests1.000 API Requests$0.00$0.00Canada (Central)AWS Secrets Manager CAN1-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests2.000 API Requests$0.00$0.00EU (Frankfurt)AWS Secrets Manager EUC1-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests1.000 API Requests$0.00$0.00EU (Ireland)AWS Secrets Manager EU-AWSSecretsManager-APIRequests$0.00$0 per 10000 API Requests1.000 API Requests$0.00$0.00EU (London)AWS Secrets Manager EUW2-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests2.000 API Requests$0.00$0.00EU (Paris)AWS Secrets Manager EUW3-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests2.000 API Requests$0.00$0.00EU (Stockholm)AWS Secrets Manager EUN1-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests2.000 API Requests$0.00$0.00South America (Sao Paulo)AWS Secrets Manager SAE1-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests2.000 API Requests$0.00$0.00US East (N. Virginia)AWS Secrets Manager USE1-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests2.000 API Requests$0.00$0.00US East (Ohio)AWS Secrets Manager USE2-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests1.000 API Requests$0.00$0.00US West (N. California)AWS Secrets Manager USW1-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests2.000 API Requests$0.00$0.00US West (Oregon)AWS Secrets Manager USW2-AWSSecretsManagerAPIRequest$0.00$0 per 10000 API Requests1.000 API Requests$0.00$0.00Service Catalog$0.00Asia Pacific (Mumbai)AWS Service Catalog APS3-AR-App-API-Calls$0.00$0.00 per API Calls for AppRegisty Application API-Calls in Asia Pacific (Mumbai)3.000 API Calls$0.00$0.00EU (London)AWS Service Catalog EUW2-AR-App-API-Calls$0.00$0.00 per API Calls for AppRegisty Application API-Calls in EU (London)1.000 API Calls$0.00$0.00EU (Paris)AWS Service Catalog EUW3-AR-App-API-Calls$0.00$0.00 per API Calls for AppRegisty Application API-Calls in EU (Paris)4.000 API Calls$0.00$0.00US East (N. Virginia)AWS Service Catalog USE1-AR-App-API-Calls$0.00$0.00 per API Calls for AppRegisty Application API-Calls in US East (N. Virginia)25.000 API Calls$0.00AWS Service Catalog USE1-SC-API-Calls$0.00$0.00 per API Calls for SC-API-Calls in US East (N. Virginia) - Free Tier12.000 API Calls$0.00$0.00US East (Ohio)AWS Service Catalog USE2-AR-App-API-Calls$0.00$0.00 per API Calls for AppRegisty Application API-Calls in US East (Ohio)1.000 API Calls$0.00$0.00Simple Notification Service$0.00Asia Pacific (Mumbai)Amazon Simple Notification Service APS3-Requests-Tier1$0.00First 1,000,000 Amazon SNS API Requests per month are free2.000 Requests$0.00$0.00Asia Pacific (Seoul)Amazon Simple Notification Service APN2-Requests-Tier1$0.00First 1,000,000 Amazon SNS API Requests per month are free2.000 Requests$0.00$0.00Asia Pacific (Singapore)Amazon Simple Notification Service APS1-Requests-Tier1$0.00First 1,000,000 Amazon SNS API Requests per month are free2.000 Requests$0.00$0.00Asia Pacific (Sydney)Amazon Simple Notification Service APS2-Requests-Tier1$0.00First 1,000,000 Amazon SNS API Requests per month are free2.000 Requests$0.00$0.00Asia Pacific (Tokyo)Amazon Simple Notification Service APN1-Requests-Tier1$0.00First 1,000,000 Amazon SNS API Requests per month are free2.000 Requests$0.00$0.00Canada (Central)Amazon Simple Notification Service CAN1-Requests-Tier1$0.00First 1,000,000 Amazon SNS API Requests per month are free3.000 Requests$0.00$0.00EU (Frankfurt)Amazon Simple Notification Service EUC1-Requests-Tier1$0.00First 1,000,000 Amazon SNS API Requests per month are free2.000 Requests$0.00$0.00EU (Ireland)Amazon Simple Notification Service EU-Requests-Tier1$0.00First 1,000,000 Amazon SNS API Requests per month are free2.000 Requests$0.00$0.00EU (London)Amazon Simple Notification Service EUW2-Requests-Tier1$0.00FollowComment"

Answer: "2Contacting support (which you've done) is the best thing to do here. You should also check in the IAM console and ensure that there are no other users or access keys that are active. There is some more guidance here: https://aws.amazon.com/premiumsupport/knowledge-center/potential-account-compromise/CommentShareEXPERTBrettski-AWSanswered 6 months ago0I have the same problem tooCommentShareJoyanswered 6 months ago0Hi Joy, any luck with your issue?CommentShareJonathanEanswered 6 months ago"


Question: Gradient colors for points on map

"I am making a Points on Map visual, and I have a scalar value associated with each point. I want the map to look like a heatmap, where the color of each point is defined by a gradient. Is there a way to do this?When I put the numerical field in the "Color" well, The order of the colors does not make any senseIs there a way to make the colors reflect a gradient, similar to this visual?FollowComment"


Question: Retrieve name and email address of workspace users.

"The workspaces console shows Name, Email, and other fields that I don't see with describe-workspaces on the command line. How do I retrieve the real name and email address of  the workspace user using the command line?FollowComment"

Answer: "1If you have WorkDocs enabled, you should be able to use the describe-users command to list the users in the directory:aws workdocs describe-users --organization-id d-0000000000where --organization-id is the DirectoryId you get from the describe-workspaces command.CommentShareEdanswered 10 months agoWarrenMatthews 10 months agoJust what I needed. Thanks very much.Share"


Question: Amplify framework identityPoolRegion config ignored

"I've tried to point out this problem in amplify-js issues, but it was closed without any explanation. https://github.com/aws-amplify/amplify-js/issues/9409Based on amplify documentation identityPoolRegion should be supported, but I can clearly see, that here https://github.com/aws-amplify/amplify-js/blob/9924a31397761fccd03f53336d754b98367199a8/packages/auth/src/Auth.ts#L202  >region: identityPoolRegion || region  the configuration value is "ignored".This results that the credentials from session function will fail later.... https://github.com/aws-amplify/amplify-js/blob/9924a31397761fccd03f53336d754b98367199a8/packages/core/src/Credentials.ts#L416The endresult is that getting cognitoClient fails, becauses regions doesn't match.... 'cognito-idp.eu-west-1.amazonaws.com/us-east-1_L9xxxxx: "eyJra.....'I would like to hear, what is the status of this. Is it something, what is not going to be fixed or is my finding even correct.  This identityPool separation is important for us, without it we can't maintain central cognito userPool, which is vital for our services.FollowCommentmike_meyer a year agoAlso running into similar issue, did you ever find a workaround for this?Share"


Question: RDS MySQL 8.0.29 version is deprecated. Could not do upgrade or modify anything.

"HiJust a month ago RDS MySQL DB engine was upgraded to version 8.029. Now I want to increase the storage of my database. When I checked the "Modify" of the database, it displayed:Minor version 8.0.29 has been deprecated. We recommend upgrading to the latest applicable minor versionThere are no other DB engine versions are displayed in the list to upgrade or downgrade. Could not select DB instance class, and storage type.I want to increase database storage, but it also does not display any list as well. Database storage is going to be full soon. I could not do anything to my database.Any help will be appreciated?ThanksFollowComment"

Answer: "1Dear Customer,Thanks for reaching out to us via AWS re:Post. I just saw this post and checked with my peers and found the below info.The minor version MySQL 8.0.29 release has been deprecated and that’s the reason that you couldn’t find the version in the list any more. At this point, recommendation is for customers that have visible symptoms of a crash we recommend they do a Point-In-Time-Restore (https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PIT.html ) to recover the database. Please accept my sincere apologies on behalf of AWS for the inconvenience caused by this.When the new version is released and available on RDS we’ll inform you and the rest of our AWS community on our announcements page here: https://aws.amazon.com/new/If you would like to downgrade your instance to version 8.0.28, below options are available:Using Native MySQL import export tool:You can use tools like mysqldump/Mydumper/Myloader to import and migrate from existing RDS MySQL instance on 8.0.29 to another instance on 8.0.28 version. Please kindly review the below documentation for more details: [+] Importing data from a MySQL or MariaDB DB to a MySQL or MariaDB DB instance - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/MySQL.Procedural.Importing.SmallExisting.html[+] Importing Data to an Amazon RDS MySQL or MariaDB DB Instance with Reduced Downtime - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/MySQL.Procedural.Importing.NonRDSRepl.htmlUsing AWS Database Migration Service:Please use the below resources to get more familiar with DMS working and settings before getting stared with the service: [+] Migrate to an Amazon RDS or Aurora MySQL DB instance using AWS DMS: https://aws.amazon.com/premiumsupport/knowledge-center/migrate-mysql-rds-dms/[+] What is AWS Database Migration Service? - https://docs.aws.amazon.com/dms/latest/userguide/Welcome.html[+] How AWS Database Migration Service works - https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Introduction.htmlHoping I was able to assistCommentShareEXPERTNIRUPAM_danswered 10 months ago"


Question: Permissions on keyfile for sftp

When i try to sftp into my instance using my original created key I am able to log In but not able to make any changes. No write permissions. Any ideas?FollowComment

Answer: "0The question is tagged with "AWS Transfer for SFTP" so i assume your question is about an AWS Transfer SFTP service that you have setup.The keyfile doesn't grant privileges, it just authenticates the user to allow access. When the user was setup in AWS Transfer it will have had an IAM role assigned to it, and that role will have a policy (or policies) attached to it that grant levels of access to the user.So if you only have read-only privileges when you login to AWS Transfer then it sounds like the user you are logging in with needs to have the policies associated with their role uplifted (or assign to the user a role whose policies allow more access).More information https://docs.aws.amazon.com/transfer/latest/userguide/users-policies.htmlCommentShareRWCanswered a month ago"


Question: jsii.errors.JSIIError: Cannot read properties of undefined (reading 'bindToGraph')

"HI AllThis is my first implementation of StateMachineFragment.Goal: Attempting to create a class for re-usable lambda state. This class can take a parameter and pass this as payload to Lambda and the lambda will execute the right query based on the payload.Below is my POC code to 'classs-ify' the lambda and the call to statemachine.from aws_cdk import (    Duration,    Stack,    # aws_sqs as sqs,    aws_stepfunctions as _stepfunctions,    aws_stepfunctions as sfn,    aws_stepfunctions_tasks as _stepfunctions_tasks,    aws_lambda as _lambda,)from constructs import Constructclass SubMachine(_stepfunctions.StateMachineFragment):    def __init__(self, parent, id, *, jobTypeParam):        super().__init__(parent, id)        existingFunc = _lambda.Function.from_function_arn(self, "ExistingLambdaFunc", function_arn="arn:aws:lambda:us-east-1:958$#$#$#$:function:dummyFunction")        lambda_invoked = _stepfunctions_tasks.LambdaInvoke(self, "someID", lambda_function=existingFunc)        wait_10_seconds = _stepfunctions.Wait(self, "Wait for 10 seconds",                                         time=_stepfunctions.WaitTime.duration(Duration.seconds(10))                                         )        self._start_state =  wait_10_seconds        self._end_states = [lambda_invoked.end_states]    def start_state(self):        return self._start_state    def end_states(self):        return self._end_statesclass StepfunctionsClasStack(Stack):    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:        super().__init__(scope, construct_id, **kwargs)        test_lambda_1 = SubMachine(self, "SubMachine1", jobTypeParam="one")        state_machine = _stepfunctions.StateMachine(self, "TestStateMachine",                                                    definition=test_lambda_1,                                                    # role=marketo_role                                                    )When I try and deploy this code, I get the following error:jsii.errors.JSIIError: Cannot read properties of undefined (reading 'bindToGraph')I am not sure where I am going wrong.Thoughts?ThanksFollowComment"

Answer: "0Hi,May I ask if this is the whole error message that is being returned? We reached out to the Step Functions team and it seems this error can be caused if the parameters that are being passed may not be correct.If possible, can you provide the stacktrace? This is to check which line of code may be triggering the error. We can then double check the documentation to validate if there may be an issue with the parameters that are being passed.CommentShareSUPPORT ENGINEERRyan_Aanswered a year ago"


Question: ECS(Scheduled Taks) -> CloudWatch - Missing logs.

"Hi,I'm facing an issue with randomly disappearing logs on cloudwatch.I have scheduled tasks on ECS which run container with defined inside entrypoint which is responsible for running task using this same container but with other entrypoint.During first task(first entrypoint) - logging works correctly but when this task trigger another tasks(same container but other entrypoint) logs in cloudwatch appears randomly.This happens even when I run that tasks by hand.First run may fail with logs but the second one 5 minutes later works. With exactly the same settings.I'm 100% sure that functionality inside container works(I checked).I have no idea what kind of further investigation may I do.Any suggestions?EDIT:I implemented boto3 for logs next to python logger.Events via boto3 are handled correctly so it's a kind of workaround but it still not resolve an issue.SOLUTION-WORKAROUND:Use  https://github.com/kislyuk/watchtower handler for python loggersEdited by: karoljago on Apr 30, 2019 12:05 AMFollowComment"

Answer: 0Hey there! I'm noticing the same issue... I posted on it and it hasn't been replied to yet.CommentSharenaji247answered 4 years ago0Figured out a way to always catch logs from python codeCommentSharekaroljagoanswered 4 years ago0How did you do it?CommentSharenaji247answered 4 years ago


Question: Lightsail Bitnami Instance Providing Access to other user

"Hello,I have Lightsail Bitnami Instance. Currently, I am able to access my instance via SSH or SFTP using a key file. However, the company that will be installing the module has requested access via FTP with a password. As I do not wish to share my key file, I am wondering if there is a way to provide temporary access to the file system via SFTP or FTP using a username and password.I was hoping you guys could provide guidance on how to achieve this. Ideally, I would like to create a temporary username and password for the company to use, and then disable this option once their work is complete.Thank youFollowComment"


Question: Glacier: AccessDeniedException

"Trying to delete multiple unlocked vaults created last year. I was able to do so for most of them, but a few are left that cannot be accessed by any software or the CLI. When I try to get the inventory using the CLI, using the user who created the vaults or the root user, I get the following:aws glacier initiate-job --vault-name <NAME> --account-id <ID> --job-parameters '{"Type": "inventory-retrieval"}'An error occurred (AccessDeniedException) when calling the InitiateJob operation: User: arn:aws:iam::<ID>:<user> is not authorized to perform: glacier:InitiateJob on resource: arn:aws:glacier:<LOC>:<ID>:vaults/<NAME>FollowComment"

Answer: "1Accepted AnswerThe issue was not related to permissions, the error message "AccessDeniedException" is misleading. I tried to access an in-existent vault, which resulted in the same error message.The problem was based on the following wrong account-id format, which I copied directly from the AWS Console. It needs to be provided without the dashes:aws glacier initiate-job --vault-name <NAME> --account-id 1234-1234-1234 --job-parameters '{"Type": "inventory-retrieval"}'CommentSharerePost-User-7362599answered 3 months ago1Hello ,Thank you for posting your question on the AWS Repost, my name is Rochak and it will be a pleasure assisting you with this today.I understand you are trying to delete multiple unlocked vaults and you were able to delete most of them but you are not able to delete few and you are getting error while trying to delete them even as a user who created the vault and also as a root user. Please, let me know if my understanding is incorrect.Please note that there are some instances where root user or admin user do get access denied and there a number of reasons that you might receive an access denied error on your root user. This includes:•A service control policy (SCP) is restricting your access to a service•A resource-based policy is restricting your access to a resource•A permissions boundary is in limiting the actions your entity can perform•A session policy is in place and is causing an authorization issue•A VPC endpoint policy is restricting access to your IAM entitiesPlease follow the troubleshooting steps provided here [1] depending on your use case and the error that you receive.I am also adding [2] for your references which provides detailed steps as well as video tutorial on troubleshooting access denied or unauthorized operation errors with an IAM policy.I hope this helps. If you need further info, let me know in the comments; otherwise I'd appreciate if you mark my answer as "accepted".Kind regards,Rochak from AWSReferences:[1] Troubleshoot access denied issues for a root user or an admin userhttps://aws.amazon.com/premiumsupport/knowledge-center/iam-access-denied-root-user/[2] Troubleshoot access denied or unauthorized operation errors with an IAM policyhttps://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-policy-issues/#CommentShareAWS-Rochakanswered 3 months ago"


Question: Need assistance with MX record to use on my website

"Hi there,Could someone assist me with the MX record required to use www.whfg.nlI would like to add them to my website.Many thanks in advanceFollowComment"

Answer: "0Hi.MX records are usually not needed to the extent that your website is hosted in a custom domain.MX records are typically used when setting up an email receiving server.Amazon SES is mainly used as an outgoing mail server, but it can also be used as an incoming mail server.https://docs.aws.amazon.com/ses/latest/dg/receiving-email-concepts.htmlRegister the MX record as described above, receive the email, and process the email with Lambda etc. Please note that it is not intended to be received by a regular mail client.CommentShareEXPERTiwasaanswered a year ago"


Question: Please add support for .koeln & .cologne TLDs

"Well, title says everything already really.I posted about this a couple years ago already on the old forums and nothing has happened since so I am posting again here.Maybe we get something this time 🤞FollowComment"

Answer: "0Hello, thank you for reaching out.I understand that you are requesting support for the ".koeln" and ".cologne" TLD registrations on Route 53.Route 53 Domains is currently directly accredited with .com, .net, and .org registries. All other TLDs are provided via third party registrar associates. To improve our level of service and support, we are actively working to become directly accredited with all other TLDs. In addition to improving our existing offering, we will become accredited with other registries to expand our TLD catalog. This work is currently in progress. We do not currently have dates to share for adding new TLDs.You can monitor the updates here at AWS Blogs - https://aws.amazon.com/blogs/aws/ and what's new on AWS - https://aws.amazon.com/new/CommentShareAustin_Lanswered 10 months ago0Well, i guess that is at least a tiny bit more progress than the post on the old forum achieved.\o/CommentSharejschulzanswered 10 months ago"


Question: How2 Create SSL Certificates for IDNs (puny code) for Lightsail instances?

"I'm currently working for a Bulgarian client that is using an International Domain Name (IDN).  The domain is in Cyrillic (Bulgarian).  I have converted the IDN to the appropriate puny code.  However, when I try to create the ssl certificate on my Lightsail instance for Wordpress in the Bitnami stack using the bncert-tool, the tool doesn't recognise the puny code nor the Bulgarian language domain.  the tool keeps asking me to "enter a valid domain name".  Therefore, I can't create the certificates and secure the traffic to my customer's site.How can I create SSL certificates for Lightsail instances for IDNs?Help me obi wan, you're my only hope ;-)thanks!FollowComment"

Answer: "0Hello,Have you tried following the steps for using Let's Encrypt certificates with WordPress instances?https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-using-lets-encrypt-certificates-with-wordpressAlso, have you tried using the generated punycode rather than the unicode as inputs?If I try using unicode input - Добър.gb -  then I get "Warning: Please enter valid domains."  This sounds like the error you mentioned in your post.If I try using punycode input - xn--90af4aj3c.gb - then it proceeds to later step where it warns me the domain doesn't resolve, which makes sense since I don't have that domain. xn--90af4aj3c.gbCommentShareAWS-Andyanswered 9 months ago0Hey Andy -Thanks for getting back to me.  Actually, it turns out that the problem was I was trying to use the bncert-tool to create the certificates.  When I ran the Alternative Method and the created then manually http to https redirect rules, everything works!So the steps were:Run the Alternative Method to create the certificates:  https://docs.bitnami.com/aws/how-to/generate-install-lets-encrypt-ssl/#alternative-approacManually create the Redirect Http2https rules:  https://docs.bitnami.com/aws/apps/wordpress/administration/force-https-apache/Now everything is working great!It was about the bncert-tool, not the IDNs!Thanks for getting back to me!CommentSharegeeftgeennaamanswered 9 months ago"


Question: Abuse phishing report

"I got an email with this title and Description but i don't know how to fix it?is anyone can help me?Sep 08, 10:50 AM UTCWe've received a report(s) that your AWS resource(s) listed in the 'Affected resources' tab has been implicated in hosting content that resembles a phishing website. Hosting a phishing website is forbidden in the AWS Acceptable Use Policy (https://aws.amazon.com/aup/). We've included the original report below for your review.Please take action to stop the reported activity. You would have also received an email notification from ec2-abuse@amazon.com with this same report. Please reply directly to that email with details of the corrective actions you have taken. If you do not consider the activity described in these reports to be abusive, please reply to that email with details of your use case.If you're unaware of this activity, it's possible that your environment has been compromised by an external attacker, or a vulnerability is allowing your machine to be used in a way that it was not intended.We are unable to assist you with troubleshooting or technical inquiries. However, for guidance on securing your instance, we recommend reviewing the following resources:Amazon EC2 Security Groups User Guide:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html (Linux)https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/using-network-security.html (Windows)Tips for Securing EC2 Instances:https://aws.amazon.com/articles/1233 (Linux)https://aws.amazon.com/articles/1767 (Windows)AWS Security Best Practices:https://d0.awsstatic.com/whitepapers/Security/AWS_Security_Best_Practices.pdfIf you require further assistance with this matter, you can take advantage of our developer forums:https://forums.aws.amazon.com/index.jspaOr, if you are subscribed to a Premium Support package, you may reach out for one-on-one assistance here:https://console.aws.amazon.com/support/home#/case/create?issueType=technicalPlease remember that you are responsible for ensuring that your instances and all applications are properly secured. If you require any further information to assist you in identifying or rectifying this issue, please let us know in a direct reply to the email you received from ec2-abuse@amazon.com.Regards,FollowComment"

Answer: "1Hello,The email should have outlined which AWS resources have been identified to be hosting a phishing site.  You may not be aware, but that resource may have been compromised and is now being used to phish other users.  It's recommended to follow the instructions and either remove the malicious phishing site or take down the individual resources (EC2 instances, etc.).Per the email, if you need additional information or support from the AWS abuse team, please reach out to ec2-abuse@amazon.com.CommentShareEXPERTChris_Ganswered 9 months agoEXPERTBrettski-AWSreviewed 9 months ago"


Question: Origination phone number gone

Under Pinpoint and SMS messaging I went though getting an Origination Phone number and this morning it said it was active.  I just logged back into the account to assign it to a campaign and it is no longer listed on my account.  No phone numbers listed.I have a registered KEYWORD.  Where do I find this phone number to assign to my campaign?FollowComment


Question: Does Neptune execute bulk loader jobs in parallel or serially?

"If I have jobs that require being processed in a certain order, can I rely on Neptune to process them serially in the order I create the jobs?  Or does Neptune try to run the jobs in parallel at the same time?Thank you,MikeEdited by: mveilleux on Jan 28, 2020 9:03 AMFollowComment"

Answer: "0A new bulk load request is only accepted if there is no active load.Bulk loader executes one single request at any given time.Within a single bulk load, Bulk loader loads data in parallel threads, non-atomically. And the order in which data is solely decided by the bulk loader, user cannot control the order in which data gets inserted.We have plan to support new bulk load requests be queued up and executed one by one from the queue.Edited by: aries-aws on Feb 10, 2020 8:29 PMCommentSharearies-awsanswered 3 years ago"


Question: Not able to access private ECR repo and image

"Hello, I am storing a docker image in the private repo of ECR, and while creating task definition, it gives me an error ofPrivate repository credentials are not a supported authentication method for ECR repositories.I also tried with the secret manager, but it is not working. Can someone guide me on what the proper way is?Thanks for your time.FollowComment"

Answer: "0Check this link it might help your case:https://docs.aws.amazon.com/AmazonECR/latest/userguide/Repositories.html#repository-conceptsCommentShareAhmed Abudayehanswered 8 months agorePost-User-9617035 8 months agoI tried this but still not workingShare0Hello,It sounds like your task execution role might not have the right permissions? Confirm that your ecsTaskExecutionRole has the following policy attached: AmazonECSTaskExecutionRolePolicy. The trust relationship should also look like:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "",            "Effect": "Allow",            "Principal": {                "Service": "ecs-tasks.amazonaws.com"            },            "Action": "sts:AssumeRole"        }    ]}If that doesn't work, I would verify that if you are doing any cross-account image pulling that your ECR repository has permissions that specifically allow the arn of your ecsTaskExecutionRole like so:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "AllowCrossAccountPull",      "Effect": "Allow",      "Principal": {        "AWS": [          "arn:aws:iam::XXXXXXXXXXXX:role/ecsTaskExecutionRole"        ]      },      "Action": [        "ecr:BatchCheckLayerAvailability",        "ecr:BatchGetImage",        "ecr:GetDownloadUrlForLayer"      ]    }  ]}Hope this helps! If not, please provide more detail on your architecture and IAM details.CommentSharegrahamschuckmananswered 8 months ago0Hi, @grahamschuckman thanks for your reply. My AmazonECSTaskExecutionRolePolicy looks like this:{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "ecr:GetAuthorizationToken",                "ecr:BatchCheckLayerAvailability",                "ecr:GetDownloadUrlForLayer",                "ecr:BatchGetImage",                "logs:CreateLogStream",                "logs:PutLogEvents"            ],            "Resource": "*"        }    ]}and I am not doing any cross account image pulling. The image is stored is same AWS account in ECR private repo.CommentSharerePost-User-9617035answered 8 months ago0Have a look at this article.https://aws.amazon.com/premiumsupport/knowledge-center/ecs-tasks-pull-images-ecr-repository/Follow the steps related to the ECS launch type you use (EC2 or Fargate). It should fix your issue.CommentShareMichaelanswered 8 months ago"


Question: Garbage collection not working in EKS  1.23

"Garbage collection fails to free up disk space on worker nodes.I can see the below message from events.kubelet failed to garbage collect the required amount of images. Wanted to free 5577161113 bytes, but freed 0 bytesEKS cluster version 1.23FollowComment"

Answer: "-1Please run df -h /var/lib/docker from your node against a worker node that uses EKS optimized AMI. Mostly volume mount on docker has less storage.In order to do that, you could run the following commands to mount to a different volume :+++++++++systemctl stop dockermount /dev/xvdf1 /var/lib/dockersystemctl start docker+++++++++https://forums.docker.com/t/how-to-have-var-lib-docker-on-a-100g-drive/45498/7CommentShareRam_AWSanswered 2 months ago"


Question: EC2 Status check failed a few times

"My EC2 instance has gone down a few times in recent months. It works again every time after rebooting it.  I am running a m5.2xlarge Ubuntu instance. The memory usage is 9%.Any help regarding the possible cause would be most appreciated, thanks.FollowComment"

Answer: "0Status checks fails due to one of many reasons.. some of them below;..Resource limitations: It is possible that the default limits for some of the AWS resources associated with your instance, such as the number of Elastic IP addresses, security groups, or network interfaces, have been reached. To verify this, you can check the AWS documentation for EC2 instance limits or contact AWS support.Issues with the OS or kernel: It is possible that your Ubuntu operating system or kernel is experiencing errors or issues that are causing the instance to go down. You can try reviewing the system logs to identify any issues.Hardware issues: If the underlying hardware of your EC2 instance is failing, this could cause the instance to go down regularly. You can review the EC2 instance system log to identify any hardware error messages.Network connectivity issues: If there are connectivity issues between the instance and other resources such as a database, web server or Elastic Load Balancer, it can cause the instance to be unresponsive.AWS Maintenance activities: AWS regularly schedules maintenance activities that require rebooting the instances. If the maintenance event is being performed, then it could be the reason for the instance to go down.Though reboot works some times (state refesh, network issue fixes, or some new changes can be fixed with reboot), might not work always.. see this documentation for more info..https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesConnecting.htmlCommentShareThulasiram Toorpuanswered 2 months agoEXPERTMatt-Breviewed 2 months ago"