Question: Enrolling existing AWS accounts in new OU

"Hi ,I have created new AWS account and set up Control tower, a landing zone, account factory and a new OU, with the intention of enrolling a number of our existing AWS accounts into a the new OU.(these accounts had previously been enrolled in another OU in a different AWS account but they were removed from that account prior to begining this process).In my new account, the accounts are added to the relevant OU,  but when I try to enroll them in control tower by re-registering the OU I get the following error :AWS Control Tower is unable to assume the AWSControlTowerExecution role in the account. Be sure the role is present in the account, or add it.I had to log onto each account and update the AWSControlTowerExecution to allow access from the new Management account ( the role was there,but it was only allowing access to the previous management account).Once that was done, I removed the  constraints, products, users and deleted the portfolio for the landing zone provisioned product in the service catalouge.As recommened in this article : https://docs.aws.amazon.com/controltower/latest/userguide/troubleshooting.htmlI then tried to re enroll these accounts again , but I am still having issues. I got the errorAWS Control Tower can't create your account due to potential drift in your landing zone. Check your landing zone and try using the advanced account provisioning method to create your accountso I tried repairing the landing zone - this didn't work.I have also tried to remove the account and re add it to the OU & re - register the OU, but I am getting the following error :Pre-check locationOU or account IDOU or account namePre-check typeLanding Zone"xxxxx"Landing zoneAdd the IAM user to the AWS Service Catalog portfolio before registering your OU.But I don't know what IAM user to add to the service catalog profolio.I would be greatfull for any advice / guidence, thanksFollowComment"

Answer: "0Hi Jimmy_m, Thanks for your very helpful information. This worked for one of the accounts I need to enroll, so appreciate the help.However, for the second account I need to enroll, I am still having a problem. It issue is that the account I am trying to enroll has an AWSControlTowerExecution IAM Role which gives trusts a different AWS account ID (it was previously enrolled in another account & organisation).I have tried to update this role to turst the correct account ID but I keep getting told my  IAM user does not have the correct permissions. The account I am using has full Admin access, and I even added full IAM access to see if this would help. It didn't. I also got the root user to log on and try the same, but even the root user did not have permissions to update the trust policy. The error message was :USER arn:aws:iam:xx : root is not authorixed to perform:  iam:UpdateAssumeRolePolicy on resource: role AWSControlTowerExecution with explict denyDo you know how I can get around this ?Kind Regards,RoisinCommentShareAWS-User-7725948answered a year agostr3tch a year agoHi Roisin, two things - looks like you are using Root - you cannot use root user with Control Tower. The second clue is "with an explicit deny" - this means that the iam action is being blocked at the Service Control Policy (SCP) level. Speak to your platform team / admins. Hope this helpsShare0Hi, There's multiple things I'd like to check on here, and hopefully we can get this working for you.To successfully use the Service Catalog Account Factory, you will need to add the User or Role you login as (for the Organization Management account), to the Portfolio permissions. That's likely what its asking for in the "Add the IAM user" part of the error message. This will allow you to correctly enroll accounts. In future there should be no need to change/delete the Account Factory Portfolio or Product itself, just Terminate the Provisioned Product if you run into issues with an account enrollment.The repair you did may have removed this configuration and placed the Service Catalog Portfolio and Product back to the default configuration.Now for the account enrollment there's a few things to confirm for existing AWS Accounts:The account must be part of the Organization alreadyThe account has the AWSControlTowerExecution IAM Role, and it trusts the Organization management account IDDoes the Account has AWS Config already setup?. This can cause enrollment problems. You can solve this 1 of 2 ways. Delete the config recorder and delivery channels (as Control Tower will configure new ones), or use this process to enroll existing AWS Config resourcesThese prerequisites are covered HEREOnce those prereqs are covered you should be able to enroll an account. Either directly by putting the account details into the Account Factory, or by registering/re-registering the OU that contains the account.CommentShareJimmy_Manswered a year ago"


Question: MediaLive Stream Bad Performance

"Hey,yesterday i tried to setup an mp4 movie as a live-stream following these instructions: https://aws.amazon.com/blogs/media/metfc-live-stream-pre-recorded-video-using-aws-elemental-medialive/The input was a 4.4 GB mp4 file and when testing, everything worked fine and i didn't find any issues...When it came to the stream really starting with about ~400 viewers, nearly all users had problems with the stream not running constantly... always having to reload the page where the video-player was embedded (as explained in the link)...so the medialive stream input/output was constantly running and there were no errors/alerts on aws side...i really don't have any idea what could have been wrong here and want to ask what i could have missed? any special settings other than proposed in the link?Would be very thankful for any hint :)Kind regardsSimonFollowComment"

Answer: "0Hi Simon,The first thing that comes to mind is to check and confirm that the URL being passed to the player is pointing at the CloudFront distribution rather than directly to the MediaStore container. You can confirm this by noting whether the domain name ends in "mediastore.<region>.amazonaws.com" rather than ending in "cloudfront.net"Regards,SteveCommentShareSteve_Wanswered a year agosimon1389 a year agoSo the url was https://d1gsgy4dju827a.cloudfront.net/live.m3u8So think this should be okay?Share0I tested a bit around, and what i found out is, when i use the "Workflow Wizard" which is available in the AWS Elemental MediaLive Service, then the HLS Settings are different in the output group. CDN Settings are set to "HLS webdav". In the instructions i posted above there is mentioned setting this to "HLS media store". If i compare the files available in the mediastore, then with the instructions i only have some ".m3u8" files available there. When using the wizard, then i have these .m3u8 files (one for every resolution) and additionally tons of ".ts" files.Does this maybe have any impact related to my issue?CommentSharesimon1389answered a year ago"


Question: Trying to diagnose why 1 second query takes longer under server load

"We are running a RDS MySQL database on a db.t2.medium instance in eu-west-1b.  We have a EC2 t2.medium running in eu-west-1a (might or might not be relevant).We have a stored procedure, that has a fairly complex query and under minimal server load takes 1 second to execute (2 seconds to return dataset to the calling app/service).  This is fine for our purposes  in terms of the query taking 1 second.'Calling SP Single App.png' shows my test console app calling the stored procedure repeatedly.However, we've noticed that when the database server is under load in terms of number of requests,  this same query can take anywhere between 3 and 5 seconds plus to execute.'Calling SP Multi Apps.png' shows 4 copies of my test console app running and calling the stored procedure repeatedly.  You can see the different in the query times.Not only are the query times slower, but the RDS CPU is spiking 60/70%+.  'CloudWatch RDS Metrics.png' shows the CloudWatch metrics, and recently caused our RDS instance to become unstable with 100s of connections.We are trying to figure out why this query when called multiple times under high load causes the CPU to spike and the query time to increase.Do we need to consider upgrading our instance typesAre we being restricted by network bandwidthAny help greatly received.FollowComment"

Answer: "0Hi,Your CloudWatch metrics show that your CPU bottlenecking at 100%.  dbt2.medium is a very low-end Burstable 2vCPU EC2 instance with only 4 GB RAM.   Please upgrade your instance and re-benchmark. If for some reason you are still having issues, I would recommend enabling RDS "Performance Insights" to help debug/tune.-randyCommentShareRandyTakeshitaanswered 4 years ago0Could this issue be caused by lack of columns having the relevant INDEX?CommentShareneildtanswered 4 years ago0There are a few things at play here, and some suggestions which may help resolve the issue.Given the graphs shared, I am sure that this is an issue, but performance graphs showing the effects might not be the most useful in this type of issue to resolve the underlying problem.  Also keep in mind that stored procedures can be notorious for behaving in a single-threaded manner, which is not to say that is the case but rather that it is a consideration.  I would strongly urge some research into the performance effects of stored procedures as a starting point to evaluate how effective the solution is for the specific architecture.Taking the stored procedure out of the equation, I would recommend the following:Examine all of the queries of the stored proc, and run them through an explain plan to see if they are using appropriate indexes.Examine the architecture of each of the tables from specific queries involved, and are there joins that are not indexed, columns in the where clause that do not have proper indexes, what are the sizes of the tables involved, and can archiving be utilized?  In some cases, it is not the index that is the issue, rather the sheer volume of rows that need to be searched to retrieve those that fit the search criteria.Do any of the tables contain large blobs or text fields?  Those types of columns should be split out of possible allowing for a faster retrieve of the relevant rows, leaving the actual raw data for a more specific pull.Granted much of this is generic and best-practice advice, but might serve as a good starting point to determine where the general bottlenecks are located.CommentSharetbone1971answered 4 years ago0The Cloudwatch graphs already show CPU hitting a 100% CPU which could easily be the reason for the  slowdown.Performance Insights would give more details on CPU demand and how that affects the queries.Both Performance Insights and Enhanced Monitoring (EM) give Swap In & Out metrics which will further indicate if there are memory pressure issues. Performance Insights uses MySQL's Performance Schema (PFS) which uses more memory so if the system already has memory issue PFS could increase that pressure. Enabling EM doesn't uses PFS so would be a good way to first check memory before enabling PI.  There should be little to no Swap IN if the systems has sufficient memory.KyleCommentShareAWS-User-1731424answered 4 years ago0This issue has now been resolved.  It turned out that we needed to add additional indexes on two of our tables.  Thank you.CommentShareneildtanswered 4 years ago"


Question: AppStream AppBlock Does Not Download From S3 On Instance Launch

"We have an application in AppStream using an AppBlock with an Elastic Fleet. The application is an executable file hosted in a public S3 bucket (< 1 MB). When the instance launches there is no sign of the EXE having been downloaded to the usual folder (C:\AppStream<AppBlockName\MyApp.exe). This was working yesterday as of 6:30 PM EDT.We have also tried a similar approach using a VHD (approx. 100MB) instead of an executable file with the same result.Finally we have tried new App Blocks, new Applications, and new Fleets to rule out any potential issues with the existing ones and the result has been the same each time.We are wondering if there is any place where a log file is stored / available to determine why this is failing or if there is an operational issue with AppStream in the ca-central-1 region?FollowComment"

Answer: "0Accepted AnswerAfter a month and a half of back and forth with AWS support we have a solution.It seems that when an S3 bucket has a '.' in the name AppStream now silently fails to download files from S3 due to known limitations with TLS and SSL certificates. Support send us this link to a blog post where the AWS team has discussed S3 path deprecation and the limitations of the virtual host style of accessing buckets. They claimed to be working on a solution but apparently they do not have one as of yet.https://aws.amazon.com/blogs/aws/amazon-s3-path-deprecation-plan-the-rest-of-the-story/We have suggested that AWS should implement a warning in the AWS Console UI when a user creates a bucket with a '.' in the name or uses a pre-exsiting bucket with a '.' in the name with an AppBlock to help avoid any one else running into this problem in the future.TLDR; Do not use a '.' in the name of buckets you intend to use with AppBlocks with an Elastic Fleet in AppStream.CommentShareAWS-User-8359084answered a year agojesse360 7 months agoAfter wasting most of a day on this, I found your post which fixed my issue. It is really unforgivable that AWS has not either fixed the bug or documented it.Share0Hi -Can you confirm the streaming instance has access to S3 from your VPC? The easiest way to test it is to assign your app block/application to an Elastic fleet with desktop mode enabled. You can then use FireFox with a S3 presigned URL for the VHD/executable file to see if it downloads. If it doesn't download, look into your VPC configuration to ensure you have either an internet route to S3, or an S3 VPC endpoint. If it does download, you'll need an AWS support case to resolve.Does your application resource have a launch parameter that includes quotes? I ran into an issue where an invalid quote character in the launch params caused an issue - basically ” failed, while " worked.CommentShareEXPERTMuraliAtAWSanswered a year agoAWS-User-8359084 a year agoWe found this post (https://repost.aws/questions/QUovIEbdOSQMuqI1n11TW9kg/custom-appstream-2-0-elastic-application-wont-mount-vhd-and-start) and tried the presigned S3 URL already and were able to download the EXE and the VHD from S3 from inside the instance in desktop mode.We tried this application without any launch parameters at all and the result was the same.ShareMuraliAtAWS EXPERTa year agoGotcha - one other thing to validate is that the AppStream 2.0 service has the appropriate trust relationship to download the file. If you followed the directions on this page (https://docs.aws.amazon.com/appstream2/latest/developerguide/store-s3-bucket.html) to provide the service access to the S3 bucket, you'll need to submit an AWS Support ticket to look at what's going on.ShareAWS-User-8359084 a year agoOur bucket is public. We use the following policy:{"Version": "2008-10-17","Statement": [{"Sid": "AddPerm","Effect": "Allow","Principal": "","Action": "s3:GetObject","Resource": "arn:aws:s3:::<bucket_name>/"}]}As we understand it this should work right (and it was working yesterday)?ShareMuraliAtAWS EXPERTa year ago"As we understand it this should work right (and it was working yesterday)?" => Ah, I totally missed this point in your original post - sorry about that. AWS Support is going to be the best bet to dive in to understand what (if anything) changed to break it at this point.Share"


Question: no way to optimize this query?

"I am using RDS SQL-server and a query is consuming a lot of resources.Here are the details:SQL ID:030023001FBCFB6957D3DB00F3AF000001000000...(Support SQL ID: SQL ID for Amazon Web Services SupportYou need this ID only when contacting Amazon Web Services support.F4065565083F482DCEA690C6F679D0A406DE48EA)Digest ID: 82C5539F7E2B928A (Support Digest ID:Digest ID for Amazon Web Services SupportYou need this ID only when contacting Amazon Web Services support.A18B7B718FB938A4FB6F89469C6A9900C8A623BD)The query is shown like the following that seems incomplete.SELECT [Id]  ,[ApplicationId]  ,[UserId]  ,[Status]  ,[CenterId]  ,[RollNumber]  ,[Category]  ,[FirstName]  ,[LastName]  ,[EmailId]  ,[PhoneNo]  ,[F1]  ,[F2]  ,[F3]  ,[F4]  ,[F5]  ,[F6]  ,[F7]  ,[F8]  ,[F9]  ,[F10]  ,[F11]  ,[F12]  ,[F13]  ,[F14]  ,[F15]  ,[F16]  ,[F17]  ,[F18]  ,[F19]  ,[F20]  ,[F21]Any help about why this query is consuming so many resources will be appreciated.FollowComment"

Answer: "1Diagnosing the reason for high resource consumption in a query can be challenging without complete information about the database schema, the query, and the execution plan. However, I can provide some general steps that you can follow to diagnose and potentially optimize your query:Execution Plan: Analyze the query execution plan using SQL Server Management Studio or a similar tool. Look for operations with high costs or long durations, such as table scans, index scans, or expensive join operations.Missing Indexes: Check if there are any missing indexes that could improve the performance of your query. The execution plan may provide index recommendations to consider.Statistics: Make sure the statistics on your tables are up-to-date. Outdated statistics can lead the query optimizer to choose inefficient execution plans.Query Design: Review the query itself for any inefficiencies or redundancies, such as unnecessary joins or derived tables. Simplifying the query can sometimes lead to better performance.Partitioning: If your table has a large amount of data, consider partitioning the table to improve query performance. Partitioning can help optimize queries that filter on a specific range of values.Hardware and Configuration: Check the hardware and configuration settings of your RDS instance. Make sure that it has adequate resources (CPU, memory, and storage) to handle your workload. You may need to upgrade your instance type or adjust the configuration settings to improve performance.Remember that diagnosing and optimizing query performance can be an iterative process. You may need to try multiple approaches and monitor the impact of your changes to find the best solution for your specific case.CommentShareEXPERTsedat_salmananswered a month ago"


Question: Continue S3 file upload from where it crashed

"HeyI ran this command to copy a huge file to S3:aws s3 cp C:\path\to\file s3://my-bucket/ --storage-class DEEP_ARCHIVE --profile s3bucket --output text --debug --cli-connect-timeout 0It's been running OK for a while, but then eventually crashed with:2022-09-06 14:00:01,477 - ThreadPoolExecutor-0_0 - s3transfer.utils - DEBUG - Releasing acquire 0/Noneupload failed: C:\path\to\file to s3://my-bucket/file Could not connect to the endpoint URL: "https://my-bucket.s3.us-west-2.amazonaws.com/file?uploadId=SoMeBiGiDeTc&partNumber=1670"2022-09-06 14:00:01,481 - Thread-1 - awscli.customizations.s3.results - DEBUG - Shutdown request received in result processing thread, shutting down result thread.Is there a way I can resume from where it got interrupted, without starting over?--If I run:aws s3api list-multipart-uploads --bucket my-bucket --profile s3bucket --output jsonI see the multipart there that crashed, but I don't know how to make it continue from there.Thank you!FollowComment"

Answer: "1Accepted AnswerIt depends on what exception caused your process to crash.  Here's an article on setting up retries.  I have the legacy method set up and I don't crash very often at all, but my internet does go out now and then.  Let me know if this helps.  Here's the article.  I'm sure it applies to the aws cli, too.https://boto3.amazonaws.com/v1/documentation/api/latest/guide/retries.htmlCommentSharejschwar313answered 9 months agonp 9 months agoThank you very much!I added now:max_attempts = 20retry_mode = standardHopefully this will resolve that :)Share1Also, since you're using multipart uploads, you might want to create a lifecycle run to save you some money with storage of failed multipart uploads.  here's an article on that.  https://aws.amazon.com/blogs/aws-cloud-financial-management/discovering-and-deleting-incomplete-multipart-uploads-to-lower-amazon-s3-costs/CommentSharejschwar313answered 9 months agonp 9 months agoThank you. I didn't know I could create a lifecycle run for that. However, I've been running aws s3api abort-multipart-upload manually for each of the zombie multipart uploads that can be found in aws s3api list-multipart-uploads :-) Thank you very much!Share1One more thing I should add.  If you've been using multipart uploads in the past and you implement that lifecycle rule mentioned in my post, your costs per day may drop dramatically.  Mine went from $2.50 per day to $0.31 per day.  Open a case with AWS and tell them you were overcharged for incomplete multipart uploads that failed.  They will ask you how far back you were using that, so be prepared to tell them that.  You may get a refund going back that far.  Good luck.  I got a refund for $340 that way.CommentSharejschwar313answered 9 months ago0Hi ThereYou can also try a managed service like DataSync for migrating large datasets.  DataSync takes care of the tuning and retries for you.  Using the S3 CLI for large transfers can require a fair bit of system tuning. You’ll have to do some testing with the number of Amazon S3 concurrent threads, part size, possibly TCP window size, and likely parallel invocations of the S3 AWS CLI to match the throughput of AWS DataSync  Take a look at this blog post for some other transfer methods you can tryhttps://aws.amazon.com/blogs/storage/migrating-and-managing-large-datasets-on-amazon-s3/CommentShareEXPERTMatt-Banswered 9 months ago"


Question: Lost connection to EC2 instance

"Can anyone tell me how to fix this?Instance i-0c2471f7af8dd9d44 is running (and serving web pages via http on port 8080) but has stopped connecting via ssh - either through the browser console or via putty (console just says there was a problem, and putty times out before checking any credentials or anything)============ PuTTY log 2020.12.17 01:12:40 ============Event Log: Looking up host "52.89.137.160" for SSH connectionEvent Log: Connecting to 52.89.137.160 port 22Event Log: We claim version: SSH-2.0-PuTTY_Release_0.74Outgoing raw data at 2020-12-17 01:12:4000000000  53 53 48 2d 32 2e 30 2d 50 75 54 54 59 5f 52 65  SSH-2.0-PuTTY_Re00000010  6c 65 61 73 65 5f 30 2e 37 34 0d 0a              lease_0.74..Event Log: Failed to connect to 52.89.137.160: Network error: Connection timed outEvent Log: Network error: Connection timed outFollowComment"

Answer: 0I had fooloshly applied a Security Group which only allowed SSH from my own IP address --- and then my ISP changed it. Changing the security group solved the problem.CommentSharealqpranswered 2 years ago


Question: A nodejs 18 based Lambda importing from aws-sdk v3 fails to find the client-ssm package

"I have writtena a Lambda function, based on NodeJS 18, that should send an openCypher query to a Neptune DB.The Neptune DB end point is stored as a paramater in the SSM.The below Lambda code fails with this error:{  "errorType": "Error",  "errorMessage": "Cannot find package '@aws-sdk/client-ssm' imported from /var/task/index.mjs",  "trace": [    "Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@aws-sdk/client-ssm' imported from /var/task/index.mjs",    "    at new NodeError (node:internal/errors:393:5)",    "    at packageResolve (node:internal/modules/esm/resolve:865:9)",    "    at moduleResolve (node:internal/modules/esm/resolve:958:20)",    "    at moduleResolveWithNodePath (node:internal/modules/esm/resolve:909:12)",    "    at defaultResolve (node:internal/modules/esm/resolve:1173:79)",    "    at nextResolve (node:internal/modules/esm/loader:163:28)",    "    at ESMLoader.resolve (node:internal/modules/esm/loader:841:30)",    "    at ESMLoader.getModuleJob (node:internal/modules/esm/loader:424:18)",    "    at ModuleWrap.<anonymous> (node:internal/modules/esm/module_job:76:40)",    "    at link (node:internal/modules/esm/module_job:75:36)"  ]}I thought the aws-sdk v3 is already loaded for the Lambda with NodeJS 18. What am I missing?The Lambda code:import { SSMClient } from "@aws-sdk/client-ssm";import { NeptuneClient } from "@aws-sdk/client-neptune";import { GetParameterRequest } from "@aws-sdk/client-ssm/commands/GetParameterCommand";const ssm = new SSMClient({  region: "us-east-1",});const neptune = new NeptuneClient({  region: "us-east-1",});export async function getParameter(parameterName) {  const params = {    Name: parameterName,  };  const request = new GetParameterRequest(params);  const response = await ssm.send(request);  return response.Parameter.Value;}export async function handler(event) {  const NEPTUNE_ENDPOINT = await getParameter("simplify-mvp-dev-neptune-db-endpoint");  const IAM_ROLE_ARN = await getParameter("simplify-mvp-dev-iam-role-secret-arn");  const params = {    DatabaseName: "db-simplify-mvp-dev",    ResourceArn: IAM_ROLE_ARN,    SecretArn: IAM_ROLE_ARN,    Sql: `MATCH (n) RETURN n`,  };  const result = await neptune.runCypherQuery(params).promise();  return {    statusCode: 200,    body: JSON.stringify(result),  };}FollowCommentJason Butz 4 months agoYou might try deploying it with your handler file called index.js instead of index.mjs, it seems like using .mjs changes some behavior based on this page in the Lambda docsShare"

Answer: "1The client you are using only exposes Control Plane actions, such as Creating/Modifying cluster instances, and is not meant to be used to query Neptune.  For openCypher, the recommendation is to query Neptune using the HTTPS endpoint as described here.CommentShareDave-AWSanswered 4 months agomor 4 months agoThanks, @Dave-AWS. Yes, I am familiar with this documentation. It does not help me to get a Node.js 18 runtime lambda using the aws-sdk v3 to work! I even removed using SSM completely (for the time being) and just trying to make the Neptune query work - it does not.Looking at the @aws-sdk/client-neptune library (on GitHub) I could not even find a method to actually send the query command.Is there not an "internal" AWS library to openCypher query Neptune from a nodejs18 runtime Lambda? should I just send out a REST HTTP request as if I'm querying any service in the internet?Share0Hi,I cannot reproduce the issue with the SSM Client. Can you please verify that your Lambda function is indeed using a NodeJS 18 runtime?Moreover the NeptuneClient class does not have a runCypherQuery method, so your code would anyway not work.To query NeptuneDB via openCypher using Javascript you need to use the HTTPS endpoint or use a Bolt library, like https://neo4j.com/developer/javascript/#neo4j-javascript-driverCommentShareEXPERTMassimilianoAWSanswered 4 months agomor 4 months agoHi Massimilian, thank you for your reply.Yes, it is definitely Node.js 18.x Runtime. I just confirmed this in the Runtime settings below the code of the Lambda.If I understand your comment, you were able to fetch an SSM parameter using my code?As for Neptune, are you suggesting that the aws-sdk/client-neptune is not available for a Lambda to use, just like the aws-sdk/client-ssm is used?Share"


Question: Authorise IAM user for all EKS clusters in an AWS account

"We need to monitor nodes and pods in all clusters. To get this information, IAM user should be authorised using ClusterRoleBinding.As per our understanding, ClusterRoleBinding needs to be applied for every cluster in EKS separately to get access to a cluster for a specific IAM user. It also requires us to keep a watch on new cluster creation as authorisation needs to be done for new cluster as soon as it's added. This is very cumbersome.Is there any way by which an IAM user can be authorised for all EKS clusters in an AWS account in one step? Also, this user should get access to newly created clusters.FollowComment"

Answer: "1Accepted AnswerHi,The only way would be to automate the modification of the particular config file that modifies the aws-auth ConfigMap adding the particular user/role. For example if you are using CDK you can use the class AwsAuth to add roles/users at the cluster creation time. Here is an alternative with terraform.If all the clusters are created with the same user/role, you could also create a recurrent tasks that lists all the EKS clusters and checks & modifies all the cluster to be compliant with the current IAM access allow.Hope this helps!CommentSharePablo Guzmananswered 3 months ago"


Question: Error message not found when I'm trying to run custom SQL on Tableau Desktop using AWS Athena Query which runs fine on Athena.

"The error message I'm getting:Error message not found: ATHENA_CLIENT_ERROR. Can't find bundle for base name com.simba.athena.athena.jdbc42.messages, locale en_USWe have a datalake architecture which we stood up on AWS s3. When I'm trying to run queries against the tables in the Curated db, in Athena, I'm getting results. When I copy the same query and paste it in the custom SQL funtion in Tableau it gives me an error. This issue is affecting our business and needs to resolve as soon as possible.Please send me an answer if you have previously dealt with this kind of issue.Other stuff:I have * access meaning I have all access in AWS.FollowComment"

Answer: "0Such an error can be caused by various reasons, for example old JDBC driver version or incorrect JDBC connection properties.Can you try following steps and see if they help:Make sure download and use the latest "JDBC driver with AWS SDK", you can download the driver from link https://docs.aws.amazon.com/athena/latest/ug/connect-with-jdbc.htmlIf the issue persists with the newest driver, please enable JDBC driver debug logging. Please refer to https://kb.tableau.com/articles/HowTo/how-to-enable-driver-logging-for-amazon-athena-using-a-properties-fileRestart Tableau and rerun the problematic query to generate driver logs. Check the logs for any specific stacktrace error messages, which normally indicates the root cause of the issue. If you need help to further troubleshoot the driver logs, please open a support ticket from AWS console. Please avoid sharing raw logs in public posts because JDBC driver logs might contain sensitive information of your account.Besides that, I'd suggest you to check this similar thread in Tableau forum: https://community.tableau.com/s/question/0D58b00009zBZgaCAG/athenaclienterror , it mentioned another possible cause related to local proxy server (if you have one), which can be overcome by specifying NonProxyHosts=*.amazonaws.com in Tableau properties file.CommentShareEthan_Hanswered 4 months ago"


Question: AWS Reports Problem

"We request the GET_FLAT_FILE_ALL_ORDERS_DATA_BY_ORDER_DATE report with the API several times throughout the day.  Over the past three days we have experienced the report request remaining in "_SUBMITTED" mode seemingly forever and never being processed.Other reports we use throughout the day, such as GET_FLAT_FILE_OPEN_LISTINGS_DATA, are working just fine.  They go from "_SUBMITTED", to "_IN_PROGRESS" and to "_DONE".Has a changed been made or current problem with the API that could be causing this?  Is any one else experiencing this problem with the same Order report?Thanks for any help!Edit:  I am currently requesting the same report using AWS Scratchpad, and the every GetReportRequestList only shows "_SUBMITTED" for the requested report.FollowComment"

Answer: "0If my Internet search is correct, that is an Amazon retail report; this forum is specifically for Amazon Web Services Q&A; I'm sorry - this isn't the right place to find an answer to your question. My search does show it as "Amazon Marketplace Web Service" but that's not the same thing - it's an API for the Amazon Marketplace but I can understand the confusion that similar names cause.I'd suggest starting with the Amazon Marketplace Developer Support page: https://developer.amazonservices.com.au/supportCommentShareEXPERTBrettski-AWSanswered a year ago"


Question: Unable to deploy greengrass-cli to new device

"I set up a raspberry Pi as a greengrass core device following the manually provisioning process. After the core device is registered, I try to deploy greengrass-cli to the device from IoT console, but it always fail with following errors. I don't understand why it is failing to negotiate version because there is no older version.2021-06-02T21:39:17.230Z [INFO] (pool-2-thread-15) com.aws.greengrass.componentmanager.ComponentManager: negotiate-version-with-cloud-start. Negotiating version with cloud. {}2021-06-02T21:39:18.901Z [ERROR] (pool-2-thread-15) com.aws.greengrass.componentmanager.ComponentManager: Failed to negotiate version with cloud and no local version to fall back to. {componentName=aws.greengrass.Cli, versionRequirement={thing/gateway_pi64==2.1.0}}software.amazon.awssdk.services.greengrassv2.model.GreengrassV2Exception: null (Service: GreengrassV2, Status Code: 403, Request ID: f08d99d4-2b93-07ad-57ae-1eada935b967, Extended Request ID: null)at software.amazon.awssdk.core.internal.http.CombinedResponseHandler.handleErrorResponse(CombinedResponseHandler.java:123)at software.amazon.awssdk.core.internal.http.CombinedResponseHandler.handleResponse(CombinedResponseHandler.java:79)at software.amazon.awssdk.core.internal.http.CombinedResponseHandler.handle(CombinedResponseHandler.java:59)at software.amazon.awssdk.core.internal.http.CombinedResponseHandler.handle(CombinedResponseHandler.java:40)at software.amazon.awssdk.core.internal.http.pipeline.stages.HandleResponseStage.execute(HandleResponseStage.java:40)at software.amazon.awssdk.core.internal.http.pipeline.stages.HandleResponseStage.execute(HandleResponseStage.java:30)...2021-06-02T21:39:32.187Z [INFO] (pool-2-thread-13) com.aws.greengrass.deployment.DeploymentService: Current deployment finished. {DeploymentId=arn:aws:greengrass:us-west-2:308868511064:configuration:thing/gateway_pi64:5, serviceName=DeploymentService, currentState=RUNNING}Edited by: jcai on Jun 2, 2021 3:38 PMFollowComment"

Answer: "0Hi there,Since you are seeing a 403 error, this means that your IoT policy is not properly configured to allow Greengrass to deploy components. Please see https://docs.aws.amazon.com/greengrass/v2/developerguide/device-auth.html#greengrass-core-minimal-iot-policy for how to properly configure the policy.Cheers,Michael DombrowskiCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0You are absolute right. I did not specify greengrass permissions in my policy. Thank you very much!CommentSharejcaianswered 2 years ago"


Question: AWS Elemental MediaConvert - Can you force a transcoded file to have a Metadata tag for 1-13-1 color space?

"I need to be able to make H264 proxy files that have the metadata tag and color space of 1-13-1. I can see options in MediaConvert to force the color space to 709, but the metadata tag for 1-13-1 isn't there.FollowComment"

Answer: "1Accepted AnswerHello and thanks for your question on re:Post.The sRGB transfer function (IEC 61966-2-1) is very close, but not identical to Rec. 709. At this time, MediaConvert does not support a MOOV/ATOM tag in MP4 for sRGB, or 1-13-1.CommentShareAdriananswered a year agoJohn DiMaggio a year agoThanks for the answer. Does MediaConvert support that tag for any formats?Share"


Question: DynamoDB: Time frame to avoid stale read

"Hi,I am writing to dynamoDB using AWS lambda. I am using AWS Console to read data from dynamoDB. But I have seen instances of stale read with latest not records getting updated when trying to pull records under few mins.  What is a safe time interval for data pull which would ensure that latest data is available on read? Would 30 mins be a safe interval?The below is from AWS site: Just want to understand how recent is recent here."When you read data from a DynamoDB table, the response might not reflect the results of a recently completed write operation. The response might include some stale data"Regards,DbeingsFollowComment"

Answer: "130 Minutes is more than reasonable. Once you get the status code of 200 back from your Lambda function, the web console should be up to date in seconds. 5 seconds would be enough to wait in normal circumstances, as long as you have received 200 from Lambda.CommentShareEXPERTLeeroy Hannigananswered a year ago"


Question: Problem with AWS Elemental MediaLive Workflow Wizard

"I'm getting some errors when I try to do a live stream using MediaLive. In MediaLive, I have MP4 input (stored in public s3) and MediaPackage configured as the destination.  I created three end-points for MediaPackage  (HLS, DASH, and CMAF). I used MediaLive Workflow Wizard to configure/set up the workflow as shown below:When I started the workflow, I got the following alerts from  MediaLive Channel:Also when I tried to open the HLS playlist or DASH MPD, I got a 404 error.For debugging purposes, I've given full access to the IAM role that is associated with the channel.Any idea on what I'm missing?FollowComment"

Answer: "1Please check your IAM role defined for Media Live. It should have permission for media package  at least action for List*, Describe*, Create*, Delete*CommentShareAbhinavanswered 10 months ago"


Question: Regain Access to AWS Account

"Hello,We are trying to login into our AWS Account using the root credentials but we are getting the following error message:"There was an error. An AWS account with that sign-in information does not exist. Try again or create a new account."We are not sure if the email address associated with the AWS Account was changed. We're able to access the EC2 instances (via SSH) that were running in the AWS Account, so this means the account is not suspended and is still active.We followed the guidelines mentioned in the following Knowledge Center and tried to get in touch with AWS Support.https://aws.amazon.com/premiumsupport/knowledge-center/forgot-aws-sign-in-credentials/?fbclid=IwAR3fPjVcFqdm8PJa6fqcp9BeyUP1uMn2jloMyTsRTu7cSavl9nCLusEYEfsMoments later we got an email from AWS stating that they cannot provide account-specific information unless we're signed into the said AWS account. The whole point of contacting via the above link was that we no longer have access to the AWS Account.I am aware that AWS RePost is monitored by AWS Engineers. Any help on this would be greatly appreciated.Thank you.FollowComment"

Answer: "0Hello there,I'm so sorry to hear about this, it's not the experience we strive for.Based on the information you've provided, we recommend writing back on your existing case & emphasizing that you no longer have access to the account.Once you've done so, our Support team will review your response and write back with further guidance.We appreciate your effort and patience.-- Ben G.CommentShareEXPERTAWS Support - Benanswered 5 months ago0I am assuming you have no access whatsoever to the console.Do you have access to CLI. Either using Keys or from the EC2 instances that you have access to.If so you can use such an access to create/modify a user so you may be able to login into the console.Then login to the console with the above user and proceed to investigate from there.Otherwise talk to AWS Support and explain your situation.CommentShareSiddheshJanswered 5 months ago"


Question: Free Tier Service

"Dear Support Center,I hope to stop use the free tier service that belongs to me, otherwise additional fee would bother me continuously.However, I could not figure out how to terminate the service. Can you support me directly please?Sincerely, H.S.YangFollowComment"

Answer: "0Hello,I am so sorry to hear about this concern.Our Support team is more than happy to look into this for you. I recommend reaching out by creating a support case here: http://go.aws/support-center.If you prefer, you can also request a call through our Support Center by following the instruction found here:https://aws.amazon.com/premiumsupport/knowledge-center/aws-phone-support/.Best regards,— Aimee K.CommentShareEXPERTAWS Support - Aimeeanswered 7 months ago0Hello,I'm having a similar problem, and AWS is billing a service that I can't terminate (RDS + Aurora). The guides suggest:Sign in to the AWS Management Console and open the Amazon RDS console at https://console.aws.amazon.com/rds/.In the navigation pane, choose Databases, and then choose the DB instance that you want to delete.For Actions, choose Delete.To create a final DB snapshot for the DB instance, choose Create final snapshot?.If you chose to create a final snapshot, enter the Final snapshot name.To retain automated backups, choose Retain automated backups.Enter delete me in the box.Choose Delete.but I haven't an instance, nor a db. Nothing to delete here! The costs are running crazy and I cant' stop them.Support cases created, answers unsuccessfull (copy&paste?).FabrizioCommentSharerePost-User-1585177answered 7 months ago0Hello Fabrizio,I'm so sorry to hear about this, it's not the experience we strive for. I've passed these concerns along internally for further review & visibility into your case.For your privacy, we're unable to discuss account or case details via this platform.In order to have your question directly addressed, kindly reply with your concerns to your most recent email correspondence from our Support team. Also, your support case can be updated by logging in here: http://go.aws/support-center.If you have any additional questions or concerns, check out this article to see how you can request a call through our Support Center: https://aws.amazon.com/premiumsupport/knowledge-center/aws-phone-support/.We thank you for your patience as we work to resolve this.Best regards,— Aimee K.CommentShareEXPERTAWS Support - Aimeeanswered 7 months ago0Hello Aimee,I thank you for the answer.I have already solved with your wonderful support team with a support case.You've been great.Have a nice dayFabrizioCommentSharerePost-User-1585177answered 7 months ago"


Question: AWS Glue setup has error glue:GetConnection on resource: arn:aws:glue:us-west-2:876911572231:catalog because no identity-based policy allows the glue:GetConnection action .

"I am working on configuring AWS Glue service, I have tried to setup database connections. One is Oracle database running on Oracle EC2(Source database) and other database is RDS running on AWS(Target database). After creating the connections , when I am testing the connectionsoracle-xxx failed. DataCatalog Connection issue : User: arn:aws:sts::876911572231:assumed-role/Awsglue/GlueJobRunnerSession is not authorized to perform: glue:GetConnection on resource: arn:aws:glue:us-west-2:876911572231:catalog because no identity-based policy allows the glue:GetConnection action .postgres-xxxx failed. DataCatalog Connection issue : User: arn:aws:sts::876911572231:assumed-role/Awsglue/GlueJobRunnerSession is not authorized to perform: glue:GetConnection on resource: arn:aws:glue:us-west-2:876911572231:catalog because no identity-based policy allows the glue:GetConnection action .Please let me know how to fix this issueFollowComment"

Answer: "0When you test a connection, you specify an IAM role that will be used to access resources. That role needs certain permissions. In your case, it seems you're using a role called Awsglue.As the error says, that role needs a policy that allows the action glue:GetConnection on the resource arn:aws:glue:us-west-2:xxxxxxxxxxxx:catalog. You'll also need a permission for same action over those two connections if no policy includes it already.Typically with AWS Glue, you'd use a role that includes the AWSGlueServiceRole AWS managed policy as described in the Setting up IAM permissions for Glue documentation, although you might want to use self-managed policies for more granular controls.In that case, in the IAM console, click on Roles, search for Awsglue and click on that role. There you will see all the policies attached to that role. Modify one of those existing attached policies or add a new one that includes that action on the necessary resources (catalog and connections). However, you'll likely need to add more permissions to that role if you are going to use it for other purposes in AWS Glue (e.g.: ETL jobs to write to S3). Check adding identity permissions and Actions, resources, and condition keys for AWS Glue in the IAM documentation for further reference.CommentShareEXPERTTasioanswered a year ago"


Question: can not remove account from organization

"I used aws organizations remove unused account command but not able to remove the account and the error message as following"An error occurred (ConstraintViolationException) when calling the RemoveAccountFromOrganization operation: The member account must be configured with a valid payment method, such as a credit card."can anybody suggest?Remark: this account was created with wrong email so it never completed the account sign-up steps. so can not used AWS organization console to remove this account.FollowComment"

Answer: "0Hi,This sounds like the same problem as this one.. So, just regurgitating the reply from AWS support below:https://forums.aws.amazon.com/thread.jspa?threadID=308394&tstart=0The actual process as you describe, requires you to log-into the account with root credentials, complete the sign-up steps and then remove the account from the Organization. Since, the email no longer works, I would suggest you to reach out to the Accounts & Billing team via a support case to check if there is a way to change the root email address on the account. -randyCommentShareRandyTakeshitaanswered 4 years ago"


Question: FSx for Windows and Active Directory

"HI,we need to use AWS FSx with Active Directory on-prem.We have on-premises synchronization of read-only Active Directory with Active Directory in Azure.Is there any possibility to connect FSX to Active Directory on-prem without establishing a lan-to-lan vpn tunnel? Could the AWS AD Connector service solve this problem?FollowComment"

Answer: 1Hi THereAmazon FSx does not support Active Directory Connector and Simple Active Directory.  See https://docs.aws.amazon.com/fsx/latest/WindowsGuide/aws-ad-integration-fsxW.htmlYou will need some sort of connectivity to your AD because FSx needs to be joined to the domain and requires a number of ports for this to work.  Why is a vpn tunnel not an option?CommentShareEXPERTMatt-Banswered 2 months agoEXPERTRob_Hreviewed a month ago


Question: Is EFS Provisioned Throughput mode billed at daily granularity?

"According to AWS documentation,You can decrease your file system throughput in Provisioned Throughput mode as long as it’s been more than 24 hours since the last decrease. Additionally, you can change between Provisioned Throughput mode and the default Bursting Throughput mode as long as it’s been more than 24 hours since the last throughput mode change.Does it also mean that if I enable Provisioned Throughput and then, switch back to Bursting Throughput mode after 24 hrs, the charges for the Provisioned Throughput are only for that 1 day or worst case 2 days?Has anyone had experience doing this?Thank you in advance.FollowComment"

Answer: "1With EFS, throughput is billed per month, and it's based on the average throughput provisioned in excess of what your EFS Standard storage allows for the month. Your throughput is measured in "MB/s-Month," which are added up at the end of the month to generate your monthly charges.Note that AWS billing works hourly. This means that if you enable provisioned throughput only for a certain number of hours, you will be charged that pro-rated amount only for the hours / days you used it for.Take a look at more information on the EFS pricing page: https://aws.amazon.com/efs/pricing/ and in particular, check the Example 3 at the bottom of the page where you can find other pricing examples.CommentShareEXPERTNataliya_Ganswered 9 months agoEXPERTChris_Greviewed 9 months ago"


Question: How to give access via role to Fargate container from AWS BATCH jobs interface

"I have a docker image based on awslinux:latest with nodejs that I want to run in AWS Batch.The Job role configuration has Admin privilege for testing purposes.When I create a job and pass my AWS ID and AWS SECRET as env variables, everything works fine.But if I do not pass them the task just breaks, and node does not have access to AWS services. I assume that the permissions should be coming from the Job role but for some reason it doesn't work.AWS SDK node version 2.1043.0Log outputFollowComment"

Answer: "0To give access to Fargate containers from AWS Batch jobs interface, you can create an IAM Role that grants the necessary permissions to access the AWS services that your application requires, such as S3 or DynamoDB. You can then specify this role in your job definition when you submit a job to AWS Batch.To do this, follow these steps:Create an IAM role with the necessary permissions for your application to access AWS services. You can use the AWS Management Console, AWS CLI, or AWS SDKs to create the role. Make sure to grant the appropriate permissions to access the services you need, and attach the role to the ECS task execution role.Create an AWS Batch job definition that specifies the container image, environment variables, and any other configuration options for your Fargate container.In the job definition, specify the IAM role you created in step 1 using the executionRoleArn parameter. This will grant the Fargate container the necessary permissions to access AWS services.Submit a job to AWS Batch using the job definition you created in step 2. The job will run with the permissions granted by the IAM role specified in the job definition.By following these steps, you should be able to give access via role to Fargate container from AWS Batch jobs interface, without needing to pass your AWS ID and AWS SECRET as environment variables.CommentShareYasseranswered 23 days agoRavenX86 23 days ago@Yasser That was my point I gave both roles (execution and job role) even admin privillage and I till get the above error unless I pass the env. So the role maybe is not loaded properly in the docker containerShare"


Question: Cloudfront distribution returning incorrect CORS headers

"HiI have configured my CloudFront distribution (in front of AppSync) to use a custom response header policy:Access-Control-Allow-Credentials: falseAccess-Control-Allow-Headers: *Access-Control-Allow-Methods: ALLAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: *When I test by making a JS fetch (POST) request from a vue.js method from localhost however, the preflight OPTIONS response does not contain any of the headers above and so the browser prevents the cors request.What am I missing?ThanksBenFollowComment"

Answer: "2Hey, I got the same/similar issue as well.I am using CF -> HTTP API (JWT Authorizer) -> LambdaIn my Lambda I configured the CORS headers to be sent in the response. This all works fine until I try to use either the CloudFront response header or the API Gateway CORS settings. The headers set in the Lambda code are gone as expected as CF and AG would replace it. BUT the CORS headers configured by CF or AG are missing.So is there still an issue or do I miss something?CommentSharedgoerdesanswered a year ago1I was able to reproduce your problem at the time you wrote it. There was a bug in CloudFront which would have caused it not to return any CORS headers at all if your browser sent the Access-Control-Request-Headers header as part of the OPTIONS request, given the custom headers policy you are using. This bug has now been fixed, so your policy should work as expected.If you are still having problems, I recommend you open a case with AWS support.As a workaround, you could use CloudFront Functions to add the headers in response to OPTIONS requests, until the bug above is fixed. You can find an example of how to do this here: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/example-function-add-cors-header-response.htmlThis could also be done using Lambda@Edge functions, on the Origin Response trigger.CommentSharePaul_Lanswered a year agoAWS-User-9080763 a year agoWas this fix rolled out?  I'm not having any joy getting CORS to work with cloudfront+appsync Apr 2022, messing with the response policies seems to have no effect.  Does it work with the new appsync custom domains?Sharejoeplaa a year agoWe're having similar issues with CF and our API on EC2. The "override" button for CF CORS policy doesn't behave as expected. When disabled, for example, we get "access-control-allow-credentials: true" from our API. When we enable "Origin override" with Access-Control-Allow-Credentials set to true, the "access-control-allow-credentials" is NOT returned at all. This also happens with the Access-Control-Expose-Headers setting.Share1Hi Ben!Did you face the response header problem with OTIONS only or other methods also?If possible, could you please share your cache behavior configuration using this managed policies?Thanks!HaiNTCommentShareAWS-HaiNTanswered a year ago0I have also been having an issue with my response policy.I have set the policy to configure CORS headers but no CORS headers are attached to the response.I added a custom header and it attaches this header perfectly fine, every response has the custom header.Surprised this hasn't been solved, its clearly been an issue for several months now.CommentShareAWS-User-5695408answered a year ago0Hi, we still face the same problem on AWS Region EU (Frankfurt).We use a cloudfront distribution with a response header return policy.The response header return policy is configured with:Access-Control-Allow-Origin: *Examples:curl -X GET-H "Origin: http://example.com" --verbose https://<CLOUDFRONT_URL>Does return "Access-Control-Allow-Origin: *"curl -X OPTIONS -H "Origin: http://example.com" --verbose https://<CLOUDFRONT_URL>Does not return "Access-Control-Allow-Origin" Header.CommentSharerePost-User-3016983answered 7 months ago0Hello,The peflight request you are making is missing at least the Access-Control-Request-Method request header.curl -X OPTIONS -H "Origin: http://example.com" -H "Access-Control-Request-Method: POST" --verbose https://<CLOUDFRONT_URL>CommentShareEXPERTachrafanswered 6 months ago"


Question: CloudHSMv2 Force "TLS client-server mutual authentication" or disable default key on HSM

"I am assuming that when you follow the steps to use "TLS client-server mutual authentication," the default key can still be used.Is it possible to only allow "TLS client-server mutual authentication" connections to an HSM?In other words, can we disable connections where the client uses the default ssl key?Is there any difference in authorization between a session on a "TLS client-server mutual authentication" ssl connection and a session on a default key ssl connection?If not, why would someone bother to use a trust-anchor-signed ssl key if anyone can make an equally authorized session with the default key?Background:https://docs.aws.amazon.com/cloudhsm/latest/userguide/getting-started-ssl.htmlAWS CloudHSM uses an SSL certificate to establish a connection to an HSM. A default key and SSL certificate are included when you install the client. You can, however, create and use your own. Note that you will need the self–signed certificate (customerCA.crt) that you created when you initialized your cluster....To use a custom certificate and key for TLS client-server mutual authentication with Client SDK 5 on LinuxFollowComment"

Answer: 0You can only allow TLS client-server  mutual authentication and disable the default key in order to do so you will have to use the Client SDK 5 configure tool to update client-side configuration files.https://docs.aws.amazon.com/cloudhsm/latest/userguide/configure-sdk-5.html--server-client-cert-file <Client/certificate/file>Path to the client certificate used for TLS client-server mutual authentication.Only use this option if you don’t wish to use the default key and SSL/TLS certificate we include with Client SDK 5. You must set this option in combination with --server-client-key-file.Required: No--server-client-key-file <Client/key/file>Path to the client key used for TLS client-server mutual authenticationOnly use this option if you don’t wish to use the default key and SSL/TLS certificate we include with Client SDK 5. You must set this option in combination with --server-client-cert-file.Required: NoThe difference  is that mutual TLS (Transport Layer Security) authentication is an optional component of TLS that offers two-way peer authentication. Mutual TLS authentication adds a layer of security over TLS and allows your services to verify the client that's making the connection.The client in the client-server relationship also provides an X.509 certificate during the session negotiation process. The server uses this certificate to identify and authenticate the client. This process helps to verify if the certificate is issued by a trusted certificate authority (CA) and if the certificate is a valid certificate. It also uses the Subject Alternative Name (SAN) on the certificate to identify the client. https://docs.aws.amazon.com/app-mesh/latest/userguide/mutual-tls.htmlCommentShareShahnaanswered 7 months ago


Question: Cognito Authorisation Server - Is there a vulnerability when using PKCE flow?

"We're using the Cognito Authorisation Server alongside a custom frontend UI to authenticate users into our web apps. Our web apps have an SPA architecture so we're using Authorisation Code with PKCE as our OAuth flow. Our login page uses the Amplify-JS Auth module to handle the process:Amplify redirects the user to the AUTHORISATION endpoint (which includes the PKCE parameters code_challenge_method and code_challenge)User logs in via SAMLUser is redirected back to our app and Amplify submits the code (along with PKCE parameter code_verifier) to the TOKEN endpoint in order to get the JWTsIn order for this to work it's necessary to create a Cognito app client without a secret. It's my understanding that PKCE is a protocol designed to work in this very case - where the authorisation server is being accessed from an insecure channel (ie browser or app) such that a client secret couldn't be trusted.It was my assumption that in this case, it shouldn't be possible to exchange the code for a token without the PKCE parameters. However I'm finding it is possible:Construct URL from #1 above without the PKCE parameters (this is fairly straight forward since the rest of the values are hardcoded)Follow link and intercept code parameter on redirect URLSend the following to TOKEN endpoint without an Authorization headerPOST /oauth2/tokengrant_type: authorization_codecode: {INTERCEPTED_CODE}client_idredirect_uriA 200 Response is received along with the JWTs.Reading around it seems that an approach is to force public clients to use PKCE: https://www.oauth.com/oauth2-servers/pkce/authorization-request/Since the authorization server should know that a specific client ID corresponds to a public client, it can deny authorization requests for public clients that do not contain a code challenge.Seems like this would be useful in this case, but I might be missing something. Is anyone able to advise? ThanksFollowComment"

Answer: "0Hi,PKCE is recommended extension to the authorization code flow to protect applications from authorization code interception, PKCE was initially created to protect native apps (where schemas other than https are being used) but then extended and is recommended for all types of apps, it is optional to use and keep in mind there are other protection mechanisms in place like TLS (intercepting a code by person-in-the-middle isn't possible) and pre-approved redirect URLs (sending the code to non-approved urls isn't possible) among other mechanisms.If you start the authorization code flow with PKCE then it is impossible to exchange the code without providing code_verifier, if you start the flow without PKCE then no code_verifier is needed, in all cases user authentication will happen before issuing authorization code. Since your application starts the flow with PKCE then a code issued to your application will always require code_verifier at token exchange time.CommentShareEXPERTMahmoud Matoukanswered a year ago"


Question: Billed for two unused "2 parameter groups in RDS"

"Request: Delete 2 parameter groups?Are you sure you want to delete these DB parameter groupsdefault.mysql8.0default.mysql8.0Unable to delete, getting the following error:Failed to delete default.mysql8.0: Default DBParameterGroup cannot be deleted: default.mysql8.0 (Service: AmazonRDS; Status Code: 400; Error Code: InvalidDBParameterGroupState; Request ID: 4463730b-4e33-4ccf-ba4a-3ba533a9d6b2; Proxy: null).Failed to delete default.mysql8.0: Default DBClusterParameterGroup cannot be deleted: default.mysql8.0 (Service: AmazonRDS; Status Code: 400; Error Code: InvalidDBParameterGroupState; Request ID: 57478ad0-cd52-456b-9f16-9cdc678fba58; Proxy: null).I am new to AWS and have been getting billed for this but I am unable to figure this out. Any help would be greatly appriciated.FollowComment"

Answer: "1Accepted AnswerThere is no billing for parameter groups. The example you show is the default parameter groups. This is created automatically and can not be deleted.CommentShareMODERATORphilawsanswered 2 months agorePost-User-6255766 2 months agoI thought that last month when I had deleted everything (so I thought), however I continued to be billed for RDS in US East (Ohio), the only thing I can see which continues to have any values in it is;Parameter groups (1)Default (1)Custom (0/100)Option groups (1)Default (1)Share"


Question: Secrets replication from one account to another

Currently we are getting a Secret from one AWS application team ( via mail)....and we are updating that secret in our Application (On-Premises) for us it's a Password. Once this is done our Application calls will get authorized by the AWS application (based on similar password/secret).Every 90 days they send one new secret and we update it in our application(manually)....we are currently planning to deploy our application to AWS....when we do this...we want to know is there any way to sync the secret from one AWS application (who are sending us now the secret) with our AWS application.....like whenever they change secret (every 90 days) that secret should get reflect in our secrets manager without manually updating it.FollowComment

Answer: "0Hello, Once the application is migrated to AWS, it can retrieve secrets from AWS Secret Manager programmatically. Sample codes to retrieve secrets from applications using Java, Javascript, C#, Python3, Ruby and Go are available in the AWS console under the secrets you have created. Additionally , please visit this page https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets.html to get more details about retrieving secrets automatically through various applications . However, we recommend that you cache your secret values by using client-side caching. Caching secrets improves speed and reduces your costs. You can retrieve based on your rotation schedule and cache at client side and use it.CommentSharegokul_Ganswered 3 months ago"


Question: My website is very Slow an I am using $40 amazon light sail

"here it is my websitevensora.comit's worpress store - woo commerce hosted in pleskit's unbelievable slow taking up to 40s to loadmy website is optimized and I have varnishedand memcachednothing did help improve my loading speedI am running my website on $40 plan2 vCPUs8 Gb of ram160 Gb SSD5 T transfer per monthdo I need to leave the lightsail an go with another Ec2 open planif yes which one will I need for my website?for faster load speedif I go with T3.Xlargewill I get better load spee for my website?Edited by: Zack47 on Jan 7, 2019 3:48 AMFollowComment"

Answer: "0No. If it's taking 40 seconds to load on a $40 machine, then the website is not optimized. It should load within a few seconds even on a $5 machine. So unless the server is under heavy load (lots of visitors on the site, or an attack of some sort), there's probably something in your WordPress set-up that causes these slow page loads. Could be a plug-in or the theme itself.Does the Wordpress admin interface load fast enough?Since memcached and Varnish do the same thing, it seems a little odd that you would have both?CommentShareRobMManswered 4 years ago0Lightsail is low quality, low performance and low reliability.You're better to use something else (or some other provider)CommentShareAndrew K Smithanswered 4 years ago0I was thinking in going withT3.Xlargeis this the same instance like the lightsail ?and thx for your replyCommentShareZack47answered 4 years ago0Thank you for your replymy WordPress Dashboard is slow as wellan y website is well optimizedwhen I test it in gtmetrix toolI get really good scorebut the loading is very badhttps://gtmetrix.com/reports/www.vensora.com/c1Bp8P7rI was thinking in going with better instancelikeT3.xlargebut I am not sure if it going to be betterCommentShareZack47answered 4 years ago0Performance scores like GTMetrix's don't have a direct relation to speed. You could score 100% and still be slow, due to a poorly optimized back-end, for example. Are you running PHP 7+? Did you install or enable an opcode cache for PHP? What's the CPU load like on the server?If you have some experience managing Linux, you could try installing something like Xdebug or Blackfire to audit the performance of your PHP application (Wordpress, in this case) and find the culprit(s).If you suspect the server itself is the problem, maybe do some benchmarks to gauge its performance. Upgrading to a more powerful server will only help if the resources assigned to your Lightsail server are now maxing out (so it's probably best to check that first).CommentShareRobMManswered 4 years ago0Unless the webpage is under heavy load, the latency issues for vensora.com will likely not be improved much by being placed it on a larger instance type because most of the issues are in the browser. Usually WordPress themes and plugins are the culprit.There are many techniques to reduce perceived latency such as:Deferring render-blocking resources (wpsol_d767083a851bce1fb17e5b5e98f98893.css, jquery.min.js)Lazy-loading images (there are 44 separate network requests for images)Reducing synchronous script executionEnsuring resources are properly gzippedMaking more resources cacheable by adding Expires and Cache-Control headersRegards,JordanCommentShareAWSJordanRanswered 4 years ago0Hi Zack47.I visit your page https://www.vensora.com/ and it does not take more than 5 seconds to load.How did you solve the problem with lightsail?I have an instance of $ 10 USD and it takes me more than 20 seconds the first time, then with cache optimization it takes less than 4 seconds.the load of the document type file (my html) is the most delayed with more than 15 seconds.Thanks!!!CommentSharecriscafa123answered 4 years ago0I have been experiencing same problem for over a month - and will be switching over to ec2.N.B. it's the initial load that is the killer for me. Once up and running there's no problem.I've used go daddy and site runs flawlessly for years - seo has been good and actually got a sale from it.  I'd say lock that in for several years if you are a newbie and don't have backend skills to press forward with my suggestions.So digging around - Cloudformation has a vanilla script to start a wordpress single site / it will fire up a backend database on RDS / ec2 box. This thing is a nuclear cockroach in terms of termination though - just switching off ec2 box will respawn one.Anyway - this suits my needs - I configured here and added notes that maybe helpful.https://gist.github.com/8secz-johndpope/9da6c80b8e9e38fae1cecb2529144314CommentSharesnoozieanswered 4 years ago"


Question: AWS beanstalk can't update environment

"In our node js backend we had to install chromium, which cannot be installed via package.json. After some work we somehow managed to make it work on deploy with these scripts:To install chromium:sudo amazon-linux-extras install epel -ysudo yum install chromium -yTo execute the previous script we put the following file under .ebextensions:files:"/opt/elasticbeanstalk/hooks/appdeploy/pre/10_install_chromium.sh":mode: "000755"owner: rootgroup: rootcontent: |#!/usr/bin/env bash/var/app/current/install-chromium.sh"/var/app/current/install-chromium.sh":mode: "000755"owner: rootgroup: rootcontent: |#!/usr/bin/env bashsudo amazon-linux-extras install epel -ysudo yum install chromium -ycontainer_commands:01_add_execute_permission:command: "chmod +x /var/app/current/install-chromium.sh"02_run_install_script:command: "/var/app/current/install-chromium.sh"The problem we face now is that this does not work when we try to update the environment, like for instance when we try to update the environment variables, because apparently the process is differentFollowComment"


Question: Pinpoint Usage Metrics

"Is there a way to find what endpoint events Pinpoint includes to constitute "usage" when visualizing daily users?  We have pushed the data from pinpoint to Elastic and when visualizing in Kibana, there are drastic inconsistencies despite including all events or a subset.FollowComment"

Answer: "0Hello,Thank you for reaching out to us.If you are referring to the daily-active-endpoints or the daily-active-users KPIs, then we are counting them if their historicalEffectiveDate contains the date for KPI.This field will only be updated if the customer specified effectiveDate manually during update/create request.So let's say if a customer create an endpoint today without specifying the effectiveDate, the endpoint will not be counted as today's daily-active-endpoint.But if the customer update the endpoint by specifying the effectiveDate as today, it will be counted as today’s daily-active-endpoint, and if there is userId in the endpoint, it will also be counted as daily-active-users.Hope this helps.CommentShareSUPPORT ENGINEERNamratha_Kanswered a year ago"


Question: "Filter length exceeded, what can be done?"

"I am executing filter to Perzonalize, where the filterValues returns a message that the maximum length is 1000 and my filter has a length of 6664. what can I do about it so that it takes the full length of my filter?Documentation: https://docs.aws.amazon.com/personalize/latest/dg/filter-real-time.htmlError message:at 'filterValues' failed to satisfy constraint: Map value must satisfy constraint: [Member must have length less than or equal to 1000, Member must have length greater than or equal to 0]\n    at Object.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/json.js:52:27)FollowComment"

Answer: "1Hello,Unfortunately this is a hard limit and couldn't be changed at this moment.Maybe you could change your dataset in a way that filter expression will be shorter?CommentShareAleksandr_Panswered 10 months ago"


Question: Creating new FSx with HDD storagetype in CF

"Hello,We have really been looking forward to the HDD storage-type and now with it being launched we want to try this out and migrate to FSx from our legacy fileshares.However when reading the CF-documentation here:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-fsx-filesystem.htmlI can see it mentions:For Windows file systems:If StorageType=SSD, valid values are 32 GiB - 65,536 GiB (64 TiB).If StorageType=HDD, valid values are 2000 GiB - 65,536 GiB (64 TiB).however neither in "AWS::FSx::FileSystem" or in "AWS::FSx::FileSystem WindowsConfiguration" I can find where to specify that parameter to set the FSx resource to the HDD storage-type.A blocker for us to launch FSx using the HDD-option, would appreciate assistance / how and where to specify storagetype to HDD.Best Regards - TheSwede86Update 2020-04-02:Heard it was going to be fixed / added soon so I'm closing this.FollowComment"

Answer: "0Hello,You can now create HDD file systems using AWS CloudFormation. See the updated Amazon FSx CloudFormation documentation for more information: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-fsx-filesystem.htmlBest wishes,AndyCommentSharecrudge-awsanswered 3 years ago"


Question: What IAM policies need my backend application written in Java to work with Cognito ?

"Hi guys,I've a doubt about Cognito. Imagine I have a backend in Java (with Java AWS SDK) that uses the Authorization Code Grant flow. This backend need to comunicate with Cognito for exchange Authorization Code, obtains tokens, etc. But at this point I have a question/s, what kind of IAM policy my backend needs to comunicate with Cognito ?, is it needed an IAM user and a policy attached that allows my backend to interact with Cognito ?Can you give me some example or recommendation about this topic ? I think I'm a little confused.On the other hand, it's so simple as creating an IAM user with programatic access (this option appears when we are creating a new IAM user), hence my backend have access to all SDK functions and API's, CLI, etc. (Cognito included) ?, thanks in advance !Best regards.FollowComment"

Answer: "1Hi!I think you might be mixing to different concepts: the OAuth2.0 grants and the Amazon Cognito (or other AWS services) API.Cognito implements different OAuth 2.0 grants including the Authorization code grant. To use it your application must use the endpoints provided by Cognito with the credentials generated in your user pool app client. Nothing to do with AWS IAM nor its policies, actually the access to the information is controlled by standard OAuth scopes.Let me share with you a fantastic guide to understand how the credentials and tokens exchange works in the Authorization Code Grant flow.Having said this, if you want to use the Amazon Cognito API to create/manage new users, devices or apps, then you'd need a valid user with the right IAM permissions to perform the actions that you need to do. But be careful, embed user credentials in your app code is a bad practice, there are different ways to do it depending on the use case, take a look to the best practices. Probably in your case the most interesting way is using Amazon Cognito Identity Pools, which provides a temporary and limited access to other AWS services.I hope it helps.CommentSharemtindanswered 10 months ago0Ok, I think I've understood what you mean. I was a little confused, but now maybe I'm right. One the one hand we have an IAM users to allow access to our IAM user to differents AWS services. And in the other hand we have the Cognito un/authenticated users that, this is what I wanted to say. So, when you say about the topic "embed user credentials..." , I really understand you. In my case, I have a frontend web application and a Java backend application that implements the Authorization Code Grant, hence I will have a credentials file in the backend server instead having a credentials hardcoded in my Java code, is it the correct way ? Thanks in advance for your helpful reply !Best regards.CommentShareAWS-User-3108276answered 10 months agomtind 10 months agoWithout knowing exactly how you are doing it, I would say yes, create a local file with the credentials and call them from the execution of your java application. Take a look to this guide if you have further questions: https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/credentials.htmlIf you're running your app in EC2, note that you can use IAM roles attached to your instance to use temporary credentials for your app. Probably this is even better from a security point of view. Take a look at https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.htmlShare"


Question: Studio or Notebook Instance?

"I’m aware of Sagemaker Studio and notebook instance, but still confused about which to choose. Notebook instance - I find it easy but seems like it’s missing some new features. Studio on the other hand seems really complicated, full with features.FollowComment"

Answer: "1Hi User,If you are looking to build, train, debug, track, and monitor your models, it will be better to use Studio and is worth overcoming the learning curve.This document sums up the benefits of Studio Notebooks.Here is a suggested Immersion Day with labs that can help you get up to speed with SageMaker Studio. Hope it helps!CommentSharejunkaianswered 4 months ago1Hi,It also confuses me when I use them at the first glance. Generally, the amazon SageMaker studio notebook is suitable for you than the notebook instance since it is faster, easy sharing, equipped with more features as described in AWS official document.However, you may also choose the notebook instance when you want to do something quickly or locally, because studio notebooks don't support local mode. In this case, you can use a notebook instance to train a sample of your dataset locally, and then use the same code in a Studio notebook to train on the full dataset later on.Hope it helps.CommentShareTina Qiananswered 3 months ago"


Question: How do I find previous release announcements for redshift?

"I mean the stuff before 2022, that was on the old forum announcements. The stickied post says describeclusterhistory api… would that work even for a brand new cluster, or a cluster that had updates paused for a while so may have skipped a release?FollowComment"

Answer: "1Please, refer to the answer to the  question Where to find AWS Release Notes?List to other maintenance posts (they can be searched with the phrase "AWS Redshift Maintenance Announcement") below:AWS Redshift Maintenance Announcement (January 9th - March 24th 2022)AWS Redshift Maintenance Announcement (March 2nd - April 4th 2022)hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: Sagemaker notebook doesn't run on Job schedule

"Hello. I created a Notebook Job Definition, scheduled to run every hour. According to the status it is "Active". Whenever I manually trigger the job with the "Run Job" button, it creates a new Notebook Job and runs successfully. However, the notebook never runs on the schedule. It should execute every hour, but instead only executes when manually triggered.Is there anything I need to do for the notebook to obey the schedule? Thanks,FollowComment"

Answer: "1Accepted AnswerAre there any problems with IAM role settings, etc.?Please check this document for reference only.https://aws.amazon.com/jp/blogs/machine-learning/operationalize-your-amazon-sagemaker-studio-notebooks-as-scheduled-notebook-jobs/CommentShareTTTT1234answered 4 months agoejwhite 4 months agoThank you, adding those extra role permissions solved the problem!Share"


Question: "Using Boto3 to get cups.crt, cups.key and cups.trust"

"I'm writing an IoT Wireless Gateway provisioning script using Boto3 and cannot figure out how to create, download, and update cups.key and cups.trust files.I've managed to get the cups.crt file using describe_certificate() but I cannot figure out which Boto methods will get me the rest of the certs necessary to connect a gateway.FollowCommentAWS-User-9404308 4 months agoDigging a little deeper, I believe since these are only available once that I need to capture them when creating using create_keys_and_certificate(), which I have working now..However, a new question is create_keys_and_certificate() gives me:certificatePemPrivateKeyPublicKeyAnd I'm not clear on how these correspond to cups.key, cups.trust and cups.crt.Is this correct?certificatePem = cups.crtPrivateKey = cups.keyPublicKey = cups.trust?  Or is cups.trust a different certificate not offered by the create_keys_and_certificate() response?Share"

Answer: "0The cups.trust certificate is obtained by calling get_service_endpoint() - https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iotwireless.html#IoTWireless.Client.get_service_endpoint`CommentShareEXPERTMassimilianoAWSanswered 4 months ago0Hi. You can find a complete working example here: https://github.com/aws-samples/aws-iot-greengrass-component-lorawan-provisioning/blob/master/artifacts/main.py. It's a Greengrass component, but it does everything you need. In this case, the gateway self-provisions.CommentShareEXPERTGreg_Banswered 4 months ago"


Question: Setting AmazonTextractFullAccess for Root User

"Hello,I am the only one who will be using any of AWS's services, so I made an account as a root user. I am having trouble running the example code here https://docs.aws.amazon.com/textract/latest/dg/analyzing-document-text.html, and I am wondering if that's because an account permission hasn't been properly configured.  How do I give myself -- the root user -- AmazonTextractFullAccess and all the permissions I need? How do I troubleshoot this issue?In case it's not a permissions issue, below is the code I ran and the error I got in AWS CLI, with "bucketname" and "documentname" with the appropriate namesaws textract analyze-document \    --document "{\"S3Object\":{\"Bucket\":\"bucketname\",\"Name\":\" documentname\"}}" \    --feature-types "[\"TABLES\"]" \    --region us-east-1aws: error: the following arguments are required: --document, --feature-typesFollowComment"

Answer: "1Please try with the Linux Subsystem in Linux or the AWS CLI.Also the region of the bucket and the default one for your AWS CLI should be the same.I just tried the following and it worked.aws textract analyze-document --document '{"S3Object":{"Bucket":"dus-idp-textract","Name":"pdf_table_1.png"}}' --feature-types '["TABLES"]' --region eu-west-1[If you think my answer helped me, please consider accept it, thanks!]CommentShareAlexRanswered 2 months ago0The root user has all permissions, so it can not be a permissions issue: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.htmlBut your command does not seem to be interpreted correct, so run it in a Cloud9 instance or a Linux Terminal with a role attached that allows for TextractFullAccess and also access to S3 in case you use your own document in your own bucket.Also have to point out that it is not best practice to use the root user for anything but admin tasks, so better use a role attached to an instance (and secure your root account with MFA):We strongly recommend that you do not use the root user for your everyday tasks, even the administrative ones. As a best practice, safeguard your root user credentials and don't use them for everyday tasks. Root user credentials are only used to perform a few account and service management tasks.CommentShareMartin Schade _AWS_answered 2 months ago"


Question: What is the CloudFormation equivalent of the "Restricted" user?

"While in SERVICE_MANAGED mode (i.e. NOT using a custom IDP), how to specify HomeDirectoryType and HomeDirectoryMappings in CloudFormation template when creating a user? Is an equivalent of the "Restricted" checkbox exist for templates?FollowComment"

Answer: "0leshik:Thank you for submitting your request for supporting HomeDirectoryType and HomeDirectoryMappings parameter to build CloudFormation templates for your SFTP server and users. We will add it to our backlog and make an announcement in the forum once it is available. Meanwhile, would you consider the option of scripting out using API or CLI commands for the CreateUser/UpdateUser operations to get access to the same 'restricted' functionality?Thanks,SmithaCommentShareAWS-User-9826533answered 3 years ago0Thanks, smithaAWS. I create users with CloudFormation, then I apply type and mappings using aws transfer update-user command. I'm glad that you consider adding this functionality to templates, this would simplify things.CommentShareleshikanswered 3 years ago0leshik:Following up on your request, you can now use the "Restricted" feature when creating users through CloudFormation templates. Please refer to the documentation for details:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-transfer-user.html and let us know if you have any questions.Thanks,SmithaCommentShareAWS-User-9826533answered 3 years ago0I don't see any documentation in that link on how to specify the restricted user in the template.Edit: Is the use of 'LOGICAL' directory type with a mapping to the home directory the equivalent of the 'restricted' option?Edited by: jtd on Jan 28, 2021 10:18 AMCommentSharejtdanswered 2 years ago"


Question: AWS SSO with Amazon Managed Grafana not working (redirection to NULL)

"Hello here,We have enabled AWS SSO with a delegation of IdP management to Azure AD, which is working fine.We are using Amazon Managed Grafana, and use AWS SSO to assign users: working fine too.The problem is we can't use the URL application in the AWS SSO login page to reach the AMGrafana dashboard.When we click the shortcut from the SSO (when you get to pick an account or an app), we get a saml URL which redirects us to a https://null/loginWe didn't see anything that we could configure so to fix the issue, and directly lands on AMGrafana from the AWS SSO login page as intended.What did we miss?Thank you for your help.Kind regardsFollowComment"

Answer: 0Do you use any of the deployment scenarios for integration with AWS SSO as mentioned in the documentation https://docs.aws.amazon.com/grafana/latest/userguide/AMG-and-Organizations.htmlCommentShareronald_lanswered 9 months ago


Question: SSO Permission Set: Relay State

"I am trying to utilize the Relay State functionality of SSO Permission Sets to automatically redirect to the Switch Role URL of an assumed role in an external account.  I copied the URL from the target account's role that I am assuming (Console>IAM>Roles) and pasted it as-is into the Relay State field for the corresponding permission set, but am receiving an Error 400 upon successful authentication.  Is there another way we can achieve this automatic redirect to the assumed role in an external account?  Without defining a Relay State, we are able to successfully assume the target account's role so we know it is configured appropriately.The use-case for this is an organization that needs to assume roles into potentially hundreds of clients' accounts without the need for each support engineer to have to remember the clients' account numbers or role names.FollowComment"

Answer: "1The permission set relay state is for redirecting to an AWS management console URL, like https://<region>.console.aws.amazon.com/systems-manager/managed-instances?region=<region>#. The sign-in URL is a separate service endpoint, which is likely why HTTP 400 errors are occurring. Maybe, you want to consider a purpose-built redirect page with a matrix of  switch role URLs that could be integrated with AWS SSO as a cloud app. This may be more scalable in the long run as you map many roles in external accounts to many AWS SSO users.CommentShareAWS-Everettanswered a year ago0I was able to get the relay state to work with https://us-east-1.console.aws.amazon.com/iamv2/home#/roles. That URL should work if the permission set has IAM privileges.CommentShareAWS-Everettanswered a year agoJay Almers a year agoThanks for your response, but it doesn't help with what we are trying to accomplish.  This is the flow that I am looking for:1.) User logs into SSO Portal2.) User clicks Management Console for specific Permission Set3.) User is routed to the "Switch Role" interface (https://signin.aws.amazon.com/switchrole)4.) Fields are already populated with target account's ID and role name to be assumedThe "Link to switch roles in console" listed when a role is created is exactly what we need, if only it would work as a Relay State URL.Share0+1 on this feature. Seems the whole point to do after SSO login is to do Switch role. But currently everything is static and is a bocker to create deep link logins with AWS SSOCommentSharekshitij Palriaanswered a year ago"


Question: AWS SSM Automation with PatchInstanceWithRollback failing on SuSE SLES

"Is there a possibility to add additional parameters for the AWS-Automation PatchInstanceWithRollback for SuSE SLES?Why is AWS SSM using "zypper update" and not "zypper patch" to patching the System? (zypper patch is the recommende way to patch the system without braking dependencies, interative mode .....)The Problem:The document PatchInstanceWithRollback uses the "zypper update" command on SuSE SLES.Per default, SLES always asks for confirmation about the licenses.The call with the -"-non-interactive parameter" is not sufficient.Here is an extract from the log:'zypper', '--non-interactive', 'update']", CLIInvokerException('Subprocess returned error code 4 for command [b'zypper', b'--non-interactive', b'update', b...........Note: System reboot required.\nContinue? [y/n/v/...? shows all options] (y): y\nDo you agree with the terms of the license? [yes/no] (no): no\nAborting installation due to the need for license confirmation.\nPlease restart the operation in interactive mode and confirm your agreement with required licenses, or use the --auto-agree-with-licenses option.\n"During handling of the above exception, another exception occurred...:The Workaround at the moment is to set the parameter autoAgreeWithLicenses = yes in the zypper.conf but this is really bad.FollowComment"


Question: How to configure subnets for an ECS cluster so it can access a database in the same VPC?

"I have an ECS Fargate Service in  VPC, which has two private subnets. This service is accessible from the internet through a load balancer, which has public subnets in the same availability zones as the private subnets. The private subnets use a NAT gateway to route traffic to the public subnets.However, I am having issues connecting to a DocumentDB database from the service. The DocumentDB database is in the same VPC as the service.I also have a lambda which uses the exact same private subnets as the service. It can connect to the database without any issues. The service and the lambda use the same connection code.  All security groups involved have a rule that allows all inbound and outbound traffic.The private subnets are routed to a NAT gateway which points to public subnets. I believe my issue is somehow related to the subnets.Does anyone have any ideas what I can do in order to connect to the database, without losing my ability to also expose the service to the internet through the load balancer?FollowComment"

Answer: "0You do not need a NAT GW to connect your private subnets to the public subnets. Your private subnets can talk to public subnets through local VPC routing.However, you will need a NAT GW or ECR VPC Endpoints to pull images from ECR to your Fargate tasks in private VPC.Let's assume that your VPC: 10.0.0.0/16Your Public Subnet Route Table can be:10.0.0.0/16  local0.0.0.0      IGWYour Private Subnet Route Table can be:10.0.0.0/16  local0.0.0.0      NATYou'll need to make sure your NACLs are allowing the communication between Public and Private subnets.With this setup, your Loadbalancer in public subnets will be exposed to the internet through the IGW.Your Loadbalancer can talk to your ECS Fargate tasks using the local VPC routing.Here is an example for Public service in a Private network - https://containersonaws.com/architecture/public-service-private-network/Your Lambda function, DocumentDB and other components in your VPC can talk to each other through local VPC routing.CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered a year ago0Using AWS ECS and AWS Fargate as the compute platform, you must have defined the security group and subnets for said service.So you need to add an Ingress rule in your DocumentDB associated Security Group to allow the ECS Service to access that DocumentDB instance.Because they are in the same VPC, you need not to do anything routing wise.If you were interested, try out  ECS Compose-X which would deal infra etc. for you.Here is an example using which would deal with IAM/Security groups etc. for you (generates CFN templates).version: "3.8"services:  the-service:    image: my-imagex-docdb:  aNewDocumentDBCluster:    Properties:      BackupRetentionPeriod: 7      DeletionProtection: false      EngineVersion: 4.0.0      StorageEncrypted: true    MacroParameters:      DBClusterParameterGroup:        Description: Some description        Family: docdb4.0        Name: sampleParameterGroup        Parameters:          audit_logs: disabled          tls: disabled          ttl_monitor: enabled      Instances:        - DBInstanceClass: db.r5.large        - AutoMinorVersionUpgrade: true          DBInstanceClass: db.t3.medium    Services:      - name: the-service:        access: RW  anExistingCluster:    Lookup:      cluster:        Name: docdbb-purmjgtgvyqr        Tags:          - Name: my-existing-DB      secret:        Tags:          - Name: docdb-secrets-manager-secret    Services:      - name: the-service        access: RWNote that when creating a new DocDB cluster, it also creates the Password etc. and stores it into AWS Secrets Manager, and grants access to your service for retrieval of that. Also takes care of granting the ingress etc. to the services defined (and only to those).CommentShareJohnPrestonanswered a year ago"


Question: The scheduler does not appear to be running

"Hello I am trying to add my first dag but I am getting the following error:The scheduler does not appear to be running. Last heartbeat was received 3 weeks ago.The DAGs list may not update, and new tasks will not be scheduled.I am trying to verify that my dependencies were installed properly as the documentation suggests,I do it from the "Airflow Scheduler Log Group" but it doesn't show me anything in log streams to search for "requirements_install_ip", can someone help me?FollowComment"

Answer: "1We have experienced this problem multiple times in recent weeks: chasing the error to the scheduler logs we find that it is unable to write to the pgSQL metadata store (on local this would require airflow db upgrade to fix, but we are unable to do this on MWAA).psycopg2.errors.UndefinedColumn: column dag.has_import_errors does not exist[...]sqlalchemy.exc.InternalError: (psycopg2.errors.InFailedSqlTransaction) current transaction is aborted, commands ignored until end of transaction blockAll steps recommended by @Arun were taken and in our case:Dependencies/failures from individual DAGs are ruled out, as our production cluster went down but not staging, where both were identical other than environment variable mappingsUpdating the environment caused the webserver to break as well, with another error indicating a failure to communicate with internal metadata storage: sqlalchemy.exc.ProgrammingError: (psycopg2.errors.UndefinedTable) relation "session" does not existMy theory as to why this occurs is due to differences in the rate at which schedulers and webservers restore themselves, leading to conflicts in the db access.In our case, the solution was to delete the cluster and re-start it: as our infrastructure deployments are handled by Terraform this was simple, but led to ~2 hours downtime on a prod cluster. Given that this is a managed service, we are distressed that issues like this are commonplace and seem to be impossible to predict or test for.REMEMBER TO RETRIEVE YOUR ENVIRONMENT AND CONNECTION VARIABLES PRIOR TO DELETING/RESTARTING YOUR CLUSTER.CommentShareRich Manswered a year ago0Hello, There could be many reasons for this issue and in general many users were able to get around the issue by following some or all of the below mentioned steps :Firstly , as mentioned in [1] (below is an extract) you could consider checking the network settings and other dependencies.——————————If the scheduler doesn't appear to be running, or the last "heart beat" was received several hours ago, your DAGs may not appear in Apache Airflow, and new tasks will not be scheduled.We recommend the following steps:Confirm that your VPC security group allows inbound access to port 5432. This port is needed to connect to the Amazon Aurora PostgreSQL metadata database for your environment. After this rule is added, give Amazon MWAA a few minutes, and the error should disappear. To learn more, see [2].If the scheduler is not running, it might be due to a number of factors such as dependency installation failures [3] , or an overloaded scheduler [4]. Confirm that your DAGs, plugins, and requirements are working correctly by viewing the corresponding log groups in CloudWatch Logs. To learn more, see Monitoring and metrics for Amazon Managed Workflows for Apache Airflow (MWAA) [5].——————————Secondly , you could also consider refreshing the environment by following the below steps :——————————Refreshing the MWAA Environment  {Amazon MWAA console > Environments > [Environment-name] > Edit }   Note: Clicking on Edit button and Next button will update the MWAA Environment.——————————Finally, if the issue persists request you to please reach out to support engineering with the below information :——————————MWAA environment ARNLogs of MWAA Environment (DAG processing, web server, scheduler, task and worker logs)Sample dagRequirements and plugin files——————————————————Reference:[1] https://docs.aws.amazon.com/mwaa/latest/userguide/t-apache-airflow-11012.html#error-scheduler-11012[2] https://docs.aws.amazon.com/mwaa/latest/userguide/vpc-security.html[3] https://docs.aws.amazon.com/mwaa/latest/userguide/best-practices-dependencies.html[4] https://docs.aws.amazon.com/mwaa/latest/userguide/best-practices-tuning.html[5] https://docs.aws.amazon.com/mwaa/latest/userguide/cw-metrics.html================ Have a nice day!CommentShareSUPPORT ENGINEERArunanswered a year ago"


Question: Quicksight Dashboard access question

I have a dashboard and I do not want to have any access restrictions for Amazon employees. Is it possible? any ANT group that provides access to all Amazon employees?FollowCommentiwasa EXPERTa year agoHi.Please tell us a few things about your question.Want Amazon employees to have unlimited access to your QuickSight dashboard?Who can't access your dashboard?What does "ANT group" mean?Share

Answer: "0This is a public customer forum, maybe not the best place for this question ;)CommentShareAWS-ADolganovanswered a year ago"