Question: Network interface getting not deleted

Hello i am unable delete my Network interface and Its VPCNetwork interface ID: eni-009369c17b1c7e931subnet-05352f1d8184c33advpc-046de896f2b74b933Please someone help me to delete itFollowComment

Answer: "0Best thing you can do is see what it is attached to.On the ec2 console, in the left menu go to "Network & Security" "Network Interfaces" and look up the interface in question.You can scroll a bit to the right to see the Description.This will give you an indication by what it was/is used.If it says it was for a Lambda you might have to wait up to 40 minutes.If it is another resources still active in your account: well you found the reason it can't be deleted.Merry Xmas.JaccoCommentShareJaccoPKanswered a year ago0When tracking down such issues in the past I have leveraged below.If you have AWS Config enabled you could search for the ENI resource to determine what is associated with the ENI.AWS Support Tools contains a simple bash script (findEniAssociations) that when given an ENI identifier and an AWS region will find if there are any Lambda functions currently using the specified ENI.CommentShareRoBanswered a year ago"


Question: EFS Burst Credit

"Since a few days we observe a strange behavior regarding the burst credits on one of our EFS Systems. The credits are going down:and the percent IO Limit does corresponde to this behavior:But checking the write, read and total IO bytes, there are no significant changes:I am also not aware of any changes on the 3 EC2 systems accessing the EFS causing this issue.Do I read these metrics wrong. Any hint to find out and understand what is causing the burst credit usage is very appreciate.Thanks in advanced.AndiFollowComment"


Question: On-premise datacentre accessing the internet via Direct Connect

"Customer who has a datacentre with no access to internet but is connected to AWS via direct connect. Is it possible to use AWS managed network services to reach the internet? The customer would prefer to consume services provided and managed by AWS instead of looking for third party NAT devices/systems.If this is possible, is it cost effective / best practice?FollowComment"

Answer: 0Accepted AnswerFrom a pure routing perspective. Another possible option is to use TransitGateway and EgressVPC attached with the Transit Gateway. Advertise  prefix 0.0.0.0/0  from TGW side to on-premises. The on-premises router then sends default traffic to TGW. TGW then sends this traffic out to the Internet via Egress VPC. This can be done by adding a static route 0.0.0.0/0 with a target to EgressVPC attachment. Egress VPC can have a NAT Gateway or other third party filtering device to NAT outgoing traffic.CommentSharemehrajkanswered 4 years ago


Question: "Why can't I create another instance, I get a limit of 0"

"Why can't I create another instance, I get a limit of 0FollowComment"

Answer: "1Hello @SwearinginYou can request a quota increasehttps://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.htmlAmazon Lightsail endpoints and quotas limitIf the Answer is helpful, please click  Accept Answer & UPVOTE, this can be beneficial to other community members.CommentSharelearn2skillsanswered 3 months ago1One possible reason is that you have reached the maximum limit of instances allowed under your account or subscription. In this case, you may need to request an increase in your instance limit from your cloud service provider.Another reason could be that your account or subscription has been suspended or terminated, which prevents you from creating new instances.CommentShareTasadduq Burneyanswered 3 months ago"


Question: Error when trying to register a windows on premise SSM agent (and missing error details)

"I'm new to SSM, and just wanted to set up a test agent on a windows VM. I followed the hybrid environment tutorial.It resulted in the fowwlowing error, when running the agent installation script (in the $env:ProgramData\Amazon\SSM\Logs\erros.log file):ERROR [processRegistration @ agent_parser.go.177] Registration failed due to error registering the instance with AWS SSM. InvalidActivation: As you can see, the details about the InvalidActivation are missing... What can I do to track the error ?FollowCommentSiTheAWSGuy a year agoHave you tried it on an EC2 to make sure the dependencies are all set up?Share"

Answer: "0HelloPlease check the Activation Code, as the Error says the Code. is invalid. $code = "activation-code", How to create activation Code.Here is the link to find the Activation https://eu-west-1.console.aws.amazon.com/systems-manager/activations/ Check for Activation ID and **Activation ID ** use in the CLI while running the command.$code = "activation-code"$id = "activation-id"$region = "region"$dir = $env:TEMP + "\ssm"New-Item -ItemType directory -Path $dir -Forcecd $dir(New-Object System.Net.WebClient).DownloadFile("https://amazon-ssm-$region.s3.$region.amazonaws.com/latest/windows_amd64/AmazonSSMAgentSetup.exe", $dir + "\AmazonSSMAgentSetup.exe")Start-Process .\AmazonSSMAgentSetup.exe -ArgumentList @("/q", "/log", "install.log", "CODE=$code", "ID=$id", "REGION=$region") -WaitGet-Content ($env:ProgramData + "\Amazon\SSM\InstanceData\registration")Get-Service -Name "AmazonSSMAgent"CommentShareGKanswered a year ago0We just had this error occur as well, but on a LInux external instance.  Generating a new activation code and id worked fine.I'm curious that the activation code that failed started with a / and also contained a +, the successful activation code was only [a-z,A-Z,0-9]CommentShareAWS-User-5057910answered a year ago"


Question: Not able to register Domain

"I need to register my domain, But every time i tried I got"We can't finish registering your domain"Please guide us I recently subscribe free tier for hands on purposes.FollowComment"

Answer: "0Hi.Route 53 cannot use free tiers or promotional credits.So, Your account must have a pre-registered credit card for payment.Please also refer to the following articles:https://www.kreyysyy.net/2020/04/20/510/ (Sorry, Japanese Article)CommentShareEXPERTiwasaanswered 5 months ago0Credit card is present and verified in "Payment preferences" > "Payment methods" but it still failed to register any domain in Route 53.Maybe there is something else to check?CommentSharerePost-User-5318858answered 4 months ago0Did you figure this out?  I'm having the same issue.  Valid credit card, available domain name, but Route 53 can't finish registering it.CommentShareBlinknoneanswered 3 months ago"


Question: Simple Email SMTP Query

"I am new to AWS and have signed up for the AWS Simple Email Service. In the admin section of my website, there is a feature from where I can send bulk emails to my website members. However, I first need to enter the following: SMTP Username and Pwd,  SMTP Port, SMTP host,  Email Queue (put emails in queue or send emails immediately), Use SSL or TLS?, Mail count.I did see an SMTP username by default but since I was not sure, I went ahead and created a new SMTP in my AWS account and have got the username and password.  I request you to let me know what I should fill for SMTP Port, SMTP Host, SSL or TLS. In my admin panel there are two fields asking Email Queue or not and mail count. What should I fill in these. Should one choose Queue while sending bulk emails?Last, most of my members have Gmail and yahoo mail ids so will the emails sent using AWS SMTP will reach their inboxes? Anything I should to avoid my emails landing in the recipient's spam folder.ThanksFollowComment"

Answer: "01.- If almost in its entirety you should use all the parameters and SSL (I would recommend it).2.- Yes, you have to fill in all the SMPT, host port and SSL data (AWS provides you with this information in the console). There are no queues for mass submissions, the API supports a large number of calls. What if AWS manages two types of sandbox and production, sandbox is like a test environment that allows you to send emails not so massively, instead production yes.https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html3.- It would be good if you activate the SES suppression list.I'll tell you quickly, after sending an email you could find that it bounces or that they place it as SPAM.By having these results, the use of the SES service and your entire account may be affected because when sending emails you will have a reputation and when you pass 5%, they can delete your entire AWS account.So, when you use the SES service, in the configuration you can also choose the "configuration set" that are a configuration when sending the emails, that configuration you can indicate if you want the logs (all the states that your email goes through whether it is sent, received, opened, bounced, spam, etc) to register with cloudwatch.You could also configure the suppression list, you have the option of rebounding and/or spam.This means that when you send an email, and this email falls into one of these states, AWS SES automatically registers that email in a suppression list, which in the next sending, you will send the email but AWS SES will not resend it to the destination mail servers (so as not to increase a bad reputation).CommentShareJose Carlos Carrasco Vergaraanswered 5 months ago"


Question: SMIL supported subtitle formats ?

"Hello For MEDIAPACKAGE-VOD, It seems that only the SRT subtitle format is supported as an input.I tried using a DFXP and the outputted HLS package did not have any subtitles.<?xml version="1.0" encoding="utf-8"?><!-- Chairytale video DV + SUBTITLE EN --><smil>  <body>    <switch>      <video name="DV_a_chairy_tale_(NFB_-_HD_720_-_WEB_(H264_2500)).mp4" systemLanguage="eng" audioName="English"/>      <video name="DV_a_chairy_tale_(NFB_-_SD_Large_-_WEB_MBL_(H264_1500)).mp4" systemLanguage="eng " audioName="English"/>      <video name="DV_a_chairy_tale_(NFB_-_SD_Small_-_WEB_MBL_(H264_900)).mp4" systemLanguage="eng" audioName="English"/>      <video name="DV_a_chairy_tale_(NFB_-_Basic_Small_-_WEB_MBL_(H264_400)).mp4" systemLanguage="eng" audioName="English"/>      <textstream src="a_chairy_tale.dfxp" systemLanguage="eng" subtitleName="English"/>    </switch>  </body></smil>```does MEDIAPACKAGE-VOD supports any other input subtitles format ?  WEBVTT, TTML ?    JoelFollowComment"

Answer: "0Hello Joel,Thank you for your question. VOD ingest of a MP4 stream referenced by a .smil file supports only SRT captions on the input. If your VOD asset is of HLS input type, then MediaPackage supports WebVTT subtitles. A list of supported codecs and input types for VOD is detailed here: https://docs.aws.amazon.com/mediapackage/latest/ug/supported-inputs-vod.htmlLet me know if this answers your question.CommentSharesamarthp-awsanswered 3 years ago0hello, it seems that WEBVTT is also supported.I tried a mediapackage-vod with WEBVTT and the outputted HLS package and CMAF contained the subtitle.Is it a feature that is fully supported but not already documented ?what about other format of subtitle like DFXP ?JoelCommentShareJoelBanswered 3 years ago0Hello Joel,Can you please let me know your input type for VOD on MediaPackage: SMIL/MP4 or HLS?If the input type is SMIL/MP4, then SRT captions is the only format supported. If input type is HLS, then MediaPackage supports WebVTT subtitles.If you could private message me the Output URL for your VOD asset, then I can take a look and provide you with more info regarding your asset.CommentSharesamarthp-awsanswered 3 years ago0My input are SMIL/MP4. and I test with SRT and VTT.with SRT no uses the output contains subtitles.but I mainly DPFX, TTXT and VTT files.so I tried a SMIL/MP4/VTT<?xml version="1.0" encoding="utf-8"?><!-- Chairytale video DV + SUBTITLE EN --><smil> <body>   <switch>     <video name="DV_a_chairy_tale_(NFB_-_HD_720_-_WEB_(H264_2500)).mp4" systemLanguage="eng" audioName="English"/>     <video name="DV_a_chairy_tale_(NFB_-_SD_Large_-_WEB_MBL_(H264_1500)).mp4" systemLanguage="eng " audioName="English"/>     <video name="DV_a_chairy_tale_(NFB_-_SD_Small_-_WEB_MBL_(H264_900)).mp4" systemLanguage="eng" audioName="English"/>     <video name="DV_a_chairy_tale_(NFB_-_Basic_Small_-_WEB_MBL_(H264_400)).mp4" systemLanguage="eng" audioName="English"/>     <textstream src="il-etait-une-chaise_1_2awllltk.vtt" systemLanguage="eng" subtitleName="English"/>   </switch> </body></smil>and I got the asset output  8cf80b39fb5d440faca4f2cd3cc7c82aand the urls are :HLS : https://cfc913ced160cab55584381804aa97a7.egress.mediapackage-vod.us-east-1.amazonaws.com/out/v1/8cf80b39fb5d440faca4f2cd3cc7c82a/935a5211904b48ddb29afc54fac84d27/cb873c12b15447ec9dca932f5f22cd34/index.m3u8CMAF : https://cfc913ced160cab55584381804aa97a7.egress.mediapackage-vod.us-east-1.amazonaws.com/out/v1/8cf80b39fb5d440faca4f2cd3cc7c82a/8de420355ab448978a2052bd4123f9e2/8070dc92e3794453b2a4ee413ad7a39e/index.m3u8please let me know what you found.CommentShareJoelBanswered 3 years ago0Hello Joel,Like I mentioned in my first comment, SRT is the only caption format supported on the input when the input is of type SMIL/MP4.https://docs.aws.amazon.com/mediapackage/latest/ug/supported-inputs-vod.html#suported-inputs-codecs-vodCommentSharesamarthp-awsanswered 3 years ago0Ok, is there any plans/roadmap to support newer subtitle format ?just wondering how the service would evolve.JoelCommentShareJoelBanswered 3 years ago0Joel,As a general rule, we don't comment on the future direction of the service. I would recommend you visit the "What's New with AWS" page periodically for details on new features being added into the service.CommentSharesamarthp-awsanswered 3 years ago0ok, I will check https://aws.amazon.com/about-aws/whats-new/media-services/best regards.JoelCommentShareJoelBanswered 3 years ago"


Question: RDS mysql replication

When we create a replica for the mysql database does it use the root user to carry out replication operations?FollowComment

Answer: "0The following document shows the operation as root user, so operate as root userhttps://docs.aws.amazon.com/ja_jp/AmazonRDS/latest/UserGuide/mysql-stored-proc-replicating.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months ago0Managed replication with RDS uses a dedicated administrative user that is created solely for running the replication thread. It is not the 'root' user.CommentShareMODERATORphilawsanswered 2 months ago"


Question: Storage/DB solution for fast loading 3GB into memory?

"A customer uses MSSQL for storing customer data. Once a day they load a single table into a memory-based cache solution they developed, and they want to improve that process' speed.The data is indexed by "tenantID" and each time they select a single tenant from the table. One tenant's data is at least 3GB and ~10M rows. This process takes ~10 minutes and they're looking for a solution to decrease that time to < 5 minutes.They're open to suggestions and re-architecture, under the constraint that the loading process happens once a day and is as fast as required. For example - change the way they write the data to this table, or changing their technology stack.FollowComment"

Answer: "0Accepted AnswerIf natively implemented in DynamoDB with 'tenantID' as the low-cardinality key, a segmented scan will still result in one segment having to deal with the 3 GB partition key.  It would most likely run faster than their current solution since DDB can sustain 24 MB/sec egress using single-threaded eventually consistent scan operation.If the customer is able use a higher cardinality primary key (say, a GUID), then a Global Secondary Index could be used to achieve the grouping and indexing by 'tenantID'.  This would allow a nearly unbounded scan rate on the base table through the use of a segmented scan.CommentShareRichard Kroganswered 3 years ago"


Question: Error while running the IoT Demo tutorial on Raspberry Pi4

"I am going through the AWS IoT tutorial for Building Demos, using Raspberry Pi. I was able to successfully carry out steps till https://docs.aws.amazon.com/iot/latest/developerguide/iot-dc-install-configure.html whereas when I run the following commands from the turorial:cd ~/aws-iot-device-client/build./aws-iot-device-client --config-file ~/dc-configs/dc-testconn-config.jsonI get the following error:2022-05-18T06:21:41.735Z [DEBUG] {Config.cpp}: Did not find a runtime configuration file, assuming Fleet Provisioning has not run for this device2022-05-18T06:21:41.735Z [DEBUG] {EnvUtils.cpp}: Updated PATH environment variable to: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games:/home/pi/.local/bin:/home/pi/.aws-iot-device-client:/home/pi/.aws-iot-device-client/jobs:/home/pi/aws-iot-device-client/build:/home/pi/aws-iot-device-client/build/jobs2022-05-18T06:21:41.736Z [INFO]  {Main.cpp}: Now running AWS IoT Device Client version v1.6.7-532a7102022-05-18T06:21:41.749Z [ERROR] {FileUtils.cpp}: Failed to create directory /var/log/aws-iot-device-client/2022-05-18T06:21:41.749Z [ERROR] {Main.cpp}: *** AWS IOT DEVICE CLIENT FATAL ERROR: Failed to initialize AWS CRT SDK.AWS IoT Device Client must abort execution, reason: Failed to initialize AWS CRT SDKPlease check the AWS IoT Device Client logs for more informationFollowComment"

Answer: "1Accepted AnswerHi. It's a permission issue. Assuming you are running Device Client as user pi, it doesn't have permissions to create the /var/log/aws-iot-device-client directory. (If you accepted the default configuration, that's where the log file will go.)I have Device Client running on an RPi4. I can't remember if I took a few steps not documented in that tutorial. However, if you run the following commands, I think you will be able to progress (assuming you are user pi):sudo mkdir /var/log/aws-iot-device-clientsudo chmod 745 /var/log/aws-iot-device-clientsudo chown pi:pi /var/log/aws-iot-device-clientThat will create the directory and make pi the owner. The 745 is as documented here: https://github.com/awslabs/aws-iot-device-client/blob/main/docs/PERMISSIONS.mdThen Device Client will be able to write logs there if you run Device Client as user pi.CommentShareEXPERTGreg_Banswered a year agoAWS-User-8126574 a year agoHi Greg, Thanks for your answer, it worked!Share"


Question: RDP Client copy not like original after ami copy of instance

"I made an Instance on aws to run a t2 micro .exe program with js.nodes on mongoDB pointing to the region on aws and RDP client runs the processes accordingly with api inside .env file etc. = works greatWanted to make many of these, so:Instance duplicated by ami=workedT2 micro RDP client = not exact copy by way of running processes are not exact like the original instance/RDP ..... why?Had to go into SSM Agent and to get it to stay running went into powerShell and put in  2 lines of code to add-routes= workedHowever 4 other processes are not EXACT like the original Instance running the original RDP client.  (They do not stay in the running state after starting them.  They become stopped after a few minutes.(The original RDP version does not do this)Why is the copy sooooo much different to the point where the actual .exe program in the t2 micro is not even running in the copy version?  Is there a way to make an exact copy of the RDP the same way it works with the original instance works with the original RDP?Your thoughts?Thank you.FollowComment"

Answer: "0When working with Windows you will find that there is a SID  on a machine that are set after initialization.   Each machine needs to have a unique SID or it will behave as you observed.This Knowledge Center Article explains how to use SysPrep to get a reusable AMI.CommentShareRobert Loveanswered a month agorePost-User-8145933 a month agoThanks for your reply.  I followed the instructions.  When trying to use the password made by the .pem it no longer works with the original instance RDP.  I am now locked out of my original RDP.SharerePost-User-8145933 a month agoAlso, the new RDP is nothing like the orginal after the SysPrep.  Has empty files throughout.  Were there any check boxes left unchecked?  The first box was unchecked.  The password was at random.  Seemed straight forward, but the copy is nothing like the original which I can no longer even access to even try this again.SharerePost-User-8145933 a month agoWhy is my original instance, that was working just fine prior to this now say that there is an "internal server error" and is no longer working and cannot access anymore.  Whole business just got shutdown.ShareRobert Love a month agoIf you have up a second server with the same Sid your original can also go downShare"


Question: AWS Connect + AWS Lex Send Multiple Messages

We are using AWSLex with AWS Connect. Our Api creates interactive messages (https://docs.aws.amazon.com/connect/latest/adminguide/interactive-messages.html) and sends it to the chat. Is there any way to send multiple messages via api? Sometimes we want to display some explanation and in next message we want to ask question with options. Is there anyway to do this?Thank youFollowComment

Answer: "0You can do this using message groups:https://docs.aws.amazon.com/lexv2/latest/dg/API_ResponseSpecification.htmlYou can have multiple groups of messages (up to 2 variations per group), and Lex will return one message per group.CommentShareMathildaAWSanswered a year ago0Hello, Actually that is not what I am asking for. I want to send 2 messages together,For exampleMessage 1: "Congratulations your appointment is created!"Message 2: "Your appointment details are...."I want to send these both to the client in this order.PS: I am using Lexv1.Thank youCommentSharebbolekanswered a year ago0In Lex v2 JSON for Messages is a list, not a key pair as it was in v1. So, if you want to send multiple messages, try Lex v2 and enter into messages list as many messages as you need.{"sessionState": {"dialogAction": {"type": "Close"},"intent": {"name": "Hello","state": "Fulfilled"}},"messages": [{"contentType": "PlainText","content": "Hi"},{"contentType": "PlainText","content": "How are you?"},{"contentType": "PlainText","content": "How may I help?"}]}CommentShareAlex Soulanswered a year ago"


Question: New clusters have "BootstrapBrokerStringTls"

"I'm trying to create MSK clusters, and since yesterday somewhen early afternoon in CEST a newly created cluster no longer has a "BootstrapBrokerString", but rather aws kafka get-bootstrap-brokers returns a response with only "BootstrapBrokerStringTls".This is clearly an unexpected API change, in a GA product. I would have expected that any move towards TLS-support (yeah! great! awesome!) would be announced, and would not affect existing documented things.Switching to TLS will be quite some work, so right now I rather would not want to do that. How can I get back to the previous behavior?EDIT: I'm also looking at the AWS console now. The cluste says "TLS client authentication" is "Disabled", and enryption in transit between clients and brokers is "Only TLS encrypted traffic allowed". So I guess that makes sense that the client information only returns "TLS" entries.I looked at bit further, and it seems that the API behavior indeed changed, and the TLS options appeared. The default is said to be "TLS/Plaintext" at https://aws.amazon.com/msk/faqs/ (which probably would still produce a BootstrapBrokerStringTls), the actual default I saw looks like "TLS" though.I'm now trying to adapt at least my creation scripts to explicitly configure ClientBroker encryption as 'PLAINTEXT', and then will have to work out how to move towards a "both" situation.Edited by: ankon on Jun 21, 2019 11:48 AM: Added information for console output, and my next steps.Edited by: ankon on Jun 21, 2019 12:11 PM: Updated with more information from documentation where I could find references to the change.FollowComment"

Answer: "0Hi.  We launched TLS support at GA and we are currently moving to a default setting of TLS for our APIs.  We will be updating our documentation and making an announcement in the Forums to communicate this change.  You can change the default setting and disable TLS at the time of creation by selecting TLS_PLAINTEXT, or PLAINTEXT for the ClientBroker parameter.  We expect this default behavior to be rolled out to all regions by 6/25.  We will also make it possible to update existing clusters encryption settings at a future date. Learn More: https://docs.aws.amazon.com/msk/latest/developerguide/msk-encryption.htmlCommentShareAWS-User-6643836answered 4 years ago0Thank you for replying!We launched TLS support at GA and we are currently moving to a default setting of TLS for our APIs. We will be updating our documentation and making an announcement in the Forums to communicate this change.Right. It's this change in defaults that tripped me quite hard, as it essentially broke the glue scripts we prepare for a disaster recovery scenario and for automating our deployments.I've now updated my awscli package, and modified the scripts to set the EncryptionInfo fields to disable TLS for now.Are you already aware of any other changes in defaults that are going to happen and that I should prepare for?CommentShareankonanswered 4 years ago0Glad you were able to get it working.  There are no other planned default changes to the API.CommentShareAWS-User-6643836answered 4 years ago"


Question: Website building

Looking for a website builder. Does AWS have a portal or community for assistance with converting a square space account to AWS on WordPress?FollowComment

Answer: "0There's no direct way of linking Squarespace or WordPress accounts with AWS. You have to set up a new account and then migrate your workloads to AWS and the best service for WordPress would be AWS Lightsail. Has an easier way of setting up WordPress for startersCommentShareKipanswered 8 months agorePost-User-5164022 8 months agoThanks, I started running down the alias route but noted Id run into connectivity issues later. Do we know the right place to tap someone who can build a better website beyond a random google search? Does AWS offer in-house? ThanksShareRodney Lester 8 months agoAmazon Honeycode might be an option too: https://docs.aws.amazon.com/honeycode/latest/UserGuide/what-is.htmlShare"


Question: RDS for MySQL Multi Master replication error 1236 from master when reading data from binary log

"Hi,Thank's for your tutorial.I working under configuring multi master GTID based replication between Non-RDS and RDS MySQL instances.The idea is configure Non-RDS Master as replica for RDS MySQL Master, and vice versaNon-RDS MySQL version - 5.7.29RDS MySQL version - 5.7.37Non-RDS Master is my local MySQL instance with ID - 5ea52da6-e25c-11ec-ac07-0aa67b862ee7RDS Master is AWS RDS for MySQL instance with ID - a82ebef1-e265-11ec-964b-0af5faa008d7I added to Non-DRS cnf and RDS database parameter group below values:sync_binlog = 0gtid-mode=ONenforce-gtid-consistencylog-slave-updatesexpire_logs_days = 10on RDS I used call mysql.rds_set_configuration('binlog retention hours',168) to set binlog retention periodReplication from Non-RDS Master to RDS Master is operating normally.But, after starting replication from RDS Master to Non-RDS Master, I receive an error 1236 on Non-RDS instance -Got fatal error 1236 from master when reading data from binary log: 'The slave is connecting using CHANGE MASTER TO MASTER_AUTO_POSITION = 1, but the master has purged binary logs containing GTIDs that the replica requires------------- This is my Non-RDS Master -------------mysql> show global variables like 'gtid_executed'\G*************************** 1. row ***************************Variable_name: gtid_executedValue: 5ea52da6-e25c-11ec-ac07-0aa67b862ee7:1-61 row in set (0.01 sec)mysql>mysql>mysql> show global variables like 'gtid_purged'\G*************************** 1. row ***************************Variable_name: gtid_purgedValue: 5ea52da6-e25c-11ec-ac07-0aa67b862ee7:1-41 row in set (0.00 sec)mysql>mysql>mysql> show master status\G*************************** 1. row ***************************File: mysql-bin.000004Position: 194Binlog_Do_DB:Binlog_Ignore_DB:Executed_Gtid_Set: 5ea52da6-e25c-11ec-ac07-0aa67b862ee7:1-61 row in set (0.00 sec)mysql> show replica status\G*************************** 1. row ***************************Master_Host: 172.31.45.85Master_User: replMaster_Port: 3306Connect_Retry: 60Master_Log_File:Read_Master_Log_Pos: 4Relay_Log_File: relay.000001Relay_Log_Pos: 4Relay_Master_Log_File:Slave_IO_Running: NoSlave_SQL_Running: NoReplicate_Do_DB:Replicate_Ignore_DB: mysql,information_schema,performance_schemaReplicate_Do_Table:Replicate_Ignore_Table:Replicate_Wild_Do_Table:Replicate_Wild_Ignore_Table: noreplicate.%,mysql.rds_%....Seconds_Behind_Master: NULLMaster_SSL_Verify_Server_Cert: NoLast_IO_Errno: 1236Last_IO_Error: Got fatal error 1236 from master when reading data from binary log: 'The slave is connecting using CHANGE MASTER TO MASTER_AUTO_POSITION = 1, but the master has purged binary logs containing GTIDs that the slave requires. Replicate the missing transactions from elsewhere, or provision a new slave from backup. Consider increasing the master's binary log expiration period. The GTID set sent by the slave is '5ea52da6-e25c-11ec-ac07-0aa67b862ee7:1-5', and the missing transactions are 'a82ebef1-e265-11ec-964b-0af5faa008d7:1-44'.'Last_SQL_Errno: 0Last_SQL_Error:Replicate_Ignore_Server_Ids:Master_Server_Id: 219284118Master_UUID: a82ebef1-e265-11ec-964b-0af5faa008d7Master_Info_File: /var/lib/mysql/master.infoSQL_Delay: 0SQL_Remaining_Delay: NULL...Master_Retry_Count: 86400Master_Bind:Last_IO_Error_Timestamp: 220602 12:37:06Last_SQL_Error_Timestamp:Master_SSL_Crl:Master_SSL_Crlpath:Retrieved_Gtid_Set:Executed_Gtid_Set: 5ea52da6-e25c-11ec-ac07-0aa67b862ee7:1-5Auto_Position: 1Replicate_Rewrite_DB:Channel_Name:Master_TLS_Version:1 row in set (0.00 sec)------------- This is my RDS Master -------------mysql> show global variables like 'gtid_executed'\G*************************** 1. row ***************************Variable_name: gtid_executedValue: 5ea52da6-e25c-11ec-ac07-0aa67b862ee7:1-6, a82ebef1-e265-11ec-964b-0af5faa008d7:1-521 row in set (0.00 sec)mysql>mysql> show global variables like 'gtid_purged'\G*************************** 1. row ***************************Variable_name: gtid_purgedValue: 5ea52da6-e25c-11ec-ac07-0aa67b862ee7:1-6, a82ebef1-e265-11ec-964b-0af5faa008d7:1-501 row in set (0.00 sec)mysql>mysql> show master status\G*************************** 1. row ***************************File: mysql-bin-changelog.000025Position: 234Binlog_Do_DB:Binlog_Ignore_DB:Executed_Gtid_Set: 5ea52da6-e25c-11ec-ac07-0aa67b862ee7:1-6, a82ebef1-e265-11ec-964b-0af5faa008d7:1-521 row in set (0.00 sec)mysql> show slave status\G*************************** 1. row ***************************Slave_IO_State: Waiting for master to send eventMaster_Host: 172.31.32.33Master_User: replMaster_Port: 3306Connect_Retry: 60Master_Log_File: mysql-bin.000004Read_Master_Log_Pos: 194Relay_Log_File: relaylog.000009Relay_Log_Pos: 313Relay_Master_Log_File: mysql-bin.000004Slave_IO_Running: YesSlave_SQL_Running: YesReplicate_Do_DB:Replicate_Ignore_DB: information_schema,performance_schemaReplicate_Do_Table:Replicate_Ignore_Table: mysql.plugin,mysql.rds_monitor,mysql.rds_sysinfo,innodb_memcache.cache_policies,mysql.rds_history,innodb_memcache.config_options,mysql.rds_configuration,mysql.rds_replication_statusReplicate_Wild_Do_Table:Replicate_Wild_Ignore_Table: noreplicate.%Last_Errno: 0Last_Error:Skip_Counter: 0Exec_Master_Log_Pos: 194Relay_Log_Space: 672Until_Condition: NoneUntil_Log_File:Until_Log_Pos: 0Master_SSL_Allowed: NoMaster_SSL_CA_File:Master_SSL_CA_Path:Master_SSL_Cert:Master_SSL_Cipher:Master_SSL_Key:Seconds_Behind_Master: 0Master_SSL_Verify_Server_Cert: NoLast_IO_Errno: 0Last_IO_Error:Last_SQL_Errno: 0Last_SQL_Error:Replicate_Ignore_Server_Ids:Master_Server_Id: 1Master_UUID: 5ea52da6-e25c-11ec-ac07-0aa67b862ee7Master_Info_File: mysql.slave_master_infoSQL_Delay: 0SQL_Remaining_Delay: NULLSlave_SQL_Running_State: Slave has read all relay log; waiting for more updatesMaster_Retry_Count: 86400Master_Bind:Last_IO_Error_Timestamp:Last_SQL_Error_Timestamp:Master_SSL_Crl:Master_SSL_Crlpath:Retrieved_Gtid_Set: 5ea52da6-e25c-11ec-ac07-0aa67b862ee7:5-6Executed_Gtid_Set: 5ea52da6-e25c-11ec-ac07-0aa67b862ee7:1-6, a82ebef1-e265-11ec-964b-0af5faa008d7:1-52Auto_Position: 1Replicate_Rewrite_DB:Channel_Name:Master_TLS_Version:1 row in set (0.00 sec)Did I miss something?FollowComment"

Answer: "0Hi,I am wondering whether the mysql.rds_skip_transaction_with_gtid will work with your situation. You can test this out to see if it is helpful or not.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/mysql_rds_skip_transaction_with_gtid.htmlCommentShareSUPPORT ENGINEERKevin_Zanswered a year ago"


Question: Get verification emails from AWS account with @mailinator.com root emails

"Hi, We do have more than 100  child AWS accounts in this organization. Most of these child account has root email with @mailinator.com domains. Inorder to access the child accounts with root, I first to perform "Forgot Password". But, the problem is: I am not getting forgot password email on any of my child accounts with @mailinator.com domains.I want to know if AWS is blocking sending emails to @mailinator.com emails. If so, what will be the possible way to access these AWS accounts with root credentials.Thank youDipendraFollowComment"

Answer: "0Did you tried to send regular email to one of these addresses to make sure that your email system configured correctly?CommentShareLuke Doroszanswered a day agoDipendra a day agoYes, Normal emails will be delivered on mailinator emails. I think only AWS is blocking. For more on mailinator: https://www.mailinator.com/Share"


Question: Can a component in greengrassv2 receive a notification from a pre update applied to another component in the same deployment?

"I need to know when an specific component is gonna be updated because it sends messages to IoT Core from files saved inside the folder of the same component. I was thinking use SubscribeToComponentUpdates for that, but my component is actually subscribed to topic so I can't receive another type of messages (supposedly). So I want to ask if is possible that another component could receive notifications when my component is gonna be updated and deferer the update and send the  missings files.FollowComment"

Answer: "0my component is actually subscribed to topic so I can't receive another type of messages (supposedly)You should be able to subscribe to local messages and to the ComponentUpdates in the same GGv2 component. Both events will be handled by different callback functions, maybe this tutorial helps: https://docs.aws.amazon.com/greengrass/v2/developerguide/defer-component-updates-tutorial.htmlCommentShareEXPERTJan_Banswered 6 months ago0Thanks for the answer! Does this mean that my component should be able to subscribe to local messages and ComponentUpdates at the same time? How could I do that if (as you say before) the events will be handled by different callback functions? Do I need one StreamHandler? I'm sorry but I can't see a solution for that.Thanks again for the answer!CommentShareaws-user-4321answered 6 months ago"


Question: Installing CDK package from CodeArtifact during CodePipeline build stage

"I have some CDK constructs as Python packages built and published to CodeArtifact repository. Now I want to reuse these packages on my CDK app with CDK Pipeline. My code is thispipeline = CodePipeline(    self,    "Pipeline",    pipeline_name="MyApp",    synth=ShellStep(        "Synth",        input=CodePipelineSource.connection(...),        commands=[            "pip3 install awscli --upgrade --user",            "aws codeartifact login --tool pip --repository my-repo --domain my-domain --domain-owner 123456789012 --region us-east-1",            "pip install -r requirements.txt",            "npm install -g aws-cdk",            "cdk synth",        ],    ),)But I am getting de following error:An error occurred (AccessDeniedException) when calling the GetAuthorizationToken operation: User: arn:aws:sts::123456789012:assumed-role/MyAppPipelineStack-PipelineBuildSynthCdkBuildPr-OC8QO3ENNGDV/AWSCodeBuild-8cb5d5ee-c307-4742-bed6-51b0a0c36c48 is not authorized to perform: codeartifact:GetAuthorizationToken on resource: arn:aws:codeartifact:us-east-1:123456789012:domain/my-domain because no identity-based policy allows the codeartifact:GetAuthorizationToken actionI understand that this Roles don't have permissions to get this CodeArtifact repository, however I don't know how to setup CodePipeline. Does anyone know how to do it? Is there any tutorial that explains how to use private CDK packages in the CDK Pipeline build process?FollowComment"

Answer: "1Accepted AnswerIt worked! I added the following Role to CodedPipeline synth_code_build_defaults parameter.role_policy = [    iam.PolicyStatement(        actions=[            "codeartifact:GetAuthorizationToken",            "codeartifact:GetRepositoryEndpoint",            "codeartifact:ReadFromRepository",        ],        resources=["*"],    ),    iam.PolicyStatement(        actions=["sts:GetServiceBearerToken"],        resources=["*"],        conditions={            "StringEquals": {"sts:AWSServiceName": "codeartifact.amazonaws.com"}        },    ),]pipeline = CodePipeline(    ...    synth_code_build_defaults=CodeBuildOptions(role_policy=role_policy),)Thank you!CommentSharewellitonanswered 3 months ago0When you define a build project you can give it a ServiceRole - "The ARN of the IAM role that enables AWS CodeBuild to interact with dependent AWS services on behalf of the AWS account".  Adding the right CodeArtifact permissions in that role should solve your problem.CommentShareEXPERTskinsmananswered 3 months ago0I tried to pass the following Role to CodePipeline class.role = iam.Role(    self,    "PipelineRole",    role_name="PipelineRole",    assumed_by=iam.ServicePrincipal("codepipeline.amazonaws.com"),    inline_policies={        "AccessCodeArtifact": iam.PolicyDocument(            statements=[                iam.PolicyStatement(                    actions=[                        "s3:Abort*",                        "s3:DeleteObject*",                        "s3:GetBucket*",                        "s3:GetObject*",                        "s3:List*",                        "s3:PutObject",                        "s3:PutObjectLegalHold",                        "s3:PutObjectRetention",                        "s3:PutObjectTagging",                        "s3:PutObjectVersionTagging",                        "sts:AssumeRole",                    ],                    resources=["*"],                ),                iam.PolicyStatement(                    actions=[                        "codeartifact:GetAuthorizationToken",                        "codeartifact:GetRepositoryEndpoint",                        "codeartifact:ReadFromRepository",                    ],                    resources=["*"],                ),                iam.PolicyStatement(                    actions=["sts:GetServiceBearerToken"],                    resources=["*"],                ),            ]        )    },)But it didn't change the CodeBuild Role, giving the same error. The ShellStep construct doesn't seem to have a way to pass a Role. Also I guess this will override the auto generated Role. Is there any code example for setting up CDK Pipeline with CodeArtifact? Below the auto generated Role that CodeBuild is using.{    "Version": "2012-10-17",    "Statement": [        {            "Action": [                "logs:CreateLogGroup",                "logs:CreateLogStream",                "logs:PutLogEvents"            ],            "Resource": [                "arn:aws:logs:us-east-1:123456789012:log-group:/aws/codebuild/PipelineBuildSynthCdkBuildP-FPjRaipET6w0:*",                "arn:aws:logs:us-east-1:123456789012:log-group:/aws/codebuild/PipelineBuildSynthCdkBuildP-FPjRaipET6w0"            ],            "Effect": "Allow"        },        {            "Action": [                "codebuild:BatchPutCodeCoverages",                "codebuild:BatchPutTestCases",                "codebuild:CreateReport",                "codebuild:CreateReportGroup",                "codebuild:UpdateReport"            ],            "Resource": "arn:aws:codebuild:us-east-1:123456789012:report-group/PipelineBuildSynthCdkBuildP-FPjRaipET6w0-*",            "Effect": "Allow"        },        {            "Action": [                "s3:Abort*",                "s3:DeleteObject*",                "s3:GetBucket*",                "s3:GetObject*",                "s3:List*",                "s3:PutObject",                "s3:PutObjectLegalHold",                "s3:PutObjectRetention",                "s3:PutObjectTagging",                "s3:PutObjectVersionTagging"            ],            "Resource": [                "arn:aws:s3:::myapppipelinestack-pipelineartifactsbucketaea9-1i6sj2jynjl5w",                "arn:aws:s3:::myapppipelinestack-pipelineartifactsbucketaea9-1i6sj2jynjl5w/*"            ],            "Effect": "Allow"        }    ]}CommentSharewellitonanswered 3 months ago0You would want to pass your Role to the CodeBuild Project, not CodePipeline - see "role" (service role) in https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_codebuild.Project.html.CommentShareEXPERTskinsmananswered 3 months ago"


Question: encryption in dynamodb

"All documentation I can find on Dynamo more or less says the following: All tables created with default options are encrypted at rest, and that tables previously unencrypted are now encrypted as well (source: https://aws.amazon.com/about-aws/whats-new/2018/11/amazon-dynamodb-encrypts-all-customer-data-at-rest/)But in my  account, when I run the “DynamoDB tables with disabled SSE” precanned query, I get back  DynamoDB tables that are not encrypted at rest.Am I trying the correct query?SELECTCOUNT(*)WHEREresourceType = 'AWS::DynamoDB::Table'AND configuration.ssedescription.status <> 'ENABLED'FollowComment"

Answer: "0Accepted AnswerCan you try running the describe-table command for the specific table you want to check whether encryption is enabled or not.Eg : I ran this against one of my table where I have not explicitly enabled encryption. This table has the default encryption ie the key is owned by DynamoDB. And this does not contain the the SSEDescription section.aws dynamodb describe-table --table-name REFERENCE_DATA --profile LON_NIH_ACC1{    "Table": {        "AttributeDefinitions": [            {                "AttributeName": "DEVICE-ID",                "AttributeType": "S"            }        ],        "TableName": "REFERENCE_DATA",        "KeySchema": [            {                "AttributeName": "DEVICE-ID",                "KeyType": "HASH"            }        ],        "TableStatus": "ACTIVE",        "CreationDateTime": "2019-12-18T22:13:24.012000+00:00",        "ProvisionedThroughput": {            "NumberOfDecreasesToday": 0,            "ReadCapacityUnits": 5,            "WriteCapacityUnits": 5        },        "TableSizeBytes": 220,        "ItemCount": 2,        "TableArn": "arn:aws:dynamodb:eu-west-2:1233444444:table/REFERENCE_DATA",        "TableId": "ea301050-9d37-40de-bc90-8e53c59491c5"    }}Next I ran the describe-table against another table where I have opted for KMS - AWS managed CMK . Here as you can see the describe table output has the section SSEDescriptionaws dynamodb describe-table --table-name MyTable --profile LON_NIH_ACC1{    "Table": {        "AttributeDefinitions": [            {                "AttributeName": "somekey",                "AttributeType": "S"            },            {                "AttributeName": "somesortkey",                "AttributeType": "S"            }        ],        "TableName": "MyTable",        "KeySchema": [            {                "AttributeName": "somekey",                "KeyType": "HASH"            },            {                "AttributeName": "somesortkey",                "KeyType": "RANGE"            }        ],        "TableStatus": "ACTIVE",        "CreationDateTime": "2021-02-18T08:26:15.886000+00:00",        "ProvisionedThroughput": {            "NumberOfDecreasesToday": 0,            "ReadCapacityUnits": 5,            "WriteCapacityUnits": 5        },        "TableSizeBytes": 0,        "ItemCount": 0,        "TableArn": "arn:aws:dynamodb:eu-west-2:12345555555:table/MyTable",        "TableId": "9ec2c655-5883-4430-833f-c42fed15290a",        "SSEDescription": {            "Status": "ENABLED",            "SSEType": "KMS",            "KMSMasterKeyArn": "arn:aws:kms:eu-west-2:1233445555544:key/d2ddf328-adf1-4322-8a31-49531a9a679b"        }    }}And the describe table operation displays the SSEDescription status only when you explicitly opt-in for KMS based encryption.If your table is encrypted using the default option the describe table does not display the SSEDescription status but the table data is encrypted is at rest using the AWS owned CMK.So that means whenever you are not seeing the SSEDescription field in the describe table output then that means that the table is encrypted using the default option.Only when you opt for KMS based encryption then you would see the following data with your describe table output "SSEDescription": {  "SSEType": "KMS",  "Status": "ENABLED",  "KMSMasterKeyArn": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-abcd-1234-a123-ab1234a1b234"  },}Hence I think your query is returning inconsistent results and you will have to adjust your query to the case where for the default encryption there will be no SSEDescription.status.CommentShareAWS-User-6438840answered 2 years ago"


Question: How quickly do the events from putEvents influence recommendations ?

"How quickly do events inserted with putEvents influence recommendations for the user? Will the recommendations be instant, or is there any pre-defined interval where the new event data gets processed to create new recommendations?FollowComment"

Answer: "0Hi-If using the User-Personalization or Personalized-Ranking recipe, new events will typically impact recommendations within 1-2 seconds for each user. That is, after calling PutEvents, subsequent calls to GetRecommendations/GetPersonalizationRanking (after a couple seconds) for the same user will potentially result in updated recommendations. This also applies to the legacy HRNN-* recipes.For the User-Personalization recipe, the auto-update process that runs every two hours will bring in new items and impression data added since the last update (for cold item exploration). The auto-update process does not retrain the model.You still want to periodically retrain your models to incorporate new events/interactions in your models (i.e., across all users). If you're using batch inference jobs, you must retrain (for all recipes) to incorporate new events in the model. Batch jobs currently do not consider new events since the last full retraining.The SIMS and Similar-Items recipes require retraining to incorporate new events since the last full training.Hope this helps.CommentShareJames_Janswered 2 years ago0Hi hsakadude,I think in short, the answer is: it depends on the recipe you use.I believe putEvents operations update your model when it retrains again, so for the User-Personalization recipe for example, it automatically retrains itself around every two hours as documented here: https://docs.aws.amazon.com/personalize/latest/dg/native-recipe-new-item-USER_PERSONALIZATION.htmlThere may be some slight updates immediately depending on your filter expressions, etc, but from what I understand the incremental data is not relevant in recommendations until the model is trained to a new solution version.Hope this helpsEdited by: law-dwg on Nov 15, 2021 12:20 AMHi hsakadude,Please disregard my message and use the one below. It is better informedCommentSharelaw-dwganswered 2 years ago"


Question: Not able to disable and delete a CloudFront distribution

"When I attempt to disable an existing CloudFront Distribution, I receive the following error in red:"Failed: The If-Match version is missing or not valid for the resource."Afterwards, I also tried to delete the CloudFront Distribution, but I receive the following error in red:"Failed to delete distribution: The If-Match version is missing or not valid for the resource."After attempting to delete the distribution, the distribution returns to an "Enabled" state.How can I permanently delete this distribution and resolve this issue?FollowComment"

Answer: "0Some web browser extensions (add-ons), for example ClearURLs, remove ETag headers, which causes updates to fail. To update your distribution, disable this browser extension or turn off ETag filtering.Also, This error occurs because you need to first get the current distribution config with cloudfront.getDistributionConfig and then copy the ETag and DistributionConfig fields into your cloudfront.updateDistribution call. You modify the DistributionConfig as needed to achieve the actual config update you're trying to do.Hope this helps, please click Accept answer if it helped you resolve the issue.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months ago"


Question: how to Configure EBS to run npm install

"I have node.js application I want to deploy to ebs, however I have two package.jsons for the client and the server. My Idea is that I want server to simply serve the built version of the client.client|-package.jsonserver|-package.jsonI was having a hard time finding in the docs if there was a way to configure the npm install command so it would first run the two installs in each sub directory.I have nodecommand.config that will start the server ie:option_settings:  aws:elasticbeanstalk:container:nodejs:    NodeCommand: "(cd server && npm run start-prod)"is there a way to do this for the install as well?FollowComment"

Answer: "0You can check this one - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-specific.htmlNodeCommand:Command used to start the Node.js application. If an empty string is specified, app.js is used, then server.js, then npm start in that order.CommentSharec3nIvoanswered a year ago"


Question: EventBridge max EventBuses on event path

"I have a following event routing:EventBusA -> EventBusB -> EventBusC -> SQSQueueWhen I send event to EventBusB or EventBusC it is routed to SQSQueue. But when I send an event to EventBusA, it does not arrive to SQS. Is there any limitation regarding the length of the path the event can be routed through? I double confirmed this is not a problem with my configFollowComment"

Answer: "1Accepted AnswerYes, there is a limit when sending events between buses in the same region. An event can traverse from a bus to a different bus only once. If you look at the doc, you will see:EventBridge can't route events received from a sender event bus to a third event bus.If you need to send it to two buses, just create two rules on the first event bus that will route to both buses.CommentShareEXPERTUrianswered a year ago"


Question: BGP Propagation not working for specific CIDR

"I am trying to propagate a network through the on-premise router to the direct connect gateway I am using a Transit Gateway to manage the network in my accounts. I take all private network ranges for testing: 10.0.0.0/8, 172.16.0.0 /12 and 192.168.0.0/16. The first two networks (10.0.0.0/8 and 172.16.0.0 /12) work and are showing as "Propagated" in the TGW route tables. However, the 192.168.0.0/16 network is not propagated. Where could be the error here?Edit:To clarify I added some pictures. There are no "Prefix List references" configured.FollowCommentTushar_J EXPERT4 months ago192.168.0.0/16 is on the AWS side or on-premises?SharerePost-User-5869278 4 months agoon-premisesShare"

Answer: "1Do you have any VPC with 192.168.0.0/16 CIDR attached to TGW ?Are all 3 CIDR locally originated from your rotuer ? or one of them is just propagated ( aka learned from backbone and readvertised to AWS ?)Same ASN in advertised CIDR of 192.168.0.0/16 as of AWS side ASN can be one of the reason.If no, then only way to diagnose further is by studying some outputs.If you are using Cisco Router then as Tushar suggested, share output of working and non working CIDRIf other vendors then share equivalent output.No other way to tshoot further.CommentShareMuhammadanswered 4 months ago0Have you checked if the on-premises CGW (router/switch/firewall ) is indeed advertising 192.168.0.0/16 route?  For example on a Cisco router you would check: show ip bgp neighbor x.x.x.x advertised-routesCommentShareEXPERTTushar_Janswered 4 months agorePost-User-5869278 4 months agoyes. I triple checked that. On-Premises config is fine.ShareTushar_J EXPERT4 months agoThere is no filtering done on AWS side for routes advertised by the customer router so likely there is configuration issue on the CGW.  The 'Allowed prefixes' on DXGW is for the other way - AWS to on-premises advertisements.ShareTushar_J EXPERT4 months agoIs this issue resolved? you may want to open support case as troubleshooting is very limited over a forum like this. Good luck.SharerePost-User-5869278 4 months agoThanks to all, the issue is resolved. It was a configuration issue on the on-premise side. Our network technician fixed it.ShareTushar_J EXPERT4 months agoIf the answer provided is useful please mark the answer as 'Accepted Answer'. Thank you.Share0That sounds a lot like an exam question. ;-)But, there's probably an issue in the Direct Connect Gateway allowed prefixes where 192.168.0.0/16 isn't specified.CommentShareEXPERTBrettski-AWSanswered 4 months ago"


Question: AWS Monitron Login trouble.

"The Monitron (https://app.monitron.aws/#/) page is no longer working for me. It is a redirect for an app update. I don't use an app to access the monitron system. I have always used the website. I guess my question is, "Is the new link to access this system?"FollowComment"

Answer: "0I tried the same Monitron  url (https://app.monitron.aws/#/) and I was able to login to the monitron web app. Please try it clear the cache and try it again.also, you can try the belowTo access AWS Monitron projects over web app, please find the sample urlhttps://app.monitron.aws/?awsAccountId=XXXXXXXXXXXXX&projectId=f774911e-4b3d-XXXX-YYYY-1d3e9d6565e2&projectName=a89286m87b&region=us-east-1&stage=prodYou can get the actual url, by navigating to AWS Monitron --> select the project ---> under project details (project link)CommentShareAWS-User-7653869answered 6 months ago"


Question: How to use mobiletargeting:SendOTPMessage and mobiletargeting:VerifyOTPMessage

"When using the mobiletargeting:SendOTPMessage in the context of Amazon Pinpoint project, I receive an error such as the following.User: arn:aws:iam::<snip>:user/<snip> is not authorized to perform: mobiletargeting:SendOTPMessage on resource: arn:aws:mobiletargeting:<region>:<accountId>:apps/<projectId>/otpAdding the policy as below does not recognize mobiletargeting:SendOTPMessage or mobiletargeting:VerifyOTPMessage, What am I missing?{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["logs:CreateLogStream","logs:PutLogEvents","logs:CreateLogGroup"],"Resource": "arn:aws:logs:::"},{"Effect": "Allow","Action": ["mobiletargeting:SendOTPMessage","mobiletargeting:VerifyOTPMessage "],"Resource": "arn:arn:aws:mobiletargeting:<region>:<accountId>:apps/<projectId>/otp/"}]}FollowComment"

Answer: "0Accepted AnswerAfter some help from AWS technical support, the issue was resolved by following the steps below.Create a policy as shown below. There are two key points;Ignore the two "Invalid Action" errors related to SendOTPMessage and VerifyOTPMessage in the GUI. Save the policyEnsure that the Resource URL is exactly as specified and uses your account id.In other words, use this instead of the policy example in "Step 2.1: Create an IAM policy" at https://docs.aws.amazon.com/pinpoint/latest/developerguide/tutorials-two-way-sms-part-2.html{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "UseConsole",            "Effect": "Allow",            "Action": [                "mobiletargeting:SendOTPMessage",                "mobiletargeting:VerifyOTPMessage"            ],            "Resource": "arn:aws:mobiletargeting:*:YOUR_ACCOUNT_ID:apps/*"        }    ]}Attach this policy to the user.CommentSharelaliranswered a year ago"


Question: Lightsail instances connecting to general aws free-tier load balancer

"I have a AWS free account with lightsail free trial.I deployed 2 instances of Odoo with Nginx connecting to 1 database. All these were set up in AWS lightsail. Then I wanted to connect to load balancer and I found load balancer in lightsail aren't included in lightsail free trial.Then I tried to find ways to connect my system to AWS elastic load balancing as it is free with 12-month free period. And then I found the below post saying that it is hard to connect them:https://stackoverflow.com/questions/61283783/how-do-i-use-a-ec2-load-balancer-with-aws-lightsail-instanceSo my question is: I have Odoo with Nginx connecting to 1 database in aws lightsail. Is it possible to connect to elastic load balancing in general aws free tier? If yes, some brief instructions would be appreciated.For testing purpose, I tried to do connection between lightsail and general aws. But it seems that they are in 2 different groups and I couldn't do that. I didn't know whether I set it up wrongly or it is indeed impossible.Thank you.FollowComment"

Answer: 1Accepted AnswerYou can use Lightsail as an ALB target in the manner described here.https://repost.aws/knowledge-center/lightsail-add-application-load-balancerYou can specify the Lightsail IP address in the ALB target by connecting the Lightsail VPC to the peer VPC where the ALB is located.CommentShareEXPERTRiku_Kobayashianswered a month agorePost-User-1934627 a month agoThank you!Share


Question: Where can I learn how to code/build games with Lumberyard?

"Hello,I`m currently trying to get into coding with c++ for lumberyard. I followed the tutorials how to set up everything properly and played a little bit with the editor. For now my problem is how to start with the coding. I have visual studio installed and opened the LumberyardSDK solution but I have no clue what I have to do next. In unity for example it is simple, you have to write behaivour scripts and attach them to game objects but what do I have to do in Lumberyard to build a "Game"? Seriously I couldnt find any tutorial about this wich could help me getting into this topic, so It would be nice if somone of you who already is further in getting into Lumberyard could help me with this.Follow"

Answer: "0Accepted AnswerHello tiobaldThe first suggestion I have is to look into this video [1] which describes some of the underlying theory of Lumberyard engine's coding architecture and shows a very quick demo of how core concepts as reflection, code generation, components, events and slices work.Then, actually start making a project in which the object is to create a native C++ component that can be attached to a game entity in the editor.You will as a minimum need a Lumberyard project. It will be in charge of loading any gems that you create for your game. Open the <lumberyard_root_folder>\dev\Bin64, then run ProjectConfigurator.exe. Create a new project there and give it a name.Games in Lumberyard should be made as one or more gems. A gem is a way of isolating your own code from the engine code so that, imagine if you update your version of Lumberyard, you don't end up with a bunch of code that you have to untangle to update. Also it may make sense to break up the game into pieces for whatever reason, these would also be gems. Gem creation is covered here [2]. The structure of gems is discussed here [3] but you can basically assume that a gem contains assets that can be loaded, a code module, and some waf data to build the code module in the gem. [4] 3. Gems in the latest release of Lumberyard (since 1.5.0.0) contain code created as AZ Modules [5] (which is a good thing). These are the libraries (static .lib or dynamic .dll) that contain the built code. The AZ module source includes an interface derived from AZ::Module and this contains a system entity and adds any required system components to it (one by default). It will also come with an event bus by default, and a single system component. System components are singleton components [6]. The module is registered with the autogenerated code, e.g.AZ_DECLARE_MODULE_CLASS(HelloWorld_010c14ae7f0f4eb1939405d439a9481a, HelloWorld::HelloWorldModule)    4. You are also free to derive components from AZ::Component and include them in the gem. [7] Registering is as easy as the example code shows:AZ_COMPONENT(MyComponent, "{0C09F774-DECA-40C4-8B54-3A93033EC381}");If you will need to store any information out of the component instances, it must have metadata added in a reflect function which tells Lumberyard what will be stored, or serialized. If it is to be seen in the editor, so that you can attach it to a game object, for example, you will need to add metadata in the reflect function which tell Lumberyard what it does in the editor, including what settings you can make on the component and how the UI looks in the editor. Reflection is simply the term used for any code you write that tells another part of the system how to use your class. You may say in the reflection code that a particular function needs to be called when data is changed by the editore, and you should also write these change callbacks in the component. [8]You should be able to create an entity in the editor now, and attach your component and set values in the object, and print them out or see them in the debugger.You should learn about slices and dynamic slices now, to get you to the level where you can start using code effectively in Lumberyard. [9]Please let us know if you run into difficulties, and I will be happy to help,Al Murray :)Solutions ArchitectAmazon Game Services[1] https://youtu.be/mNulWXcJ1JA[2] http://docs.aws.amazon.com/lumberyard/latest/userguide/gems-system-gems.html[3] http://docs.aws.amazon.com/lumberyard/latest/userguide/gems-system.html[4] http://docs.aws.amazon.com/lumberyard/latest/developerguide/az-module-gems.html[5] http://docs.aws.amazon.com/lumberyard/latest/developerguide/az-modules-intro.html[6] http://docs.aws.amazon.com/lumberyard/latest/developerguide/az-module-parts.html[7] http://docs.aws.amazon.com/lumberyard/latest/developerguide/component-entity-system-create-component.html[8] http://docs.aws.amazon.com/lumberyard/latest/developerguide/component-entity-system-reflect-component.html[9] http://docs.aws.amazon.com/lumberyard/latest/developerguide/dynamic-slices.htmlSharerePost-User-3977697answered 6 years ago0As Cajunction says, You are probably better off using scripts to get the flow of the game worked out and then if needed add in C++ or assembly. If you do go assembly look into MASM. It is purely the best macro assembler ever or even asm{} in C++I was under impression that maybe you wanted to delve into the core functions of interacting with the engine classes directly through your own code. It is possible to do so but again you need to KNOW coding C++ to get there.For general stuff stick to scripts for now and through scripts you will learn the basics of C++ programming since C++ is just a lower level of scripts so the flow of code is identical in practice.SharerePost-User-0178152answered 6 years ago0Things are kind of shaky when you get to C++ here. Your best bet is to follow the tutorials and get use to the engines interface and hope the developers realize that not everyone using LY wants a cut and dried level building, crysis clone.If you're like me and want to scrap the editor and build your own interface then you have to decipher it in the engines source directory .<your drive>:\Amazon\Lumberyard\1.6.0.0\dev\Code\CryEngineIt has no API documentation which is frustrating and the most of the code is undocumented. I find it quite challenging but it is doable although I am considering a different option at the moment..SharerePost-User-0178152answered 6 years ago0Hey,I think you are much more advanced then me, my current aim is to learn how to write games in general with lumberyard(using mostly c++ and not the flow graph) but there are none tutorials about how to build something with c++ or how to do something in lumberyard besides creating levels with the editor... But anyways thanks for your replySharerePost-User-2449719answered 6 years ago0Hello,first of all thank you for your replys! Currently I already have knowlede in some languages and I`m following sonme tutorials about C++. My problem is how to do things with C++ in LY..Something like a documentation or video how to build a "wasd" input controller or even a hello world LY version would help me alot because I have to learn the basics of interaction between the code and the game(hope you get what i mean). The only tutorial I can find about Lumberyard wich uses C++ is about writing a gem, but I think this is not what im looking for. Sorry if its hard to understand me but english is not my first language.SharerePost-User-2449719answered 6 years ago0I imagine that is so , given most devs know c++ already, and they are concentrating on 'flow' because tho c++ I guess ( I'm not knowledgeable in c++ atm, working on it as well) is faster ,where you need speed, flow is usually enough for scripting needs, which is usually sufficient for many purposes unless you are going deep into code , for things not well done in flow.Epic via ue4 is suggesting BP use where possible as its fantastic for prototyping and where you only need scripting.Same thing here applies, I should think.You likely ? would learn c++ better, once you learn another language, at least that was my experience.They are mostly the same anyway, hence why that's possible.To my knowlege anyway, assembly is the only exception, but thats 'machine code' anyway, which you won't be using in any game engine that I'm aware of.Start small > build up.SharerePost-User-2755327answered 6 years ago0Thanks a lot! ISharerePost-User-2449719answered 6 years ago"


Question: Animation Graph interaction

"Hello,I'm new to the animation editor. I'm trying to create an animation graph.I'm watching tutorials to figure out how this works, but I do not have the same result.When I look at tutorials, the animation graph nodes display "progress bar" in each motion node showing the currently playing animation. My nodes do not display any bars like in the image below.REMOVEDUPLOADIn fact, I am not able to play any animation from the animation graph. When I "Shift + Left Click" a motion node, the actor is not animated. I tried to right click and "Activate State", but it does nothing either.In addition, when I add a condition to a transition, I do not have a dot showing on the transition arrow.I'm using the version 1.12.0.0.Do I have to switch to "animation graph" mode to be able to interact with the animation graph?I can play my motions when I go in Motions tab and double click them.Note: Sometimes, when I attempt to play an animation in Motion Tab, I get a popup window showing: error #1). There is nothing else, no description. When I attempt to open another motion, I get the same result. So I close the Motion editor and open it back up. Then I attempt to play a motion and everything freeze in Amazon Lumberyard, and I get "beeps" when I try to click something. I stop the lumberyard process and restart lumberyard, and then the editor restart to work. I saw another thread of someone having issues as well with the Animation Editor. https://forums.awsgametech.com/t/animation-editor-unusable-for-me-and-bugged/4528/1Solutions mentioned didn't help me out: text scale to 100%. It was already at 100%. I'm using a GTX 1080 FTW as well, so graphic card shouldn't be the problem. I would hate to work hard on something and then lose everything because the animation editor decide to freeze.Follow"

Answer: "0Accepted AnswerHi @REDACTEDUSERREMOVEDUPLOADPlease try this and let us know if you have success running your Animation Graph with this method. Hope this helps!SharerePost-User-0479726answered 5 years ago0Hi @REDACTEDUSERSharerePost-User-0479726answered 5 years ago0Ah, that's what I was missing. Thanks!!!About the error I get sometime, here is the popup I get:REMOVEDUPLOADAt that point, the Animation Editor stop to work, and I have to restart Amazon Lumberyard.SharerePost-User-1026337answered 5 years ago0Also @REDACTEDUSERSharerePost-User-0479726answered 5 years ago0Hello @REDACTEDUSERI found the step by step procedure to reproduce this error (at least for me).I've done it 4 times in a row and it crashed everytime.Step 1: Open the animation editor and have the Motions pan activeREMOVEDUPLOADStep 2: Click on the Animation Graph in Resource ManagementStep 3: Click somewhere in the 3d ViewerStep 4: Double Click on a motion in the Motions tabVoilàYou should get this error:REMOVEDUPLOADSharerePost-User-1026337answered 5 years ago0Hi @REDACTEDUSERSharerePost-User-0479726answered 5 years ago"


Question: Greengrass switches the deployment version without executing the startup script

"Operation steps:Through aws greengrass v2 create-deployment -- cli-input-json locally file://update-component.json Mode deploymentThe local deployment of version 28 is successfulThe local deployment of version 0 is incompleteRe-deploy version 28 locallyPhenomenon:Start script will not be executed after step 3Q: How to make step 3 execute the startup scriptFollowCommentMichaelDombrowski-AWS EXPERT4 months agoWhat do you mean by "incomplete"? What is the exact status of the deployment?If the deployment rolled back, which Greengrass will do automatically in some circumstances, then it will run the startup again (if necessary). If no changes were made which require the startup script to run, then it will not run.Share"

Answer: "0Hello,This is Tom from AWS Support.As mentioned through the comment, IoT GreenGrass will roll back deployment automatically in some circumstances, then it will run the startup again (if necessary). If no changes were made which require the startup script to run, then it will not run.If there is an issue with current deployment startup script, I would recommend to check and see if there are any status codes from devices' file system logs (e.g. STARTUP_ERROR or STARTUP_TIMEOUT):https://docs.aws.amazon.com/greengrass/v2/developerguide/troubleshooting-component.htmlI hope the above information helps for further troubleshooting. Have a nice day.CommentShareSUPPORT ENGINEERTom_Tanswered 4 months ago"


Question: AWS CLI commands after AWS SDK credential store authentication

"Hi, I'm trying to understand if it's possible to use AWS CLI commands after authenticating and storing credentials in the encrypted SDK credential store (RegisteredAccounts.json file).I can successfully run the PowerShell tools commands such as Get-S3Bucket to list buckets, but AWS S3 LS or any other AWS command complains about the profile either not existing or not being found (if i try specify it with set AWS_PROFILE="myProfile"All the documentation I read instructs me to use the AWS CONFIGURE command and create a profile with a credentials file but i don't understand how/if i can use the SDK credential store as the authentication source.Any clarification appreciatedFollowComment"

Answer: "0Accepted AnswerHi,I understand that you'd like to know if AWS CLI supports sourcing credentials from SDK store.AWS CLI DOES NOT support sourcing credentials from the SDK store.AWS Tools for PowerShell supports this feature as you have mentioned:Using AWS Credentials - Credentials Store Locations - https://docs.aws.amazon.com/powershell/latest/userguide/specifying-your-aws-credentials.html#specifying-your-aws-credentials-storeThe AWS SDK for .NET and Toolkit for Visual Studio can also use the AWS SDK store.Using the SDK Store (Windows only) - https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/sdk-store.htmlProviding AWS credentials - Credentials locations - https://docs.aws.amazon.com/toolkit-for-visual-studio/latest/user-guide/credentials.html#credentials-locationsHowever, please note that AWS CLI DOES NOT support sourcing credentials from the SDK store.Since you want to use a named profile for CLI, you may follow the guidelines in the documentation below to achieve this use case:Named profiles for the AWS CLI - https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.htmlTo use a named profile for multiple commands, you can avoid specifying the profile in every command by setting the AWS_PROFILE environment variable at the command line. I believe this is what you are trying to achieve (please correct me if I'm wrong).For Linux or macOS, you may set the AWS_PROFILE environment variable to use a profile called 'user1' as shown below:$ export AWS_PROFILE=user1For Windows, you may set the AWS_PROFILE environment variable to use a profile called 'user1' as shown below:C:> setx AWS_PROFILE user1Please let us know if you run into any further questions or concerns!CommentShareSUPPORT ENGINEERSumukhi_Panswered a year agoDan a year agoUnderstood thank youShare"


Question: Get free storage space of a RDS using python

"Hello,How to get free storage space of a RDS using python SDK?Regards,Kandarp BhattFollowComment"

Answer: "0Hi,Here you go.  This will print out a list of the Minimum FreeStorageSpace in Bytes for the last 15 minutes (5 minute intervals). You will need to modify the DBInstanceIdentifier Value to match your database instance indentifier...import boto3from datetime import datetime,timedeltaimport json# Create CloudWatch clientcloudwatch = boto3.client('cloudwatch')response = cloudwatch.get_metric_data(    MetricDataQueries=[        {            'Id': 'fetching_FreeStorageSpace',            'MetricStat': {                'Metric': {                    'Namespace': 'AWS/RDS',                    'MetricName': 'FreeStorageSpace',                    'Dimensions': [                        {                            "Name": "DBInstanceIdentifier",                            "Value": "database-1"                        }                    ]                },                'Period': 300,                'Stat': 'Minimum'            }        }    ],    StartTime=(datetime.now() - timedelta(seconds=300 * 3)).timestamp(),    EndTime=datetime.now().timestamp(),    ScanBy='TimestampDescending') print(response['MetricDataResults'][0]['Values'])Hope this helps!-randyCommentShareRandyTakeshitaanswered 4 years ago0Hi Randy,Thanks for the reply and worked.ThanksKandarp BhattCommentSharekandarpanswered 4 years ago"


Question: Windows Self Managed Nodes fail to join a cluster

"I created a node-group of self managed nodes with terraform, the ec2 instanced get created with the right tags, security group & settings, the aws-auth config map includes this SG for the rols "system:bootstrappers" & "system:nodes, the amazon-vpc-cni config map includes the "enable-windows-ipam" setting and yet the nodes don't show up in the cluster nodes.Anyone has any ideas what can be wrong?FollowComment"

Answer: "0Check the following link to verify the Windows AMI version compatible with EKS Clusterhttps://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-windows-ami.htmlDouble-check the aws-auth ConfigMap in your EKS cluster to ensure that it includes the correct roles for your Windows nodes.You can use the kubectl get configmap aws-auth -n kube-system -o yaml command to inspect the ConfigMap.Review the Amazon VPC CNI ConfigMap to ensure that it has the correct "enable-windows-ipam" setting.You can use the kubectl get configmap aws-node -n kube-system -o yaml command to inspect the ConfigMapCommentShareEXPERTsdtslmnanswered 2 months agoNadav Sinai 2 months agothanks for the advice, I checked the AMI is as expected and verified the two config maps,everything is in place yet the nodes don't join the cluster.I verified security group and rules and restarted the instances, nothing helps.Share0Please see the documentation provided here https://docs.aws.amazon.com/eks/latest/userguide/launch-windows-workers.html for launching self-managed Windows nodegroups. Note - you will need some Linux based nodes for core addons such as CoreDNS which are required for the clusterCommentSharebryantbiggsanswered a month ago"


Question: Security group for VPC Link / ApiGatewayV2 is not working

"Hey there, I have set up a security group for my VPC link (AWS::ApiGatewayV2::VpcLink) on my API GATEWAY HTTP API V2 (AWS::ApiGatewayV2::Api). Even if I remove all the inbound rules I'm able to reach the server from the internet. Any ideas?FollowCommentdonkee 20 days agoDid you ever figure this out?Share"


Question: Is there and open source security platform(CIEM/CSPM) which implements or calculates AWS's effective permissions for stating out the permission boundaries of iam identities?

Hi. I wanted to know if there was any opensource security platform which uses the AWS permissions boundary to evaluate the effective permission for a particular identity? Can someone point me out to some documentation for github for such products. ThanksFollowComment

Answer: "0To grant only the permissions required to perform a task, you can generate policies based on your access activity that is logged in AWS CloudTrail. For that you can use IAM Access Analyzer to analyze the services and actions that your IAM roles use, and then generates a fine-grained policy that you can use. After you test each generated policy, you can deploy the policy to your production environment. This ensures that you grant only the required permissions to your workloads.More information hereI hope this helps!CommentSharePablo Guzmananswered 7 months ago"


Question: How to migrate all content from one AWS account to another?

"Due to a project we want to migrate all content from one AWS account to another.This is because a project was done and now the customer wants to have access to the resources we have deployed and we no longer have access to the account. Basically the idea is to give the account to the client.I don't know if there is a solution or an optimal way to exchange the account.I look forward to hearing from you, thank you in advance.FollowComment"

Answer: "2Hi,This article was done exactly for this purpose, depending on the resources in the account: https://aws.amazon.com/blogs/architecture/migrate-resources-between-aws-accounts/Hope it helps ;)CommentShareEXPERTalatechanswered 7 days ago2In addition to the above, it may be easier to move the whole account to the other organization. See this blog post for how to do it this way: AWS Organizations, moving an organization member account to another organization.CommentShareEXPERTkentradanswered 7 days ago"


Question: Number of Dimensions Support for Metric Filters in AWS CloudWatch

"As part of our application monitoring and analysis, we heavily rely on AWS CloudWatch for collecting and analyzing various metrics. While the existing functionality has been instrumental in our monitoring efforts, we have encountered a requirement to expand the number of dimensions associated with our metric filters.Presently, I am aware that Metric Filters in AWS CloudWatch support up to three dimensions. However, due to the evolving needs of our application and the increasing complexity of our infrastructure, we have reached a point where we require additional dimensions to capture more granular data for effective monitoring and troubleshooting.To optimize our monitoring capabilities and gain deeper insights into our system's performance, I kindly request your assistance on the following inquiries:Is there any way to increase the number of dimensions supported by Metric Filters in AWS CloudWatch?If it is possible to increase the dimensions, what is the recommended approach or any available workarounds?Are there any considerations or best practices we should be aware of when working with an increased number of dimensions in Metric Filters?FollowComment"

Answer: "0Up to three settings can be made as described in this document.There is currently no way to increase this value.https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html#logs-metric-filters-dimensionsYou can use the CloudWatch console or AWS CLI to create metric filters that publish dimensions with metrics that JSON and space-delimited log events generate. Dimensions are name/value value pairs and only available for JSON and space-delimited filter patterns. You can create JSON and space-delimited metric filters with up to three dimensions. For more information about dimensions and information about how to assign dimensions to metrics, see the following sections:CommentShareEXPERTRiku_Kobayashianswered 11 days ago"


Question: Location of root path for wordpress on Lightsail

I need to locate the root or default path for wordpress on lightsail.  Google is requiring us to load a file and they never seem to find it.  Any help would be appreciated.FollowComment

Answer: "0Hi,AWS Lightsail uses bitnami images, you will find the default path in of the below directories,/opt/bitnami/apps/wordpress/htdocs/or/opt/bitnami/wordpress/wp-contentBy default all user files are uploaded to /opt/bitnami/wordpress/wp-contentLet me if this helps,CommentShareSUPPORT ENGINEERLundianswered a year ago"


Question: "Calculating LIST, GET, SELECT requests to/from S3"

"I am attempting to use the AWS Pricing Calculator to estimate retrieving objects from S3, and it asks for the number of LIST requests to S3 and the number of GET, SELECT from S3. The calculator also asks for the estimated amount of data returned and scanned. I am unsure of how to estimate these numbers. If I want to retrieve 1,000 objects, would it incur 1,000 GET and SELECT requests but only one LIST request? I am assuming *data returned *is the amount of data transferred out, but what is data scanned?Any clarification would be greatly appreaciated.FollowComment"

Answer: 1So a big piece will be around how you call the data.If you know the full key to the object and just run an S3 Get command then you will just pay for 1 GET and the data.If you do the same in the console via drilling down a folder structure you will also pay for all the LISTS that it calls to generate the console. Depending how big your bucket is and how it is structured this could be a lot of queries.So if you want to keep costs low use full key (path and object) with a CLI or SDK command.Hope this helps.CommentShareRobin Fordanswered a year ago


Question: QLDB - Journal revision history metadata field addition request

"Dear Experts,Our use of the QLDN is programmatic via API endpoints, all CRUD Operations are done via the deployed API endpoint.Please we have a situation where we believe adding more fields in the metadata section of the segments revision history might help us track changes more expediently.In the Journal revision history API response, What we have today:response cut short**************"metadata": {"id": "9hUtjL7taVu36pRGZ995iG","version": 4,"txTime": "2022-11-28T18:34:44.454Z","txId": "LNQEhATqdhyCm8thrtggPz"}response cut short**************In the journal revision history API response,What we hope to achieve:response cut short**************"metadata": {"id": "9hUtjL7taVu36pRGZ995iG","version": 4,"txTime": "2022-11-28T18:34:44.454Z","txId": "LNQEhATqdhyCm8thrtggPz""createdBy": "6299d4f8710fba0013744654""updatedBy": "62572fe658ceba00141a1396"}response cut short**************We have been searching for resources online to guide us on this implementation, however no luck yet. Please is this a possibility today and how can this be achieved, if possible?any guidance or advise will be well appreciated.Thank you,LioFollowComment"

Answer: "0Hi Lio. I know where you are coming from as it is a question I have asked previously. The metadata section is added by the QLDB service. Unfortunately, there is no way for a customer to add any custom attributes to this section. The alternative approach I use is to add additional attributes to each table such as createdBy if that is what is needed, so they will be presented in the data section and usableCommentShareEXPERTMatt Lewisanswered 5 months ago"


Question: Can AWS Lambda use multicast in a VPC?

"Amazon VPC has support for multicast, as this page of the documentation explains:  https://docs.aws.amazon.com/vpc/latest/tgw/working-with-multicast.html AWS lambda can be connected to a VPC: https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.htmlCan AWS lambda send and/or receive multicast messages to/from a VPC?FollowComment"

Answer: "3Accepted AnswerAlthough Amazon VPC supports multicast via AWS Transit Gateway, AWS Lambda does not directly support sending or receiving multicast messages. When you connect a Lambda function to a VPC, it receives an Elastic Network Interface (ENI) with a private IP address, allowing it to communicate with other VPC resources.Lambda functions, on the other hand, are designed to be stateless, event-driven compute services that do not support multicast messaging patterns such as group communication or network broadcasting. Multicast is typically used in scenarios requiring one-to-many or many-to-many communication, whereas Lambda functions are typically triggered by specific events or API calls.If your application requires multicast communication, you may need to consider an alternative solution, such as running your code on Amazon EC2 instances within your VPC. This way, you can take full advantage of AWS Transit Gateway's multicast support.CommentShareEXPERTsdtslmnanswered 2 months agoEXPERTTushar_Jreviewed 2 months agorePost-User-4909282 2 months agoSo, the ENI recieved by the AWS Lambda does not allow the multicast messages to arrive?ShareBrettski-AWS EXPERT2 months agoNo, because Lambda is event-driven, not packet-driven. It doesn't support setting up a network listener - that is, opening up a port and listening for inbound connections.Share"


Question: API Gateway Content Type issue

"Hi Team ,We wanted to expose PingAccess Console via APIGateway.We have below flow :Internet --> AWS API Gateway --> Private NLB --> EC2(Hosted PingAccess Admin Console)We have deployed AWS API Gateway  REST API with proxy integration and VPC link configuration but we are no able to open the same using API Gateway Endpoint.We are getting below error in Browser.Refused to apply style from 'https://pingaccess.dev.obiebank.obly.io/dist/styles.css' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled.We have added Content-Type in Response Headers and remove application/json from Content-Type option in Method Response tag.Note: We are able to open PingAccess Console from NLB , with creating Public NLB.FollowComment"

Answer: "0Are you using Proxy Resource?Seems like your issue is that API gateway is not forwarding the URL path to NLB, so your backend is always returning the content of https://pingaccess.dev.obiebank.obly.io/ (which most likely is an HTML page)If you don't want to specify all possible URL path in the API gateway, using proxy resource is the way to capture all URL suffix and forward to the backend.https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-set-up-simple-proxy.htmlCommentShareRichardFananswered a year agoAWS-User-5331128 a year agoHi RichardFan , Thanks for responding. YES, we are using Proxy resource and we have mention greedy Proxy path {proxy+} to handle all context paths.Share"


Question: Please allow reverse DNS for EC2 IPv6

"Currently AWS offers setting of reverse DNS names for EC2/VPC IPv4 addresses, although the process is conflated with enabling outgoing SMTP permission for those addresses.  This post/question is to allow the same for IPv6 addresses.There are two obvioud ways that AWS could do that:A (simplistic): Allow setting reverse DNS names for individual IPv6 addresses using the existing form for IPv4 addresses.  This is procedurally simple, but requires AWS to run some massive IPv6 rDNS zones covering the entire AWS EC2 IPv6 address space.B (flexible): Provide a form where EC2/VPC customers can request delegation of reverse DNS for their assigned /56 IPv6 subnet, this delegation could be to any set of DNS servers, including but not limited to Route 53.  This would only requre AWS to run delegation-only IPv6 rDNS zone for the AWS EC2 IPv6 address space, but would  require a third form to unlock outgoing SMTP traffic.FollowComment"

Answer: "1Hi !Thanks for contacting AWS Re:post .I understand you would like to have reverse DNS names enabled for EC2 / VPC IPv6 .I do apologize for the inconvenience of the Service limitation, However, as I understand the importance of your use case I have created a  feature request on your behalf for this functionality. As you can imagine, any new feature requires the product to undergo rigorous testing and troubleshooting before it is made available, to ensure security and stability for end users. Hence,  I can't provide you with an ETA for when the feature will be released, however if it's released, it should be announced in the AWS What's New blog below:https://aws.amazon.com/new/CommentShareSUPPORT ENGINEERAnsh_C answered a year ago0Hi !Further adding, this doc explains setting PTR record (reverse DNS) for IPv6 as well : https://aws.amazon.com/premiumsupport/knowledge-center/route-53-reverse-dns/CommentShareSUPPORT ENGINEERAnsh_C answered a year ago0That route 53 article reflects that AWS EC2 still doesn't allow rDNS for EC2 IPv6 address space, which is frankly embarrassing.CommentShareAWS-User-4644975answered a year ago0I run hosting platforms like Plesk and Cpanel on AWS and the inability to set reverse DNS for IPv6 addresses prevents them from being used for mail servers completely. It's already good practice to set a proper reverse dns entry for mail servers but Google especially rejects all mails from IPv6 addresses without a reverse entry. Please add my vote for a feature request too.CommentSharePSi_101answered a year ago0I have a feeling like this has something to do with the fact that the Elastic IPv4 IPs you can get PTR records for are a paid service, whereas the IPv6 addresses just work without having to pay for them, and AWS have no real incentive to do the extra work for free.So, before realizing that this would be an issue, I have recently upgraded my mail service and everything works with IPv6, but I have to disable it, again, because otherwise I won't be getting mails, because mail servers out there will be refusing to cooperate without the DNS PTR Record (whenever they happen to prefer IPv6 which is the increasingly common case.)Is the only way, really, to buy my own IPv6 CIDR and register it with a VPC? (and then have an appropriate reverse-mapping zone on a DNS server of my own somewhere?) ... I don't even dare start thinking about how expensive it would be to acquire a block of IPv6 addresses.Maybe it could actually be an AWS business model to act as an LIR, register small IPv6 ranges for me with RIPE. Apparently I could already bring my own range (if I were a big company and had one), so there must be ways to advertise the routing from the VPC. Maybe if that were affordable, I would roll the DNS, myself.CommentSharecharly4711answered 6 months ago0It appears that reverse entries for IPv6 are now available via support requests, although they got ours wrong the first time and every message had to go through a robot-like 1st level support team that responded to everything with "we have forwarded this advanced request to a specialist team" or words to that effect.Anyways, traffic through AWS-hosted IPv6 ranges is already a paid service, and so are the virtual servers that IPv6 addresses can be assigned to.  Automating the process should significantly reduce the cost of handling this.  Besides automating the entry of requests, another important thing to automate is the following rule (derived from the specifications of the PTR record type, but apparently not explicit in any RFC):For any customer-requested PTR record, an AWS automation script should:Check that a single forward record of the corresponding type (A or AAAA) exists and matches for the customer-requested PTR value.  Records for the other type (AAAA or A) should be ignored.Set the TTL of the PTR record no higher than the remaining TTL returned by the automated check for the forward record, but also no higher than the remaining time on the customer contract for the VPC containing the IP address.Automatically repeat steps 1 and 2 when about 25% of that TTL remains.If the forward entry goes away or fails, temporarily remove the PTR entry, and notify the customer by automatic email, but keep the PTR entry it in the retry database for 1 week after the e-mail in case the forward entry is restored by the customer.Example:Customer request: "2001:db8:1234:5678::2 PTR mail1.example.com"Matching forward records in customer-controlled DNS domain (the A records are not relevant to IPv6 PTR records):mail1.example.com. 86400 IN AAAA 2001:db8:1234:5678::2mail1.example.com. 86400 IN A 192.0.2.2mail1.example.com. 86400 IN A 192.0.2.12Forward record from DNS cache at AWS HQ:mail1.example.com. 35400 IN AAAA 2001:db8:1234:5678::2Resulting PTR record in AWS owned DNS:3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.7.6.5.4.3.2.1.8.d.b.0.1.0.0.3.ip6.arpa. 35400 IN PTR mail1.example.com3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.7.6.5.4.3.2.1.8.d.b.0.1.0.0.3.ip6.arpa. 35400 IN LOC $LocationOfDataCenter_rounded_to_nearest_degree_thus_hiding_secret_street_addressFailure of step 1 would  have caught the mistake in manually processing our request.The structure of the above 4 steps would also keep the AWS DNS clean from stale PTR records from removed customer services.An example of rounded LOC coordinates for the Doppler building would be "48 N 122 W 0m 90m 100000m 1000m" indicating that each building in that AWS location is about 90m wide, somewhere in the Seattle area and not on top of a mountain (server is less than 1600ft above the GPS zero altitude).CommentShareAWS-User-4644975answered 6 months ago0Will AWS hand over ip6.arpa to our /64s delegated in our VPCs?  That way we can control our own ip6.arpa and not have to wait 3-5 days for every PTR request?CommentSharerePost-User-2918011answered 6 months ago"