Question: High cost in NatGateway bytes

"Hello Eveyone,We found in Cost Explorer a large amount of data recorded in the metric USW2-NatGateway-Bytes in a single day. About 10TB. This is absolutely unusual and I would like to find the source and destination of all this traffic.So I created a CloudWatch dashboard of all my EC2 instances and configured it with various parameters in hopes of finding something that would show the source of the problem.So far no parameter used has shed light on the issue and I still haven't figured out what happened.I would like your help to try to identify where all this traffic came from.Thank you!FollowComment"

Answer: "2Hi ThereIn addition to Tushar's answer, here is a Premium Support article that will walk you through determining the top talkers through your nat gateway after you enable VPC Flow Logshttps://aws.amazon.com/premiumsupport/knowledge-center/vpc-find-traffic-sources-nat-gateway/If you did not have VPC flow logs turned on when the incident occurred, you might be able to find something by examining you EC2 instance CloudWatch metrics, particularly NetworkOut and NetworkIn for that particular day, but this may not be accurate because it will show ALL traffic in/out of the instance including to other instances and other AWS services.Also take a look at this article after you determine the source for some suggestions on how to remediate and monitor in the futurehttps://aws.amazon.com/premiumsupport/knowledge-center/vpc-reduce-nat-gateway-transfer-costs/CommentShareEXPERTMatt-Banswered 5 months agoKallu 5 months agoWithout any idea of what is going on in the VPC, my first guess would be that extra traffic is S3 uploads and/or downloads and there is no S3 gateway endpoint in VPC, but traffic goes from private subnets to NATGWs and then out to internet where S3 public endpoint is.ShareTarcisio M 5 months agoThanks for your message, Matt-B. We didn't have the vpc log flow enabled so I'm trying my luck using CloudWatch data. The articles you sent were very handy, thank you!Share1You will need to enable VPC Flow Logs With additional Meta-Data such as below to find out the original Source and Destination IPs:pkt-srcaddr : the packet-level IP address of the source. You typically use this field in conjunction with srcaddr to distinguish between the IP address of an intermediate layer through which traffic flows, such as a NAT gateway.pkt-dstaddr : the packet-level destination IP address, similar to the previous one, but for destination IP addresses.Reference: https://aws.amazon.com/blogs/aws/learn-from-your-vpc-flow-logs-with-additional-meta-data/CommentShareEXPERTTushar_Janswered 5 months agoTarcisio M 5 months agoThanks for your message, Tushar J. Unfortunately, VPC flow logs was not enabled until we find the issue. The article you sent was very useful, thank you!Share"


Question: Create Campaign: Always use latest version of segment?

"Templates and Segments are both versioned. When creating a Campaign, it's possible to use the latest ("ACTIVE") version of a Template, but it seems that functionality is not available when selecting the Segment.I.e. You are forced to specify a Segment version, and there is no way for subsequent changes to the segment to be automatically picked up by dependent Campaigns.Is my understanding correct?TIAFollowComment"


Question: How to add a CodeBuild report for failsafe JUnit tests?

"For my integration tests that are run by the failsafe Maven plugin, I added the section "IntegrationReports" in my buildspec file:reports:  SurefireReports: #surefire junit reports    files:      - '**/*'    base-directory: 'target/surefire-reports'  IntegrationReports: #failsafe junit reports    files:      - '**/*'    base-directory: 'target/failsafe-reports'The surefire reports are generated as expected but for the failsafe the build is failing with a message similar to this:CLIENT_ERROR: Error in UPLOAD_ARTIFACTS phase: [IntegrationReports: [error processing report: [/codebuild/output/src415328417/target/failsafe-reports/failsafe-summary.xml: expected element type <testsuite> but have <failsafe-summary>]]]The failsafe-summary.xml is generated by the Maven plugin maven-failsafe-plugin version 3.0.0-M8:<?xml version="1.0" encoding="UTF-8"?><failsafe-summary xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://maven.apache.org/surefire/maven-surefire-plugin/xsd/failsafe-summary.xsd" result="null" timeout="false">    <completed>9</completed>    <errors>0</errors>    <failures>0</failures>    <skipped>0</skipped>    <failureMessage xsi:nil="true" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"/></failsafe-summary>Is there a way to show these reports?FollowComment"

Answer: 0Accepted AnswerThe solution is actually simple: all I needed to do is eliminate the failsafe-summary.xml file from the list of reports.The relevant buildspec fragment becomes:reports:  SurefireReports: #surefire junit reports    files:      - '**/TEST*.xml'    base-directory: 'target/surefire-reports'  IntegrationReports: #failsafe junit reports    files:      - '**/TEST*.xml'    base-directory: 'target/failsafe-reports'CommentSharerePost-User-9103684answered 4 months ago


Question: Lightsail WebPortal got error: The maximum API request rate has been exceeded for your account

"Lightsail WebPortal got error:The maximum API request rate has been exceeded for your account. Please try your request again shortly. For best results using the Lightsail API, use an increased time interval between requests.And that all my instance is gone 😥😥😥.How can i fix it. Thank you.FollowComment"

Answer: "0Hello, these error messages indicate a temporary issue retrieving data about your Lightsail resources. The service is fully available at this time so you should be able to see your resources again.CommentSharedonleyatawsanswered 7 months ago"


Question: How to transcribe a call with AWS transcribe API ?

"I got this error when I'm trying to transcribe a call:Account isn't authorized to call this operation. Check your account permI think the bad property is DataAccessRoleArn, I tried to create new role on IAM console, but it does not work.Here's the full PHP code:<?phprequire 'vendor/autoload.php';use Aws\TranscribeService\TranscribeServiceClient;$awsKey = "{awsKey}";$awsSecretKey = "{awsSecretKey}";$clientAWS = new TranscribeServiceClient([    'region' => 'eu-west-3',    'version' => 'latest',    'credentials' => [        'key' => $awsKey,        'secret' => $awsSecretKey    ],]);$result = $clientAWS->startCallAnalyticsJob([    'CallAnalyticsJobName' => 'Transcript1', // REQUIRED    'ChannelDefinitions' => [        [            'ChannelId' => 0,            'ParticipantRole' => 'AGENT',        ],        [            'ChannelId' => 1,            'ParticipantRole' => 'CUSTOMER',        ]    ],    'DataAccessRoleArn' => 'arn:aws:iam::{id}:role/AWSRole', // REQUIRED    'Media' => [ // REQUIRED        'MediaFileUri' => 's3://{bucketName}/2022/02/23/file.wav',        'RedactedMediaFileUri' => 's3://{bucketName}/2022/02/23/',    ],    'Settings' => [        'ContentRedaction' => [            'RedactionOutput' => 'redacted', // REQUIRED            'RedactionType' => 'PII', // REQUIRED        ],    ],]);print_r($result);Do you know how to fix role issue?Thank you in advance,J.FollowComment"

Answer: "0Accepted AnswerFor fixing this issue, you have to:Select a region compatible (in my case eu-central-1)Create a new role with AmazonS3FullAccess policy (just for testing, adjust for security) and this trust entity:{     "Version": "2012-10-17",     "Statement": [         {             "Effect": "Allow",             "Principal": {                 "Service": "transcribe.amazonaws.com"             },             "Action": "sts:AssumeRole"         }     ] }Attach AmazonTranscribeFullAccess and AmazonS3FullAccess policiy to your IAM user (just for testing, adjust for security)CommentShareAWS-User-7039541answered a year ago0There are two pieces of permissions that you have to consider here.Your access key and secret key must have permissions to run the command startCallAnalyticsJobThe analytics job must be able to access the data it needs using the role DataAccessRoleArn.From the error message, it appears that (1) is the issue. Do the keys that are running this command have the permissions to run startCallAnalyticsJob on that specific job Transcript1? This would either be a role that your user has assumed, or your actual IAM user itself.If that doesn't solve the problem, then you would want to make sure that the DataAccessRole has a trust relationship with Transcribe, such that transcribe is allowed to assume that role with access to the right objects in your S3 Bucket. Take a look at how to update the trust relationship for a role here . This guide also walks you through creating it if needed.The role would look something like:{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "Service": "transcribe.amazonaws.com"            },            "Action": "sts:AssumeRole"        }    ]}CommentShareShaffer-Morrisonanswered a year agoAWS-User-7039541 a year agoThank you for your response. For testing I tried to attach this strategy to my user:{"Version": "2012-10-17","Statement": [{"Sid": "VisualEditor0","Effect": "Allow","Action": ["s3:","transcribe:"],"Resource": "*"}]}But I get the same error.Here's the role used by DataAccessRoleArn property:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"Service": "transcribe.amazonaws.com"},"Action": "sts:AssumeRole"}]}Thank you again.ShareShaffer-Morrison a year agoYour policy is missing a tiny detail. In the Action section, it should read s3:* and transcribe:* (with the star). Can you give that a try and see if it works? And is the whole error message what you posted above?{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action":                 "s3:*",                "transcribe:*"            ,            "Resource": "*"        }    ]}ShareAWS-User-7039541 a year agoI think, there was a bug when I pasted json, because the stars has been here.See: https://pastebin.com/fCP9wCFVHere's the full PHP error:Fatal error: Uncaught exception 'Aws\TranscribeService\Exception\TranscribeServiceException' with message 'Error executing "StartCallAnalyticsJob" on "https://transcribe.eu-west-3.amazonaws.com"; AWS HTTP error: Client error: POST https://transcribe.eu-west-3.amazonaws.com resulted in a 400 Bad Request response: {"__type":"BadRequestException","Message":"Your account isn't authorized to call this operation. Check your account perm (truncated...) BadRequestException (client): Your account isn't authorized to call this operation. Check your account permissions and try your request again. - {"__type":"BadRequestException","Message":"Your account isn't authorized to call this operation. Check your account permissions and try your request again."}' GuzzleHttp\Exception\ClientException: Client error: POST https://transcribe.eu-west-3.amazonaws.com resulted in a 400 Bad Request response: {"__type":"BadRequestException","Message":"Your account isn't authorized to call this operation. Check your account perm (truncated.. in /Users/J/PhpstormProjects/dev/vendor/aws/aws-sdk-php/src/WrappedHttpHandler.php on line 195Thank you so muchShareShaffer-Morrison a year agoHmm, I would recommend starting simple and trying out some other SDK calls first, such as s3 ls command, and then maybe some more basic transcribe commands to see if they get the same error message.Are you part of an AWS Organization? It's possible that you could be getting rejected due to service control policies (https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html)  that might limit your account from being able to use the transcribe service.ShareAWS-User-7039541 a year agoI tried with the CLI (with same access and secret keys) thoses commands:aws s3 ls s3://mybucketnameIt works.But with this command I get an error:aws transcribe start-call-analytics-job --call-analytics-job-name MfTranscript1 --media MediaFileUri=s3://mybucketname/file.wav --data-access-role-arn "arn:aws:iam::{id}:role/AWSRoleTranscribe" --channel-definitions '[{"ChannelId": 0, "ParticipantRole": "AGENT"},{"ChannelId": 1, "ParticipantRole": "CUSTOMER"}]'An error occurred (BadRequestException) when calling the StartCallAnalyticsJob operation: Your account isn't authorized to call this operation. Check your account permissions and try your request again.I have no AWS Organization. But can I use the eu-west-3 (Paris) region?Thank youShareShow 3 more comments"


Question: Generate presigned url for S3 Object Lambda

"Recently S3 Object Lambda got released, which I think is really cool. I have a working setup where I can use retrieve an object via the get_object BOTO3 method with the S3 Object Lambda. Also generating a presigned url directly on the bucket works. But when I try to generate one for the S3 Object Lambda as follows:url = s3.generate_presigned_url("get_object",  Params={"Bucket": "arn:aws:s3-object-lambda:eu-west-1:account-id:accesspoint/my-object-lambda","Key": "filename.txt",})I get the error:<?xml version="1.0" encoding="UTF-8"?><Error xmlns="">MissingAuthenticationToken<Message>Missing authentication token.</Message><RequestId>REDACTED</RequestId><HostId>{host-id}</HostId></Error>  Is this not supposed to work (yet)?Edited by: Paulvdb on Mar 31, 2021 11:17 AMFollowComment"

Answer: "1Accepted AnswerHi Paulvdb,Glad to hear you're enjoying S3 Object Lambda.  I believe Boto3 defaults to using Signature Version 2 when presigning requests.  Can you try setting the signature version to SigV4 when creating the S3 client to see if that helps?Something like:s3 = boto3.client('s3', config=Config(signature_version='s3v4'))CommentShareAWS-User-6108294answered 2 years ago0I can confirm that this is the case. Interestingly, if you generate a presigned URL from the CLI (V2), it will automatically default to using Sigv4. The AWS documentation on this seems to be out of date and does not include the updated signature version needed: https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html.What is up to date is this guide here explaining in more detail how to generate the presigned URLs with the updated signature version: https://howtocloud.io/generate-s3-presigned-urls-with-boto3/.Kudos to the first user for including the exact same code snippet that I gave to another user who was debugging.CommentSharegrahamschuckmananswered a year agokennyaws a month agoThe AWS CLI V2 does not support Sigv2. This is noted as a breaking change in the AWS CLI v2 migration guide under the section "AWS CLI version 2 uses only Signature v4 to authenticate Amazon S3 requests":https://docs.aws.amazon.com/cli/latest/userguide/cliv2-migration-changes.html#cliv2-migration-sigv4The Python SDK boto3 still uses older signing methods by default with presign commands for backwards compatibility.Share0I was able to create presigned url using Lambda with boto3, but was no able to download the file using generated URL,got Access Denied error, fix was to add lambda IAM permission : "s3:GetObject"CommentShareADV-ITanswered 10 months ago"


Question: Monthly instace RDS db.t4g.small price much higher than expected

"I created a RDS Postgres db.t4g.small instance without Proxy with 100Gb of storage and, after the first month, the costs are much higher than estimated by the calculator (estimated: about $40, actual: $228) . Instance utilization was very low (6% cpu average).What parameter am I leaving out in pricing or configuring the instance?FollowComment"

Answer: "0Have you considered the backup storage cost ?CommentSharekarananswered a month agofederico-mostaza a month agoHi karan, yes but the db size is less than 5Mb for nowShare0Federico, you mentioned 100Gb of storage, it does not matter the actual size of the DB used by you, the cost is calculated based on the instance hours(on demand) + the storage + any db backup(storage) you have created.If you have a very small DB, I would suggest that you downsize your instance to a free tier, it will give you 750 hours of Amazon RDS and 20GBCheck out this link for more infohttps://aws.amazon.com/rds/free/CommentShareOthnajidanswered a month ago"


Question: "How to use IAM users, groups and roles with SSO"

"My organization has no AD nor any IdP that can be used to link AWS SSO to.I see that the SSO identity store has no cf/cli/api feature to manage users.Is there a way to use IAM users, goups and roles in the root account to log into the other organization accounts?If so, how to?FollowComment"

Answer: "2You can log into the member accounts from the root account by Switch Role. Of course, you need to attach proper permission to the IAM users, goups and roles in the root account.If Organizations not Control Tower, the role "OrganizationAccountAccessRole" in default is assigned to the member accounts. If Control Tower, "AWSControlTowerExecution" is assigned.In this use case, the root account is often called as jump account. However, for example In production, It is better to use another account not the root account as jump account for separating permissions from the root account.https://aws.amazon.com/premiumsupport/knowledge-center/organizations-member-account-access/https://docs.aws.amazon.com/controltower/latest/userguide/roles-how.htmlCommentSharesuzukianswered a year ago"


Question: Distinguish Redshift Spectrum from Redshift Costs

"Can Redshift Spectrum costs be distinguished from Redshift costs at billing time?A customer has been a user of Redshift for the past year, and are now moving to use Redshift Spectrum more. They are trying to determine how to analyze how much of their monthly Redshift costs are attributed to Spectrum.Thank you for any insight you can provide.FollowComment"

Answer: "0Accepted AnswerRedshift billing is independent of any cost that may incur due to querying S3 data using Redshift spectrum. When customer queries S3 data using Redshift Spectrum it involves- 1) spinning up compute environment which are part of the Spectrum managed fleet and is complete transparent to customers. These fleet of servers are taken from hot pool of servers managed and maintained by the Redshift service. Customers do not pay for these servers as they are baked into Redshift pricing- both on demand as well as RI pricing. 2) Scanning and retrieving the requested data from s3.The only cost that customers need to pay for quering S3 data via Redshift SPectrum is the s3 scanning cost. And the cost is $5 per TB data data scanned. AWS Billing has added the feature to drill down API operations by Service. Yes customers can retrieve the Spectrum cost from the Cost Explorer by filtering out Service = Redshift and group by API Operations and look for the line item "DataScannedInTB ($)". This will provide the cost incurred by Redshift Spectrum. On the contrary if customers filter by S3 and hoping to find the DataScannedInTB there to extrapolate Spectrum cost, it will be incorrect. Hope this helps.You can check the https://aws.amazon.com/redshift/pricing/ page for pricing associated with Redshift Spectrum.CommentShareAWS-User-9244242answered 5 years ago"


Question: WorkDocs client on MAC shows 500gb capacity for users with UNLIMITED quota.

"I am using WorkDocs to store my files in the cloud. I need to upload a large chunk of files and it failed today. I looked at the drive info on my Mac, and it says the size is 500gb. The user is set up as an admin user with UNLIMITED storage.  Why is this happening and how can I resolve it?  I have seen a post saying that the workdocs size is set to the same size as the OS drive where you have the client installed. Why in the world would this be set this way? I am using WorkDocs to store data I do not want taking up space on my laptop, so it surely could be more than the local hard drive capacity.  Sounds like this is a known issue, when will it be resolved or do I need to research other solutions for my cloud storage?FollowComment"


Question: Best practices of reading messages from a Kafka topic and putting it into S3

"Hi AWS,What is the best practices during the process of reading messages from topic and putting into S3, will there be a rare condition where the message can be missed or not posted due to some unknown error ?. In this case can we use a kafka topic in between the compute that would be reading from and posting it to S3— what is the pros and cons here?So even if a record is missed that can be fetched later also we do not need a second custom application assuming AWS kafka-S3 sink connect ?FollowComment"


Question: How to use lightsail instance snapshot and point it to different IP

"Hi there,I took a snapshot of an instance to deploy it on a new instance which I did but whenever I write out the IP address of the new instance and adding :2087 as the port it takes me to my old instance console login (I use cpanel).My goal is to enter the new instance to extract a database file and then terminate the new instance.Would love to get some help to solve this issue.Thank you!FollowComment"

Answer: "0Did you try a different browser and/or private mode? You might have been seeing cached info?CommentShareJohn Voldanswered a year agoSoftsimple a year agoThat's not the issue the problem related to computer networking I need to fix it.Share0You need to access the new instance using the IP address that is assigned to it. When you create a new instance from a snapshot, it's not given a static IP.CommentShareDavid Ganswered a year agoSoftsimple a year agoI assigned a new static IP address and changed the hostname file, I don't have a lot of knowledge in computer networking if I did I would probably solve this problem quick, will try more stuff.Share0I need an answerCommentShareSoftsimpleanswered a year ago"


Question: SES: How do I "contact my AWS Account Manager to request an increase"?

"I'm using Amazon SES, and I'd like to increase my recipient quota from 50 to 200. The documentation (https://docs.aws.amazon.com/ses/latest/dg/quotas.html) says I need to contact my account manager to request an increase.I opened a support case, and got a message that read in part: "...The channel you have contacted is for Amazon Simple Email Service limit increase requests. Therefore, I cannot provide technical support through this channel"That sounds like exactly the place I should ask for a limit increase, but they directed me here instead. Has anyone successfully gotten a recipient quota increase in SES? If so, how?Thanks All!FollowComment"

Answer: "0How did you open the case? Did you go through AWS Console --> Service Quotas ->> Amazon Simple Email Service(Amazon SES) and asked to adjust the quota?CommentShareNikoanswered 3 months ago0Yes, that's exactly what I did.Edit: the Service quota page only allows you to open tickets for sending quota or sending rate, not the recipient quota. I therefore opened a more general ticket asking for the increase, referencing the URL I posted above.CommentShareBobojonesanswered 3 months ago0Disambiguation of some event types (asynchronous bounces, spam complaints, opens, clicks) for each recipient is not possible because all recipients will have a copy of the message with the same message-id. It is better to send to one recipient at a time to achieve the highest accuracy, resulting in more more accurate list hygiene and engagement metrics. There is no cost benefit of sending to more than one recipient destination in a single API call.CommentShareJesse_Tanswered 2 months ago"


Question: Update existing MySQL database to Optimized Writes?

What are the options to update an existing database (one that predates Optimized Writes) to support Optimized Writes?Our database is currently running MySQL 8.0.26. What sequence of steps would we need to perform? And is there an option that utilizes blue/green deployments?FollowComment

Answer: "1We have a similar issue too.RDS (r6g, MySQL 8.0.31) created before Optimized Writes become available and currently during instance restart log shows:"The database is using the doublewrite buffer. RDS Optimized Writes is incompatible with the storage configuration. For more information, see the RDS Optimized Writes for MYSQL documentation."However, instance matches all conditions from the documentation and it's not possible to turn off innodb_doublewrite because it's not modifiable.So it seems it's not possible to enable Optimized Writes for existing instance.Looks like the only way to create a new instance and move all the data (or do it with replication).Maybe it's also possible to make a snapshot and restore from it to a new instance, not yet checked.CommentShareosaanswered 4 months ago0Optimized writes is automatically enabled when the following conditions are met.Optimize Writes will be available when the following conditions are metRDS for MySQL version 8.0.30 and higher.Use the following DB instance classesdb.x2iedndb.r6idb.r6gdb.r6gddb.r5bYou can only modify a database to turn on RDS Optimized Writes if the database was created with a DB engine version and DB instance class that support the feature. In this case, if RDS Optimized Writes is turned off for the database, you can turn it on by setting the rds.optimized_writes parameter to AUTO.When you are restoring an RDS for MySQL database from a snapshot, you can only turn on RDS Optimized Writes for the database if all of the following conditions apply:The snapshot was created from a database that supports RDS Optimized Writes.The snapshot is restored to a database that supports RDS Optimized Writes.The restored database is associated with a parameter group with the rds.optimized_writes parameter set to AUTO.Doc: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-optimized-writes.html#rds-optimized-writes-limitationsAnd blue/green deployments can be used when upgrading minor MySQL versions.CommentSharehayao-kanswered 5 months agoAWS-User-8949122 5 months agoThis isn't correct.Applying this configuration to an existing RDS instance that predated the release of Optimized Writes does not automatically enable it on the instance. The above criteria only apply to new instances.Sharehayao-k 5 months agoThank you for your comment. You are correct and I have revised my response.Share"


Question: AppStream 2.0 Client URL

"I'm testing AppStream2.0 desktop client to connect to a stack that integrated with AWS SSO. Apparently I can't put the SSO URL & the only option is to use the Appstream URL. If I copy the application URL which I get after login to the SSO (sample : https://appstream2.ap-southeast-1.aws.amazon.com/#/reserve?reference=fleet%2FOsakaFleet-AlwaysOn), the client throw 404 error.Is there any specific way to use AS2 client with SSO-based Appstream stack?FollowComment"

Answer: "0Accepted AnswerBy default (without any additional configuration), the AppStream 2.0 (AS2) native client only supports streaming URLs or the User Pool login page. This is to prevent end users from using the AS2 client as a mini-browser. Admins have 3 options for enabling other URLs/domains for their end users (for example, AWS SSO or other SAML IdPs):(HKLM registry key) StartURL - Single URL that is the default value when the user launches the native client. The value would be that of your SSO portal.(HKLM registry key) TrustedDomains - A comma-separated list of domains that are acceptable for your user to enter into the native client text box. The value would be that of your SSO portal. Your user would then be able to manually enter this value when they launch the native client.(DNS TXT record) Trusted domain - A DNS TXT record that enables that domain/subdomain without any user-side configuration changes.You can learn more about all 3 of these here: https://docs.aws.amazon.com/appstream2/latest/developerguide/install-client-configure-settings.html#access-appstream-with-client.If I copy the application URL which I get after login to the SSO (sample : https://appstream2.ap-southeast-1.aws.amazon.com/#/reserve?reference=fleet%2FOsakaFleet-AlwaysOn)This is not a valid direct access URL. AS2 only supports IdP-initiated federation, so the URL that needs to be entered is that of AWS SSO - either the catalog URL.CommentShareEXPERTMuraliAtAWSanswered 3 years ago"


Question: Can you encrypt an existing unencrypted Amazon Redshift snapshot?

I wasn't able to find a way to encrypt an existing unencrypted Amazon Redshift snapshot. Is it possible?FollowComment

Answer: "0Accepted AnswerNo, Amazon Redshift snapshots are encrypted together with the data at the same time your Amazon Redshift cluster is encrypted. However, you can encrypt a previously unencrypted cluster, but only the subsequent snapshots will be encrypted.For more information, see [Encrypt your previously unencrypted Amazon Redshift cluster with 1-click] (https://aws.amazon.com/about-aws/whats-new/2018/10/encrypt-amazon-redshift-1-click/). Also,  Amazon Redshift database encryption in the Redshift cluster management guide.CommentShareEXPERTFabrizio@AWSanswered 4 years ago"


Question: My Production Access request was denied without any real reasons.

"Hello to you.I am interested, why my request was not approved and how could support found that my using of SES could have a negative impact on your service? Is there some real reasons?!My case ID :9472281271FollowComment"

Answer: "-4Hi, You can check the reason from below link :https://repost.aws/questions/QUO1mCvTNXQFOKYOJPTsM4_w/our-request-for-production-access-is-getting-deniedCommentShareJigar Shahanswered a year agoAWS-User-7894085 a year agoAre you kidding?, Our account is secure, our domain is clean and spam-free, our billing information is also correct and only used by us.  We paid $100 for a business plan and got treated like this, it's terrible.Share"


Question: AWS VPN NAT alternative

"Our standard deployment when we setup VPN with a customer require us to use NAT between our subnet and the customer’s subnet . We need to be independent regardless to the subnets that the customer use and we don’t want to extend our customer networks / subnets to our AWS Tenant Account ,therefore we will need to setup NAT between our internal network and the customer network . This appears to be not supported with AWS VPN and does not seem to be on roadmap. What are some alternatives or workaround that can be used?FollowComment"

Answer: "1Depending upon the level of connectivity required, a VPC endpoint(s) may work if you only need to expose a couple of host/services.  https://docs.aws.amazon.com/vpc/latest/privatelink/endpoint-service.htmlCommentSharePeteranswered a year ago"


Question: Can I assign one elastic IP to different subnets that are residing on different availability zones but same aws region?

"I was trying to create a network loadbalancer that maps to different subnets that are in different availability zones , however it keeps saying "Allocation 'elasticipID' can be used for one subnet only". How can I solve this issue, thanks!FollowComment"

Answer: "1Accepted AnswerYou will need to have one Elastic IP per each subnet/availability zone. Please refer to the following documentation.Note: Be sure to create the same number of Elastic IP addresses as the number of subnets that you select in each Availability Zone. For more information, see Elastic IP address limit.How do I attach an Elastic IP address to new or existing internet-facing Network Load Balancers?CommentShareTaka_Manswered 6 months agoEXPERTTushar_Jreviewed 6 months ago"


Question: AWS Account suspended

Why my aws lightsail account is suspended ? My account is not payment due.FollowComment

Answer: "0Hi,according to this: https://repost.aws/knowledge-center/reactivate-suspended-accountIf your account has no past due charges, then check the email address associated with the AWS account. AWS sends a notification and instructions to the registered email address on the account if your account is suspended for another reason. If you’re not sure why your account was suspended, contact AWS Support for help.Hope it clarifies.CommentShareEXPERTalatechanswered 2 months agoEssential First 2 months agothank you I have already contacted the AWS support team. So far they haven't done anything to make me feel comfortable.Share"


Question: "Can Comprehend Events say if the event happened, and if it is in the past or the future?"

I see Comprehend has an event detection API https://docs.aws.amazon.com/comprehend/latest/dg/how-events.htmlIs it capable of saying if the event happened ? or didn't happen? Or is in the future?FollowComment

Answer: "0HiLike AWS Textract, Comprehend can work in asynchronous mode. Launch "StartEventsDetectionJob" and the response will give back a 200-response if successful.Then just retrieve the jobid and the arn.++CommentShareJack-Angel-369answered a year ago"


Question: Drag & drop deployment stopped working

Amplify Console in Ubuntu 18.04 & Chrome browser: Manual deployment using Drag & drop stopped working 4-Aug-2020. 100% reproducible. Stuck in 'Retrieving deployment details...'.Works OK in the same environment when using S3 bucket.Are there any changes to Amplify Console deployment requirements between 3-Aug and 4-Aug? Or any other reason preventing Drag & drop deployment now?FollowComment

Answer: "0Hi, I just checked and drag and drop deployment works for me in us-west-2. Which region are you seeing the issue? Please provide a sample zip file that reproduces the issue as well.CommentShareAWS-User-5020802answered 3 years ago0I used eu-west-1 and eu-north-1.I did not use zip file but drag&drop build output directory. For S3 deployment I used zip file and it worked same time same configuration.However, when testing with same configuration today in eu-north-1 I see drag&drop work OK. Also see that yesterday stuck deployment is now completed.So what did not work 4-Aug and 5-Aug seem to working now as earlier and expected => ISSUE SOLVED.CommentShareartnanswered 3 years ago0Drag and drop deployment in amplify has stopped working for me in eu-west-1. The webpage says deployment is ok, but the website is not updated.CommentSharethomasflanswered a year ago"


Question: Error message: Undelivered Mail Returned to Sender

"Hi,I am using WorkMail with Outlook 2010 to send mails to my clients.It worked fine since past 2 months.But since 2 days ago, I got error message as below:======================Unfortunately, the system was unable to deliver your mail.The error given was:2019-01-17 03:40:42 : You are currently not allowed to send this e-mail. Please try again later.You may need to contact your e-mail administrator to solve this problem.The mail address I sent are all valid.I got around 30 mails from 300-350 mails.When I receive this message, I have to mark them one by one from my list, and wait to next day and resend the 30 mails again.It is too troublesome and double work for me.Please help.  Why is this happening?JohnnyFollowComment"

Answer: "0Hi Johnny,I'm sorry to hear you're experiencing problems sending mail. This bounce message is the results of exceeding the daily mailing quota. But if you only sent ~350 you should not get this message.I will forward this case to the service team for investigation.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 4 years ago0Hi Robin,Thanks for your reply.What is the daily mailing quota, 5000 mails?I did not send so many mails, and I sent mails through WorkMail & SES without problems 2-3 months ago.Now it does not work so well.https://imgur.com/JPI5Ipahttps://imgur.com/QgkzXyKPlease help.CommentShareJohnnyLeeanswered 4 years ago0Hi Johnny,The WorkMail limits can be found on this documentation page: https://docs.aws.amazon.com/workmail/latest/adminguide/workmail_limits.htmlThe service team is investigating the issue and I will update you once I know more.Sorry for the inconvenience this is causing you right now.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 4 years ago0Hi Johnny,The service team is still investigating the problem but to unblock you they have manually increased your limit so you should be able to send at least 10k emails per day.I will update you with more information once I have that from the service team.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 4 years ago0Hi Johnny,I got another update from the service team, they have identified and correct a bug.We're sorry for the inconvenience this has caused.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 4 years ago0Hi Robin,Thank you very much for your help, it works fine now.JohnnyCommentShareJohnnyLeeanswered 4 years ago"


Question: DeepLens HW v1 Registration Failed

"Hi,I registered my DeepLens HW v1 several times already and I still get the same result when in the AWS console: registration status failedI have no idea why this is happening since I am following the exact steps in the official documentation.No answers about such issues were provided here, this is why I am posting this question. What might be the reasons behind the registration failing? I did upload the certificates, provided the roles needed, connected the camera to the internet...The documentation only request me to repeat the registration again, but I've been doing this many times already and nothing was solved. Please help!Thanks.FollowCommentChris_P a year agoMy initial thoughts would be to make sure all the firmware and software is up to date. Make sure the device isn't previously registered to another account. If you are the original owner, I would still deregister the device and then try to register again. If you aren't the original owner, the previous owner may not have deregistered the device.ShareAWS-User-7357456 a year agoHi Chris_P,Yeah, my DeepLens device is renewed one. How will I deregister the device and then try to register again without original owner permission.Share"

Answer: "0I ran into the same problem and this is what I did:de-registered the device with failed registration statusattached a keyboard and  monitor to the camera and logged in using the password I created during the initial registration attempt (if you haven't set that password then the default should be aws-cam)opened cmd on the camera and ran the below commands to update it:sudo apt-get updatesudo apt-get install awscamsudo rebootOnce the camera was rebooted, I inserted a pin in the reset hole in the cameradid the registration process all over again and it was successfulCommentSharenetbug123answered a year agoAWS-User-shree a year agoThis approach is not working for me. The device doesn't go into reset mode after I reboot and insert the pin in the reset hole.Share"