Question: Polly Question regarding SSML settings

"I noticed that the Polly SSML "newscast" only works with two voices: Mathew,Male and Joanna, Female.  Is that correct or am I missing something?FollowComment"

Answer: "1Accepted AnswerYes, correct.The documentation states the following.https://docs.aws.amazon.com/polly/latest/dg/voicelist.html** These voices can be used with Newscaster speaking styles when used with the Neural format. For more information, see NTTS Newscaster Speaking Style.CommentSharehayao-kanswered 4 months ago"


Question: Optimizing AI/ML for Sustainability Workloads: Ask the Expert

"Ask the Expert - AWS Support You EventWelcome to the follow up discussion on "Optimizing AI/ML for Sustainability Workloads" Twitch event. If you missed live twitch event on June 20 at 11am Pacific, you can access the recording. If you have a question you'd like to see discussed during the live event, post a comment below. After the live event, you can continue asking questions until June 24.Machine Learning models are more and more complex and consume more and more energy. But AI is also a fantastic tool for mitigation of climate change. As builders, it’s our responsibility to develop Sustainable and Responsible ML models and to make sustainable use of AI.Join experts Francesco Penta, Louise Fox, and Benoitde de Chateauvieux to learn best practices to reduce the environmental impact of your Machine Learning workloads.Our AWS expertsFrancesco Penta is a Principal Cloud Support Engineer based in Dublin, Ireland. He loves helping customers solving hard technical challenges and architecting highly scalable and resilient infrastructures. Has a soft spot for automation and will never say no when someone asks to look at a packet capture.Louise Fox is a Technical Account ManagerLouise’s journey with AWS started, when she joined as a Cloud Support Intern in the Dublin office. While in Cloud Support, she worked with multiple security, storage and content delivery services. She has since moved to the Technical Account Manager role in Amsterdam, where she is working directly with a diverse range of customers, helping them build their businesses on AWS.Benoit de Chateauvieux is a Startup Solutions Architect at AWS, based in Montreal, Canada. As a former CTO, he enjoys helping startups build great and sustainable products using the cloud.Ask questions from Tuesday June 14 to Friday June 24 by using the "Answer" button- Please be sure to upvote answers if they helped you -FollowComment"

Answer: "1Accepted Answer@C_River: To calculate the Carbon Footprint of AWS services, you can use the new Customer Carbon Footprint Tool. It can help you track, measure, review, and forecast the carbon emissions generated from your AWS usage.https://aws.amazon.com/blogs/aws/new-customer-carbon-footprint-tool/https://aws.amazon.com/aws-cost-management/aws-customer-carbon-footprint-tool/CommentShareBenoit de Chateauvieuxanswered a year ago1@ZT: Thanks for this idea! We’re constantly getting feedback from customers on where they would like the next AWS Region and we have a list of locations that we are looking at. We're always re-evaluating and reprioritizing that list and we continue on our path to powering our operations with 100% renewable energy by 2025.CommentShareBenoit de Chateauvieuxanswered a year agoSUPPORT ENGINEERMonica_Lluisreviewed a year ago0I missed the twitch yesterday. I was wondering if there is a way to calculate the carbon print of AWS services and if there are tools and best practices.CommentShareC_Riveranswered a year ago0I live near Alicante and work for a Swiss company that has  many AWS Cloud customers that we manage. Now I find this topic super important and I have an idea. Amazon building , expanding warehouse in Alicante which has 320 sunny days a year. Why AWS dont want to build a datacenter here too. Near the coast the water wells are giving cheap salty water which not good for agriculture but perfect for cooling system, also constant wind near the coastline. Feel free contact me for more info.CommentShareZTanswered a year ago"


Question: Running Vitis 'hello world' example on F1 instance results in 'xrt_xocl::error'  what():  No devices found

"I've been working my way through a Vitis FPGA 'hello_world' tutorial here:https://github.com/aws/aws-fpga/blob/master/Vitis/README.mdI've gotten up to step 3, and attempted to run the program with:./hello_world ./vadd.awsxclbin...but this resulted in the following error:terminate called after throwing an instance of 'xrt_xocl::error'  what():  No devices foundAbortedAny ideas why I'm getting this? I'm using an f1.2xlarge instance running in ap-southeast-2b availability zone.One observation I had was that sometimes when I run ls -lh /dev/xfpga, I can see the device there. But on other occasions, this results in the following error:ls: cannot access /dev/xfpga: No such file or directoryI wonder if my issue relates to that?I did have a read of a suggested prior post:https://repost.aws/questions/QUPevEIRVGSP6MiHeQ_1Db0A/runtime-error-on-f-1-instance-xrt-error-no-devices-foundI think one suggestion there was to try running as the root-user, gave that a try, didn't help for me, same error.FollowComment"

Answer: "0@Deep_P:  Ok, I'll do so, and I'll elaborate on all my exact steps in detail, in-case it sheds any further light:I start up my EC2 instance (an f1.2xlarge in ap-southeast-2b)I ssh inI check systemctl status mpd and see it isn't running yetcd $AWS_FPGA_REPO_DIRsource vitis_runtime_setup.sh (this appears to run mpd service)I do a systemctl status mpd again, and I see:● mpd.service - Xilinx Management Proxy Daemon (MPD)   Loaded: loaded (/etc/systemd/system/mpd.service; disabled; vendor preset: disabled)   Active: active (running) since Wed 2022-01-05 22:50:50 UTC; 27s ago Main PID: 4117 (mpd)   CGroup: /system.slice/mpd.service           └─4117 /opt/xilinx/xrt/bin/mpdJan 05 22:51:00 ip-10-161-10-222.ap-southeast-2.compute.internal mpd[4117]: [0:0:1d.0] read 80 bytes out of 80 bytes from f...: 1Jan 05 22:51:00 ip-10-161-10-222.ap-southeast-2.compute.internal mpd[4117]: [0:0:1d.0] mpd daemon: request 10 received(reqS...32)Jan 05 22:51:00 ip-10-161-10-222.ap-southeast-2.compute.internal mpd[4117]: AwsDev: 0000:00:1d.0(index: 0)Jan 05 22:51:00 ip-10-161-10-222.ap-southeast-2.compute.internal mpd[4117]: [0:0:1d.0] write 524360 bytes out of 524360 byt...d 5Jan 05 22:51:00 ip-10-161-10-222.ap-southeast-2.compute.internal mpd[4117]: [0:0:1d.0] msg arrived on mailbox fd 5Jan 05 22:51:00 ip-10-161-10-222.ap-southeast-2.compute.internal mpd[4117]: [0:0:1d.0] retrieved msg size from mailbox: 40 bytes Jan 05 22:51:00 ip-10-161-10-222.ap-southeast-2.compute.internal mpd[4117]: [0:0:1d.0] read 72 bytes out of 72 bytes from f...: 1Jan 05 22:51:00 ip-10-161-10-222.ap-southeast-2.compute.internal mpd[4117]: AwsDev: 0000:00:1d.0(index: 0)Jan 05 22:51:00 ip-10-161-10-222.ap-southeast-2.compute.internal mpd[4117]: [0:0:1d.0] mpd daemon: request 11 received(reqS...24)Jan 05 22:51:00 ip-10-161-10-222.ap-southeast-2.compute.internal mpd[4117]: [0:0:1d.0] write 2112 bytes out of 2112 bytes to fd 5Hint: Some lines were ellipsized, use -l to show in full.cd $VITIS_DIR/examples/xilinx_2021.1/hello_world./hello_world ./vadd.awsxclbinOh, interesting, when I try it now this morning, it has worked fine, giving me this output!Platform Name: XilinxINFO: Reading ./vadd.awsxclbinLoading: './vadd.awsxclbin'Trying to program device[0]: xilinx_aws-vu9p-f1_shell-v04261818_201920_2Device[0]: program successful!TEST PASSEDI'm not quite sure why it decided to work this morning, perhaps someone has looked into the issue on the AZ and remedied something? If so, that's great, all fine on my end now :)CommentShareGurceanswered a year agoDeep_P a year agoGood to know. I'm glad it works now! Let us know if you have any more issues around this!Share0Hello,Could you try running:sudo systemctl restart mpdsudo journalctl -u mpdThe latter should show if mpd started correctly and your devices should work after that.Let us know if this doesn't work.-DeepCommentShareDeep_Panswered a year ago"


Question: cloudshell - ctrl-K interpreted as ctrl-L

"On my cloudshell instance, I did a 'sudo yum install kbd', which allowed me to use a command line tool called 'showkey'. This command line tool echos the key presses that it detects.Running it via 'showkey -a', so that I could use ctrl-d to exit from it, when I press the 'ctrl-k' key combination, to my bafflement, it echos that I just pressed the ctrl-L key instead!As a comparison, running 'showkey' on my local Ubuntu machine, it correctly showed that I pressed the 'ctrl-K' key.Why does this matter? Because I use ctrl-K to edit command lines. It typically maps to the Gnu readline's 'kill-line' (functioning as a kill to end of line).BTW, I've noticed this same bug/issue appearing on my Cloud9 environment as well, when I open up a terminal from within Cloud9.FollowComment"


Question: Cognito: Require Federated AD Group to be returned in Access Token

A customer is integrating Cognito with Ping to allow federation with Active Directory. The access token generated by Cognito is then passed to Istio to provide RBAC based on Istio policies to backend Java apps in AWS. These policies are based on the AD Group. When using Ping without Cognito they can take the AD Group (memberOf) that is returned as 'group' in the Ping response authorize the user in Istio and authorization completes successfully. When using Cognito the AD group is not present and they have not been able to find a method to include or inject it as a custom attribute.Is there a recommended method to allow for AD groups to be forwarded in the Access Token by Cognito? My initial assumption is that there would need to maybe be a mapping to a Cognito Group or an override in the Pre Token Generation Lambda Trigger?FollowComment

Answer: "0Accepted AnswerAs of today you can't add custom attributes to Cognito access token. You probably could achieve mapping AD groups to Cognito groups but I wouldn't recommend that, management would probably be unnecessarily complex and potentially error prone. Another way would be to see if customer could use id_token instead. You can map AD attributes to Cognito ones and those are included in id_token.CommentShareAWS-User-2851372answered 2 years ago"


Question: SLES for SAP workloads

"Hello,Can we use SLES for below scenarios of SAP workloadsSLES for DEV and QA Instances deployed in Single AZSLES for SAP Prod  application servers deployed in single AZ and replication to other AZ/Region using AWS elastic DRSLES for HANA DB(in AZ 1 and AZ2) . AZ 2 HANA instance configured for lean DR replicating using HSR.ThanksFollowCommentSunil_Y 8 months agoPlease clarify which SAP products you are referring to. Also, please share if the use case if for HA or DR or both? Mention RTO and RPO for HA  along with RTO & RPO for DR.Share"

Answer: "1Assumption: I am using your question is for SAP NetWeaver AS ABAP based application on HANA Database (eg ECC, S/4)SLES for DEV and QA Instances deployed in Single AZAnswer: Yes, this is how most Customers. Make sure your SLA is met with this design. See https://aws.amazon.com/compute/sla/SLES for SAP Prod application servers deployed in single AZ and replication to other AZ/Region using AWS elastic DRAnswer: You can do both ways. It depends upon your RTO & RPO plus the use case. Are you looking for a HA solution or a DR solution? Elastic DR service is primarily for cross-region DR use cases but technically it can be used in the same region across two AZs. Since the latency is very low between the two AZs in the same region, a better approach will be to distribute your application across AZs and also setup an ERS and HANA secondary node in the second AZ. You can automate the failover using SLES pacemaker cluster. But again, there isn't information provided here to provide a recommendation.SLES for HANA DB(in AZ 1 and AZ2) . AZ 2 HANA instance configured for lean DR replicating using HSR.Answer: Yes, you can do this if your HA RTO requirement is met. The secondary instance should still have enough memory to accommodate your row store table plus another 50GB for runtime. Also, adjust the HANA parameters to turn off table preloads.Refer to the following guide for more details:https://docs.aws.amazon.com/sap/latest/general/general.pdf#architecture-guidance-of-sap-on-awsCommentShareSunil_Yanswered 8 months agorePost-User-0382502 8 months agoHi Sky,  not sure If I was clear in asking the question.  my question is for all the three scenarios can we use SLES instead of SLES for SAPShare"


Question: Limiting outbound traffic to AWS Management Console or other consoles

"I've a network whose outbound traffic is strictly limited to a whitelist of sites or domains.I searched and couldn't find any documentation about how could I allow stations on this network to use AWS Management Console without allowing any arbitrary outgoing connections.Is there any minimal list of hostnames, domains or IP ranges - similar to https://learn.microsoft.com/en-us/azure/azure-portal/azure-portal-safelist-urls -  that I'd whitelist for this purpose?Thanks!FollowCommentAdrianB 6 days agoI have exactly the same question but haven't been able to find an answer yet. The issue is inconsistent access to the AWS console through our corporate proxy. There needs to be a whitelist of all possible top level domains. aws.amazon.com and amazonaws.com don't cover it.Share"

Answer: "1The consoles are all https://<region>.console.aws.amazon.com/ with a generic of https://console.aws.amazon.com/, which will redirect you to a region once you have selected one, or default to us-east-1.CommentShareRodney Lesteranswered 2 months agoVladimir 2 months agoThanks, Rodney, but the problem is that there's a huge number of other sites behind the scenes, reached by browser to retrieve JS, CSS files, images, to send API calls to. The partial list includes:https://<some-random-value>.cloudfront.nethttps://a.b.cdn.console.awsstatic.comhttps://cdn.assets.as2.amazonaws.comhttps://<region>.signin.aws.amazon.com (for some reason, sites for more than single region are accessed)https://portal.sso.<region>.amazonaws.comhttps://global.ccs.amazonaws.comhttps://global.console.aws.amazon.comhttps://global.help-panel.docs.aws.a2z.comhttps://phd.aws.amazon.comhttps://portal.sso.<region>.amazonaws.comhttps://prod.log.shortbread.analytics.console.aws.a2z.comhttps://prod.tools.shortbread.analytics.console.aws.a2z.comhttps://static.global.sso.amazonaws.comhttps://website.sso-portal.<region>.amazonaws.comAnd so on.It's hard to compile a complete list by tracking browser calls.I could whitelist whole domains like aws.amazon.com or amazonaws.com, but I want to avoid opening access to services of tenants hosted on AWS - as opposed to native services of AWS itself. For instance, if I whitelist cloudfront.net, I'll allow access to anyone's site behind CloudFront.Is there some way to distinguish between these two kinds of services?ShareRodney Lester 2 months agoAs you surmise, there is no unique IP range because CloudFront supports all tenants, and the console apps (it is not one application) are running in the overall EC2 IP range and are implemented using AWS Services. What is the particular concern?I've see the desire to only allow their people to access their account's services, so we suggest using an Identity provider with Multi-factor authentication, SAML federation, and IAM Roles, and well-defined IAM access (you can use source IP, i.e. your NAT from your corporate network as a condition) to regulate access. Note that the NAT restriction prevents support personnel from accessing remotely unless they connect to your corporate VPN.ShareVladimir 2 months agoWhat is the particular concern?We want stations on our network to reach only necessary sites, to avoid data exfiltration or stations' infection by malware.The same concerns that made Microsoft publish these instructions for Azure - https://learn.microsoft.com/en-us/azure/azure-portal/azure-portal-safelist-urls. I'm surprised a bit that Amazon didn't do it.Allowing users to sign into particular AWS accounts only is another issue. By the way, how can it be implemented? In Azure, this is called "tenant restriction" and is implemented by injecting an HTTP header "Restrict-Access-To-Tenants: <permitted tenant list>" into calls to their login service.:https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/tenant-restrictionsDoes AWS have something like this?ShareRodney Lester a month agoYou can use source IP to restrict access to the AWS services and console. See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_deny-ip.html. Typically this is the corporate NAT range. AWS console access is restricted through IAM. It is worth talking with your AWS account team to ask for this feature.ShareVladimir a month agoI'm NOT trying to limit who can sign into our AWS account.I'm trying to limit stations on a network behind my firewall, so that:their users would be able to sign into our AWS account via Management Console;their users WOULDN'T be able to sign into OTHER AWS accounts;the stations WOULDN'T be able to communicate with resources of other AWS tenants - say, their S3 endpoints or VM instances.This is all realizable in Azure. Can this be implemented with AWS?ShareShow 2 more comments"


Question: DynamoDB + Elasticsearch: is that a good architecture pattern?

"While playing with AWS Amplify, I was looking for the most appropriate architecture pattern, which would allow me to have the following:scalable and reliable DB to handle CRUD operations (DynamoDB rocks here)complex querying and filtering, where data access patterns are not strictly defined or unknown (Elasticsearch wins here)So obviously I am hooked by the idea of streaming DynamoDB data to Elasticsearch for ALL queries and keeping DynamoDB with read/write operations only.What are the pros and cons of this architecture?(posted on Reddit: https://www.reddit.com/r/aws/comments/cq48vb/data_querying_searching_and_filtering_dynamodb/stackoverflow: https://stackoverflow.com/questions/57493773/data-querying-searching-and-filtering-dynamodb-elasticsearch)FollowComment"

Answer: 0Hey andrew-psch - This absolutely a good architecture pattern. AWS offers a diverse set of database services so you can pick the DB engine that best fits your use case. Here is a video of one of our SAs presenting on integrating DDB and Elasticsearch. https://www.youtube.com/watch?v=WXmghnE1_vU.CommentShareAWS-User-6425534answered 4 years ago


Question: DNS propagation (48 hours - really?)

"I recently changed my nameservers on my domain in Godaddy to the nameservers in my Route 53 hosted zone. I'm at a stand still until the domain propagates. I checked the propagation on https://dnsmap.io/#NS/swartzfinance.com and it appears that almost all the authoritative  DNS servers have picked it up, and all the ones in the USA where I'm at. So why is my site still not coming up? swartzfinance.comUsually, it is a matter of a couple of hours that DNS changes take effect. I feel like telling people to wait 48 hours in this day and age is really just CYA, which is what Google support told me (I'm trying to verify my domain for Workspace). Amazon touts a 60-second world-wide propagation. So is Godaddy just really slow and archaic? I can't imagine in this age of technology that we have to be put on hold for 2 whole days for something like this.I've considered that maybe it's something on my end, but I'm scared to try anything since I might have to wait another 2 days.FollowComment"

Answer: "0I guess it really does still take 48 hours in some cases. It finally went though.CommentShareSwartzanswered 2 years ago0im approaching 48 hours too, this isn't going to work for me when we go into production and need things to go as fast as normal.CommentSharerePost-User-2742014answered 9 months ago"


Question: Getting a blank screen when I start SQL Developer

"I have installed SQL Developer sqldeveloper-22.2.1.234.1810-x64 with JDK. After the installation is complete, when I started the SQL Developer, I get a black screen. It asked me to download MSVCR100.dll and copy it to the bin dir. I have a 64-bit machine. Pls helpFollowComment"


Question: Mxnet default version?

"Am struggling to deploy a SageMaker trained object detection model on DeepLens.  When I attempt to use mo.optimize on DeepLens, I get error status 2 "inconsistent platform versions.".  According to the SageMaker documention I found, the default version of mxnet is 1.2.1.  Is this info current, and is it therefore safe to assume that an mxnet model trained and created in SageMaker console will use that version?Edited by: BigEd on May 19, 2019 9:41 AMFollowComment"

Answer: "0Error messages during model optimizing indicated SageMaker had saved the model with mxnet 1.4.0, so I upgraded to that on DeepLens and it solved my problem.CommentShareBigEdanswered 4 years ago0Apologies for the late response.Glad to see you were able to work around the problem.Please let us know if there is anything we can assist with.Thanks!CommentShareAWS-User-3711112answered 4 years ago"


Question: OSCAR_DROP_INDEXES_TABLES (Aurora MySQL clusters) - what is it?

An Aurora  cluster stuck for a long time doing OSCAR_DROP_INDEXES_TABLES operation.What is it? Do we have a proper description for it?FollowComment


Question: Cannot SSH into Resized EC2 Instance

"Hi all,I have been working on deploying an application on an EC2 instance (ubuntu 22.04) and have ran into some issues with ssh'ing back into the server after a restart. I take it that the associated volume is fine, as I'm able to migrate and mount it to other EC2 instances with my .pem file and get in via ssh without issue. I have verified that this pem file is valid, as well as that it is the relevant one for this specific instance. I've included a picture of the verbose errors I've received when trying to ssh, and am happy to provide more granular details if needed..FollowCommentiwasa EXPERT7 months agoHi, @okeefe.Please tell us your pre-change and post-change instance types.Share"

Answer: "1Hi - Please provide more details from which instance type to which you made the resize and also can you please see if the instructions on following are being followed?In the AWS EC2 console, click on the checkbox next to your instance's name, then click on Actions and select Connect. Click on the SSH client tab and copy the ssh command example and also see all other instructions.CommentShareEXPERTAWS-User-Nitinanswered 7 months agoEXPERTIndranil Banerjee AWSreviewed 7 months ago"


Question: Keep the python script alive

"Hello,I launched a lightsail instance and ran a python script. I connected to lightsail via Aws ssh client (I think it was another Chrome tab). I want python script to be continuously running even if internet is disconnected.How do I do that?Thanks.FollowComment"

Answer: "2Accepted AnswerThis isn't specific to Lightsail, it's something that happens because of the way Linux handles processes being stopped. In this case, your shell process is stopped and so is anything else that was started in that shell.You can work around it by using the nohup command.CommentShareEXPERTBrettski-AWSanswered a year agobhansali a year agoThanks. It works.Share"


Question: TLS Termination with an ELB

"Hi,I'm using an ELB that listens to https traffic on port 443 using TLS with an ACM certificate, decrypts traffic and then forwards it over http port 80 to the target EC2 instances. The ELB and target instances are in the same VPC. Is this secure or should I be forwarding traffic from the ELB to the target servers using HTTPS?Thanks,DavidFollowComment"

Answer: "0Hi,In my opinion, if your EC2 instances are in a private subnet and the security groups are set in place, you are secure. At some point in the flow of traffic from the client to the final destination on the EC2 instance, your traffic will be decrypted, so its a matter of personal choice as to whether or not you feel that a private subnet within a VPC is considered "secure" enough.  Note: if you are in a heavy regulated industry, such as banking, then you will be required to add encryption on the backend.  You can find many links online debating this topic. Here is one from security.stackexchange.com.https://security.stackexchange.com/questions/30403/should-ssl-be-terminated-at-a-load-balancerHope this helps a bit,-randyCommentShareRandyTakeshitaanswered 4 years ago0Thanks Randy, that is helpful.CommentSharedavemeyeranswered 4 years ago"


Question: "Upgrading Aurora PostgreSQL cluster from 12.12 to 14.6. Why do we need to drop and recreate all replication slots?  Post upgrade, How to ensure replication slots resume incremental changes only?"

"It appears that Aurora PostgreSQL major version upgrade requires us to first drop all replication slots, then perform upgrade, and then recreate replication slots. We use logical slots for Debezium/Kafka replication for inter-process work flows. When we drop and recreate these replication slots as part of major version upgrade, how can we ensure replication restarts from where it left of (meaning, replication resumes incremental changes only) and not force us to do FULL sync. We cannot afford to have FULL sync due to large table sizes.FollowComment"

Answer: "0Hello,As correctly mentioned by you, an upgrade can't occur if the instance has any logical replication slots. This is unfortunately a limitation from the engine, including the community version. "Before upgrading, make sure you know the purpose of any logical replication slots that are in use, and confirm that it's okay to delete them. If the logical replication slots are still being used, you shouldn't delete them, and you can't proceed with the upgrade" [1].If the logical replication slots aren't needed, you can delete them using the following SQL:SELECT * FROM pg_replication_slots;SELECT pg_drop_replication_slot(slot_name);"I also confirmed to you that we currently have an open feature request to our developer team to make replication slots to be maintained during a major version upgrade.While I cannot confirm this feature request will be approved or if there is an estimated time for the feature to become available, I've echoed your voice to the internal team.AWS is continuously improving its services and you can keep track of AWS latest services and products. If the request is approved, the changes will be posted on https://aws.amazon.com/blogs/aws/    and http://aws.amazon.com/new .============================Now to answer your second query regarding ensuring that replication restarts from where it left of (meaning, replication resumes incremental changes only) and not forces you to do FULL sync. Please note that if replication slot is inactive, it means there is no replication going on at that moment. However, it will not require FULL SYNC. In order to make sure that data is not lost, please make sure that before upgrading all changes are replicated, then perform the upgrade and right after the upgrade, re-establish the replication. For more information regarding Re-establishing logical replication after a major upgrade, you can refer AWS document [2].References:[1] RDS User Guide - How to perform a major version upgrade - https://aws.amazon.com/premiumsupport/knowledge-center/rds-postgresql-version-upgrade-issues/[2]Working with extensions and foreign data wrappers - Reestablishing logical replication after a major upgrade https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Appendix.PostgreSQL.CommonDBATasks.html#Appendix.PostgreSQL.CommonDBATasks.pglogical.recover-replication-after-upgradeCommentShareSUPPORT ENGINEERrePost-User-1105423answered 4 months ago"


Question: OpenSearch cluster green but stuck in processing for 2 weeks

"My OpenSearch cluster has been stuck in processing since the last auto-tune event. the cluster status is green across the board. The cluster is usable without issue (reading, writing, Kibana), but this prevents me from performing an upgrade or applying other config changes.Monitoring shows:Cluster status greenInstance count is 9, as expected: 3 master and 6 data nodesJVM memory pressure looks good: seeing the expected "sawtooth" curve never exceed 75% and going as low as 45%Most recent update was a Service software update to R20211203-P2. It seems to have taken 5 days, but looks like it completely well. (Judging by the instance count graph)The cluster is usable without issue, Kibana is reachable and responsive, constantly writing to the cluster without error, nothing seems offRough timeline:19.12.2021 - update to R20211203-P2, instance count is doubled to 18 (expected blue/green deployment)24.12.2021 - instance count drops back to the expect 9, cluster status green26.12.2021 - Notification "Auto-Tune is applying new settings to your domain", instance count doesn't rise, still at 9now - Cluster still stuck at "processing" even though everything is greenWhat I tried:GET /_cluster/allocation/explain  responds with "unable to find any unassigned shards to explain" which makes sense GET /_cat/indices?v shows everything green, as expectedI also tried modifying the disk size to try and "kick" the cluster into doing a blue/green deployment and hopefully getting unstuck but that didn't seem to happenThe only possible clue was in CloudWatch error logs, a repeating message appears since the last auto-tune event started on 26.12.2021: with "master not discovered yet", I'll try to pretty-print it below:[2022-01-11T06:36:23,761][WARN ][o.o.c.c.ClusterFormationFailureHelper] [52cb02d8573b17516f7756d5fe05484d] master not discovered yet: have discovered [{***}{***}{***}{__IP__}{__IP__}{dir}{dp_version=20210501, distributed_snapshot_deletion_enabled=false, cold_enabled=false, adv_sec_enabled=false, __AMAZON_INTERNAL__, shard_indexing_pressure_enabled=true, __AMAZON_INTERNAL__}, {***}{***}{***}{__IP__}{__IP__}{imr}{dp_version=20210501, distributed_snapshot_deletion_enabled=false, cold_enabled=false, adv_sec_enabled=false, __AMAZON_INTERNAL__, shard_indexing_pressure_enabled=true, __AMAZON_INTERNAL__}, {***}{***}{***}{__IP__}{__IP__}{imr}{dp_version=20210501, distributed_snapshot_deletion_enabled=false, cold_enabled=false, adv_sec_enabled=false, __AMAZON_INTERNAL__, shard_indexing_pressure_enabled=true, __AMAZON_INTERNAL__}, {***}{***}{***}{__IP__}{__IP__}{imr}{dp_version=20210501, distributed_snapshot_deletion_enabled=false, cold_enabled=false, adv_sec_enabled=false, __AMAZON_INTERNAL__, shard_indexing_pressure_enabled=true, __AMAZON_INTERNAL__}, {***}{***}{***}{__IP__}{__IP__}{imr}{dp_version=20210501, distributed_snapshot_deletion_enabled=false, cold_enabled=false, adv_sec_enabled=false, __AMAZON_INTERNAL__, shard_indexing_pressure_enabled=true, __AMAZON_INTERNAL__}, {***}{***}{***}{__IP__}{__IP__}{imr}{dp_version=20210501, distributed_snapshot_deletion_enabled=false, cold_enabled=false, adv_sec_enabled=false, __AMAZON_INTERNAL__, shard_indexing_pressure_enabled=true, __AMAZON_INTERNAL__}, {***}{***}{***}{__IP__}{__IP__}{imr}{dp_version=20210501, distributed_snapshot_deletion_enabled=false, cold_enabled=false, adv_sec_enabled=false, __AMAZON_INTERNAL__, shard_indexing_pressure_enabled=true, __AMAZON_INTERNAL__}]; discovery will continue using [__IP__, __IP__, __IP__, __IP__, __IP__, [__IP__]:9301, [__IP__]:9302, [__IP__]:9303, [__IP__]:9304, [__IP__]:9305, __IP__, __IP__, __IP__, __IP__, __IP__, __IP__, __IP__, __IP__, __IP__, __IP__, __IP__, __IP__, __IP__, __IP__, __IP__, __IP__, __IP__, __IP__] from hosts providers and [] from last-known cluster state; node term 36, last-accepted version 0 in term 0I masked the node IDs and replaced them with ***. The log message lists 7 of them above, I can only recognize 3 IDs as my master nodes, cannot recognize the rest of the IDs (not my data nodes) and not sure I understand what's going on here. Any help would be appreciated.FollowComment"

Answer: "0Thank you for posting your question, for the above scenario you have described, please create a ticket with the AWS support so they can help you in resolving the issue.CommentShareEXPERTFabrizio@AWSanswered a year agoggmabob a year agoThanks for your response, Fabrizio! One small follow-up question, is there a specific ticket type/category I can choose to make sure it reaches the right team? I should mention I only have the basic support plan, any hint is welcome, thanks again.Shareggmabob a year agoI notice only now, but it seems that the issue was actually resolve right around the same time you posted this answer, Fabrizio. Did you trigger something internally?For all I can tell the issue is completely gone. The "master not discovered yet" message is gone form the logs and the cluster is "Active" again no longer in processing. If that was you, then thank you!ShareFabrizio@AWS EXPERTa year agoHi , it was not me, just a coincidence :-). happy it was resolved, and sorry I did not see your comment before.Share"


Question: Correct process for configuring S3 bucket so ONLY Cloudfront can access?

"Hi...I've recently received a standard email security warning "We’re writing to notify you that your AWS account .... has one or more S3 buckets that allow read or write access from any user on the Internet. By default, S3 buckets allow only the account owner to access the contents of a bucket; however, customers can configure S3 buckets to permit public access".I have only one S3 bucket and it's used only as the origin for Cloudfront. It does not need to permit direct access for anyone, even me. Currently , the items in the bucket permit public read access to anyone, including Cloudfront, so that Cloudfront can access them. Is that or is it not correct? This must be a fairly standard configuration but I can't find it documented anywhere. If it's not correct to give Public access in this case, what is the recommended way to secure access to an S3 bucket so that only Cloudfront and no-one else can access it, please?There is no easy and obvious way of doing this in S3 --> Buckets --> Permissions --> Access Control Lists unless it is possible to specify Cloudfront under "Access for other AWS accounts"?Thanks for any help.FollowComment"

Answer: "0This should help:To allow access to your Amazon S3 bucket only from a CloudFront distribution, first add an origin access identity (OAI)[1] to your distribution. Then, review your bucket policy and Amazon S3 access control list (ACL)[2] to be sure that:•Only the OAI can access your bucket.•CloudFront can access the bucket on behalf of requesters.•Users can't access the objects in other ways, such as by using Amazon S3 URLs.Note: After you restrict access to your bucket using CloudFront, you can optionally add another layer of security by integrating AWS WAF[3].[1] https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#private-content-creating-oai[2] https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#private-content-granting-permissions-to-oai[3] https://docs.aws.amazon.com/waf/latest/developerguide/getting-started.htmlCommentShareawsrwxanswered 4 years ago0Thanks!CommentShareChris Janswered 4 years ago"


Question: Import Contact Flow via CLI or UI

Has anyone found that using the import/export of a contact flow works but to export a contact flow and then use the AWS CLI create-contact-flow to import it into another environment  I received an application exception.It looks like the CLI/API expect a different json format compared to the export/import which may make adding this step to a pipeline difficult.Any views/feedback would be welcomeFollowComment

Answer: "0So the export/import format of the JSON is different from the UI so you cannot use the AWS CLI/ Connect API to import the file.So you need to use the describe-contact-flow CLI/API to get the correctly formatted JSON and then use the create/update contact flow CLI/API for it to work. It will not work by using the UI Import facility.CommentSharem66rusanswered 2 years ago0m66rus wrote:So you need to use the describe-contact-flow CLI/API to get the correctly formatted JSON and then use the create/update contact flow CLI/API for it to work. It will not work by using the UI Import facility.That won't work across instances either since the ARNs for all prompts, flows, queues etc. will be different in the described flow vs the created/updated flow (they differ across instances). So you need to list all prompts, flows, queues, lambdas in each instance then match them up somehow (e.g. by Name), then replace all ARNs in the flow JSON with the corresponding resource ARNs from the instance you are updatingCommentSharerectalogicanswered 2 years ago0Yes you are correct, the ARN need parsing but I was having an issue just getting it to import but found that I was wasn't handling the format of the contents attribute. In terms of replacing the ARN i am working on a script to replace those.CommentSharem66rusanswered 2 years ago"


Question: code whisperer - will it work for kotlin ?

I enabled code whisperer in intellij ide. We are using kotlin for building our backend services.I am not seeing any code recommendation for kotlin from code whisperer. Wondering will it work for kotlin ?Do I need to make any configuration changes to enable it for kotlin ?FollowComment

Answer: "0Accepted AnswerYes, CodeWhisperer now (as of April 13th 2023) supports Kotlin - https://aws.amazon.com/codewhisperer/features/CommentShareMODERATORsrinz9answered 2 months ago0Code whisperer does support the IntelliJ IDEA, It currently supports C#, TypeScript, Python, Java and Javascript languages.It does not appear that Kotlin is a currently supported language.https://aws.amazon.com/codewhisperer/https://aws.amazon.com/codewhisperer/features/CommentShareKeith_AWSanswered 2 months ago"


Question: Desktop Browser Testing (Remote session)

"I'm able to use device farm for running automated selenium test. However I'm not getting any option of remote connection for a machine.i.e. I'm looking for an option where I can remotely connect to an OS/Browser combination and do testing manually.Such remote option is available for mobile device testing, however I can't see similar option for Desktop Browser Testing.Can somebody please suggest If I'm missing anything?FollowComment"


Question: Machine Learning Certification - score card

"Hi, I have taken Machine learning certification exam early this week. I did take couple certs in the past, know the process well. I have not received exam result for ML cert. I called PearsonVue, they said to call AWS training and certification. I can not find AWS training and certification contact number.In the past I received result on the same day, I did not have to wait 5 business days when test was delivered successfully by PearsonVue to AWS., people who have taken same cert did receive their result within 24 hours this week. I can be reached at romi.parimi@gmail.com, look forward to training team contact me as a result of this post., so I can provide any additional information needed.  Please look into this request.FollowCommentrparimi 5 months agoThank you for quick response - AWS training and certification team.You said it was AWS internal tool problem. I got my ML cert score card  now :)Share"

Answer: "0Let us know what you hear back! Thanks and Best of luck!CommentSharePrakash Hanswered 5 months agorparimi 5 months agoHeard back and got my score report now, thanks for resolving it!Share0That is good news!CommentSharePrakash Hanswered 5 months ago"


Question: Cognito Migration from one pool to another - UserMigration_ForgotPassword flow results in error - "Error getting validation token for user {user's email}. Exception migrating user in app client.

"Hi,We've setup the migration lambda correctly and it is exiting fine after finding and confirming the user. The memory allocated to the lambda is also high (512MB). The migration lambda exits correctly, but we see the error in the frontend when we try the forgot password flow for a user. Any advice is appreciated.FollowComment"

Answer: "0Hello,User Migration Exception can occur due to various reasons -Invalid UsernameInvalid Delivery MediumInvalid Final User StatusReturning bad response (As reported externally here on third part forum as well in the past - "If you return a bad response the lambda will succeed but the trigger action will fail and Cognito will give you a fairly generic message.")where one can see the following accompanying error message - Exception migrating user in app client like you noticed in your case.But, in your specific use case, you are currently seeing a specific error for validation token -> "Error getting validation token for user {user's email}".To be able to understand the root cause of your validation token error, we need to first understand -Your lambda environment in regards to the SDK usageYour lambda code snippet for UserMigration_ForgotPassword source [1]How are you returning your response to Cognito in Lambda,Finally your Lambda CloudWatch logs [2] to confirm that the error is not being up-streamed from Lambda to Cognito itself.However, please do not post any sensitive information over re:Post since this is a public platform. Therefore, I would highly recommend you  creating a support case with our Premium Support team so that we may discuss details on your resource configurations.References:[1] https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-migrate-user.html#user-pool-lambda-migrate-user-trigger-source[2] https://docs.aws.amazon.com/lambda/latest/dg/monitoring-cloudwatchlogs.htmlCommentShareSUPPORT ENGINEERYash_Canswered 7 months ago"


Question: How to connect to IoT Core by IAM (access key id / pwd)

"hello,i'm trying to connect to AWS IoT Core from my PC using mqtt client tools. (like, MQTT.fx, mqttbox)I can connect successfully by certificate mode.But I cannot connect by user id / pwd mode. (IAM user access key id, access key pwd)Let me know how to configure AWS settings or mqtt client settings.FollowComment"

Answer: "0Hi, thanks for the question! In order to use IAM credentials, the SigV4 process is used. Since this is not supported in the MQTT protocol overall, it is accomplished by establishing a connection via MQTT over websocket. The full list of communication protocols can be found here.You can see this in action here. This is a Python example that uses publish/subscribe. By setting the --use-websocket and --signing-region arguments, normal IAM credentials can be used. For example, by setting environment variables.Let us know if this is helpful!CommentShareGavin_Aanswered a year ago"


Question: Sagemaker Studio JupyterServer App does not load

"After months of seamless work in SageMaker Studio, the JupyterServer App won't load for the last 4 days. The Control Panel shows that the JupyterServer is in "Pending" or "Failed" state after I try to launch the app. When clicking "Launch app", the screen shows that:"The JupyterServer app default encountered a problem and was stopped."The "Restart Now" button is visible, but pressing this results in the same behaviour.I created a new JupyterServer App and it experiences the same problem under that account. I use a different account for another project and the JupyterServer under that account works perfectly. I even mounted the EFS associated with the App on an EC2 instance and deleted some files to reduce the EFS volume but it did not help (it was 995 MB and as far as I know, 5GB is the default limit).I found a post stating the same problem from 2 years ago, but could not follow the advice to delete the app and create a new one, since the Delete option is not available in the Action dropdown (https://repost.aws/questions/QUxoSA7eTzQbK-T4OWjJvSmQ/sage-maker-studio-will-not-load). All apps that I create is "default".Please help, how could I overcome this and access Jupyter Lab again?Thank you.FollowComment"

Answer: "0Even if you're not seeing the "Delete app" option in console (because the app Failed), the good news is that the "Restart" button should be doing the same thing for you: So how can you find out more about what's breaking here and hopefully fix it?To see logs, you can open the /aws/sagemaker/studio log group in Amazon CloudWatch: Here you should find log streams like {DomainID}/{UserProfileName}/JupyterServer/default and (if you have a lifecycle configuration script set up?) {DomainID}/{UserProfileName}/JupyterServer/default/LifecycleConfigOnStart.If you do have a custom lifecycle configuration script set up, this can often be a point of failure: I'd suggest trying to detach it and/or adding some extra flags like set -ux to help debug what might be going wrong in it. Also since SageMaker Studio recently launched JupyterLab v3 support in parallel to JLv1. If you've been experimenting with both versions, it's worth checking which version your user is currently configured to use, and remembering that some setup scripts which might work on one version could break on another.Your user's EFS home folder (and any additional setup the LCC script does) will be the only data persisted between JupyterServer launches, so content could be another point of failure. It sounds like you started to explore this already.You could try to delete (or otherwise edit) the user's ~/.jupyter folder from EFS to clear any customized Jupyter configuration settings that might be causing problems during start-up. Again, this may be useful if you're using any features or extensions for which the Jupyter configuration API changed between JLv1 and v3.I haven't found overall data volume to cause these kind of start-up problems myself so far. I have seen some cases where having a git repository with many active changes (e.g. thousands) causes a UI slowdown when working in the repository's folder, but I haven't seen it prevent the actual start-up I think?CommentShareEXPERTAlex_Tanswered a year ago0@Alex_T thank you for the reply. The CloudWatch logs don't show any sign of failing notebooks, and I did not have any LCC either. The final solution was the following:I mounted the EFS associated to the SageMaker domain on an EC2 instance and made a backup of all notebooks and other files (saved them on my local computer too).Then, I deleted the SageMaker domain by following these steps: https://docs.aws.amazon.com/sagemaker/latest/dg/gs-studio-delete-domain.html (via CLI)Created a new SageMaker domain. The JupyterServer App starts now.Finally, I mounted the new EFS to the EC2 instance and uploaded the notebooks and files. They are all visible and working in Jupyter.CommentSharecaptain_baluanswered a year ago"


Question: Amazon Rekognition Only for Object Detection

"Is there a parameter for the rekognition API that specifies that I'm not interested in any labels that don't have instances? I am drawing bounding boxes around detected objects, so objects without instances are useless. Im using the python SDK, boto3 version 1.26.18.FollowComment"

Answer: "1Hi rePost-User-5089220,Can you please elaborate what you are looking for ? Are you using DetectCustomLabels or DetectLabels API ? If you are trying to filter out some of labels from detection results, there is no label filtering for DetectCustomLabels. In other case, you can check out DetectLabels API documentation here for Filter inclusion and exclusion parameters.Please let us know if you need further assistance.Thanks for reaching out to us.CommentShareaws-yasarkaanswered 6 months agorePost-User-5089220 6 months agoHi, I'm using the DetectLabels API. I am already using filters, but I was wondering whether it's possible to filter the response so that it only returns detections with instances. In other words, I'm looking to do object detection rather than classification, as I'm using the response from amazon to draw bounding boxes around the detections I find. For example, in this response http://json-parser.com/aa5371a9, I got 4 labels, but only 3 had instances. Is it possible to add a parameter that ensures the face label wouldn't have been returned because it didn't have any instances?Share"


Question: Upgrade from Postgres 12.7.R1 to 13.3.R1 stuck

"We are trying to upgrade our RDS DB from Postgres 12.7.R1 to 13.3.R1 however this is failing:The instance could not be upgraded from 12.7.R1 to 13.3.R1 because of following reasons. Please take appropriate action on databases that have usages incompatible with requested major engine version upgrade and try again.- Following usages in database 'staging' need to be corrected before upgrade:-- The instance could not be upgraded because there are one or more databases with an older version of PostGIS extension or its dependent extensions (address_standardizer, address_standardizer_data_us, postgis_tiger_geocoder, postgis_topology, postgis_raster) installed. Please upgrade all installations of PostGIS and drop its dependent extensions and try again.We only have PostGIS installed none of these other extensions and it is already running the latest version available:_List of installed extensions_   _Name      | Version |   Schema   |                             Description_                               ---------------------------------------------------------------------------------------------------------+fuzzystrmatch | 1.0     | public     | determine similarities and distance between stringspg_trgm       | 1.3     | public     | text similarity measurement and index searching based on trigramsplpgsql       | 1.0     | pg_catalog | PL/pgSQL procedural languageplv8          | 2.3.8   | pg_catalog | PL/JavaScript (v8) trusted procedural languagepostgis       | 3.0.3   | public     | PostGIS geometry, geography, and raster spatial types and functionstablefunc     | 1.0     | public     | functions that manipulate whole tables, including crosstab(6 rows)We are completely stuck and would be very grateful of any advice on how to proceed.Many thanks in advance for any help.FollowComment"

Answer: "0For anyone else who find this the problem appears to be that the AWS process for moving up to PostGIS 3.x does not quite work as expected, I suspect this is due to PostGIS splitting out raster to a separate extension.   I had already run ALTER EXTENSION postgis UPDATE; but this did not sort the problem.  ALTER EXTENSION postgis_raster UPDATE; said this was not installed however it was not possible to install this either.This post helped point me in the right direction:  https://stackoverflow.com/questions/42634626/postgresql-upgrade-on-amazon-rds-blocked-by-postgis-versionWhen running SELECT postgis_full_version(); I got:POSTGIS="3.0.3 6660953" [EXTENSION] PGSQL="120" GEOS="3.8.0-CAPI-1.13.1 " PROJ="Rel. 5.2.0, September 15th, 2018" GDAL="GDAL 2.4.4, released 2020/01/08" LIBXML="2.9.1" LIBJSON="0.13.1" LIBPROTOBUF="1.3.2" WAGYU="0.4.3 (Internal)" RASTER (raster lib from "2.5.2 r17328" need upgrade) [UNPACKAGED!] (raster procs from "2.5.2 r17328" need upgrade)Running SELECT postgis_extensions_upgrade(); seems to have resolved the issue.  I ran ALTER EXTENSION postgis UPDATE; to be on the safe side.Just kicked off the upgrade and it's now running well.I hope this helps anyone who has similar issues.CommentShareaddresscloudmarkanswered 2 years ago"


Question: Disk space and memory reserved by fargate for publishing logs.

We are currently performing chaos testing o our service which uses fargate. We observed that when we hogged the disk with100% disk space still logs were getting published by the fargate and no logs were discarded. I wanted to know does fargate reserve some additional space for publishing the logs.FollowComment

Answer: "0Hi. Assuming you are using the default logging driver, most likely AWS CloudWatch, the capture of the logs from your containers is sent to CW directly, not stored on disks. We run 100s of services and never once have we had a disk capacity error due to logs with AWS Fargate and the CW Log driver (or Fluent-Bit for that matter).If your application has multiple log streams configured internally and one of these is file, then might be worth to disable it then when running in Fargate, and stick to stdout/stderrCommentShareJohnPrestonanswered 8 months ago"


Question: Google SSO with AWS IAM Identity Center fails

"Hi,I've followed this (https://aws.amazon.com/blogs/security/how-to-use-g-suite-as-external-identity-provider-aws-sso/) instruction to get Google SSO working for AWS and eventually want to turn on auto provisioning of accounts; however im unable to login and get an error (it may be a bug?) that: Something went wrong, looks like this code isn't right. please try again.Any help is appreciated as our organization isn't able to login.FollowComment"

Answer: "0You can use a root IAM user to login to the account and check SSO user/group lists. I assume that lists are empty and AWS does not know anything about your users in Google.Need to make sure that Google supports Cross-domain Identity Management (SCIM) for auto-provisioning. A couple of years ago it did not, so we had to replicate users from Google to AWS SSO manually.CommentShareOleksii Bebychanswered 4 months ago0Identity Center has doesn't work well with Google as an Identity Provider, because Google doesn't have a SCIM server. So checking that the user actually exists is a good first step.If the user logging into Identity Center exists in the Identity Center user directory, I would look at the SAML assertion Google is sending. Make sure the NameID value of the SAML assertion sent by Google matches the username value of a user populated in Identity Center.If the NameID value does match a user in Identity Center, I suggest opening a support ticket because there are a few things that could go wrong. But the NameID value not matching a user is the most common issue.CommentShareAWS-User-7083746answered 4 months ago0HiI had the same problem after following the same blog post.It turns out that you have to use the email address as the username of the user when you are creating it!Hope it fixes your issueCommentShareGhuntianswered 4 months ago"


Question: How to reduce Data Transfer Cost in AWS

"Hello Everyone,Our AWS data transfer cost suddenly increases.I check my current billing and found Bandwidth consumption is too high due to that this cost was increasedIs there any way, we can optimize this cost?FollowComment"

Answer: "2We have a number of available resources that can help you understand network data transfer usage and charges better, explain which tools you could use to visualize them, and also optimize it.Depending which services you use, and how your services connect and share the traffic, you might want to check some of these blogposts:Overview of Data Transfer Costs for Common ArchitecturesExploring Data Transfer Costs for AWS Managed DatabasesUsing AWS Cost Explorer to analyze data transfer costsHow can I reduce data transfer charges for my NAT gateway?Also, take a look at this video presentatino with the demo from AWS Supports You twitch series on how to monitor and tips how to optimize data transfer costs:  AWS Supports You | Monitoring and Optimizing Your Data Transfer Costs From your screenshot it looks like the majority of your data transfer charges are related to the traffic that goes from your resources and then leaving AWS (traffic going Out to the Internet). Depending on your setup, you could evaluate if it's worth using CloudFront, if your traffic goes to end users who access data from your resources over the Internet. Also, with CloudFront, you would use the security savings bundle, and save up to 30% on your CF usage if you plan to grow your usage over time.CommentShareEXPERTNataliya_Ganswered 8 months ago0There is some guidance provided here - https://docs.aws.amazon.com/wellarchitected/latest/cost-optimization-pillar/plan-for-data-transfer.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 8 months ago"


Question: What are the minimal MySQL grants required by SecretsManager to rotate a password?

"I would like to use SecretsManager to rotate a database password using the alternating accounts strategy. I don't want to use the database "Master" user for that, I want to create a dedicated MySQL user for Secrets Manager.I understand the AWS IAM roles and policies, AWS networking and such. I am looking for the minimum privilege I must grant SecretManager inside my RDS MySQL instance so that it can rotate a password, but not SELECT any data? I am looking for a statement like this one:CREATE USER 'secrets_manager'@'%' IDENTIFIED BY 'password';GRANT ?????? ON ?????? to 'secrets_manager'@'%'As an example, Hashicorp Vault lists the SQL statements required to change a password, making it possible to GRANT a limited set of statements to Vault.FollowComment"

Answer: "0Secrets Manager uses a Lambda function to rotate a secret. The Lambda function has a resource policy that allows Secrets Manager to invoke it. Secrets Manager calls the Lambda function by invoking an IAM execution role attached to the Lambda function. Permissions for the Lambda function are granted through the IAM execution role as inline policies. If you turn on rotation by using the Secrets Manager console, the Lambda function, resource policy, execution role, and execution role inline policies are created for you.You can read up more here.https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-required-permissions-function.htmlCommentShareDevinder-theDBGuyanswered a year agoguillaume-seguin a year agoThanks. But when the Lambda finally runs, it must authenticate in the database as a user, right? My question is about the permissions that user needs in MySQL (given by the GRANT statement)?Share"


Question: Ingress annotations only for a specific path

"Hi,I have this ingress configuration:apiVersion: networking.k8s.io/v1kind: Ingressmetadata:  name: "oidc-ingress"  annotations:    kubernetes.io/ingress.class: alb    alb.ingress.kubernetes.io/scheme: internet-facing    alb.ingress.kubernetes.io/target-type: ip    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'    alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'    alb.ingress.kubernetes.io/load-balancer-attributes: idle_timeout.timeout_seconds=300    external-dns.alpha.kubernetes.io/hostname: example.com    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!    alb.ingress.kubernetes.io/auth-type: oidc    alb.ingress.kubernetes.io/auth-on-unauthenticated-request: authenticate    alb.ingress.kubernetes.io/auth-idp-oidc: '{"issuer":"https://login.microsoftonline.com/some-id/v2.0","authorizationEndpoint":"https://login.microsoftonline.com/some-id/oauth2/v2.0/authorize","tokenEndpoint":"https://login.microsoftonline.com/some-id/oauth2/v2.0/token","userInfoEndpoint":"https://graph.microsoft.com/oidc/userinfo","secretName":"aws-alb-secret"}'    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!spec:  rules:  - http:      paths:      - pathType: Prefix        path: /        backend:          service:            name: ssl-redirect            port:               name: use-annotation      - pathType: Prefix        path: /jenkins        backend:          service:            name: jenkins            port:               number: 8080      - pathType: Prefix        path: /        backend:          service:            name: apache            port:               number: 80If I kubectl appy this Ingress config it will apply annotations to all routing rules, which means:/*/jenkins/jenkins/*I would like to apply OIDC annotations only for the Jenkins rules, it means:If I open https://example.com it will be available to everyone.If I open https://example.com/jenkins, it will redirect me to OIDC auth page.I can do this manually through AWS console when I remove authenticate rule from /* and leave it for /jenkins/* only.However I would like to achieve this through Ingress annotations to be able to automate this process.Please how can I do this?Thanks for your help.FollowComment"

Answer: "1Accepted AnswerHi, you should divide into several Ingresswith group annotation. You may want to refer this linkTest it like below!apiVersion: networking.k8s.io/v1kind: Ingressmetadata:  name: "base"  annotations:    alb.ingress.kubernetes.io/group.name: example    alb.ingress.kubernetes.io/scheme: internet-facing    alb.ingress.kubernetes.io/target-type: ip    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'    alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'    alb.ingress.kubernetes.io/load-balancer-attributes: idle_timeout.timeout_seconds=300    external-dns.alpha.kubernetes.io/hostname: example.comspec:  rules:  - http:      paths:      - pathType: Prefix        path: /        backend:          service:            name: ssl-redirect            port:               name: use-annotationapiVersion: networking.k8s.io/v1kind: Ingressmetadata:  name: "jenkins"  annotations:    alb.ingress.kubernetes.io/group.name: example    alb.ingress.kubernetes.io/group.order: 10    alb.ingress.kubernetes.io/target-type: ip    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'    alb.ingress.kubernetes.io/auth-type: oidc    alb.ingress.kubernetes.io/auth-on-unauthenticated-request: authenticate    alb.ingress.kubernetes.io/auth-idp-oidc: '{"issuer":"https://login.microsoftonline.com/some-id/v2.0","authorizationEndpoint":"https://login.microsoftonline.com/some-id/oauth2/v2.0/authorize","tokenEndpoint":"https://login.microsoftonline.com/some-id/oauth2/v2.0/token","userInfoEndpoint":"https://graph.microsoft.com/oidc/userinfo","secretName":"aws-alb-secret"}'spec:  rules:  - http:      paths:      - pathType: Prefix        path: /jenkins        backend:          service:            name: jenkins            port:               number: 8080apiVersion: networking.k8s.io/v1kind: Ingressmetadata:  name: "default"  annotations:    alb.ingress.kubernetes.io/group.name: example    alb.ingress.kubernetes.io/group.order: 20    alb.ingress.kubernetes.io/target-type: ip    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'spec:  rules:  - http:      paths:      - pathType: Prefix        path: /        backend:          service:            name: apache            port:               number: 80CommentShareEXPERTposquit0answered a year agoAWS-User-5199957 a year agoThank you very much! it's working. In case someone in future will try this, I only mention here, that every group must have this annonation as well: kubernetes.io/ingress.class: alb.Share0I would like to ask you, what's your opinion on this OIDC solution in terms of the security? Do you think it's secure to have such an ALB with inbound rules: 0.0.0.0/0 and restrict the paths, which I want to have private with OIDC auth only?I and my colleagues work from different places, so it would be NOT possible to restrict the inbound rules with some specific IP addresses. We usually don't have a public static IP and we don't like an approach to connect to VPN which could provide us a public static IP address, that we could add to the inbound rules of the ALB.I know there's an option to use this annotation : alb.ingress.kubernetes.io/scheme: internal, instead of internet-facing, but I'm not sure whether I can use this option for my use case and without a VPN access.Thanks for your opinions.CommentShareAWS-User-5199957answered a year ago"


Question: Is it a good way to implement custom authorization logic(like an API call to validate header parameters) in Lambda Authorizers?

"Hi,I want to add some authorization logic in every API Gateway other than token authentication to secure my APIs. My custom logic includes call an API to validate my header parameters. If the user have that permission it will generate an allow policy. Is it is possible to implement in custom authorizer?Or is there any other methods available to validate my custom header?Can we throw custom message from Lambda Authorizer based on our requirement?ThanksFollowComment"

Answer: "0Hi.You can use the header verification function for simple regular expressions.If you need custom validation using an external API, I think the Lambda authorizer is a good choice.What does custom message throw mean? Please tell me the scenario.CommentShareEXPERTiwasaanswered a year agoAWS-User-9476241 a year agoHi,Thanks for the answer.I want message format like this {    "errorCode": "xyz_12#",    "errorType": "Constraint error",    "errorMessage": "Need administrative permisssion to perform this action"};This error message may be dynamic based on the user role.ThanksShare"


Question: WAF Geo Restriction - False Positive IP Block

"Hello,My organization recently obtained our own block of public IP addresses from ARIN. We are currently using one of these IPs as our outbound IP for all internet traffic.We are seeing an increase in "403 Forbidden" errors for certain websites hosted on AWS. The responding server header for these errors is "awselb/2.0"One software vendor we worked with said they had to manually add an exception for our IP address. That specific vendor said their AWS WAF was configured to only allow connections from certain countries (one of the countries being the US, where we are located).I have verified that our geoIP information is accurate in Maxmind as well as other major providers. Also, our IP block is not listed in any major spam lists.So my question is, why is AWS not seeing our IP as being in the US? Do they use a separate geoIP database, or are they just slow to refresh their database with other geoIP providers?Unfortunately, my organization is not currently an AWS customer, so we have no access to AWS support. This forum is our only resort. Any help you can provide would be very much appreciated.ThanksFollowComment"


Question: This Device Was Unavailable and Skipped

"Hi there,I'm trying to run iOS XCUITests on device farm. It looks like the 2 ipa files are uploaded ok, however I'm always getting the error "This Device Was Unavailable and Skipped".Run url:https://us-west-2.console.aws.amazon.com/devicefarm/home?region=us-east-1#/projects/91f1db19-85d9-42e3-8d0d-46b5fe23a288/runs/90c10a16-c872-495f-9e2b-631ce03235d2/jobs/00000Another example:https://us-west-2.console.aws.amazon.com/devicefarm/home?region=us-east-1#/projects/91f1db19-85d9-42e3-8d0d-46b5fe23a288/runs/8490529a-7c67-4a91-9297-ab5754c20db1Thx!-AFollowComment"

Answer: "0Hi, the errors were caused by that we failed to parse the tests in standard environment. Please try to use custom environment https://docs.aws.amazon.com/devicefarm/latest/developerguide/custom-test-environments.html.Thanks!CommentShareAWS-User-5202920answered 4 years ago0Thank you for the help.I've tried running in the custom environment (with the default settings). Tried 2 runs but both failed in different way.In the first run it did the setup and teardown but errored on the test with "Early unexpected exit, operation never finished bootstrapping - no restart will be attempted". Also says: "The bundle “WURRLYeduUITests” couldn’t be loaded because it is damaged or missing necessary resources. Try reinstalling the bundle."https://us-west-2.console.aws.amazon.com/devicefarm/home?region=us-east-1#/projects/91f1db19-85d9-42e3-8d0d-46b5fe23a288/runs/4cf371ce-9108-4a31-9032-8ca5c5c1475dOn the second run (with same settings) it failed to do the setup. (error "Screenshot detected")https://us-west-2.console.aws.amazon.com/devicefarm/home?region=us-east-1#/projects/91f1db19-85d9-42e3-8d0d-46b5fe23a288/runs/03b27aed-449d-4696-8d05-38fd96dbad06Any ideas? Thx!Edited by: SuperRedViking on Apr 25, 2019 9:00 AMCommentShareSuperRedVikinganswered 4 years ago0Ok, I believe the issue was that the deployment target of the UI test target was set to a higher iOS version than the app target itself. (and higher than the test device).I lowered the iOS version to 11.1 and was able to complete a successful run on Device Farm. Weeehoo!CommentShareSuperRedVikinganswered 4 years ago"


Question: Input and Output interface for the CatBoost algorithm

"to set up CatBoost Classifier as a built-in algorithm, aws in this [https://docs.aws.amazon.com/sagemaker/latest/dg/catboost.html] suggested this notebook [https://github.com/aws/amazon-sagemaker-examples/blob/main/introduction_to_amazon_algorithms/lightgbm_catboost_tabular/Amazon_Tabular_Classification_LightGBM_CatBoost.ipynb] , my question is should I prepare inference file on top of the train.csv? if yes what is that and how it should be prepared?FollowComment"

Answer: "1Accepted AnswerAccording to the documentation,[https://docs.aws.amazon.com/sagemaker/latest/dg/catboost.html] 'The CatBoost built-in algorithm runs in script mode, but the training script is provided for you and there is no need to replace it. If you have extensive experience using script mode to create a SageMaker training job, then you can incorporate your own CatBoost training scripts.' Is the same with the Inference script, all provided artifacts.CommentShareEXPERTLorea-AWSanswered 10 months ago1For the built-in algorithms, you can simply specify estimator.deploy(), or tuner.deploy() and the trained model will be deployed to an endpoint for inference.You can also bring your own code/model, in which case, you'll need an inference.py file. See Use your own Inference Code for details.CommentShareDurga_Sanswered 10 months agoM 10 months agoThanks @Durga_S , I provided the code and trace back in this post  https://repost.aws/questions/QUVfbc_AsXRzaxAl69MMFlsQ/error-for-training-job-catboost-classification-model-error-message-type-error-cannot-convert-xxx-to-floatI'm trying to find a solution and I have searched a lot but with no success.  Please share your thoughts on this as well! ThanksShare"


Question: ECS Services In Different Accounts Using Same ALB and Route53 URL alias

"I have two AWS accounts.Account A has several ECS services, an ALB with target groups targetting IPs and Ports on those ECS services, and a hosted zone with a Route53 Alias record tying an API URL (ex. api.example.com) to the ALB DNS name.Now there is a requirement to have another ECS service, but in a separate account (account B) for security reasons. We still need to use the existing "api.example.com".What options do I have to deploy the new ECS service to the new account B, but have its traffic routed through the ALB of account A so we can still use the same API URL? Is my best option VPC peering, PrivateLink, etc? I'm struggling trying to find a good example of this.Also, account B does not have any ALB set up right now. Just an ECS service not exposed by any ALB target group. Could I potentially create a separate ALB in account B, add a target group that targets the new ECS service, and then somehow DNS my way into using the API URL configured in account A's hosted zone?Thank you!FollowComment"

Answer: "0What you are looking for is an API management layer.It goes like this:ALB -> API Gateway -> ALB ACCOUNT A -> ECSALB -> API Gateway -> ALB ACCOUNT B -> ECSNow, your account A needs properly setup networking and routing tables in your subnets able to resolve to ALB ACCOUNT B IPs.The API Gateway can be either AWS API Gateway, or Istio, or Kong, or others....And yes, you need at least 3 ALBs, One in front of each ECS, and one in front of the API gateway.Hope that helps!CommentShareDavidCaballeroanswered 4 months agorePost-User-9306963 4 months agoWhat exactly is API Gateway doing in this scenario within both the accounts? Is that an API GW in each account or just one?ShareDavidCaballero 4 months agoIts just 1 API gateway for both or "n" accounts. To clarify, with an API Gateway or an Ingress Controller layer at that point you can route your traffic to any targets.Share"


Question: Changing the UI of the Amazon Connect Streams CCP

"Hi,I am new to Amazon Connect and I have build my own Amazon Connect Streams using the instructions and code present on the GitHub. Following are the links:-GitHub Code: https://github.com/amazon-connect/amazon-connect-streamsGitHub Documentation: https://github.com/amazon-connect/amazon-connect-streams/blob/master/Documentation.mdThe application is running as expected. But now I have to change the UI of the CCP. Basically, I have to change the entire look of the CCP. But I am not able to locate the files that are required to make the UI changes.Please help.FollowComment"

Answer: 1Here is a sample blog on the UI:https://aws.amazon.com/blogs/contact-center/manage-agent-desk-phone-settings-with-a-custom-contact-control-panel/Workshop on Custom CCP:https://catalog.workshops.aws/amazon-connect-bootcamp/en-US/module6Workshop on full customization:https://catalog.workshops.aws/amazon-connect-softphone-controls/en-US/7-exercise-3CommentSharePhani_Lanswered a year ago


Question: Aurora event You may want to increase the provisioned storage

"Hi,I don't have a support agreement with AWS so am unable to raise a ticket with them.Currently suffering from an aurora database complaining about no disk space so i'm guessing it's local storage has filled up?What are my options? Resize the instance to a larger size and hope that fixes it?Cheers!FollowComment"

Answer: "0So I got out of this jam by:Changed the instance type of the cluster read instance to the next size up (as localstorage is dictated by instance type)Failed over the write node - now the resized read instance becomes the writer. We can now write to the database.Create a new read replica at the correct instance type and wait for it to complete creatingDelete the old, local disk full replica.CommentShareHuwgeanswered 2 years ago"


Question: "Find what version of RDS engines are available, using the API?"

"Is there a way that I can check what versions of MySQL are available using the command line or an api call?I'm trying to build a centralised report for a number of things, including if the currently used version has an upgrade available and don't want to be logging into multiple screens in the GUI or having to manually reference DocsFollowComment"

Answer: 0Accepted Answeraws rds describe-orderable-db-instance-options --engine mysql --query OrderableDBInstanceOptions[*]."EngineVersion"  --output table | uniqCommentShareMODERATORphilawsanswered 3 years ago0That's awesome...thanks s much :-DCommentSharejodrellanswered 3 years ago


Question: ADFS Claims Mapping to Cognito User Pools

"Hi All,I'm looking for a way to send custom attribute such as "Company" from AD using ADFS to Cognito User Pools.The customer wants to include the "Company" field in the JWT Token ID.For example, for E-Mail claims configuration I would use the following settings on ADFS side:https://d2908q01vomqb2.cloudfront.net/0a57cb53ba59c46fc4b692527a38a87c78d84028/2018/08/10/ADFS6.pngWith the following schema on Cognito side:http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressThere is any solution for that?Which schema / custom claims configuration should I use?FollowComment"

Answer: 0Accepted AnswerOn your Cognito User Pool you have a list of Attributes.  If the attribute you need is not on the standard list you can add a custom attribute.  You can then go to the Federation section of the console screen and select Attribute Mapping.  This will allow you to map the source attribute from ADFS to the attribute you selected or created in the Cognito User Pool.CommentShareDavid_Manswered 3 years ago


Question: Duplicate MQTT messages being received at DynamoDB

"So I have some sensors that are sending MQTT data using the IOT Core  to DynamoDB. However I note that there are always 2 messages(duplicates).I am using Select for the topic, set up a Rule as was needed,etc. ITs all working fine, except for the duplicates. I looked through the questions but didn't find an answer.Any suggestion to find the root cause appreciated. Regards6/11/22 additional dataSome additional info might be useful so I have provided it here.Rule query statement The source of the messages you want to process with this rule.Extract below.............SELECT state.reported.value as state_reported_value FROM '#' Using SQL version 2016-03-23 Actions Actions are what happens when a rule is triggered.Insert a message into a DynamoDB tableExtract end.................Hope this helps in directing me. RegardsFollowComment"

Answer: "0Accepted AnswerHi fixingthingsguy. The issue is likely related to using a wildcard for the topic in the FROM statement of the rule. The state.reported.value property could be found in the message of more than one topic. Even amongst shadow topics and shadow documents.In this case, it will likely appear in the shadow document for both the /update topic when the device publishes the new value and in the shadow document of the /updated/accepted topic when IoT Core responds. You probably want to change the FROM statement to use $aws/things/+/shadow/update if you're using the Classic shadow or $aws/things/+/shadow/name/<shadowName>/update if you're using a named shadow.CommentShareEXPERTGreg_Banswered a year ago0Greg_B. Thanks very much. I've been wracking my brains on this one. I just tested using your suggestion and the duplicates are not occurring.  So for any future user who sees the same problem, here's the before and after SELECT using Classic Shadow.BEFORE:SELECT state.reported.value as state_reported_value FROM '#'AFTER Greg_B's suggestion:SELECT state.reported.value as state_reported_value FROM '$aws/things/+/shadow/update'CommentSharefixingthingsguyanswered a year ago"


Question: Athena query fails with GENERIC_INTERNAL_ERROR: Missing variable: <column_name>

HiAfter creating quite complex view based on "UNION ALL" of 4 complex selects I've ended up with a curious situation:The view itself is queried OK with simple queries like select * from <view_name> where <conditions>Once I wrap it into bigger select like select count(*) from (select * from <view_name> where <conditions>) I get the following strange error:GENERIC_INTERNAL_ERROR: Missing variable: <column_name> where <column_name> is absolutely live and valid column that could be queried and returned as usualThe issue is repeatable - once I recreate the same set of views on another Database and same data - issue repeatsHowever it's barely searched on the web - looks like nobody faced such errorsFollowComment

Answer: "0Accepted AnswerUpdate on the topic:I had the hypothesis that the resulting query is too long (after unwrapping all the selects from underlying views)So I changed the <view_name> to Create Table As Select and looks like it fixed my problem, however I'm not sure that exactly this helpedCommentShareSergey Nanswered a year ago"


Question: Codebuild Rate Limiting

"We have been noticing a significant uptick in CodeBuild failures due to throttling, usually when several of our pipelines (that contain CodeBuild projects) get triggered concurrently.  The error message is "Error calling startBuild: Rate exceeded (Service: AWSCodeBuild; Status Code: 400; Error Code: ThrottlingException)".We have several CodeBuild projects and several pipelines, and sometimes several of those do get triggered concurrently. We have currently been retrying these manually. Is there a solution to this that does not involve just setting up automatic retries?FollowComment"


Question: IAM Role/profile support with Athena ODBC Connector

"When using Athena ODBC on Windows Computer/Laptop, is it possible to use IAM role instead of creating IAM access key and secret access key? Is it even possible? unable to get clear mention about this.FollowComment"

Answer: "1Use IAM role credentials for an Athena JDBC driver connectionThis is a method with the JDBC driver. You could also apply it to the ODBC driver, I guess.CommentSharejhashimotoanswered 5 months agorepost_user_1342 5 months agoLet me get back to you with the update if it worked. Thanks!Share0Yes the Amazon Athena ODBC driver supports authentication using IAM profile (see "Using an IAM profile on Windows" in page 15 of the ODBC driver guide). However, on your Windows laptop, you still need use an IAM user credentials (access key + secret access key) to assume that IAM role. For details how to configure the credential file, please refer to https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html#cli-role-overviewCommentShareCorvus_Lanswered 5 months ago"


Question: Executing a project containing the following technologies Amazon Web Services (AWS) (free tier) Angular JS Java Javascript Node.JS NoSQL

"I am supposed to work on and deliver a full stack project with the implementation of the technologies mentioned below, i.eAmazon Web Services (AWS)Angular JSJavaJavascriptNode.JSNoSQLGet the website link of the full stack project and upload the website link of the project in the application form for a internship job role in a company or organization which happens to be in Bangalore city of the country India.I am not well aware of how to build a full stack project from scratch and upload the website link of the project in the online application form for the internship opportunity in full stack development in a company or organization in Bangalore city of the country India.May I please know how can I execute a full stack web development project by making use of the technologies indicated earlier i.e Amazon Web Services (AWS), Angular JS, Java, Javascript, Node.JS and No SQL, retrieve the website link of the full stack web development project and upload the website link in the online application form for full stack development internship in a company or organization in Bangalore city of the country India and how can I know more about it?I wish to start with the basic free tier account of AWS platform to execute the full stack web development project as per the specifications mentioned earlier.I am hereby indicating the internship website link for your reference.https://internshala.com/internship/detail/full-stack-development-internship-in-bangalore-at-clappia1684315774May I please know about it?FollowComment"

Answer: "0Here's a step by step guide on one way to deploy a full stack environment - https://aws.amazon.com/getting-started/hands-on/build-react-app-amplify-graphql/.However, I would highly recommend you start by learning about the AWS ecosystem.  This course is available for free here - https://explore.skillbuilder.aws/learn/learning_plan/view/82/cloud-essentials-learning-plan-earn-a-learning-badge.Once you have some of the skills you'll earn by going through the training, you'll be able to better understand the tools and services used to deploy the full stack tools.I highly recommend you start with the first part, so that when asked about what you deployed you'll be able to articulate the decisions made.Hope this helps.CommentShareCarlos del Castilloanswered 7 days ago"


Question: Why does the "AWS System Manager" collect a list of processes?

Hello.Hello. I noticed something strange while monitoring system events.I need to know why does the "AWS System Manager" collect a list of processes.Thanks for your help.FollowComment

Answer: "0It's part of the functionality offered by Fleet Manager.  From the doc:"Using Fleet Manager, you can view information about processes. For example, you can see the CPU utilization and memory usage of processes in addition to their handles and threads. With Fleet Manager, you can start and terminate processes from the console."If you want to dig into all the functionality of the SSM Agent and what it collects, it's on GitHub here.CommentShareAWSJoeanswered 10 months agoLael 10 months agoWhy does the agent collect process information even when I am not using(open) the fleet manager?Isn't the process information fetched from the instance in real time?Share"


Question: DRC failing with multiple driver nets in cl_ocl_slv

"Hi,I am adapting the cl_dram_dma hdk example for my own project, and during the running of aws_build_dcp_from_cl.sh, I am encountering the DRC error below. I cannot find anywhere in the cl_ocl_slv module or instantiation that has the nets below, so I was hoping to get some insight into why the DRC is failing and how to go about fixing it.Thank you in advance.Command: opt_designAttempting to get a license for feature 'Implementation' and/or device 'xcvu9p'INFO: [Common 17-349] Got license for feature 'Implementation' and/or device 'xcvu9p'Attempting to get a license: PartialReconfigurationFeature available: PartialReconfigurationRunning DRC as a precondition to command opt_designStarting DRC TaskINFO: [DRC 23-27] Running DRC with 8 threadsERROR: [DRC MDRV-1] Multiple Driver Nets: Net WRAPPER_INST/CL/CL_OCL_SLV/I9[0] has multiple drivers: WRAPPER_INST/CL/CL_OCL_SLV/pipe[0][0]_i_2/O, and WRAPPER_INST/CL/CL_OCL_SLV/pipe[0][0]_i_1__3/O.WARNING: [DRC RPBF-3] IO port buffering is incomplete: Device port I2C_FPGA_MEM_R_SCL expects both input and output buffering but the buffers are incomplete.WARNING: [DRC RPBF-3] IO port buffering is incomplete: Device port I2C_FPGA_QSFP28_R_SCL expects both input and output buffering but the buffers are incomplete.INFO: [Project 1-461] DRC finished with 1 Errors, 2 WarningsINFO: [Project 1-462] Please refer to the DRC report (report_drc) for more information.ERROR: [Vivado_Tcl 4-78] Error(s) found during DRC. Opt_design not run.FollowComment"

Answer: "0Hello,You should be able to open the Synthesized design schematic and trace the nets in question to the source/destination flops.  This should give you an idea on where the multi-driven net is.Thanks,-AsifCommentShareawsasifanswered 4 years ago"


Question: How does fronting API Gateway with CloudFront help with DDoS mitigation and protection?

"Hi,We have an API Gateway with regional endpoints. We have attached WAF to the API Gateway for L7 protection.Researching how we can further protect our system, this AWS whitepaper suggests we use CloudFront in front of the API Gateway:Amazon CloudFront distributes traffic across multiple edge locations, and filters requests to help ensure that only valid requests will be forwarded to your API Gateway deployments.I suspect my understanding of the edge network is limited and the answer may be obvious, but can someone expand on this quote or provide further information on why CloudFront helps with DDoS mitigation?Also as far as I know, CloudFront uses Shield for DDoS mitigation and detection at L3/L4. But Shield Standard is also used in all AWS services, including API Gateway. Are there benefits to using CloudFront for DDoS mitigation and protection beyond Shield?FollowComment"

Answer: "1Accepted AnswerHi,When you use AWS Shield Standard with Amazon CloudFront, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. These services are part of the AWS Global Edge Network and can improve the DDoS resiliency of your application when serving any type of application traffic from edge locations distributed around the world.Some benefits of using CloudFront are:Access to internet and DDoS mitigation capacity across the AWS Global Edge Network. This is useful in mitigating larger volumetric attacks, which can reach terabit scale.AWS Shield DDoS mitigation systems are integrated with AWS edge services, reducing time-to-mitigate from minutes to sub second.Stateless SYN Flood mitigation techniques proxy and verify incoming connections before passing them to the protected service. This ensures that only valid connections reach your application while protecting your legitimate end users against false positives drops.Automatic traffic engineering systems that disperse or isolate the impact of large volumetric DDoS attacks. These services isolate attacks at the source before they reach your origin, which means less impact on systems protected by these services.I Suggest you to read the AWS Best Practices for DDoS Resiliency Whitepaper is an AWSome source of knowledge regarding this topic.Additionally, you have some other security benefits with CloudFront:Reduced latency for your end users if they access your services from other countriesRestricting the geographic distribution of your contentServing private content with signed URLs and signed cookiesAnd others...Another good benefit is a cheaper DTO using CloudFront, example (from AWS Pricing Calculator):DTO in US East (N. Virginia) - Internet: 1024 GB x 0.09 USD per GB = 92.16 USDCloudFront DTO in US East (N. Virginia) - Internet:  1024 GB x 0.085 USD = 87.04 USDBest Regards,Ricardo MakinoCommentShareRicardo_Manswered 6 months ago0Currently, AWS Shield Advanced doesn't support enabling protection on API Gateways, but supports CloudFront. Therefore, it's a best practice to place the CloudFront Distribution in front of the API Gateway and then enable protection on that distribution.https://repost.aws/questions/QUGMi_eNmkTB-nVwLdze9eKA/what-are-the-benefits-of-using-amazon-cloud-front-together-with-amazon-api-gatewayCommentShareGautam Kumaranswered 6 months agoRicardo_M 6 months agoHi Gautam, but Shield Standard protects all AWS Resources, the question is what are the benefits including Amazon CloudFront within Amazon API Gateway just using AWS Shield Standard?Share"


Question: Cognito Custom HTML Message with Text alternative

"We found out that our Cognito emails are filtered at some company email servers. We are sending custom messages with HTML EMails. The email has no text only alternative. When we remove the HTML and replace it with a custom text message, the emails will reach the target inboxes.Is it possible to send HTML emails with text alternatives?Is there any solution for this problem? We need a solution to deliver our email verification mails to all our customers.We already use a custom verified identity for FROM email address via SES.FollowComment"

Answer: "0Hello,In regards to your first question, I believe that Amazon SES can send emails in text-only templates. However, Cognito cannot send verification or invitation messages without HTML. This is because Cognito requires HTML placeholders in order to send user verification codes, links, and invitation usernames and passwords.In regards to solutions, because Cognito Email verification messages require the HTML placeholder, I would recommend first checking that your SES domain is properly authenticated as is suggested in the SES documentation here:https://docs.aws.amazon.com/ses/latest/dg/tips-and-best-practices.htmlIf your domain isn't properly authenticated, doing so may resolve the HTML email issues you face. If your domain is properly authenticated you might have to work with your customers to resolve why your emails are being filtered out of their mail systems.If you have any more questions feel free to reach out.CommentShareJustin_Panswered 10 months ago"


Question: "Bug Report: EventBridge Schedules Console does not set "launchType" for ECS RunTask, breaks Assign Public IP"

"Issue Description: When creating a schedule on the EventBridge Schedules Console that uses ECS RunTask, the schedule fails to include launchType in its requestParameters when it is set. This breaks the ability to set Assign Public IP with the error "Assign public IP is not supported for this launch type."Likely related to this issue: https://repost.aws/questions/QU7GVF66EhSjuLp04GafMKGQ/event-bridge-scheduler-fails-on-ecs-run-task-with-fargate-launch-typeSteps to Reproduce:Create a new schedule in the EventBridge Schedules console.Choose ECS RunTask as the Target.Under the RunTask config section, set Compute Options > Launch type to FARGATESet Configure Network Configuration > Auto-assign Public IP to ENABLEDRunTask will fail with logs in CloudTrail similar to the following:"errorCode": "InvalidParameterException",    "errorMessage": "Assign public IP is not supported for this launch type.",    "requestParameters": {        "cluster": "arn:aws:ecs:XXXXX:XXXXX:cluster/XXXX",        "count": 1,        "enableECSManagedTags": true,        "enableExecuteCommand": false,        "networkConfiguration": {            "awsvpcConfiguration": {                "assignPublicIp": "ENABLED",                "subnets": [                    "subnet-XXXXX"                ]            }        },        "overrides": {},        "placementConstraints": [],        "placementStrategy": [],        "platformVersion": "1.4.0",        "startedBy": "chronos-schedule/XXXXX",        "tags": [],        "taskDefinition": "arn:aws:ecs:XXXXX:XXXXX:task-definition/XXXXX:X"    },Notably, launchType is missing from requestParameters even through assignPublicIp was successfully set.Workaround: I was able to finish my desired test by manually creating a schedule using the AWS CLI. Then, I had no further issue implementing the request in the actual Lambda function being developed. However, this issue was an obstacle to testing and debugging.FollowCommentHenrique Santana 5 months agoI was able to create the schedule and run the task. Checking the Ctrail, I can see that it has the launchType filled with "Fargate".Could you please run the below command output?$ aws scheduler get-schedule --name SCHEDULE_NAMEShare"


Question: I have a question about the AWS FreeRTOS DQP test.

"hi.AWS FreeRTOS DQP certification testing in progress.During initial authentication, the following error occurs.I would like to know how to proceed with this part.[INFO] [2022-12-15 10:49:41]: Setting up device for testing[INFO] [2022-12-15 10:49:41]: Library Version Check test setup[INFO] [2022-12-15 10:49:41]: Downloading FreeRTOS-Libraries-Integration-Tests Version Mappings from https://raw.githubusercontent.com/FreeRTOS/FreeRTOS-Libraries-Integration-Tests/main/version-mappings.yml[INFO] [2022-12-15 10:49:41]: Downloading FreeRTOS manifest.yml from https://raw.githubusercontent.com/FreeRTOS/FreeRTOS-LTS/202210.01-LTS/manifest.yml[INFO] [2022-12-15 10:49:41]: Library Version Check test execution[INFO] [2022-12-15 10:49:41]: FreeRTOS Version: 202210.01-LTS[INFO] [2022-12-15 10:49:41]: Checking if FreeRTOS-Libraries-Integration-Tests exists in manifest.yml[INFO] [2022-12-15 10:49:41]: IDT can not test version compatiblity with FreeRTOS-Libraries-Integration-Tests, because it does NOT exist in your manifest.yml[INFO] [2022-12-15 10:49:41]: Version Checking manifest.yml Libraries[INFO] [2022-12-15 10:49:41]: Verifying local FreeRTOS-Kernel repo contains the required version V10.5.1[INFO] [2022-12-15 10:49:41]: Finding required commit id for repo FreeRTOS-Kernel[INFO] [2022-12-15 10:50:25]: The required commit id is c17a41c for version V10.5.1 of repo 'FreeRTOS-Kernel'[INFO] [2022-12-15 10:50:25]: Getting information about the local repo 'FreeRTOS-Kernel'[ERROR] [2022-12-15 10:50:25]: Local repo 'FreeRTOS-Kernel' is on commit eadaff5, which is not the required commit. Please checkout commit c17a41c[INFO] [2022-12-15 10:50:25]: The repo 'FreeRTOS-Kernel' version was not verified.[ERROR] [2022-12-15 10:50:25]: Test failure: The required FreeRTOS libraries for version 202210.01-LTS were not able to be verified with the following reasons:IDT can not test version compatiblity with FreeRTOS-Libraries-Integration-Tests, because it does NOT exist in your manifest.ymlLocal repo 'FreeRTOS-Kernel' is on commit eadaff5, which is not the required commit. Please checkout commit c17a41c[INFO] [2022-12-15 10:50:25]: Cleaning up test resources...[INFO] [2022-12-15 10:50:25]: Library Version Check test cleanup[INFO] [2022-12-15 10:50:25]: #################################################[INFO] [2022-12-15 10:50:25]: Cleaning up AWS resources... This may take a while...[INFO] [2022-12-15 10:50:25]: #################################################[INFO] [2022-12-15 10:50:25]: Finished running test case[INFO] [2022-12-15 10:50:26]: All tests finished. executionId=ba3bf8eb-7c1a-11ed-ae09-ca9402fae9a5[INFO] [2022-12-15 10:50:26]:========== Test Summary ==========Execution Time:         46sTests Completed:        2Tests Passed:           1Tests Failed:           1Tests Skipped:          0Test Groups:FreeRTOSVersion:            FAILEDThank you.FollowComment"

Answer: "0Please submit a ticket to the AWS Training & Certification customer support team, and they will provide assistance. If you already submitted a case, please allow at least 48 hrs to get a response.CommentShareNelliT-AWSanswered 2 months ago"


Question: ELB health check fails if path is anything but root

"I've got an Application ELB running in front of a Target Group that currently has only 1 instance, a web server (NGINX) running a WordPress site.The ELB's health check fails with a 404 error unless I set the path to the web server's root directory ("/"). The ELB seems to be directing traffic fine--I can browse anywhere on the site no problem, including to a special file I created just for the health check (health-check.php).I looked in my web server's access log to see what exactly is happening when the ELB health check tries to ping a file:172.31.36.39 - - [12/Jul/2020:13:38:41 +0000] "GET /health-check.php HTTP/1.1" 404 134 "-" "ELB-HealthChecker/2.0"But if I point the health checker to the root it works fine:172.31.28.14 - - [12/Jul/2020:13:59:42 +0000] "GET / HTTP/1.1" 200 396 "-" "ELB-HealthChecker/2.0"I'm going round and round in circles here trying to figure this out but can't seem to pinpoint the problem.Any advice or help would be hugely appreciated.Why does the server return a 404 code to the health checker but returns a 200 when I access the same exact file with my browser?FollowComment"

Answer: 0I resolved this: the health checker apparently communicates to the server without using the domain name assigned to it and I had inadvertently left something in the NGINX config. that pointed any requests other than those with the domain name to a different root location. So the health checker wasn't actually looking in the right root directory. My mistake.CommentShareMrMegunticookanswered 3 years ago0I figured it out...see my last post.CommentShareMrMegunticookanswered 2 years ago


Question: Azure files to Winfx - Datasync CIFS Mount Error 2

"Mounting the destination location, which is an Azure file share is failing with return 2Task failed to access location loc-0315c941957665151: x40016: mount error(2): No such file or directory Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)FollowCommentDan Adams 4 months agoWould this be an Azure Files to Amazon FSx for Windows transfer (or reverse?)  Your comments list the destination as an Azure file share.Share"

Answer: "0Hello,You can start here by checking your Azure SMB location settings and verify the Server, Path and User along with credentials for the Azure files location.This blog provides setup tips and how to get those required details.https://aws.amazon.com/blogs/storage/how-to-move-data-from-azure-files-smb-shares-to-aws-using-aws-datasync/CommentShareDarryl_Dioanswered 5 months ago"