Question: Lifecyle rule not moving to Glazier

Hi!  I am new to using Amazon AWS.  I have some buckets in S3.  For one of the buckets I created a Lifecycle rule to move things older than 30 days to Glazier.  This LiveCyle rule is not moving anything to Glazier.  How can I figure out why this is not working?FollowComment

Answer: "0Sorry - I was looking at this incorrectly.  The rule is running.CommentShareBurke500answered 2 years ago0Hello,Greetings of the day,I am happy that your lifecycle rule is running as expected.I would also like to mention that, Amazon S3 rounds the transition or expiration date of an object to midnight UTC the next day. For example, if you created an object on 1/1/2020 10:30 UTC, and you set the lifecycle rule to transition the object after 3 days, then the transition date of the object is 1/5/2020 00:00 UTC.However, there might be a delay between when the lifecycle rule is satisfied and when the action for the rule is complete. Changes in billing are applied when the lifecycle rule is satisfied, even if the action hasn't been completed.[+] https://aws.amazon.com/premiumsupport/knowledge-center/s3-lifecycle-rule-delay/[+] https://docs.aws.amazon.com/AmazonS3/latest/dev/lifecycle-expire-general-considerations.htmlThank you!!CommentShareAWS-User-2928704answered 2 years ago"


Question: Using Python script to automate Routing Profile change

"I have created a Python script with Selenium to read data (like alias, routing profile name) from real-time routing profile change request SIMs coming from Operations team and then going to the Amazon Connect and change the existing routing profile selection for that particular alias to the requested routing profile and then coming back to the SIM and resolving it with comments. This is to automate our real-time SIM requests. This Python script will interact with the Amazon Connect web application using keys (TAB, SHIFT, SPACE, ENTER, etc) to do its job and use xpaths to interact with the SIM-C portal elements. Do I need any special permissions from the Amazon Connect team to use/run this script? Can anyone help me with this question?FollowComment"

Answer: "1Accepted AnswerHi there!  This type of automation is quite common.  You'll need IAM permissions to access the requisite Amazon Connect resources via SDK or API.  Check out this documentation link that discusses available Resources in IAM for Amazon Connect: https://docs.aws.amazon.com/connect/latest/adminguide/security_iam_service-with-iam.htmlCommentSharegthomasanswered a year ago1Doing this via Selenium is not the best approach, look at the API to do everything you're looking for.davidCommentSharedmaciasanswered a year ago"


Question: How to reset offset of a consumer group created through MSK connect

"I have created consumer using MSK connect but when I try to reset the offset to the beginning, it keep throwing this errorError: Assignments can only be reset if the group 'connect-opensearch-connector-v1' is inactive, but the current state is Stable. if I were to delete the connector, would I need to re-create it with the same name so that it subscribe to the same consumer group? and pull the records based on the offset which was set post deleting it?FollowComment"


Question: Unable to update the email address of a AWS Account under AWS Organizations

"Hi,I have created a new organization unit(OU) and created a AWS Account within this OU, the AWS Account email is not working so I want to update the email with other one but I have not found any option for updating the email ID for an AWS Account. Please do needfulFollowCommentMaulik_Makadiya a year agoI doubts, its not possible to edit email address once sub account is created under organization.Share"

Answer: "2You can update the email address on an Organizations-created account by logging in as the root user (to that account); see https://aws.amazon.com/premiumsupport/knowledge-center/change-email-address/ and https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-account-payment.htmlHowever, before you can log in to an Organizations-created account you will need to reset the root password, because Organizations sets it to a randomised one and then discards it. This may be a problem if you cannot receive email at the address used for the account. See https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot-aws-sign-in.html#troubleshoot_general_lost-root-creds for some options.CommentShareEXPERTJames_Sanswered a year ago0You can update an account's email address by logging into that account's console.  Even then you may find the old email address is still shown under Organizations - annoying, but doesn't have any impact.CommentShareEXPERTskinsmananswered a year ago"


Question: ssh key-pair anomaly on copying AMI

"I made an image of an instance running in N. Virginia, copied it to Singapore and launched it. On launch, it told me that I have no existing key-pairs, so I had to create a new one. That seemed odd, as I had a key-pair for the instance running in N. Virginia.After launch, when I tried to connect via SSH I gotPermission denied (publickey,gssapi-keyex,gssapi-with-mic).After trying several solutions, I tried connecting to the new, Singapore instance using the key from the old N. Virginia instance. I connected successfully.  I checked the authorized_keys file and saw that it contained the old N. Virginia key.I extracted public key from the new Singapore key-pair that I had downloaded and concatenated that into the authorized_keys file on the new Singapore instance.When I tried to connect using the new key_pair, I again gotPermission denied (publickey,gssapi-keyex,gssapi-with-mic).The only way that I can connect to the new instance is by using the old key-pair. It's not too much of a problem as I'd have chosen to use that key-pair anyway, had I been given a choice when I launched the instance for the first time.However, I'm concerned that it won't accept the new key-pair, even though I've added it to authorized keys. I'm also surprised that the process for copying an AMI has what appears to be a bug.FollowComment"

Answer: "1Hi!  When you created the AMI, did you remove the SSH host key pairs located in /etc/ssh?  If you do so, this will force SSH to generate new and uique SSH key pairs when another instance is launched using the AMI (such as what you did in the Singapore region).This includes the following key files that may be present:ssh_host_dsa_keyssh_host_dsa_key.pubssh_host_keyssh_host_key.pubssh_host_rsa_keyssh_host_rsa_key.pubssh_host_ecdsa_keyssh_host_ecdsa_key.pubssh_host_ed25519_keyssh_host_ed25519_key.pubIf you remove the SSH host key pairs prior to creating the AMI, then the shared AMI should use the new keys as you expected to happen.   You can use something like shred to remove files: https://www.gnu.org/software/coreutils/manual/html_node/shred-invocation.html.Edit: This is documented behavior.  Check out the Remove SSH Key Pairs section of https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/building-shared-amis.html for a security practice to use when sharing AMIs.  I would recommend removing the SSH key pairs when you're creating the image and this issue should resolve when you start a new instance from that new image.CommentSharejsoncanswered a year agoAWS-User-1977007 a year agoNo, I didn't do anything out of the ordinary. I just stopped the instance and then started the image copy.Share0This is expected behaviour.In the console, key-pairs are region-specific - creating a key-pair in one region does not make it available in other regions. You can import key-pairs so that you have the same key-pair in each region; but creating a new key-pair in the Singapore region (even with the same name) is actually creating a new key-pair.When you copied the AMI from N. Virginia to Singapore the AMI contained the public key for the key-pair from the N. Virginia region. Had you created a new AMI in the Singapore region it would have used the key material from the key-pair created in the Singapore region; but because it was copied it contained the original key material.In the end, you got to a valid solution - taking the Singapore public key material and putting it on the instance; but you might also have created a key-pair and imported it into both regions: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-ssh-key-pair-regions/CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: CloudFront Live Streaming - Active Viewers

"A customer is using MediaLive / MediaPackage for live streaming integrated with CloudFront. Is there any way to monitor how many clients are watching the livestream? Currently customer is using CloudFront monitoring metrics and they can obtain number of requests made to CloudFront. However, it does not give any information about the sessions. How many new clients watching, how many of them had left etc.. Is there any monitoring metric or API that customer can get this information including session data?Thanks.FollowComment"

Answer: "0Accepted Answerbest way to capture actual viewer number would be capturing player event.in order to do so, customer should add a plug-in to the streaming player which sends data to Kinesis Data Firehose. (or any other implementation)There is a solution + workshop https://github.com/awslabs/aws-streaming-media-analyticsCommentShareJuliananswered 3 years ago"


Question: View SAML assertions passed to Cognito

My company uses Cognito to manage users for our website.I would like to debug problems users have signing in with SAML.Is there a way to see logs on SAML assertions that are passed from our user's IdP to Cognito?I'm hoping there's a place where I can see the content of every SAML assertion that Cognito receives.  So far I have not found anything like this.FollowComment

Answer: 1I would recommend using the SAML tracer chrome extension(It's like fiddler for SAML).  Please see the following URL. If you are unable to use the extension or it does not meet your needs then please use AWS CloudTrail logs.https://chrome.google.com/webstore/detail/saml-tracer/mpdajninpobndbfcldcmbpnnbhibjmch?hl=enCommentShareGauravanswered 6 months ago


Question: How do I end my account/take my website offline?

How do I end my account/tkae my website offline?FollowComment

Answer: "0Delete Website on S3If your website is hosted via S3 then deleting the bucket and hosted zones on Route53 will remove the website and prevent future charges.To Delete AWS AccountLog in to the AWS Management Console with your account credentials at https://aws.amazon.com/console/.In the top navigation bar, click on your account name or the "Services" dropdown menu and select "My Account."On the "My Account" page, scroll down to the "My Billing Dashboard" section and click on the "Go to Billing & Cost Management" button. This will open the AWS Billing and Cost Management console.In the left navigation pane of the Billing and Cost Management console, click on "Billing preferences" or "Payment methods" to ensure that your billing information is up to date and that there are no outstanding charges.After reviewing your billing information, go to the "Account Settings" section and click on "Close Account." This will initiate the account closure process.Follow the instructions provided on the screen to close your account. This may involve confirming your identity, reviewing any outstanding charges, and acknowledging the consequences of closing the account.Once you have completed the closure process, AWS will start terminating your resources and services. Depending on your usage and the resources involved, this process may take some time.It's important to note that closing your AWS account will stop any ongoing billing, but it does not automatically delete your website or associated resources. You will need to manually terminate or delete your AWS resources such as EC2 instances, S3 buckets, databases, and any other services you have been using. Be sure to back up any data you want to keep before terminating resources.CommentShareFS_AWSanswered 6 days ago"


Question: Unable to get WAF rule OversizeHandling property from Lambda

"From what I can tell, it doesn't seem to be possible to retrieve the OversideHandling property for a WAF rule using a Lambda function. The WAF is returned using client.get_web_acl(...), however the OversizeHandling is stripped out of the rules inside the WAF.This is problematic because our workflow is that we create a stack in CloudFormation using aws-waf-security-automations, then have a lambda run to make our own customisations to these rules and save them. Because the OversizeHandling is stripped during this process, the end result we are not compliant with the breaking changes being introduced at the end of this month that makes specifying the OversizeHandling mandatory.I've created a simple proof of concept to demonstrate this:WAFNote the OversizeHandling is present in the Body of the SqliMatchStatement{  "Name": "test-waf2-CloudFrontWAFAutomationsTest-1JLD9J7O1XHCD",...  "Rules": [...    {      "Name": "test-waf2-CloudFrontWAFAutomationsTest-1JLD9J7O1XHCDSqlInjectionRule",      "Priority": 20,      "Statement": {        "OrStatement": {          "Statements": [...            {              "SqliMatchStatement": {                "FieldToMatch": {                  "Body": {                    "OversizeHandling": "CONTINUE"                  }                },                "TextTransformations": [                  {                    "Priority": 1,                    "Type": "URL_DECODE"                  },                  {                    "Priority": 2,                    "Type": "HTML_ENTITY_DECODE"                  }                ],                "SensitivityLevel": "LOW"              }            }...Test lambda:import jsonimport loggingimport boto3logger = logging.getLogger(__name__)logger.setLevel(logging.INFO)client = boto3.client('wafv2')def lambda_handler(event, context):    web_acl = client.get_web_acl(Name="test-waf2-CloudFrontWAFAutomationsTest-1JLD9J7O1XHCD", Id="b01b9488-6255-443a-b3f5-5f384dc4f0b9", Scope="CLOUDFRONT")    logger.info("Web ACL: %s", web_acl)Lambda log outputNote there is no OversizeHandling under the Body of the SqliMatchStatement. The SensitivityLevel also appears to be missing.{   "WebACL":{      "Name":"test-waf2-CloudFrontWAFAutomationsTest-1JLD9J7O1XHCD"...      "Rules":[...         {            "Name":"test-waf2-CloudFrontWAFAutomationsTest-1JLD9J7O1XHCDSqlInjectionRule",            "Priority":20,            "Statement":{               "OrStatement":{                  "Statements":[...                     {                        "SqliMatchStatement":{                           "FieldToMatch":{                              "Body":{                                                               }                           },                           "TextTransformations":[                              {                                 "Priority":1,                                 "Type":"URL_DECODE"                              },                              {                                 "Priority":2,                                 "Type":"HTML_ENTITY_DECODE"                              }                           ]                        }                     },Does anyone have any idea why the OversizeHandling is being stripped, or have a suggestion for a workaround? Thank you!FollowComment"


Question: EMR serverless spark jobs connection with postgresql

"Hi, I want to run a job on EMR serverless which reads and writes data from postgresql. I downloaded the jar file and pushed it to s3 and set "spark.jars" in Spark properties in management console. However the job is still failing.Thank you,MuthuFollowCommentdacort a month agoMore details are needed including what the error message is when the job fails. That said, if you are connecting to postgres, make sure your Serverless application is created in a VPC and that the security groups have access to the database. Reachability analyzer can be used to debug network connectivity issues.ShareKashif a month agoHi Muthu,Can you please share what error you are getting and snippet of your code if possible to see how you are trying to connect?Share"

Answer: "1Accepted AnswerThank you all for taking your time to reply, I solved the issue by following Dacort's comment and setting up my Serverless application inside a VPC whose security groups have access to the database.  This is my code snippetsample_data = spark.read.format("jdbc").options(url='jdbc:postgresql://<sample-name>.<region-name>.rds.amazonaws.com/dev',dbtable='public."<sample-name>"',user='<sample-user>',password='<sample-pass>',driver='org.postgresql.Driver').load()I was getting this error :Caused by: java.net.SocketTimeoutException: connect timed out : org.postgresql.util.PSQLException: The connection attempt failed.CommentSharemuthuanswered a month ago"


Question: Not able to enter in VR Play Mode

"Hi,I build a scene with some basic entices. And imported Core VR Asset in my scene.Dragged the VRCameraRig in entity panel and enabled the CurrentVRCameraRig. But when i click on Enter VR icon on bottom right of Amazon sumerian is gives error that "Please make sure that your system is connected and turned on.Here I am using HTC Vive Device and it is working properly on other platformsCan you suggest me what I can do to resolve this?FollowComment"


Question: DMS task fails when Postgres DateStyle parameter is not ISO

"Hi everyone.I need to replicate some tables from a Postgres 11.14 database on an Amazon EC2 instance with DMS.When I start the DMS task, it fails and the log shows me that the problem has to do with the configuration of the parameter DateStyle in the source system (Postgres).In the source this parameter is set to 'SQL, DMY' and DMS tells me that needs it set up to 'ISO' to do the replication.2022-06-08T21:22:00 [SOURCE_CAPTURE  ]E:  Bad setting for 'DateStyle' parameter. WAL connection setup is expecting 'ISO'. [1020452]  (postgres_endpoint_wal_engine.c:1341)I cannot change this configuration in the source because there we have a Core that needs this parameter to be configured like that ('SQL, DMY').Is there another way in which we can replicate without having to change this parameter?Thanks in advance.FollowComment"

Answer: "0Accepted AnswerWe were finally able to find the solution:Set datestyle only for the replication user:ALTER USER my_replication_user SET datestyle='ISO, MDY';For verifying whether the change has taken effect:SELECT usename,useconfig FROM pg_catalog.pg_user WHERE usename='my_replication_user';After making the above changes, restart the DMS task and that's all.CommentShareaimeezuhaanswered 10 months ago0Can you use Logical Replication (which is far better than DMS) to replicate instead? What is the target?CommentShareJD-PostgresExpertanswered a year ago"


Question: DataSync Agent -- What user does it run as?

A customer is running a POC of DataSync to sync files from an Isilon file system to S3. They have strict audit logging requirements and would like to configure the DataSync agent to access the file system via NFS using a specific user in order to track its access in their audit logs.What user does the DataSync Agent run as?Can it be configured to run as a different user or to access the NFS mount as a specific user?FollowComment

Answer: "0Accepted AnswerToday, DataSync will mount NFS locations as the root user.  This is why we recommend no_root_squash to be enabled in our docs (https://docs.aws.amazon.com/datasync/latest/userguide/create-nfs-location.html).  We do this intentionally as it gives us the most likely chance of being able to access all files on the file system.  I'm not sure if Isilon supports root_squashing to a particular UID/GID, but that might be a workaround here.CommentShareJeff_Banswered 3 years ago"


Question: getting null on quicksight service configuration

Does anyone have any insight on this issue?getting null on quicksight service configuration -FollowComment

Answer: "0Without additional context, it's difficult to say exactly what's causing the null values you're seeing in Amazon QuickSight. Here are a few things you could check to resolve your issue:Data source configuration: Make sure your data source is properly configured and that the appropriate permissions are set.Data format: Ensure that your data is in a format that QuickSight can read and that the data source is pointing to the correct file or database.Data connection: Make sure that QuickSight can establish a connection to the data source. This can be done by checking the data source connection status in QuickSight.Data refresh: If you're using a DirectQuery or Live Connection, make sure that the data is being properly refreshed.Missing values: Check if there are any missing values in your data that might be causing the null values in QuickSight.Calculation logic: If you're using calculated fields in QuickSight, make sure the calculation logic is correct and that there aren't any errors in the formula.Follow these steps https://docs.aws.amazon.com/quicksight/latest/user/troubleshooting.html to check if they help. By following these steps and checking for any potential issues, you should be able to resolve the null values you're seeing in QuickSight. If you're still encountering problems, consider reaching out to Amazon Support for additional assistance.CommentShareAnanth Tirumanuranswered 4 months ago"


Question: "CentOS 8 removed, CentOS 9 added yet CentOS 7 remains?"

"In lightsail We note that CentOS 9 steam has been added to LightSail on the sly with the complete removal of CentOS 8. However, CentOS 7 remains?What is the status with relation to CentOS 8 in lightsail?We as a company need to reassurance as given the above move by AWS with no mention anywhere on the LightSail news blog has got us spooked even more so.FollowComment"

Answer: "0Indeed, the documentation here lists CentOS9 and erases CentOS8.This leads me to believe that CentOS8 itself may not be able to create a new one with lightsail.Well, I would not be surprised if CentOS8 itself is no longer available as it is nearing EOL. (Although I wonder why CentOS7 is still around...)https://lightsail.aws.amazon.com/ls/docs/en_us/articles/compare-options-choose-lightsail-instance-imageCommentShareEXPERTRiku_Kobayashianswered 8 days ago"


Question: Programically get Standard Control Score

"I hope this is not a dumb question and I'm just overlooking something.  I'm trying to figure out how to get the Security Score from a set of enabled controls (CIS) via CLI/Boto/Golang, etc. I don't see any options where to pull it from or how to calculate it.  Has anyone done this before?FollowComment"

Answer: "0We are planning to release an API for security scores later this year. today, you would need to more manually calculate a score based on number of passed vs. failed controls.Edited by: Ely-AWS on Feb 1, 2021 1:10 PMCommentShareEly_Kanswered 2 years agorePost-User-6726844 2 months agoHi @Ely-AWS, I wanted to know is this api is available now?Share0Oh, that's great to hear, thank you for the update!CommentSharethethirdfishanswered 2 years agoAWS-User-2792197 a year agoIs this available now?Share0Is this  out now? I need the same.CommentShareSunil Kanswered 22 days ago"


Question: AWS Client VPN Self Service Portal for Google Federated idp

"Is it possible to connect my cvpn endpoint to a Self-service SAML provider in Google? I've basically followed the steps described in the link below, but have found that Google will not allow an app to have an entity id ( urn:amazon:webservices:clientvpn ) that is in use by another app. In this case, the first app is handling the Vpn auth, which works as expected. I'm just wondering if maybe there's an alternate URN/approach available that we could use as the audience to pair with the self service ACS url?Steps for creating the vpn/self-serve apps:https://geeks.wego.com/setting-up-aws-sso-and-aws-client-vpn/Stack Overflow article indicating this is not possible.https://stackoverflow.com/questions/67914215/how-to-configure-saml-app-in-google-for-aws-client-vpn-and-self-service-portalFollowComment"

Answer: "0I cant find the definiate answer, but if google supports more than 1 ACS URL then yes you can use the same IDP application.I have done the same in AzureADCommentShareGary Mcleananswered a month ago0Please be informed that VPN auth uses a different ACS URL to connectAssertion Consumer Service (ACS) URL: http://127.0.0.1:35001Audience URI: urn:amazon:webservices:clientvpnAnd Self Service portal uses a different ACS URLApplication ACS URL: https://self-service.clientvpn.amazonaws.com/api/auth/sso/samlApplication SAML audience: urn:amazon:webservices:clientvpnBut both these two Service Functions use same SAML audience URLApplication like OKTA let you define Two ACS URL in same App which would let you define Authentication and Self Service Portal in same App.Some IDPs do not give that option to create Second ACS URL in same App. But then they allow you to create a Second App for that purpose.Unfortunately,  it seems like Google has a limitation where they do not even let you define a Second App where SAML Audience URL is same.Its expected to have SAML Audience URL same on AWS auth and Self Service portal and there is no way on AWS to change that and  hence there is no workaround from AWS side as well as its a google limitation.However, alternatively you can use AWS SSO with AWS IDP where you can create One App for VPN auth and one App for Self Service portal.https://aws.amazon.com/blogs/security/authenticate-aws-client-vpn-users-with-aws-single-sign-on/CommentShareBiswajit_Manswered a month ago"


Question: Kinesis Analytics Application output to SNS?

"Hello,I'm trying to figure out the best way to output messages to SNS from a Flink Kinesis Analytics application. My understanding is firehose has ~60s of latency, which is not acceptable for this use case, as we want <1 sec of latency from ingestion to output. If I'm ok with > once delivery of output, could I just create a flink function to send a message to SNS directly and not have to worry about creating a sink that handles checkpoints/deduplication/batching/whatever else?We're looking at <1000 TPS.Any thoughts or suggestions would be appreciated.Thanks!FollowComment"

Answer: 0Thank you for reaching out to us. Firehose does have some latency due to buffering hints[1] in the service. Having Kinesis stream connector to kinesis analytics takes care of checkpoints/batching and this can be read by lambda and written to SNS. The architecture is as below:Kinesis  analytics --> Kinesis stream --> lambda --> SNSPlease refer to the below blog for example architecture :-- https://aws.amazon.com/blogs/big-data/building-a-real-time-notification-system-with-amazon-kinesis-data-streams-for-amazon-dynamodb-and-amazon-kinesis-data-analytics-for-apache-flink/Please note that de-duplication should be done on consumer end. This can be done in lambda function in the above case. Let us know if you may have any other queries.References[1] https://docs.aws.amazon.com/firehose/latest/APIReference/API_BufferingHints.htmlCommentShareSUPPORT ENGINEERAWS-User-2071047answered 10 months ago


Question: Run different notebooks present in same Sagemaker notebook instance with lifecycle configurations based on different lambda triggers

"I have a sagemaker notebook instance having two jupyter notebook ipynb files.When I had one jupyter notebook, I was able to run it automatically with one lambda function trigger and lifecycle configuration.Now I have two jupyter notebooks and corresponding two lambda function triggers. How can I run them based on the trigger by changing the lifecycle configuration script.FollowCommentDurga_S a year agoTo clarify, are you looking to schedule notebook executions automatically on starting the notebook instance?Can you share your current solution (lambda handler, lcc script) so I can get a better understanding?ShareDurga_S a year agoAssuming you're using an LCC such as this - https://github.com/aws-samples/amazon-sagemaker-notebook-instance-lifecycle-config-samples/blob/master/scripts/execute-notebook-on-startup/on-start.shYou might have to have two LCC scripts - one for each notebook and use the Lambda function to attach the right LCC script based on the trigger.Share"


Question: Uploading a folder to S3

A user wants to upload a complete folder to AWS S3 using the S3 Management console. How can the user perform this activity?A. Just drag and drop the folder using the flash tool provided by S3B. Use the Enable Enhanced Folder option from the S3 console while uploading objectsC. The user cannot upload the whole folder in one go with the S3 management consoleD. Use the Enable Enhanced Uploader option from the S3 console while uploading objectshttps://aws.amazon.com/blogs/aws/new-s3-features-for-the-aws-management-console/Drag and Drop works for me.FollowComment

Answer: "0The S3 documentation states that you can use drag and drop individual files or folders using the console."When you upload a folder, Amazon S3 uploads all of the files and subfolders from the specified folder to your bucket. It then assigns an object key name that is a combination of the uploaded file name and the folder name. For example, if you upload a folder named /images that contains two files, sample1.jpg and sample2.jpg, Amazon S3 uploads the files and then assigns the corresponding key names, images/sample1.jpg and images/sample2.jpg. The key names include the folder name as a prefix. The Amazon S3 console displays only the part of the key name that follows the last /. For example, within an images folder the images/sample1.jpg and images/sample2.jpg objects are displayed as sample1.jpg and a sample2.jpg."The latest documentation is available here: https://docs.aws.amazon.com/AmazonS3/latest/userguide/upload-objects.htmlFurthermore you can use 3rd party file browsers like Cyberduck or S3 Browser that allow multipart uploads and concurrent upload connections that will greatly speed up the upload process.CommentShareNuno_Qanswered 5 months ago0So, what is the answer to the question?CommentSharerePost-User-6305996answered 5 months ago0Answer is [A.] from the options given.In S3 Management console clicking 'Upload' brings up the following:CommentShareAWS-User-2870192answered 5 months ago"


Question: AWS PrivateLink for S3 VS DX public VIF

"Hello,Now that AWS PrivateLink for S3 has been released (https://aws.amazon.com/blogs/aws/aws-privatelink-for-amazon-s3-now-available/). I was wondering what would be the benefits of using Public VIF over AWS PrivateLink to access Amazon S3 from on-premises resources ?ThanksFollowComment"

Answer: "0Accepted AnswerHi,1st of all there're different ways to evaluate differences between S3 Interface EP (Private link) & S3 GW EP .Reachability :Private link :S3 Private link are available from Peer Link/ through Transit Gateway/ VPN / On PremisesGW EP : "Endpoint connections cannot be extended out of a VPC. Resources on the other side of a VPN connection, VPC peering connection, transit gateway, AWS Direct Connect connection, or ClassicLink connection in your VPC cannot use the endpoint to communicate with resources in the endpoint service." source:https://docs.aws.amazon.com/vpc/latest/userguide/vpce-gateway.htmlCost:PrivateLink for S3 is available in all AWS Regions. AWS PrivateLink is available at a per-GB charge for data processed and a hourly charge for interface VPC endpoints.Gateway EP is free of charge.DNSVPC Gateway EP are using 'public' EPS3Privatelink  must use you must update your applications to use endpoint-specific DNS names.Please note that Gateway EP & IEP can be used together as described below:(source : https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html)Use Private link for on prem ressources / use GW EP S3 for VPC ressources.(https://docs.aws.amazon.com/AmazonS3/latest/userguide/images/interface-and-gateway-endpoints.png)If your use case is to use Direct connect for S3 , You've got different options:-Use Public Vif (and restrict /maintain the prefixes for S3 only based https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html) but it adds some complexity to setup-Use EC2 Proxy Farm from On premises ressources (but need to scale/maintain operate them)-Use S3 Private linksHTH!CommentShareAWS-User-9789647answered 2 years ago"


Question: EC2 instance can be accessed by using different account pem if your ip address is whitelist for same region

"Hi,EC2 instance can be accessed by using different account pem if your ip address is whitelist for same region. Is it expected or bug from aws side?FollowCommentemned 15 days agoWhay do you mean by account pem ?ShareGary Mclean 15 days agoQuestion makes no senseShareDamian Olguin EXPERT15 days agocan you clarify and give more context?ShareRanjeet 15 days agoI mean that I am able to use access key of aws account A to access EC2 instance of another aws account B in same region.Share"

Answer: "1A ssh private key (PEM key), is a security credentials that you use to prove your identity when connecting to an Amazon EC2 instance. Neither it has relation with AWS Account nor with AWS regions, rather it is related to the machine/instance.For Linux instances, the private key allows you to securely SSH into your instance. Key pair can be created using the Amazon EC2 console or a third-party tool.If you specify a key pair at launch, when your instance boots for the first time, the public key material is placed on your Linux instance in an entry within ~/.ssh/authorized_keys. Additionally you may append the public key on the Linux instance for a specific user, the path to the file is ~/.ssh/authorized_keys.To fetch the public key from a private key (PEM), you may execute the following command:$ ssh-keygen -yf ssh_key_name.pemSince you are able to use the same private key, you must see same public key hash on both the instances in ~/.ssh/authorized_keys.Anyone who has the .pem can ssh to your instance without the need for any other AWS credentials since the associated public key is available on the instance.You may refer:Amazon EC2 key pairs and Linux instances:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.htmlAdd or remove a public key on your instance:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.htmlYou may also refer the following third-party article:What is SSH Public Key Authentication?https://www.ssh.com/academy/ssh/public-key-authenticationCommentShareAyushmaan_Banswered 14 days ago"


Question: No module named 'awscam' Traceback - Deeplens / Lambda

"Hi, I am building a simple application using Aamzon Deeplens. When compiling the Lambda function which interact with deeplens, it keep poping up the error "Unable to import module 'greengrassHelloWorld': No module named 'awscam' Traceback". I have reinstall awscam and updated the software on Deeplens for multiple times. I even tested the  Deeplens Lambda template that is provoided by AWS. It still shows the same error.Please advise.FollowComment"

Answer: "0Hey there,how did you build and package your lambda function? It seems like the dependencies are not picked up by the mechanism. Also, does this error appear if you try to run the function locally in a unit test? If you could provide more details about the project setup, that would help to pinpoint the issue.BestAlexCommentShareAlexander Melnykanswered a year ago"


Question: Training a classifier on parquet with SageMaker ?

"Hi,What parquet data loading logic is known to work well to train with SageMaker on parquet? ml-io? pyarrow? any examples? That would be to train a classifier, either logistic regression, XGBoost or custom TF.FollowCommentAWS-User-7732475 a year agoHi, I'm facing the same issue but for testing. It doesn't seem that testing in Sagemaker accepts PyArrow or parquet files. Do you know if Sagemaker does accept parquet files for testing or only training? If not, whats the go around?Share"

Answer: "1Accepted AnswerXGBoost as a framework container (v0.90+) can read parquet for training (see example notebook).The full list of valid content types are CSV, LIBSVM, PARQUET, RECORDIO_PROTOBUF (see source)Additionally:Uber Petastorm for reading parquet into Tensorflow, Pytorch, and PySpark inputs.As XGBoost accepts numpy, you can convert from PySpark to numpy/pandas using the mentioned PyArrow.CommentShareGili Nachumanswered 3 years ago"


Question: AWS Glue ERROR. Internal service error: Invalid Input Provided

"I try to run a simple script (like: print('test')) in a glue job, but get next error: JobName:XXX and JobRunId:YYY failed to execute with exception Internal service error: Invalid Input Provided. Even yesterday afternoon, complex scripts worked without problems, but today such a simple script cannot work (Execution time: 0 seconds). All these problems are related to the Ireland region, for example, when script is executed in Virginia, such error does not occur.FollowCommentAnanth Tirumanur 9 months agocan you share some more job details and whats in the log? Do you see InvalidInputException in your logs?Is the job a Spark or Python Glue job?SharerePost-User-7244213 9 months agoIn the log I also see: failed to execute with exception Task allocated capacity exceeded limit. (Service: AWSGlueJobExecutor; Status Code: 400; Error Code: InvalidInputException; Request ID: XXX; Proxy: null). This job is a Spark job.SharerePost-User-0633280 9 months agoI have the exact same error in the Ireland region (eu-west-1).In my case I am using an AWS Lake Formation Blueprint which creates a Workflow and some Jobs in AWS Glue.I have run it multiple times and the workflow always fails with this error.ShareLeandro Jacques 8 months agoI'm having the same issue for pythonshell job type in Ireland region, I haven't tested other regions yet. The only way to correct the problem that I've found is destroying the glue job and, then, re-creating it again. Does anybody has any other kind of solution for this problem?Share"


Question: How to set off automatic filtering in QuickSight?

"I am using logs as data source and want to visualise time series data in AWS QuickSight. I filter on specific identifiers. It is important to monitor the complete time series, including anomalies. The subtitles of the scatter plots say "Showing top 50 in column_1 and top 14 in column_2".How does QuickSight select the data shown in visualizations?And how can I avoid this automatic selection (as I do not want to lose any data points)? I want to monitor all raw data.FollowComment"

Answer: "0Thank you for the detailed explanation. I want to inform you that the Scatter plot shows up to 50 points on X, up-to 50 points on Y (within each X), so the total number of points can be 2500 in both cases (group and non-group). However if your use-case requires more data points than 2500 at this moment it is not possible to increase. 2500 is a hard limit. Please refer here for more information.According our Visual Types document, all visual types limit the number of data points they display, so that the visual elements are still easy to view and analyze. The visual selects the first n number of rows for display up to the limit for that visual type. The number of data points supported varies by visual type. To learn more about display limits for a particular visual type, see the topic for that type.The visual title identifies the number of data points displayed if you have reached the display limit for that visual type. If you have a large dataset and want to avoid running into the visual display limit, use one or more filters to reduce the amount of data displayed. For more information about using filters with visuals refer here.CommentShareSUPPORT ENGINEERSanket_Kanswered a year ago"


Question: Billing for cross-account VPC peering

"Assuming I have 2 accounts in the same region and have set up cross-account VPC peering.  According to https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html#vpc-peering-pricing, when you go through a peering connection, you pay inter-AZ rates for each GB transferred in/out.My question is: do both accounts pay for the data in AND out, or does each pay only for their data out, or is there some other method?  I can't find this clearly documented anywhere.FollowComment"


Question: How can I run a post action script while writing to redshift from aws glue?

"df.toDF().write.format("jdbc").\        option("url", "").\        option("dbtable", f"public.{tableName}_staging").\        option("user", "").\        option("password", "").\        option("postactions", f"DROP TABLE IF EXISTS $staging").\        mode('append').save()I have mention the post actions script in the option but it is still not executed, is there a different way to execute the post action script from redshift in aws glue notebookI used the script from https://stackoverflow.com/questions/49735489/upsert-from-aws-glue-to-amazon-redshiftFollowComment"

Answer: 0Please note postaction is a feature of Glue DynamicFrame while you are converting there to a standard Spark DataFrame (toDF()) and using the standard JDBC driver instead of the Glue native Redshift connector.My advice is that you write that DynamicFrame using a sink provided by GlueContext (like in the example you reference). Otherwise you would have to open your own connector to Redshift to run that DROP DDL (e.g. opening a JDBC connection or a Python library like psycopg2)CommentShareGonzalo Herrerosanswered a month ago


Question: Best practice for uploading new server builds to Gamelift

"I'm trying to understand the proper protocol for uploading new server builds to gamelift. My understanding is as followsPackage the server locallyUpload a build to gameliftDelete existing fleetsCreate a new fleet with the same configuration as the old fleet, except with the newer buildReplace references to fleets within lambdas. (here's an example of an official AWS source providing a script with a hardcoded fleet ID linked to from this tutorial)Redeploy lambdasThis seems excessive - deleting and deploying a new fleet both take a long time. Since each fleet will have the same configuration as the last one, manually re-entering this information and having to replace code in lambdas seems prone to human error.Is there no way to update the build on a fleet? Should I be programmatically fetching the fleet ID somehow in my lambdas? If I am forced to delete and re-create new fleets with identical configurations, is there a good way to ensure new fleets are configured correctly?FollowComment"

Answer: "1Accepted AnswerYou are correct, that replacing an existing build with a new one requires you to create a new Fleet. However, you don't necessarily need to replace the fleet ID in your backend systems (such as AWS Lambda), if you use a Fleet Alias. With an alias, you can reference the alias in your Lambda function instead, and just change the fleet that the alias references.Another option is to register your fleet to a GameLift queue, and use the StartGameSessionPlacement API to create new game sessions. In this model, you would switch the fleet registered to the Queue when doing a new deployment. This also allows you to introduce latency-based session placement to multi-region fleets, and use the placement events for receiving the state of game session creation.Out of these two options, alias is the faster and smaller change to your implementation. You can introduce GameLift queues if you find some of the additional features beneficial.CommentShareJuho_Janswered 6 months agoEXPERTToni_Sreviewed 6 months agoVedgy 6 months agoThanks. I'll look into these features. :)Share"


Question: List queue messages yet unprocessed by consumer

"Hi everyone,I have a first lambda than scans an ftp server for new files every 2 minutes.Once a new file is detected, the lambda function will send its location path as a message in an SQS queue.A second lambda will get triggered as soon as a message is in the queue.It will receive this message containing the location of the file and download it from the server to its tmp folder, then transfer it from its tmp folder to an S3 bucket.To avoid the first lambda to pass the same files locations multiple times, I make it first check the file is not already in the bucket and not in the queue neither.The problem is that the using: sqs.receive_message() doesn't return anything in my first lambda.I assume it is due to the visibility timeout.So my question is: Is there a way i can peek in the queue for messages that have not yet been processed by the consumer (second lambda)?Would setting the visibility timeout to 0 (if possible) do the trick? If I then call sqs.receive_message() in my first lambda (not the consumer then), will that remove the messages from the queue?Many thanksAntoineFollowCommentMichael_F EXPERTa year agoHave you looked into AWS Step Functions yet? I think it might solve a lot of your problems regarding chaining Lambda functions together.Share"

Answer: "1SQS does not have a way to peek messages in the queue. You should not follow this approach. If you want to make sure that each file is processed only once and that even the first function doesn't put the same file name twice into the queue, consider using SQS FIFO queues with deduplication.CommentShareEXPERTUrianswered a year ago"


Question: AWS Glue - Glue Jobs - Glue 2.0: Worker Types

"Hey guys, I've got several questions regarding Glue 2.0 worker types for AWS Glue Jobs.I have gone through this documentation https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html as Im trying to figure out the type and amount of workers I need for my jobs, and the pricing as well, and I still have some questions left.How many DPUs is 1 Standard worker type equivalent to?How are resources being sliced by the second executor provided by a single standard worker?Whats the difference between having 2 executors (standard) and 1 executor (G.1X)? In what situation should I use one over the other?Assuming 1 Standard Worker = 1 DPU (Question 1 might answer this one too), am I being charge the same as a G.1X worker?Documentation mentions that, while using Glue 2.0, you need to specify a worker type and number of workers, does this mean that if I am using a standard worker type, all workers (and executors) are going to be active in the execution? Docs specify that while using Glue 1.0, you just need to provide a Max Number so Im assuming not all of workers are necessarily active here.Really Appreciate the help guys,RegardsFollowComment"

Answer: "1Hi,1 Standard node = 1 DPU. (  https://docs.aws.amazon.com/glue/latest/dg/add-job.html  )on one standard node you have 2 executor , each executor gets assigned half the cores and half the memory (actually less you have to consider the overhead)has mentioned in answer 2 - 2 executors will need to split cores and memory , so you run more tasks in parallel but each can only manage a smaller amount of data (remember that Spark tries to run all in memory) .  when you have a single executor you reduce the parallel tasks but increase the data each task can manage. Starting from Glue 2.0 we advice to use only G.1X and G.2X worker types.yesGlue 2.0 does not use dynamic executor allocation, so you need to specify the exact number of Worker. Glue 1.0 was using Dynamic executor allocation so in theory the job would define how many executor were needed , so theoretically you are right., but unfortunately, I am not sure if that matched the billing process. (anyway, the current advice it to use Glue 2.0 and Glue 3.0 , so I would not focus on Glue 1.0 configuration).With Glue 3.0 we have launched in preview autoscaling  that will allow you to define again a maximum number of workers but use actual workload statistics to define the number of workers active (AND billed) at anytime.hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year agoAWS-User-4093929 a year agoThank you so much for your reply, this was really helpful, there were a few key concepts I was missing out, It is clear now. Also, I wasn't aware of Glue 3.0 autoscaling, I will dig a bit more into it. Thanks again (:Share0please find below for type of Worker node -The type of predefined worker that is allocated when a job runs. Accepts a value of Standard, G.1X, G.2X, or G.025X.For the Standard worker type, each worker provides 4 vCPU, 16 GB of memory and a 50GB disk, and 2 executors per worker.For the G.1X worker type, each worker maps to 1 DPU (4 vCPU, 16 GB of memory, 64 GB disk), and provides 1 executor per worker. We recommend this worker type for memory-intensive jobs.For the G.2X worker type, each worker maps to 2 DPU (8 vCPU, 32 GB of memory, 128 GB disk), and provides 1 executor per worker. We recommend this worker type for memory-intensive jobs.For the G.025X worker type, each worker maps to 0.25 DPU (2 vCPU, 4 GB of memory, 64 GB disk), and provides 1 executor per worker. We recommend this worker type for low volume streaming jobs. This worker type is only available for AWS Glue version 3.0 streaming jobs.CommentShareVenkateshanswered 4 months ago"


Question: Publishing npm private package to AWS CodeArtifact (private field set to true in package.json)

"ContextI am attempting to publish a private package to AWS CodeArtifact and having difficulties.The package.json file has its private field set to false to prevent accidental publishing to npmjs.com registry in case a developer in our team makes a mistake.Package publish to AWS CA fails with the expected error (see Response 1 below).Same thing happens when I specify the following publishConfig (see Response 2 below).{  "publishConfig": {    "registry": "https://xxxxx-demo-domain-xxxxxxxxxxxx.d.codeartifact.us-east-1.amazonaws.com/npm/xxxxx-demo-repo/",    "access": "restricted"  }}QuestionHow do I configure the publishConfig to allow the package to be published to a specific AWS CA domain/registry under our team control?I couldn't find information about it in the AWS Documentation nor on StackOverflow nor anywhere else online.Response 1$ npm publishnpm noticenpm notice 📦  @ec/trivial-package@1.2.0npm notice === Tarball Contents ===npm notice 77B  index.jsnpm notice 797B package.jsonnpm notice === Tarball Details ===npm notice name:          @ec/trivial-packagenpm notice version:       1.2.0npm notice filename:      @ec/trivial-package-1.2.0.tgznpm notice package size:  541 Bnpm notice unpacked size: 874 Bnpm notice shasum:        a356f71ca997c48c54cd91172884ae8da9911725npm notice integrity:     sha512-WSa7fmhfuSXFY[...]Nn9JqgAUaHSeA==npm notice total files:   2npm noticenpm ERR! code EPRIVATEnpm ERR! This package has been marked as privatenpm ERR! Remove the 'private' field from the package.json to publish it.npm ERR! A complete log of this run can be found in:npm ERR!     C:\Users\igors\AppData\Local\npm-cache\_logs\2022-01-06T01_47_28_986Z-debug.logResponse 2$ npm publishnpm noticenpm notice 📦  @ec/trivial-package-2@1.0.0npm notice === Tarball Contents ===npm notice 77B  index.jsnpm notice 609B package.jsonnpm notice === Tarball Details ===npm notice name:          @ec/trivial-package-2npm notice version:       1.0.0npm notice filename:      @ec/trivial-package-2-1.0.0.tgznpm notice package size:  507 Bnpm notice unpacked size: 686 Bnpm notice shasum:        57511cd858f92a1818621045f34bfd5723649271npm notice integrity:     sha512-uV5seBJT40fFy[...]BVD355OzLkcBQ==npm notice total files:   2npm noticenpm ERR! code EPRIVATEnpm ERR! This package has been marked as privatenpm ERR! Remove the 'private' field from the package.json to publish it.npm ERR! A complete log of this run can be found in:npm ERR!     C:\Users\igors\AppData\Local\npm-cache\_logs\2022-01-06T20_27_04_435Z-debug.logFollowComment"


Question: AWS CDK to create a Fargate Load Balancer solution with an ssl certificate with an external DNS provider

"Hello,I want to create a. ECS Fargate ApplicationLoadBalancer solution  using a certificate for a Domain which is hosted on a external DNS provider (godaddy)Here is my code:    //create a new certificate in the certificate manager for the domain     const certificate = new acm.Certificate(this, ‘certificate’, {      domainName: ‘api-fargate.mygodaddy.org’,      validation: acm.CertificateValidation.fromDns(),    }    );    new ecs_patterns.ApplicationLoadBalancedFargateService(this, ‘ECService’, {      cluster,      taskDefinition,      certificate: certificate,      domainName: ‘api-fargate.mygodaddy.org’,      listenerPort: 443,      taskSubnets: {        subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,      },    });The error I get is:Error: A Route53 hosted domain zone name is required to configure the specified domain nameHow I can do what I want, not having a Route53 hosted domain, I hope the answer is not do it all manual   ;)FollowComment"

Answer: "0Accepted AnswerHi,Can you share version used? Typically I would look into GitHub repository and check why that error is triggered.For instance, https://github.com/aws/aws-cdk/blob/767cd31c2b66b48b3b8fed7cd8d408a6846cf1e1/packages/%40aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts#L457. In that version, seems as domainZone needs to be provided too, apart from domainName.As you may use a different version, the code logic may be different.Eventually, could be that this construct pattern  requires the domain to be on route 53, but hope to be wrong :)Hope it helps ;)CommentShareEXPERTalatechanswered a month agoJoachim a month agohmmm, you are right, it seams there is no way to do that using the  ApplicationLoadBalancedFargateService functionShare"


Question: Component life cycle when editing a deployment

"I have a few components deployed to a device. Each component installs a package in its "Install" lifecycle. It uses "apt" to install a package. So, deploying multiple components at the same time always fails because they all try to install at the same time and since dpkg is locked, they fail.I have two questions.1- how can I force my deployment to just install one component at a time?2- When I modify a component in my deployment (for example change the version number) the install cycle of some other components that were not changed in that deployment is also called which causes the whole deployment to fail. Is this the intended behavior for deployment? I was under the impression that only the modified components will be reinstalled and the rest of the components in that deployment stay the same.Thanks.FollowComment"

Answer: "0Hello,Components will always run the install step in parallel, there is no way to avoid this. You could move the "apt" calls into the startup phase which can run serially depending on how the component has its dependencies configured. A component will not run the startup phase until all of its dependencies are in the running or finished states.Performing a deployment will not reinstall components if those components are unmodified. A component will be reinstalled if 1) Greengrass restarts, 2) the component version changes, 3) the component install lifecycle step changes due to a configuration change.If you don't think that any of these 3 apply, then please provide the Greengrass log file for further debugging.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Thanks for the quick response.Does this mean that after restarting the device (and in turn restarting greengrass) it tries to re-install every component?How about the Bootstrap lifecycle. The  documentation https://docs.aws.amazon.com/greengrass/v2/developerguide/component-recipe-reference.html  says it is run before the Install lifecycle and only if the component version has changed. Can I use Bootstrap to avoid re-installing all the packages on every reboot?Thanks.CommentShareHojjat12000answered 2 years ago0Hello,Yes, install will every time after the device reboots or Greengrass restarts; the fact that a component has installed is not persisted.Bootstrap will only ever run once, however it must be used judiciously as it requires a Nucleus restart everytime you update that component. This means that to make an update, the entire Greengrass system must be stopped, then bootstrapped, then started again. Bootstrap should only be used when you have a particular use case which requires the Nucleus to restart (exit 100 in your bootstrap script) or the device to reboot (exit 101 in your bootstrap script).Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Thanks Michael,Does this mean that I should avoid having big artifacts in my components? Because after each reboot greengrass tries to download all those artifacts and try to install them.I wrote a script that checks the version of the deb package that I'm installing and won't try to reinstall if the same version is currently installed. This way I'll avoid the error with the apt lock and I can only change one component in a deployment without an issue.Now, I'm trying to avoid downloading the artifacts altogether if the version installed on the computer is the same.Do you have any suggestions?(Dependency is not going to work out for us, because the components are independent and each deployment could have a combination of all the packages)CommentShareHojjat12000answered 2 years ago0Hi,Install is separate from download. Component artifacts are only downloaded one time during the deployment. What I've been talking about is the "install" lifecycle step which you define in the component recipe. Additionally, there is a "skipIf" keyword which you can use to skip running a lifecycle stage if a file or command exists already. See https://docs.aws.amazon.com/greengrass/v2/developerguide/component-recipe-reference.html and search for "skipIf".So hopefully that addresses your concern.When you say that you want to avoid downloading the artifacts, what artifacts are you referring to? Artifacts downloaded as part of your component's lifecycle scripts, or are these artifacts in the recipe which Greengrass would download? If they are downloaded by Greengrass, then they are only ever downloaded once for each version of the component.If you have common artifacts, then putting them all into a single component and having your other components reference that one is a typical use case. If you say that you cannot do that, then I'm not sure what you are looking to do, please clarify your requirements.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Sorry about that. Let me clarify.1- Do the artifacts defined in the recipe (in the Artifacts section) download only once for each version of the component? Or only once for each deployment?2- If I change a component in a deployment and deploy again. Does greengrass download all other components too (does it download the artifacts for them? we know that it does call the install cycle, but does it also download the artifact?)3- You mentioned "Artifacts downloaded as part of your component's lifecycle scripts, or are these artifacts in the recipe" which suggests there could be two types of artifacts. I was talking about the artifacts that one would add in the Artifacts section of the recipe, but is it even possible to download artifacts in a lifecycle script? For example can I explicitly download an artifact in the Run cycle, but not the Install cycle?I don't know if it is clear. Thanks for the help by the way. This is very helpful.CommentShareHojjat12000answered 2 years ago0Once per component version. If the artifact exists already on disk and the checksum matches the checksum which is in the recipe (this is automatically added by Greengrass cloud service) it will not be downloaded.Same answer as above. If you are deploying any number of components then only the files that have changed or do not exist already will be downloaded.Greengrass doesn't know or care what you do in your lifecycle scripts, so you can certainly use any mechanism of your choosing to download files from anywhere. Just as some random example: "wget <my url> && unzip file && python file"CommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago01,2- I have seen greengrass downloading the same package over and over again while it hasn't changed in a while (when I change another component and deploy again). I will keep an eye on the logs to actually debug it if it happens again.3- Oh. Yes. I thought there is a special mechanism (just like the Artifact section) that you could define more artifacts for a specific cycle. Then I can download my packages from s3 conditionally.Thank you for your help.CommentShareHojjat12000answered 2 years ago01,2 - You may see this behavior if your deployment fails and rollsback. After the rollback we will cleanup any unused artifacts which would include the artifacts that we just downloaded for the deployment which was then rolledback.CommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0That might be it. But I have set "Failure handling policy" to "Don't roll back" since months ago. Would a failure cause a clean-up even if the rollback is disabled?CommentShareHojjat12000answered 2 years ago0If it did not roll back, then it would still be "running" the broken version of a component and since that version is active it would not be cleaned.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago"


Question: "NuGet reports error NU1103: Unable to find package version, but version is really in CodeArtifact."

"When running the statement against CodeArtifact:dotnet restore --verbosity quiet --nologo "sample.sln"the result is:sample.csproj : error NU1103: Unable to find a stable package sample with version (>= 22.0.80) [sample.sln]sample.csproj : error NU1103:   - Found 2 version(s) in invantive/22.1 [ Nearest version: 22.1.7-beta ] [sample.sln]sample.csproj : error NU1103:   - Found 1 version(s) in invantive/22.0 [ Nearest version: 22.0.76 ] [sample.sln]sample.csproj : error NU1103:   - Found 0 version(s) in Microsoft Visual Studio Offline Packages [sample.sln]However, CodeArtifact really contains the 22.0.80 version which was uploaded maybe 5 minutes earlier. The CodeArtifact credentials provider has been loaded and configured.This problem occurs every now and then.How can I convince NuGet called through dotnet to check more thoroughly? Is CodeArtifact ready for production use?FollowCommentguido a year agoI seem incapable to add a picture, but this is the content of CodeArtifact:Developer Tools > CodeArtifact > Repositories > 22.0 > samplesample (info)Package versionPackage status22.0.80Published22.0.76PublishedShareguido a year agoClearing the nuget cache on dotnet fixes the issue:dotnet nuget locals all -cDoes CodeArtifact maybe return an incorrect lifetime for the JSON with the packages available or forget to take into account a local time / UTC difference?Share"


Question: Accessing AWS Secrets Manager from Redshift cluster

"Hi, is there any possibility to access a secret and its content, stored in AWS Secrets Manager using a sql query from a Redshift cluster?FollowComment"

Answer: "2Accepted AnswerYou can use Lambda UDFs  to retrieve AWS Secret Manager secret's information using SQL statements in  Redshift.Create a lambda function that takes secret ARN as input and returns the required information from secret as outputCreate a Lambda UDF in Redshift to invoke the lambda function using SQL statementsExample provided in this blog shows how to access Amazon DynamoDB using Lambda UDFs. You can access AWS Secret Manager in a similar way. You can follow this blog to understand how to retrieve secret information securely using AWS LambdaAlso, that there are many other alternative ways to retrieve secrets. You can retrieve from AWS console,  the AWS CLI (get-secret-value) or using the GetSecretValue API .Please refer to retrieve secrets documentation to know more about these alternatives.CommentShareAnusha_Canswered 16 days agoEXPERTFabrizio@AWSreviewed 16 days ago0Hi,One option is to use redshift data api (https://docs.aws.amazon.com/redshift/latest/mgmt/data-api.html), in combination with sdk libraries (https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/SecretsManager.html) and combine/filter the results.Hope it helps ;)CommentShareEXPERTalatechanswered 17 days ago"


Question: Optional AWS-specific parameter

"Hello,I want to create a Cloudformation template that can take optional ListAWS::EC2::VPC::Id , ListAWS::EC2::Subnet::Id  and ListAWS::EC2::SecurityGroup::Id.My intention is to create a user-friendly cloud formation template in which if the user provides optional parameters I can use those parameters in deploying the Lambda function if the user does not provide them (Or they don't have them) I can deploy lambda without these parameters.I know I can use CommaDelimitedList but that will not user friendly as that will not give the list of valid parameter values.Please help.ThanksFollowComment"

Answer: "0To make it user-friendly could you provide a list of friendly names of the different valid VPC, Subnet, SGs combinations then in the template use mappings to get the specific values in the resource definition. Also, the default friendly name could be "None" for networking, then you can use Conditions to control whether to include networking.You could make it more dynamic by having the Friendly name be the stack name that created the network components and import those values using dynamic references.CommentShareEXPERTkentradanswered 3 months agoSushil Kumar 2 months agoThanks for your answer.Problem is I don't have a list of VPC, Subnet, and SGs as these are varies depending upon the AWS Account as these accounts are third-party.This is a good idea to use ListAWS::EC2::VPC::Id as this list out all available  VPC but we cannot make it optional.Share"


Question: AWS Polly Speech Generation: Is it possible to produce speech plus speech marks in one call?

"I need both speech output (as .MP3) and speechMarks output (as .JSON). Currently, I'm using two calls from the CLI based on the documentation, one call to generate each one for the same text.I believe that means I'm getting billed twice for the same text.  Is this correct?  Are you billed twice, once for audio, and a second time for speech marks?Also, this takes two calls / more time / seems to duplicate effort / the server must be doing the same computation twice.Is there a way to make a single call that generates both speech audio output (mp3) and SpeechMarks (json) in a single call, and/or a way to pay once rather than twice for the same text?Related question / Similar issue: I also need multiple speech variants for the same text to allow for end-user preferences (eg different voices, different speed/prosody). Is there a way to batch generate multiple sets of speech output from a single call to decrease speech generation cost for this situation, rather than paying for 2x the amount of text for each small variant?Would prefer to do this using the CLI, but also fine to use tasks, the js API, the python API, etc.Here are the docs with examples of the calls to generate audio and SpeechMarks:https://docs.amazonaws.cn/en_us/polly/latest/dg/using-speechmarks.htmlhttps://docs.amazonaws.cn/en_us/polly/latest/dg/get-started-cli-exercise.htmlThanks for your helpFollowComment"

Answer: "0Hello,It's not possible to call both speech audio output (mp3) and SpeechMarks (json) in a single API call. One API call can only provide audio output (or) speech marks output. Also, it's currently not possible to pass different outputs for input parameters in same API call. For different speech variants outputs, different API calls needs to be initiated.CommentShareSUPPORT ENGINEERayushshanswered 8 months ago"


Question: CodePipeline how to make artifact locations accessible to CodeBuild

"I want to retrieve artifact locations, currently has create additional actions to invoke custom lambda function, to read the artifact locations from the CodePipeline Job event data.Can this information be retrieved in another way e.g. exposed as environment variables, or even an API/CLI call?  This would be useful to be able to raise events to perform asynchronous post processing steps on artifacts (such as test results).FollowComment"

Answer: "0Accepted AnswerHi,CodePipeline uses S3 to store pipeline artifacts - from https://docs.aws.amazon.com/codepipeline/latest/userguide/concepts.html:When you use the console to create your first pipeline, AWS CodePipeline creates an Amazon S3 bucket in the same region as the pipeline to store items for all pipelines in that region associated with your account. Every time you use the console to create another pipeline in that region, AWS CodePipeline creates a folder for that pipeline in the bucket. It uses that folder to store artifacts for your pipeline as the automated release process runs. This bucket is named codepipeline-region-1234567EXAMPLE, where region is the AWS region in which you created the pipeline, and 1234567EXAMPLE is a ten-digit random number that ensures the bucket name is unique.You can use the GetPipeline API to get info about a specific pipeline; in the response you then have the 'artifactStore' info that contains the details about the S3 bucket - https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PipelineDeclaration.html#CodePipeline-Type-PipelineDeclaration-artifactStore.CommentSharedstroppaAWSanswered 5 years ago"


Question: AWS FSx for DR and interaction with S3

"Hello, a customer has 30TB of Windows shares and would like to have a DR solution for it in AWS.I thought first about using FSx for Windows and using DataSync to continuously import data from on-prem to FSx. However I would like to decrease the price of the solution: is it possible to have this kind of flow?First import the data from on-prem to S3Store the data in S3 when the DR is not activatedMake incremental backups regularly to S3Finally, import to FSx when the DR is activated ?The customer is also using CommVault as a third-party tool.Thank you in advance.FollowComment"

Answer: "0Accepted AnswerMy understanding is that by decreasing costs you mean not running FSx as a hot standby, correct?Unfortunately, Importing data to S3 (either through File Gateway or Datasync) will invalidate all NTFS metadata. And although you might be able to develop a programmatic way of restoring the data to FSx from S3, you will definitely lose  your NTFS permissions.It is possible to preserve the metadata by archiving files into WinRAR but WinRAR might have limitations on archive size and will likely complicate the recovery process.CommentShareBoris_Nanswered 3 years ago"


Question: Glue job throwing error : AnalysisException: The namespace in session catalog must have exactly one name part

"I have creating glue job that is reading parquet file from s3 and using iceberg connector to create iceberg table . I have used catalog name as my_catalog , database I have created with name db and table name I have given is sampletable , though when I run the job it fails with below error:AnalysisException: The namespace in session catalog must have exactly one name part: my_catalog.db.sampletableFollowComment"

Answer: "0Hello,Make sure to use the catalog name "my_catalog" on your Spark Configuration? Also, verify you're including the spark.sql.extensions (with a value of org.apache.iceberg.spark.extensions.IcebergSparkSessionExtensions) on your Configuration, you can find an example on https://aws.amazon.com/es/blogs/big-data/automate-replication-of-relational-sources-into-a-transactional-data-lake-with-apache-iceberg-and-aws-glueCommentShareLuis Gerardo Baezaanswered 3 months ago"


Question: NetworkBindings missing from describe_tasks. Bug??

"Hey AllI'm trying to extract 'containerPort' from 'networkBindings' returned in the describe_tasks api call. I noticed that networkBindings are missing when the task launchType is fargate, even though containerPort is explicitly defined in taskdefintion. The response looks like this : 'networkBindings': []But if the launchType is ec2, networkBindings are correctly returned :'networkBindings': [{'bindIP': '0.0.0.0', 'containerPort': 80, 'hostPort': 80, 'protocol': 'tcp'}]Is this a known bug or am I doing something wrong?CheersVFollowComment"


Question: Ideias for creating a highly AWS/IAM integrated application

"Hello Folks!I started to work on an application that provides a web interface for users who needs to execute some runbooks, namely those for ECS and EKS instead of EC2 Instances.For this app, I wish to interact with cloud resources using the user credentials/permissions, the same kind of experience we have when using the AWS Console. Eg:a. Do you have putItem permission to the app dynamodb config table? so you can configure application details, like a runbook registration;b. Do you have execCommand permission for a given ECS Cluster or task? So you can apply the runbook over those ECS tasks;Having the MVP in place (using lambdas and API-GW IAM authentication), I now need to think about how to effectively the user logs in and interact with the cloud resources from a web interface.  Since then, I looked at some possible options:IAM Identity Cloud Applications - seems to be amazing, but I didn't find any documentation on how to create an application or examples for it;AWS Amplify & Cognito - Cognito seems to be a big gun here; I'd like to avoid it if possible;Login with Amazon - Not sure about this one; it seems to be focused on non-technical apps, but I didn´t tap into the details.What do you folks think? Is it feasible? Between the 3 options, what would you pick? Is there another way to do it?Thanks in advance!FollowComment"

Answer: "0Hi, I would pick number 2.It is extreme simple to achieve, and provides out of the box support for passing access tokens to subsequent services (api gw), customizable hooks for cognito phases.It is definitely a product with limitations, but at least you can then focus on your business instead of spending time on basic authentication/authorization features.Hope it helps ;)CommentShareEXPERTalatechanswered a month ago"


Question: How to RTT(Render To Texture)

"Intro:Hello Lumberyard Community.I'm coming from development on another engine and recently discovered lumberyard and how polished it is. I'm trying to port over some functionally and there are a few question I have. I'm mainly wondering if I need to develop something or if its part of the lumberyard core.Question:Is it possible to pass a pixel buffer and render to a texture? And are there any examples of doing this? What part of the API should I be looking at? To explain I previously was rendering different cameras and a chromium instance to textures and was wondering if it was possible to do the same.The only previous reference I found was this post, which doesn't help much:https://forums.awsgametech.com/t/render-to-texture/1019/1Hope my question makes sense.Thanks!Follow"

Answer: "0Accepted AnswerHi @REDACTEDUSERI have an experimental version of render to texture that is not part of the engine yet, but I am looking into other options for distributing this code in a way where it won't be supported, but would at least be available for testing by a wider audience. I've created an internal issue to track this request LY-84395.UPDATE: Lumberyard 1.18 introduces the render to texture component which can be used to draw a scene to a texture https://docs.aws.amazon.com/lumberyard/latest/userguide/component-render-to-texture.htmlSharerePost-User-5841084answered 5 years ago0Hi @REDACTEDUSERAlso, we can't access your jira. ;)ThanksSharerePost-User-2072306answered 5 years ago0Hi @REDACTEDUSERSharerePost-User-2072306answered 5 years ago0Thanks @REDACTEDUSERSharerePost-User-5841084answered 5 years ago0Actually @REDACTEDUSERSharerePost-User-2072306answered 5 years ago0Thank you for the follow up! Really excited to use the feature. Also really appreciate all the hard-work by the lumberyard team!SharerePost-User-6245444answered 4 years ago"


Question: How can I enable user home folder persistence for the Linux applications that we host using AppStream 2?

We have a handful of apps for users to consume in AppStream 2 that are running on Amazon Linux 2. I'd love to be able to offer users a persistent home folder similar to our Windows applications. Is this possible?FollowComment

Answer: "1Accepted AnswerHome folders are supported on Windows and Linux based fleets.https://docs.aws.amazon.com/appstream2/latest/developerguide/home-folders.htmlYou can enable home folders in the stack settings. From the documentation:Home folders are stored on fleet instances in the following default locations:Non-domain-joined Windows instances: C:\Users\PhotonUser\My Files\Home FolderDomain-joined Windows instances: C:\Users%username%\My Files\Home FolderLinux instances: ~/MyFiles/HomeFolderCommentShareJeremy_Sanswered 3 months agoEXPERTkentradreviewed 3 months agodylanatcuri 3 months agoThis was super helpful, thanks to this link, I was able to configure a couple apps - DBeaver and Oracle SQL Developer in our stack for our SQL developers/DBAs to write to these paths via env variables and command line arguments.For those curious:AppStreamImageAssistant list-applications{"status": 0,"message": "Success","applications": [{"Name": "Terminal","AbsoluteAppPath": "/usr/bin/gnome-terminal","AbsoluteIconPath": "/usr/share/icons/gnome/256x256/apps/utilities-terminal.png"},{"Name": "DBeaver","AbsoluteAppPath": "/usr/bin/dbeaver-ce","AbsoluteIconPath": "/usr/share/dbeaver-ce/dbeaver.png","LaunchParameters": "-data /home/as2-streaming-user/MyFiles/HomeFolder/DBeaver"},{"Name": "SQL_Developer","AbsoluteAppPath": "/usr/bin/gnome-terminal","AbsoluteIconPath": "/opt/sqldeveloper/icon.png","LaunchParameters": "-- sqldeveloper'"}]}I also patched in an environment variable in /etc/profile.d/sqldeveloper.sh and /opt/sqldeveloper/sqldeveloper.sh, like so:export IDE_USER_DIR="$HOME/MyFiles/HomeFolder/SQL_Developer"Worked like a charm!Share"


Question: Game compile flickering

"I have compiled game, but in the context of build-game I have flickering problems.But in the editor, everything is perfect !!!!. I've tried many settings from the game console to see if something is wrong, but I did not get any results.I attach one game screenshots to see the problem. I hope someone can tell me what's wrong.I also published a private video that shows the effects of flickering:https://youtu.be/Jz17GxEqCKMThanks for the supportFollow"

Answer: "0Accepted AnswerSorry for the troubles @REDACTEDUSERSharerePost-User-5738838answered 6 years ago0It seems that the problem is in compiling the executable with:Lmbr_waf build_win_x64_vs2015_release -p game_and_engineThe generated build that is then moved to the _packs directory once compiled and includes the DLLs in the executable differs in rendering from the version of the Launcher executable that is located in Bin64vc140.I did a try by building two executables in the play "_packs"One as per instructions: http://docs.aws.amazon.com/lumberyard/latest/userguide/game-build-release.htmlAnd the other by moving the game DLLs used by the editor as well.With the "Launcher" that was Bin64vc140 along with the editor the game has run perfect rendering !!I did not control the C ++ source code to see the problem, the "define" of the compiler is so many (too much work !! :-), but I think there are a small bugs.For the moment thank you and shout for my english.There is also a problem with the "gamevolume" that is not rendered in the game, but for that I will open a new post, as soon as I know where the problem is in the exact way.Thank you all for the support !SharerePost-User-5153142answered 6 years ago0Fantastic @REDACTEDUSERI'll make a note for our team on your observations with this process and bugs found — Thank ya much!SharerePost-User-5738838answered 6 years ago0Can you try pushing your camera near clip plane out more. That can help a lot with zbuffer accuracy.SharerePost-User-7779371answered 6 years ago0I tried, but nothing to do. I've also created a very simple map with the only terrain but the effect in the game-biuld shows artifacts. : - (((SharerePost-User-5153142answered 6 years ago"


Question: My Step Function user role is giving an error for an AWS tutorial I am following.

"I am doing this AWS Step Function tutorial: https://docs.aws.amazon.com/step-functions/latest/dg/tutorial-continue-new.htmlWhen I run the Step Function it failed on the "Iterator" Lambda function with this error:Neither the global service principal states.amazonaws.com, nor the regional one is authorized to assume the provided role.The role for my Iterator Lambda function has a Trust Policy set to this:{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "Service": "states.us-east-1.amazonaws.com"            },            "Action": "sts:AssumeRole"        }    ]}Any ideas on what is causing this error?Thank you.FollowComment"

Answer: "0I have been troubleshooting this for a few days. Anyone able to help me with this?CommentShareChristiananswered a year agoIvan Zelenkov 6 months agoI had the same issue.This is my trust policy:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"Service": "lambda.amazonaws.com"},"Action": "sts:AssumeRole"}]}When you try to create the Lambda function just after the role creation, that can throw an error. Amazon needs a few seconds to replicate your new role through all regions. So, the fix is to wait a few seconds before creating the Lambda function. I used 5 seconds delay in my case Thread.sleep(5000); and was not getting that error anymore. Hope this helps!Share0Neither the global service principal states.amazonaws.com, nor the regional one is authorized to assume the provided role.This error can happen when you just created the role and the state machine in a short period of time. It takes a few seconds for IAM to propagate the new permissions.The role defined for the function cannot be assumed by Lambda.This means the IAM Role configured on your Lambda function does not allow Lambda to assume it.The cause could not be determined because Lambda did not return an error type. Returned payload: {"errorMessage":"2022-06-06T15:02:36.302Z fcf6b434-6217-48f5-bf85-919a91456c28 Task timed out after 3.11 seconds"}This error means you Lambda took more than 3s to execute (most likely you have a 3s timeout on your Lambda configuration) and the return to Step Functions was the Lambda execution timeout.CommentSharediegosantiviagoanswered a year agoChristian a year agoThank you.Yes. I had to make these two changes:edit the timeout for the "Restart" function in "Configuration" -> "General configuration",   I set the timeout to 5 minutes and 3 seconds.I had to edit the "Restart" code to export handler: var aws = require('aws-sdk'); var sfn = new aws.StepFunctions(); exports.handler = (event, context, callback) => {     let StateMachineArn = event.restart.StateMachineArn;     event.restart.executionCount -= 1;     event = JSON.stringify(event);     let params = {     input: event,     stateMachineArn: StateMachineArn }; sfn.startExecution(params, function(err, data) { if (err) callback(err); else callback(null,event); }); }Then deploy it after making the code change.Now this successfully works!Share0For me the Trust Policy looks ok.Could you double-check that your region is correct and the role is properly attached to the State Machine you want to use?CommentShareshimoanswered a year ago0I tried that and still getting an error:"The role defined for the function cannot be assumed by Lambda. (Service: AWSLambda; Status Code: 403; Error Code: AccessDeniedException; Request ID: 82b2b3f2-ce43-4114-aaa4-ceef08c22470; Proxy: null)"Then I checked the "Iterator" role and had to fix the trust policy for this to lambda:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"Service": "lambda.us-east-1.amazonaws.com"},"Action": "sts:AssumeRole"}]}Now it runs further but breaks at the "Restart" function with this error:"The cause could not be determined because Lambda did not return an error type. Returned payload: {"errorMessage":"2022-06-06T15:02:36.302Z fcf6b434-6217-48f5-bf85-919a91456c28 Task timed out after 3.11 seconds"}"Any ideas?CommentShareChristiananswered a year ago"


Question: continuous integration with aws

Repo hosted on awscommit. I'm looking at setting up a continuous integration solution in AWS. I don't have much knowledge on AWS code deploy and aws pipeline. Can anyone please help me out?FollowComment

Answer: 0Accepted AnswerStep 1 : Open code pipeline in aws developer console Make pipeline with source repo as of code commit and if any need connect            code build and at the end you can add code deploy   On the change in code commit and on the commit code pipeline will fetch code from code commit and build in code build as per the spec of the code build yaml file.With code deploy simple add the end point Elastic bean stalk or ec2 or s3 anything you can addCode pipeline : Work to connect end and transfer code form one end to another endCode Build : Build and code and as output give and provide artifactsCode deploy : Deploy final code to aws servicesOR :From using code pipeline you can direct send code artifacts to elastic beanstalks and alsoFlow will be like : Code pipeline >>> Elastic beanstalk or anything (s3)OR :From using code pipeline to code build you can send artifaces direct to elastic beanstalkFlow will be like : Code pipeline >>> Code Build >>> Elastic beanstalk or anythingCommentShareharshmanvaranswered 4 years ago0can you pleasealso mentation with jenkin if possibleCommentSharechaganlalanswered 4 years ago


Question: Can't cancel spot fleet request

"EDIT (see below for the original question): I was able to solve my issue by getting the Fleet ID (starts with "fleet-") from the Spot Request's Tags and then running the following on the instance via the CLI (be sure to replace FLEET-ID and edit the region if needed):aws ec2 delete-fleets --fleet-ids "FLEET-ID" --terminate-instances --region "us-east-1"Note: This causes the fleet's instances to be terminated and the fleet to be deleted. After that, no new instances where created.I'm not sure why I couldn't see my fleet in the AWS Management Console (I was logged in as the root user), maybe the fleet wasn't displayed because it only consisted of one Spot instance and no On-Demand instances?If the AWS team wants to test this, please feel free to reach out to me, I'm happy to provide all steps to reproduce this issue.Original question:Hi everyone,in order to test Spot Fleets, I have used the EC2 API action "CreateFleet" to create a fleet of one Spot instance and zero On-Demand instances. I have used a Launch template, worked well. Instance type is t4g.nano, Fleet Target Capacity is set to one instance.Now I seemingly can't cancel the fleet request: In the console, when clicking EC2 - Instances - Spot Requests, only the Spot Request is listed, but not the Fleet Request. If I cancel the Spot Request with the option to terminate the instances assigned to it, the instances are terminated, but of course a new Spot Request is immediately created.If it helps, the Spot Request's Persistence is "one-time".Thank you!FollowComment"


Question: How to restrict download permission for content served from presigned-url

"For our implementation we want to only stream the content to user and restrict user from downloading it, how can we restrict the download permissions from the presigned URL provided ?FollowComment"

Answer: "1Hi,S3 is an object based storage service and although you can manage who has access to your S3 bucket and the objects stored in it, there’s currently no direct way of preventing users who have been granted read access to the files stored in your S3 bucket from downloading them.=> Potential options would be to make use of :a. HLS Content Protection - https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/content-protection.htmlb. DRM (which restricts access to your playlist so that only authenticated users can view your content)Digital Rights Management - https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/drm.htmlhttps://stackoverflow.com/questions/46702054/amazon-s3-bucket-policy-to-prevent-download  (as this is a third party link please be cautious)https://aws.amazon.com/blogs/aws/using-amazon-cloudfront-for-video-streaming/=> You can also refer to these documents on securing videos using Cloudfront and other media services :https://aws.amazon.com/blogs/media/part-1-protecting-your-video-stream-with-amazon-cloudfront-and-serverless-technologies/https://aws.amazon.com/blogs/media/creating-a-secure-video-on-demand-vod-platform-using-aws/Please note that the implementation of above solutions might have cost implications. So, please refer to the applicable pricing documents before using any service.I would also advise first deploying these changes (with regards to whichever option you want to test/implement) in a test environment and not your live site or normal environment.CommentShareSUPPORT ENGINEERAWS-User-7474266answered 10 months ago0Hello,Could you provide more details?Technically there is no big difference between streaming and downloading of data as anyway data reached final device.One of the solution could be usage of encryption: your stream client will be able to decrypt data by receiving a temporary key while direct downloading will just give you an encrypted data.CommentShareAleksandr_Panswered 10 months agorePost-User-7538660 9 months agoHello,For our business we want to restrict download and screen recording access for users.Can you explain on how we can implement encryption, and will that help in restricting the users from having the video offline ?Share"


Question: "k8s pod created by statefulset is stuck in pending state, waiting for pvc bound"

"I am using an EKS fargate cluster and I think it might be an issue with EKS.I created a statefulset with volumeClaimTemplates which bounds to pre-created PV.The problem is the pod created by statefulset is stuck in pending state, waiting for PVC bound.But the PVC is already bound with PV. So When I delete the pod, the pod is successfully mounted.How can I solve this problem without manually deleting the pending pod?pod event logEvents:  Type     Reason            Age        From               Message  ----     ------            ----       ----               -------  Warning  FailedScheduling  <unknown>  fargate-scheduler  Pod not supported on Fargate: volumes not supported: efs-vol not supported because: PVC efs-vol-collector-relay-statefulset-0 not boundFollowComment"


Question: Certificate Renewal Mail Failing

"The certificate doesn't send mails to the listed mails ( admin, administrator ) and I can't renew the cert cause of that. What should I do to solve this?FollowComment"

Answer: 0I had a problem with my admin group mail permissions.CommentSharemustafasaberanswered 3 years ago


Question: Not receiving OnStartGameSession callback in Frankfurt

"Hi, I have been playing (in order to assess if we will adopt it for a multiplayer game) with Gamelift for two weeks and everything was fine (in us-east-1) until I have deployed a fleet in Frankfurt.After the deployment of the fleet. get it active (meaning game server is initialising ok the SDK) I am not able to receive in the game server the OnStartGameSession callback and all the matchmaking request are timing out.I am not able to receive the MatchmakingSucceeded and I am not able to receive the callback I already mentioned.Any ideias?FleetID: fleet-******eu-central-1FollowComment"

Answer: "0Accepted AnswerHi,So the player latency data is for us-east-1 only, but in eu-central-1 the queue was configured to require player latency info as well. The player latency data needs to include en-central-1 for it to work. Thus the game session didn't get sent to the fleet.[PlayerLatency(regionIdentifier=us-east-1, playerId=55125217-f64f-4716-a596-767d7611ff24, latencyInMilliseconds=10.0), PlayerLatency(regionIdentifier=us-east-1, playerId=9d493251-81eb-4e43-8df9-382420da578e, latencyInMilliseconds=10.0)], Regional latency: {us-east-1=PlayerLatency(averagePlayerLatency=10.0, maxPlayerLatency=10.0)}Hope this helps, let us know if you need further assistance.CommentSharerePost-User-5046723answered 2 years ago0Just to clarify, the matchmaking is working fine in us-east-1. Exactly the same deployment(I am using cdk) in eu-central-1 the servers do not receive the callback that allow to activate de Game sessionCommentSharerePost-User-9537167answered 2 years ago0Some update, I tried to create the Queue, Fleet, Build, Matchmaker Config in Ireland and the behaviour is the same as in Frankfurt.In CloudWatchI see PlacementTimedOut in the Queue metricsMatch created metricThere are 1 available game session in the fleetWhen I run manually StartGameSessionPlacement I see that the fleet reserves a Game Session and then I need to create 2 player sessions in this case the OnStartGameSession is not called also.I am really confused with this behaviour. I notice that there are other topics in the forum with this type of issue but all were solved by AWS or by some misconfigurations which is not my case (AFAIK).Some help would be much appreciated.CommentSharerePost-User-9537167answered 2 years ago0What do your fleet/queue metrics show you in Frankfurt or Dublin? Do you see game sessions timing out in the queue/fleet?If StartGameSessionPlacement is not working, then I would look at the timeouts in your fleet / queue esp GameSessionActivationTimeoutSeconds.Start with eliminating queues and try placing a game session on the fleet directly. Does that work for you, ie CreateGameSession?CommentSharerePost-User-5332620answered 2 years ago0Can you provide some sample matchmaking ticket id/game session ids where you've seen this behavior (plus the region)? I can then ask the GameLift service to investigate your issues.Note: For urgent or blocking issues its always faster to go through AWS support.CommentSharerePost-User-5332620answered 2 years ago0@REDACTEDUSERI just experienced the issue:{"tickets": [{"ticketId": "dd36fc7b-fb63-4835-8a72-4d4118173214","startTime": "2021-01-06T22:53:24.584Z","players": [{"playerId": "55125217-f64f-4716-a596-767d7611ff24","team": "drivers"}]},{"ticketId": "bfe5a488-6eed-464b-b007-5f6abc436932","startTime": "2021-01-06T22:53:24.587Z","players": [{"playerId": "9d493251-81eb-4e43-8df9-382420da578e","team": "drivers"}]}],"ruleEvaluationMetrics": [{"ruleName": "FairTeamSkill","passedCount": 3,"failedCount": 0},{"ruleName": "FastConnection","passedCount": 3,"failedCount": 0}],"acceptanceRequired": false,"type": "PotentialMatchCreated","gameSessionInfo": {"players": [{"playerId": "55125217-f64f-4716-a596-767d7611ff24","team": "drivers"},{"playerId": "9d493251-81eb-4e43-8df9-382420da578e","team": "drivers"}]},"matchId": "9a5eac22-5323-4d16-856a-90f77f6b9dc9"}I hope this helps troubleshoot the issue in eu-central-1. After the PotentialMatchCreated a get a MatchmakingTimedOut message.Thanks in advance.CommentSharerePost-User-9537167answered 2 years ago0[quote="Pip, post:4, topic:9984"]GameSessionActivationTimeoutSeconds[/quote]Looking into the runtime configuration of the fleet this is the default value of 300seconds.Calling the create-game-session to the fleet: `fleet-******The odd thing is that I do not see any activation log message (I added in the server code in order to track/debug the flow), so I do not know how this game session gets activated.If I run this same CF template in us-east-1 everything works properly.I checked several times and there is not reference in any place to a region.I have a Client Service, running in my laptop,  that is making the  request to the StartMachmaking, in eu-central-1 I see all the messages arriving to the service via SQS  except the matchmakingsuccedeed.CommentSharerePost-User-9537167answered 2 years ago0Very nice catch, I was searching for us-east-1 in all cdk code but never notice it in the code (its a PoC só it's hardcoded in the request).Thank you very much.CommentSharerePost-User-9537167answered 2 years ago"


Question: The microphone and speakers are not functioning

https://aws.amazon.com/ko/premiumsupport/knowledge-center/workspaces-audio-microphone-issues/The microphone and speakers are not functioningHelp meFollowCommentAbhiAlate 8 months agoCould you post more details about the WorkSpace you're using and the version of WorkSpaces client?Share


Question: Delete BotAlias created in Amazon Lex.

I have created a chat bot using lex service and integrated it to Facebook.Now when I was doing the cleaning up part while deleting the bot created in the lex is prompting as **" this bot is currently used by an alias named RestaurantBot . Delete botAlias RestaurantBot from Restaurant.  " **As a preliminary customer of AWS I am unable to delete the application I created. Kindly request the AWS support team to resolve this problem.FollowCommentABHISHEK a year agoAre you using Lex V1 or Lex V2?Share


Question: Issue with DataBrew RecipeJob Destination S3 path

"I have a bit of an issue with databrew job pushing result file into the incorrect location.The use case:I am working on the step function which is masking the data using Data Brew. I have a parquet input file in S3 with path: folder1/file.parquet in the Account A. My Databrew job is configured to mask the data in the file and push it to S3 in Account B under the same path as original file.The config is:"Outputs": [    {      "Format": "PARQUET",      "MaxOutputFiles": 1,      "Overwrite": "TRUE",      "Location": {        "Bucket": "BucketInAccountB",        "BucketOwner": "AccountBOwnerId",        "Key.$": "States.Format('{}/{}/{}/{}/{}',States.ArrayGetItem(States.StringSplit($.detail.object.key, '/'), 0),States.ArrayGetItem(States.StringSplit($.detail.object.key, '/'), 1), States.ArrayGetItem(States.StringSplit($.detail.object.key, '/'), 2), States.ArrayGetItem(States.StringSplit($.detail.object.key, '/'), 3), $.Dataset.filename)"      }    }  ],The actual behaviour is that output file name is folder1/file.parquet/NameOfTheRecopeJob_time_part000.parquetThe crazy bit is that when I check the job in DataBrew console, in Job run history and open the Output, it actually shows the expected path - https://us-east-1.console.aws.amazon.com/s3/object/BucketInAccountB?region=ap-southeast-2&prefix=folder1/file.parquetFollowComment"