Question: Custom Identity Provider - works until Policy is defined?

"Hi, I've got a server setup with a custom identity provider running a lambda function.  With only a Role defined in the response, my user can log in (but of course has more access than is desired).When I add the Policy inline to the lambda response, the login fails.Testing with test-identity-provider yields 200 success when no Policy is defined.  However, when a Policy is defined (it seems any policy, with or without variables) testing with test-identity-provider I get the following:"Message": "Unable to call identity provider: Unable to unmarshall response (We expected a VALUE token but got: START_OBJECT). Response Code: 200, Response Text: OK","StatusCode": 500,The policy I'm using is not special, just an example found online:  const policy = {    "Version": "2012-10-17",    "Statement": [        {            "Sid": "AllowListingOfUserFolder",            "Action": [                "s3:ListBucket"            ],            "Effect": "Allow",            "Resource": [                "arn:aws:s3:::${transfer:HomeBucket}"            ],            "Condition": {                "StringLike": {                    "s3:prefix": [                        "in/${transfer:UserName}/*",                        "in/${transfer:UserName}"                    ]                }            }        },        {            "Sid": "AWSTransferRequirements",            "Effect": "Allow",            "Action": [                "s3:ListAllMyBuckets",                "s3:GetBucketLocation"            ],            "Resource": "*"        },        {            "Sid": "HomeDirObjectAccess",            "Effect": "Allow",            "Action": [                "s3:PutObject",                "s3:GetObject",                "s3:DeleteObjectVersion",                "s3:DeleteObject",                "s3:GetObjectVersion"            ],            "Resource": "arn:aws:s3:::${transfer:HomeDirectory}/*"         }    ]};and later:    response = {      Role: 'my_role_arn',      Policy: policy,        HomeDirectory: '/my-bucket/in/myuser',     };Anybody got any hints about what I'm doing wrong?Thanks.Edited by: TTF2019 on Apr 13, 2019 5:10 AMFollowComment"

Answer: "0Accepted AnswerHey,I think your problem is the policy type. You need to return the json string, rather than the object.CommentShareapersonanswered 4 years ago0Thanks!Changing the last part to this fixed the issue by making the policy a string.response = {      Role: 'my_role_arn',      Policy: JSON.stringify(policy),        HomeDirectory: '/my-bucket/in/myuser',     };CommentShareTTF2019answered 4 years ago0Where did you change the json stringify?CommentSharePriorityITSanswered 4 years ago0PriorityITS:Are you still seeing issues using Scope Down Policy with with your Custom Identity Provider integration? I'm not sure if you are aware, but with our recent logical directories for S3 feature you can control access by mapping S3 paths to end user visible paths. That way only those portions of your S3 bucket would be visible to them. Here are a few resources to get started:The announcement for this feature (for use cases where it's applicable): https://aws.amazon.com/about-aws/whats-new/2019/09/aws-transfer-for-sftp-now-supports-logical-directories-for-amazon-s3/Blog post on how to "chroot" your users to a designated folder:https://aws.amazon.com/blogs/storage/simplify-your-aws-sftp-structure-with-chroot-and-logical-directories/Building a data distribution service using logical directories:https://aws.amazon.com/blogs/storage/using-aws-sftp-logical-directories-to-build-a-simple-data-distribution-service/Please let me know if you have any questions or want to provide me details on your use case over private message.Thanks,SmithaCommentShareAWS-User-9826533answered 4 years ago"


Question: MSK Connect  - Failed to create using in-built AWSServiceRoleForKafkaConnect role

"I have created many connectors already using very similar configuration. Since yesterday (25th Jan 2022) I am unable to create a kafka connector using the AWSServiceRoleForKafkaConnect role. The existing connectors that have already been created are still working fine. Here is the error I get when clicking Create Connector on the last page in the form:Error creating connector There was a problem creating a connector. If the problem persists, contact AWS Support. API response Invalid parameter serviceExecutionRoleArn: A service linked role ARN cannot be provided as service execution role ARN.I have tried to create a connector with the same configuration that has already worked, only now I'm receiving the error above. Has something been updated around this? Do I need to create a new service role?Other Details:Using small MSK cluster with Authenticate=Noneusing camel connector jar file (that is currently working with other connectors)FollowComment"

Answer: "0Hi there, there were some recent changes made to the use of Service Linked Roles (SLR) as an execution role for Amazon MSK Connect Connectors. SLRs are no longer allowed to be used as the execution role. This may not affect Connectors which do not interact with Amazon MSK clusters or other resources using IAM authentication, but will affect any interaction with IAM controlled resources. It is recommend that all connector execution roles use customer managed roles with Trust Relationships including kafkaconnect.amazonaws.com. See the documentation on Service Execution Roles (1) for more details.Currently the console allows the selection of an SLR (AWSServiceRoleForKafkaConnect) as the execution role, this will be removed in future updates and should not be used when creating connectors.(1) https://docs.aws.amazon.com/msk/latest/developerguide/msk-connect-service-execution-role.htmlCommentShareSUPPORT ENGINEERHarshith_Manswered a year ago"


Question: When exactly does KCL drop records? Can't recreate (but need to handle)

"From AWS docs:"The most common cause of skipped records is an unhandled exception thrown from processRecords. The Kinesis Client Library (KCL) relies on your processRecords code to handle any exceptions that arise from processing the data records. Any exception thrown from processRecords is absorbed by the KCL. To avoid infinite retries on a recurring failure, the KCL does not resend the batch of records processed at the time of the exception. The KCL then calls processRecords for the next batch of data records without restarting the record processor. This effectively results in consumer applications observing skipped records. To prevent skipped records, handle all exceptions within processRecords appropriately."Our KCL client is written in node, following this example.No matter how we tried crashing it, the KCL function simply exits and next time we start it starts from the SAME checkpoint. In other words the above statement doesn't seem to hold true. It does not skip records.For our application we can't afford dropped records and need to be 100% sure this can't happen.Can someone with more kinesis/aws experience comment how exactly the above can happen on the consumer side (we're handling the producer already)?FollowComment"


Question: Does Amazon Mechanical Turks display grader quality metrics for Requesters?

"Does Amazon Mechanical Turks have any kind of metrics available to assess the quality of their response to a requester's requests? For example, if a grader was very fast in answering a question that normally takes a long time, it would be helpful to see the time it took. It would be great to understand this. ThanksFollowComment"


Question: AWS Transit Gateway attachment pricing

"Looking for some clarity on how Transit Gateway (TGW) to Transit Gateway pricing works. Do we configure/price that as 1 attachment per TGW? Or 1 attachment total between the 2 TGW instances?With regular VPC/VPN peering attachment, the same attachment is charged once, however with TGW - TGW, seems that we may be charging the attachment twice (1 per TGW).FollowComment"

Answer: "0Accepted AnswerFor Transit Gateway - Transit Gateway attachment pricing - I assume you are talking about TGW peering - This is charged to owners of each TGW. So there are two hourly charges.  TGW1 per hour charge and TGW2 per hour charge.For more info, see this link https://aws.amazon.com/transit-gateway/pricing/ that has following included:"For peering attachments, each Transit Gateway owner is billed hourly for the peering attachment with the other Transit Gateway."You are right, VPN/VPC is charged once.In addition to above there are data processing charges per GB of data processed.CommentShareEXPERTVKanswered 3 years ago"


Question: Problem listing App Runner services (Error listing services message)

"Hi guys, have been using App Runner services for months but something new came up today and nothing is declared in the Health page so I though I could maybe find an answer here.I'm getting an "Error listing services." on the App Runner \ Services pages. And none of my services are shown so I can't manage them currently.I also have the same error for the Github Connections page.I logged out and back in but it does not help.This error below is in the browser console multiple times:Any ideas ? ThanksFollowComment"

Answer: "1Accepted AnswerWe're having the same issue in us-east-2. I am able to list the services via AWS CLI, however.CommentSharerePost-User-9454512answered 4 months agoDavidOs 4 months agoI'm actually in us-east-2 also. I don't know why it tries to connect to fusion.gamma in us-east-1. We see in the list of accepted servers the fusion.gamma.us-east-2. Maybe it is down and it fallbacks to us-east-1 but then it refuses connection.I'm also able to list the sevices view AWS CLI.At least the services run fine. And the one with automatic deployments are also deploying.SharerePost-User-9454512 4 months agoI contacted support and they fixed the issue.ShareDavidOs 4 months agoYes it is thanks!Share"


Question: Snowball edge Storage Optimized - S3 buckets with object lock enabled

"Reading AWS docs it states here: https://docs.aws.amazon.com/snowball/latest/developer-guide/sbe-before-ordering.html#s3-importSnowball Edge cannot write to buckets if you have turned on S3 Object Lock. We also cannot write to your bucket if IAM policies on the bucket prevent writing to the bucket.In terms of object lock, is that only an issue if the data on the snowball isn't unique? is that a blanket 'computer says no' (ie it would refuse to allow a snowball order to such a bucket?)?If I do have object locked buckets what does AWS intend for users to do? Create a new bucket for the import and do a copy into the correct bucket once uploaded?Other than this warning there is no additional info to help anyone in this instance.OwenFollowComment"

Answer: "0Accepted AnswerGreetings,Based on the AWS documentation, it appears that Snowball Edge cannot write to buckets if you have turned on S3 Object Lock, regardless of whether or not the data on the Snowball is unique. This is likely because S3 Object Lock is intended to provide strict control over the retention and deletion of objects in S3, which could conflict with the data transfer process of Snowball.If you do have object locked buckets, one option could be to create a new bucket for the import and then move the data into the correct bucket once it has been uploaded. However, it would be best to consult with AWS support to determine the best approach for your specific use case.It is worth noting that the Snowball documentation does state that "If your security policies prevent Snowball Edge from accessing your bucket, you must create a new bucket that allows access for the duration of the job." Therefore, it is likely that creating a new bucket for the transfer would be the recommended approach if the original bucket is subject to S3 Object Lock or IAM policies that prevent writing to the bucket.Let me know if answered your questionCommentShareZJonanswered 3 months agoEXPERTkentradreviewed 3 months agoOmmps 3 months agoThanks for your input I appreciate it. I assumed that would be the required course of action to be fair, and I really do appreciate the clarification that it is indeed the most likely route to take. In terms of documentation I see what you say, more that it would have been helpful to have a pointer to that where that warning is stated as otherwise its a bit confusing as to where to go forward once seeing that.Share0Given that you can't upload your snowball files to the Object Locked S3 bucket - assuming you want to move everything to those buckets, you may want to investigate setting up a new bucket as the snowball ingestion, then use a lambda function to move (copy/delete) those to the Object-Locked S3 bucket.  Obviously, you'll need the appropriate IAM perms.CommentShareJimbo Surloanswered 3 months ago"


Question: How to get last heartbeat and last event telemetry for a thing in AWS IoT using Javascript SDK

"Hello,I'm trying to figure out a straightforward way to get the last heartbeat time (last timestamp a device connected to the MQTT broker) and last event time (last timestamp a device sent telemetry data) and last state time (last timestamp it reported on its state), through the AWS Javascript SDK.In Google IoT Core I can call the iot.v1.DeviceManagerClient.getDevice() passing the devicePath to it and will return, among other things, this three timestamps I mention. Here https://cloud.google.com/iot/docs/reference/cloudiot/rest/v1/projects.locations.registries.devices the keys 'lastHeartbeatTime', 'lastEventTime' and 'lastStatusTime' are in the response.For getting a device in AWS IoT Javascript I'm currently using IoT.describeThing() passing the thingName to it and returns this response object https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Iot.html#describeThing-property.How can I make an API call through the Javascript SDK to get these three timestamps in AWS IoT Core?This is for use in a web app to show information for our devices. Note that I don't want to make a subscription to the lifecycle events topics, I just want to trigger an API call via the SDK when a user request for information on the device in my web app, to show the latest timestamps for these three properties.Thanks in advance, as I haven't found anything online regarding this!FollowComment"

Answer: "0Hello Nicolas.With Google IoT, it seems that "device state" and "telemetry events" are published to special topics: /devices/DEVICE_ID/state and /devices/DEVICE_ID/events. These are Google conventions and these topics have no special meaning in AWS IoT. Are you migrating devices from Google to AWS? If so, and you can't change the device firmware, you will likely need to use AWS IoT Rules to subscribe to these topics and a Lambda to process these messages, storing the timestamp in a storage service of your choice.Within AWS IoT, device shadows is probably a good choice (somewhat dependent on fleet size and message frequency). The shadow documents include timestamps and/or you could use the timestamp() SQL function in the rule. In your web app, you would use getThingShadow. If you can change the device firmware, you may consider to make the devices publish device state directly to the shadow reserved topics: https://docs.aws.amazon.com/iot/latest/developerguide/device-shadow-mqtt.html.If shadows are not suitable, DynamoDB is another good option.The time at which the last heartbeat was received is essentially just the corollary of whether the device is connected or not. If a PINGREQ has not been received for 1.5 PINGREQ intervals, the device will enter a disconnected state. You're aware of the lifecycle events, but please be aware of this sample that stores the status in DynamoDB: https://github.com/aws-samples/connectivity-management-example-for-aws-iot-core. The sample could be altered to instead store in shadows, and with an event timestamp (bringing connectivity, device state and telemetry event timestamps together in once place for your web app).Side point: you linked to documentation for V2 of the JS SDK. You might consider to use V3 instead.CommentShareEXPERTGreg_Banswered 4 months agoNicolas Gorga 3 months agoHey Greg,I created a Lambda function that gets triggered whenever there's a message posted to the topic 'devices/+/events' (our devices post to the topic 'devices/{deviceId}/events' telemetry, as discussed due to current implementation with GCP IoT), and in the SQL query statement i 'Select timestamp() as eventTimestamp, topic(2) as deviceId'.The function code extract this pieces of information from the 'event' object and store the timestamp for the corresponding deviceId in our Firestore Database collection for IoT Devices if the timestamp is newer than the currently stored one. With this I sort the 'lastEventTime' attribute.Now, for the 'lastHeartbeatTime', after checking the DynamoDb sample I see it stores the connected or disconnected timestamp, but what I need is the heartbeat as defined by you, the most recent Ping request. Using the lifecycle events, for devices that are disconnected, the timestamp I get  from the 'disconnected' event is in fact the lastHeartbeatTime, but when a device is connected, storing the timestamp of the 'connected' event as the lastHeartbeatTime is incorrect, as the true value would be the latest Ping request for the ongoing connection.After searching I see the Ping request is handled internally by the broker and it's clients and it's not posted to any topic, so it makes me think I have no chance to construct the 'lastHeartbeatTime' attribute accurately, not for connected devices at least.What do you think?Share0Hello Greg,Thanks for the quick response! I'm trying to make a migration yes, but i find that things that were quite straightforward with Google's solution is not so with AWS. It's a bit weird to me having to take care of persisting this information and also triggering a rule every time a device posts telemetry data to store the timestamp (at least for the metric of 'lastEventTime'), but if there's no other simpler option I guess it is what it is.I'll check the sample! Yes, sorry about the link, I noticed that and started checking v3. If you have time, I would love to ask some more questions to see what you recommend, let me know if you're up for itCommentShareNicolas Gorgaanswered 4 months agoGreg_B EXPERT3 months agoYou can ask new questions here on re:Post. Don't be shy on upvoting and accepting answers to ensure people are motivated. :-)i find that things that were quite straightforward with Google's solution is not so with AWSIf your devices were built for AWS in the first place, they would likely publish to shadow topics and this would be similar to what you experience for device state, and possibly telemetry events.Share"


Question: Is it normal for DLM created AMIs to be 17 minutes late to the scheduled time?

"I'm using DLM (Data Lifecycle Manager) to create an AMI for an instance every day at 3am, but the resulting AMIs are being created 17 minutes too late (creation date). I've configured my policy to reboot the instance before creating the snapshot. Is this normal behavior?FollowComment"

Answer: 0Yes.From the docs: "Subsequent snapshot or AMI creation operations start within one hour of their scheduled time"CommentShareNati_Canswered a year ago


Question: AWs SSO with Amplify UI

"HiI see in the documentation that Amplify UI Authenticator allow other login sources like Google or Facebook, but ¿not allow AWS SSO?I have a setup with cognito + AWS SOO as SAML identity provider.I log-in using the Cognito Hosted UI, but when it come back to the callback URL the Amplify UI Authenticator not detect the user as logged.I'm doing something wrong or just Amplify UI Authenticator not support SAML identity providers?FollowComment"


Question: Drop datashare does not allow for re-create and share with same name later?

"We created a datashare from our Redshift ETL cluster, and it was in use for a bit on a separate datamart cluster.We removed the datashare from that datamart cluster and deleted it.  (the datamart cluster)According to the AWS Console, there was no longer any consumers of the data share.did a DROP DATASHARE datashare_name; from the ETL cluster.Now I need to create the datashare again with the same name, and share it with a different cluster.No issue with CREATE DATASHARE command, nor the GRANT ALTER, SHARE ON DATASHARE to myself command.But when I try to share it with GRANT USAGE ON DATASHARE datashare_name TO NAMESPACE [REDACTED], it always returns[0P000] ERROR: The PublishDataShare failed due to duplicate dataShareNames, but the dataShareNames are unique per namespace. customerId is [REDACTED], producerImmutableClusterId is [REDACTED], localShareId is [REDACTED], dataShareName is [FIRST_FEW_LETTERS]When I use SHOW DATASHARES, it shows this share with a create date of just now.  None of svv_datashares, svv_datashare_objects, or svv_datashare_consumers tables show this share.How can I track down and remove any old shares with this name, so that I can use it?  (we have a standard naming schema for our resources that we need to follow)Thanks!FollowCommentDanish Amjad a year agoDid you find any solution?Share"

Answer: "0Thank you for posting your question, for the above scenario you have described, please create a ticket with the AWS support so they can help you in resolving the issue.CommentShareSUPPORT ENGINEERChaitanya_Tanswered a year agoEXPERTFabrizio@AWSreviewed a year ago"


Question: QuickSight - Can I use countif + contains?

"Hi,I'd like to count if a field (string) has a certain text included.Already tried:countIf({ID}, {Ticket type} contains 'Wochenend')distinct_countIf({ID}, {Ticket type} like '%Wochenend%')distinct_countif({ID}, locate(toLower({Ticket type}), 'Wochenend') <> 0)...but nothing worked.Would appreciate help from the community!Many thanks,AxelFollowComment"

Answer: "0Accepted AnswerThe third option is almost correct but you have used toLower function and yet checked for 'Wochend' with 'W'(caps) instead of 'w' . Here is an example :countIf(ID,locate({Ticket type},'Wochenend')<>0)CommentShareprabaharAWSanswered 6 months ago"


Question: SFTP error from AWD VPC tunnel

"We setup one site-to-site tunnel to a 3rd party vendor using our own fortigate firewall.The tunnel is up and running and we setup one Windows SFTP server in our network for the vendor to do file transfer.All credentials are shared to them but when they tried to send file to the server, they encountered "File Write error" ERROR Message: Error writing file 3: Permission denied.Firewall policies at both ends have already enabled all services to pass through.What could be the reasons why they cannot write to the SFTP server ?FollowComment"

Answer: "0Accepted AnswerHi This, seems windows folder permission issue, give write permission and also try changing ownership of the folder. To troubleshoot further, you can check file transfer within same vpc, then try with vpc peering.CommentSharesouravanswered a year ago0Can you provide an architecture diagram?Have you set-up your own SFTP server using a third-party product on a Windows EC2 machine in AWS? And have you provided a site-to-site VPN between your AWS VPC and the vendor's network? Where exactly is the Fortigate firewall running?Have you checked if ports have been opened for the appropriate CIDR ranges on the security group of the EC2 machine where your SFTP server, assuming that's the case?You should also run the checks mentioned in this document - https://aws.amazon.com/premiumsupport/knowledge-center/ec2-windows-unable-connect-port/CommentShareEXPERTIndranil Banerjee AWSanswered a year ago0we managed to resolve the issue. it was due to folder permission issue.it works now.CommentSharerePost-User-2927281answered a year ago"


Question: deployment stuck "in progress" and docker-login. task failed

"i am trying to deploy docker image which is stored in ECR using greengrass. but in one of my core i am not able to deploy it Job executions process stuck "In progress". and inside my core i have properly setup Security credentials and core as well.greengrass logs which is inside my core.AWS statusSo, i am struggling to figure out why this has happened and what i can do. Any ideas?FollowCommentAWS-User-soumitra 10 months agoFirst thing I suggest for you to simulate your policy/role that is attached. See if it giving successful and denied. That will give you clue if it stopped in first place.https://policysim.aws.amazon.com/home/index.jsp?#Share"

Answer: "0Hello,I see your Docker images are stored in an Amazon ECR private repository, and you are encountering error when logging into ECR.Make sure that you installed the latest AWS CLI version 2. We recommend that you use the AWS CLI version 2. For more information, see Installing the AWS CLI in the AWS Command Line Interface User Guide.Be sure that you have included the token exchange service component as a dependency in the Docker container component. Also, verify the Greengrass device IAM role if it has proper permissions. It must allow the ecr:GetAuthorizationToken, ecr:BatchGetImage, and ecr:GetDownloadUrlForLayer actions, as shown in the following example IAM policy.{  "Version": "2012-10-17",  "Statement": [    {      "Action": [        "ecr:GetAuthorizationToken",        "ecr:BatchGetImage",        "ecr:GetDownloadUrlForLayer"      ],      "Resource": [        "*"      ],      "Effect": "Allow"    }  ]}CommentShareOlawale-AWSanswered 10 months ago0Hello, the error in your screenshots appears to be due to misconfiguration for docker and Greengrass does not deal with docker installation or configuration, you might try the few suggestions from  https://github.com/docker/cli/issues/2229 , as described in this issue you may have golang-docker-credential-helpers installed which also needs pass installed.For your Greengrass deployment I believe this error occurs before the usage of TokenExchangeService for ECR login/image download, so as suggested by others on this question also make sure your policies and roles are correctly configured. Thanks.CommentShareshagupta-awsanswered 10 months ago0First thing I suggest for you to simulate your policy/role that is attached. See if it giving successful and denied. That will give you clue if it stopped in first place.https://policysim.aws.amazon.com/home/index.jsp?#CommentShareAWS-User-soumitraanswered 10 months ago"


Question: Reading AWS Glue table from S3 - GetObject API costs

"Dear AWS re:PostFor my ETL jobs, I read most of my date from RDS, but some I read directly from a table whose data sit on S3.I only discovered today that each job run generated not insignificant cost using the GetObject API and I'm trying to reconstruct how the calls work.I have approximately 60 000 files that sit S3 that for this table, but I'm using a push down predicate to read only 6 000 for my ETL.I think the GetObject cost associated with my ETL is around 50 000 000 Get Object calls (storage class is S3 Standard), i.e. 20$/0.0004*1000.As I'm only expecting 5000-6000 files to be read, I'm assuming that create_dynamic_frame.from_catalog reads each file on S3 using the partNumber option to cut the files in pieces. As the maximum number of parts is 10 000, that fits more or less my my estimates. However I couldn't find more details on the documentation on how the S3 calls work in create_dynamic_frame.from_catalog.Thanks a lot for your help !FollowComment"


Question: "Charge generated using RDS, however I was doing a Skill Builder lab"

"I was doing a lab in AWS Skill Builder on Amazon RDS. In the practical part, I had to create a database, and in the video it was not informed if it would generate costs, so I decided to leave it running. At the end of the month, a high charge was generated, and I used the RDS for studies. I wanted to know if there is a way to solve this without having to pay. I saw that AWS provides study vouchers. How can I get it?FollowComment"

Answer: "0HI,I would recommend raising a Billing Support request from your account, so that the Billing team can look at this specific case and provide a resolutionhttps://console.aws.amazon.com/support/home#/case/create?issueType=customer-serviceThanksArunCommentShareArunanswered a month ago"


Question: PinPoint OTP support for email

I would like to know if PinPoint send OTP message service support email as a delivery methodFollowComment

Answer: "0Yes, Amazon Pinpoint supports sending One-Time Passwords (OTPs) via email as a delivery method.When configuring a Pinpoint campaign, you can choose to use email as a channel for sending OTPs. You can also customize the email content and design, as well as the frequency and timing of the messages.To use email as an OTP delivery method, you will need to verify your email domain or use Amazon SES (Simple Email Service) to send emails on your behalf. Additionally, you will need to configure your email templates to include the OTP and any other relevant information, such as instructions for how to use the OTP.Overall, Pinpoint's support for sending OTPs via email can be a convenient and secure way to deliver one-time codes to your users for authentication or other purposes.CommentShareYasseranswered 22 days ago"


Question: Why is an rw EFS mounted on EC2 not allowing file or folder creation?

"I created an EFS and mounted it on a free tier Amazon Linux 2 AMI (HVM) EC2 instance. I'm able to SSH into the EC2 instance, and I can navigate into /mnt/efs/fs1. However, when I do an mkdir abc in the /mnt/efs/fs1 folder, I get the error mkdir: cannot create directory ‘abc’: Permission denied.If I run mount -t nfs4, I get the output:_127.0.0.1:/ on /mnt/efs/fs1 type nfs4 (rw,relatime,vers=4.1,rsize=1048576,wsize=1048576,namlen=255,hard,noresvport,proto=tcp,port=20240,timeo=600,retrans=2,sec=sys,clientaddr=127.0.0.1,local_lock=none,addr=127.0.0.1,netdev)I've seen a page about the AWS transfer family, but the steps aren't clear and it looks like it's not meant for the purpose I need it for. I basically need to create a few folders in EFS and copy some files from my PC to those folders on EFS. Since AWS does not provide a drag-and-drop option like Google Drive, I'm having to use SSH. But I'm not even able to create a directory on the mounted folder.Please help.FollowComment"

Answer: "0Accepted AnswerIt's possible that you are trying to create the directory as a non-root user, while /mnt/efs/fs1 is owned by root.Please see https://docs.aws.amazon.com/efs/latest/ug/accessing-fs-nfs-permissions.html - you can either change the permissions on your directory as root (with sudo) or use an access point.CommentSharejlluszczanswered 2 years ago0If you want to create a folder inside the EFS volume that is owned by a user on the EC2 instance, you could do the following (assuming you are logged in as ec2-user):cd /mnt/efs/fs1sudo mkdir your-folder-namechown -R ec2-user:ec2-user your-folder-nameThis will use root privileges to create new folder within the EFS volume and then assign ownership to another user, in this case the default ec2-user that you will get when you create an EC2 instance using Amazon Linux 2.CommentSharemicahanswered 2 years ago"


Question: Are the docs incorrect in stating that ALB Security Policies ELBSecurityPolicy-2015-05 and ELBSecurityPolicy-2016-08 are identical?

"On reviewing this page for Application Load Balancers, it states that Security Policies ELBSecurityPolicy-2015-05 and ELBSecurityPolicy-2016-08 are identical.However upon checking the output of aws elbv2 describe-ssl-policies for ELBSecurityPolicy-2015-05 and ELBSecurityPolicy-2016-08, they are not identical.ELBSecurityPolicy-2015-05 has an additional cipher, DHE-RSA-AES128-SHA, that is not present in the output for aws elbv2 describe-ssl-policies ELBSecurityPolicy-2016-08.Do the docs need to be updated?FollowComment"

Answer: "0Accepted AnswerHi Rachel,just checked the output of the two policies you mentioned and apart from the name there is no difference:aws elbv2 describe-ssl-policies --name ELBSecurityPolicy-2015-05 > 05.jsonaws elbv2 describe-ssl-policies --name ELBSecurityPolicy-2016-08 > 06.jsondiff 05.json 06.json 83c83<             "Name": "ELBSecurityPolicy-2015-05",--->             "Name": "ELBSecurityPolicy-2016-08",Do you see the difference in a particular region or in all regions?Cheers,PhilippCommentSharePhilipp Sanswered 4 months agoRachel 4 months agoThanks for your response.Interesting. I see the difference in region us-east-2.After seeing your comment I spot checked us-east-1 and ca-central-1.I do not see any difference other than name for us-east-1.I do see the difference on DHE-RSA-AES128-SHA for ca-central-1Share"


Question: ECS-optimized Amazon Linux 2 latest AMI does have fix for the latest vulnerable CVE-2022-0847?

There is recent linux vulnerability called  dirty pipe linux kernel vulnerability i.e CVE-2022-0847.So ECS-optimized Amazon Linux 2 latest AMI does have fix for the latest vulnerable CVE-2022-0847? Please advise.Ref:https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-optimized_AMI.htmlhttps://www.datadoghq.com/blog/dirty-pipe-vulnerability-overview-and-remediation/FollowComment


Question: Public ALB  - NAT Gateway

"Hello,Scenario: ALB public face + Private Instancesplease, could someone help me to understand why if i delete Nat Gateway Private Instances appear as Unhealthy and load balancing doesn´t work?Thank you!FollowComment"

Answer: "0Hi,I just did a quick test in my environment.1. NAT Gateway in public subnet2. ALB in public subnet3. Two EC2 instances running httpd in two different private subnets and in the same target group. Both subnets have routes to the NAT Gateway and verified they have access to Internet4. Verified that the Target Group status was healthy for both of the Registered Targets. Also Verified that both EC2 instances were being load balanced by the ALB5. Removed the NAT Gateway and waited 15 minutes. Both of the Instance ID status remained healthy and the ALB was still able to load balance to the two web servers.I am not quite sure how to reproduce your scenario. Can you provide more details?-randyCommentShareRandyTakeshitaanswered 4 years ago0Hello Randy,thank you very much for your answer and help.I deployed the same scenario without NAT Gateway.ALB in 2 public subnets (default gateway to IG), instances in to private subnets  (only local route) but when I browse to the ALB DNS y get a 502 Bad Gateway.Health check of the ALB also unhealthy for the two instances.It only works when there is a NAT Gateway, but if private instances respond to ALB then NAT Gateway is not needed, isn´t it?Thank you!!!CommentShareIgnaanswered 4 years ago0Hi,The NAT Gateway is only used so that the EC2 instances that are in the private subnet can get access to the Internet, for example, for the purpose of downloading software/patches. The ALB does NOT replace the NAT Gateway and generally the NAT Gateway should NOT impact the ALB functionality.For example, in my setup, I had to download the apache web server on EC2 instances running in the private subnets. To download the apache web server, I have to run "yum install httpd -y".  I am NOT able to install httpd, without the NAT Gateway running because it downloads the software to my EC2 from the Internet.  (I am NOT able to download to my EC2 instance using the ALB). However, after installing httpd, I can remove the NAT Gateway and that should NOT have an effect on running the web server.-randyCommentShareRandyTakeshitaanswered 4 years ago0Hi Randy,thank you very much again!Oh my god! I forgot that my private instance needs outbound internet access in order to install apache with user dataThank you!Now, I don´t know why my instances fail ALB health checks, are ALB health ckecks from public IPs?Thank you!!CommentShareIgnaanswered 4 years ago0Hi,If you configured your ALB to use a Target group with registered targets that are in a private subnet, then the ALB will perform health checks from private IPs.Whenever, I see an issue with the ALB's target's failing health checks, I login to the EC2 instance to troubleshoot (normally, it's because my web server was not properly installed/started by my user data).Note: you will need to login to your EC2 instance in a private subnet, either through a bastion server or using System Manager's session manager:https://aws.amazon.com/blogs/aws/new-session-manager/You will then want to check your EC2 logs in /var/log/cloud-init.log and; /var/log/cloud-init-output.logand/or try running the user data commands at the command line to see why they may not be working.-randyCommentShareRandyTakeshitaanswered 4 years ago0Thank you very much Randy!CommentShareIgnaanswered 4 years ago"


Question: Cannot import numba python package inside AWS Lambda function

"I have an AWS Lambda function with Python 3.7 runtime and AWSLambda-Python37-SciPy1x lambda layer added.I have my python dependencies (such as numba) installed on a EFS directory that I add to the path that the Lambda function can access.(I installed numba with pip install --target . numba==0.47.0, for version 0.47.0, for example)I can inport numpy, but trying to import numba gives the following error:Runtime.ImportModuleError: Unable to import module 'lambda_function': Numba could not be imported.If you are seeing this message and are undertaking Numba development work, you may need to re-run:python setup.py build_ext --inplace(Also, please check the development set up guide http://numba.pydata.org/numba-doc/latest/developer/contributing.html.)If you are not working on Numba development:Please report the error message and traceback, along with a minimal reproducerat: https://github.com/numba/numba/issues/newIf more help is needed please feel free to speak to the Numba core developersdirectly at: https://gitter.im/numba/numbaThanks in advance for your help in improving Numba!The original error was: 'cannot import name '_typeconv' from 'numba.typeconv' (/mnt/access/numba/typeconv/__init__.py)'--------------------------------------------------------------------------------If possible please include the following in your error report:sys.executable: /var/lang/bin/python3.7Traceback (most recent call last):I tried with the numba versions 0.45.0, 0.47.0, 0.48.0, 0.49.0, 0.49.1, 0.55.1 and the error is the same in all versions.I saw this response, but when I delete de numba files from the EFS directory, i get a No module named 'numba' error, which indicates that there is no other numba version installed.Below is the full code of the AWS Lambda function:import syssys.path.append("/mnt/access")import os, json, sysimport numba def lambda_handler(event, context):    return {        'statusCode': 200,        'body': json.dumps('All OK')    }Is there a specific way I should be installing numba?*ps:I describe this exact problem in this issue on the numba repository, but unfortunately the numba mainteiners do not have familiarity with aws lambda, so I coundn't get help.FollowCommentflo a month agoAny solution to-date?Share"

Answer: 1Has this issue been resolved ?CommentSharerePost-User-5268626answered 3 months ago0You may be interested in using anaconda-project to build a Docker image for AWS LambdaYou could write an anaconda-project.yml as shown below. When building the image using source-to-image (s2i) or anaconda-project dockerize all dependencies (pip and conda) are included in the image.There is a special entrypoint just for AWS Lambda usage that you set when you create the lambda function.https://github.com/Anaconda-Platform/s2i-anaconda-project#entrypointsname: lambda-with-numbapackages:  - python=3.7  - numpy  - numba  - pip  - pip:    - awslambdariccommands:  default:    unix: python -m awslambdaric <file>.<handler_func>CommentShareAlbertDeFuscoanswered a year ago


Question: Cannot create resource group - Blocked form submission

"I tried to create a resource group on Chrome 87.0.4280.88 (Official Build) (x86_64) for macOS and when clicking on the  "Create Group" button nothing happens. Navigating out of the page makes me lose the form fields values and the RG is not created. Opening Developer Tools, this error is shown on clicking on the  "Create Group" button:Blocked form submission to '' because the form's frame is sandboxed and the 'allow-forms' permission is not set.url: https://us-west-2.console.aws.amazon.com/resource-groups/groups/new?region=us-west-2Obs: ad blocker was disabledEdited by: aFullStackDev on Dec 30, 2020 12:48 PMFollowComment"

Answer: 0This seems to be a bug on creating or editing a Resource Group on Google Chrome. It works on Safari.CommentShareaFullStackDevanswered 2 years ago


Question: "Elastic beanstalk event status issue: Ok to Severe,  Severe to shutdown"

"I have a webapp running on Elastic beanstalk. (Platform - Tomcat 8.5 with Corretto 11 running on 64bit Amazon Linux 2/4.3.7)At beginning it's works fine. But after a few days, I started to get some error event notificationslike below:May 28, 2023 17:04:13 (UTC+8)INFOEnvironment health has transitioned from Severe to Ok.May 28, 2023 17:03:13 (UTC+8)WARNEnvironment health has transitioned from Ok to Severe. 100.0 % of the requests are erroring with HTTP 4xx.May 28, 2023 19:41:28 (UTC+8)INFOEnvironment health has transitioned from Severe to Ok.May 28, 2023 19:39:28 (UTC+8)WARNEnvironment health has transitioned from Ok to Severe. 100.0 % of the requests are erroring with HTTP 4xx....Some times, the server health could recover from a ‘Severe’ to ‘Ok’, but sometimes it cannot recover to 'Ok' and turns to shutdown.I checked the server backend logs(/var/log/nginx/access.log), I belived that my webapp has been attacked.The attacker send lots of bad request during a period of time, to make my web server fail to respond properly.The logs as below:128.199.16.76 - - [28/May/2023:17:02:22 +0000] "GET /db/webdb/index.php?lang=en HTTP/1.1" 404 777 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "-"128.199.16.76 - - [28/May/2023:17:02:22 +0000] "GET /mysqlmanager/index.php?lang=en HTTP/1.1" 404 777 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "-"128.199.16.76 - - [28/May/2023:17:02:23 +0000] "GET /administrator/db/index.php?lang=en HTTP/1.1" 404 785 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "-"128.199.16.76 - - [28/May/2023:17:02:23 +0000] "GET /sql/websql/index.php?lang=en HTTP/1.1" 404 779 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "-"128.199.16.76 - - [28/May/2023:17:02:23 +0000] "GET /admin/web/index.php?lang=en HTTP/1.1" 404 778 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "-"128.199.16.76 - - [28/May/2023:17:02:23 +0000] "GET /database/index.php?lang=en HTTP/1.1" 404 773 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "-"128.199.16.76 - - [28/May/2023:17:02:24 +0000] "GET /phppma/index.php?lang=en HTTP/1.1" 404 771 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "-"128.199.16.76 - - [28/May/2023:17:02:24 +0000] "GET /phpMyAdmin2/index.php?lang=en HTTP/1.1" 404 776 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "-"128.199.16.76 - - [28/May/2023:17:02:24 +0000] "GET /administrator/pma/index.php?lang=en HTTP/1.1" 404 786 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "-"128.199.16.76 - - [28/May/2023:17:02:24 +0000] "GET /php-my-admin/index.php?lang=en HTTP/1.1" 404 777 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "-"128.199.16.76 - - [28/May/2023:17:02:25 +0000] "GET /phpmyadmin2022/index.php?lang=en HTTP/1.1" 404 779 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "-"128.199.16.76 - - [28/May/2023:17:02:25 +0000] "GET /db/phpmyadmin4/index.php?lang=en HTTP/1.1" 404 783 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "-"128.199.16.76 - - [28/May/2023:17:02:25 +0000] "GET /mysql/pma/index.php?lang=en HTTP/1.1" 404 778 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "-"128.199.16.76 - - [28/May/2023:17:02:25 +0000] "GET /index.php?lang=en HTTP/1.1" 404 760 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" "-"...I think at that moment my server is still alive but the EC2 heath check found that in one minute all the request were responded as 404, so AWS set my server into 'Severe'.What can I do on ElasticBeanstalk to make my webApp not go fail?May I change EC2 heath check rule ?  Or dose AWS support any service to protect the webApp like firewall?FollowComment"

Answer: "0How about deploying AWS WAF to protect your web applications?AWS WAF can be configured on ALB or CloudFront and can be used to prevent attacks on web applications.Also, AWS WAF can be configured with rate-based rules, so it is possible to have it deal with attacks such as DDoS.https://docs.aws.amazon.com/waf/latest/developerguide/getting-started.htmlIf you want to specialize in DDoS countermeasures, you can also consider deploying AWS Shield Advanced as a countermeasure.https://docs.aws.amazon.com/waf/latest/developerguide/ddos-advanced-summary.htmlIt would be better to start with AWS WAF, which can be easily configured.CommentShareEXPERTRiku_Kobayashianswered 6 days ago"


Question: CIS Centos Linux 7 Benchmark - Level 1 - LAMP

"CIS Centos Linux 7 Benchmark - Level 1, I install Apache, MySQL, php and open local my page index.html curl localhost/index.html or 127.0.0.1/index.html - it works, but when i open in browser Firifox this page doesn't workFollowComment"


Question: Can I set an additional target value that only applies to scale-in of aws ecs fargate?

"I configured autoscaling using aws ecs fargate.For example, if I set the target value of cpu to 80 among the service indicators, I know that if the cpu usage rate is over 80%, the number of tasks will be increased by scaling out, and if it is less than 80% in the increased state, it will be scaled in and the number of tasks will be reduced.What I am concerned about is that in case of scale in, the cpu target value is 80, so if it is less than 80, the number of tasks will decrease. Therefore, after the task is executed, it will be scaled in immediately, and the number of tasks will immediately drop below 80. (In case there is no cooldown period)I think you can prevent the number of tasks from decreasing right away by setting a scale-in cooldown period, but it would be more useful if you additionally set a service indicator target value that only scales in.Is there a way to separately set the target value to which only scale in is applied in the ecs fargate service?Or is there a way other than setting the cooldown period?FollowComment"

Answer: "0Accepted AnswerHi,The scale-in value actually isn't the target value, if you pull up the CloudWatch alarms created by the target tracking policy, the Low usage alarm will be some amount under the target value (dynamically calculated by target tracking).  Additionally, it requires 15 periods of 60 seconds each to be triggered, so at the very least its not scaling in for 15 minutes (alarm settings aren't configurable with target tracking)Additionally, target tracking has quite a few built in mechanisms to prevent excessive churn of your service.  If target tracking doesn't feel like its 'safe' to scale-in, it won't.  For example, if you have multiple target tracking scaling policies, it will only scale-in if all of them want to at once (ex, one for CPU and one for Memory Reservation is a common setup in ECS)Target Tracking works quite well for the majority of usecases, but if you try it out and its not working for you, you can click the 'disable scale-in' option on the policy and make a custom Step Scaling based policy and alarm where you set everything to your exact preferred values.  Just keep in mind that step scaling does NOT have all the other internal protections target tracking has to prevent churn.  If the policy triggers and isn't blocked by cooldown/in-progress activities, it'll scale - so be careful when configuring all the alarm and policy settings.CommentShareShahad_Canswered 4 months ago"


Question: How to create sub-domain in EC2 Instance running

"Hi Dear,I have domain name purchased from go daddy. But After assigning the same PublicIP for C(i.e for subdomain) Record(). It was not works only A records work.How to resolve the Issue.I looking forwards with thanks for your response;FollowComment"

Answer: "0What do you mean by C Record, do you mean CNAME?CNAME has to point to another DNS record and not an IP address.How is your EC2 setup - there is presumably a public IP (which it seems is set to the value of you A-record) and you can connect to the EC2 on this IP address, right?Can you explain more about how the C Record (which presumably means the IP address arrived at from the CNAME record) fits into this?CommentShareRWCanswered a month ago"


Question: Sagemaker batch transform

"Hi, it seems that Sagemaker Batch Transform is limited to 100MB payloadsI'd like to run preds against a 5GB csv file, what the recommended way to do so?FollowCommentclouduser a year ago@Olivier_CR - i'm curious , how are you creating this batch jobs, are you doing it via console, cli or using lambda to do it via code?Share"

Answer: 0Accepted AnswerSageMaker Batch Transform will automatically split your input file into whatever payload size is specified if you use "SplitType": "Line" and "BatchStrategy": "MultiRecord". There's no need to split files yourself or to use large payload sizes unless you have very large single records.Hope that helps!CommentShareAWS-User-8377309answered 5 years ago


Question: Does Amazon Workspaces support 32-bit application

"Hey all,May I know if Amazon Workspaces supports 32-bit application?Best regards,FollowComment"

Answer: "0Accepted AnswerIt depends. "Any 32-bit or 64-bit application that is compatible with Windows 7 through to Windows 10 / Server 2016" should be compatible with WorkSpaces.  Amazon WorkSpaces doesn't, at the time of writing, natively support production workloads with camera redirection, USB redirection or LPT/COM port redirection - so if an application (32 or 64 bit) requires such device support there could be issues. Here, consider testing with, say, Fabulatech's technologies.  The public beta of WorkSpaces Streaming Protocol does allow customers to test native USB camera support for Windows devices.For customers who have legacy WinXP,Windows 7/10 applications that won't work in a Windows Server operating system, and the customer cannot deploy BYOL, we have solutions from AWS Partners such as Cloudhouse or Droplet IncThere is no requirement to package applications with Amazon Workspace Application Manager (WAM) for WorkSpacecs. Given WAM only operates with Amazon WorkSpaces, is not available in all regions where WorkSpaces is supported, and does not support Linux - I would explore how your customer uses and deploys applications today and reuse that method; or look to AWS Partner solutions such as Liquidware Flexapp (available on Marketplace  ); or indeed, make use of any application deployment tooling that can operate across your customer's different application environments.CommentShareEXPERTAndrew_Wanswered 3 years ago"


Question: AWS Directory Service

"Currently, we have an on-prem Active Directory. We also have a disaster recovery environment that is connected also in our on-prem AD. Once our on-prem get down, there will be no SSO or domain for our servers. We are thinking of using AWS Directory Service to extend our on-prem AD to AWS Cloud, and as a solution also for disaster recovery.Is this possible?Once we configured this service, do the servers or users will still be able to connect using their AD accounts or domain if our on-prem AD fails?What will happen to the AWS Directory Service if it lost the connection to our on-prem AD?FollowComment"

Answer: "1Yes, it is possible using a combination of AWS services.However it's more of a Microsoft AD question than an AWS Managed AD question.If your main concern is DR and not willing to move the AD into the cloud, then one option you have is to use AWS Elastic Disaster Recovery (DRS), the next generation of CloudEndure DR. What it does is to have a block level replication of your on-prem AD servers into the cloud and you can launch it when you needed to during an incident. In that approach the AD controllers in the cloud will act very similar to your on-prem AD. There might be some down time when you spining up new AD servers on the cloud, but it should be minimal, and your users can reconnect as normal after that.You also have the options to use AWS Managed AD. However, in that case you it would be a different forest, which might not address your DR needs.Lastly you had the option to host your AD on EC2 and add them as domain controllers to your existing AD.I know many customers are cost conscious, but I do recommend you think about migrate the Active Directory completely to the cloud. Using AWS Managed AD cross region replication, you have a fully managed AD solution that can help you achieve the SLAs you are looking for.CommentShareJason_Sanswered a year ago"


Question: Braket Tasks Queue but queue isn't being cleared

"Hi, I have a bunch of queued braket tasks that have been sitting in the queued for over 3 hours.  Any idea how to check that the queue is still being serviced or is broken?Edited by: AussieV123 on Sep 6, 2020 11:40 AMFollowComment"

Answer: "0The queue has finally been processed but I still don't know why it was stalled.  If you are running this from a notebook or the CLI it would be nice to know that you are stuck in a queue. Any ideas on how to do that?CommentShareAussieV123answered 3 years ago0Which device were you targeting? Some QPUs are only available to process tasks during pre-defined windows of execution, so your tasks would be queued until the QPU becomes available. Availability windows are shown for each device in the Amazon Braket ConsoleCommentShareAWS-User-9676527answered 3 years ago0The DWave machine.This was before the unplanned maintenance anounced on the 9th.At the time the machine was advertised as being online and ready for use.CommentShareAussieV123answered 3 years ago0I plan on writting a service that uses the Dwave machine.  Is there someway to tell if the service is up from a lambda function?CommentShareAussieV123answered 3 years ago0Hi AussieV123,The GetDevice API (https://docs.aws.amazon.com/braket/latest/APIReference/API_GetDevice.html) tells you the status of a device. If you are working in python it might be more convenient to use a boto3 client for that (https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/braket.html#Braket.Client.get_device).CommentShareemkesslerAWSanswered 3 years ago"


Question: Redshift cross AWS account connection recommended?

"Hello AWS Experts,We are having two different AWS account in the same  region. For instance Account_1 and Account_2. Account_1 EC2 has Talend installed and Account_2 has Redshift. We need to fetch Redshift(Account_2) data directly from Account_1. Is cross account connection for fetching data is recommended?Can anyone please help me here? Kindly give me the URL also if you have.Appreciate your help!Thanks,RNFollowComment"

Answer: "0If you are running RA3 node type, then using Redshift-managed VPC endpoints is what you should take a look at.  It supports cross-account access as well.https://docs.aws.amazon.com/redshift/latest/mgmt/managing-cluster-cross-vpc.htmlCommentShareDon_Danswered 6 months ago"


Question: UNLOAD to parquet does not work for arrays

"usingUNLOAD(SELECT * FROM TABLE) TO 's3://...'    WITH (format = 'PARQUET',compression = 'SNAPPY');there is a column in table with is an array which comes back withParquet record is malformed: empty fields are illegal, the field should be ommited completely instead. How do I unload parquet if the column  has arrays?FollowCommentDavid 6 months agoWhich column type is used to store array? Is it SUPER?Share"


Question: API Gateway Response Models are Not Exported in Open API Documentation

I have an API in API Gateway that has Models defined for one of the REST responses.  I am trying to export the the OPEN API document for this API but the cli command is not exporting these models (I have redacted the rest-api-id to protect the innocent :)aws apigateway get-export --parameters extensions='apigateway' --accepts application/yaml --rest-api-id .......... --stage dev --export-type swagger openapi.ymlI have also tried:aws apigateway get-export --parameters extensions='apigateway' --accepts application/yaml --rest-api-id .......... --stage dev --export-type oas30 openapi.ymlBoth of these commands generated an openapi.yml file but neither one includes the Model as defined in the AWS console.FollowComment


Question: "Unable to list bucket, appears to time out"

"Hi, I have a bucket shareablee-next that I'm not able to list the contents of. In the web console, the ListObjects request appears to time out, and on the CLI the command runs for a long time without returning anything.FollowComment"

Answer: "0It looks like this was due to having versioning enabled on this bucket, and having lots of deleted objects retained as previous versions.If I did something like this:import boto3s3 = boto3.resource("s3")bucket = s3.Bucket("shareablee-next")for obj in bucket.object_versions.filter(Prefix='testing/'):    print(obj.key)I was able to quickly list object versions. It appears that the normal object list operation was slow because it had to filter out many, many, deleted objects first.My ultimate goal was to delete this objects along with their previous versions, so I can also just use this:import boto3s3 = boto3.resource("s3")bucket = s3.Bucket("shareablee-next")bucket.object_versions.filter(Prefix='testing/').delete()I had also set up a lifecycle rule, but it also seemed to be delayed by the slow listing. Now that I've run this delete script for a while, I can list the bucket again, and there are still objects that should have been deleted by now.CommentSharedoug-shareableeanswered 3 years ago"


Question: Component not deploying on Greengrass Core Device

"I have a setup where I can get device to use fleet provisioning. The device register fine and can deploy an initial deployment  including CLI, ShadowManager, TokenExchangeService, mqtt.Bridge.  and Nucleus.I also have a Python component. When I deploy the component locally (CLI) it all works fine.I then uploaded a zip file of my component (only the needed Python files) to a S3 bucket. adapted the recipe and tried to deploy it in that initial deployment. In that instance I get the following errors2022-01-20T11:42:04.864Z [ERROR] (pool-2-thread-11) com.aws.greengrass.tes.CredentialRequestHandler: Error in retrieving AwsCredentials from TES. {iotCredentialsPath=/role-aliases/GGRATokenXchange/credentials, credentialData=TES responded with status code: 400. Caching response. {"message":"Unable to assume the role, or the role to assume does not exist"}}2022-01-20T11:42:04.882Z [INFO] (pool-2-thread-11) com.aws.greengrass.componentmanager.builtins.S3Downloader: get-bucket-location. task failed and will be retried. {task-attempt=1, componentIdentifier=io.screencloud.SCRDMngt, artifactUri=s3://scrdm.artifacts/io.screencloud.SCRDMngt/1.0.0/scrdm.zip}With the first message being repeated afterward (There was a stack trace not shown here).Now, GGRATokenXchange is a role alias for GGRTokenXchange with the following policies{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor2",            "Effect": "Allow",            "Action": [                "logs:DescribeLogStreams",                "iot:Connect",                "iot:DescribeCertificate",                "logs:CreateLogGroup",                "logs:PutLogEvents",                "s3:ListMultipartUploadParts",                "iot:Receive",                "s3:PutObject",                "logs:CreateLogStream",                "iot:Subscribe",                "s3:AbortMultipartUpload",                "s3:GetBucketLocation",                "iot:Publish"            ],            "Resource": "*"        }    ]}and{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": "s3:GetObject",            "Resource": "arn:aws:s3:::scrdm.artifacts/*"        }    ]}with scrdm.artifacts the name of the bucket where my component is stored. You'll notice the "s3:GetBucketLocation".effectiveConfig.yaml seem to have the proper thing name and pathsCan someone please tell me what I am doing wrong?TIAFrançoisFollowComment"

Answer: "1What does the AWS IoT Core policy contain that is associated with the core devices certificate? Specifically, do you have the following included:{    "Effect": "Allow",    "Action": "iot:AssumeRoleWithCertificate",    "Resource": "arn:aws:iot:region:account-id:rolealias/token-exchange-role-alias-name"},This allows the TES component access to the AWS IoT Role Alias. More details can be found here.Let me know if that helps!CommentShareGavin_Aanswered a year agoAWS-User-0691707 a year agoThanks for your comment.The policy attached to the certificate generated when the device registered is:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["iot:Publish","iot:Subscribe","iot:Connect","iot:Receive"],"Resource": [""]},{"Effect": "Allow","Action": ["iot:GetThingShadow","iot:UpdateThingShadow","iot:DeleteThingShadow"],"Resource": [""]},{"Effect": "Allow","Action": ["greengrass:"],"Resource": [""]},{"Effect": "Allow","Action": "iot:AssumeRoleWithCertificate","Resource": "arn:aws:iot:us-east-2:xxxxxxxxxxxx:rolealias/GGRATokenXchange"},{"Effect": "Allow","Action": ["s3:"],"Resource": [""]}]}It has the bit about AssumeRoleWithCertificateShare0Setup a new a account and now it works. Don't ask why.CommentShareAWS-User-0691707answered a year ago"


Question: Textract Form data + Raw data

"I am having a problem in extraction of text if a page has form data as well as some raw data format. For instance half or some portion of the page has plain text and half of the page has form data. Once we analyze document by textract it will say that it has form data, once we extract as per form data then in downloaded file only portion of form data will be captured and if we run raw data then all of the page including form data will be extracted but it will not be in a structured format.Is there a way we can do extract data where we have form then it will be excluded from raw data or anything else we can do to have the same extraction as per document uploadedFollowComment"

Answer: "0Hey!This one is a bit tricky, but if you understand how the JSON response is structured, you should be able to post-process the AnalyzeDocument API Json Response to get the data you need.The AnalyzeDocument API will return all the text it found in the document + the FeatureTypes you requested (In this case Forms)Each word is represented by an ID, and this ID is present in the Forms relationships.You will first have to process and save the Form relationship resultsThen you will have to delete from the response, the IDs of the words that correspond to the forms and will obtain the remaining raw text you are looking for.Take a look at the Textractor aws sample, which can help you process the JSON results!Hope this helps.CommentShareDani Manswered a year ago"


Question: How do I create an OpenSearch subscription for CloudWatch using the API?

It's possible to stream CloudWatch logs to OpenSearch. The process of setting up the subscription via the UI ids described here: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_OpenSearch_Stream.html. Is there a way of setting this up using the API or CloudFormation? It's not listed as an option here: https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutSubscriptionFilter.htmlFollowComment

Answer: "0I recommend taking a look at sample CloudFormation templates such as this one and another one here. When you create a subscription to stream logs to OpenSearch, a Lambda function is used to stream logs. Therefore, there is no single API to set up the subscription. Instead, you will need to create a subscription with a destination set for Lambda.CommentShareTaka_Manswered 10 months ago"


Question: Error creating cluster on Red Hat Openshift

"Hello,I try to create a cluster on Red hat openshift, and it need AWS IAM user credentials AWS access key ID, then I created one, but still errors like the below:CLUSTERS-MGMT-400: User name associated to BYOC credentials is emptyOperation ID: 25e8e957-16ea-4428-bfd1-c53681edb6bcThank you.FollowComment"

Answer: "0Does this have anything to do with AWS ParallelCluster? If not, please remove the AWS ParallelCluster label.CommentShareJacopo De Amicisanswered a month ago"


Question: eb deploy successful but code not updating

"Hi. I'm running into a weird issue. I deploy my apps to Elastic Beanstalk using the eb cli, and it has always worked in the past. However, lately I've noticed that when I use eb deploy, the application is successfully deployed, but the code is still always the old version. If I SSH into the EC2 instance, it's still the old code. Nothing really has change in terms of my application. To get around this, I have to manually deploy files, but I would like eb deploy to just work like it did before. Is this a known issue?FollowComment"

Answer: "0Go to the Application Versions area for your app and click the link in the Source column to download the source for the version in question. Expand the bundle and check if the file content matches your expectations.CommentSharejohnthussanswered a year agodnguyen41 a year agoYes, it does match my expectations. However, the web app does not reflect those changes. In Elastic Beanstalk, the running version is the correct version (with the correct changes), but what's actually on the server is still the old version.Share0For an update to my issue, I was able to narrow it down to EB environments where the EC2 has termination protection enabled. For environments without termination protection, then eb deploy works as expected. It definitely used to work before with environments that have termination protection enabled, so some release must've broken this process.CommentSharednguyen41answered a year ago"


Question: Send WAF logs to rSysLog (direct connection to 514 port over UDP) through Amazon Kinesis Data Firehouse

"We are required to send WAF logs to an external server running rSysLog with several tools already set and configured for traffic analysis.I perceived that externalization of log data streams are made with the option of using Kinesis Data Firehouse for logging in the WebACL settings.However, when I tried to create a delivery data stream, I don't see any option for common SysLog protocol.Is it not really possible to do that? I didn't see mention in Amazon AWS official documentation and tricks around the internet seem to be in the opposite side, from rSysLog to Kinesis services and using an intermediate software that doesn't seem to work in another way.FollowComment"

Answer: "0Hello,There are a few documents that may be helpful in accomplishing this.This article on setting up Kinesis Firehose as a logging destination, and this one on managing webACL logging.Additionally, this guide walks through setting up syslog integration w/ Kinesis. That last link also outlines testing procedures, which may come in handy.Hope that helps!CommentSharemramlanswered 5 months ago"


Question: What is an Mqtt 'session'?

"In creating an Mqtt client connection using the class AwsIotMqttConnectionBuilder, I encounter a configuration setting called "withCleanSession(boolean)" that is described in the documentation this way:/** * Configures whether or not the service should try to resume prior * subscriptions, if it has any * * @param cleanSession true if the session should drop prior subscriptions when *                     a connection from this builder is established, false to resume the session * @return {@link AwsIotMqttConnectionBuilder} */public AwsIotMqttConnectionBuilder withCleanSession(boolean cleanSession) {    this.config.setCleanSession(cleanSession);    return this;}What is the meaning of "session" in this context? Is a session something that is local to one computer, or is it a state stored on the network somewhere? Is the client ID of the connection related to its state?FollowComment"

Answer: "0Accepted AnswerPlease see here: https://docs.aws.amazon.com/iot/latest/developerguide/mqtt.html#mqtt-persistent-sessionsPersistent sessions store a client’s subscriptions and messages, with a quality of service (QoS) of 1, that have not been acknowledged by the client. When a disconnected device reconnects to a persistent session, the session resumes, its subscriptions are reinstated, and subscribed messages received prior to the reconnection and that have not been acknowledged by the client are sent to the client.And: https://docs.aws.amazon.com/iot/latest/developerguide/sdk-tutorials.htmlThe message broker receives messages from devices and publishes messages to devices that have subscribed to them. With persistent sessions —sessions that remain active even when the initiating device is disconnected—devices can retrieve messages that were published while they were disconnected. On the device side, MQTT supports Quality of Service levels (QoS) that ensure the host receives messages sent by the device.Also: https://aws.amazon.com/about-aws/whats-new/2019/01/aws-iot-core-now-enables-customers-to-store-messages-for-disconnected-devices/Is the client ID of the connection related to its state?Yes, the Client ID is used to identify which session to resume.CommentShareEXPERTGreg_Banswered a year agoFrank a year agoThanks for the response. I think the source of my problem was that I had created multiple clients with the same Client ID and that was causing issues. Once I gave each client a unique ID things worked as expected.Share"


Question: Is there an easy way to delete the 'log4j hotfix' tool that gets installed as a dependency of Corretto?

"We recently switched to using Corretto Java 11 and I noticed that something called log4j-cve-2021-44228-hotpatch gets installed as a dependency. This package executes a script that appears to be modifying the Java runtime to install an agent that will somehow patch vulnerable versions of log4j. Looking at journalctl, I see this script runs every 30 minutes.We don't use log4j and we don't have it installed on our EC2 instances. We have over 100 EC2 instances. Is there an easy way to permanently remove this tool or do we have to switch to the OpenJDK Java release?FollowComment"


Question: Retry deployment on single device

"I have multiple device to which my component is deployed to. I added a new device "my-device15", but the component was not properly started on it. I SSH'd into the device and fixed the problem. Can I retry the deployment only on this device without revising the deployment (since that would impact all the other device)?FollowComment"

Answer: "0Accepted AnswerHi thereYou could create a same deployment but change target type to single core device.CommentShareLihaoanswered a year agoTSpark a year agoThanks for the answer ! In that case, the device "my-device15" would have two overlapping deployments. Wouldn't that be an issue ?ShareTSpark a year agoIs the "shutdown" lifecycle script called when a component enters "broken" state ?ShareLihao a year agoThanks for the answer ! In that case, the device "my-device15" would have two overlapping deployments. Wouldn't that be an issue ?If I got a device failed like this, I'd remove it from the thing group, create a test deployment to it to make sure everything works and then add it back to thing group. I hope I understand your use case correctly.Is the "shutdown" lifecycle script called when a component enters "broken" state ?Yes, it will.Share"


Question: Is setup.py still relevant in AWS CDK v2 projects?

"I'm migrating an AWS CDK project from v1 to v2. The file setup.py has been around since the start of the project, but I can't really find any details about this file in the Working with the AWS CDK : Python documentation (https://docs.aws.amazon.com/cdk/v2/guide/work-with-cdk-python.html).Does this file have a purpose?FollowComment"

Answer: "0Hi there,Setup.py is now not being added in by default in CDKV2. I've only seen it be added into CDK apps that were generated by the CDKv1 CLI:You can review the below github issue for more informationhttps://github.com/aws/aws-cdk/issues/9135That the reason you were seeing the setup.py file  initally when working CDKv1.It was deprecated due to standards changing and to instead use pip as a standalone since setup.py introduced issues with package installations: https://blog.ganssle.io/articles/2021/10/setup-py-deprecated.htmlCommentShareAditya_Tanswered 3 months ago"


Question: SES setup issue(s)

"EDIT : no longer required. Started the setup again and managed to get it working.Hoping someone can point me in the right direction.New to setting up anything related to an email server but have fumbled my way through most of it (I believe) using Lightsail, SES, postfix and dovecot.At present I have a site hosted outside AWS which has recently been replaced by a site on Lightsail (old site still currently running). The old domain is up for renewal in a week or so's time and I'm shutting it down I will be transferring the domain to AWS and pointing at the new site. The old site/hosting has email included which I need to set-up in AWS.  The purpose of the email server is just for welcome, password reset, account notifications etc as well as inbound for a few legal reasons (privacy requests etc) and account management (aws, payment provider etc).For the past day or so I've played around with dovecot and postfix and finally managed to get outlook to connect to dovecot to download mail and send to myself.I have several issues however that I'm stuck on.  The only email I can send/receive is to/from myself. Incoming mail at present disappears in to the ether somewhere (previously would be rejected).The domain is verified within SES and I have a confirmation email from AWS saying I can send DKIM signed emails from any address in this domain.If I send from the server itself directly to an external address I get aUndelivered Mail Returned to Senderbounce with<recipient_email_address_here>: host email-smtp.eu-west-1.amazonaws.com[52.51.155.83]   said: 554 Message rejected: Email address is not verified. The following   identities failed the check in region EU-WEST-1: recipient_email_address_here (in   reply to end of DATA command)If I send from outlook I get anUndeliverablebounce withThe following recipient(s) cannot be reached:     'recipient_email_address_here' on 12/07/2019 13:39           Server error: '454 4.7.1 <recipient_email_address_here>: Relay access denied'Looking in the dovecot and postfix logs both of the above emails match what is logged.I've tried to add the specific sending email address to be verified however the verification email never arrives (presuming same issue as inbound mail from external just going to the ether). I have tried pointing the MX record to the server (where postfix/dovecot are) directly and also to inbound-smtp.eu-west-1.amazonaws.com.  Although if I've read the docs correctly pointing inbound to the aws server means I then need to set-up rules to subsequently pass the message on to my server (and the options available didn't see to apply which is why I tried directly at the server where postfix/dovecot is).I realise that the problem will most likely be in my postfix/dovecot settings somewhere so not strictly an AWS SES issue but I'm at a bit of a loss as to where or what to try. If anyone could point me in the right directly it would be much appreciated.ThanksHappy to post any logs if it helpsEdited by: jpknz on Jul 12, 2019 6:34 AMEdited by: jpknz on Jul 13, 2019 1:39 AMFollowComment"

Answer: "0Started set-up from scratch and it's workingCommentSharejpknzanswered 4 years ago0How did you get yours to work?I am unable to create a mailbox for the domain email?I just added the MX record and followed the examples: 10 mailserver.example.comand just switched the example with my domain name, I have the emails in the SES, pending verificationPlease someone heCommentSharebilleeanswered 4 years ago"


Question: My LightSail Instance/Website is not working

"Hi anyone can help me resolve my instance issue. It's not working, I tried to reboot but still no luck. Please help me get my lightsail instance up and running.Here are my instance details:Web address: burhanidigital.comFollowCommentrePost-User-5810350 a year agoIssue resolved, thanks for the help :)Share"

Answer: "0Accepted AnswerHello,It's hard to troubleshoot this without knowing more information.Was this created using an existing application Blueprint such as Wordpress, Drupal, Joomla, or Magento?Was this created using a standard Linux blueprint with a web server like Nginx or Apache?Ensure that the web server is up and running and the configuration is valid.Apache restartsudo service apache2 restartorsudo systemctl restart httpdNginx restartsudo service nginx restartorsudo systemctl restart nginxIf either of these fails to restart, you may have an error in your configuration or your instance may be out of storage space. Try researching the error by searching re:Post or Google.CommentShareEXPERTChris_Ganswered a year ago0Hi thereA simple curl request shows us that the instance is not accessible on port 80 (HTTP)curl burhanidigital.comcurl: (7) Failed to connect to burhanidigital.com port 80: Connection refusedConnection refused means that something is blocking the incoming request (my curl command). Each EC2 Instance has a firewall. In Lightsail this can be viewed in the instance "manage" menu. This menu has a "Networking" tab. Check the "IPv4 Firewall".By default it should have:Ensure your firewall matches the screenshot for HTTP and HTTPS.If the issue persists connect to the instance and confirm the web server is running. This will likely either be Apache or Nginx.Check if the instance is listening on port 80 with this command,netstat -tulpnIf you dont see 80 and 443 like below this is the problem.To resolve that you will need to start the web server. This will vary depending on the platform and blueprint you have chosen. As an example, if you chose linux and wordpress you can start apache using bitnami with this command:sudo service bitnami start apacheThe bitnami docs go into more detail here [1]. If the issue persists let us know what platform (linux/windows) and blueprint (wordpress, ruby, node) you've chosen.https://docs.bitnami.com/aws-templates/apps/wordpress/administration/control-services/CommentShareCormacanswered a year ago"


Question: RedriveAllowPolicy error during Cloudformation deploy

"Hello there,I want to create a SQS queue that is defined in a Cloudformation template like thisFooQueue:Type: AWS::SQS::QueueProperties:RedriveAllowPolicy:redrivePermission: denyAllwhich worked before for other queues (and should be working according to the docs?). However, for this one, I am now getting the error "extraneous key [RedriveAllowPolicy] not permitted".Am I missing something, or did something get changed?Thanks in advance!FollowComment"

Answer: "0Accepted AnswerHello,Thanks for reaching out.As the official cloudformation doc mentioned(https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sqs-queues.html ), you need to provide a json property for RedriveAllowPolicy, follow is one sample:AWSTemplateFormatVersion: 2010-09-09  Description: A sample template  Resources:    MyQueue:      Type: 'AWS::SQS::Queue'      Properties:        RedriveAllowPolicy: '{"redrivePermission":"denyAll"}'    Please let's know if you have any further questions,Regards,CommentSharejunhuazhanswered 2 years ago"


Question: 1/2 comprobacion de estado

"Hello, everyone, i need your help some body, for repair or knows why i get that error or 1/2 status comprobation.My ionstance dont had that problems, its so new in my case, i have one instance with centos 7 sistem running.I need somebody for help me to resolve this incovenient.thanks so muchFollowComment"

Answer: "1This document provides pointers on how to troubleshoot instances with failed status checks - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstances.htmlCommentShareEXPERTIndranil Banerjee AWSanswered a year agoBecker4 a year agoOk let my try to resolve with this informations, and I back with you, thanks so much Indranil.Share"


Question: Data Sync Agent in Azure as SMB destination

"Hi,I have deployed a DS agent in Azure connected to a file share. I have the agent online and authorisation to the azure file share.using the AWS guide here: https://aws.amazon.com/blogs/storage/how-to-move-data-from-azure-files-smb-shares-to-aws-using-aws-datasync/However running the DS Task, the error in the console is:Ping received for wrong hostIdI have tried the local IP address for the file share but the error is still the same.I can't find any troubleshooting details for this error.The agent can successfully lookup the file share name and resolve the DNS to the local ip address, so I'm not sure what the issue is.FollowComment"

Answer: 0Hi ThereAre there any firewalls on the Azure vnet that might be inspecting or blocking traffic from the Agent to the DataSync service?CommentShareEXPERTMatt-Banswered 2 months ago


Question: "GraphQL -> RDS (Aurora Serverless v1, mysql, DataAPI): Connection Errors"

"I'm seeing frequent connection errors and wondering if others have encountered this and/or know of workarounds.Details:Error Message: "Got an error reading communication packets".How it's produced: const response = await API.graphql(graphqlOperation(upsertUser, { user: { ...etc... }}));Frequency: Nearly every other request.Tech stack:Frontend: Amplify, ReactBackend: AppSync: GraphQL API, RDS (Aurora Serverless v1, MySql, DataApi enabled, ACU Min=1, Max=4)All components were created in the week of July 20, 2021 so they should be sufficiently updated.Additional Context:My research so far make me suspect the database connections are being depleted despite the fact that I'm the only user on this application and Aurora DataAPI supposedly does connection pooling.  I can trigger the problem with 1 user running 2 queries a few seconds apart so there's zero chance to scale this until I can get around this issue. I'm considering adding RDS Proxy but that seems redundant with DataAPI... Help would really be appreciated here.What the app is doing: The react app loads an object from the database via graphQL -> stored procedure, then displays the object fields, then allows the user to save any changes to those fields via graphQL -> stored procedure.  This sequence works for the first modify but the next modify triggers a connection error. The inputs that triggered the connection error are valid as I'm able to save to the database without error when the page reloads and I send the same inputs.CloudWatch logs for my aurora db cluster sometimes show a statement like this but it seems not every error is logged:2021-07-27T23:46:40.922336Z 101 [Note] Aborted connection 101 to db: '<DB NAME>' user: 'admin' host: '1.2.3.4' (Got an error reading communication packets)I have not seen any other helpful logs.FollowComment"

Answer: 0I was able to solve my issue by changing the way the application was rendering content.  Seems there was a bad sequence of asynchronous React events which leading to the graphql request being affected.  The problem has not happened in a day so I can't say exactly what fixed it but all the changes have been in the frontend of the app since then.CommentShareebar1answered 2 years ago


Question: Default Cluster Version in EKS

Hi.Is there any way to know the default version of the Cluster that will be set in EKS via SDK or API other than the aws console?Why is the default version of Cluster in EKS 1.22 instead of 1.23?Are there any rules by which the default version is determined?Thanks!FollowComment

Answer: "2Accepted AnswerHello,Let me suggest a way for you to know default version. You can use the flag --dry-run with eksctl which make calls to EKS API. Same option isn't available in AWS CLI EKS as of now.eksctl create cluster --name development --dry-run | grep version  version: "1.22"The community releases new Kubernetes minor versions, such as 1.23 but they don't automatically immediately become the default version on EKS.1.22 (Amazon EKS release date April 4, 2022) is the default version because it has endured more support duration than 1.23 (Amazon EKS release date August 11, 2022).Refer to this doc to know more about how AWS plan their Kubernetes releasesCommentShareOlawale-AWSanswered 9 months agoEXPERTChris_Greviewed 9 months ago"


Question: Subdomain redirection to EC2 instance

"Hi, I am new to DNS and server setup. I have a website - abc.com hosted in hostgator and a python application running in ec2 instance. I need to point app.abc.com to the ec2 the instance while keeping the abc.com as it is.What I have tried:I have already created an elastic IP. Created nameserver records in Route 53 and added 4 NS in hostgator. Then, I created app.abc.com record in route 53. As of now, app.abc.com is redirecting to the ec2 instance but abc.com is not working. Im guessing I should not have added the 4 NS records from route 53 to the hostgator's DNS records.Any idea on how to implement this?FollowComment"

Answer: 0Fixed it by adding another record in route 53 to point back to the host ip.CommentSharegvganswered 3 years ago


Question: How to make a Year-Over-Year Line Chart in QuickSight

"Hello,I need help to understand if there is a way to display year-over-year data in a line chart.  For my particular example, I am plotting vehicle rentals over time.  I want to plot the date the rental occurs on the x-axis and the count of total rentals for that day on the y-axis.  The tricky part is that I want to show the data with a year-over-year comparison and that is where I need help.I am aware of the Color field for Line Charts that allows grouping different lines over one another by different dimensions.  However, I cannot do this because I am already using the date field along the x-axis...QuickSight tells me "You can't use the same field for more than one dimension (blue) field well.  Choose different fields for them"Essentially what I want is for the x-axis to show all the months (or days) from January to December.  Then Each different color line will represent the count of rentals for each year. Ideally, this would be drillable too, so a user could drill down to the week or day view but preserve the year-over-year view. Here is an image that I've created demonstrating this: YoY Line ChartI have come up with a workaround by creating a calculated field to extract each part of the date (year, month, date, etc) so that QuickSight doesn't scold me for using the same field in multiple dimension field wells.  The problem with this is that then those fields are no longer of the DateTime type.  I don't like this because I lose the value of using Dates in a Line chart (relative date filtering, automatic drilling, etc.) and, if it isn't a date, QuickSight can only sort alphabetically (April comes before January, etc.)Does anyone have a technique for showing YoY trend data in the way I've described?ThanksFollowComment"

Answer: "0Hi ,you could potentially use the periodOverPeriodLastValue to create a calculated field for PreviousYear for the specific measure, or more than one calculated field if you want to compare more years, and play with the offset.using your method, instead of splitting all part of the years, you could just create a calculated field that maps the same day and month to an non existent year in your data set ( i.e. calculated field parseDate(concat('1900-',substring(toString(Date),6,5)),'yyyy-MM-dd') ) .In this way you have stiil a date format and you can use the visual custom fromat for the date to show MMM-dd i.e. Jan 01.obviously the first method should be the right one to test the second is more of a workaround.CommentShareEXPERTFabrizio@AWSanswered a year ago0Thank you for posting your question, as of now the two ways you can achieve what you have described are the one you mentioned in your post and the one mentioned by Fabrizio@AWS above.CommentShareSUPPORT ENGINEERChaitanya_Tanswered a year ago"


Question: CodeDeploy - DownloadBundle failing

"With an existing auto-scaling group, and an existing CodeDeploy revision, we encounter quite a few DownloadBundle failures from CodeDeploy when a scale-out event occurs. What exactly is DownloadBundle doing? I would assume, based on the name, that it's pulling the zip file from "Revision location" (e.g - S3). According to the events log, the ApplicationStop event executed prior to DownloadBundle and that hook is defined in appspec.yml which is stored in the zip file ("Revision location") retrieved from S3 so I would assume the download from S3 has already happend.FollowComment"

Answer: "0What exactly is DownloadBundle doing?The AWS Official FAQs state the following [1][1] AWS CodeDeploy FAQs | Amazon Web Seviceshttps://aws.amazon.com/codedeploy/faqs/?nc1=h_ls#:~:text=of%20a%20deployment.-,DownloadBundle,-During%20this%20deployment----- excerpt -----During this deployment lifecycle event, the agent copies the revision files to a temporary location on the instance. This deployment lifecycle event is reserved for the agent and cannot be used to run user scripts.----- excerpt -----I'm not sure of the specific error in your environment, but I found a similar GitHub Issue below. [2][2] CodeDeploy fails at "DownloadBundle" step - Issue #255 - aws/aws-codedeploy-agenthttps://github.com/aws/aws-codedeploy-agent/issues/255According to the GitHub Issue above, this can happen with certain CodeDeploy agent versions.I hope this is helpful.CommentSharemn87answered 8 months ago"


Question: How to return some json to specific path when www.mydomain.com hosted in S3?

My domain(www.mydomain.com) is hosted in s3. It is a static website. But I want to return a JSON file to this path www.mydomain.com/.well-known/assetlinks.json how can I achieve that?FollowCommentbwhaley EXPERT5 months agoCan you not simply upload the file to the S3 bucket with the path /.well-known/assetlinks.json?Share

Answer: "0Hi, @Asit DixitIf you have "The specified key does not exist" error, you need to create an S3 bucket with a custom domain name.I was able to create and access an S3 bucket as follows.% curl http://hoge1224.tak1wa.com/.well-known/assetlinks.json{    "hoge":"fuga"}Note: I'm assuming you don't use CloudFront.If you use CloudFront, you can create an S3 bucket without using a custom domain name.CommentShareEXPERTiwasaanswered 5 months ago"


Question: Regarding AWS dynamodb

"Hi,I am working with 10 iot devices which sends data to IOT core and then store to dynamodb. I want to design web interface to display this data.Now in dynamodb, i have same partition key value and sort key value. now my question is data i receive in dynamodb will be sorted order?Also suggest any way to handle data from multiple devices.FollowComment"

Answer: "1The data in DynamoDB will be sorted order by the sort key you have defined. Sorting is only applicable to items which share the same partition key. Lets take an example of a table where we sort data by time, time being the sort key (SK)PKSKsens-1012022-10-26T17:30:00.000-04:00sens-1012022-10-27T17:30:00.000-04:00sens-1012022-10-28T17:30:00.000-04:00sens-1012022-11-21T17:30:00.000-04:00sens-1012022-11-22T17:30:00.000-04:00sens-1012022-12-01T17:30:00.000-04:00sens-1072022-10-26T17:30:00.000-04:00sens-1072022-10-27T17:30:00.000-04:00sens-1072022-10-28T17:30:00.000-04:00sens-1072022-11-21T17:30:00.000-04:00sens-1072022-11-22T17:30:00.000-04:00sens-1072022-12-01T17:30:00.000-04:00sens-1032022-10-26T17:30:00.000-04:00sens-1032022-10-27T17:30:00.000-04:00sens-1032022-10-28T17:30:00.000-04:00sens-1032022-11-21T17:30:00.000-04:00sens-1032022-11-22T17:30:00.000-04:00sens-1032022-12-01T17:30:00.000-04:00Now you can see that each sensor data is sorted by the order of the sort key, but sorting is not across all sensors in the table.CommentShareEXPERTLeeroy Hannigananswered 3 months agoEXPERTkentradreviewed 3 months agokushal 3 months agoHi,Thanks for your prompt response. I understood that we can sort data if we keep PK constant using sort key. As i said earlier, I have multiple devices which sends timeseries data to dynamodb. As a PK, I am using Device ID. As a sort key i am using a positive going number as it will sort out other attributes of data. I am not using time stamp as SK since in a single timestamp, multiple data is transmitted. due so, data get unordered.Lets say If we want history of data @ some perticular time, then what to do? How do we fetch historical data from dynamodb?Kindly note that data should be in order as they come from iot core.Also what if PK and SK are constant & data attributes are changing?Share-1can any body help me out in this or any suggestions?CommentSharekushalanswered 3 months ago"


Question: SES SMTP rejects bounce messages from Exim

"I'm using SES as a smarthost for an Exim mail server. SES SMTP is rejecting bounce messages generated by Exim with this error in the log:2023-02-26 23:12:34 1pWQC2-004ohJ-24 ** jarle+ln11@jarle.com root@ln11.jarle.com R=send_via_ses T=ses_smtp H=email-smtp.eu-west-1.amazonaws.com [54.155.93.136] X=TLS1.2:ECDHE_SECP256R1__RSA_SHA256__AES_256_GCM:256 CV=yes DN="CN=email-smtp.eu-west-1.amazonaws.com": SMTP error from remote mail server after MAIL FROM:<>: 501 Invalid MAIL FROM address providedThe problems seems to be that the MAIL FROM address is empty ("<>"). But this is correct according to the standard, RFC  1123 section 5.2.9.Any suggestions on how to handle this?FollowComment"

Answer: "0[RFC5321] allows the reverse-path to be null (see Section 4.5.5 in [RFC5321]).  In this case, there is no explicit sender mailbox, and such a message can be assumed to be a notification message from the mail system itself.  When the reverse-path is null, this document defines the "MAIL FROM" identity to be the mailbox composed of the local-part "postmaster" and the "HELO" identity (which might or might not have been checked separately before).https://www.rfc-editor.org/rfc/rfc7208#section-2.4So, a null return path is effectively the same as postmaster@HELO, but specifically null to prevent backscatter loops.SES will rewrite the return path to UUID@MAILFROMdomain for all egressing outbound mail. If you have feedback forwarding configured, any NDRs that flow back to that return path address will be sent to the MAIL FROM address that you specified in the original request. https://docs.aws.amazon.com/ses/latest/dg/monitor-sending-activity-using-notifications-email.htmlSo, you will want to be sure that feedback does not result in another outbound NDR and cause a loop.CommentShareJesse_Tanswered 3 months ago"


Question: STS deactivation

"STS can be deactivated for all regions except US East.  What is the significance of the US East region, that prevents/disallows the deactivation of STS?FollowComment"

Answer: "0us-east-1 is a bit of a special region in AWS with regards to global services like IAM. If you go to global services like IAM, you might have noticed your console URL gets changed to https://us-east-1.console.aws.amazon.com/Because these core global services like STS have a dependency on this region, thats why you can't disable it.CommentSharerianbkanswered 8 months ago"


Question: Strange cost of ALB in two regions! why?

"Hi,I have ALB for a busy website in Bahrain, daily visits over 200K, yet the monthly cost of the ALB is less than $1.Also, I have a small ec2 for 3 websites with ALB, and the monthly cost is $10. The maximum dialy visits for all websites is 3.Middle East (Bahrain)Elastic Load Balancing - Application$0.85USD0.0 per Hrs for LoadBalancerUsage:LoadBalancing:Application usage in Middle East (Bahrain)696.000 Hrs$0.00USD0.0 per LCU-Hrs for LCUUsage:LoadBalancing:Application usage in Middle East (Bahrain)15.000 LCU-Hrs$0.00USD0.0088 per LCU-Hrs for LCUUsage:LoadBalancing:Application in Middle East (Bahrain)96.111 LCU-Hrs$0.85US East (N. Virginia)Elastic Load Balancing - Application$9.55$0.008 per used Application load balancer capacity unit-hour (or partial hour)1.515 LCU-Hrs$0.01$0.0225 per Application LoadBalancer-hour (or partial hour)424.000 Hrs$9.54FollowComment"

Answer: "0No idea?!?is this the right place for such post?Edited by: marvix on Mar 25, 2020 3:42 PMCommentSharemarvixanswered 3 years ago0Ok, I got ... in case someone else reading this, the Bahrain region still under free tier.CommentSharemarvixanswered 3 years ago"


Question: Can't RDP into our server or get a ping response.

"We have not accessed this server is several months.  Now when we try to RDP intoit using IP 18.222.193.153 (which is what we used previously) we are not able toaccess it.  Pinging that IP also does not return a response.We need access to the server as soon as possible.Thank you,LarryFollowComment"

Answer: "1Find the EC2 instance in AWS Console, and check it is running.Confirm that its public IP address is still the one that you are trying to connect to (if the instance was stopped for a while and then restarted its public IP will have changed).Check that the security group(s) applied to the instance allow inbound connections on port 3389/tcp (for RDP) and that inbound ICMP is enabled (for ping).If all of the above checks out then the next thing to check would be connectivity and routing for the subnet in which the EC2 instance is running.CommentShareRWCanswered 2 months agorePost-User-7794122 2 months agoI have rebooted, the public IP is the same, 3389/tcp is enabled. Subnet and routing looks right.  We have not changed anything since the last time we accessed this server.ShareRWC 2 months agoInbound 3389/tcp from anywhere (0.0.0.0/0)? If it isn't then try expanding the security group rule to be that.(I assume in all this that you are trying to get access over the internet, and not over Direct Connect or VPN).Also, are you able to view the EC2 system console screen, just to check that the instance is up and running properly and displaying the Windows login screen?Share"