Question: What principal do I need to mount EFS volume in Fargate task

"I have an EFS file system policy below[2]. Using the principal of AWS:* allows my Fargate task to mount the file system.  I'd like to tighten up the principal but can't figure out what works. Going off some documentation here, I've tried[1] principals similar to the examples (with my account ID substituted) but the task fails to start with errorslike unsuccessful EFS utils command execution; code: 32. I don't get if the error is coming from missing taskRole/taskExecutionRole policies, or rather something missing for the Fargate service/cluster/assumed role itself.Do I need to add a Role Session principal (since Fargate is assuming my role at some point to launch the task) and if so how do I find out what that is?Secondly, is there any better way to debug errors like these than just burn-and-learn? All I have in Cloudtrail is stuff like "Trying something, something failed, obscure error #"[1]"Principal": { "AWS": "arn:aws:iam::123456789012:root" }"Principal": { "AWS": "123456789012" }[2] EFS policy{    "Version": "2012-10-17",    "Id": "my-app-efs-pol",    "Statement": [        {            "Sid": "my-app-efs-pol-sid",            "Effect": "Allow",            "Principal": {                "AWS": "*"            },            "Action": [                "elasticfilesystem:ClientMount",                "elasticfilesystem:ClientWrite",                "elasticfilesystem:ClientRootAccess",                "elasticfilesystem:DescribeMountTargets"            ],            "Resource": "arn:aws:elasticfilesystem:us-east-1:<myaccount_id>:file-system/fs-<filesystemid>",            "Condition": {                "Bool": {                    "aws:SecureTransport": "true",                    "elasticfilesystem:AccessedViaMountTarget": "true"                }            }        }    ]}FollowComment"

Answer: "0Can you try, for number 1.  https://docs.amazonaws.cn/en_us/efs/latest/ug/access-control-overview.html    "elasticfilesystem:CreateFileSystem",    "elasticfilesystem:CreateMountTarget"On number 2, try this:  https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/CommentShareRolyanswered 4 months ago0x90 3 months agoI added  "elasticfilesystem:CreateMountTarget" to the EFS policy OK, but adding "elasticfilesystem:CreateFileSystem" generates "Invalid policy" error in the File System Policy tab.  Both of those links are quite broad. For instance "Mounting with IAM authorization", in your second link, demos how to specify an IAM role using sudo at the command line. That might help for debugging, but I'm not clear how to limit access by IAM role instead of just "AWS": "*"Share"


Question: "Sns SMS, country of phone number or country where phone is?"

I want to send SMS messages through AWS sns. It is for a hospitality project. The users who will receive the messages will be in Greece at the time but their phone numbers might be from different countries. Can I send messages with Sender ID as it can be done in Greece or shoud I comply with what is asked for from each country that the phone number may originate?FollowComment

Answer: "0To send SMS to end-users, you will have to comply with end-users country requirements. For example, you will not be able to send messages to United states number using a senderID. To know more on each country and their requirements, refer to: https://docs.aws.amazon.com/sns/latest/dg/sns-supported-regions-countries.html#sms-support-note-2CommentSharerePost-User-4180316answered a month ago"


Question: AWS IoT Core for LoRaWAN - support for CN470 band

"Hi, I couldn't find in the documentation any notice of support for CN470-510 band in the AWS IoT Core for LoRaWAN. Is it supported or not?If not, is there any plan to do so in a near future? Or are there any LoraWan bands supported in China region right now?FollowComment"

Answer: "3the AWS IoT Core for LoRaWAN does not explicitly mention support for the CN470-510 frequency band (China LoRaWAN frequency)here there is a list of supported frequencyhttps://aws.amazon.com/iot-core/lorawan/#:~:text=AWS%20IoT%20Core%20for%20LoRaWAN%20customers%20can%20use%20US902%2D928,characteristics%20of%20these%20respective%20bands.US915: Used in the United States, Canada, and some countries in South America.EU868: Used in Europe and some countries in Africa and the Middle East.AU915: Used in Australia, New Zealand, and some countries in the Asia-Pacific region.AS923: Used in some countries in the Asia-Pacific region and the Middle East.CommentShareEXPERTsedat_salmananswered 2 months ago"


Question: LoRa device join/accept not uploading data

"Devices (same firmware, hardware, etc) split between 2 lora servers depending on our customer. LORIOT or AWS.Issue does not exist on LORIOT.Issue is not restricted to a small set of devices, it is random. In a set of 50 devices the proportion again is random but can be up to about 20% of the devices.Description of issue:A device sends a join_ request. The server replies with join accept. The device receives the join_accept. The device then starts sending uplink_data. As far as the device is concerned it has joined and keeps sending uplink_data. The AWS LoRa server does not receive or show any of the uplink_data. If the device is restarted, i.e. a new join_request / join_accept then it can work normally.Is this an encryption issue that occurs after the join_accept?Any other ideas?FollowComment"

Answer: "0We have tried a variety of profiles all with no success all based around EU868, specifying lora protocol 1.0.2 or 1.0.3, rxfreq2 8695250, rxfreq2, RegParamsRevisionRP002-1.0.1, RegParamsRevisionRegional Parameters v1.0.3rAno filters on gateway.We have set up a log in cloudwatch and have also used the network analyser.with the network analyser we get a join_request and join_accept, but then no data_uplink messages even thought the device is sending them. Other identical devices are sending through the same gateway. If you restart the device it then join and data will come through OK. It is random when this happens.When gateway joins lns we get a CUPS request and gateway certificate exchanged.CommentShareBacchusanswered 2 months agoGreg_B EXPERT2 months agoI think you need to look into the logs that I mentioned. For example, when the device sends the missing uplink, does the gateway receive it? My guess is no, which is why I asked you to check what frequencies the device is sending on and what frequencies the gateway is listening on.Share0Hi Bacchus. I don't know what's wrong, but it sounds like the device is maybe not transmitting on the right frequencies. Can you please elaborate on:what RF region you're using?what sub-bands or filters, if any, you defined in the gateway configuration in IoT Core?Are you able to get:traces/logs of Join Request and Join Accept, especially CFList (please use Network Analyzer)traces/logs of device TX frequencies when uplinks are received and when they're notBasic Station logs of the router_config message: https://lora-developers.semtech.com/build/software/lora-basics/lora-basics-for-gateways/?url=tcproto.html#connecting-to-an-lnsBasic Station logs when the device sends the uplink: does the gateway receive the uplink? I think you need to establish whether the uplink is lost between device and gateway or between gateway and cloud.CommentShareEXPERTGreg_Banswered 2 months ago"


Question: My AWS Account is Compromised - 1000X Monthly Charge

"My AWS account is compromised - I don't really understand how this would happen for a platform like AWS, where many people have their business on it.There are 1000x increases on billing due to the account being compromised. Billing dashboard shows continuing thousands of dollar charged even though turning off hundreds of instances started because of the account being compromised. I have already:Reset passwordDeleted all customized IAM rolesRemoved all other IAM usersAWS has provided any updates on the billing adjustment. What should I do? I would literally be bankrupt because of billing of a compromised account.FollowComment"

Answer: "3Hello,I sincerely apologize for the frustration this situation has caused. If you have an open support case regarding the account compromise I encourage you to continue working with our Support team through that case as we're unable to discuss account/case specifics on re:Post. You can also respond to the most recent email you've received from our Support Team.Please bear in mind that cases like this require multiple teams to be engaged to find a resolution and it can take a little time based on workload and staffing.If you'd like to speak to someone directly you can always request a call by updating the Contact Option of your case. If you Select Chat you will be able to connect with a Support Agent through chat. If you select Phone, you will be able to speak with someone on the phone. You can find the details here:https://aws.amazon.com/premiumsupport/knowledge-center/aws-phone-support/— Brian D.CommentShareEXPERTAWS Support - Briananswered a year agoEXPERTBrettski-AWSreviewed a year ago"


Question: Quickly access shadow of multiple things

"Hello,We want to show the current status of our things in a web interface. Their state is stored in each individual shadow. What is the easiest way to access 100+ shadows quickly?We are using Java and the only way to access the message broker I found in the java SDKs is in the device SDK. However, AWSIotMqttClient connection is limited to 50 subscription which makes it hard to manage many shadows at once.What is the intended way to access the shadow from a web application  backend?Thanks in advance!FollowComment"

Answer: "0Hi Gepro,This sounds like a potential use case for fleet indexing and maybe dynamic thing groups. With this feature enabled, you could write a query that returns a bunch of shadows in one go. Check out these features:https://docs.aws.amazon.com/iot/latest/developerguide/iot-indexing.htmlhttps://docs.aws.amazon.com/iot/latest/developerguide/dynamic-thing-groups.htmlHTH,RyanCommentShareRyan_Banswered 4 years ago"


Question: AWS Lambda NodeJS compatibility issues.

"I am working on AWS project by freecodecamp (link: https://www.youtube.com/watch?v=JgwI22y_eFA).This project is an online book store website which focuses on Amplify, AppSync, DynamoDB, S3 and Lambda.At about 28:00, the mentor uses amplify push to push resources to cloud, but I'm getting incompatibility errors regarding Node JS.Screenshot URL: https://drive.google.com/file/d/18gdCOudpop9SUTtbYj7VcEfkQctIm8Qw/view?usp=sharingGithub link for code: https://github.com/FossWithKc/BookStore-AWSPlease Help me.FollowCommentJack-Angel-369 a year agoHello ))) yes the 10.X runtime is not supported anymore. Update the runtime version to the last one and all would work )))Share"

Answer: "0Hi, NodeJS 10 is not supported anymore by AWS Lambda. Versions 12 and 14 are supported (doc).The version of amplify cli you use (4.24 according to the video), is a bit old (~2 years) and was using NodeJS 10. You should update to a more recent version of amplify cli: npm install -g @aws-amplify/cli. Note that the content in the GitHub repo may not be compatible with a more recent version of the cli...CommentShareJerome VDLanswered a year ago"


Question: Security Hub with Organisations

when using aws security hub with organisations do we need to enable  and setup aws security hub in each child account that exists in the organisation?FollowComment

Answer: "1You do need to enable Security Hub in each account and in each region that your workloads are hosted in, individually.You can of course achieve this easily by using CloudFormation.To use Security Hub within an AWS Organization, do the following:Choose one account (lets call it security-tooling account with id 123456789012) as your org wide security tooling account.Delegate AWS Security Hub administration to this security-tooling account.If are going to use other security services its best practice to make this security-tooling account the delegated administrator for those services as well (ex: Amazon GuardDuty, Amazon Inspector).Enable AWS Config in every account and every region that you want to use AWS Security Hub in (This is because AWS Security Hub depends on AWS Config).Enable AWS Security Hub in every account and every region that you want to.In the Security-tooling (delegated administrator ) account; navigage to: Security Hub --> Settings --> Account Management.Here you will see the list of accounts in your AWS Organization. You can enable these accounts. This enablement is so that those accounts send findings to the Security-tooling (delegated administrator) account.Check the "auto enable accounts". When you do this, all subsequent accounts that get added to the organization will directly become members and start sending findings to the delegated administrator account. (IF AWS SECURITY HUB IS ENABLED IN THOSE ACCOUNTS)Finally navigate to Security Hub --> Settings --> Regions. Select an aggregation region and  add Linked regions, so as to aggregate findings in one region.KEY POINT:An account may become a member but that would be of no use if AWS Security Hub is not enabled in it. An account may have AWS Security Hub enabled in it, but your findings will not be centralised if it is not made member account.CommentShareSiddheshJanswered 6 months ago0When you use both Security Hub and AWS Organizations together, you can automatically enable Security Hub for all of your accounts, including new accounts as they are added. This increases the coverage for Security Hub checks and findings, which provides a more comprehensive and accurate picture of your overall security posture.The detail instruction is at here: https://docs.aws.amazon.com/securityhub/latest/userguide/accounts-transition-to-orgs.htmlCommentSharesmoyanswered 10 months agorePost-User-6703621 10 months agoI have enabled that and i can see the child accounts in the masters security hub however there are no finding for sub accounts.   if a security standard has been enabled at the master  security hub than does it automatically propagate to the linked accounts?Share"


Question: issue with client-appstream

"hello all,i have a small tsx file that i am wanting to create an appstream url:import * as AWS from "@aws-sdk/client-appstream";const client = new AWS.AppStreamClient({ region: "eu-west-2" });export default function AppStreamURI() {  const params = {    "FleetName": "Windows-Fleet",    "StackName": "Windows-Stack",    "UserId": "someone@gmail.com",    "ApplicationArn": "null",  }    const command = new AWS.AssociateApplicationFleetCommand(params);  client.send(command).then(    (data) => {      console.log(data)    },    (error) => {      console.error(error)    }  )  return(
Hello
  )}The ApplicationArn is added as it was throwing an error saying this was needed, but couldnt find it noted in the aws documentation (?).I have aws config in vscode and is working on Cognito connection and what-not.I am getting the following error, which i am hoping someone can assist me with:Error: Credential is missing    at SignatureV4.credentialProvider (runtimeConfig.browser.js:23:1)    at SignatureV4.signRequest (SignatureV4.js:83:1)    at SignatureV4.sign (SignatureV4.js:52:1)    at middleware.js:12:1    at async StandardRetryStrategy.retry (StandardRetryStrategy.js:47:1)    at async loggerMiddleware.js:2:1 undefinedI am using React with "@aws-sdk/client-appstream": "^3.226.0"FollowComment"

Answer: "0Looking at the AppStream 2.0 API documentation, I see that the ApplicationArn is one of the required parameters. For the error you are receiving, make sure that the client is signing the request. If you are using Cognito, you may want to look at the following documentation to retrieve credentials from an identity pool and use that for the appstream client.AssociateApplicationFleetConfiguring the Amazon Cognito Identity credentials objectCommentShareTaka_Manswered 5 months agogavinc 5 months agoI understand this is a requirement for the API when using the AssociateApplicationFleet but this is not documented for CreateStreamingURL. (https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateStreamingURL.html)I am not using Cognito for this, as the streaming url is noted that no existing user is needed for testing, so the url can have any username.Share"


Question: Can the email alias be referenced as a template variable in the resendConfirmationCode and forgotPassword email templates?

"Is there a way to reference the email alias in the the email template for reset password? I am using email as an alias and generating the cognito username (guid). But when the reset password email goes out I would like it to reference the email address rather than the generated username.To illustrate, this is how the email is generated currently as it references {username}. Your username is aVwe3uyXcc9WbmkKTbNq4i and your temporary password is 1ZVKi@ZL.I'd like to reference the email alias. Is that variable available to the email template?I am passing email as the "Username" parameter to both resendConfirmationCode and forgotPassword methods and in both cases the {username} parameter in the template is replaced with the guid username rather than the email alias.FollowComment"

Answer: 0Can you use the Custom Message Lambda for CustomMessage_ForgotPassword case and do a look up in the event.request.userAttributes for the appropriate value you need to craft your own message.reference: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-custom-message.htmlCommentShareJeff Lombardo-AWSanswered 4 months agoRyan Tomaselli 4 months agoThanks Jeff. One problem I got was that if I don't have usernameParameter in my template then the CustomMessage_ForgotPassword trigger is ignored. I suppose I could hide that variable in the html but that doesn't work for anything other than HTML.ShareRyan Tomaselli 4 months agoI just confirmed that if I hide the usernameParameter in a hidden span tag in the custom message then the custom message is sent successfully (vs the default userpool message)Share


Question: Issues connecting to ElastiCache Memcached

"I'm trying to connect to a ElastiCache Memcached endpoint through my EC2 instance, but I'm seeing this can't reach to the Memcached node:telnet: Unable to connect to remote host: Connection timed outThis just happening today. Is there some issue with ElastiCache?FollowComment"

Answer: "0Good, I restarted the memcached service into my web instance and worked again). The memcached service into my Bitnami instance allowes me to connect to ElastiCache.CommentShareneoacevedoanswered 3 years ago0Hi There,When you get timeout issue, it is best to check the security group, NACLs of the Elasticache and EC2 for allowing the port ( in this case 11211 or the custom port, if configured ). Try with more than one EC2 instance to see if the issue is at EC2 or Elasticache side. Also, keep an eye on the Elasticache events to see if there is anything going on with the cluster.CommentShareSUPPORT ENGINEERSatyamanswered a year ago"


Question: AWS App Runner Health Check Failed

"Hi,I have Python app that process data and I am running it in Docker. Locally, it is working fine. When I tried for a first time to run on AWS App Runner I needed health check, so I expose 80 port of container and install nginx that listen on that port. When I run container locally I can access the nginx homepage. I was trying to setup health check in AWS App Runner. I am using TCP check on port 80. For some reasons it is failing all the time. Could you please give me some suggestions what could be the issue?Thank you in advance!FollowCommentHari 3 months agoHi,I work for service team, can you please share the serviceARN associated with this issue so we can look into this and get back to you. ThanksShare"


Question: Lambda You do not have sufficient permission. Access denied. on root account.

"When I try to access Lambda Dashboard/Functions from root account, I get this error: You do not have sufficient permission. Access denied.FollowComment"

Answer: "0Hi!  Good question.A couple follow-up questions:What region are you in?  Some regions are not enabled by default (for example Africa: Cape Town, Europe: Milan) and may be why you see that error.Are you part of an organization?  If so, are there Service Control Policies applied?I would check the above 2 to see why you are getting access denied at the root account level.Edit based on the response: Are other services like this as well?  Check AWS Health to see if AWS limited your account based on suspicious activityCommentSharejsoncanswered a year agostopper a year agoI mostly use Oregon (or rarely Ohio) as my region, but I get this error on all 4 top regions in region selector.Also, no, this is my personal account, I'm not part of an organization.P.S. I'm trying to access Lambda to check functions generated by AWS Amplify deploying Next.js SSR app.Share0Hello,I think you might have run into an open issueAmplify frontend build returns Starting SSR Build... [ERROR]: AccessDenied: Access Denied #2086https://github.com/aws-amplify/amplify-console/issues/2086SriCommentShareSrianswered a year ago"


Question: [Announcement] AWS Lambda now provides a .NET 6 managed runtime

"AWS Lambda now supports .NET 6 as both a managed runtime and a container base image. Developers creating serverless applications in Lambda with .NET 6 can take advantage of new features such as improved logging, simplified function definitions using top-level statements, and improved performance using source generators. Using .NET 6 also lets you take advantage of new .NET language features and performance optimizations. For more information on Lambda’s support for .NET 6, see our blog post at .NET 6 runtime now available in AWS Lambda.FollowSrikanth_N SUPPORT ENGINEER6 months agoThis is an announcement migrated from AWS Forums that does not require an answer.Share"


Question: AFI generation has been pending..

"Hello aws, depites of the aws support of https://repost.aws/questions/QUn-Z39lZhRaS_g93s0U32Eg/how-should-i-delete-afi-that-is-stuck-in-pending,AFI gen of my design with full functionality still has same issue -- the afi state is stuck in pending.{    "FpgaImages": [        {            "FpgaImageId": "afi-0092bd7a65eb6908c",            "FpgaImageGlobalId": "agfi-074215586b74cb0d4",            "Name": "",            "Description": "",            "State": {                "Code": "pending"            },            "CreateTime": "2022-10-06T23:49:51+00:00",            "UpdateTime": "2022-10-06T23:49:51+00:00",            "OwnerId": "034954464192",            "Tags": [],            "Public": false,            "DataRetentionSupport": false        }    ]}Could you please abort the process to delete the AFI again?Moreover, I can provide the same xclbin file whose control-status registers are hacked not to be programmed. Could you please check out if my xclbin has some problem to be generated?https://drive.google.com/file/d/1Y_N6_aB0Ppm8iVLqqPBGAjCwhDO6-9I-/view?usp=sharingThank you.Steen KimFollowComment"


Question: Possible typos on AWS website (aws.amazon.com)

"Hello,I might find small typos in page (English) https://aws.amazon.com/opensearch-service/pricing/,first paragraph :Amazon OpenSearch Service makes it easy for you to search, analyze, visualize, and secure up to petabytes of text and unstructured data. With Amazon OpenSearch Service, you pay only for what you use. There is no minimum fee or usage requirement. You are charged based on three dimentions: instance hours, which are the number of hours an intance is available to you for use; the amount of storage you need; and data transferred in and out of Amazon OpenSearch Service. Storage pricing depends on xthe storage tier and type of instance you choose.instance instead of intanceand the instead of xtheThanks,DuoFollowComment"

Answer: "1Accepted AnswerHi THereThank you for reporting this, there is actually a third type "dimentions".  I have forwarded to the relevant team to take a look at.CommentShareEXPERTMatt-Banswered 6 months ago"


Question: Bug: Amazon Chime in germany with arabic as language

"If chime app is downloaded in germany on an android phone with the language set to arabic, the app will give an error report in arabic and won't start. When set to german and after a restart the app will open.FollowComment"


Question: Pinpoint Journey - Send through Lambda

"Hi,When creating a journey and sending messages through a Lambda ("Send through a custom channel -> Execute a Lambda function"), I can't seem to find a way to customise the payload that the Lambda is supplied on a per-event basis.As an example, I would like to:Start a journey with a segmentExecute a Lambda and tell it to send Content A to customers in the segmentWait for a period of timeExecute the same Lambda and tell it to send Content B to customers in the segmentI would like to create a single Lambda but ask it to send different content at different points in a single journey.Is there any way to do this?Thanks,Geoff.FollowComment"

Answer: "0Hi!I'm having exactly the same issue - what i found out so far is the fact that according to the documentation, you can actually set MessageConfig.Data to contain arbitrary payload. Example:aws pinpoint list-journeys --application-id <YOUR_APPLICATION_ID>{    "JourneysResponse": {        "Item": [            {                "Activities": {                    "8OoZiq9qB9": {                        "CUSTOM": {                            "DeliveryUri": "arn:aws:lambda:eu-central-1:<YOUR_ACCOUNT_ID>:function:pinpoint-dev-somelambda",                            "EndpointTypes": [                                "CUSTOM"                            ]                        },                        "Description": "Hello"                    },                    "O56tkxsxLV": {                        "Holdout": {                            "NextActivity": "8OoZiq9qB9",                            "Percentage": 99                        }                    }                },                "ApplicationId": "<YOUR_APPLICATION_ID>",                "CreationDate": "2020-07-21T16:56:26.983Z",                "Id": "0d1a6e240e984396a0b84abf154edc3f",                "LastModifiedDate": "2020-07-21T17:02:19.832Z",                "LocalTime": false,                "Name": "LeJourney",                "Schedule": {                    "Timezone": "UTC"                },                "StartActivity": "O56tkxsxLV",                "StartCondition": {                    "Description": "Entry",                    "SegmentStartCondition": {                        "SegmentId": "6f247c535dd042dfbf3af706fabeeee7"                    }                },                "State": "DRAFT"            }        ]    }}The above is the output produced when creating a simple journey via UI.Now, if you create an appropriate update-journey request:(File: journey.json){    "ApplicationId": "<YOUR_APPLICATION_ID>",    "JourneyId": "0d1a6e240e984396a0b84abf154edc3f",    "WriteJourneyRequest": {        "Activities": {            "8OoZiq9qB9": {                "CUSTOM": {                    "DeliveryUri": "arn:aws:lambda:eu-central-1:<YOUR_APPLICATION_ID>:function:pinpoint-dev-somelambda",                    "EndpointTypes": [                        "CUSTOM"                    ],                    "MessageConfig": {                        "Data": "{\"foo\":\"bar\"}"                    }                }            }        },        "Name": "LeJourney2",        "State": "DRAFT",        "StartActivity": "8OoZiq9qB9",        "StartCondition": {            "Description": "Entry",            "SegmentStartCondition": {                "SegmentId": "6f247c535dd042dfbf3af706fabeeee7"            }        }    }}aws pinpoint update-journey --cli-input-json file://journey.jsonIt will update your journey accordingly - BUT: the next time the journey is loaded via UI, your MessageConfig is GONE. So it's pretty wonky to use - unless AWS supports setting this via UI (or at least doesn't throw it away), it's pretty much of no use at all, i'm afraid.Best regards,Marian Saegermarian@roadcrew.ioCommentShareMarianSaegeranswered 3 years ago0That's a real shame. Pinpoint Journeys seem like they could be useful on the surface, but there's just too much low-level do-it-yourself needed to make it work.Thank you for your reply!CommentSharegviljoenanswered 3 years ago"


Question: how to log error/messages in while running a sagemaker batch transform job?

"i'm using a hugging face model and a container to create a batch transform job in sagemaker. i have a custom inference code and in the output_fn function i'm returning json_dumps(prediction). I'm using print(prediction) to see, if i can see it in the cloudwatch logs to find out type and what prediction is. how can  log these messages . Also, the inference output i get is in the form below., i'm not sure why is it not a json object in each line instead it has square brackets. I want to use the filter to match the input and output in the batch job. I'm not sure how the output should look like , because i'm trying to associate input with output by using dataprocessing config as below. but i get an error. the documenation has example of csv not json. what should the output look like so that i can associate the input with output when they both are in json format.  "DataProcessing": {        "JoinSource": "Input"    },[ output text 1 ][output text 2 ]# Serialize the prediction result into the desired response content typedef output_fn(prediction, accept=JSON_CONTENT_TYPE):    logger.info("Serializing the generated output.")    if accept == JSON_CONTENT_TYPE:        output = json.dumps(prediction)        return output, accept    raise Exception("Requested unsupported ContentType in Accept: {}".format(accept))FollowCommentMarc a year agoHave you taken a look at this StackOverflow question: https://stackoverflow.com/questions/60421123/aws-sagemaker-batch-transform-with-json-input-filterShare"


Question: Dynamo scan not finding records of time in unix.

"Below are the params:let params = {    TableName: SESSIONTABLE,    ProjectionExpression:         "practitioner_full_name, appointment, utc_offset, start_time, start_time_unix, attendees, practitioner_email, id, practitioner_id, no_video_link, title, practitioner_title, service_text",    FilterExpression:        "(start_time_unix between :currentTime and :unixTimeAfteramin)",    ExpressionAttributeValues: {        ":currentTime": 1660297747000,        ":unixTimeAfteramin" : 1660297807000,    },    };This is the value of start_time_unix column - 1660297800000The value of start_time_unix lies well within currentTime and unixTimeAfteramin column values.Not sure what's wrong with dynamodb here. I tried the three values in python shell as well, it works good there.Python 3.8.10 (default, Jun 22 2022, 20:18:18) [GCC 9.4.0] on linuxType "help", "copyright", "credits" or "license" for more information.>>> 1660297747000 < 1660297800000 < 1660297807000True>>> FollowComment"

Answer: "1Accepted AnswerHow much data is in your table? When you execute a Scan request, it will return only the first 1MB of data (described here) and if none of those items match the FilterExpression then you will be returned an empty response.In order to scan the entire table, you will need to implement pagination so that you can request the next 1MB worth of data. Described here. You can also see examples of this in out GitHub Repo in various languages.The AWS CLI paginates by default, you can try run your request there which will allow you to quickly understand if that is the issue.CommentShareEXPERTLeeroy Hannigananswered 10 months ago"


Question: Trigger a lambda function based on thing type

"How do you i trigger a lambda function based on a thing type? For example add a rule whenever a device shadow was updated. My use case is, having two cloudformation stacks for dev and staging.All lambda functions are tagged specifically per stack. (Eg shadow-update-dev, shadow-update-staging). I'm thinking to add a attribute or type for a thing, and create an IOT rule to trigger what tag function it should trigger.Should i just create a placeholder lambda that checks the thing type and trigger whats the corresponding lambda function? Is a step function a good match for this?FollowComment"

Answer: "0Hi janpoltan,Today, the rules engine cannot fetch thing type, thing group, or registry attributes for a thing when processing a message. You could write a Lambda function to fetch these kinds of metadata and evaluate that at runtime with the aws_lambda() function: https://docs.aws.amazon.com/iot/latest/developerguide/iot-sql-functions.html#iot-func-aws-lambdaThe other way to achieve that is as you describe, with a Step Functions solution.A third way to achieve this, if it makes sense for your solution, is to store the thing type in the device shadow. The shadow can be referenced by the rules engine at runtime today. The main concern is whether this leaks inappropriate control plane info to your data plane, or whether there is risk of your device or other actors accidentally clearing this type from the shadow.RyanCommentShareRyan_Banswered 4 years ago0Ive tried using the aws_lambdahttps://docs.aws.amazon.com/iot/latest/developerguide/iot-sql-functions.html#iot-func-aws-lambdaIt looks like the sql dont support passing topic vars?SELECT topic(3) as id, aws_lambda("arn:aws:lambda:eu-west-1:xxxx:function:xxxx", {"payload": id}) as deviceEnv FROM 'device/test'orSELECT aws_lambda("arn:aws:lambda:eu-west-1:xxxx:function:xxxx", {"payload": topic(3)}) as deviceEnv FROM 'device/test'CommentSharejanpoltananswered 4 years ago0I'm a little surprised the second approach didn't work. If the topic() function is not evaluated first before sending the value to Lambda, you can write this in a nested way to work around:SELECT aws_lambda("arn:aws:lambda:eu-west-1:xxxx:function:xxxx", {"payload": topic}) as deviceEnv FROM (SELECT *, topic(3) as topic FROM 'device/test')Admittedly I did not test the above SQL, but this is how I've solved past similar issues where values needed be generated and bubbled up to a secondary query.HTH,RyanCommentShareRyan_Banswered 4 years ago0Actually the second option worked. My mistake not updating the topic filter todevice/test/+SELECT * FROM 'device/test/+' WHERE (SELECT aws_lambda("arn:aws:lambda:region:accountId:function:functionName", {"deviceId": topic(3)}).env as env FROM 'device/test/+') = "dev"The where clause doesnt seem to workEdited by: janpoltan on Apr 3, 2019 1:44 AMCommentSharejanpoltananswered 4 years ago0It seems it wont workCommentSharejanpoltananswered 4 years ago0Moved to other postCommentSharejanpoltananswered 4 years ago"


Question: what is the replacement function in athena for add_months ?

"We are migrating hue query into athena. Currently we are facing issue in finding replacement for add_months function. Can you suggest here ? Basically, how to add/minus the number of months in athena, this should solve our issue. Please help, thank youI have tried the below things but these functions are not working in athenaselect dateadd(month, 3, CAST(format_datetime(date_parse(cast(20220331 as VARCHAR),'%Y%m%d'),'yyyy-MM-dd') AS VARCHAR));select date_add('month', 3, CAST(format_datetime(date_parse(cast(20220331 as VARCHAR),'%Y%m%d'),'yyyy-MM-dd') AS VARCHAR));select date_add('month', 3, CAST(format_datetime(date_parse(cast(20220331 as VARCHAR),'%Y%m%d'),'yyyy-MM-dd') AS VARCHAR));SELECT DATE_ADD('day', 10, '2020-06-15') FollowComment"

Answer: "0I am able to achieve this using date_add function , thank youCommentShareAWS-User-Jameanswered 10 months ago"


Question: Network Setup - 2 on-prem locations 1 AWS region

"Hi,I would like to know what would be the best possible option in terms of complexity and cost for the scenario below that we are trying to implement for a client.Customer A has all web apps deployed on-prem and has clients that come through a co-located VPN based network(say ClientNet network) to access those apps. Now all these apps will be deployed in AWS regions(Prod and Non-prod vpc-s) so in essence Customer A will now be on AWS and all these clients will need to access these apps on AWS via this ClientNet network. At the same time, there will be some to and from communication between AWS VPC-s and Customer A's network for stuff that will still be hosted on-prem like Active Directory and other COTS.Can this be achieved without creating 2 separate Direct Connects or 2 separate VPN-s?By 2 separate DC-s I mean - one DC between ClientNet and AWS and one DC between Cutomer A one-prem and AWS and the same applies for VPN if we were to replace DC with VPN.Can TGW be used to consolidate this one just one connection whether its DC or VPN that can assessed later based on requirements for security and bandwidth?FollowComment"

Answer: "1Hello,It is probably best if you discuss this with your account's Solutions Architect but here are some general guidelines:If you are worried about time to market and need to setup connectivity quickly then VPN would be easy and quick way to setup connectivity to AWSNote that IPSEC VPN over the internet is a best effort solution - meaning there is no SLA and it is prone to issuesIf you want predictable latency and reliable path to AWS with SLA, Monitoring etc then DirectConnect (DX) is the answerYou could also have DX as Primary and VPN is Secondary/Failover path for high availabilityWith AWS managed VPN there is a bandwidth limitation of 1.25 Gbps, if you terminate it on a VirtualPrivateGateway (VGW) if you do decide to use TransitGateway you can use ECMP and bundle Multiple VPN Tunnels to get more aggregate bandwidthIf you are looking for a scalable solution then TransitGateway is the answer, you can setup Hub and Spoke connectivity to multiple VPCs - TGW is a regional construct but you can do Inter as well as Intra-region TGW Peering and consolidate all connectivity within AWS regions.You mentioned 1 Region in the subject but in future if you do expand to multi-region architecture you can then think of DX + DXGW +TGW architecture, DirectConnect Gateway is a global construct and can give you connectivity to upto 3 TGWs in 3 different regions.Answer to your main question:Can TGW be used to consolidate this one just one connection whether its DirectConnect or VPN that can assessed later based on requirements for security and bandwidth?Yes, you can use TransitGateway to consolidate all the connectivity from your on-premises to AWS:It supports Site-to-site VPN (Over the internet or Over DX Public VIF)Connectivity via DX using Transit VIFProvides inter or intra region connectivitySD-WAN connectivity options using Connect attachmentLastly, I recommend going through the AWS Hybrid Connectivity Whitepaper which has several reference Connectivity models described:https://docs.aws.amazon.com/whitepapers/latest/hybrid-connectivity/aws-dx-dxgw-with-vgw-multi-regions-and-aws-public-peering.htmlHope this helps.CommentShareEXPERTTushar_Janswered a year agoEXPERTToni_Sreviewed a year ago"


Question: using lightsail DNS to host static wbesite on S3

I know S3 can be used for static hosting. I have a domain and dns zone in lightsail. How do I point my domain to the S3 bucket? I don't want to move the dns zone to Rout53 because lightsail DNS is free. Is this possible?FollowComment

Answer: "1Accepted AnswerHi Yoel,You can configure the S3 static website hosting using your own customer domain with LightSail DNS, the process is very similar to when using R53, you just need to follow the below steps:Lets say you have a domain named: example.comCreate an S3 bucket with a subdomain, e.g "www.example.com" - for the apex you will need to use R53 Alias records.On the S3 console, go to the bucket, Properties, "Static website hosting", edit.Select "Enable", input your index document and Save.Scroll down and take note of the S3 static website endpoint (without the bucket name), should be something like "s3-website-{region).amazonaws.com"  - more details on the endpoint per region on the linkUnder LightSail, select "Domains & DNS", select your domain zone and under "DNS records" add a new record.Record type: CNAMERecord name: www  (so it becomes www.example.com)Route traffic to: Input your static website endpoint, e.g "s3-website-eu-west-1.amazonaws.com" for a bucket in Ireland, Save.Your should have something like:Having done the above and once you have a bucket policy that allows public Read (s3:GetObject) from your bucket, you can now use your custom domain to access your website hosted on S3.Note: S3 static websites are only available through HTTP, if you would like to use HTTPS, use Amazon CloudFront to serve a static website hosted on Amazon S3 as explained on the link.CommentShareHugo-AWSanswered 4 months ago"


Question: Configure consumer_timeout for RabbitMQ

"Hello,Do you know if there is a way to configure the consumer_timeout (delivery acknowledgment) parameter of RabbitMQ in AmazonMQ?https://www.rabbitmq.com/consumers.html#acknowledgement-timeoutOur instances got automatically upgraded and we now have timeout errors for our tasks with long ETAs.Thank you very much for your help!FollowCommentrePost-User-0203227 7 months agoWe need to be able to configure this parameter as well.Share"

Answer: "2Hi there,Kindly note that we currently support the configuration of the consumer_timeout on Amazon MQ for RabbitMQ brokers. You may open a support case to Amazon MQ support and request for your broker to be configured with the desired consumer_timeout.CommentShareSUPPORT ENGINEEREthan AWSanswered a year agoNorbert a year ago@Ethan, any update on when this will be possible though the AWS API?Sharedevops_dude 4 months agoAny update on when the end user will be able to manage this setting?Share1Please note this is supported by opening a support case and sending a ticket to our team.  In future we plan to add self-configuration.CommentShareTrevor_Danswered 7 months agoZeus Arias 5 months agoDo you have any estimate of when the rabbitmq.conf configuration will be available?We are getting "Broken pipe" messages and we are planning to configure heartbeat at server level, in any case, how can we see the default configuration of RabbitMQ in AWS?Share0Thank you for your reponse.The ability to tweak this parameter will be indeed great. We're going to rollback to 3.8.11 however we have to spin up a new instance and will lose our current queues, which is less than ideal.CommentSharemartifactanswered 2 years ago0Hello,We have recently moved to AmazonMQ and after moving we found the same issue of our jobs timing out. Is there an ETA on this feature?Thanks.CommentShareumakanswered 2 years ago0Hello, my team finds itself with the same issue, we are looking forward to start amazonMQ but we need to be able to set those values to our needs, ETA for making those available for user change?Also, when having AWS basic accounts how do we ask for those values to be change and how long might that take?CommentSharekairanswered 10 months ago0Hi, same thing here. Any updates on the work to have the capability to change rabbitmq.conf, or maybe at least consumer_timeout? Thank you.CommentSharekenanswered 9 months ago"


Question: Contact nat settings

"HelloI'm inquiring about NAT.Currently, I want to set it as IGW through NAT and communicate with ec2 on the Internet, what should I do?FollowCommentAWS-User-0357409 3 months agoHi, thanks for the question.  Can you provide more context on what you are trying to accomplish?Is this only outbound traffic from EC2 to the internet?  ie: EC2 communicating out to the internet for updates, etc.Is this inbound from the internet?  Meaning are you trying to expose EC2 instances publicly so people can reach them?  Like hosting a website.Are you looking for only management access to EC2 instances over the internet?  So they wouldn't be publicly accessible, but you would need to SSH to them for management access.Let us know.  Thanks!Share"

Answer: "0Hello, you can follow this procedure to create your NAT Gateway. And you will have to modify the route tables of your subnets, see here.CommentShareVincentanswered 3 months agoEXPERTkentradreviewed 3 months ago"


Question: unable to create cost and usage report using rest api

"Hi ,I am trying to create cur reports using rest api . but i am getting below errorRequest failed with status HTTP 400 - https://cur.us-east-1.amazonaws.comError response - {"__type":"UnknownOperationException"}I tried DescribeReportDefinitions too , but ended up the same error.header :'{"Content-Type":"application/x-amz-json-1.1", "X-Amz-Target":"AWSOrigamiServiceGateway.PutReportDefinition"}'body :'{"ReportDefinition": {"ReportName": "ExampleReport","TimeUnit": "DAILY","Format": "textORcsv","Compression": "ZIP","AdditionalSchemaElements": ["RESOURCES"],"S3Bucket": "example-s3-bucket","S3Prefix": "exampleprefix","S3Region": "us-east-1","AdditionalArtifacts": ["REDSHIFT","QUICKSIGHT"]}}'can you please suggest where i am going wrong. Thanks!FollowCommentJonathan_D EXPERT5 months agoCan you please share the full command line / script you use?Share"

Answer: "0As shown in the image X-Amz-Target: AWSOrigamiServiceGateway.PutReportDefinition , but actual target isX-Amz-Target:AWSOrigamiServiceGatewayService.PutReportDefinition. CommentSharerePost-User-5676470answered 5 months agoJonathan_D EXPERT5 months agoI have submitted a request to get this reviewed and corrected. thanks! IN the meantime sharing this link if someone struggles to find x-amz-target for a given service name: https://repost.aws/questions/QUbRw_C7KISoOrFN5ShYNuFQ/http-resolver-x-amz-targetShare0Hi Jonathan,thanks for your reply. I got the issue . Seems like the target mentioned in the documentation is wrong , got the proper target from cli commands using debug.CommentSharerePost-User-5676470answered 5 months ago0Glad to hear! thanks for letting us know.Do you have more information on what is wrong in the documentation? You can always use the "Provide feedback" link at the bottom of the AWS documentation page if you find an issue.CommentShareEXPERTJonathan_Danswered 5 months ago"


Question: How to use `initial-value` parameter of Named Entity Recognition project in Ground Truth?

"In my NER Ground Truth labeling job, I want give human workers a head start by applying a regular expression or other NER model to the text. When the text is shown to the human worker, I want the text spans that matched the RE/model result to already be highlighted with the found entity. Then, the human can accept the result or modify it.It looks like Ground Truth's crowd-entity-annotation  template already provides a way to do this. The documentation says the template accepts an 'initial-value' attribute, which looks like exactly what I want. I have not been successful in using it though.I tried adding an 'initial-value' array to the input manifest file of my project, but it didn't make a difference.I found this example project using A2I that creates a custom template for displaying a model's annotations to the worker. However, when I followed this example, it only shows the model annotations in a separate textbox versus having them pre-highlighted.I modified the custom UI template from that project to explicitly set initial-value to a task.input.initial-value field, but that also didn't work.This would be a huge speed boost if I could get it to work. What is the correct way to set and display the initial values in an NER project? Is there a working example I can look at?FollowComment"

Answer:
"1Hello,I understand that you are trying to use the ‘initial-value’ parameter of Named Entity Recognition project in Ground Truth andIn this context i would like to tell you that the ‘initial-value’ array which you were trying to add in the manifest file needs to be added in the HTML UI file that you have created for the human workers to label the tasks.Below is the code that i tried replicating at my end and when i added the ‘initial-value’ array inside the  <crowd-entity-annotation> script it worked.<crowd-entity-annotation  name="crowd-entity-annotation"  header="Highlight parts of the text below"  labels="[{'label': 'person', 'shortDisplayName': 'per', 'fullDisplayName': 'Person'}, {'label': 'date', 'shortDisplayName': 'dat', 'fullDisplayName': 'Date'}, {'label': 'company', 'shortDisplayName': 'com', 'fullDisplayName': 'Company'}]"  text="Amazon SageMaker Ground Truth helps you build highly accurate training datasets for machine learning quickly."  initial-value="[    {        label: 'person',        startOffset: 0,        endOffset: 16    }  ]">  <full-instructions header="Named entity recognition instructions">

Read the text carefully.

Highlight words, phrases, or sections of the text.

Choose the label that best matches what you have highlighted.

To change a label, choose highlighted text and select a new label.

To remove a label from highlighted text, choose the X next to the abbreviated label name on the highlighted text.

You can select all of a previously highlighted text, but not a portion of it.

  </full-instructions>  <short-instructions>    Apply labels to words or phrases.  </short-instructions>

        What is the overall subject of this text?
      <crowd-radio-group>        <crowd-radio-button name="tech" value="tech">Technology</crowd-radio-button>        <crowd-radio-button name="politics" value="politics">Politics</crowd-radio-button>      </crowd-radio-group>
</crowd-entity-annotation>Using the above code, I was able to view the highlighted initial-value that we provided to the human workers as a head start by applying an ‘initial-value’ label so that they could either accept or modify it :Below is the output after running the above code:If you have any difficulty in verifying any of the above mentioned points or if you still run into issue, Please reach out to AWS Support[+] (Sagemaker), along with your issue/use case in details and we would be happy to assist you further.[+] Creating support cases and case management - https://docs.aws.amazon.com/awssupport/latest/user/case-management.html#creating-a-support-casehttps://docs.aws.amazon.com/awssupport/latest/user/case-management.html#creating-a-support-caseCommentSharerePost_user_sganswered 2 months ago"


Question: Failed to create a table redshift spectrum - Syntax Error

"I have a query at  https://pastebin.com/k8beGWkMI apologize for not warping above query in code block because formating errors keeping making fieldnames disappear.Somehow the query above gives meERROR:  syntax error at or near ":"LINE 4:             "node": struct<Change from "node" to node still gives me the errorAny help is appreciated!Edited by: jotarokuro on Jun 20, 2019 5:54 AMEdited by: jotarokuro on Jun 20, 2019 5:56 AMEdited by: jotarokuro on Jun 20, 2019 5:58 AMFollowComment"

Answer: 0The solution is  relatively simple. I have documented it here  https://stackoverflow.com/questions/56690208/redshift-spectrum-gives-syntax-error-on-creating-nested-data/56691510CommentSharejotarokuroanswered 4 years ago


Question: Accessing DynamoDb data from Sagemaker

I have some data in my DynamoDb database and I want to access it in my Sagemaker notebook. To my surprise having done some research it looks like I need to transfer the data from DynamoDb into an S3 bucket and access the data from a csv file in there. Is that correct? What is the best way of doing this?FollowComment

Answer: "1You can access the data in your SageMaker Notebook by reading it using the boto3 client. Initialize a DynamoDB Client and do a Scan which will return all the data that you require.Note that this will be in JSON format and you would need to convert that to a format which is useful for the rest of your notebook, such as converting to a pandas dataframe.https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/dynamodb.htmlCommentShareEXPERTLeeroy Hannigananswered a month ago0Hey so in short, that is correct and you will have to export your DynamoDB table to S3.Here is a guide on how to do that: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/S3DataExport.HowItWorks.html(Note: DynamoDB can export your table data in two formats: DynamoDB JSON and Amazon Ion)Another way to approach this is by directly exporting your DynamoDB table into a .csv then uploading that file to S3:https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/workbench.querybuilder.exportcsv.htmlYou can also use AWS Glue to transfer your table from DynamoDB to S3 (Although Glue can be a bit of a learning curve), the documentation should give you the tools you need:https://docs.aws.amazon.com/glue/latest/dg/how-it-works.htmlSagemaker Data Wrangler is also able to import data from many sources other than S3, although DynamoDB is not supported yet. You can check out support data sources for Data Wrangler here:https://docs.aws.amazon.com/sagemaker/latest/dg/data-wrangler.htmlHope this helps, and please let me know if you require anything else!CommentSharemtahsinanswered a month ago0Hello there,Yes, there is no direct connection between Dynomodb and Sagemaker. You should export data to S3 then read it from Sakemaker or you can use glue or EMR to create connection between them.You can check the following documentation:https://aws.amazon.com/blogs/big-data/analyze-data-in-amazon-dynamodb-using-amazon-sagemaker-for-real-time-prediction/CommentSharefiratmelihyilmazanswered a month ago"


Question: Unable to open more than ~50k connections between two EC2 instances in the same VPC

"I have two linux instances in my custom VPC, and I'm trying to test to see how many concurrent TCP connections I can get between them. One is in a public subnet with an elastic IP, and one is in a private subnet and only has a private IP.Connections between these two servers work normally.  I am using a tool that sets up one instance as a simple server, and the other as a client.  The client will continually make TCP connections to the server and hold them open.  After about 51k connections have been made, the client stops connecting.  After a few minutes, I get "connection timed out" and the client dies.I've raised the file descriptor limit on both servers and verified that ulimit -a shows the increased number.  I have checked for ephemeral port exhaustion and see no evidence of that (the tool uses multiple ports for the server to listen on so it should easily be able to get more than 51k connections.)When I run the client externally (outside of AWS on a linode droplet) I can get up to about 250k simultaneously connections to my private ec2 instance.  Whatever is causing the issue doesn't seem to apply to traffic inbound from the internet. However, going the other way (from the public ec2 instance to the external server) I again hit the 51k limit.I'm tearing my hair out trying to figure this out.  Anybody have any ideas?FollowComment"

Answer: "1There are two things to check here:First, ephemeral port numbers are a 16-bit number which means that (all other things aside) you can open a maximum of 65,536 TCP connections from A to B if you are using the same destination port on B (say, port 80). You can open a lot more than that (kernel limits permitting) if you are using different destination ports.I'm guessing from your comment about 250k connections that you are using different source and destination port numbers - but I'm a little confused about how you are reaching a private EC2 instance from an external source.Second: It sounds like you're using NAT Gateway - and my guess is that your routing within the VPC between the two private instances is also (somehow) using NAT Gateway - but it probably shouldn't. NAT Gateways support up to 55,000 connections to each unique destination - it's called out in our documentation - and that number is suspiciously close to your 51k number you're hitting. So it's worthwhile checking that out.CommentShareEXPERTBrettski-AWSanswered 8 months agodjp928 8 months agoThe test program I'm using opens connections to multiple ports (about 100 different ports) on the server.  I've done tests to see the number of ephemeral ports in use and it never gets about about 510 per (src ip, src port, dest ip, dest port) combo. Plus I never get any errors in logs about ephemeral port exhaustion so I'm pretty sure it's not that.I thought the NAT gateway might be the issue as well, but I can't see any traffic being dropped by the NAT gateway in the flow logs.As for the inbound connections, I'm not testing those against the private server.  I test those using the public instance as the "server".  So I just open the pots and use the elastic IP to access to instance.  I've also tried going the other way between the ec2 instances (using the public instance as the server and the private one as the client) and I have the same problem.ShareBrettski-AWS EXPERT8 months agoFlow Logs won't show the traffic being dropped by NAT Gateway so that might still be happening.Share"


Question: S3 Lifecycle - Exclude Prefix

"If I have a prefix Folder-1 which has a rule to keep contents live for 6 months and beyond 6 months to move the contents to Glacier. I would like to exclude Folder-1.1 and Folder-1.2 from this policy and have the data retained for 2 years. So, if I create an explicit rule on Folder-1/Folder-1.1 and Folder-1/Folder-1.2 to retain anything for 2 years, will the Glacier rule apply to all the rest of the folders except Folder-1.1 and Folder-1.2?Prefix structure is as follows:Folder-1/    |-- Folder-1.1    |-- Folder-1.2    |-- Folder-1.3    |-- Folder-1.4I don’t think S3 supports exclude rules currently in the Lifecycle management. Any recommendations on how this can be achieved?FollowComment"

Answer: "0Accepted AnswerS3 is a key-value object storage service, there is no concept of ‘folder’ but 'prefix', for lifecycle rule if a rule is applied on a shorter prefix, it will take effect on the whole sub prefixes' objects, including 1.1 and 1.2. So yes applying the 1/  'folder' will make 'folder' 1.1 and 1.2 being treated as the same as 1.3 and 1.4.You can use object tag as the filter instead of prefix e.g creating a tag on all the objects with prefix 1/1.3 1/1.4 and use a single rule, or only applying lifecycle rules on 1/1.3 and 1/1.4.CommentShareAWS-User-7452253answered 3 years ago0Is it possible to create the tag only for objects that should be excluded from file movement rules?For example:- folderA---folder1------- file1------- file2---folder2------- file3------- file4If I want to exclude folder 1, I create the tag only on folder 1.Can I use this approach? Or it is mandatory create a tag for each folders?ThanksCommentShareluk3tt0answered 5 months ago"


Question: AWS not responding within 24 hours on System impaired

"Hi everyone, Has anyone had experience with AWS not responding within 24 hours on System impaired case ? Do you have suggestions on what to do in such a case? In case the AWS team sees this question, the number of my case is XXXXXXXXXX. Please help.*Edit: Removed case ID -Elle G.FollowComment"

Answer: "0You haven't mentioned what support plan you're under or what response method you selected.  The advice we've had from our Technical Account Manager is to always raise cases with Chat or Phone response selected, not Web.  This will get higher priority and faster response.  It's particularly effective with Enterprise Support where you're on a higher-priority queue.CommentShareEXPERTskinsmananswered 2 months ago"


Question: Connection Stalled while putting multiple file say more than 4 files at a time to an S3 bucket but the same is working fine with EC2.

"Hi ,we have a mirroring setup ( get and put the file between two server by comparing on the either side wherever missing) by using the perl module .With Traditional Unix/linux server it is working good but when we try to use S3 for same file transfers it didn't worked at all. After multiple search got to know the below Change we have to do to make it work .my $sftp = Net::SFTP::Foreign->new('user@s-12345.server.transfer.us-east-2.amazonaws.com', queue_size => 1);we have added the above queue_size parameter in our code but it is working for very few files not more than 4 . If we try to put more files the connection starts stalling, the exact error is "Connection to remote server stalled" .when we are using the EC2 username and URl for file transfer it is working fine with any number of files like as we are doing with Linux/unix Datacenter based server.I want to know why S3 is not working properly . what is the difference between S3 and AWS .we have Network Packet capture done but no issue found as no packet loss was there .please help.FollowComment"

Answer: "0Testing with FileZilla as SFTP client connecting to AWS Transfer Family SFTP server I was able to transfer 10 files simultaneously, each file was 100mb in size. Can you please try testing with a different client and check if you observe the same behavior ?CommentShareabharaswanswered 5 months ago"


Question: AmplifyProvider generate a huge amount of warnings on import

"I am getting a huge amount of warnings when I import AmplifyProvider.WARNING in ./node_modules/@aws-amplify/ui/dist/esm/types/authenticator/user.jsModule Warning (from ./node_modules/source-map-loader/dist/cjs.js):Failed to parse source map from 'D:\reactjs\amplify-work\node_modules\@aws-amplify\src\types\authenticator\user.ts' file: Error: ENOENT: no such file or directory, open 'D:\reactjs\amplify-work\node_modules\@aws-amplify\src\types\authenticator\user.ts' @ ./node_modules/@aws-amplify/ui/dist/esm/index.js 14:0-95 14:0-95 14:0-95 @ ./node_modules/@aws-amplify/ui-react/dist/esm/index.js 8:0-74 8:0-74 8:0-74 8:0-74 @ ./src/index.js 10:0-56WARNING in ./node_modules/@aws-amplify/ui/dist/esm/validators/index.jsModule Warning (from ./node_modules/source-map-loader/dist/cjs.js):Failed to parse source map from 'D:\reactjs\amplify-work\node_modules\@aws-amplify\src\validators\index.ts' file: Error: ENOENT: no such file or directory, open 'D:\reactjs\amplify-work\node_modules\@aws-amplify\src\validators\index.ts' @ ./node_modules/@aws-amplify/ui/dist/esm/machines/authenticator/actors/signIn.js 8:0-66 528:23-24 @ ./node_modules/@aws-amplify/ui/dist/esm/machines/authenticator/index.js 4:0-54 275:18-19 @ ./node_modules/@aws-amplify/ui/dist/esm/index.js 12:0-79 12:0-79 @ ./node_modules/@aws-amplify/ui-react/dist/esm/index.js 8:0-74 8:0-74 8:0-74 8:0-74 @ ./src/index.js 10:0-56WARNING in src\index.js  Line 5:8:   'Amplify' is defined but never used          no-unused-vars  Line 7:10:  'AmplifyProvider' is defined but never used  no-unused-vars1548 warnings have detailed information that is not shown.Use 'stats.errorDetails: true' resp. '--stats-error-details' to show it.webpack 5.71.0 compiled with 1549 warnings in 513 ms===============================================Create standard: create-react-appImport: npm i @aws-amplify/ui-react aws-amplifyFile index.jsimport React from "react";import ReactDOM from "react-dom";import "./index.css";import App from "./App";import Amplify from "aws-amplify";import "@aws-amplify/ui-react/styles.css";import { AmplifyProvider } from "@aws-amplify/ui-react";ReactDOM.render(  <React.StrictMode>    <App />  </React.StrictMode>,  document.getElementById("root"));File App.jsimport "./App.css";function App() {  return (

Hello world

  );}export default App;package.json{  "name": "amplify-work",  "version": "0.1.0",  "private": true,  "dependencies": {    "@aws-amplify/ui-react": "^2.13.0",    "@testing-library/jest-dom": "^5.16.3",    "@testing-library/react": "^12.1.4",    "@testing-library/user-event": "^13.5.0",    "aws-amplify": "^4.3.18",    "react": "^18.0.0",    "react-dom": "^18.0.0",    "react-scripts": "5.0.0",    "web-vitals": "^2.1.4"  },  "scripts": {    "start": "react-scripts start",    "build": "react-scripts build",    "test": "react-scripts test",    "eject": "react-scripts eject"  },  "eslintConfig": {    "extends": [      "react-app",      "react-app/jest"    ]  },  "browserslist": {    "production": [      ">0.2%",      "not dead",      "not op_mini all"    ],    "development": [      "last 1 chrome version",      "last 1 firefox version",      "last 1 safari version"    ]  }}FollowComment"

Answer: "0OK, I found out what is the problem. I must install typescript with CRA.Please consider issue solved.CommentShareAWS-User-2035787answered a year ago"


Question: Mapped Network Drives in WorkSpaces

Do we have any Powershell scripts we can use as a template to help customer  map network drives?They want to remain consistent with their mapped drives across  Desktops and WorkSpaces.The long term solution is of course to use WorkDocs.FollowComment

Answer: "0Accepted AnswerAny particular reason for PowerShell?  They can definitely map network drives by way of GPO.  Beyond that, if they really wanted to mount, they could also use the "net use" syntax (e.g. net use z: \sharedmachine\sharedvol).CommentShareAWS-User-2022376answered 8 years ago"


Question: How to automate updating of Quicksight Dashboard

I have a Quicksight Analysis that needs to be published as a Dashboard. The analysis is changing based on demands and I need to update and replace the contents of the existing dashboard. The only way that I know is to click the update and replace existing dashboard through the ui. Is there a way to automate this process?Edit:Follow up question. Ultimately what I wanted to do is to have the dashboard be refreshed alongside the refresh of the analysis (containing the refreshed dataset) without having to always run commands or click 'publish dashboard' in the ui. I'm looking for a way to trigger and automate that part. Thank you for your answers!FollowComment

Answer: "0Hi.You probably can't do it on the QuickSight console.Alternatively, embed the dashboard or view into an external website.The external website uses an iframe to display the QuickSight view.And on your external site you can write custom code in JavaScript to refresh the iframe every few seconds.CommentShareEXPERTiwasaanswered 3 months agorePost-User-8583808 3 months agoThank you for your answer but... Yes, i actually have a website that embeds the quicksight dashboard. However, afaik, it only embeds the Quicksight Dashboard, not the 'Analysis'. And to refresh the data in my embedded dashboard, i need to publish my analysis and replace the existing one so that the same Dashboard ID is pointed to the website. I understand that alternatively, I can run commands on the Quicksight API instead of doing it in the Quicksight console. However, it does not satisfy the automation that I want as it still demands me to run commands whenever a fresh Quicksight Analysis needs to be published as a Dashboard. Do you have an idea how i can automate that part?Shareiwasa EXPERT3 months agoi was wrong So the analysis settings and configuration are updated, not the dataset. That's difficult.Share0You could achieve this updating analysis template and dashboard by using QuickSight APIs or CLI. Please refer this blog which contain references to some of these commands.I see it to be a 3-step processOnce you have made the necessary changes to the analysis via UI - update the templateUse the latest template version id and update the dashboardPublish the dashboard using the latest dashboard idaws quicksight update-template --cli-input-json file://./template-analysis.json{    "Status": 202,    "TemplateId": "DemoDashboardTemplate",    "Arn": "arn:aws:quicksight:us-east-1:XXXXXXXXXXXX:template/DemoDashboardTemplate",    "VersionArn": "arn:aws:quicksight:us-east-1:XXXXXXXXXXXX::template/DemoDashboardTemplate/version/2",    "CreationStatus": "CREATION_IN_PROGRESS",    "RequestId": "0ddc99c5-72a2-400b-8222-5a17e78d117e"}aws quicksight update-dashboard --cli-input-json file://./update-dashboard.json{    "Arn": "arn:aws:quicksight:us-east-1:XXXXXXXXXXXX:dashboard/DemoDashboard1",    "VersionArn": "arn:aws:quicksight:us-east-1:XXXXXXXXXXXX:dashboard/DemoDashboard1/version/2",    "DashboardId": "DemoDashboard1",    "CreationStatus": "CREATION_IN_PROGRESS",    "Status": 202,    "RequestId": "46a274c0-a793-45b4-9b44-b54945714c13"}aws quicksight update-dashboard-published-version --aws-account-id XXXXXXXXXXXX --dashboard-id DemoDashboard1 --version-number 2{    "Status": 200,    "DashboardId": "DemoDashboard1",    "DashboardArn": "arn:aws:quicksight:us-east-1:XXXXXXXXXXXX:dashboard/DemoDashboard1",    "RequestId": "4907a7c1-c86b-4354-9c30-d67d257c45f0"}CommentShareEXPERTGokulanswered 4 months agorePost-User-8583808 4 months agoFollow up question. I wanted the dashboard to be refreshed alongside the refresh of the analysis (containing the refreshed dataset) without having to always run commands or click 'publish dashboard' in the ui. i'm looking for a way to trigger and automate that part. Is there a way that i can do that in quicksight? Thank you so much for your answerShare"


Question: Workdocs Drive does not install

"Environment:Two Workspaces running in same VPC with Internet access via NAT GW and IGWAWS Workspace running on Windows Server 2008 R2 Datacenter  presenting a Win 7 desktopAWS Workspace running on Windows Server 2016 presenting a Win 10 desktopRegion us-west-2AWS Workdocs Drive installed and working in Win10 Workspace (after roughly 3 hours of tweaking rights and browsers etc -- yeah, I'm complaining)AWS Workdocs Drive seems to install on the Win 7 Workspace and I get the icon for completing the install, but....Next step should be to run the Workdocs Drive installer that brings up the login screen for the desired Workdocs instance.Problem:The login screen never appears. Instead....Opening on the Workdocs Drive icon as Administrator results in the tray icon showing up with the message "Authenticating User..."The MS Message Queuing Service is started as are its components, MQAC, RPC, and Windows Event logThe Event log shows the following errors:The only negative event taking place when the installation starts is a warning that mentions a need to restart.Informational events state that the installation of the drive was successful-- Since there was no pop-up message displayed I restarted the Workspace instanceUpon restart the Tray Icon still displays the message "Authenticating user"the Event log shows two Errors from the Source "Amazon Workspaces":--  "Error when trying to start service HighlanderCGH."-- "Line 296. Cannot find any service with service name 'HighlanderCGH'."I'm flummoxed.  Any useful actionable advice is welcome.Thanks in advanceAbevEdited by: albevier on Jun 22, 2019 10:25 AMFollowComment"

Answer: "0After much mucking about for several months and trying to share documents between the two workspaces (sometimes successful, sometimes not) with many "Workdocs Drive" applications hangs, I decided that I would move on.  Conclusion: Workdocs Drive is not ready for prime time.CommentShareAl BeVieranswered 4 years ago0BTW, I did get it to "install" after much tearing of hair.  Never could figure out the error but I created a new workspace and was able to install without error.CommentShareAl BeVieranswered 4 years ago0Hi albevier:Thank for being AWS customer and choosing WorkSpaces and WorkDocs.let us follow-up with you offline to understand why your setup for WorkDocs client previous instance of WorkSpaces didn't work.ThanksCommentShareAWS-User-5522455answered 4 years ago0I noticed while installing workdocs drive on a few workspace instances that sometimes it would hang forever during the install process. Eventually I gave up and from the local workspace app I restarted the workspace and the next try worked fine.CommentSharegeorge-tempoanswered 4 years ago0Hi george-tempo:I have sent a DM to you to collect additional information for your setup. If there are pending software updates on those few WorkSpace instances, WorkDocs Drive installation will not complete until restart.We will be able to review the setup and help unblock your teamThanksCommentShareAWS-User-5522455answered 4 years ago"


Question: Does Elastic DRS failback only copy the delta when restoring to the original server?

"I've found a references to the mass failback client for DRS supporting delta changes when failing back to VMWare: https://youtu.be/7sxL8Oy4EpE?t=270. My question is, does the ISO failback client also support just copying the changes back when doing a failback to the original server that was failed over to in AWS?FollowComment"


Question: Storage Gateway Appliance/VM + FSx Windows File Server across domains?

"We are exploring using an AWS FSx Windows File Server that can host a file share that'll be accessible across EC2 instances, AWS Workspace instances, and physical workstations at a client site.  We do have AWS Directory Services hooked up to our company's on-prem domain, so the EC2 instances & AWS Workspace instances would all be on our company's domain, but my question is more regarding the physical workstations that we have at a client's site which are not on our domain.  We would be able to put a Storage Gateway on the client's network either as a VM or hardware appliance, but my question is, would the Storage Gateway need to be on the client's domain or our domain?  If on the client's domain, would it be able to communicate with our FSx Windows File Server over VPN?  If on our domain, would the physical workstations on the client's domain be able to access the file share?Thank you in advance,JoeFollowComment"

Answer: "0Accepted AnswerGreetings,You can use AWS Storage Gateway to expose your FSx Windows File Server to the physical workstations at the client's site. However, you'll need to ensure proper network connectivity and access permissions.For the Storage Gateway to work correctly, it should be on the same network as the physical workstations at the client's site. It doesn't necessarily need to be on the client's domain, but being on the same network is crucial.Here's how you can set up the desired architecture:Create a VPN connection between your AWS VPC and the client's network, if not already set up. This will allow secure communication between the client's on-premises environment and your AWS resources. More information on AWS VPN can be found here: https://aws.amazon.com/vpn/Deploy the Storage Gateway as a File Gateway on the client's network. This can be done using a virtual machine or a hardware appliance. Make sure it has proper network access to the client's workstations and the AWS VPN connection. More information on AWS Storage Gateway can be found here: https://aws.amazon.com/storagegateway/Mount your FSx Windows File Server on the Storage Gateway. The Storage Gateway should be able to communicate with the FSx Windows File Server over the VPN. To accomplish this, you may need to configure appropriate routes and security groups in your AWS VPC and on-premises network.Configure the Storage Gateway to use your AWS Directory Service for authentication. This way, when physical workstations access the file share, the Storage Gateway will handle the authentication with your AWS Directory Service. More information on joining a Storage Gateway to a domain can be found here: https://docs.aws.amazon.com/storagegateway/latest/userguide/GettingStartedCreateFileShares.html#GettingStartedCreateFileShares-jdFinally, configure the client's workstations to access the file share exposed by the Storage Gateway. They should be able to access the file share with appropriate credentials, even if they are not on your company's domain.Keep in mind that this setup may require additional fine-tuning based on the specific requirements of your company's network and the client's network.Please let me know if I answered your questionCommentShareZJonanswered 3 months ago0Hello Joe,In addition to Zokir response, please consider below as well, as your use-case involves two different AD domains :To attach FSx Window File Server to FSx File Gateway, FSx Windows File Server and FSx File Gateway both should be joined to same AD domain.Depending on the access requirements, you may need at minimum one way trust or two way trust (for bidirectional AD user accounts access).You may access your file shares from both Amazon FSx File Gateway as well as directly from Amazon FSx in AWS; however, you should ensure that files can only be written from a single location at a time. We don't recommend having multiple writers to the same files from two locations as it would lead to InvalidFileState errors.CommentShareSuryaanswered 3 months agojoe 3 months agoAssuming we have a VPN set up between our client's on-prem network and our company's AWS environment and we have both the on-prem storage gateway and our fsx windows file server on our company's domain, is there a way that the on-prem workstations on the client's domain could access the file share on our domain?  Perhaps via a mapped drive with different credentials?ShareSurya 3 months agoTo achieve your use-case, you would need one way forest trust relationship between your company's domain and your client's domain. In this case, your company's domain trusts your client's domain.Your client's domain would take the role of trusted domain and your company's domain would take the role of trusting domain.Validated authentication requests travel between the domains in only one direction—allowing accounts in your client's domain to authenticate against resources shared in your company's domain. In this case, Amazon FSx interacts only with your company's domain. Your company's domain then passes on the authentication requests to your client's domain.Above would be needed even when you consider using only FSx Windows File Server as well.Please refer below :https://docs.aws.amazon.com/fsx/latest/WindowsGuide/fsx-aws-managed-ad.html#using-a-rfimhttps://aws.amazon.com/blogs/security/everything-you-wanted-to-know-about-trusts-with-aws-managed-microsoft-ad/ (Scenario 1)https://aws.amazon.com/blogs/architecture/field-notes-designing-multi-region-aws-managed-microsoft-active-directory-for-hybrid-environments/Share"


Question: Availability of SQS Temporary and Virtual Queues in Languages Other Than Java.

"Several years ago AWS introduced temporary and virtual queues and put out a Java library. I'd like to implement this in PHP and Golang but it is not available. Is AWS planning to support virtual queues in these languages? If so, when?Is there a way to use virtual queues in these languages without a library/SDK?FollowComment"

Answer: "0Hello,I understand that you would like to implement Temporary or Virtual queue using PHP and Golang. Our available documentation provides Java library to help you create lightweight Temporary queue.https://github.com/awslabs/amazon-sqs-java-temporary-queues-clientJava library is just an abstraction layer to handle the underlying implementation that provides two interfaces:  AmazonSQSRequester and AmazonSQSResponder for two-way communication through queues. At this time, we only have Java library that supports this implementation.I have raised a feature request with our service team on your behalf, to provide AWS solution for Temporary queue in Golang and PHP. While I am unable to comment on if/when this feature may get released, I request you to keep an eye on our What's New (https://aws.amazon.com/new/) and Blog (https://aws.amazon.com/blogs/aws/) pages for any new feature announcements.Here is an existing public request for Golang implementation:  https://github.com/awslabs/amazon-sqs-java-temporary-queues-client/issues/31Having said that, you can use Java Temporary Queue Client example to re-implement the logic in any other language of your choice, without using SDK or library.The basic logic for the implementation is to create temporary or virtual queue to which you can send messages. The queue URL for virtual queue uses the format: <host queue URL>#<virtual queue name>. Your custom code will further remove the virtual queue name from virtual queue url, store virtual queue name as an attribute and sends message to host SQS queue. For ReceiveMessage, consumer polls the host queue, checks the virtual queue attribute and store the messages in respective virtual queue in memory. Finally, messages are dispatched to the listener.https://aws.amazon.com/blogs/compute/simple-two-way-messaging-using-the-amazon-sqs-temporary-queue-client/CommentShareSUPPORT ENGINEERIsha_Kanswered a year ago"


Question: How to run customized ssm document on config auto-remediation via CloudFormation?

"Hi,I'm trying to run auto-remediation via config on multiple accounts.The ssm document I need doesn't exist in China regions, so I created a customized one.I'm using CloudFormation to deploy the auto-remediation within AWS Config stackset.but I'm getting an error that the ssm_document_name is not valid."... ResourceType:AWS::Config::RemediationConfiguration, ResourceStatusReason:Could not find SSM documentarn:aws-cn:ssm:cn-northwest-1:account#:documents/doc-name with version null (Service: AmazonConfig; Status Code: 400; Error Code: InvalidParameterValueException;)(obviously, the "account#" and "doc-name" are replacing the real info)What can be the reason?FollowComment"


Question: What is the entrypoint /greengrass-entrypoint.sh?

"Hi,I had a problem when I tryed to running AWS IoT Greengrass in a Docker Container with the command:docker run --rm --init -it --name aws-iot-greengrass --entrypoint /greengrassentrypoint.sh -v c:/Users/%USERNAME%/Downloads/certs:/greengrass/certs -v c:/Users/%USERNAME%/Downloads/config:/greengrass/config -p 8883:8883 216483018798.dkr.ecr.us-west-2.amazonaws.com/aws-iot-greengrass:latestThe command prompt output say: No such file /greengrassentrypoint.sh, what is /greengrassentrypoint.sh?Edited by: EliezerMaduro on Oct 8, 2020 7:26 PMFollowComment"

Answer: "0Accepted AnswerDid you run the command with a typo. greengrassentrypoint.sh instead of greengrass-entrypoint.sh?Can you confirm that docker run --rm --init -it --name aws-iot-greengrass --entrypoint /greengrass-entrypoint.sh works.CommentShareAWS-User-1579492answered 3 years ago0Yes, that was my problem, the correct form is this /greengrass-entrypoint.shThank youCommentShareEliezerMaduroanswered 3 years ago"


Question: AWS SSM port forwarding session using AWS-SDK

"Hello,I am curious whether it is possible to open and maintain SSM port forwarding session using @aws-sdk ssm client. I have seen examples using AWS CLI, but I have not seen examples using SDK.What I would like is to do something like this:const { SessionId } = await ssmClient.send(      new StartSessionCommand({        Target: 'i-0af865f7bb036b35c', // jump host        DocumentName: 'AWS-StartPortForwardingSessionToRemoteHost',        Parameters: {          host: ['bastion-tst2-myslsdb.cluster-xxxxxxxxx.eu-west-1.rds.amazonaws.com'],  // remote db I try connect to          portNumber: ['5432'],          localPortNumber: ['5432']        }      })    );**This should open tunnel from my local port through the jumphost to the database. **In my case, the session starts, but no local port seems to be open on my localhost.The session then terminates automatically in about 20 seconds.FollowComment"

Answer: "0Hi,In Python, we have to use URL and the token into the Response for sending data to the WebSocket connection.https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/ssm/client/start_session.htmlSo, my guess is, you have to use the WebSocket protocol to send your data in.To maintain your connection up, you send periodically a probe to keep it alive.Sorry, I don't have any example to show you.Otherwise, you can create a subprocess/subshell and keep the process ID, to track it.CommentShareDonovanswered a month ago"


Question: (resolved) Why am I getting a 401 error when signing in from Cognito's hosted UI?

"Thank you for all your help.I would appreciate it if you could tell me if you know about the following events.【Question】Why do I get a 401 Authorization Required error when signing in from Cognito's hosted UI when integrating Cognito and ALB?【Specific situation】We have verified the integration between Cognito and ALB following the procedure in the following blog. [1][1] I added authentication with Cognito to an environment where content is delivered with EC2 and ALB | DevelopersIOhttps://dev.classmethod.jp/articles/cognito-alb-secret/The procedure itself was all successful, but I had a personal concern.That is, what would be the behavior if I signed in from Cognito's hosted UI instead of accessing the ALB's domain?I actually created a user in Cognito and clicked the "View Hosted UI" button from the Cognito console.The sign-in page appeared, so I signed in as a Cognito user and changed my password.However, the screen that appeared after the password change showed only 401 Authorization Required.After that, I tried accessing the ALB domain, and this time the EC2 page behind ALB was displayed correctly.This does not happen when signing in at the ALB domain, but only when accessing from the Cognito hosted UI.[Regarding the attached file]・401 Authorization Required screen・Button to display Cognito's hosted UI・Allowed callback URLsWe would be grateful if you could enlighten us on the above.FollowComment"

Answer: "1Accepted AnswerAs per the following documentation[1], the authentication flow for when authenticating a website, the Application Load Balancer is expecting the user to hit the load balancer first. ALB Authentication works by defining an authentication action in a listener rule. The ALB's authentication action will check if a session cookie exists on incoming requests, then check that it's valid. If the session cookie is set and valid then the ALB will route the request to the target group with X-AMZN-OIDC-* headers set. The headers contain identity information in JSON Web Token (JWT) format, that a backend can use to identify a user. If the session cookie is not set or invalid then ALB will follow the OIDC protocol and issue an HTTP 302 redirect to the identity provider. At this point the Authentication flow will be followed and the Session cookie will be updated with the lastest authentication information.You can also review the following blog post[2] for a more detailed breakdown on how Application Load Balancer authentication works.To answer your question "That is, what would be the behavior if I signed in from Cognito's hosted UI instead of accessing the ALB's domain?", as the client has not initially tried to access your website, the Load Balancer is not aware of where the client is trying to access behind the load balancer and the request will be unexpected. The Load Balancer "oauth2/idpresponse" endpoint exists to handle the Auth Code Exchange with the Cognito Token endpoint, and forward to client back to the original URI once the communication between Cognito and the Load Balancer is complete.[1] Authenticate users using an Application Load Balancer - Authentication flow - https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html#authentication-flow[2] Simplify Login with Application Load Balancer Built-in Authentication - https://aws.amazon.com/blogs/aws/built-in-authentication-in-alb/CommentShareSUPPORT ENGINEERMichael_Hanswered 8 months agomn87 8 months agoThank you for your response.Your very detailed explanation helped me to understand.I understood that the Hosted UI is not supposed to be accessed directly, and therefore it is an error.We will close this case with what you have explained.Thank you very much.Share0This is a good explanation but there is another issue related to this, when you logout using redirect uri method as described here https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.htmlGET https://mydomain.auth.us-east-1.amazoncognito.com/logout?   response_type=code&   client_id=ad398u21ijw3s9w3939&   redirect_uri=https://YOUR_APP/redirect_uri&   state=STATE&   scope=openid+profile+aws.cognito.signin.user.admin This does redirect to login page, but signin in from here redirects you to https://<DOMAIN>/oauth2/idpresponse?code=<XXXXXXXXXXXXX>&state=STATEAnd it shows 401.While if you go to your domain, it will show the logged in page secured with ALB. If you logout and go to the domain with ALB, it does takes you to login page and from there you can login just fine.Earlier when I set it up, the login was working from logout page as well as hosted UI page. But now it's not working from hosted UI or logout redirect uri page. But working fine with ALB.We don't need to use the hosted UI, but users do wanna re login after logout.Can you please tell me what could be the issue.CommentSharerePost-User-5779450answered 4 months ago"


Question: Agentless Application Migration Service Last Snapshot Job Failed

"Hello,Setting up AMS with agentless discovery and replication onprem using vCenter 7.x works fine for the initial snapshot creation and replication but subsequently fails on any further snapshot creation/updates on the VM so the virtual machine shows as "stalled" in the AMS console. Checking all requirements, and the fact that it works initially, I am unable to decipher as to why subsequent snapshots are failing and there isn't much documentation on troubleshooting this so I was curious if someone had hit this before and might have some guidance?Environment:vCenter 7.xWindows 2019 VM and Ubuntu 20 VM in testing - both show "stalled" after successful initial replicationMGN client plugin 1.1.6Thanks for any help!FollowComment"

Answer: "1Accepted AnswerI have the same problem after the initial snapshot.I traced the error to this:In the vcenter-client logs I see this error:{    "message": "VixDiskLibVim: Failed to verify SSL certificate: actual thumbprint=**VCENTER_THUMBPRINT** expected=**THUMBPRINT_FROM_CONFIG**\n",    "log": {        "type": "Remote",        "name": "Agent",        "level": "INFO",        "level_number": 20    },    "source_code": {        "function": "Log",        "file": "com.amazonaws.cloudendure.agent.snapshotflavor.JVixLoggerImpl"    },    "runtime_thread": 24,    "origin": {        "hostname": "mymgn.local"    },    "@timestamp": "2022-08-31T18:39:18.128Z"}And then the snapshot transport fails, for what I see, in the vcenter-client.config file there is a thumbprint of the vCenter from the initial agent configuration, but when It fetches it again its different. I checked the thumbprint manually and I get the same as the agent when tries to transport the snapshot. So I don't know where it got the other one.Getting the thumbprint with:openssl s_client -connect vcenterhostname:port < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdinreplace it in vcenter-client.config file, and running "vcenter_configuration_update" script seemed to work.CommentSharefmtrasan-Kdanswered 9 months agolaughmk 9 months agoHi,You nailed it with this response. Thank you and great find! Ironically, I have gotten nothing from AWS support, but this seems to have fixed it for me. I still see some other errors in the logs so my hope is to use the support case to identify the answer to your question above about how that thumbprint is initially obtained. I will reply back here if/when I receive that answer. Great job and thank you for sharing!Thanks!Share"


Question: "OpenSearch Nodes Disappear, don't drop to zero?"

"We're having an issue where our UAT environment AWS OpenSearch setup seems to drop nodes occasionally, but doesn't seem to drop to zero.  As it's our testing environment, we only have one node for OpenSearch, but for some reason it'll disappear and then come back with only the .kibana index still available, we can then restore from our last snapshot.I tried to setup an automated task to watch for when Nodes dropped to zero, creating an event bridge alert, but the problem is, it doesn't drop to zero as you can see from the metric snapshot below, so the event bridge alert never triggers.Why doesn't it drop to zero?  How can I automate the restoration when the node eventually comes back?  how can I trigger an alert at the very least when the nodes disappear?FollowComment"

Answer: "0Hi,I hope you were able to find a solution to the issue, but if not, I can share some pointers:Since you have a single node cluster, the missing metrics can be logically assumed a drop to zero when the node disappears and there isnt any metric sent to Cloudwatch. I assume with this setup you dont have dedicated master nodes, which would explain why there is a gap in node count metricThere is some finite amount of data that a single node can hold and that does not always correspond to the free disk space. There are multiple metrics like the JVM allocation, number of shards etc... On a single node cluster, I have seen node restart and data loss when the JVM Memory pressure goes beyond 75% for a longer duration. Also look for CPU / Memory utilization.There are other metrics also that you can look for like cluster state being non-green. There is a possibility these other alert / metrics may precede the actual time of node restart and provide you a heads up about the issue.You can trigger an alert for missing data to be treated as breaching threshold in Cloudwatch. That should notify you.--SydCommentShareSydanswered 9 months ago"


Question: build a custom aws connect CCP

"Hi team, i am try to build this website that have impeded CCP to display a custom attribute  sent by aws connect (set custom attribute ) in the work flow ,<!DOCTYPE html>    <meta charset="UTF-8">

    when i run the code am getting error in console !connect-streams-min.js:1 Uncaught ValueError: containerDiv must be providedat new t.ValueError (connect-streams-min.js:1:450668)at t.assertTrue (connect-streams-min.js:1:445913)at t.assertNotNull (connect-streams-min.js:1:445973)at t.core.initCCP (connect-streams-min.js:1:345122)at init (ccpIndex.html:14:26)at ccpIndex.html:43:13please help, all what we need is to display the custom attribute in a popup msg to the agent !FollowComment"

Answer: 1Have you checked our self-serve workshop that teaches you how to do this? Try this link: https://catalog.us-east-1.prod.workshops.aws/workshops/e507e74d-d816-4808-94c5-58abc598c40b/en-US and see if this solves your problemCommentShareMagdaanswered 3 months ago


Question: "Writing to S3 bucket from Lambda, same account, “InvalidARN" message"

"Been digging through tutorials for days, but they all say the same thing, and it seems like I should be in slam dunk territory here, but I get the following error whenever I try to read or write from my S3 bucket.“InvalidARN: ARN accountID does not match regex ”[0-9]{12}“”I only have one AWS account, so my lambda function should be owned by the same account as my S3 bucket. I have given my lambda role s3:GetObject and PutObject permissions, as well as just s3:*, I have verified that my S3 bucket policy is not denying access explicitly, but nothing changes the message.I am new to AWS policies and permissions, but google isn't giving up a lot of other people getting this message. I don't know where I am supposed to be supplying my AccountID or why it isn't already there. Would be grateful for any insights.FollowComment"

Answer: 0Whoops! Turns out in the end it was a bad bucket name. I was using the full ARN instead of just the short name. :-pCommentSharechriscalefanswered 2 years ago


Question: AWS Glue Schema Registry Replication

Do we have AWS glue schema registry replication story? We can't set up the redundancy by ourselves because it would have a different schema version.This is important for us in terms of business continuity in the case of regional outage.FollowComment