Question: Fargate Service Performance Degedation

"On 04/21 at about 11:23, we started experiencing a severe degradation of performance on our Fargate deployed services.  Tasks that were taking milliseconds are now taking seconds.  We did not deploy any new services, these are the same services that have been running for months.The only interaction these tasks have is with an RDS Aurora databases.Has something changed on AWS that I need to account for?Thank you,ChrisFollowComment"

Answer: "1Look for the cause of poor performance.Are you seeing anything unusual in the application logs, for example?If you are using RDS Aurora, you can also enable "Performance Insights" to search for SQL that is taking a long time to process.https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_PerfInsights.Enabling.htmlYou can also check AWS Compute Optimizer and other tools to see if ECS is underperforming.https://docs.aws.amazon.com/compute-optimizer/latest/ug/view-ecs-recommendations.htmlCommentShareEXPERTRiku_Kobayashianswered a month agoKirk_D a month agoIn addition to the application logs and RDS Aurora performance insights, I would recommend looking at the CloudWatch logs for either ECS and EKS (unclear which service is in use, Fargate is available for both). These will provide visibility into issues with the launching of new containers, or issues with the container environment.Share"


Question: Can I buy amazon ses credits?

"I want to increase my limit of amazon SES emails, is it possible to buy The quota?FollowComment"

Answer: "0If your current sending quotas aren't adequate for your needs and AWS haven't automatically increased them, please request an increase. Few ways to do this:A self-serve way is described in User requested increased sending quotasAlternatively, you can open a AWS Support case by visiting the AWS Support Center and create a case by clicking 'Create case'.Hope this helps.CommentShareAWS-User-2870192answered 5 months ago"


Question: SES Ip Blacklisted in Spamhaus

"According to Q4 of https://docs.aws.amazon.com/ses/latest/dg/faqs-dnsbls.html, when one of SES Ip address used by AWS falls into a DNSBL like spamhaus, AWS itself takes action to remove it from the list. Recently we've noticed a lot of messages falling into spam when using one of the ips in range 54.240.3.X. When checking it on spamhaus we were able to see that since 2022/07/17 this ip range is listed as spam. I'd like to know when will AWS take action to move this ip out of this DNSBL or if it is possible to assign another ip range to send the emails.FollowComment"

Answer: "1Good luck with that. AWS don't seem to really care much about their IP addresses being blacklisted, and in fact, you cannot even use the term "blacklisted" in a support request, as I assume they are trying to prevent people from even complaining about it!CommentShareAWS-User-4661929answered 8 months ago"


Question: lightsail sudo plesk login fails - disk full

"I have a WordPress site on LightSail. Tried to login but can't navigate to wp-admin. Tried to login to Plesk and it says the disk is full. How do I get into the account to free up space?ubuntu@thirsty-kalam:~$ sudo plesk loginDB query failed: SQLSTATE[HY000]: General error: 1021 Disk full (/tmp/#sql_301_0.MAI); waiting for someone to free some space... (errno: 28 "No space left on device"), query was: DESCRIBE clientsFollowComment"

Answer: "0Greetings,You can follow these Plesk specific instructions to free up space in your temp directory and other areas  which may allow you to restart the psa service and login in to Plesk:https://support.plesk.com/hc/en-us/articles/115000140333-MySQL-fails-to-start-when-a-Plesk-server-lacks-disk-space-SQLSTATE-HY000-No-space-left-on-device-500-Plesk-Exception-Database#:~:text=0%20100%25%20/-,Resolution,-First%2C%20to%20bringIf the above steps don't free up sufficient disk space allowing you to restart Plesk and log back in, please follow the steps listed in the following knowledge centre article which guides you on how to increase your Lightsail plan or bundle to one with a larger volume size:https://aws.amazon.com/premiumsupport/knowledge-center/lightsail-instance-failed-status-check/#:~:text=reduce%20memory%20usage.-,Disk%20full%20errors,-If%20there%27s%20noWe'd appreciate if you'd update this thread with your findings, and hopefully confirmation of the issue being resolved.Regards, AntAWSCommentShareAntAWSanswered 2 months agorePost-User-1507573 2 months agoThis looks helpful, thanks. But I can't perform any of the recommend actions to free up space. I get permission denied for al of them. I login via SSH via the browser from the LightSail area of the AWS Management Console.  I assume the provided user that I am logging in with does not have root. How to do I create or locate a user with higher permissions?SharePavel - AWS 2 months agoDid you try prefixing the failed-due-to-lack-of-permissions cleanup commands with sudo?Share0Thanks for your response.If you are not able to log into the AWS Management Console to increase the Lightsail bundle with a larger volume, I'm afraid only the account root user, or an IAM user with higher permissions, can either perform the steps themselves or provide you permissions to do so. However, if you have restricted access to AWS Management Console, I suspect the account you are using is managed by another party and you won't be able to create a user with higher permissions, or view information about a user with higher permissions, based on your current permissions. Considering this, you will need to reach out to account owner/s directly to assist further.Once you're able to, they can review the following documentation for guidance on managing access to Amazon Lightsail to grant you required permissions: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-managing-access-for-an-iam-userCommentShareAntAWSanswered 2 months ago"


Question: Does AWS DMS work with Oracle 21c express edition

I have my Oracle instance setup on-premise. The version is 21c express edition.Does DMS work with this version of Oracle as the source ?FollowComment

Answer: "0This might be one to clarify with AWS Support directly but referencing the DMS documentation, for Oracle as a source it calls out belowAWS DMS supports the following Oracle database editions:Oracle Enterprise EditionOracle Standard EditionOracle Express EditionOracle Personal EditionFor self-managed Oracle databases, AWS DMS supports all Oracle database editions for versions 10.2 and later (for versions 10.x), 11g and up to 12.2, 18c, and 19c. For Amazon RDS for Oracle databases that AWS manages, AWS DMS supports all Oracle database editions for versions 11g (versions 11.2.0.4 and later) and up to 12.2, 18c, and 19c.CommentShareRoBanswered a year ago"


Question: When will we see AWS Single Sign-On in EU ?

"Hi there..With the newly build-in directory in AWS Single Sign-On, the service really got interesting, but with the GDPR regulation we still cannot use it here in EU.AWS Single Sign-On has been out since 2017, when can we expect to see it "Over here" ?Looking forward..DavidFollowComment"

Answer: 0Thanks a lot David. We have added your request to our feature back log and will update the thread once the service is available in EU region.CommentShareAWS-User-3789583answered 4 years ago0https://aws.amazon.com/about-aws/whats-new/2019/02/aws-sso-is-now-available-in-the-asia-pacific-singapore-asia-pacific-sydney-eu-frankfurt-eu-ireland-eu-london-us-east-ohio-and-us-west-oregon-regions/CommentSharedfnielsenanswered 4 years ago


Question: Deploy YOLOv5 in sagemaker - ModelError: InvokeEndpoint operation: Received server error (0)

"I'm trying to deploy custom trained Yolov5 model in Sagemaker for inference. (Note : The model was not trained in sagemaker).Followed this doc for deploying the model and inference script - Sagemaker docsModelError                                Traceback (most recent call last)<ipython-input-7-063ca701eab7> in <module>----> 1 result1=predictor.predict("FILE0032.JPG")      2 print(result1)~/anaconda3/envs/python3/lib/python3.6/site-packages/sagemaker/predictor.py in predict(self, data, initial_args, target_model, target_variant, inference_id)    159             data, initial_args, target_model, target_variant, inference_id    160         )--> 161         response = self.sagemaker_session.sagemaker_runtime_client.invoke_endpoint(**request_args)    162         return self._handle_response(response)    163 ~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/client.py in _api_call(self, *args, **kwargs)    399                     "%s() only accepts keyword arguments." % py_operation_name)    400             # The "self" in this scope is referring to the BaseClient.--> 401             return self._make_api_call(operation_name, kwargs)    402     403         _api_call.__name__ = str(py_operation_name)~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/client.py in _make_api_call(self, operation_name, api_params)    729             error_code = parsed_response.get("Error", {}).get("Code")    730             error_class = self.exceptions.from_code(error_code)--> 731             raise error_class(parsed_response, operation_name)    732         else:    733             return parsed_responseModelError: An error occurred (ModelError) when calling the InvokeEndpoint operation: Received server error (0) from primary with message "Your invocation timed out while waiting for a response from container primary. Review the latency metrics for each container in Amazon CloudWatch, resolve the issue, and try again.". See https://ap-south-1.console.aws.amazon.com/cloudwatch/home?region=ap-south-1#logEventViewer:group=/aws/sagemaker/Endpoints/pytorch-inference-2022-06-14-11-58-04-086 in account 772044684908 for more information.After researching about InvokeEndpoint, tried thisimport boto3sagemaker_runtime = boto3.client("sagemaker-runtime", region_name='ap-south-1')endpoint_name='pytorch-inference-2022-06-14-11-58-04-086'response = sagemaker_runtime.invoke_endpoint(                            EndpointName=endpoint_name,                             Body=bytes('{"features": ["This is great!"]}', 'utf-8') # Replace with your own data.                            )print(response['Body'].read().decode('utf-8'))But this didn't help as well,detailed output :ReadTimeoutError                          Traceback (most recent call last)<ipython-input-8-b5ca204734c4> in <module>     12 response = sagemaker_runtime.invoke_endpoint(     13                             EndpointName=endpoint_name,---> 14                             Body=bytes('{"features": ["This is great!"]}', 'utf-8') # Replace with your own data.     15                             )     16 ~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/client.py in _api_call(self, *args, **kwargs)    399                     "%s() only accepts keyword arguments." % py_operation_name)    400             # The "self" in this scope is referring to the BaseClient.--> 401             return self._make_api_call(operation_name, kwargs)    402     403         _api_call.__name__ = str(py_operation_name)~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/client.py in _make_api_call(self, operation_name, api_params)    716             apply_request_checksum(request_dict)    717             http, parsed_response = self._make_request(--> 718                 operation_model, request_dict, request_context)    719     720         self.meta.events.emit(~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/client.py in _make_request(self, operation_model, request_dict, request_context)    735     def _make_request(self, operation_model, request_dict, request_context):    736         try:--> 737             return self._endpoint.make_request(operation_model, request_dict)    738         except Exception as e:    739             self.meta.events.emit(~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/endpoint.py in make_request(self, operation_model, request_dict)    105         logger.debug("Making request for %s with params: %s",    106                      operation_model, request_dict)--> 107         return self._send_request(request_dict, operation_model)    108     109     def create_request(self, params, operation_model=None):~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/endpoint.py in _send_request(self, request_dict, operation_model)    182             request, operation_model, context)    183         while self._needs_retry(attempts, operation_model, request_dict,--> 184                                 success_response, exception):    185             attempts += 1    186             self._update_retries_context(~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/endpoint.py in _needs_retry(self, attempts, operation_model, request_dict, response, caught_exception)    306             event_name, response=response, endpoint=self,    307             operation=operation_model, attempts=attempts,--> 308             caught_exception=caught_exception, request_dict=request_dict)    309         handler_response = first_non_none_response(responses)    310         if handler_response is None:~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/hooks.py in emit(self, event_name, **kwargs)    356     def emit(self, event_name, **kwargs):    357         aliased_event_name = self._alias_event_name(event_name)--> 358         return self._emitter.emit(aliased_event_name, **kwargs)    359     360     def emit_until_response(self, event_name, **kwargs):~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/hooks.py in emit(self, event_name, **kwargs)    227                  handlers.    228         """--> 229         return self._emit(event_name, kwargs)    230     231     def emit_until_response(self, event_name, **kwargs):~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/hooks.py in _emit(self, event_name, kwargs, stop_on_response)    210         for handler in handlers_to_call:    211             logger.debug('Event %s: calling handler %s', event_name, handler)--> 212             response = handler(**kwargs)    213             responses.append((handler, response))    214             if stop_on_response and response is not None:~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/retryhandler.py in __call__(self, attempts, response, caught_exception, **kwargs)    192             checker_kwargs.update({'retries_context': retries_context})    193 --> 194         if self._checker(**checker_kwargs):    195             result = self._action(attempts=attempts)    196             logger.debug("Retry needed, action of: %s", result)~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/retryhandler.py in __call__(self, attempt_number, response, caught_exception, retries_context)    266     267         should_retry = self._should_retry(attempt_number, response,--> 268                                           caught_exception)    269         if should_retry:    270             if attempt_number >= self._max_attempts:~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/retryhandler.py in _should_retry(self, attempt_number, response, caught_exception)    292             # If we've exceeded the max attempts we just let the exception    293             # propogate if one has occurred.--> 294             return self._checker(attempt_number, response, caught_exception)    295     296 ~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/retryhandler.py in __call__(self, attempt_number, response, caught_exception)    332         for checker in self._checkers:    333             checker_response = checker(attempt_number, response,--> 334                                        caught_exception)    335             if checker_response:    336                 return checker_response~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/retryhandler.py in __call__(self, attempt_number, response, caught_exception)    232         elif caught_exception is not None:    233             return self._check_caught_exception(--> 234                 attempt_number, caught_exception)    235         else:    236             raise ValueError("Both response and caught_exception are None.")~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/retryhandler.py in _check_caught_exception(self, attempt_number, caught_exception)    374         # the MaxAttemptsDecorator is not interested in retrying the exception    375         # then this exception just propogates out past the retry code.--> 376         raise caught_exception~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/endpoint.py in _do_get_response(self, request, operation_model, context)    247             http_response = first_non_none_response(responses)    248             if http_response is None:--> 249                 http_response = self._send(request)    250         except HTTPClientError as e:    251             return (None, e)~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/endpoint.py in _send(self, request)    319     320     def _send(self, request):--> 321         return self.http_session.send(request)    322     323 ~/anaconda3/envs/python3/lib/python3.6/site-packages/botocore/httpsession.py in send(self, request)    449             raise ConnectTimeoutError(endpoint_url=request.url, error=e)    450         except URLLib3ReadTimeoutError as e:--> 451             raise ReadTimeoutError(endpoint_url=request.url, error=e)    452         except ProtocolError as e:    453             raise ConnectionClosedError(ReadTimeoutError: Read timeout on endpoint URL: "https://runtime.sagemaker.ap-south-1.amazonaws.com/endpoints/pytorch-inference-2022-06-14-11-58-04-086/invocations"FollowComment"

Answer: "0Is there any error in your CloudWatch Logs that could point to the issue?I see you are sending a string named "FILE0032.JPG". The .predict function will make a prediction to the endpoint with the string "FILE0032.JPG" not the serialized file "FILE0032.JPG"Kindly see how a YOLOv4 model is invoked here.CommentShareMarcanswered a year agoAWS-User-5413662 a year agoThanks Marc,Please refer the next answer column for my comment.Share0Thanks for reply. There is no error in CloudWatch logs. (Pasted below) Sorry for the long description, i thought detailed info would be helpful.2022-06-15T11:15:21.349+05:30Warning: MMS is using non-default JVM parameters: -XX:-UseContainerSupportAllTraffic/i-0ed6739cdaf7cf56a2022-06-15T11:15:21.349+05:30log4j:WARN Continuable parsing error 2 and column 16AllTraffic/i-0ed6739cdaf7cf56a2022-06-15T11:15:21.349+05:30log4j:WARN Document root element "Configuration", must match DOCTYPE root "null".AllTraffic/i-0ed6739cdaf7cf56a2022-06-15T11:15:21.349+05:30log4j:WARN Continuable parsing error 2 and column 16AllTraffic/i-0ed6739cdaf7cf56a2022-06-15T11:15:21.349+05:30log4j:WARN Document is invalid: no grammar found.AllTraffic/i-0ed6739cdaf7cf56a2022-06-15T11:15:21.349+05:30log4j:ERROR DOM element is - not a <log4j:configuration> element.AllTraffic/i-0ed6739cdaf7cf56a2022-06-15T11:15:21.349+05:30log4j:WARN No appenders could be found for logger (io.netty.util.internal.PlatformDependent0).AllTraffic/i-0ed6739cdaf7cf56a2022-06-15T11:15:21.349+05:30log4j:WARN Please initialize the log4j system properly.AllTraffic/i-0ed6739cdaf7cf56a2022-06-15T11:15:21.599+05:30log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.AllTraffic/i-0ed6739cdaf7cf56a2022-06-15T11:15:27.349+05:30Model server started.I tried this example, it says"An entry_point script isn’t necessary and can be a blank file. The environment variables in the env parameter are also optional" in the tutorial But when i tried it, it threw this error---------------------------------------------------------------------------ModelError                                Traceback (most recent call last)<ipython-input-25-b706a4fea979> in <module>     13 for i in range(iters):     14     t0 = time.time()---> 15     response = client.invoke_endpoint(EndpointName=optimized_predictor.endpoint_name, Body=body, ContentType=content_type)     16     t1 = time.time()     17     #convert to millis~/anaconda3/envs/pytorch_p36/lib/python3.6/site-packages/botocore/client.py in _api_call(self, *args, **kwargs)    399                     "%s() only accepts keyword arguments." % py_operation_name)    400             # The "self" in this scope is referring to the BaseClient.--> 401             return self._make_api_call(operation_name, kwargs)    402     403         _api_call.__name__ = str(py_operation_name)~/anaconda3/envs/pytorch_p36/lib/python3.6/site-packages/botocore/client.py in _make_api_call(self, operation_name, api_params)    729             error_code = parsed_response.get("Error", {}).get("Code")    730             error_class = self.exceptions.from_code(error_code)--> 731             raise error_class(parsed_response, operation_name)    732         else:    733             return parsed_responseModelError: An error occurred (ModelError) when calling the InvokeEndpoint operation: Received server error (500) from primary with message "Content type applicatoin/x-image is not supported by this framework.            Please implement input_fn to to deserialize the request data or an output_fn to            serialize the response. For more information, see the SageMaker Python SDK README.Traceback (most recent call last):  File "/usr/local/lib/python3.6/site-packages/sagemaker_inference/decoder.py", line 106, in decode    decoder = _decoder_map[content_type]KeyError: 'applicatoin/x-image'During handling of the above exception, another exception occurred:Traceback (most recent call last):  File "/usr/local/lib/python3.6/site-packages/sagemaker_inference/transformer.py", line 128, in transform    result = self._transform_fn(self._model, input_data, content_type, accept)  File "/usr/local/lib/python3.6/site-packages/sagemaker_inference/transformer.py", line 233, in _default_transform_fn    data = self._input_fn(input_data, content_type)  File "/usr/local/lib/python3.6/site-packages/sagemaker_pytorch_serving_container/default_inference_handler.py", line 111, in default_input_fn    np_array = decoder.decode(input_data, content_type)  File "/usr/local/lib/python3.6/site-packages/sagemaker_inference/decoder.py", line 109, in decode    raise errors.UnsupportedFormatError(content_type)sagemaker_inference.errors.UnsupportedFormatError: Content type applicatoin/x-image is not supported by this framework.            Please implement input_fn to to deserialize the request data or an output_fn to            serialize the response. For more information, see the SageMaker Python SDK README.". See https://ap-south-1.console.aws.amazon.com/cloudwatch/home?region=ap-south-1#logEventViewer:group=/aws/sagemaker/Endpoints/sagemaker-inference-pytorch-ml-c5-2022-06-15-05-44-12-970 in account 772044684908 for more information.FYI,torch.__version__1.6.0kernel conda_pytorch_p36 (Same steps followed as mentioned in the tutorial)Very confused on how to proceed after this? Why SageMaker is this much complex? Any kind of help would be appreciated. Thanks Marc.CommentShareAWS-User-5413662answered a year ago"


Question: We'll be right back!

"REMOVEDUPLOADDevelopers!Your feedback has been incredibly imperative to us as it provides vivid perspectives to the challenges faced in taking amazing games to the global audience (please keep ‘em coming). To that, the team is continually working hard to improve your experience on Amazon GameLift, that includes the channels you use to communicate with us! With that in mind, we’re -temporarily- putting the forums in read-only mode for some cool upgrades that we believe will help improve the digital experience.For customers who –literally- just posted a support question, we’ll do our best to answer them while the forums undergoes these changes. [Worry not, your posts will not be lost].Catch you in the new forum (^-^ /)~// CheersGameLift Dev TeamFollowComment"

Answer: "0Thanks for the new forum, it's a lot better than the old one.CommentSharerePost-User-3297722answered 4 years ago"


Question: Connect Windows 10 WorkSpace to Amazon Linux 2 EC2 Instance

"Hi, I'm experimenting with a Windows 10 WorkSpace for the first time and need some guidance on how to access an application on my Linux EC2 instance. They are both in the same account and when I created the WorkSpace I selected the default VPC which is also where my EC2 instance is. I have installed a Java application on the Workspace that needs to connect to an application on the Linux EC2 instance but so far I've failed miserably.  I've added the WorkSpace IP into the Security Group associated with my EC2 instance but it just can't see it. I've tried both the public and private IP address of the EC2 instance. Any help will be greatly appreciated.FollowComment"

Answer: "0Based on your scenario, I would suggest verifying a couple of items:Verify that the WorkSpace and Ec2 Linux instance are in the same subnet.On the security group assigned to the WorkSpace and Ec2 Linux instance, add ensure you've added the target security group the the list. Check this documentation for steps: Rules to connect to instances from an instance with the same security groupCheck to see if you have communication between the two instance by doing ICMP ping or a simple Windows TracertIf you still encounter problems/error, I would recommend opening an AWS Support Ticket to have a Support Engineer review the logs associated with your account for further troubleshooting. ThanksCommentShareEXPERTDzung_Nanswered a year ago"


Question: Kinesis Video TURN servers vs IPv6

"I'm working on a WebRTC video streaming solution based on KVS WebRTC support. I noticed that clients are unable to establish connection using AWS's TURN servers when connecting from IPv6 only networks. WebRTC logs show Skipping TURN server because of address type mis-match which seems to be pointing to IPv6 vs IPv4 issues. When I run dig -t aaaa  +short XX-XX-XXX-XX.t-776cc62f.kinesisvideo.us-east-1.amazonaws.com (which is an address of a TURN server returned by API call), I don't get any results. Could someone confirm that KVS TURN servers do not support IPv6? If that's the case what's the best approach to work around this limitation? Using other TURN provider, spinning up self hosted server, anything else?FollowComment"

Answer: "0Kinesis Video Streams for WebRTC does not support IPv6 at this time. If you are working with an AWS account team, please work with them to provide more details about your requirements so the details can be shared with the service team.CommentShareEXPERTDavid Maloneanswered a month ago"


Question: Accessing Elastic Beanstalk Application files from FTP Client

"Hi everyone,Is there a possibility to access and modify application files deployed using Elastic Beanstalk service, through FTP client? I can connect with the application but every time I try to modify even a single text file inside the app, I get 'permission denied' error.Best regardsFollowComment"

Answer: "0Generally, it is not a best practice to directly modify the already deployed files, this is because when you make an environment update either from console or EB CLI all the files will be replaced again from the new application version source bundle downloaded from S3. In order to make persistent changes, you would need to deploy a new version to the environment[1][2]. The easiest way should be using eb cli which will allow you to deploy from your local machine's directory. Regarding your question, the permission denied error is either due to access limitation for the FTP user to write to the files under /var/app/current or the FTP configuration does not allow file modification. You can login into the instance and switch as ftp user and check if the user can make changes to the files as expected.[1] https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.deploy-existing-version.html[2] https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/eb3-deploy.htmlCommentShareAWS-User-5157529answered 5 years ago"


Question: Can I Import .sql files from Encrypted s3 bucket into Encrypted MySQL RDS instance?

"An offshore team is dumping daily raw data from a SQL instance (.sql.gz zipped files) into an s3 bucket in my org. Task at hand is to import this data into a MySQL RDS instance, query the instance, transform the data then load it into a Postgresql instance. I can't seem to find a way to do this with Lambda or Glue or any third party applicationFollowCommentAshish_P 10 months agoQ-1: What do you mean by encrypted S3 bucket and encrypted MySQL RDS ? Are both encrypted with AWS managed keys / Custom Key ?Q-2: In subject line you have mentioned MySQL RDS but in actual question you have mentioned PostgreSQL, can you please clarify ?Share"

Answer: "0Hello, Thank you for your question. There are some limitations on importing files from s3 to Amazon RDS. You can't import .sql files from an encrypted backup in an s3 bucket to RDS.Here's the official document on limitations and recommendations for importing files from s3 to Amazon RDS: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/MySQL.Procedural.Importing.html#MySQL.Procedural.Importing.LimitationsCommentShareAmir_Canswered 9 months agoSUPPORT ENGINEERAWS_SamMreviewed 9 months ago"


Question: How do I solve a "Failed" message on a Redshift Serverless workgroup?

"My workgroup shows a status of "Failed", and has done for a few days. I can still access the data in the Query Editor. I can successfully create a new workgroup, and the namespace associated with the workgroup is showing as Available. There are no controls for restarting or recreating the workgroup, or any way I can see to get out of the failed state.I think a related issue is that the workgroup no longer has a VPC security group or subnets associated with it, which seems to have happened around the time the workgroup changed from publicly accessible back to private. I didn't change this.I can't add a VPC security group or subnets because attempting to change those settings shows an error banner saying "ValidationException: Cannot update multiple configurations at the same time for workgroup default", despite having only completed the minimum required fields.FollowCommentrePost-User-5502197 a year agobig thumbs up on this - I've noticed this too and I think its messing with my code when I try to connect to RedshiftDataAPIService through boto3. Before I did not need a cluster identifier or workgroup name and now it is erroring out saying I need one? So Im having to provide the workgroup name to get it working again but its a breaking change across all my codeShare"


Question: Webvtt segments for HLS through elastic transcoder

"Elastic Transcoder is creating segmented webvtt files for my HLS streams, with headers that look like this:WEBVTTX-TIMESTAMP-MAP=MPEGTS:0, LOCAL:00:00:00.000Is there a way to configure Elastic Transcoder to change that to for example removeRemove the LOCAL:00:00:00.000 portion entirely ORRemove the space after the comma ORChange the order portions of that line appear.Finally, is this something Media Convert could handle, but not Elastic Transocder. If so, could you let me know. Thank you.FollowComment"


Question: "CodePipeline Deployment to include files such as png, js, and css"

"I would think that what I am trying to do is very common and can only assume I am just doing something wrong here. I've been experimenting for the past few weeks with using CodePipleline to "CICD" my sample .NET RazorPages app.Everything runs fine locally.  Static files such as css and js files load into page. In fact, can publish to my RazorPages app directly to a  ElasticBeanstalk instance using my AWS Toolkit in VS 2022.  Again no problems.However, things seems to go sideways when I use CodePipeline. Despite all my efforts, it seems the deploy process will not transfer over some of the files from my code repo (GitHub).  More specifically, things located in the wwwroot folder.http://jsplayground2021web-prod.us-east-1.elasticbeanstalk.com/No errors from the source, build or deploy events in the pipeline.  Nothing.I keep circling back to my buildspec.yml file (https://github.com/RedBirdOBX/JsPlayground2021/blob/master/buildspec.yml) but can't seem to get anything to be picked up in the files list.Clearly I'm doing something wrong.  Pointers or assistance would be appreciated!FollowComment"


Question: Access "aud" claim in resolver mapping for AWS AppSync

"I am using OIDC Access tokens to authenticate calls to AWS AppSync. I would like to filter on the different client-ids that are using the API, but I am not able to access the claim "aud"Is there a way to read the "aud" claim in the resolver template, or some other way of getting the client-id?  $context.identity.aud does not work (NULL)FollowComment"

Answer: "0Accepted AnswerI found it myself, you can access all claims using:$ctx.identity.claims.audCommentShareKetilanswered a year ago0Hi,Sorry to crash this thread. Just wondering are you using AppSync GraphQL for the above case? And if so, are you calling your GraphQL Api directly from an external client via the GQL Api https://....../graphql URL? I am having an issue such that I am calling my GraphQL Api (testing via postman) via the https:// end-point. I am using AccessKey/SecretKey/Session token in the postman Authorization setting. I can hit the Api, and the resolver can see the incoming payload. However, my payload does NOT contain the "identity" property. The "augments" property is there, but not the "identity". According to documentation, if using AWS_IAM authentication, the "identity" should be there.CommentSharerePost-User-8196003answered a year ago"


Question: Impact of changing RDS Oracle licensing options

Hello TeamI am trying to change the license option for my RDS Oracle instance from "BYOL" to "License Included".Will there be any impact on the temporary unavailability of the RDB instance at that time?ThanksFollowComment

Answer: "2Accepted AnswerHelloDowntime occurs while changing RDS Oracle licensing options.If you choose to apply the change immediately, it occurs immediately.If you don't choose to apply the change immediately, it occurs during the next maintenance window.Reference Doc - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html#USER_ModifyInstance.SettingsIf this answer has led to a solution, please approve the answer for the betterment of the community.CommentShareVetrivelanswered 2 months ago"


Question: Error when update Cognito pool for a CustomEmailSender

"Hi,I am trying to update an existing Cognito User Pool to make it send Emails using a third-party provider, I am following every detail mentioned inhttps://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-custom-email-sender.htmlHowever when it comes to updating the pool using a CLI command "aws cognito-idp update-user-pool --lambda-config " I receive the following error:Parameter validation failed:Unknown parameter in LambdaConfig: "CustomEmailSender", must be one of: PreSignUp, CustomMessage, PostConfirmation, PreAuthentication, PostAuthentication, DefineAuthChallenge, CreateAuthChallenge, VerifyAuthChallengeResponse, PreTokenGeneration, UserMigrationUnknown parameter in LambdaConfig: "KMSKeyID", must be one of: PreSignUp, CustomMessage, PostConfirmation, PreAuthentication, PostAuthentication, DefineAuthChallenge, CreateAuthChallenge, VerifyAuthChallengeResponse, PreTokenGeneration, UserMigrationso what I understand is the CustomEmailSender is for some reason had been rejected as aparameter!and at same time this is not available in the console either.I can set a CustomEmailSender only when i create a user pool using CloudFormation YAML script, but I am unable to update exisiting oneHelp in this is highly appreciated.FollowComment"

Answer: 2Accepted AnswerCould you check if you are using the latest version of CLI? Latest version should support this.CommentSharekJayanswered 2 months agoAbdullah 2 months agoThanks @KJayThis actually made a difference!I updated the CLI to the latest version and it worked as expected.Share


Question: How to exclude the specific rules in AWS Managed Rule group with CloudFormation

"Hi all,I'm using CloudFormation to manage AWS Firewall Policy.Following the document here: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-fms-policy.htmlI have defined SecurityServicePolicyData with type WAFV2.Example Code"ManagedServiceData": "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"Now I want to exclude one of the rules within AWSManagedRulesCommonRuleSet but I don't see any guidelines or examples to do that.My question is how to exclude one of the rules within AWSManagedRulesCommonRuleSet for example with CloudFormation. ?Regards,FollowComment"

Answer: "0Accepted AnswerHello there,Please find below an example to exclude a rule from AWS Managed Rule:{    "Resources": {        "PolicyWAFv2": {            "Type": "AWS::FMS::Policy",            "Properties": {                "ExcludeResourceTags": false,                "PolicyName": "Policy",                "RemediationEnabled": false,                "ResourceType": "AWS::ElasticLoadBalancingV2::LoadBalancer",                "SecurityServicePolicyData": {                    "Type": "WAFV2",                    "ManagedServiceData": {                        "Fn::Sub": "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesAmazonIpReputationList\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"                    }                }            }        }    }}CommentShareSUPPORT ENGINEERZhiyuan_Lanswered a year agoJason a year agoThanks, ZhiyuanIt works for me.Share"


Question: Client Error Exception (Access denied for AWS Comprehend)

"Getting the following exception while trying to access the AWS Comprehend using  aws_access_key_id, aws_secret_access_key, aws_session_token."ClientError: An error occurred (AccessDeniedException) when calling the BatchDetectDominantLanguage operation: User: arn:aws:sts::********:assumed-role/AWSReservedSSO_AWSAdministratorAccess_************/*******@.com is not authorized to perform: comprehend:BatchDetectDominantLanguage with an explicit deny in a service control policy"FollowComment"

Answer: 0You should confirm with your AWS Organizations administrator. Probably the administrator is the one who created your AWS account. The operation (comprehend:BatchDetectDominantLanguage) is denied by Service Control Policy (SCP) of AWS Organizations. SCP is able to deny operations independently of IAM policies.CommentShareimikyanswered 4 months ago


Question: Amplify + Next.js SSR + CDK Backend -- no current user error consistently

"Having a terrible time setting up a simple "blogs list" and individual "blogs post" toy example.  If I do everything in amplify, it just works.  If I create the backend in CDK and bring over the aws-exports.json, some settings are not being picked up.Of course, I have Amplify.configure(...awsExports, ssr: true) in all files.I've tried muliple versions of getserversideprops plus :aws-exports with all settings on one level, and also the nested version with "API" and "Auth" segregatedCopy pasted in the aws-exports in to the [id].js fileThe blogs list page renders as expected after I have logged in.  When I try to access a specific blog post, I am routed to the page and the error "no current user" is raised.  Clearly, I am authorized already.i am thinking of doing everything through CDK and seeing if that eliminates some settings issues.  Using CDK for the backend is a must since appsync on amplify is horribly slow to push / develop.TIA for any assistance.V.FollowComment"


Question: EKS security group being flagged by Security Hub standard

"Hi all,I have recently enabled Security Hub on my account where we have EKS set up via CDK. We have assigned the "AWS Foundational Security Best Practices v1.0.0" standard to Security Hub and it came up with a couple of findings. One of them is that the security group used by EKS is allowing all traffic to the ingress nodePorts. We are allowing all sources because we are doing client ip preservation on the NLB, so we can get the client IP addresses on the pods.Is there some way around this/fix so it doesn't get flagged by this standard?We enabled Security Hub to generate a report for a Facebook Data Protection Assessment that was required to our company.Any help would be appreciated!BestLior.FollowComment"

Answer: "0To address this finding, you can create a security group that allows traffic only from the NLB's security group or from specific IP ranges that are trusted. You can then update your EKS cluster to use this new security group instead of the existing one. Or you could use WAF to filter traffic based on specific criteria, such as IP address or geographic location. This can provide an additional layer of security to your application while still allowing you to preserve client IP addresses.CommentShareWilklinsanswered a month agoLior 21 days agoFrom my understanding if I have client IP preservation, the source IP that I will see will not be from the NLBs but from the client IPs, or am I wrong in this assumption? If this is correct, then I cannot limit an IP range because the public ingress needs to allow everyone to connect to it.Share"


Question: TimeStream and time zones

I have IoT things sending timestamps in GMT to a TimeStream table. This means that the data is corrected to GMT no matter where the data was collected. Are there time zone shift functions that I am missing? The only thing I can find (and works OK) is using time - 5h.Are there any functions that correct based on an actual timezone?FollowComment

Answer: "1HiCurrently, timestream does not support Timezone. The only way available if the input time different from UTC is to add or subtract to offset before input into table.CommentShareSUPPORT ENGINEERKevin_Zanswered a year ago"


Question: S3 Bucket Date of Last Interaction

"I'm looking at the utilization of my S3 buckets in an account, and would like to know if there is a good way to look at the date of last interaction across all of them.The intention is to find these under-utilized or non-utilized buckets and make some decisions around what to do with the data.  I'm already  using intelligent tiering with these which does help somewhat, this would be a manual evaluation process though.FollowComment"

Answer: 1Accepted AnswerTake a look at S3 Storage Lens. You can filter on active buckets in the default dashboard. See: Introducing Amazon S3 Storage Lens – Organization-wide Visibility Into Object StorageCommentShareEXPERTkentradanswered 3 months agoRyan Dalton 3 months agoThis looks like it might be a match.  Thanks for the guidanceShare


Question: Aws CodePipeline to Deploy to ECS Cluster using AWS CLI

"I am using AWS CodePipeline to create a CICD. I am using Bitbucket as a source, using CodeBuid and Amazon CodePipeline. I have done this using console but now I want to create CodePipeline using AWS CLI. For this, we have to create a JSON file that holds the configuration. I want to deploy my application to ECS but I don't find any JSON format to do this.Here you can see the JSON file:{  "pipeline": {    "roleArn": "arn:aws:iam::74555555530:role/service-role/AWSCodePipelineServiceRole-us-east-1-HubspotConnector",    "stages": [      {    "Name": "Source",    "Actions": [        {            "InputArtifacts": [],            "ActionTypeId": {                "Version": "1",                "Owner": "AWS",                "Category": "Source",                "Provider": "CodeStarSourceConnection"            },            "OutputArtifacts": [                {                    "Name": "SourceArtifact"                }            ],            "RunOrder": 1,            "Configuration": {                "ConnectionArn": "arn:aws:codestar-connections:us-east-1:747926693930:connection/5b2xxxx2-2xxf-4xx0-9xx3-xxcfxxxxx72f",                "FullRepositoryId": "an-c/rpipeline",                "BranchName": "xxxxxx",                "OutputArtifactFormat": "CODE_ZIP"            },            "Name": "ApplicationSource"        }    ]},      {        "name": "Build",        "actions": [          {            "inputArtifacts": [              {                "name": "SourceArtifact"              }            ],            "name": "Build",            "actionTypeId": {              "category": "Build",              "owner": "AWS",              "version": "1",              "provider": "CodeBuild"            },            "outputArtifacts": [              {                "name": "default"              }            ],            "configuration": {              "ProjectName": "cicdCli"            },            "runOrder": 1          }        ]      }    ],    "artifactStore": {      "type": "S3",      "location": "codepipeline-us-east-1-16896969692329"    },    "name": "newPipelineCicd",    "version": 1  }}It has source stage, build stage but I don't know how to write build stage (for Deploy to ECS). Can someone guide me what are the exact parameters for build stage (ECS deployment).FollowComment"

Answer: "0In order to check for the Json format of the ECS Deployment stage in the AWS CodePipeline, you can refer the below document :[] Amazon Elastic Container Service - Action declaration - https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference-ECS.html#action-reference-ECS-exampleFurther, I would also recommend you to checkout this[1] document to know more about the 'CodePipeline pipeline structure' in detail.Also, feel free to refer these[2][3] documents which consists of the step by step tutorial to deploy to Amazon ECS using AWS Codepipeline.References :[1] CodePipeline pipeline structure reference - https://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.html[2] Tutorial: Amazon ECS Standard Deployment with CodePipeline - https://docs.aws.amazon.com/codepipeline/latest/userguide/ecs-cd-pipeline.html[3] Tutorial: Create a pipeline with an Amazon ECR source and ECS-to-CodeDeploy deployment - https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-ecs-ecr-codedeploy.htmlCommentShareSUPPORT ENGINEERAnkur_Panswered 9 months agoAWS-User-8471608 8 months agoI ran a command for the CodePipeline skeleton that returned me the skeleton of pipeline. But it contains some of the fields that aren't defined anywhere in the documentation like this:  "stages": [{"name": "","blockers": [{"name": "","type": "Schedule"}What are blockers? can you tell me? can you tell me where these are defined? The tutorial link you shared with me isn't showed codepipeline creation from AWS CLI instead it is showing me creation of CodePipeline via console, which I have already done.It has been more than two weeks for searching a proper format and those fields describption.  I didn't expect that kind of blunder from AWS.Share"


Question: [Errno 2] No such file or directory

"Hey Team,I'm trying to access AWS console using AWS CLI, but I'm getting following error, please do help[Errno 2] No such file or directorySoftware Version installedC:\Users>python --versionPython 3.7.0a2C:\Users>aws --versionaws-cli/1.13.0 Python/2.7.9 Windows/8 botocore/1.8.3C:\Users>pip --versionpip 9.0.1 from c:\users\nrao2\appdata\local\programs\python\python37\lib\site-packages (python 3.7)Edited by: NTRao on Nov 30, 2017 6:47 PMFollowComment"

Answer: "0I found a suggestion by googlingC:\WINDOWS\system32>copy "c:\Program Files\Amazon\AWSCLI\botocore\vendored\requests\cacert.pem" "c:\Program Files\Amazon\AWSCLI\certifi"But above one could not resolved my issue...Appreciate your suggestionsEdited by: NTRao on Nov 30, 2017 6:51 PMEdited by: NTRao on Dec 1, 2017 10:46 AMCommentShareNTRaoanswered 6 years ago0Hey Team,Greetings!!I found that ssl connection causing this issue!, Later I ignored ssl connection using "--no-verify-ssl"Now my aws cli is able to establish connection from my aws accountHope it will be useful!!ThanksNTRaoCommentShareNTRaoanswered 5 years ago"


Question: AWS CloudShell IP????

Does the CloudShell IP change each time I login?How can I find the IP Address?What I am trying to do is block the SSH on lightsail to the IP of cloudshell so I can have my cloudshell scp files over?FollowComment

Answer: "1Hello,You can find the current IP by running:curl https://icanhazip.com/v4When CloudShell stops/starts, the CloudShell IP changes each time.CommentShareEXPERTChris_Ganswered 4 months ago"


Question: Interactive glue job %magic command to configure Number of retries

"Hi, I need to modify the number of retries. The default number is 3 but I want to modifity to 1. I didn't find that information in the documentation.FollowComment"

Answer: "0At the moment, you cannot modify the number of retries by a %magic command.The only way is the following work around:Open the Jobs(Legacy) console.Select the notebook job whose configuration you want to modify.Click 'Action' and then 'Edit job'.Next click on "Security configuration, script libraries, and job parameters (optional)'.Modify the parameters as required and then 'Save'.CommentShareFlorian Knorranswered 6 months ago"


Question: IoT rule ingestion with dynamic measure names

"Hi,I have few problems with ingesting data into Timestream DB using IoT rule engine. My measurement data comes in few different data types from many sources with unique identifiers. Therefore, I can't just group the data under the same measure name.To resolve this I planned to use a unique measurement identifier as measure_name, so each series could have its respective data type. However, since those identifiers are dynamic (not just "cpu_temp" or something common like that), I can't just add them in the SELECT clause of SQL rule engine. Also, to add more complexity, the timestamp I want to use is the one that comes in the MQTT message, rather than the one at the time of rule invocation. I have tried, but I can't filter out metadata attributes in SQL rule engine, so all attributes get written to DB.So far I only see one solution, which is to have one measure_name for each possible data type and keep unique identifiers in dimensions.Is there any better solution to this scenario?Would it be possible to use the value from one attribute as the name for the outgoing result of the other attribute in SQL rule engine?From:{SignalName: "UniqueSensorIdentifier",Value: 12345.6789}To:{UniqueSensorIdentifier: 12345.6789}Thank you.FollowComment"

Answer: "0For anybody with the same issue:You can use:SELECT Signal.* FROM topicAnd just nest the reading in Signal in your incoming JSON.Edited by: ayuzva on Jun 18, 2021 11:43 AMCommentShareayuzvaanswered 2 years ago"


Question: Arbitrary upstream repositories: on the roadmap?

"Hello,I am interested in using CodeArtifact in some projects. We currently use several Maven repositories which, while public, are not on CodeArtifact's list of supported upstreams. Unless I am mis-reading the documentation, it's not possible to use an arbitrary upstream repository outside the approved list (which, for Maven, looks limited to Maven Central). Is this a feature that's on the roadmap for CodeArtifact?FollowComment"

Answer: 0This feature is something the service team wants to build but there is no ETA I can share right now.CommentShareCarl Lewisanswered 3 months ago


Question: Error using Aurora Postgres version 11.8 as DMS source endpoint

"We had a DMS source endpoint that was connecting to an Aurora Postgres 10.7 database and it was working fine.  We upgraded the database to Aurora Postgres 11.8 and now the endpoint connection test is failing. A DMS target to the same database is working fine, so it appears the replication instance is setup correctly.  The error message is:Test Endpoint failed: Application-Status: 1020912, Application-Message: Failure in resolving database version.  ODBC general error., Application-Detailed-Message: Failed retrieve database backend version RetCode: SQL_ERROR  SqlState: XX000 NativeError: 1 Message: ERROR: rds_activity_stream stack item 9 not found on top - cannot pop; Error while executing the query Failed (retcode -1) to execute statementIs Aurora Postgres 11.8 supported as a source by DMS?Edited by: mnpete on Nov 19, 2020 7:16 AMFollowComment"

Answer: 0I found the problem.  It appears that DMS source endpoints don't work when the activity stream is enabled.  After disabling the activity stream I was able to successfully test the source endpoint.CommentSharemnpeteanswered 3 years ago


Question: Resource Utilization for Fargate ECS

"A customer is in the midst of transitioning their ECS workload from running on EC2 hosts to Fargate.As a part of this process,they'd like to ensure their ECS tasks are appropriately sized in terms of CPU and Memory reservation - ideally to maximize resource utilization while ensuring they can scale horizontally when necessitated by workload requirements.I've not had much success finding advice on what CPU / Memory utilization % targets to shoot for.  if anyone can provide insight or recommendations it would be greatly appreciated.FollowComment"

Answer: "0Accepted AnswerThe general answer is that they would need to load test their application and determine how much vCPU and memory the application needs. Since they are currently using ECS/EC2, they should be able to look at their existing metrics and get an understanding of how much vCPU and memory their tasks are using in production and define task size and scaling parameters based on that.Container Insights is useful for this purpose: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cloudwatch-container-insights.htmlCommentShareMatsanswered 3 years ago"


Question: Create a greengrass component on the cloud

Are all greengrass component run on edge? Can I create a component that run on the cloud? Or how can I connect a component on edge to the cloud for message exhanging?FollowComment

Answer: "0Hi, yes, Greengrass components run on whichever host device is running the Greengrass Nucleus component. Typically this is at the edge.Our developer guide goes into detail on how to use Greengrass IPC to communicate between components and IoT Core.https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.htmlCommentShareJoeAtAWSanswered 5 months ago"


Question: Wordpress on Bitnami and AWS unavailable

"On AWS EC2 instance I've installed Bitnami and on top of that I've installed Wordpress and a Wordpress theme.After few months of customization few days ago I stopped and started the instance. Since then my site is unavailable.I am trying to bring the site up and for this I've found this tutorial: https://www.youtube.com/watch?v=xvtoVxk8kWAFollowing the tutorial I can say the following:Status check for sys. reachability successfully passedStatus check for instance reachability successfully passedSecurity groups look ok from my perspectiveNetwork ACL looks ok from my perspective (all traffic allowed)In the tutorial (time 4:20) it says to start the following command:sudo systemctl status httpdWhen I run this command I get the following outputUnit httpd.service could not be found.I tried running this command as "root" and as "bitnami" user. In both cases I am getting the same error message.In the aforementioned tutorial in the comments someone wrote that "sudo systemctl restart httpd" worked for him. But when I run this command I still get "Unit httpd.service not found.".Bottom line is - I am trying to bring the site up. This way or any other way. All checks which video describes until 4:20 minute look same/similar on my end. That's why I am trying to bring it up with "sudo systemctl...". can anyone please help me with this? Thanks!Following the video (4:41) I've run this command to check if the traffic is received on port 80/443:netstat -tunlp | grep -i httpI don't get any result (at least not the result as shown in the video). Based on this I conclude that the site is NOT listening on port 80/443I tried running this command and here is the resultsudo firewall -cmd --state sudo: firewall: command not foundIf I runsudo /opt/bitnami/ctlscript.sh statusThen I get this result apache already running mariadb already running php-fpm already runningCan anyone please help me to bring the site back up? The matter is urgent and critical. Thanks for support and understanding.If I run this command:sudo /opt/bitnami/bndiagnostic-toolI get the following output`An updated version is available. Would you like to download it? You would need t o run it manually later. [Y/n]: nWelcome to the Bitnami Diagnostic tool.Please read the following information carefully.Press [Enter] to continue:This tool collects system information and files from a Bitnami stack into adiagnostic bundle file to be uploaded and reviewed by the Bitnami Team, for thesole purpose of providing you support for any issue you may find.The uploaded information will be automatically removed from our systems after 1month. In case you have any doubt regarding our privacy policy please check:https://www.vmware.com/help/privacy.htmlPress [Enter] to continue:Do you accept? [y/n]: y|The bndiagnostic tool has finished searching for errors and has found someissues that might be related to yours. The output will be shown on the nextpage:Press [Enter] to continue:===== Begin of bndiagnostic tool output =====? Resources: Found possible issues? Connectivity: Found possible issues✓ Mariadb: No issues found✓ Processes: No issues found? Wordpress: Found possible issues? Apache: Found possible issues✓ Php: No issues found[Resources]Your instance has little available RAM memory.total used free shared buff/cache available Mem: 975 386 63 1 524 420 Swap: 63412 622You could try to increase your instance's memory. Please check your cloudprovider's documentation for more information.Press [Enter] to continue:[Connectivity]Server ports 22, 80 and/or 443 are not publicly accessible. Please check thefollowing guide to open server ports for remote access:https://docs.bitnami.com/general/faq/administration/use-firewall/[Wordpress]Found recent WordPress plugin related error messages in the Apache error log.[Sun Feb 26 21:00:44.149415 2023] [proxy_fcgi:error] [pid 952:tid140330003298048] (70007)The timeout specified has expired: [clientip_address:20346] AH01075: Error dispatching request to : (polling),referer: https://www.<my-domain-name.com>/wp-admin/plugins.php?s=&plugin_status=allPlease check the following guide to deactivate plugins:https://developer.wordpress.org/cli/commands/plugin/deactivate/[Apache]Press [Enter] to continue:Found recent error or warning messages in the Apache error log.[Sun Feb 26 20:59:56.709925 2023] [proxy_fcgi:error] [pid 952:tid140329768302336] (70007)The timeout specified has expired: [clientip_address:32977] AH01075: Error dispatching request to : (polling),referer:https://www.<my-domain-name.com>/wp-admin/admin.php?page=w3tc_dashboard&_wpnonce=521586fa3b&w3tc_note=flush_all[Sun Feb 26 20:59:43.844511 2023] [proxy_fcgi:error] [pid 952:tid140330158352128] (70007)The timeout specified has expired: [clientip_address:28814] AH01075: Error dispatching request to : (polling),referer:https://www.<my-domain-name.com>/wp-admin/admin.php?page=w3tc_dashboard&_wpnonce=521586fa3b[Sun Feb 26 21:00:29.519343 2023] [proxy_fcgi:error] [pid 689:tid140329474819840] (70007)The timeout specified has expired: [clientip_address:51737] AH01075: Error dispatching request to : (polling)Please check the following guide to troubleshoot server issues:https://docs.bitnami.com/general/apps/wordpress/troubleshooting/debug-errors-apache/Press [Enter] to continue:===== End of bndiagnostic tool output =====Press [Enter] to continue: The diagnostic bundle was uploaded successfully to the Bitnami servers. Please copy the following code:68c41c59-2922-1493-7306-970580d0b299And paste it in your Bitnami Support ticket._`Re. "connectivity":this is how my inbound rules are defined: https://prnt.sc/ieCq2NSsX6B6This video (https://www.youtube.com/watch?v=uLmjoHDCkag) shows how the issue with unreachable site is resolved (14:56 min).However, when I connect as bitnami user I can't run the commands show in the video.On the other hand, if I try to connect with the instance over console-aws either as "admin" or "ec2-user", I get the following errorFailed to connect to your instance Error establishing SSH connection to your instance. Try again later.Why can't I connect with the instance?FollowComment"

Answer: "0Connection error:It appears to me that you should check your security group's inbound rules. Please check the source either it is My IP or 0.0.0.0/0. If you get the public IP dynamically, then you have to change the My IP, and I believe you know the 0.0.0.0/0 source which is not secure, but you may try it.By stopping and restarting the ec2 could replace the EIP or Auto enabled public IP. If this the case you should reassociate the EIP with the VPC/EC2.If I am not wrong "sudo apachectl configtest" will tell you line by line, if there is any apache server problem.The wider part is DNS configuration with your new EIP or public IP and check the NS server. There are a few commands to check those. There is a publication on AWS "How do I troubleshoot issues with DNS record resolution for my public hosted zone in Route 53?" could help you.Before you do anything, please make a snopshot of the instance, in case you may create more problem with the current instance.I hope this will help you.CommentSharerePost-User-7136343answered 3 months agofibonaccius 3 months agoThanks for your reply.This is how inbound rules in the security group are defined: https://prnt.sc/ieCq2NSsX6B6I am using public hosted zone. I also noticed that elastic IP is associated with VPC."sudo apachectl configtest" returns "Syntax OK".I am really running out of options here, so I'd appreciate any help.Please consider I am not an infrastructure expert. Thanks.I'd appreciate if we can proceed more structurally. Please let me know how and what I need to check and I will send you the infos. Thanks.Share0Your security group inbound rules, look fine.As you have mentioned that you are not an AWS infrastructure expert, that's a concern. So, I an not sure whether you have created the VPC and its dependencies manually or dynamically. If you have created the VPC and its dependencies manually, then it will be hard for you to check the association of subnets, IG, and IG's association with the VPC. You will get there, no worries.As I have said before when you have stopped the instance, your instance is no longer with the EIP any more. What you can do, just select that EIP and under Action on the top, release that EIP and reassociate it with the EC2.Action > Release Elastic IP addressesAction > Associate Elastic IP addressesOn Associate Elastic IP address Info - PageClick refresh icon under the Instance and click inside the box, you will see the Instance/s, select the correct instance to associate the EIP. Afer all click the "Associate" button.Or you can delete the EIP, and allocate a new EIP and associate the new EIP with the EC2.Select "Elastic IPs" on the left side of the dashboard.Click "Allocate Elastic IP address" top right corner of the page.Now follow the "Action" menu to associate this EIP with your correct instance. I hope this will help you, and again you have reedit the DNS A recored. Because your DNS A record still have the old EIP. You have to replace the old EIP with the new one, if you have created a new noe. If you have not created a new EIP then you do not need to edit the DNS A record.Let me know, I am happy to assist you.CommentSharerePost-User-7136343answered 3 months agofibonaccius 3 months agoThank you for your reply. I did not create anything manually. I used Bitnami image and I believe that took care of everything automatically and resources were created dynamically. Before I make changes to elastic IP can you please have a look at the current settings I described (with screenshots) in this question. https://stackoverflow.com/questions/75624841/site-unavailable-on-ec2-instance-bitnami-imagePlease let me know afterwards if you think I should proceed with the changes regarding elastic IP you recommended.Just one more quick comment regarding elastic IP. I see the same IP in  DNS A records in "Route53 -> DNS Management, Hosted zone -> My Domain Name". Can you please explain how adding a new elastic IP could resolve the issue? Are you sure I don't need to update anything else except DNS A record after I create a new elastic IP?Thanks again for your support!UPDATE: if I try to release the EIP, I get this message: https://prnt.sc/hxpmArxuXfPgAdditionally, I don't see where I can delete the EIP: https://prnt.sc/yVumPxORTYUg(since I am not infra. expert, as you can see, I am being super cautious regarding the changes)Share0In the tutorial (time 4:20) it says to start the following command: sudo systemctl status httpd When I run this command I get the following output Unit httpd.service could not be found.I am back again, its probably you have installed "apache2" instead of httpd, even though both are apache server. Type-sudo systemctl status apache2sudo systemctl start apache2sudo systemctl enable apache2sudo apachectl configtestLet me know with the update.CommentSharerePost-User-7136343answered 3 months agofibonaccius 3 months agoIf I run "sudo systemctl status apache2" then I get the following output "Unit apache2.service could not be found.".If I run "sudo /opt/bitnami/ctlscript.sh status" then I get this output:apache already runningmariadb already runningphp-fpm already runningI posted this question on Bitnami forum https://github.com/bitnami/vms/issues/720 and to my question whether an issue is on Bitnami side, Bitnami says the following:"That's not possible. Bitnami pre-configures, packs, and publishes applications which can be deployed by end-users. Our applications are tested to work out of the box so it's unlikely that the issue is related to Bitnami configuration itself. Most of the time when the applications fail after deployment, it's due to either changes in the configuration or a lack of machine resources."(I did not experience any issues with performance)Share0It appears everything is fine by looking at the screenshots. I did not get which security group is attached with your EC2 whether it is default or other two-security group. There are many cURL and dig commands to troubleshot the DNS, HTTP, HTTPS, NS, SOA and the correct IP address maped with the FQDN.You are right, there is no EIP delete option.Before that I would say clear your Browser cache, and flush dns cache from the system. Turn off your router for a moment and reset it. And even you can restart your computer. Without getting the full access of the system, I am unable to investigate any further. You can approach to AWS.Please take a snapshot, you can make an instance from the snapshot - before you make any changes of the current EC2. If you have any further questions, please do not hesitate to ask me. Finally, I apologise for any inconvience.CommentSharerePost-User-7136343answered 3 months agofibonaccius 3 months agoThanks for your quick response.I am very much stuck with this and don't have any ideas on what to do next. As you could see I posted the issue on multiple forums, but it did not bring me any further.Cache is emptied and routed is restarted. Site is still unreachable and it's been like this for 6 days already.Do you have any other concrete ideas regarding resolving the issue? I'd appreciate any help I can get.Share0I have an Amazon Linux 2 AMI with httpd, MySQL, and WordPress installed. I have activated a theme. All on a sudden, I could not access the website. I tried all the avenues, nothing worked. Then I thought, as I am trying so many times, may be my network treat it as a DDoS attack. I had stopped for a few days to open the website, you will be surprused that my website came back after a day or two. It is from my own experience.One thing I did extra which was I added the IP with the server host's folder. In my case it is: "sudo nano /etc/hosts"x.x.x.x domain nameSaved it and restarted the server.You can have a look at the link:https://aws.amazon.com/premiumsupport/knowledge-center/route-53-fix-dns-record-resolution/Please let me know. Thanks again.CommentSharerePost-User-7136343answered 3 months agofibonaccius 3 months agoI found a solution - when I ran this command "sudo /opt/bitnami/ctlscript.sh restart" my site was up again.Hope this helps someone in the future.Many thanks for your help and guidance! I really appreciate itShare0I found a solution - when I ran this command "sudo /opt/bitnami/ctlscript.sh restart" my site was up again.Hope this helps someone in the futureCommentSharefibonacciusanswered 3 months agorePost-User-7136343 3 months agoThanks for letting me know, when you provided me the full details of your post, I saw this command in the bitname documents, and I thught you already applied this command. Good luck.Share"


Question: aws greengrass webcam component

"I would like to do a realtime video detection. I decided to use a object detection component ( i.e. aws.greengrass.DLRImageClassification ), which continuously called to capture a image from a webcam component for object detection and store the detection result in a database. What component can I use? How to use webcam as a greengrass component, is there any existing componet for that?FollowComment"

Answer: "0From the existing community components, there are components available for streaming video but no specific components just for capturing images.However, you can always build your custom component to capture images from webcam. Here is an example  - https://github.com/aws-iot-builder-tools/greeneyes/blob/main/blog-posts/001/guest/bash-capture-loop/capture-oneThis is a custom component where an image is captured using bash script library.CommentSharesunriseanswered 5 months ago"


Question: Load Balncer in Elastic Beanstalk Appliaction

"Hello, my goal is to add HTTPS to my .NET 6 application.I followed some tutorials but I have problems that exists only on my side.The actual problem: I cannot add a Load Balancer to my Elastic Beanstalk Appliaction.Also i don't have a custom domain and i am not able to create a CertificateFollowComment"

Answer: "1In the navigation pane, choose Hosted zones. Choose the name of the hosted zone that has the domain name that you want to use to route traffic to your load balancer. Choose Create recordSee if this worksCommentShareAWS_Guyanswered 3 months ago"


Question: Can't Terminate my EC2 Instance

"How do I permanently terminate my EC2 instance i-02d2c9f4ce88cf135?I've tried from the CLI and Web Console but it keeps restarting and running. Short of reporting my CC stolen, how do I permanently kill the thing?Edited by: Colin A. White on Jun 10, 2020 2:50 PMFollowComment"

Answer: "0Hello Colin,I have checked your account and I can confirm that you are terminating the Instances correctly. After that action a new instance is actually re-created. It is not restarting.The reason behind this behavior is an Auto Scaling group which is configured to always check and make sure that 1 EC2 instance is running. Therefore if an instance is terminated, the Auto Scaling group will launch a new one.If this is not needed please delete the Auto Scaling group. You can follow this link: https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-process-shutdown.htmlThank you,VasosAWSCommentShareAWS-User-5546426answered 3 years ago"


Question: Uncaught RedisClusterException: Can't communicate with any node in the cluster in /home/cloudpanel/public_html/RedisCache.php

"Hello Everyone,We are getting "Uncaught RedisClusterException: Can't communicate with any node in the cluster in" this error.We are using Elastic Cache redis cluster with 2 node and cluster mode was enablePHP library ==>https://github.com/cheprasov/php-redis-client we are using this library.This error randomly occurs in our websites. At the time of error Elastic cache load was normal.Is there any way to trouble shoot this issue.FollowComment"


Question: Does AWS do internal logging for user access information for AWS services?

"Does AWS do internal logging for user access information to AWS services if customer disabled logging for the services used explicitly?Major services in questions - Route53, WAF, Cloudfront, S3Thanks,FollowComment"

Answer: "1All of these services are integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service . CloudTrail captures a subset of API calls for particular service or actions as events, including calls from the console and code calls to the APIs. There is also a good blog which shows how to notify on changes to CloudTrail and re-enable logging whenever logging is disabled.References :Logging Amazon S3 API calls using AWS CloudTrail - https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging.htmlLogging and monitoring in Amazon Route 53 - https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/logging-monitoring.htmlLogging API calls with AWS CloudTrail - https://docs.aws.amazon.com/waf/latest/developerguide/logging-using-cloudtrail.htmlUsing AWS CloudTrail to capture requests sent to the CloudFront API - https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/logging_using_cloudtrail.htmlMonitor Changes and Auto-Enable Logging in AWS CloudTrail - https://aws.amazon.com/blogs/mt/monitor-changes-and-auto-enable-logging-in-aws-cloudtrail/CommentShareEXPERTAWS-User-Nitinanswered 8 months agoAWS-User-7344930 8 months agoThanks for your suggest but let me rephrase my intent - I want to run a website on AWS with highest privacy. I configured the services not to do the access logging. And I want to know if AWS log the user access internally even if I disabled access logging in AWS console.Share0You can use Cloud HSM directly without KMS and KMS custom key store. AWS Cloud HSM provides two ways how clients can connect to it.Command line utilities : https://docs.aws.amazon.com/cloudhsm/latest/userguide/command-line-tools.htmlProgrammatic access: https://docs.aws.amazon.com/cloudhsm/latest/userguide/use-hsm.htmlThese both ways, user can directly integrate with Cloud HSM without any interaction with any of other AWS services. As far as IAM concerns, AWS Cloud HSM access does not fall under IAM.CommentSharekpanswered 8 months ago"


Question: "Can lambda know the specific attribute which changed in the dynamo db table update, when a lambda is triggered by dynamo db table update item??"

"My client has an architecture to trigger a lambda whenever the dynamo db table is updated. However, my client needs to perform a check on the specific attribute which changed. The lambda payload gives the new and old image. However the lambda should compare and check what changed between the old and new image in order to proceed to the next step. In this case, is there any way the lambda can know which specific attribute changed when an item is updated in a dynamo db ?FollowComment"

Answer: "3Yes, if you configure your DynamoDB Stream to emit NEW_AND_OLD_IMAGES then the Lambda can see the before and after of the update. You will then have to decide in your application logic which values where changed by comparing the OLD_IMAGE to the NEW_IMAGECommentShareEXPERTLeeroy Hannigananswered a year agoEXPERTBrettski-AWSreviewed a year agoMatthias Pichler a year agoTo maybe add to that: the way we do this comparison is by using jsonpatch which is a standardized way of representing the diff between two JSON objects. It is also available in a lot of languages.Share"


Question: Recognize BIND DNS and disregard Lightsail Networking

"OS: ubuntu 20.04I have registered my domain name at Godaddy, setup custom nameservers and set the nameserver hostnames to the Static IP of my instance.I am using Webmin/Virtualmin and have installed BIND DNS which I would like to use instead of a Lightsail Networking DNS zone.How do I configure things to recognize my BIND DNS and disregard Lightsail Networking?FollowComment"

Answer: "0Check out this link: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-static-dns-ubuntu-debian/CommentShareDavid Ganswered 2 years ago0I found that the following worked for me.Login to AWS console: https://console.aws.amazon.comCreate a new DHCP option setEnter an option set nameEnter the domain nameLeave other fields emptyGo to "Your VPS's"Select the VPCUnder "Actions" dropdown,edit DHCP option set and select the set you just creatededit DNS hostnames...  disableedit DNS resolution... disableReboot the instanceAfter doing this my running BIND DNS server was recognized and I was able to enter DNS records there.CommentSharebbd153answered 2 years ago"


Question: Can I use Get-EC2Tag or Get-EC2Instance AWSPowershell cmdlets to match multiple tags and return results only matching those two tags?

"I want to return the resource/instance ID of a specific instance matching two tags:$awsEx = (Get-EC2Tag -Filter @{name='tag:Status';values=""},@{name='tag:Site';values="SITENAME"}).ResourceId$awsEx returns nothing. Running this:$awsExIpv4 = (Get-EC2Instance -InstanceId $awsEx).Instances.PrivateIpAddress$awsExIpv4 returns a list of instance IP addresses. The IPs I've crosschecked have matched the Site value. So it's simply returning instances that only match the Site tag and not the Status tag. If it did match both tags, it would return only one instance. The instance that contains no value in Status tag and is tagged with SITENAME in the Site tag.When I run:$awsEx = (Get-EC2Tag -Filter @{name='tag:Status';values=""}).ResourceId$awsEx returns the instance Id I need.**How do I run this query to return results only matching both tags? **While this works now to return only the instance I need, in the future there could be other instances with no value in the Status tag but differing values in the site tag that should not be returned, as the returned instance Id in the script I am running will be terminated.RESOLUTIONI was able to resolve this by using different appends and the correct cmdlet. Please see below:$awsEx = (Get-EC2Instance -Filter @{name='tag:Status';values=""},@{name='tag:Site';values="SITENAME"}).Instances.InstanceId FollowComment"

Answer: "1Hi,Thank you for your rePost question. My name is RJ - an AWS Support Engineer who will be addressing your inquiry today.I understand from the examples provided, you are looking to return a list of EC2 Instances leveraging multiple tags as filters. Furthermore, I understand that one of the tags will have varying values.To meet your use-case, please consider the following DescribeInstances API example:## PowerShell## Creating first filter object, setting 'Status' tag to Wildcard ## Therefore, return any EC2 Instance with the tag 'Status' with any value$filterOne = New-Object -TypeName 'Amazon.EC2.Model.Filter' -ArgumentList 'tag:Status','*'## Creating second filter object, setting 'Site' tag to 'SITENAME'$filterTwo = New-Object -TypeName 'Amazon.EC2.Model.Filter' -ArgumentList 'tag:Site','SITENAME'$awsEx = (Get-EC2Instance -Filter @($filterOne,$filterTwo)).Instances.InstanceIdLooking more deeply into the DescribeTags API, I found the following.At this time, the DescribeTags API does not support multiple tags as filters, and therefore leveraging Python, PowerShell, and the AWS CLI render the same Null result. This behavior is expected since DescribeTags is intended to target a single tag, and then return the associated resources.That being said, DescribeTags does support multiple filters, such as Resource-Type, and Resource-Id.In order to leverage multiple filters with the DescribeTags API, please consider the following example:## PowerShell## Creating second filter object, setting 'Site' tag to 'SITENAME'$filterOne = New-Object -TypeName 'Amazon.EC2.Model.Filter' -ArgumentList 'tag:Site','Sitename'## Creating first filter object, setting 'Resource-Type' to 'Instance'$filterTwo = New-Object -TypeName 'Amazon.EC2.Model.Filter' -ArgumentList 'resource-type','instance'$awsEx = (Get-EC2Tag -Filter @($filterOne,$filterTwo)).ResourceIdIn the above example, the first filter instructs the DescribeTags API to target only the tag key/value pair 'Site'='Sitename'. After the API identifies that specific tag, the second filter instructs the API to return only EC2Instance resource types; ignoring VPCs, RouteTables, NatGateways etc.References:AWS EC2 DescribeTagsAWS EC2 DescribeInstancesCommentShareSUPPORT ENGINEERRJ-Danswered a year agoprolificeri a year agoHi RJ,Thanks much for your response on my question.  DescribeTags API is interesting and I will read the documentation regarding this, however, I was able to workout my solution with a colleague!It appears my initial solution was working but, it was only working to retrieve the overarching container containing the instances. Once I narrowed it down and used the correct cmdlet, it worked. Please see my solution below:$awsEx = (Get-EC2Instance -Filter @{name='tag:Status';values=""},@{name='tag:Site';values="SITENAME"}).Instances.InstanceIdShare"


Question: What are the re:Post community tiers' features and requirements?

"FAQs mention that there are 6 community tiers, which are also present on the My Dashboard page. What are the point requirements for each tier? What features are unlocked when one reaches a new tier?StackOverflow, for example, lists the privileges gained with increased reputation. I believe revealing the rewards motivates to take action.FollowComment"


Question: Amazon PIVOT bug?  "column does not exist"

"I'm trying to use the Amazon PIVOT feature and am encountering what appears to be a bug.  See minimal query and output below:> WITH t1 AS (select 1 as a) select 1 from t1 PIVOT (sum(a) for a in (1)) WHERE ('NaN'::FLOAT = 0);ERROR:  Query unsupported due to an internal error.DETAIL:  SQL reparse error.CONTEXT:  column "nan" does not exist in unnamed_pivot1.The literals in the where clause don't have anything to do with the pivot, so the error message does not seem accurate.  Is this indeed a bug?  Please let me know if I can provide any further information.  Thanks!FollowComment"

Answer: "-1The literal in the where clause is the problem. The query can't be parsed because there isn't a column named "nan".Are you trying to check for null with "nan"?CommentShareEXPERTjgrcloudanswered a year agomdrach a year agoSorry, not sure I understand your question.  Here's a query that gives the output that I expect.  The WHERE clause has nothing to do with the rest of the query in the OP or in this example.WITH t1 AS (select 1 as a) select 1 from t1 PIVOT (sum(a) for a in (1)) WHERE ('hello' = 'world'); ?column?----------(0 rows)Share"


Question: DNS configuration for  cPanel email forwarding

"I have successfully migrated a cPanel WordPress site from GoDaddy shared hosting to Lightsail. Domain registration and DNS management are still on GoDaddy. Having modified the top level domain and mail subdomain A records on GoDaddy to point to my Lightsail static IP, I can access my web site OK. However, the email forwarders I have set up in cPanel on Lightsail are not working. Changing the mail A record on GoDaddy back to its original value allows the cPanel forwarders on my GoDaddy site to work as before. Are there other DNS records that need to be added or modified for cPanel email forwarding on Lightsail to work? TIAFollowComment"

Answer: "0Hello, GrayBeard007,Thanks for using Lightsail!We get questions like this a lot so we wrote a doc on it: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-configuring-reverse-dnsThat procedure will step you through the process for enabling outbound SMTP on your instance.Thanks,DonleyCommentSharedonleyatawsanswered 2 years ago0Thanks for the reply. I eventually found out my problem was caused by the port 25 block, which has since been removed.CommentShareGrayBeard007answered 2 years ago"


Question: AMI scan for Marketplace

"I am scanning an AMI for AWS Marketplace and need to follow these guidelines:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/building-shared-amis.html. I am supposed to remove all keys (/.ssh/authorized_keys) for security reasons and use cloud-init to inject public keys but during scanning I get the error that AWS cannot ssh into the AMI because there is no key. so the dilemma is if (/.ssh/authorized_keys) are removed scanning cannot happen because AWS cannot ssh into the server, but if (~/.ssh/authorized_keys) is present then its a security issue and throws an error. I need solutions please!FollowComment"

Answer: "0Hi, the scanner doesn't need any ~/.ssh/authorized_keys to be present. In fact, the scanner will call out this as an issue if that file contains any keys.Just before you create your image (AMI) for AWS Marketplace from your running or stopped EC2 instance, you remove those authorized keys so that the image (AMI) is clean.CommentShareJoseph Shihanswered 7 months agorePost-User-4807537 7 months agoI have been to solve it by using the OS name that is associated with the AMI originally for the value BEFORE scanning, for example my AMI's OS name is ubuntu, but I was using ec2-user as OS user before scanning and was presented with that error.  Thanks Joseph you are right.ShareJoseph Shih 7 months agoThanks for the update! Glad it helped.Share0Thanks Joseph, But It still needs the ssh key pair that was provided on login to be able to scan the AMI or else it returns an error. so another way of phrasing the question is where do you locate the ssh key pair for scanning purposes which it clearly needs without placing it in the ~/.ssh/authorized_keys file?CommentSharerePost-User-4807537answered 7 months agoJoseph Shih 7 months agoHi, the way the scanner works to use keypair is the same way you would introduce your keypair in any generic AMI. When you try to launch a new EC2 instance from a public AMI of Amazon Linux 2 or Ubuntu, those AMIs have no keys in it. It is during the initial launch where you specify a keypair. Then EC2 will take care of adding the public key on-the-fly into the new EC2 instance. The scanner (and ultimately your customers) do the same thing. The expectation is that your AWS Marketplace customers are not using your keypair when they launch your AMI, they specify their own. Thus the AMI doesn't need your keypair when you publish it.Share0verbatim of the error I am getting:Issue found:Unable to connect using SSH on port 22 with the username [ec2-user] and the keypair provided at launch.Recommendation:Provide the correct username for the AMI. AMIs must support login with the keypair associated with the instance at launch.Meanwhile the username was provided for the AMI (ec2-user)CommentSharerePost-User-4807537answered 7 months agoJoseph Shih 7 months agoHave you confirmed that the SSH port is on the default port 22 and that the OS user is ec2-user? Is this how you log into the instance? If not, those two values can be changed in the scanner.Share"


Question: Lambda function from container - Missing Parent Directory

"I've a built a container image that I'm able to execute locally.  The container works well with aws-lambda-rie.However, when trying to create lambda function in the console with it, I encounter:"Failed to create the function xxxxxx : MissingParentDirectory: Parent directory does not exist for file: ./usr/share/doc/ca-certificates/copyright"The folder exists on the container. What could be causing this error? Are there other undocumented requirements for containers to be lambda compatible?FollowComment"

Answer: "0In our case the same error was seemingly caused by the missing directory entries in the image filesystem. You can verify their presence by first doing docker export to tar file:docker image ls# find out the image you needdocker create --name="image-export" <your-image-here>docker export "image-export" > "image-export.tar"docker rm "image-export"and then listing its contents via tar tf image-export.tar. The example ouput below contains directory entries (lines ending with "/")app/app/app.binbin/bin/bashbin/catThe image having those lines in tar tf output was working properly on Lambda while the image that haven't had them failed with error message similar to what you've encountered.CommentSharevzanswered a year ago0We tracked down the issue to distroless - https://github.com/GoogleContainerTools/distroless/blob/3cfaaa01d9e53c2cd17b9fba8e3877981f5b4349/cacerts/cacerts.bzl#L31Tar layer created with a file under /usr/share/doc/ca-certificates/copyright but without including empty folders for the tree structure leading up to it /usr, /usr/share, ... etc was causing the issue.CommentSharepiyushrptanswered a year ago"


Question: GlobalAccelerator+ALB: internal name disclosure vulnerability?

"Hi,we have a Global Accelerator in front of a private ALB as unique entry point for our applications.We noticed that, under some circumstances, the internal ALB name can be revealed:$ telnet 3.xxx.yyy.41 80Trying 3.xxx.yyy.41...Connected to 3.xxx.yyy.41.Escape character is '^]'.GET /images HTTP/1.0HTTP/1.1 301 Moved PermanentlyServer: awselb/2.0Date: Thu, 18 May 2023 08:54:23 GMTContent-Type: text/htmlContent-Length: 134Connection: closeLocation: https://internal-konvoy-prod-alb-xxxxxyyyyyyzzzz.eu-south-1.elb.amazonaws.com:443/images<title>301 Moved Permanently</title>
301 Moved Permanently
Connection closed by foreign host.or:$ curl -v -0 -H "Host:" http://3.xxx.yyy.41/images*   Trying 3.xxx.yyy.41:80...* TCP_NODELAY set* Connected to 3.xxx.152.41 (3.xxx.yyy.41) port 80 (#0)> GET /images HTTP/1.0> User-Agent: curl/7.68.0> Accept: */*>* Mark bundle as not supporting multiuse< HTTP/1.1 301 Moved Permanently< Server: awselb/2.0< Date: Thu, 18 May 2023 09:00:53 GMT< Content-Type: text/html< Content-Length: 134< Connection: close< Location: https://internal-konvoy-prod-alb-xxxxxyyyyyyzzzz.eu-south-1.elb.amazonaws.com:443/images<<title>301 Moved Permanently</title>
301 Moved Permanently
* Closing connectionAs far as I know, this is a security vulnerability classified as CVE-2000-0649 and, in general, a bad practice.FollowComment"

Answer: "2Accepted AnswerThe scenario you've described indeed exposes the internal ALB name in the 'Location' header when a 301 redirect is issued. While not a critical vulnerability, it provides unnecessary information that could potentially be used in sophisticated attacks.This seems to be the default behavior of ALB when handling redirects. To mitigate this, you have a few options:ALB Listener Rule: Add a Listener Rule on your ALB to handle the HTTP to HTTPS redirection, instead of having your backend do it. This way, the ALB name should not be exposed in the location header.Lambda@Edge: Use Lambda@Edge on CloudFront to modify the headers to strip out any sensitive information.Nginx Proxy: If you're using an Nginx server, you can use it as a proxy and modify the 'Location' header to avoid exposing the internal hostname.CommentShareEXPERTsdtslmnanswered 12 days ago"


Question: Where and how exactly does Secrets Manager store Secrets

"I just read the entire User Guide and unless I am missing something I found nothing that spells out exactly what is used to store secrets (S3, database, etc?) and what security controls/level of security is in place (other than the secrets being envelope encrypted by AWS KMS). I understand this is quite basic, but I can't find the information anywhere. I also watched Secrets Manager presentations from AWS on YouTube and none of them spelled out how things work behind the scenes.FollowComment"

Answer: "1In general, we don't talk about how services are built behind the scenes. They are managed services and they are designed to deliver the features that are in the documentation. While the implementation details may be interesting in general they aren't public. This also gives us the freedom to find different ways of implementing services which might increase performance or decrease the cost to customers. There are absolutely cases where we talk about these things; but for the most part we don't.In this case: Does knowing how the service work influence your decision to use it? Or change how you would use it?CommentShareEXPERTBrettski-AWSanswered 9 months ago"


Question: DynamoDb truncating attribute value upto certain length

"Hi AWS experts,I have a use case where I am trying to insert a large xml string as an attribute value to an item. I do see that the value is getting truncated to 32604 characters after saving it. I do know that an item max size can be 400KB which includes sum of all attribute names and attribute values and this is inclusive of the same item which is projected in LSI of that DynamoDB table. My question is this what is expected if we try to insert large String in an item ? Is my assumption correct ?FollowComment"

Answer: "1You can have string values in excess of 32kb in DynamoDB. I wouldn't want to do it frequently, but it's allowed.https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/ServiceQuotas.html says:"The length of a String is constrained by the maximum item size of 400 KB."My guess is something else in your stack is truncating the string if you're seeing truncation. It's not DynamoDB itself.CommentSharejzhunteranswered 2 months ago-1Accepted AnswerYes your assumption is likely to be correct if the item's other attributes add up to take it over 400Kb.Note DynamoDB is intended as on OLTP DB supporting large amounts of small operations.  If you have a large piece of data associated with your record it might not be best to store that directly in your database. You'll clog up the RAM and churn your disk I/O as you read and write that blob, and may get expensive.  Put the blob in S3 instead.  Your database record can include a pointer to the object in S3, and you can load it out when it's needed. S3 has a better pricing model for reading and writing large blobs of data, and it won't put extra strain on your database.CommentShareEXPERTskinsmananswered 2 months agoAritro Sen 2 months agoYes thanks for confirming.. This is exactly what I was also thinking as an alternative.Share"


Question: Additional Verification Required

"hello,I'm trying to connect my domain to AWS Amplify but I'm getting Additional Verification Required.My domain does not rank with Alexa top 1000 websites.Please assist me with signing a certificate and connecting my domain.RegardsSpotyfaFollowComment"

Answer: "1Hi There,I understand that you are trying to create a new certificate but are getting a failed error saying "Additional verification required to request certificates for one or more domain names in this request".Please note there are two ways this error could come up.When the certificate contains a domain that ranks within the Alexa top 1000 websites.[1]Or as of March 10, 2022 ACM has restrictions to issue new certificates until further notice for the following domains:.RU, .BY, Бел - Belarus, Рф - Russian Federation, .moscow, .москва - Moscow, .SU - Soviet Union, (http://ru.com/) .RU.COM, .РУС, .RU.NETPlease note that All Amazon certificates for these domains will remain functional until expiration, but will not be renewable and no new certificates from these domains will be issued. The only workaround that would work in your scenario would be to obtain a certificate from a third party that can issue a certificate for your domain, and import the certificate into ACM [2]I trust the above information is helpful to you.=========References=========[1] https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-failed.html#failed-additional-verification-required[2] https://docs.aws.amazon.com/acm/latest/userguide/import-certificate.htmlPlease note that I personally value your feedback, please accept this answer if you find it helpful to you.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months agoChris_G EXPERT9 months agoTo add to the above, .ir (Iran) ccTLDs are also also in the list of ACM restrictions.Share0Hello,Thanks for the quick reply,None of the options above applies to my case.I'm trying to connect a .ir domain to AmplifyRegardsCommentShareSpotyfaanswered 9 months ago"


Question: Is there a way to update connector configuration using MSK-connect API?

"I have an s3 connector deployed on MSK Connect, and a repository on github with the json connector configuration file. I'd like to update the connectors configuration on demand via MSK's REST API. I've checked the API documentatio, but it seems like the UpdateConnector API only allows to modify the capacity configuration. The CreateConnector API does allow to provide connector configuration, but it returns an error if the connector already exists. I could delete and then recreate the connector, but this doesn't seem like a good approach.Is there another way to update a running connector configuration?FollowComment"

Answer: "0Hi there, yes it is currently not possible to update the configuration, to pause or stop the connector. Any changes to the connector config requires recreating the connector. The ability to update a connector configuration (with different settings, and different custom-plugins) is currently in the roadmap to be included in the future. There is no ETA that we can provide at the moment but please keep a tab of https://aws.amazon.com/about-aws/whats-new/ for the upcoming improvements.CommentShareSUPPORT ENGINEERHarshith_Manswered a year agorePost-User-9458038 4 months agoHey !1 year passed since this comment, any news on that ?Any way to see the roadmap of the msk connector ?ThanksShare"