Question: How to deal with multiple duplicate keys (Fn::Sub) in a aws cloudformation template?

"I have a policy that is being made in a cloudformation template. I want to add two resources to the policy, they end up being arn::bucket and arn::bucket/*. The issue is that the arn is a parameter and I get the error: [cfn-lint] E0000: Duplicate resource found "Fn::Sub" (line 161). I understand that it doesn't like the duplicates."RolePolicies": {          "Type": "AWS::IAM::Policy",          "Properties": {              "PolicyName": "GetGEBucketPutCustomerBucket",              "PolicyDocument": {                  "Statement": [                      {                          "Action": [                            "s3:PutObject",                            "s3:GetObject",                            "s3:GetObjectAttributes",                            "s3:GetObjectTagging",                            "s3:ListBucket",                            "s3:DeleteObject"                          ],                          "Effect": "Allow",                          "Resource": {                              "Fn::Sub": [                                  "${arn}/*",                                  {                                      "arn": {                                          "Ref": "CustomerS3BucketARN"                                      }                                  }                              ],                              "Fn::Sub": [                                "${arn}",                                {                                    "arn": {                                        "Ref": "CustomerS3BucketARN"                                    }                                }                            ]                          }                      }                  ]              },              "Roles": [                  {                      "Ref": "InstanceRole"                  }              ]          },          "Metadata": {              "AWS::CloudFormation::Designer": {                  "id": "a713fcc6-95c8-423f-a5b8-0020a81e5ce4"              }          }      }However, this cloudformation is allowed to run, but produces errors. When viewing the policy in IAM console window after create, I see that both of the resources were not created.IAM policy editor gives me this error.Ln 1, Col 0Missing Version: We recommend that you specify the Version element to help you with debugging permission issues. since the resource than ends with /* wasn't created by cloud formation.FollowComment"

Answer: "0Hello, when adding multiple resources in the 'Resource' element of an IAM policy statement, to indicate the values to be of type list, in JSON, the comma-separated values have to be enclosed with [ ] and in YAML, individual resources have to be listed with '-'. The above is considered as a single resource with duplicate !Sub leading to the duplicate key issue. Following resource definition worked for me that you can consider testing:"RolePolicies": {          "Type": "AWS::IAM::Policy",          "Properties": {              "PolicyName": "GetGEBucketPutCustomerBucket",              "PolicyDocument": {                  "Statement": [                      {                          "Action": [                            "s3:PutObject",                            "s3:GetObject",                            "s3:GetObjectAttributes",                            "s3:GetObjectTagging",                            "s3:ListBucket",                            "s3:DeleteObject"                          ],                          "Effect": "Allow",                          "Resource": [                                {                                    "Fn::Sub": [                                        "${arn}",                                        {                                            "arn": {                                                "Ref": "CustomerS3BucketARN"                                            }                                        }                                    ]                                },                                {                                    "Fn::Sub": [                                        "${arn}/*",                                        {                                            "arn": {                                                "Ref": "CustomerS3BucketARN"                                            }                                        }                                    ]                                }                            ]                      }                  ]              },              "Roles": [                  {                      "Ref": "InstanceRole"                  }              ]          },          "Metadata": {              "AWS::CloudFormation::Designer": {                  "id": "a713fcc6-95c8-423f-a5b8-0020a81e5ce4"              }          }      }CommentShareSUPPORT ENGINEERSreshtha_Kanswered 6 months ago"


Question: A process unrecognized by GameLift is attempting to make GameLift Server SDK API calls. Are you using a process launcher?

"Hi,I am unable to run my executable on amazon gamelift. I've seen another post with this error, but it didn't help me resolve it.context:I am building a single C++ executable on an Amazon Linux 2, along with an install.sh script to install some third parties.I am calling InitSDK from the main executable.I have set it up like this in the fleet:/local/game/MyExecutableIt is not a shortcut, and I am not running a process launcher.I would like some help with this, as I have no clue why this is happening.Thanks!DavidFollowComment"

Answer: "0Accepted AnswerOk, I think found the issue. It seems to be a bug in the SDK 3.4.1Calling InitSDK will return Aws::GameLift::GAMELIFT_ERROR_TYPE::ALREADY_INITIALIZED . IsSuccess() returns false. I added an extra check:if (error.GetErrorType() != Aws::GameLift::GAMELIFT_ERROR_TYPE::ALREADY_INITIALIZED)Pretty much all SDK calls seem to behave this way. ProcessReady() also returns ALREADY_INITIALIZED as an error.Adding this extra check fixed it for me it seems, and now my simple test fleet is "active". I still need to make this work with my bigger project, but I think this was probably the issue here.Marking this as the solution. But the SDK needs to be checked for this bug. I am building the SDK without STD.CommentSharerePost-User-2813319answered 2 years ago0Hi @REDACTEDUSERWe typically see this error message when a process that tries to communicate with GameLift (via initSDK, processReady, etc.) is not the process in the runtime configuration.Does you fleet eventually go active? If so, how often do you see this error message?Is it possible that you are running other processes that are invoking GameLift SDK calls? (e.g. something that started from the install.sh?)It might be possible to find out which process is invoking GameLift SDK and generated this error message:a. Make sure you create your fleet with TCP port 22 open (you cannot update fleet port settings until the fleet is ACTIVE), so you can ssh into the fleet (see example script), run sudo su, and go to /local/whitewater/AuxProxy/logs to find the GameLift process manager logs.b. Look for SERVER_PROCESS_SDK_INITIALIZATION_TIMEOUT, prior to that, there should be a log SDK connected:... immediately followed by SDK disconnected:...; You can also use the timestamp of the fleet event error to narrow your search.c. In the SDK connected... message, see if you can find any information identifying the processAre you using the latest versions of the C++ SDK? (If you downloaded the SDK after 2020-09-17 then you should have the latest, see release notes) If not, please try using the latest version of the C++ SDK.If you need further assistance, please provide your region and fleet id to help us investigate.Related: https://forums.awsgametech.com/t/launch-bash-script-or-jar-is-it-possible/5829CommentSharerePost-User-7108006answered 2 years ago0Hi James,Thanks for the quick reply.It never goes active.No other processes. I install stuff first using install.sh, I see the log and looks fine. I am calling my executable and that's it. First thing I do is call InitSDK. I know the executable is called, because I played with return code and it changed.Ok I will attempt SSH into it. I was wondering how to get the logI am using the C++ SDK version 3.4.1More info:my fleet Id is : fleet-******REMOVEDUPLOADEverything looks good until that point.(edit): For the fail to report healthy, it's the InitSDK that takes forever to run. I think it tries to contact amazon gamelift and it fails to do so. Not sure if there is another outbound port I have to bind? I've bound TCP 22 and TCP 9313CommentSharerePost-User-2813319answered 2 years ago0Have you tried to test the integration with GameLift local? If not, please give that a try also: https://docs.aws.amazon.com/gamelift/latest/developerguide/integration-testing-local.htmlI am calling my executable and that’s it.Do you mean your install.sh script is calling your game server executable? If so, it would make sense why you are seeing this error. You should be passing the server launch path in CreateFleet's RuntimeConfiguration argument, see "Server Process Allocation" in https://docs.aws.amazon.com/gamelift/latest/developerguide/fleets-creating.html. On instance start up, GameLift takes care of running the game server process that you specified in the runtime configuration. This is the only process that can call SDK method, any other processes that tries to invoke SDK calls are not allowed.Not sure if there is another outbound port I have to bind? I’ve bound TCP 22 and TCP 9313Nope, GameLift takes care of reserving the outbound port that it needs to communicate with the service, so that shouldn't be the issue.Please let us know if you have any luck with the SSH approach.CommentSharerePost-User-7108006answered 2 years ago0Sorry, by "calling my executable" I mean I've set up in the fleet the executable and nothing else. /local/game/MyExecutableI am not calling it by the intermediate of a shortcut or other process.I'll be looking at the ssh and local today. Could be hard to setup, because I am on windows, and building my code inside a docker container (amazonlinux:latest)CommentSharerePost-User-2813319answered 2 years ago0From the doc,Only instances in active fleets can be remotely accessedMine never get active, so I'll try the other solution to gamelift local...CommentSharerePost-User-2813319answered 2 years ago0So I was still able to SSH into it (Doc is wrong :) ) but I cannot find the specified log file. There is no logs folder under AuxProxy. There is a logs folder on the parent but none called gamelift process manager.REMOVEDUPLOADI am unsure if those other logs are related to this. I cannot find SERVER_PROCESS_SDK_INITIALIZATION_TIMEOUT in them.CommentSharerePost-User-2813319answered 2 years ago0I also tried to run the executable directly from SSH. Here is the log I see if it can help track down:[2021-06-23 12:18:07] [connect] Successful connection[2021-06-23 12:18:07] [connect] WebSocket Connection 127.0.0.1:5757 v-2 "WebSocket++/0.5.1" /socket.io/?EIO=4&transport=websocket&t=1624450687&pID=20533&sdkLanguage=Cpp&sdkVersion=3.4.1 101[2021-06-23 12:18:07] [connect] Successful connection[2021-06-23 12:18:07] [connect] WebSocket Connection 127.0.0.1:5757 v-2 "WebSocket++/0.5.1" /socket.io/?EIO=4&transport=websocket&t=1624450687&pID=20533&sdkLanguage=Cpp&sdkVersion=3.4.1 101[12:18:07:0522] Failed to GameLift::InitSDK():that last line is from my code, and I am attempting to print the error message but it's empty:auto gamelift_outcome = Aws::GameLift::Server::InitSDK();if (!gamelift_outcome.IsSuccess()){    auto error = gamelift_outcome.GetError();    log("Failed to GameLift::InitSDK(): %s\n", gamelift_outcome.GetError().GetErrorMessage());    return 1;}CommentSharerePost-User-2813319answered 2 years ago0If you can help me look into it a bit more would be great:Region: us-west-2Fleet id: fleet-******CommentSharerePost-User-2813319answered 2 years ago0Ok i ran gamelift local, then ran my executable. And I get this, several times, after calling InitSDK[2021-06-23 14:15:25] [info] asio async_connect error: system:111 (Connection refused)[2021-06-23 14:15:25] [info] Error getting remote endpoint: system:107 (Transport endpoint is not connected)[2021-06-23 14:15:25] [error] handle_connect error: Underlying Transport ErrorCould there be a bug with this C++ SDK version? Or did I skip a step somewhere :thinking:There is no other log, no other calls done. It mirrors pretty much what we were seeing in the fleet. InitSDK fails then keep retrying for a few minutes.CommentSharerePost-User-2813319answered 2 years ago0Okay, good to know that it's reproducible on GameLift local, at least we can iterate much more quickly on the fix.I have submitted a request for the GameLift team to take a lookP48992119CommentSharerePost-User-7108006answered 2 years ago0@REDACTEDUSERWe've checked on our end that 3.4.1 C++ SDK is working as expected, i.e. no hangs after initSDK. I'll DM you the test app source code.If you tried this and still have issues, could you please provide us some code snippet for your server executable?CommentSharerePost-User-7108006answered 2 years ago0I will try to build your unit tests using the same environement. Could my problem be because I don't build it on Ubuntu, but I build it inside a AmazonLinux2 env directly? (I thought that would be the only way to build this)CommentSharerePost-User-2813319answered 2 years ago0Hi @REDACTEDUSERthe code you gave me, are we sure we're talking about the exact same SDK? I see you have code like this:// Init AWS Sdk for usageAws::SDKOptions options;Aws::InitAPI(options);Which I don't seem to have. I am supposed to call InitSDK first, and the documentation specifies it's the first thing I should call.I confirm that the version of the SDK I am building is: GameLift-Cpp-ServerSDK-3.4.1In that SDK folder, I have no such file as Aws.h.I'll try to compare your CMakeLists.txt with mine and see if there is something I missed. Could that file be generated in any other way? I am building the SDK as per the documentation:cmake3 -DCMAKE_BUILD_TYPE=Release VERBOSE=1 ..make -j16P.S.: I saw this InitAPI in the game example on github too, but I didn't make much of it, thinking it was probably using a much older API.(edit) It appears I am missing "AWSSDK". I don't recall seeing this as requirement, I knew I missed an important step. Trying to figure out how to install that one. Will marked this post as the solution if this works.CommentSharerePost-User-2813319answered 2 years ago0Aws::InitAPI is used to send testing data to SQS (to help us verify that players joined, game session created, etc.), it shouldn't have anything to do with the iniSDK() issue that you are seeing.You could really strip the code down to only calling initSDK() and processReady(), similar to https://github.com/aws-samples/aws-gamelift-sample/blob/master/GomokuServer/GomokuServer/GameLiftManager.cpp#L54-L93If your code is simple enough but initSDK() is still hanging, then it's possible that your SDK is the root cause. Could you verify that you followed all the steps correctly in the README that came with the C++ SDK?CommentSharerePost-User-7108006answered 2 years ago0Hi James, Ok thanks. Good to know, so I only need server SDK.I took a different approach this time. Simple project, 1 file and I am now building it in Ubuntu instead of directly on AmazonLinux2 EC2.This is the simplest test I could do, and it still fails with:A process unrecognized by GameLift is attempting to make GameLift Server SDK API calls. Are you using a process launcher?I first build the Server SDK. Then I create a CMake for my code like so:cmake_minimum_required(VERSION 3.0.0)project(simple)add_executable(${PROJECT_NAME} main.cpp)# Setup includes and linked librariestarget_include_directories(${PROJECT_NAME} PUBLIC     ${CMAKE_SOURCE_DIR}/GameLift-Cpp-ServerSDK-3.4.1/build/prefix/include)set(GAMELIFT_BIN_DIR ${CMAKE_SOURCE_DIR}/GameLift-Cpp-ServerSDK-3.4.1/build/prefix/lib)target_link_libraries(${PROJECT_NAME} PUBLIC     ${GAMELIFT_BIN_DIR}/libaws-cpp-sdk-gamelift-server.a    ${GAMELIFT_BIN_DIR}/libprotobuf.a    ${GAMELIFT_BIN_DIR}/libsioclient.a    ${GAMELIFT_BIN_DIR}/libboost_date_time.a    ${GAMELIFT_BIN_DIR}/libboost_random.a    ${GAMELIFT_BIN_DIR}/libboost_system.a)The main.cpp file:#include <stdio.h>#include <aws/gamelift/server/GameLiftServerAPI.h>#define PORT 9313#define log(...) { printf(__VA_ARGS__); }int main(int argc, char *argv[]){    log("Hello Gamelift!\n");    // InitSDK    Aws::GameLift::GenericOutcome initOutcome = Aws::GameLift::Server::InitSDK();    if (!initOutcome.IsSuccess())    {        auto error = initOutcome.GetError();        log("Failed to GameLift::InitSDK(): %s\n  %s\n  %s\n",             error.GetErrorName(),             error.GetErrorMessage(),             error.GetDefaultNameForErrorType(error.GetErrorType()));        return 1;    }    // ProcessReady    Aws::GameLift::Server::ProcessParameters processParameters(        [](Aws::GameLift::Server::Model::GameSession gameSession, void* cbObject)        { // onStartGameSession            // game properties        }, nullptr,        [](Aws::GameLift::Server::Model::UpdateGameSession, void* cbObject)        { // onUpdateGameSession        }, nullptr,        [](void* cbObject)        { // onProcessTerminate        }, nullptr,        [](void* cbObject) -> bool        { // onHealthCheck            return true;        }, nullptr,        PORT, // port        {} // logParameters    );    auto gamelift_outcome = Aws::GameLift::Server::ProcessReady(processParameters);    if (!gamelift_outcome.IsSuccess())    {        auto error = gamelift_outcome.GetError();        log("Failed to GameLift::ProcessReady(): %s\n", gamelift_outcome.GetError().GetErrorMessage());        return 2;    }    // ProcessEnding    Aws::GameLift::Server::ProcessEnding();    return 0;}I have a feeling it's not the code, but it's a permission thing maybe?Fleet ID: fleet-****Side note:I found a bug. While testing with gamelift local, calling InitSDK will return Aws::GameLift::GAMELIFT_ERROR_TYPE::ALREADY_INITIALIZED. IsSuccess is false before of this. I added an extra check:        if (error.GetErrorType() != Aws::GameLift::GAMELIFT_ERROR_TYPE::ALREADY_INITIALIZED)Is this normal? I am calling InitSDK once.CommentSharerePost-User-2813319answered 2 years ago0Glad that you are unblocked. I'll cut a ticket for the GameLift team to investigate.Could you share your build process with us if you wouldn't mind? E.g. commands to run CMAKE. Thanks!P48992119CommentSharerePost-User-7108006answered 2 years ago0Sure.All commands below are performed inside WSL (Ubuntu on windows)Created an empty folder for the new projectCopied GameLift-Cpp_ServerSDK-3.4.1/ into itBuild GameLift-Cpp_ServerSDK-3.4.1cd GameLift-Cpp_ServerSDK-3.4.1mkdir buildcd buildcmake ..makecd ../..Create main.cpp#include <stdio.h>#include <aws/gamelift/server/GameLiftServerAPI.h>#define PORT 9313#define log(...) { printf(__VA_ARGS__); }int main(int argc, char *argv[]){    log("Hello Gamelift!\n");    // InitSDK    Aws::GameLift::GenericOutcome initOutcome = Aws::GameLift::Server::InitSDK();    if (!initOutcome.IsSuccess())    {        auto error = initOutcome.GetError();        log("Failed to GameLift::InitSDK(): %s\n  %s\n  %s\n",             error.GetErrorName(),             error.GetErrorMessage(),             error.GetDefaultNameForErrorType(error.GetErrorType()));        return 1;    }    // ProcessReady    Aws::GameLift::Server::ProcessParameters processParameters(        [](Aws::GameLift::Server::Model::GameSession gameSession, void* cbObject)        { // onStartGameSession            // game properties        }, nullptr,        [](Aws::GameLift::Server::Model::UpdateGameSession, void* cbObject)        { // onUpdateGameSession        }, nullptr,        [](void* cbObject)        { // onProcessTerminate        }, nullptr,        [](void* cbObject) -> bool        { // onHealthCheck            return true;        }, nullptr,        PORT, // port        {} // logParameters    );    auto gamelift_outcome = Aws::GameLift::Server::ProcessReady(processParameters);    if (!gamelift_outcome.IsSuccess())    {        auto error = gamelift_outcome.GetError();        log("Failed to GameLift::ProcessReady(): %s\n  %s\n  %s\n",             error.GetErrorName(),             error.GetErrorMessage(),             error.GetDefaultNameForErrorType(error.GetErrorType()));        return 2;    }    // ProcessEnding    Aws::GameLift::Server::ProcessEnding();    return 0;}Create CMakeLists.txtcmake_minimum_required(VERSION 3.0.0)project(simple)add_executable(${PROJECT_NAME} main.cpp)target_include_directories(${PROJECT_NAME} PUBLIC     ${CMAKE_SOURCE_DIR}/GameLift-Cpp-ServerSDK-3.4.1/build/prefix/include)set(GAMELIFT_BIN_DIR ${CMAKE_SOURCE_DIR}/GameLift-Cpp-ServerSDK-3.4.1/build/prefix/lib)target_link_libraries(${PROJECT_NAME} PUBLIC     ${GAMELIFT_BIN_DIR}/libaws-cpp-sdk-gamelift-server.a    ${GAMELIFT_BIN_DIR}/libprotobuf.a    ${GAMELIFT_BIN_DIR}/libsioclient.a    ${GAMELIFT_BIN_DIR}/libboost_date_time.a    ${GAMELIFT_BIN_DIR}/libboost_random.a    ${GAMELIFT_BIN_DIR}/libboost_system.a)Build simple servermkdir buildcd buildcmake ..makecd ..Copy executable to a finalbuild foldermkdir finalbuildcp ./build/simple ./finalbuild/Upload buildaws gamelift upload-build --name simple --build-version 1.0.0 --build-root ./finalbuild --operating-system AMAZON_LINUX_2 --region us-west-2You will run into issues where you need openssl-1.0 for your SDK to build. And if you build this inside an EC2 Linux2, you need to use cmake3 command instead.CommentSharerePost-User-2813319answered 2 years ago0Hi David-I think I see what's going on here, though I'm not positive on the nuances.  I believe what's happening is that the two methods you refer to are returning a GenericOutcome(nullptr).  Then that is picking up the constructor for GenericOutcome(GameLiftError) instead of GenericOutcome(void*).  GameLiftError is an enum and the first value (ordinal 0) is ALREADY_INITIALIZED.  This lines up with what you're seeing for ProcessReady, for which that return shouldn't even be possible.This is not really good coding convention on our side and I've cut a tracking item to ensure that we follow a better pattern (not relying on this sketchy implicit conversion path) in the next revision of the SDK.  On your side, I suspect there could either be a compiler bug or incomplete C++ 11 support that treats nullptr as 0 instead of a pointer.  Updating to a more recent compiler might fix that.  If not, the workaround you've specified above should be harmless and sufficient.CommentSharerePost-User-0985817answered 2 years ago0Thanks Brian!@REDACTEDUSERCommentSharerePost-User-7108006answered 2 years ago"


Question: AWS SES incoming response track

"I am using the AWS SES service. We have sent emails, and I would like to track the replies/responses. Is there a way to manage this?So basically how we can store or access the incoming emails.FollowComment"

Answer: 0You may be interested inSES Receipt Ruleshttps://docs.aws.amazon.com/ses/latest/dg/receiving-email-receipt-rules-console-walkthrough.htmlYou could have a rule for replies to specific email addresses perform actions like invoking a Lambda function.  The rules can also store the messages in S3 or send to WorkMail.CommentSharetedtrentanswered 6 months ago


Question: Occasional 'The Token can't be used before...' error after Cognito authentication

"We are authenticating with AWS Cognito and using the resultant AccessToken for access to our Java API, which is using the Auth0 jwt library. We are occasionally seeing this error:InvalidClaimException: The Token can't be used before <x>...Where x is in the future, according to both our alerting software and our Slack instance where alerts are additionally sent to.We've added an 'acceptLeeway' of 30seconds, which reduced the occurrences but we're still occasionally seeing errors - x is now always 30 seconds in the future.Beyond increasing the leeway further, any thoughts?FollowComment"

Answer: "0Hello Tom,Greetings from AWS !The error indicates that, your application where the token is being used has not reached the time when the token is issued. To sync your application server's time with Amazon, please refer to document [1].Further, I have found a relevant third-party Github repo issue [2] which may be helpful for you in this scenario. Please note that third-party resources are shared on best effort basis and AWS will not be able to vouch for the accuracy of the content being provided. Kindly ensure to test in your development environment before using in production.--References--[1] https://aws.amazon.com/blogs/aws/keeping-time-with-amazon-time-sync-service/[2] https://github.com/auth0/java-jwt/issues/467CommentShareSUPPORT ENGINEERTarit_Ganswered a year ago"


Question: Trouble with "Deploy a Web Application on Amazon EC2" training module

"Hi There!I'm following the instructions in the Deploy a Web Application on Amazon EC2 training guide and it says "Go to the file /lib/cdk-ecs-infra-stack.ts, this is where you will write the code for the resource stack you are going to create." once you've installed the ec2 cdk, however that file isn't there.Has anyone run into this before?FollowComment"

Answer: "0Hello! I assume your question is in reference with the training module here. I see that the module does mention Go to the file /lib/cdk-ecs-infra-stack.ts. Instead could you go to the file at ./lib/ec2-cdk-stack.ts and continue with the steps outlined in the module. Please give this a try and let us know if you are running into any issues.  That being said, I apologize for the inconvenience and have provided feedback to documentation team to have this corrected.CommentShareDeepakanswered a year ago"


Question: How can I use Math for CustomizedMetricSpecification using application-autoscaling for ECS

"Hi guys,I've found that is possible to use math in a target tracking scaling policy for Amazon EC2 Auto Scaling (https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-target-tracking-metric-math.html)I've tried to use same config in application auto-scaling for service-namespace ECS without successThis is my config{    "CustomizedMetricSpecification": {        "Metrics": [            {                "Label": "ack_total",                "Id": "m1",                "MetricStat": {                    "Metric": {                        "MetricName": "rabbitmq_queue_messages_ack_total[switch_events]",                        "Namespace": "Prometheus"                    },                    "Stat": "Average"                },                "ReturnData": false            },            {                "Label": "published_total",                "Id": "m2",                "MetricStat": {                    "Metric": {                        "MetricName": "rabbitmq_queue_messages_published_total[switch_events]",                        "Namespace": "Prometheus"                    },                    "Stat": "Average"                },                "ReturnData": false            },            {                "Label": "Relation (ack_total + 1) / (published_total + 1)",                "Id": "e1",                "Expression": "(m1 + 1)/(m2 + 1)",                "ReturnData": true            }        ]    },    "TargetValue": 1.0}This is the command I've used:aws application-autoscaling put-scaling-policy --service-namespace ecs --policy-name rabbitmq-pub-ack-scaling-policy --scalable-dimension ecs:service:DesiredCount --resource-id "service/XXXXX/events"  --policy-type TargetTrackingScaling --target-tracking-scaling-policy-configuration file://alarm-definition.jsonI'm getting this error:Parameter validation failed:Missing required parameter in TargetTrackingScalingPolicyConfiguration.CustomizedMetricSpecification: "MetricName"Missing required parameter in TargetTrackingScalingPolicyConfiguration.CustomizedMetricSpecification: "Namespace"Missing required parameter in TargetTrackingScalingPolicyConfiguration.CustomizedMetricSpecification: "Statistic"Unknown parameter in TargetTrackingScalingPolicyConfiguration.CustomizedMetricSpecification: "Metrics", must be one of: MetricName, Namespace, Dimensions, Statistic, Unitbased on doc available in https://docs.aws.amazon.com/autoscaling/application/APIReference/API_CustomizedMetricSpecification.htmlseems impossible to use a custom metric with mathBest regards.FollowComment"

Answer: "0Accepted AnswerHello,Metric math support for EC2 AutoScaling (ASG) target tracking policies was just recently launched: https://aws.amazon.com/about-aws/whats-new/2022/12/amazon-ec2-auto-scaling-supports-metric-math-target-tracking-policies/While there are currently plans to add this to Application AutoScaling in the future, its not currently supported and we're not able to comment on if/when the feature will be released.  In the meantime, for your usecase you would need to either:create a custom metric in cloudwatch which represents the expression, and base the target tracking policy on that single metricUse StepScaling with the math expressionCommentShareShahad_Canswered 5 months agoIuri Diniz 5 months agoThank you, that was the question I had and you managed to clear it up for me. I was wondering if there was something missing from the docs or this feature was just not implemented. I needed to resolve this question before doing something custom. Now I'm going to customize it as you suggested.Share0You can use math expressions in the CustomizedMetricSpecification parameter of the RegisterScalableTarget action of the Application Auto Scaling service to specify the metric to scale on and the dimensions for the metric.Here is an example of how to use math expressions in the CustomizedMetricSpecification parameter:CustomizedMetricSpecification:MetricName: "mymetric"Namespace: "mynamespace"Dimensions:- Name: "InstanceId"Value: !Ref MyEC2InstanceStatistic: "Average"Unit: "Count"MetricScale: 1MetricType: "Custom"ResourceLabel: !Sub "${ECS_CLUSTER_NAME}/task/${TASK_DEFINITION_NAME}"In this example, the MetricScale parameter specifies a scale factor to apply to the metric. The ResourceLabel parameter uses the !Sub intrinsic function to substitute variables in a string template with their actual values.You can use other intrinsic functions, such as !If, !Join, and !Ref, in the CustomizedMetricSpecification parameter to customize the metric specification.CommentShareSeanSianswered 5 months agoIuri Diniz 5 months agoCould you reformat the example?Share0@Shahad_C the docs imply support for math expression with EC2 ASG Target Tracking. But I couldn't find any way to use this with "CustomizedMetricSpecification" (i'm getting the same error as mentioned here).The only thing I did find, is the support for math expression with "Advanced predictive scaling policy" (e.g. PredictiveScaling) but not for TargetTrackingScaling.Are the docs wrong? can you share an example of an TargetTrackingScaling policy using an alarm based on math expression?Thanks!CommentSharestamanswered 4 months agoShahad_C 4 months agoHi @stam - this is a very new feature in EC2 AutoScaling, so my guess is your CLI version is out of date and doesn't support these new parameters yet if your error message is similar to the one shared in this post.  Try updating the CLI and seeing if you still get the same errorsShare"


Question: LoRaWAN duplicate uplink messages arrived from multiple gateways - Does it filtered?

I wanted to ask how the LoRaWAN server filter (if at all) duplicate uplink messages that received by two or more GW and transmitted to the server.FollowComment

Answer: 1Hi. It's the responsibility of the LoRaWAN Network Server to perform de-duplication and AWS IoT Core for LoRaWAN does indeed implement this. It keeps the message with the strongest RSSI.CommentShareEXPERTGreg_Banswered a year ago


Question: Unknown Unicast traffic forwarding support within a subnet

"Does unknown unicast traffic forwarding support within a subnet?As part of Gigamon visibility, we do packet broking. One of our customer wanted to sent the packets directly to the tools VM without any tunnel mechanism. Hence, we need to support unknown unicast flooding support within a subnet. Is this supported in AWS Subnet.FollowComment"

Answer: "4Accepted AnswerIn general, AWS does not support unknown unicast flooding within its virtual private cloud (VPC) environment, which is the default network environment for most AWS deployments. Instead, AWS uses a variety of mechanisms to manage network traffic and improve network performance, including virtual private networks (VPNs), peering connections, and direct connect services.If your customer requires support for unknown unicast flooding within their AWS subnet, it may be necessary to work with AWS support or a network specialist to design a custom solution that meets their specific requirementsCommentShareEXPERTsedat_salmananswered 2 months agoEXPERTBrettski-AWSreviewed 2 months ago"


Question: NLB WITH SEVERAL SERVICES IN EKS

0I am trying to design a network load balancer in eks which is being utilised by several services on the namespaceI designed a network load balancer in eks but now I need to add on other services for my microservice architecture. How do I configure my nlb to use several servicesFollowComment

Answer: "0Generally, You can do that with ingress Controller on ALB.Most of case, ALB will be recommended option.Otherwise, you can do with NLB by defining some annotations.You need to define Ingress resources for each of your services instead of service resources.the only service will be in front of you ingress controller, and that will be the NLB.Flow : NLB -> Nginx Ingress Service -> My ServiceRefer : https://aws.amazon.com/blogs/opensource/network-load-balancer-nginx-ingress-controller-eks/CommentShareByungho Leeanswered 3 months ago"


Question: MediaTailor Ad Insertion Automation - Any Ideas?

"I've had good success with MediaTailor in terms of adding pre-roll ads and mid-roll ads during Program specification. The issue now is automation: while I can manually add ad breaks as part of the program information, this is a cumbersome process for long-form VOD (specifically movies). Does anyone know how to automatically create ad breaks - on par with "put an ad break every 5 minutes in this two hour movie" without having to individually specify each break in milliseconds?FollowComment"


Question: Need help in connecting Remote - SSH from Dev Env to Windows

Hello everyone I am trying to do Remote SSH for quite some time and unable to make it work .The problem :Trying to connect to Aws Codecatalyst Dev environment Linux(remote ssh) to my local windows machine and it is in an endless loop of " Setting up SSH Host aws -exampleID".I had tried it with my remote ubuntu aws workspace and it works flawlessly (ubuntu remote workspace to Aws codecatalyst Dev Environment) so it seems like some issue with my local machine .Things I have tried:When comparing the logs of failed vs successful I have noted that the remote.SSH.useLocalServer was true in my success log. So tried to add this to the settings.json but during run time it automatically changes from true to false .Also tried clean uninstall and install couple of times (remove appData and ssh config files)I have added an image of log of the failed Remote SSH .Would appreciate if Remote SSH users can take a look into the logs and give their insightsFollowComment

Answer: 0Hi Alaguraja - I'm so sorry you encountered this issue. Our Dev Environment team is looking into the issue now. I'll respond once they come back with guidance. In the meantime could you please let us know what version of VSCode are you using?CommentShareMODERATORSundaresh_Ianswered 5 months agoSundaresh_I MODERATOR5 months agoWe couldn't reproduce the issue. Could you please share the VSCode version that you are using ?Share


Question: how to configure ideal value for MaxConcurrentTransforms in setting up a sagemaker batch transform ?

"based on the documentation , https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html, it states that " The ideal value for MaxConcurrentTransforms is equal to the number of compute workers in the batch transform job." how to figure out what the number of compute workers is , i assume this depends on the instance type. also what about the instance count parameter we can set , do we have to take that into account as well?FollowComment"

Answer: "0Accepted AnswerThe ideal value for MaxConcurrentTransforms varies based on instance type as well as based on your specific model.it could make sense to increase MaxConcurrentTransforms up to the core count of the instance you are using (for cpu based transform), however, you should also take into account the memory utilisation by your model.The ultimate answer is it "depends" and I would recommend that you experiment with increasing this number gradually from 1 up to instance core count, while monitoring RAM/cpu utilisation to find the optimal.CommentSharegeorgios_sanswered a year agoclouduser a year ago@georgios_s - thanks . You pointed out instance count for the cpu based instances , if you don’t mind could you elaborate what would be the case for gpu basedShare"


Question: AWS IoT + AWS Amplify Android  + Android

"Hello,We are looking at the documentation to build an Android App to Subscribe&Publish commands on AWS IoT.The documentation says it is now recommended to use new AWS Amplify Android SDK for all new applications.We did so and we also managed to use the new Authenticator UI in Compose and sign up & sign in.After a couple of days (documentation is quite unorganized), we made it and all was going well... at least until we figured out the new Amplify SDK for Android doesn't has any reference to PubSub module (which the Mobile SDK has).We are stuck.  Is there anything we are missing in the documentation, or it isn't implemented at all (will it ever be?) ?Should we go back using the "old" not recommended Mobile SDK to login using cognito as credential provider (https://docs.amplify.aws/sdk/pubsub/getting-started/q/platform/android) + AWS Android SDK to make use of aws iot module ? Also, in this case, can we still use the Authenticator UI Component (https://github.com/aws-amplify/amplify-ui-android/tree/main/authenticator) or we should build the UI and logics behind it ?That's mainly because we cannot seem to get the AWSMobileClient object anywhere using the recommended Amplify Android SDK, which i necessary to initialize for AWS IoT.Thank you in advance.FollowComment"


Question: Does an EC2 gracefully shut down when I terminate it?

"I have an EC2 instance that runs a spring boot java application as a service, meaning the service will automatically start up after the EC2 rebooted and will also automatically shut down when the stop action is called on the EC2 instance. But what happens when I terminate the EC2 instance? Will the java application running on the instance be allowed to gracefully shut down before the EC2 instance is terminated or are all process halted abruptly on termination?I would also like to know how long a stopping EC2 instance will wait for a service to gracefully shut down and if there is a way to configure this waiting time.ThanksFollowComment"

Answer: "0According to the docs:When an EC2 instance is terminated using the terminate-instances command, the following isregistered at the OS level:* The API request will send a button press event to the guest.* Various system services will be stopped as a result of the button press event. systemd handles a graceful shutdown of the system. Graceful shutdown is triggered by the ACPI shutdown button press event from the hypervisor.* ACPI shutdown will be initiated.* The instance will shut down when the graceful shutdown process exits. There is no configurable OS shutdown time.CommentShareEXPERTkentradanswered a month agoViridios a month agowhat is ment by 'guest'? Furthermore you say that there is no configurable shutdown time. Does that mean that the termination process will hang indefinately if the systemd process does not shutdown properly and hangs?ShareMikel Del Tio a month agoHi Viridios,According to Amazon User Guide for Linux Instances, if the instance OS does not shut down cleanly within a few minutes, a hard shutdown is performed. Even so, If the instance remains in the shutting-down state for several hours, Amazon EC2 treats it as a stuck instance and forcibly terminates it.Sharekentrad EXPERTa month agoThe guest is your instance, from the hypervisor point of view.Sharekentrad EXPERTa month agoThe guest is your instance, from the hypervisor point of view.Share"


Question: [URGENT] AWS SSO Failing with botocore.exceptions.ClientError: An error occurred (InternalServerException) when calling the GetRoleCredentials operation (reached max retries: 4): internal error

"Hello,Starting in recent hour today we cannot login using SSO from external (standalone) applications, we have done no change in our side.The AWS management console works, however, 3rd party desktop applications are not working, this is across the board issue.I try to manually trigger SSO with a test program, I get the exception: botocore.exceptions.ClientError:An error occurred (InternalServerException) when calling the GetRoleCredentials operation (reached max retries: 4): internal errorThe sequence is based on the AWS examples available and provided below, it worked perfectly until recent hours.Does anyone experience the same? What is the right channel to provide the information to AWS?Regards,Alon#!/usr/bin/env python3import boto3.sessionimport timeimport typingdef awssso(    sso_start_url: str,    sso_region: str,    sso_account_id: str,    sso_role_name: str,    region: str,    urlopenner: typing.Callable[[str], None] = lambda url: print(        f"Please open URL: {url}"    ),) -> tuple[boto3.session.Session, None]:    session = boto3.session.Session()    sso_oidc = session.client("sso-oidc", sso_region)    client_creds = sso_oidc.register_client(        clientName="myapp",        clientType="public",    )    device_authorization = sso_oidc.start_device_authorization(        clientId=client_creds["clientId"],        clientSecret=client_creds["clientSecret"],        startUrl=sso_start_url,    )    urlopenner(device_authorization["verificationUriComplete"])    for n in range(        device_authorization["expiresIn"] // device_authorization["interval"]    ):        time.sleep(device_authorization["interval"])        try:            token = sso_oidc.create_token(                grantType="urn:ietf:params:oauth:grant-type:device_code",                deviceCode=device_authorization["deviceCode"],                clientId=client_creds["clientId"],                clientSecret=client_creds["clientSecret"],            )            break        except sso_oidc.exceptions.AuthorizationPendingException:            pass    else:        raise RuntimeError("Timeout while waiting for authorization")    role_creds = session.client("sso", sso_region).get_role_credentials(        roleName=sso_role_name,        accountId=sso_account_id,        accessToken=token["accessToken"],    )["roleCredentials"]    role_expiration = time.gmtime(role_creds["expiration"] / 1000)    return (        boto3.session.Session(            region_name=region,            aws_access_key_id=role_creds["accessKeyId"],            aws_secret_access_key=role_creds["secretAccessKey"],            aws_session_token=role_creds["sessionToken"],        ),        role_expiration,    )def test() -> None:    session, ttl = awssso(        sso_start_url="https://<snip>.awsapps.com/start",        sso_region="us-east-1",        sso_account_id="<snip>",        sso_role_name="<snip>",        region="us-east-1",    )    print(f"Identity: {session.client('sts').get_caller_identity()}")    print(f"TTL: {ttl}")    for b in session.resource("s3").buckets.all():        print(b)if __name__ == "__main__":    test()FollowComment"

Answer: "0Me and a co-worker has same error when using: aws sts assume-role command ;/ We can't log in since this morning. We didn't change anything so it looks definitely like AWS InternalServerExceptionResults:An error occurred (InternalServerException) when calling the GetRoleCredentials operation (reached max retries: 2): internal errorCommentSharerePost-User-2836916answered 8 months ago0Working now, more than 1 hour of outage which did not appear in the AWS health dashboard.CommentShareAlon Bar-Levanswered 8 months ago"


Question: Tips for handling overlapping intents? (Lex v2)

"For my use case, we have defined a Greeting intent and 2 domain-specific intents - let's call them IntentA and IntentB.The Greeting intent is trained on obvious openers like 'Hi', 'Hello', 'Hello <botname>', 'Good morning' and so forth. The bot will respond by greeting the user and informing them what the bot can help with.For intents A and B, we are building the utterance lists with the aid of pre-bot transcripts from real users.The issue is, many users naturally ask for intentA and intentB with a greeting phrase followed by their main intent. For example, 'Good morning, can you please help me <complete intentA>' or 'Hi there, I need to <complete intentB>'.Since Lex does not appear to offer muiti-intent detection within a single utterance, what would be the recommended approach?Here are the strategies we're considering:Train the Greeting intent on the greeting strings, and train intents A + B using phrases both with and without greeting text. (Assumption: Lex would learn that isolated greetings should match the Greeting intent, otherwise the intent-specific content should take precedence)Train the Greeting intent as above, but train A + B with no greeting content. (Assumption: greeting phrases are shorter, therefore the salient portion of the user's utterance would likely be given more weight by Lex...but would this generalize if phrase lengths were equal across all 3 intents?)Remove the Greeting intent and do not include greeting words in A + B training utterances. (Assumption: Greeting words in an intent would be ignored, and on their own would trigger the FallbackIntent which could be programmed to greet the user the first time & reprompt / escalate after that)Explicitly treat Greeting words as stop words - would this trigger the FallbackIntent if the user says 'Hi' for example?Any other options we've overlooked?Thanks in advance!FollowComment"

Answer: "2Thanks for the good question. I think your option 1. is most likely to achieve what you want. by extending the training examples of intents A + B both with and without carrier greeting phrases, it helps with the machine learning model at robustly recognizing those intents based on the salient content part, and only resort to the greeting intent if there's no other specific content.CommentShareyianswered a year ago"


Question: Is it possible to renew an expired Certificate?

"Automatic renewal of my certificate failed. Detailed renewal status: Unable to process this request.  Domain names and CNAME info are all correct, as far as I can tell.I'd like to renew it, but I can't find any information on how to. Is it possible, or do I need to create a new certificate?FollowComment"

Answer: "1Accepted AnswerHelloYou can not renew the Failed/Expired Certificate instead you can create a new one by importing a new certificateA certificate is eligible for automatic renewal subject to the following considerations:ELIGIBLE if associated with another AWS service, such as Elastic Load Balancing or CloudFront.ELIGIBLE if exported since being issued or last renewed.ELIGIBLE if it is a private certificate issued by calling the ACM RequestCertificate API and then exported or associated with another AWS service.ELIGIBLE if it is a private certificate issued through the management console and then exported or associated with another AWS service.NOT ELIGIBLE if it is a private certificate issued by calling the ACM Private CA IssueCertificate API.NOT ELIGIBLE if imported.NOT ELIGIBLE if already expired.NOT ELIGIBLE for a certificate with a domain name that contains hyphens as its third and fourth characters. For example, the following domain name is not permitted:CommentShareGKanswered a year ago"


Question: EKS HPA's apiVersion fails to stay at v2beta2

When I deploy my HPA's I am choosing apiVersion:  autoscaling/v2beta2 but kubernetes is making them autoscaling/v2beta1For example: If I deploy this.apiVersion: autoscaling/v2beta2kind: HorizontalPodAutoscalermetadata:  name: surething-hpaspec:  scaleTargetRef:    apiVersion: apps/v1    kind: Deployment    name: surething  minReplicas: 2  maxReplicas: 4  behavior:    scaleDown:      stabilizationWindowSeconds: 300      policies:      - type: Percent        value: 100        periodSeconds: 15    scaleUp:      stabilizationWindowSeconds: 0      policies:      - type: Percent        value: 100        periodSeconds: 15      - type: Pods        value: 4        periodSeconds: 15      selectPolicy: Max  metrics:  - type: Resource    resource:      name: cpu      target:        type: Utilization         averageUtilization: 100I will get thisapiVersion: autoscaling/v2beta1kind: HorizontalPodAutoscalermetadata:  name: surething-hpa  namespace: dispatch-dev  uid: 189cee35-c000-410b-954e-c164a08809e1  resourceVersion: '404150989'  creationTimestamp: '2021-04-04T17:30:48Z'  labels:    app: dispatch    deployment: dev    microservice: surething  annotations:...  selfLink:...status:...spec:  scaleTargetRef:    kind: Deployment    name: surething    apiVersion: apps/v1  minReplicas: 2  maxReplicas: 4  metrics:    - type: Resource      resource:        name: cpu        targetAverageUtilization: 100All the documentation I can find on EKS and HPA's says that I should be able to use apiVersion: autoscaling/v2beta2. My cluster is version 1.21 and my nodegroup is as well.When I run kubectl api-versions I can find autoscaling/v2beta2 in the list.I'm at wits end on this one. Can someone tell me what I am doing wrong?FollowComment


Question: CloudHSM Key Hierarchy

"In simple terms, what is the key hierarchy in CloudHSM for actually encrypting data. I found this very easily for AWS KMS...... Domain Key > HBK/KMS Key > Data encryption Key (with exportable key tokens in the mix).I can find no similar explanation in the literature for CloudHSM. I have gone through blogs, user guide, FAQs etc. What's the top key and how does it work it's way down in the envelope process from there. If this can be found in a link it would be great if someone could pass it along. I have been looking for quite some time. Thanks.FollowComment"


Question: QuickSight Cant parse my csv file

"hello, I've been trying to get QuickSight to parse one CSV document I have, and it's not working. It keeps telling me that the format is not supported and the file cant be parsed although it's a normal CSV file. Any suggestions regarding this?FollowComment"

Answer: "0There is no real "normal CSV" file format. There are many possible issues with CSV mainly around strings that can be quoted (") or can include commas (,) in the text. There can also be issues with missing values, line breaks, headers, encoding, etc.Try to simplify the CSV file by removing various columns (using Excel, for example) and rows to try and identify where your CSV is not what expected by QuickSight.CommentShareMLGuyanswered a year ago"


Question: EC2 failed to access to the internet when to use `Deep Learning GPU` AMIs

"EC2 failed to access to the internet when to use Deep Learning GPU AMIsEC2 failed to access to the internet when I use Deep Learning GPU AMIs.As far as I know this is not a problem related to network interface, security group and routing table.I can access to the EC2 via ssh and ping 8.8.8.8 works.other EC2s that use the same security group and routing table can access to the internet properly.I can access if and only if I modify nameserver in /etc/resolv.conf but it rolls back to the pre-built-in value soon.Belows are my environments.- Region: ap-northeast-2b- Instance: gd4n.x2large- AMI: (tried both of them and failed)  - Deep Learning AMI GPU PyTorch 1.13.1 (Ubuntu 20.04) 20230103  - Deep Learning AMI GPU PyTorch 1.13.1 (Amazon Linux 2) 20230105Belows are pre-built-ins in /etc/resolv.confnameserver 127.0.0.53options edns0 trust-adsearch ap-northeast-2.compute.internalFollowComment"

Answer: "0It sounds like the EC2 instance is unable to properly resolve DNS names, which is preventing it from accessing the internet. One possible solution would be to modify the nameserver in the /etc/resolv.conf file to use a valid external DNS server, such as 8.8.8.8 or 8.8.4.4 (Google's public DNS servers). However, you mention that this change is not persistent and that the file is reverting back to its original state.A possible cause could be that the AMI has a script that runs on startup that restores the original /etc/resolv.conf file. You may want to check for any such scripts and modify or disable them.Another possible cause could be that the DHCP client on your instance is not properly updating the /etc/resolv.conf file. You may want to check the DHCP client configuration and ensure that it is set to update the DNS server information.You can also try to use AWS Systems Manager to run commands on your instances. This can be useful to update the DNS server or check the DHCP configuration.CommentShareDivyam Chauhananswered 4 months ago"


Question: Has anyone managed to get aws.greengrass.SystemsManagerAgent installing on Ubuntu 18.04?

"Hi,When attempting to deploy the new aws.greengrass.SystemsManagerAgent (v1.0.0) Greengrass component, onto our IoT device (Nvidia Jetson Nano - running Ubuntu 18.04), it consistently fails to install, giving the error message 'Snap - Failed to install'.To test what was going on, I found the installation steps used in the component recipe and attempted to replicate these manually. In doing so, I discovered that the command 'ssm-setup-cli -install' used in the 'Install' lifecycle step doesn't work on it's own, with the CLI tool erroring with the message 'Region must be specified'.After changing the command to 'ssm-setup-cli -install -region eu-west-1' (i.e. adding the region in as an additional flag), the installation of the agent completed successfully.Therefore, I believe a simple fix for this issue is to provide a means of specifying the region as part of the aws.greengrass.SystemsManager component configuration (https://docs.aws.amazon.com/greengrass/v2/developerguide/systems-manager-agent-component.html#systems-manager-agent-component-configuration), but I can't help feeling that is this was a problem for everyone, then it would have been reported and fixed by now?Would appreciate any feedback on whether anyone's got this component installing correctly first time round?Many thanks.FollowComment"

Answer: "0Hi there,We'll investigate why it failed without the extra flag and loop back here later.Update:snap - failed to install: it was reported before. They are investigating on this issue and will take this over.Region must be specified: Greengrass will set region env variable. When ran manually without Greengrass, the env variable missed which is expected.CommentShareLihaoanswered a year agocgddrd a year agoThanks @Lihao - is there a ticket somewhere where I can keep an eye on the snap - failed to install issue resolution?Share"


Question: **FAILED: SemanticException [Error 10035]: Column repeated in partitioning columns ** while creating another table with partitioning enabled

"This query ran against the "sf_sav_raw" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: 70884e2f-ed4d-4268-b5b5-1c630aa47570FollowComment"

Answer: 1This error in CREATE TABLE occurs when a partitioned column name is same as one of the table columns name defined in schema.For more information:https://docs.aws.amazon.com/athena/latest/ug/create-table.htmlCommentShareSachin_Kanswered a year ago


Question: OpenSearch serverless create error

Trying to create a serverless opensearch service and  I am getting a very generic error with no further instructions on how to resolve: "Unable to create collection".FollowComment

Answer: "1The error message is quite generic and annoying to troubleshoot. I suggest doing these as these are the most common issues:Check the OpenSearch logs to see if there are any error messages or exceptions that provide more information about the issue. This could help you identify the root cause of the problem.Permission issues: Make sure that you have the correct permissions to create a collection. You may need to check the access control policies for the OpenSearch service and IAM users or roles to see if they have the necessary permissions.Incorrect input parameters: Double-check that the input parameters you provided are correct. The name of the collection, the index and type names should be valid and should not contain any special characters or spaces.Resource limitations: You might have reached the resource limits of the OpenSearch cluster or the individual node where you are trying to create the collection. In this case, you may need to increase the available resources or reduce the size of the collection.Connectivity issues: Ensure that there are no network connectivity issues between the client and the OpenSearch cluster. You may need to check the network configuration and security groups to ensure they are correctly configured.If none of these troubleshooting steps work, you may need to try to raise an issue at https://github.com/opensearch-projectCommentShareAnanth Tirumanuranswered 3 months ago"


Question: Textract-API not returning TABLE specific data when using PHP client

"I'm using the following code:private function analyze(string $fileName): Result{    return $this->textractClient->analyzeDocument(        [            'Document' => [                'S3Object' => [                    'Bucket' => $this->bucketName,                    'Name' => $fileName,                ],            ],            'FeatureTypes' => ['TABLES', 'FORMS']        ]    );}I point to a JPEG image in the bucket and everything seems to work. However, the image contains a table with information which is processed correctly when I use the Textract web interface (by uploading the original PDF where the mentioned JPEG image was extracted from) but in the PHP result, there are no block types "TABLE" or "CELL"; they're all of the type "LINE".Am I doing something wrong?Any help would be highly appreciated.FollowComment"

Answer: "0Hi, just want to confirm is your PDF file a multi-page document or just one-page document? If it is multi-page document, then it might be that the result is paginated so you cannot search for TABLE result. Thanks.CommentShareAWS-User-0574899answered 10 months agoMichiel 10 months agoThe PDF is indeed a multi-page document but the JPEG I'm using with the AnalyzeDocument call is just one page as it's a single image. And this page has a table on it, which gets extracted fine when I use the web interface with the original PDF but gets extracted as LINE blocks when I analyze the JPEG.Share"


Question: DNS not propagating after domain transfer between two AWS account

"Hi, we recently (1 week ago) moved some domain from an AWS account to a different one via AWS CLI.Everything went smooth and we can see all the domains in the new account but for some reason if we make changes in the "hosted zone" the new records are not propagating.The weird thing is that they do if we modify the hosted zone in the OLD account, even if the domain is not registered there.Any ideas?Thanks!FollowCommentJustin G 8 months agoEnsure you have updated the domain to point to the recreated hosted zone in the new account.Share"

Answer: "0Hi ThereMoving the domain is a separate process from moving the hosted one.  If you're using Route 53 as the DNS service for the domain, Route 53 doesn't transfer the hosted zone when you transfer a domain to a different AWS account.   Please see https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-transfer-between-aws-accounts.htmlStep 1: Transfer a domain to a different AWS accountStep 2 (Optional): Migrate a hosted zone to a different AWS accountCommentShareEXPERTMatt-Banswered 8 months agodaniele-imille 8 months agoHosted zone has been recreated of courseShare"


Question: The option of LAMP(PHP 7) is missing in the blueprint section of Lightsail's Create instance

"I created instance with LAMP(PHP 7) few days ago, when I try to create another LAMP(PHP 7) blueprint instance. I only can select LAMP(php8) now.FollowComment"

Answer: "0It seems that AWS Lightsail may have updated their blueprint offerings, and the LAMP(PHP 7) blueprint is no longer available. AWS periodically updates their instance blueprints to provide the latest and most secure versions of the software.if you still need LAMP 7 with lightsailCreate a new Lightsail instance with the available LAMP(PHP 8) blueprintConnect itDowngrade PHP version to 7Update your web server configuration to use the PHP 7Restartdowngrade code as followssudo apt-get updatesudo apt-get install software-properties-commonsudo add-apt-repository ppa:ondrej/phpsudo apt-get updatesudo apt-get install -y php7.4replace 7.4 with your desired versionCommentShareEXPERTsedat_salmananswered 2 months agorePost-User-2408960 20 days agoHi, would it be possible to provide the step for updating the webserver? Appreciate it!Share"


Question: Black stream in case input loss on elemental encoder

"I am facing an issue with my live streaming. I have set up 2 elemental encoders for RTMP push to Youtube. Issue I am having is in case of input loss, my encoder is pushing black video to endpoint.I have backup setup on different encoder. I want the RTMP push to pause on primary in case input loss is there, not emit black frames.The problem with emitting black frames is that, connection is alive between my encoder and youtube, hence Youtube does not failover.When I will achieve pause the stream push, YT will switch to the secondary input stream.FollowComment"

Answer: "0Hi,This is an expected behaviour for RTMP output. When input loss, it triggers the input loss behaviour to push either black/color image or slate image that is defined. Unfortunately, there is no option to pause RTMP output when input loss.If you would like to achieve this, my suggestion is to implement a script to monitor the input alert using the email notification or web callback URL and send a REST API to start/stop when an alert is raised. You can enable notification under Global Processors > Notification.For example, if you receive an input alert, send a stop output API to stop the RTMP output and when input alert is cleared, send an start output API to resume RTMP output.https://docs.aws.amazon.com/elemental-onprem/latest/pdf/live_2.22_api.pdf/live_events/<id>/stop_output/live_events/<id>/start_outputRegards,SamEdited by: samuelAWS on Oct 29, 2021 12:30 AMCommentSharesamuelAWSanswered 2 years ago0I already have alerts configured for input loss. Just wanted to eliminate the manual intervention of start/stop in case of input loss.Currently we are practicing the same manual start stop in that case. Since we do not have this feature for RTMP push, thanks for the clarification.CommentShareKumarAbhishekanswered 2 years ago"


Question: MySQL on RDS another account with root privileges

"Is there any option to grant SUPER privileges to another user? When i try to do it using MySQL CLI i get an error and i found many posts that this is impossible but there is no workaround proposed.We have few database engineers and we want separate accounts for them, so far we are unable to do so as we cannot grant them all privileges and for example they are unable to edit procedures.log_bin_trust_function_creators  set to 1 is working only for the root user.Any solutions for this issue?FollowComment"

Answer: "0This Premium Support Post: How do I create another master user for my Amazon RDS DB instance that is running MySQL?  answers the question I think. To recap here:Create a user: CREATE USER 'new_master_user'@'%' IDENTIFIED BY 'password';.Grant permissions to the new user: GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, PROCESS, REFERENCES, INDEX, ALTER, SHOW DATABASES, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER ON *.* TO 'new_master_user'@'%' WITH GRANT OPTION;Accessing or using the true admin user (rdsadmin) is not allowed even for the master user created in the database. You can't replicate some of the permissions used by this user either.CommentShareC Mencarellianswered 4 months agoEXPERTBrettski-AWSreviewed 4 months agoDataedo 4 months agoOk, but this is creation of standard user, as I mentioned we want to grant SUPER  to other accounts, so this is not solving our issue.ShareDataedo 4 months agoJust to add, master user permissions will be enough, as looks like it's enough to manage proceduresShareC Mencarelli 4 months agoYour question specifies root privilege, as I mention in the answer, this is not possible. However the answer I provided will get you exactly the same permission set that is granted to the user that is created with the database and given to you to use as a db user. Can you share the sql and error you're getting?Share"


Question: New to Cloud9 -- having problem in creating an environment

"I am taking a DevOps course in Coursera, and have an issue with creating an environment using Cloud9.The exercise is straightforward, but the following error repeatedly appears.Unable to access your environmentThe environment creation failed with the error: The development environment 'be393d452d9c46bb95caf98f710e2a6e' failed to create because the instance type t2.micro isn't available in the requested Availability Zone. Try recreating your environment, and choose an instance type that's supported by the AZ..Task 1: Creating an AWS Cloud9 environment and downloading the applicationFor this task, you create an AWS Cloud9 environment for use as your development environment. You also download the pre-built application onto the AWS Cloud9 instance.Is there anyone who could help me? The task says that I should keep the default setting when creating the environment in the exercise.Thank you in advance!FollowComment"

Answer: "1Accepted AnswerTry changing the subnet after you have selected the VPC because the subnet determines the Availability Zone. The error message is saying "The t2.micro instance type is not available in the AZ that you have selected". If it does not work in any of the AZs in the particular region, then you have two options:a) Choose another AWS regionb) Choose a different instance type. There may be a cost associated with choosing a different instance type, so check out the AWS documentation for how much you will be billed for that particular instance type. Also once you are done with your exercise, make sure to delete every resource you created.CommentShareEXPERTIndranil Banerjee AWSanswered 9 months agoMona 9 months agoIt worked! Thank you so much for your comment :)ShareIndranil Banerjee AWS EXPERT9 months agoHi Mona - Is it possible for you to accept my answer. ThanksShare"


Question: When will AWS update the Cloud9 Base Images?

"Ubuntu 18.04 has reached EOL. Amazon Linux 2 EOL was just extended 2 years to 2025. What is the future of AWS Cloud9 at this point? Are there plans to upgrade the base images to the latest and greatest Amazon Linux and Ubuntu, respectively?Thanks in advance!FollowComment"

Answer: "0Hello, Please find the below information regarding the EOL of Ubuntu AMI:When will a new Ubuntu base image be available? A new Ubuntu AMI will be available by July 30, 2023.Can I choose Ubuntu 18.04 after 31 May, 2023? Yes. You can choose Ubuntu 18.04 after 31 May, 2023. The option to choose Ubuntu 18.04 will be available in the console until the next Ubuntu AMI is released.What happens after the EOL of Ubuntu 18.04? After 31 May, 2023, Ubuntu 18.04 LTS will no longer receive further security updates from Canonical. You can continue to receive security updates by choosing one of the following options:Upgrade to Ubuntu Pro 18.04 with the AWS License Manager. Ubuntu Pro subscription incurs an additional costs.Create a Cloud9 environment with Amazon Linux 2 AMI, orCreate an SSH based Cloud9 environment with existing compute with any Linux distribution, which includes Ubuntu 20.04 and Ubuntu 22.04.CommentShareCloud Support Engineeranswered 3 days ago-1Hello,The Ubuntu documentations has moved the  "Ubuntu 18.04 LTS" from the LTS (Long Term Support) [1] phase in 2023 to ESM (Extended Security Maintenance) for a further 5 year [2]. It will become 'EOL' (End of Life) in 2028 [3].Therefore, currently AWS has not announced when Ubuntu 18.04 support will come to end and when will the latest version be released.As soon as the new version is released, it should be publicly announced in either one of the following links:[+]What's New: http://aws.amazon.com/new/[+]Release Notes: https://aws.amazon.com/releasenotes[+]Cloud9 https://docs.aws.amazon.com/cloud9/latest/user-guide/history.htmlReferences:[1] The Ubuntu lifecycle and release cadence - https://ubuntu.com/about/release-cycle[2] Extended Security Maintenance - https://ubuntu.com/security/esm[3] List of releases - https://wiki.ubuntu.com/ReleasesCommentShareCloud Support Engineeranswered 17 days agorePost-User-0334029 13 days agoThe answer is not sufficient. Will Cloud9 instances on Ubuntu 18.04 continue to receive security updates and if so, how frequently?Share"


Question: Performance degradation during EBS Snapshot acquisition

"I have a long-term data copy operation to EC2, which will be performed during the EBS Snapshot acquisition.Is there any indicator as to how much the performance related to data copying will decrease during the EBS Snapshot acquisition?FollowComment"

Answer: 1Accepted AnswerWhat type of EBS volume are you using? Snapshots may affect the performance of st1 and sc1 volumes but not others. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSPerformance.htmlCommentShareEXPERTBrettski-AWSanswered 6 months ago0I use gp3. Thanks.CommentSharerePost-User-20221103answered 6 months ago


Question: "ValidationException: The assume role is invalid" while creating Association

It show this error "ValidationException: The assume role is invalid"  while creating Association with the document "AWSEC2-PatchLoadBalancerInstance". It say to use "AWSServiceRoleForAmazonSSM" but it can be added as the association roleFollowComment

Answer: "0Hello,This seems to be a limitation with the document "AWSEC2-PatchLoadBalancerInstance". A possible workaround for this would be to clone the document and provide an assume role manually within the automation document itself. Please follow below steps for the same -Go to AWS Systems Manager service --> DocumentsSearch and select the document "AWSEC2-PatchLoadBalancerInstance"Click on Actions --> Clone documentUnder the field 'Assume Role - optional', provide the ARN of the Role 'AWSServiceRoleForAmazonSSM' and click on Create Automation at the bottom of the screenUse this cloned copy to create SSM associationAlternatively, you can use AWS Maintenance Windows to patch your LB instances using the document 'AWSEC2-PatchLoadBalancerInstance'.Hope this helps!CommentShareSUPPORT ENGINEERSimar_P-Sanswered 2 months ago"


Question: SiteToSiteVPN configuration file invalid info

"Hello,I have created a site-to-site VPN and configured it to allow only Encryption: (AES256, AES256-GCM-16) and Authentication:(SHA2-256) but when I downloaded the file I found it still contains Encryption: aes128Authentication: sha1, which is not correct.IPSEC tunnel configuration from the remote side works fine with my modifications Encryption: (AES256, AES256-GCM-16) and Authentication:(SHA2-256) but the configuration file causes misleading to the remote VPN admin, so how we can download the correct modified configuration to avoid this issue?ThanksFollowComment"

Answer: 0The downloaded file will always show all available option. This file is standard/generic and donot change as per parameter selected.CommentShareMuhammadanswered 5 months ago


Question: Trigger on Absence of Information from AWS IoT

"My greengrass core device runs a component that sends MQTT messages at set intervals. These messages go to an IoT Rule, then on to a sitewise dashboard.Is there an easy way to trigger on the absence of the message for a particular time ? E.g. no message has been sent for 10 minutes, send an event/trigger some action.I understand that I could send the messages to a dynamos DB/some persistent storage, then trigger a lambda at certain intervals to check the last timestamp.But is there a natively supported IoT way to check that, between alarms/metrics ? It would be nice to be able to do it all within AWS IoT.FollowComment"

Answer: "0Accepted AnswerYes, you can use AWS IoT to check for the absence of messages for a particular time. One way to do this is by using IoT Rules and IoT Events.First, you can create an IoT Rule that listens for the MQTT messages from your Greengrass core device. In the rule, you can specify a condition that checks the timestamp of the message and compares it to the current time.Next, you can use the IoT Events service to detect when the condition specified in the IoT Rule is not met. To do this, you can create an IoT Event detector that checks the output of the IoT Rule and triggers an action when the rule's output is "false" or "absent".You can also use the IoT Events service to specify a "Missing message" detector that checks whether a message has not been received for a certain period of time. You can set the detector's parameters to detect when the message is missing for a specific time, e.g. 10 minutes, and then trigger an action when this condition is met.Finally, you can use the IoT Action service to trigger an action when the detector finds a missing message. This action can be a Lambda function, an SNS topic, or a SQS queue, among other things.By using this approach, you can set up an IoT-native solution that checks for the absence of messages and triggers an action when this condition is met, all within the AWS IoT service.CommentSharejayamaheizenberganswered 4 months ago0To check if a message has not been received for a certain time you can use IoT Events. You create a detector that on reception of a message starts/re-starts a timer. When the timer runs out you trigger the notification.This detector model is part of the templates provided by IoT Events, and is called Device HeartBeat.Select  this link to Create a new detector model, then select Browse and select template and Device HeartBeat.Note that you can either reuse the Input  created by the template and adapt your message to it (generating the fields value and heartbeat_id) or create a new input matching your message and modify the detector accordingly.CommentShareEXPERTMassimilianoAWSanswered 4 months ago"


Question: Truncated words in German

"HiWe have seen a truncation problem in the pair EN-DE. This does not occur in other language pairs we work with (EN-FR, EN-ES). only for German.See one example attached. The source string is "Application package location:", and the German output should be "Speicherort des Anwendungspakets" but gets truncated after "pak". This has been observed throught the TMS and replicated in the AWS Translate Console.C.FollowComment"

Answer: "0Hi laguardia,Thanks for you feedback. We have addressed this issue.Thank you for choosing Amazon Translate!CommentShareAWS-User-6042432answered 2 years ago0Reproduced, and sent the translation feedback via console.CommentShareMia Canswered 10 months ago"


Question: Pinpoint RSVP System

"Team -- I am looking to create an SMS based RSVP system that should --a) greet the user based on 'OriginationNumber' .. for instance, if the text message is coming from +18001234567, the response back should be a greeting with the user's name based on a details in the file imported as part of a segmentb) present a small menu the user can interact with and confirm their attendancec) save all responses to a csv or text fileQuestion I have is on a). Once Pinpoint receives a SMS from an 'OriginationNumber', how do I automatically greet the user tied to the 'OriginationNumber'? I suspect I have to import a file with all phone numbers and run a lambda function to compare the 'OriginationNumber' with the file and return the associated name?Any help is greatly appreciated for this new Pinpoint user.FollowComment"


Question: Security Hub - Setup aggregated regions

"Hi,I have a question about setting upp Security Hub and aggregated region.If I have Region A - I do all the steps to set up Security Hub. Then I set Region A as the aggregation region.In Region B, do I need to do all the steps to set up Security Hub from scratch (delegate admin, enable, add members etc like Region A) and then link the region? or can I just link the region directly? If I link directly does Security Hub perform controls on every member account in Region B even though there is no "members" in Region B account list?I can't find any documentation that answers that specific question.Thank you!//NFollowComment"

Answer: "0In Region A of the delegated admin for security hub, located in settings you need to setup up your aggregation region.Delegated admin is global and not per region.Member accounts only list other accounts and not itsself. If you are in an org or invite other accounts then they appear here.Member accounts are not regions but other AWS accounts that is not the current Admin accountI assume your not using an origanisation? As you will need to also configure Security Hub in each account also.Hope this helpsCommentShareGary Mcleananswered 12 days ago"


Question: Access Greengrass logs as non root user

"Hello all,I'm trying to read greengrass logs (system or lambda) from program which is not running as root. But all Greengrass logs are owned by root and have access mode 600. Also the path to the logs is also owned by root and have mode 700, which also denies other users from accessing them.I tried changing the mode of the log files to 644 and directories to 755 but after greengrass restart the original modes are restored. I also tried to setup default ACL to the folder, hoping that new files would inherit the ACLs (which they do) but it seems that Greengrass forcibly changes the mode of new log files which changes the ACL mask to 000, which also denies access to all other users.Is there a way to modify the mode of log files (or Greengrass write directory in general)? Or is there some hack with would allow to read Greengrass logs?Thank you very much for the responsesFollowComment"

Answer: "0Hi,Unfortunately this is not a feature we currently support; though this may be something we could add in a future release.In the meantime, would you be able to  publish your logs to cloudwatch (https://docs.aws.amazon.com/greengrass/latest/developerguide/greengrass-logs-overview.html#config-logs )and have this non-root program access them from there? This may be a workaround.Thanks,AVCommentShareavipinkuanswered 3 years ago0Hi,thank you for the quick answer.We are currently looking into using named pipes with 644 mode and a process which will copy the logs into this pipe. But CloudWatch might be easier solution.CommentShareAtriaanswered 3 years ago"


Question: "existing ubuntu ec2 instance that has data should look like new server, after deleting everything"

my question is i have got an existing Ubuntu ec2 instance that has got DNS mapping and setup. I need to delete of all the installation with files and folders and make it look like a fresh server. so how can i approch itFollowComment

Answer: "1Any reason why you can’t create a new instance so it’s fresh and terminate the old one?CommentShareGary Mcleananswered 16 days ago0HelloAssuming this instance needs to be publicly accessible and is configured without a load balancer or an elastic IP. I don't believe that there is a straightforward way to achieve a clean installation state. However, I would recommend the followingUninstall all the software using apt purgeUse apt autoremove to remove any unused packageRemove any user directories/log filesIf ssh multiple SSH keys are configured, remove the keys from authorized_hostsHope this helps.CommentShareBisinaanswered 16 days ago"


Question: Analyze Document for Malaysia Identity card

"Hi, currently I'm doing data extraction for the Malaysia's identity card using this sync function, AnalyzeDocument.However the AWS Textract not able to extract meaningful result using FORMS feature type. Hence I'm using QUERIES feature to extract the person's name, person's identity number and person's customer address. In this case, the accuracy is lower whereby more than 50% of the result are useless.Please advise on which extraction type can be used to increase the accuracy.Thanks.FollowComment"

Answer: "1There are two different kinds of accuracy issues you might be struggling with here:Failure to identify the required items/entities: For example "This is the date of birth", "this is the name", etc - expected key not being detected, or Query not pulling back the correct part of the documentFailure to correctly recognise the text: For example "Substituting 0 for O in ID number" - KV/query pulling back the correct part of the document, but incorrect OCRIdentifying entitiesIn case you're struggling with (1) and have already tried Queries, I'd suggest to try training an Amazon Comprehend Native Document NER model. You can find the linked blogs for collecting training data and building the model. When trained with actual document annotations (instead of plain text), Comprehend entity recognition is capable of accounting for both the page position and the text content to detect entities in documents: Which works much better for these kind of tasks than a plain text entity recognizer model.Technically, this feature currently only supports English - but:I've heard anecdotes of customers getting good results in other languages, especially with documents (like this use case) where the format is very consistent so the model can rely heavily on position cuesIf you'd like to explore a self-managed, multi-lingual, layout-aware model on Amazon SageMaker, there's an end-to-end sample here that combines Amazon Textract with Hugging Face LayoutXLM. This sample, and the general value of using layout-aware models for document processing, is discussed further in this AWS ML Blog post.Correcting OCREntity recognition models like those mentioned above just "tag" text so cannot generally "fix" OCR error patterns like substituted similar characters or omitted characters. If you're struggling mainly with (2), there are multiple approaches you could consider:Pre-processing or (validating & rejecting) images to improve image quality: For example boosting contrast, detecting and removing skew, detecting blur or glare, or validating/normalizing pixel resolution of the area of interest (the identity card). This could range from using standard image processing libraries like Pillow, to using ML models to localize the region of interest (identity card) in the image.Post-processing OCR results to fix common problems:For example using rules and regular expressions to validate things like dates, or ID numbers that include checksumsAlternatively, using sequence-to-sequence text models to "translate" raw OCR text into cleaned text and fix common patternsI've worked with at least one customer in Southeast Asia who found success using a seq2seq BERT model to clean identity card data from OCR errors; and several who've applied rule-based post-processing to improve result accuracy. You could probably extend layout-aware language models to perform this kind of sequence-to-sequence/translation task too, but there's less pre-existing content around that.CommentShareEXPERTAlex_Tanswered 8 months ago0Thank you for using Textract. As a machine learning service, Amazon Textract may not be able to achieve desired accuracy on certain documents. Given this our generic models behind Analyze Document may not be working for your use-case. Additionally, our Analyze ID API currently only supports United States ID documents only. However, we are continuously improving the quality of our models. In order to help us improve the models for your documents, please open a customer support ticket and share your documents to help us analyze further. Additionally, please look out for announcements regarding our model quality updates that are announced on the AWS Textract public release channel.CommentSharerePost-User-1142988answered 8 months ago"


Question: How to use CloudWatch to monitor the number of active connections to a Lightsail server

"Is there any way to use CloudWatch to monitor the number of active connections to a Lightsail/EC2 server?  I know there's such an indicator for the Application Load Balancer, however, there's no load balancer in my infrastructure.   The number of active web users/connections is one of the most popular indicators and we want to find out more about it.  Thank you.FollowComment"

Answer: "2Hello,LightSail comes with limited set of features and currently there is no direct way to monitor number of active web connections to LightSail web server using CloudWatch. However LightSail can intergrate with CloudWatch and CloudWatch provides some netstat related metrics that can come handy to get information related to TCP/UDP connection state like :netstat_tcp_established : The number of TCP connections established.netstat_tcp_close: The number of TCP connections with no state.netstat_tcp_syn_sent : The number of TCP connections waiting for a matching connection request after having sent a connection request.For a complete list of metrics provided by CloudWatch to intergrate with LightSail, please refer [1] and [2].The steps to configure a LightSail instance to send data to Amazon CloudWatch is available in following article:[+] https://aws.amazon.com/blogs/compute/monitoring-memory-usage-lightsail-instance/This article has steps to collect memory related data, however for collecting netstat data you can change the cloudwatch configuration file mentioned in Step 5 of the article with netstat values.For your reference I have provided a sample Cloudwatch configuration file to collect the three netstat metrics (tcp_established, tcp_close and tcp_syn_sent).Configuration file for collecting tcp_established, tcp_sync_sent and tcp_close:{  "agent": {    "metrics_collection_interval": 10,    "run_as_user": "root"  },  "metrics": {    "namespace" : "MyCustomNamespace",    "metrics_collected": {      "netstat": {        "measurement": [          "tcp_established",          "tcp_syn_sent",          "tcp_close"        ],        "metrics_collection_interval": 10      }    }  }}The above netstat metric will provide approximate count of the web connection. In case you need the exact count of web connection then you can consider using EC2, as it provide additional features which allows to create and use custom CloudWatch metrics. So, basically you can create a script which collects data of active connection and then report it to amazon-cloudwatch. For more details you can refer [3] and [4].Note: AWS does not endorse any third party articles. These links are researched and provided as a best effort attempt to help you.Hope it helps!!Resources:https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.htmlhttps://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/metrics-collected-by-CloudWatch-agent.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/cloudwatch-push-custom-metrics/https://www.techtarget.com/searchcloudcomputing/tutorial/How-to-create-EC2-custom-metrics-with-Amazon-CloudWatchCommentSharevaibhav-AWSanswered 6 months ago"


Question: Can't define an AWS API Gateway mapping template from the console

"I'm new to AWS API Gateway and got stuck trying to define a mapping templates.I'd like to map a application/x-www-form-urlencoded POST request to a lambda function I created. I managed to define a route and link it to the function.But when I tried to create a simple mapping template from the console by clicking "Models" the "Create" with the following definition:{"body" : $input.json('$')}  it fails with:it prints "Invalid model specified: Validation Result: warnings : [],errors : [Invalid model schema specified]Judging by the [documentation][1] my definition seems right.On the top of the form it tells me that it's using a JSON Schema syntax wich is different from the documentation linked above.Is the documentation outdated? Am I submmiting it wrong? How can I solve that?[1]: https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-override-request-response-parameters.htmlFollowComment"

Answer: 0My mistake. Turns out I was trying to define it on the wrong place.CommentShareyagotlimaanswered 3 years ago


Question: Does Inbound Data Tranfer means "Upload to AWS" and Outbound means "Download"?

I'm a student and I'm new to AWS.I learned that Inbound Data Transfer is all free while Outbound is charged. My question is what does Inbound/Outbound Data transfer actually mean? Does Inbound = Upload data from my PC to AWS Storage/Database and Outbound = Download from AWS back to my PC?I found a similar question on StackOverFlow but I still want to confirm it herehttps://stackoverflow.com/questions/21320063/what-is-inbound-outbound-data-transferFollowComment

Answer: "1Yes.  I wrote a script that does uploads and downloads, but costs are more complicated than just that.  They charge for storage if you use S3 to store your data.  Downloads they charge for. There are a number of ways they charge us.  I would recommend that you set up an account and get familiar with AWS cost explorer https://aws.amazon.com/aws-cost-management/aws-cost-explorer/ and set up budgets that flag you when you exceed a certain amount https://aws.amazon.com/aws-cost-management/aws-budgets/.  If you are uploading to an S3 bucket, you'll need to set up lifecycle rules on each bucket to delete failed multipart uploads.  Instructions are here:  https://aws.amazon.com/blogs/aws-cloud-financial-management/discovering-and-deleting-incomplete-multipart-uploads-to-lower-amazon-s3-costs/CommentSharejschwar313answered 8 months ago"


Question: ECS Step Scaling option always disabled on new UI ?

"Hi there,I used to configure my ECS services to scale on a "Step Scaling" mode. Currently, after the new UI has been set to default, I'm seeing that the Step Scaling option is always disabled.The only possibility I found is Target Tracking which does not give you too much flexibility.I will appreciate any help on how to either get back to the previous UI, or been able to use Step Scaling on the new one.Thanks a lotFollowComment"

Answer: "1Accepted AnswerOn the left menu, at the top, there is toggle, "New ECS Experience". Turn it off to go to the classic console.CommentShareEXPERTkentradanswered 3 months agorePost-User-7136343 3 months agoSorry to make a comment: The question has two parts, Mr Kentrad only answered one part, then how come the answer was accepted. The second part was answered by rePost-User-2073239, so his answer must be accepted by AWS.Is there any flaw to the system?Share0As kentrad mentioned, if you go rollback the UI and go back to the previous one you can do it. It seems they have not implemented the Step Scaling in the new UI... (wondering why they are setting as default a UI which is under construction)CommentSharerePost-User-2073239answered 3 months ago0We continue to improve the new ECS console and add functionality. You can still use the classic ECS console and to do so you can switch back by turning off the "New ECS experience" toggle and the top of the left menu. You can see list of features are currently only available in the class ECS console https://docs.aws.amazon.com/AmazonECS/latest/developerguide/new-console.htmlYou can also read about the new ECS console in the blog post https://aws.amazon.com/blogs/containers/announcing-upcoming-changes-to-the-amazon-ecs-console/CommentShareSergeyanswered 3 months ago"


Question: How can I make non-disruptive backups of my instances and ebs?

"I want to backup using AMI or Snapshot. During backup, the instance continues to write to EBS. At this time, is it possible to make non-disruptive backups while maintaining disk consistency?FollowComment"

Answer: "0Only data written to the disk is captured in the snapshot, data in memory not yet written to the disk will be excluded. For non-disruptive backups this is generally considered good enough.You do have an option on Windows to do VSS snapshots that can handle open files a little better (https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/application-consistent-snapshots.html)If you need to make sure all data is written to disk first, the best way is to either shutdown the instance or unmount the volume being snapshotted.CommentSharerianbkanswered 8 months ago"


Question: "The advantages and limitations of using AWS IoT Analytics, Amazon Kinesis, or AWS Lambda"

"How can we efficiently process and analyze high volumes of IoT data ingested by AWS IoT Core? What are the advantages and limitations of using AWS IoT Analytics, Amazon Kinesis, or AWS Lambda in combination with other big data services like Amazon Redshift or Amazon EMR for this purpose?FollowComment"

Answer: "3Accepted AnswerHi sdtslmn,AWS IoT Analytics is a service which allows you to ingest, process, store and analyse/visualise your data. You can use so called pipeline activities to enrich your data for example with meta data. In case you change your pipeline activities you can also reprocess your data. You can store your data in a service managed area or in your own Amazon S3 bucket.Amazon Kinesis services are for streaming data and run real time analytics on it. But Kinesis is not a long term storage. Amazon Redshift is a data warehouse which allows you to run SQL analytics on your data. Amazon EMR can be used to process and analyse data.AWS IoT Analytics is more a whole solution whereas services like Amazon Kinesis, Amazon EMR or Amazon Redshift are building blocks which you could use to build your own solution.It depends on your use-case what which services would be a good fit for you. Do you need to store data in long term, how do you want to consume the data, are you looking for real time or batch analytics, etc.Cheers,PhilippCommentSharePhilipp Sanswered 2 months ago"


Question: Subscription not working with NONE data source?

"Hi,I'm trying to use AppSync subscription with a mutation on a none data source. However, it looks like the subscription is not working as AppSync doesn't support subscription on none data source. In this document, it's said that:The following example shows how to work with GraphQL subscriptions. It doesn't specify a data source because the data source could be AWS Lambda, Amazon DynamoDB, or Amazon Elasticsearch Service.and there is no mention about none data source.Could somebody please confirm this? Thank you!FollowComment"

Answer: 0Sorry my bad. It was due to one issue with the Lambda which is triggering the AppSync mutation. Everything is fine now.CommentSharephianswered 4 years ago0Glad things are working. Have a nice day.CommentShareMichaelParisanswered 4 years ago


Question: Programmatically referring to entities in a Sumerian scene

"I'm using LoadEntityInstanceAction as recommended here. However, rather than manually nominate a specific entity to copy, I would like to specify it dynamically so I can reuse the script to generate multiple new entities via a for loop.The drag and drop fields used in Sumerian show the name, but if I type the name instead of dropping it in, it doesn't work, so the name only doesn't seem sufficient.  Similarly, if I don't nominate a entity to copy, the console output shows a missing 'ID' value, but how do I format the entity ID hex string as a parameter?  I'm hoping for something like:ctx.start([s.entity.LoadEntityInstanceAction, { entity: entityId='4ba69fc04dd94c1f904921e7e800c3a9'onCreate: onSpawnedEntityReady}]);I've been looking through the API documentation and can't see the answer, so if I'm just missing something, I apologise! ThanksFollowComment"

Answer: "1Accepted AnswerEntitySets in Sumerian provide a convenient way to query your scene for entities that match certain criteria. You can query entities by name (as displayed in the "Entities" outline) or by tag. You can use literal strings or Regular Expressions to define your match criteria.Below is some example code that creates an EntitySet by searching your scene for two entity name strings ("MyBox" and "MySphere") and then loops over those entities to create copies of them.import * as s from 'module://sumerian-common/api';export default function(ctx) {// Create an EntitySet containing the source entities// we care about.const spawnableEntities = ctx.world.entities.withName("MyBox", "MySphere");// Loop through each source entity in our EntitySet// and spawn a copy of each.spawnableEntities.forEach(entity => {ctx.start([s.entity.LoadEntityInstanceAction, { entity: entity, onCreate: onSpawnedEntityReady}]);});// This function will be triggered as soon as each new entity instance // has completed its initialization and is ready for use.function onSpawnedEntityReady(spawnedEntity) {// Here we're just moving the new entity to a random location.const x = Math.random() * 2;const y = Math.random() * 2;const z = Math.random() * 2;spawnedEntity.position.setDirect(x, y, z);}}An alternative to using the .withName() method is to use the .withTag() method. With that approach, you could tag multiple entities with a tag name of your choosing, for example "copy_me". Then you would use ctx.world.entities.withTag("copy_me") to create your EntitySet.CommentShareKrisanswered a year ago0Awesome, thanks!CommentSharebatfinkanswered a year ago"