Question: Amazon Transcribe in Telugu language..

"Hi,In amazon transcribe i am looking for telugu language. As per this link https://aws.amazon.com/about-aws/whats-new/2019/11/amazon-transcribe-now-supports-speech-to-text-in-7-additional-languages/, telugu is avaible. However, I don't see it in the languages in amazon transcribe section. Any ideas?FollowComment"

Answer: "1Referring to this link, it appears that Telugu is only supported for batch at this time.  Some of the languages list both batch and streaming.https://docs.aws.amazon.com/transcribe/latest/dg/supported-languages.htmlLanguageLanguage codeData inputTranscribing numbersAcronymsCustom language modelsRedactionCall Analytics*Telugute-INbatchnononononoAs such, I do not see it in the console under Real-time transcription but I do see it under Transcription jobs on the left.Hope this helps you!CommentShareEXPERTiBehranswered 21 days ago"


Question: Why AWS Lambda function with Pytorch takes additional 10 seconds than sam local invoke

"Hello,I am new to AWS Lambda,I created a Pytorch Lambda function using SAM with architecture x86_64. When invoking the same function with SAM local invoke, the total billable seconds is around 7 seconds, but after "sam deploy --guided" I invoked lambda function + API gateway using Python request module with the exact same setting as sam local invoke (Memory = 3 GB). Then the total billable seconds is around 17 seconds. I just did not understand why there is 10 seconds increase in time.FollowComment"

Answer: "0Lambda cold start have to allocate a work environment (frirecracker virtual environment) to download your code, setup the local runtime and run your code. It may take few seconds in the first invocation but for other invocations this is not required.Please take a look on this following blog: https://aws.amazon.com/pt/blogs/compute/operating-lambda-performance-optimization-part-1/   https://aws.amazon.com/pt/blogs/compute/operating-lambda-performance-optimization-part-2/CommentShareEXPERTDaniel ABIBanswered 5 months ago"


Question: EC2 instance checks getting failed

EC2 instance checks getting failed and no clue about what is happening.Unable to get logs during that time and not able to see logs.Please help on this issue.Thanks in advance.FollowComment

Answer: "0Hi,Do you have an instance ID?CommentShareAWS-User-8424448answered 3 years ago0we upgraded server and it helped to resolve issueCommentShareKalyanp1answered 3 years ago"


Question: Unable to retrieve snapshot due to image not available

I have migrated snapshot from old aws account to another but unable to convert the snapshot to imageImage - Ubuntu 16.04 LTS - Xenial (HVM)Error - This version has been removed and is no longer available to new customers.Any idea how I can convert snapshot to ec2 if the image is no longer availableFollowComment

Answer: "0Hi,From your notes, can you provide me more detail on the following "convert the snapshot to image"How are you converting the snapshot to image?If you have copied the snapshot from a different account, are you able to create a volume from the snapshot [1]?From my tests I was able to create volume from an snapshot that was created via AMI. The idea is to create a new volume from snapshot and attach the volume as a root volume  (/dev/sda1)on a test instance to check if instance is able to boot. If instance boots successfully then you can create a new AMI not sure if you have taken this approach but feel free to provide more detail or correct me if I missed something.Based on the wording of your error I could assume that you are seeing:InvalidAMIID.Unavailable -- The specified AMI has been deregistered and is no longer available, or is not in a state from which you can launch an instance or modify attributes [1]This error means that you won't be able to launch new instance from the given AMI as it was de-registered, can read more on this topic here [3]. The docs also seem to state that "When you deregister an Amazon EBS-backed AMI, it doesn't affect the snapshot(s) that were created for the volume(s) of the instance during the AMI creation process." in practice your snapshots should still be available for use.[1] Create a volume from a snapshot - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-volume.html#ebs-create-volume-from-snapshot[2] Client error codes for specific actions - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/errors-overview.html#api-error-codes-table-client[3] Deregister your AMI - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/deregister-ami.htmlCommentShareSUPPORT ENGINEERLundianswered 6 months ago"


Question: EventBridge API Destination Deauthorized Connection

"Is there a way to configure an apiDestination connection not to be deauthorized on a 401 error??Currently I am using EventBridge to schedule custom api endpoint calls; this tasks could be programmed to be executed after several days. In the meantime if a diferent unauthorized task get executed, the connection became deauthorized an any other future call is not executed.I dont want to create a different connection for each rule, as all my tasks are executed over the same apiDestination but using different payloadsFollowComment"


Question: Record Level Upsert on Governed Tables

"Hi,Is there support for record level upsert transactions on Governed Tables?ThanksFollowComment"

Answer: "0Governed table only supports S3 Object level transactions like adding/deleting S3 Objects to a table using UpdateTableObjects API.As of today, it doesn't support record level transactions.CommentShareSachin_Kanswered a year ago"


Question: Webhook to AWS API Gateway error: {"message":"Forbidden"}

"Hi all,Some basic information on what I want to manage in AWS:Goal: I have a Particle board. This Particle board is an arduino like board with a GSM modem. This board sents data to the Particle Cloud. In the Particle Cloud I want to use a webhook to send the data to AWS API Gateway. After this a lambda function should insert the received data into a dynamoDB.What I already did:I followed this instruction for the API:  https://aws.amazon.com/de/blogs/aws/amazon-api-gateway-build-and-run-scalable-application-backends/I created an API Key. I chose that an API Key is required. I'm adding this API Key into my header on the request (using Postman to test the API.)deployed the api.I'm calling the api like this: https://XXXXXXXXX.execute-api.eu-central-1.amazonaws.com/prod/dataProblem:request looks like this (postman):GET /prod/data HTTP/1.1x-api-key: MY_API_KEYUser-Agent: PostmanRuntime/7.26.3Accept: /Postman-Token: 326808aa-a0c0-49fa-952e-bbac3ce2fe97Host: XXXXXXXXXX.execute-api.eu-central-1.amazonaws.comAccept-Encoding: gzip, deflate, brConnection: keep-aliveresponse (postman):Date: Thu, 13 Aug 2020 15:36:32 GMTContent-Type: application/jsonContent-Length: 23Connection: keep-alivex-amzn-RequestId: 12a821d3-77be-46d5-8889-b03fd98a1942x-amzn-ErrorType: ForbiddenExceptionx-amz-apigw-id: RNugJGJWliAFlHQ={"message":"Forbidden"}When I'm disabling the need of the API Key the API is working as expected.I'm not sure which step and/or setting I might have missed.Does somebody can help me?EDIT: Here is the Particle Webhook documentation. But I think it's not necessary as Postman also fails. So it is certainly not a webhook error. :)https://docs.particle.io/reference/device-cloud/webhooks/#sending-complex-dataBest,TimEdited by: T1mS on Aug 13, 2020 8:41 AMEdited by: T1mS on Aug 13, 2020 8:43 AMEdited by: T1mS on Aug 13, 2020 8:45 AMEdited by: T1mS on Aug 13, 2020 8:46 AMFollowComment"

Answer: "0Hi,I found my mistake. The problem was, that I forgot to asign the API Key to an Usage Plan.Now it is working as expected.CommentShareT1mSanswered 3 years ago"


Question: Launch Announcement: AWS IoT TwinMaker is now generally available

"Today, we are announcing the general availability of AWS IoT TwinMaker, a service that makes it easier for developers to create digital twins of real-world systems such as buildings, factories, production lines, and equipment. Customers are increasingly adopting digital twins to make better operational and strategic decisions in industries such as smart buildings, manufacturing, construction, energy, power & utilities, and more. With AWS IoT TwinMaker you now have the tools you need to build digital twins to help you monitor and improve your industrial operations.With AWS IoT TwinMaker, you can quickly get started creating digital twins of equipment, processes, and facilities by connecting data from different data sources without having to re-ingest or move the data to another location. You can use built-in data connectors for the following AWS services: AWS IoT SiteWise for equipment and time-series sensor data, and Amazon Kinesis Video Streams for video data. AWS IoT TwinMaker also provides a framework for you to create your own data connectors to use with other AWS or third-party data sources (such as Amazon Timestream, Snowflake, and Siemens MindSphere). Then, you can easily access all digital twin data using the AWS IoT TwinMaker unified data access API to underlying data sources without needing to query each data source individually.AWS IoT TwinMakerAWS IoT TwinMaker lets you model your physical environment using entities (e.g. any physical asset or system like a furnace, an assembly line, or an entire factory) and its components (e.g. data connectors) and then saves you time by automatically creating a knowledge (or digital twin) graph that combines and understands the relationships among the connected data sources. As your built environment evolves, for example if you add new sources of data, you can easily update your model so your digital twin remains accurate and current.Once the digital twin graph is created, you can then visualize the data in context of the physical environment. Using AWS IoT TwinMaker, you can import existing 3D models (such as CAD files, and point cloud scans) to compose and arrange 3D scenes of a physical space and its contents (e.g. a factory and its equipment) using simple 3D composition tools. To create a spatially aware visualization of your operations, you can then add interactive video and sensor data from connected data sources, insights from connected machine learning (ML) and simulation services, and equipment maintenance records and manuals. To help developers quickly build a web-based application for end users, such as plant operators and maintenance engineers, AWS IoT TwinMaker includes a plugin for Grafana and Amazon Managed Grafana, a fully managed service for the open source dashboard and visualization platform from Grafana Labs.AWS IoT TwinMaker is generally available in regions of US East (N. Virginia), US West (Oregon), Asia Pacific (Singapore), Asia Pacific (Sydney), Europe (Frankfurt), and Europe (Ireland), with more regions to come soon.To learn more visit the AWS IoT TwinMaker product page, and to find an AWS Partner to help you on your digital twin journey, visit the AWS IoT TwinMaker partner page. Use the AWS Management Console to get started, or visit our GitHub repository for a sample digital twin application.FollowComment"


Question: "Control CloudWatch Dashboard plot attributes, like line color?"

"I have a CloudWatch Dashboard with several widgets all with line plots breaking out the data by the same dimension.  I'd like to be able to somehow control the colors (or other plotting attribute) of the line such that data in each widget's plot is easy to relate to the other widgets.  For example, the plotted data lines are broken out by resource instances and I'd like all the line plots for a single instance to all be the same color.Is this possible? If so, how to do it in the CloudWatch console and/or the Cloudwatch CLI?Thanks,-KurtFollowComment"

Answer: "0I found an answer to my question about controlling line color on CloudWatch Dashboard graphs in addition to labeling the breakout dimension too.Color and label are controlled via the "Dashboard Widget Object: Rendering Properties Object Format" JSON documented here: https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/CloudWatch-Dashboard-Body-Structure.html?shortFooter=true#CloudWatch-Dashboard-Properties-Metric-Widget-Object.The JSON can be passed to the CLI at dashboard creation time as documented here: https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/put-dashboard.htmlAlso the CloudWatch Dashboard itself allows simple JSON editing of the properties via that "Action"->"View/edit source" control on the dashboard itself.It's pretty straight forward.  The only tricky part is the documentation for setting colors says "The six-digit HTML hex color code to be used for this metric." which I didn't inherently know.  There's a good reference web page for HTML color codes here: https://htmlcolorcodes.com/Turns out it all works better than I expected.Enjoy,-KurtCommentShareklarsonanswered 4 years ago"


Question: DMS SCT Terraform scripts

"Hi, can we create an Instance profile, Data providers and Migration project for DMS Schema Conversion using Terraform or Cloud Formation?Need to do on-premise(Oracle) to AWS RDS Aurora Postgres migration using AWS SCT and DMS.FollowComment"

Answer: "0The AWS provider for Terraform does support 6 of the 7 Database Migration Service (DMS) resource types (list below).The AWS provider does not support the Schema Conversion Tool (SCT) directly, but it appears that you can use the output from SCT when defining a DMS replication task.On our AWS Samples GitHub repository we have a AWS DMS Samples that demonstrates how to configure data migration between on premises and Amazon Aurora database in isolated VPCs using DMS.AWS Sample Codehttps://github.com/aws-samples/aws-dms-terraformAWS provider documentation (with examples)https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dms_certificatehttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dms_endpointhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dms_event_subscriptionhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dms_replication_instancehttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dms_replication_subnet_grouphttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dms_replication_taskhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dms_s3_endpointCommentShareawstyleranswered 3 months ago-1Please note Terraform or cloudformation is used to create resources in AWS cloud.SCT is currently a standalone tool wont support it.In case you are referring to DMS Schema Conversion in AWS Database Migration Service it is still not supported in cloudformation /terraform.CommentShareAWS-User-8174525-subhashanswered 4 months ago"


Question: Deploy an model trained using Sagemaker's built-in k-NN algorithm for AWS Panorama

"Hi, I'm trying to use a k-Nearest Neighbour model for deployment to an Edge device (AWS Panorama). I understand I need to create an optimized model to suit the target device. As I understand it the built-in algorithms all include a SageMaker Neo 'compile_model' function which I am running over my trained model -Build model..knn = sagemaker.estimator.Estimator(container,                                       role,                                        instance_count=1,                                        instance_type='ml.m5.2xlarge',                                       output_path=output_location,                                       sagemaker_session=sess,                                       input_mode='Pipe'                                   )# Setup the hyperparametersknn.set_hyperparameters(**hyperparams)knn.fit(fit_input, job_name=job_name)Build optimised model...optimized_ic = knn.compile_model(    target_instance_family="ml_c5",    target_platform_os="LINUX",    target_platform_arch="ARM64",    input_shape={"data": [1,3,512,512]},    output_path=s3_optimized_output_location,    framework="mxnet",    framework_version="1.8",)While the initial model builds fine I get an error running the optimised model / compile_model function:Failed. Reason: ClientError: InputConfiguration: No valid Mxnet model file -symbol.json found. Please make sure the framework you select is correct.I can find a few google references for attempts at something similar with KMeans algorithm, but is k-NN algorithm dramatically different? Do I just have the wrong settings? I understand all of the built-in algorithms use were originally mxnet trained? When I extract my model I only have three files:model_algo-1model_algo-1.jsonmodel_algo-1-labels.npyI am struggling to work out where I am going wrong in porting this model!FollowCommentdcoder4 a year agoI have similarly tried the SageMaker Neo conversion using the 'Panorama Test Utility' and the steps suggested to optimise the model there. The problem again seems to be an issue with the knn trained model not being based on mxnet or missing a '-symbol.json' file?Share"

Answer: "0The default Panorama service leverages NEO to compile and run the models.  Unfortunately, the 1P Sagemaker algorithms are not compatible with NEO.  Also, the Panorama service leverages Nvidia Jetson hardware, which is not compatible with the 'ml.m5.2xlarge' hardware.  With that said, Panorama now supports an option to "bring your own runtime" to Panorama that has recently been introduced that would allow you to leverage 1P Sagemaker models.  If you were to train your model with a GPU enabled instance (p3 or g4dn), the process would involve building your own custom container for Panorama with the MXNET 1.4 version installed.  If this is still something you are pursuing, reach out and I can help walk you through the process.CommentSharestvwhiteanswered a year ago"


Question: Pinpoint test message PERMANENT_FAILURE Access Denied

"I feel like I'm stuck in a parallel universe and chicken and the egg situation. I'm trying to use Pinpoint to send a voice message, but first I need to get an originating phone number. But my account first needs to be unlocked so that I can select Australia. I raised a support case, but they are telling me I need to send a test message. But how can I send a test message when I don't have an originating phone number? It's like a chicken and the egg with AWS support. Ripping my hair out!I am trying to send an SMS Test message from Amazon Pinpoint to a verified phone number. I'm still in Sandbox mode. I tried from two different accounts. I made sure I had no SCPs interfering.I went to Amazon Pinpoint, created a new project and then went to the Test message screen. I selected my phone number, selected TRANSACTIONAL and typed in a sample message. I pressed send and I get the following:Message not sent: We weren't able to send your SMS message to +614xxxxxx22.DetailsRequest Id 884 : [+614xxxxxx22: PERMANENT_FAILURE Access denied]I am logged in using Identity Center SSO with AdministratorAccess.I tried two different phone numbers.What is going on? Do my accounts have some kind of freeze on them? The error message is not very helpful as is does not tell me why access is denied even though I'm using Admin access.Thanks - difficult one...FollowComment"


Question: AWS SES not sending notification via SNS

"Hi,I have two verified email addresses of the the same domain.For both emails I use very same bounce notification SNS topic. If I send a test email for address 1 I get the notification, for address 2 I don't.All resources are in the same area. (eu-west-1)The domain also has valid DKIM records. Furthermore I have additional domains set up with the same email addresses (1 & 2) where the setup is working just fine.PS: I tested all with the Amazon SES mailbox simulator.FollowComment"

Answer: "0Accepted AnswerSo finally I got it working with help of the (paid) support. Here is the solution for all of you who run into the same problem:Quote:Now question is, does "hallo@domain.com" have a valid mailbox for receiving verification email? If yes, then you need to clicks on the verification email then the Email Identity will actually be verified and SNS topics set on this email identity are able to be triggered. If this is not a valid mailbox for receiving emails, then you will not receive verification email and the email identity remains "unverified" in the back-end. Hence, SNS topics set on this wouldn't work.*Since, 'domain.com' domain is already verified, you do not need to verify "hallo@domain.com" explicitly.  If you do want to do verify the email address then you need to make sure that 'hallo@domain.com' is a valid mailbox for receiving verification email and then clicking on the verification email.**Alternatively, you can:*Delete identity hallo@domain.comSet SNS notifications on identity domain.com which will capture bounces/complaints/delivery for all emails sent through SES for the domain.CommentShareStefananswered a year ago"


Question: boto3 sqs receive_message MaxNumberOfMessages

"Hi,we have a normal sqs (not FIFO), and trying to pull messages from it through python boto3 receive_message call specified here : https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sqs.html#SQS.Client.receive_messagemessage = sqs.receive_message(QueueUrl=queue_url,AttributeNames=['SentTimestamp'],MessageAttributeNames=['All'],VisibilityTimeout=120,MaxNumberOfMessages=MAX_RECEIVE_MESSAGES,WaitTimeSeconds=MAX_WAIT_TIME_SECS)and having a few questions.With understanding WaitTimeSeconds > 0 is called long polling.  Even if we have around 10 messages in sqs, setting WaitTimeSeconds = 2 secs, MaxNumberOfMessages =10, we still get 1 message by calling receive_message.  Is that expected behavior?Based on developer document, MaxNumberOfMessages does not guarantee receiving the specified number of messages but just give the API a chance to scan through servers which containing messages.   Am I understanding it correctly?We program a loop to call the above api multiple times (times =10) and do get 1 message each time - total 10 messages.   We wonder if such programming style would hit some sort of API limit (only allow certain times of receive_message call in a period).  Is there such limit existing?Will we be charged by each receive_message call?  What is the amount of charge by each call?Is it true only when the queue has > 5000 messages then we will see long polling returns more than 1 message?the api allow us to specify VisibilityTimeout.  However, if the SQS has a specified visibility timeout during creation.  Which one will take affect, the one specified in API or the one specified during SQS creation?where in real life, we will have a million message in the sqs at the very beginning.  if we set WaitTimeSeconds = 2 secs, will the call return in 2 secs or possibility less than 2 secs in case the single long polling returns 10 messages within 1 sec?our lambda is waken up by cloudwatch event every minute (shortest time can be specified by cloudwatch event rule), once waken up, it will run into a loop which keeps calling receive_message with MaxNumberOfMessages =10 until either the loop runs N times or received M number of messages.    Any issue with this design?Sorry for so many questions.  Thank you!FollowComment"

Answer: "0The number of messages that you will get depends on the load on the queue, where there will be more load, you will see more messages in a batch.You are charged for each API call, the price is $0.40 per 1 Million API calls. You can find more pricing information here.When you use long polling, the time you specify is the max wait time for messages. If there are messages in the queue, the call will return immediately.The visibility timeout that you specify when calling the API has precedence over the visibility timeout defined on the queue.After saying all of that, why are you consuming the messages this way? Why not trigger the function from a queue and let Lambda handle all of it for you? See the doc.CommentShareEXPERTUrianswered 6 months agoDavidYen 6 months agoAppreciate your answer.  We are running this way instead of configured the queue triggering the lambda is because this is very busy system (Actually we did try that in our production system and ran out of lambda number of instance allowance).  If there are thousands or millions of message in the queue, we are very easy to run out of lambda instance limit and we did experience that.  Is this a valid concern?  Any other suggestions?ShareUri EXPERT6 months agoJust ask for a limit increase. We increase that limit easily. Otherwise, the way you operate now, you have a single concurrency, which may not be enough to handle all the messages.Share"


Question: EC2 Instance suddenly cannot connect to Internet

"Need help on my Instance.My instance suddenly cannot connect to the internet, but can do ping to google. If you ask how about the VPC or Network configuration, the VPC itself used in different EC2 instance and the instance can connect to the Internet.The pic below is screen shot for apt updateThe pic below is screen shot for ping to googleThank you.FollowComment"

Answer: "0Have you taken a look at this troubleshooting guide - https://aws.amazon.com/premiumsupport/knowledge-center/ec2-connect-internet-gateway/#:~:text=To%20troubleshoot%20why%20your%20Amazon,isn't%20blocking%20the%20access.If it still does not work, you may have to enable VPC Flow logs in your VPC to determine the root cause - https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 7 months agoGoldenRama-ITS 7 months agoHi, currently I have no issue with the VPC, SecurityGroup or Route, since the VPC is used in different EC2 instance and running without issue with the internet.  And the firewall inside the server is currently disabledShare"


Question: How to optimize a batch of Spark Jobs on EMR to reduce overall processing time by 4-5x?

"A customer is running a batch of 25 nightly Spark jobs split across 2 EMR clusters processing in parallel.There are no dependencies between these jobs - They can all run in parallel.Overall they are fetching 250GB of data from these tables across all jobs.  The job completion time varies from 20 minutes to 4 hours for each job.  Their overall batch completion time is 12-14 hours.  They need to cut this time down to 2-3 hours.What will be the top-3 to 5 recommendations that they can try to achieve this in 1-2 weeks?The Spark code is straightforward - 1) Run SparkSQL to read data over JDBC and load DataFrame, 2) Transform/Join DataFrames, 3) Write DataFrames to S3 partitions.FollowComment"

Answer: "0Accepted AnswerHello. There are many factors to this. I am listing some below:a) What is the instance configuration? Is it sufficient? Do you want to reconsider it?b) Is auto scaling turned on?c) What does Spark UI say? Which task takes most time? Is it task that takes more time or more time is spent on waiting for resources?c) Read over JDBC , how many parallel connections are being used?d) Are you using dynamic partitions?These are some high level checklist which needs to be answered.Most important is the code , are you using repartiton/coalesce? Are you using any collect in code? Code is the main factor which usually causes performance issues. Please feel free to reach out to me if you will need any additional information.CommentShareSundeepanswered 2 years ago"


Question: SES - Email in suppression list.

"In SES while sending email, I am getting failed status due to email id in suppression list. When looking at suppression list, the email is not there. Tried to delete email from suppression list using cli (https://docs.aws.amazon.com/cli/latest/reference/sesv2/delete-suppressed-destination.html), It gives NotFoundException.What to do?FollowComment"

Answer: "0From the documentation: If an address is on the global suppression list, but not on your account level suppression list (which means you want to send to it), and you do send to it, SES will still attempt delivery; however, if it bounces, it still counts toward the bounce rate for your account and toward your daily sending quota.CommentShareJesse_Tanswered 2 months ago"


Question: Can AWS IVS serve as a Live Source in Elemental MediaTailor?

"Premise: I want to use an IVS livestream as program in a MediaTailor Channel to insert programmatic ads into a live stream. Mediatailor allows specific ad breaks in milliseconds as part of a program in a channel - Mediatailor  also allows for the use of live streams - I'm assuming that if I can import a live stream as a program into a Mediatilor channel, that I can insert timed ads into the live stream.The issue I'm having: Creating a program in a MediaTailor Channel does not allow for Live SourceI can add a live stream to one of my source locations for MediaTailor without issue, and it accepts the stream, returning the message "Reference this live source in programs within a MediaTailor channel." BUT when I go to add a program to my new Mediatailor channel it requests: "Select an existing source location" - which I do, then it requests "Select an existing VOD source" - there is no way to choose my live source from the source location even though it is listed under the correct source location.I know this is fairly obscure - but if anyone has any solutions to bringing live streams from IVS into MediaTailor Channels - I'd love to hear about it!Thanks!FollowComment"

Answer: "0Hi,The source for AWS Elemental MediaTailor needs to have SCTE-35 ad markers like described here : https://docs.aws.amazon.com/mediatailor/latest/ug/what-is-flow.html.The Amazon IVS output HLS streams do not have those (nor the service has the ability to insert them) so ad insertion/replacement with AWS Elemental MediaTailor and IVS is not possible.ThanksCommentSharePedro_Fanswered 3 months agoRadiant RePoster 3 months agoThanks so much for your response. We know however, that MediaTailor is capable of ingesting a live feed. Here is this method described:https://docs.aws.amazon.com/mediatailor/latest/ug/channel-assembly-working-live-sources.htmlSo if IVS cannot provide the required live feed, what product within AWS can?Thanks for your time an consideration.Share0The first answer we received on this simply states that ad insertion/replacement using IVS as a source is not possible.This would lead to the next question: when MediaTailor specifies a live source - what source are they suggesting as an ingest?Here's documentation that shows that MediaTailor can, in fact, accept a live source:https://docs.aws.amazon.com/mediatailor/latest/ug/channel-assembly-working-live-sources.htmlAnd here's a screen shot showing a live feed ingested into a source location in MediaTailor:So if an IVS live stream cannot be used - what can?Any assistance appreciated!CommentShareRadiant RePosteranswered 3 months ago"


Question: DynamoDB in step function is not able to put item with map field

"I am trying to put an item at dynamodb via step function. I am having issue when the item includes a map field which contains a list. For example.My step function{  "Comment": "A description of my state machine",  "StartAt": "DynamoDB PutItem",  "States": {    "DynamoDB PutItem": {      "Type": "Task",      "Resource": "arn:aws:states:::dynamodb:putItem",      "Parameters": {        "TableName": "test",        "Item": {          "ID": {            "S.$": "$.input"          },          "Info": {            "M.$": "$.info"          }        }      },      "End": true    }  }}My input to the step function{  "input": "Second",  "info": {    "name": "John",    "age": "30",    "cars": [      "Ford",      "BMW",      "Fiat"    ]  }}The error I am recieving.An error occurred while executing the state 'DynamoDB PutItem' (entered at the event id #2). The Parameters '{"TableName":"test","Item":{"ID":{"S":"3"},"Info":{"M":{"name":"John","age":"30","cars":["apple","pear"]}}}}' could not be used to start the Task: [Cannot deserialize value of type com.amazonaws.services.dynamodbv2.model.AttributeValue from Array value (token JsonToken.START_ARRAY)]FollowComment"

Answer: "0Hey tj! The MAP type need to have each property also mapped to the right type (see this link). If the map has a well defined format, you can map each property at the PutItem.If the format is unknown, my recommendation is to try the ExecuteStatement with a PartiQL statement as it accepts JSON like maps. Only note that you'll need to do some transformation to convert the double-quotes (") to single-quotes (').I did the test here:INSERT INTO "Teste" VALUE {  'id': 'Second',  'info': {    'name': 'John',    'age': '30',    'cars': [      'Ford',      'BMW',      'Fiat'    ]  }}and at the table I have:{ "id": {"S": "Second"}, "info": {  "M": {   "age": {"S": "30"},   "cars": {    "L": [     {"S": "Ford"},     {"S": "BMW"},     {"S": "Fiat"}    ]   },   "name": {"S": "John"}  } }}CommentShareEduardoanswered 10 months agotj 10 months agothank you for the reply, can you please post your step function json? I can't figure out how to insert the PartiQL query into ExecuteStatementShare"


Question: How do I group timeseries data by field to view on stacked area graph?

"I would like to view a timeseries data grouped by some field name on a stacked area graph.It understand how to do either by field or by time slices, but I cannot understand how to do both at the same time so I can view a stacked area graph grouped by a field.E.g. I group by field like this (it produces only a bar graph):fields @message    | parse @message "[*] something*,*" as hash, taskName, restOfMessage    | display @timestamp, taskName, restOfMessage    | filter ispresent(taskName)    | stats count(*) by taskNameOr like this (produces a stacked area with just one line, and I want it to have lines for every taskName):fields @message    | parse @message "[*] something*,*" as hash, taskName, restOfMessage    | display @timestamp, taskName, restOfMessage    | filter ispresent(taskName)    | stats count(*) by bin(30s)Would appreciate any adviceFollowComment"

Answer: "0You can visualise in 'Stacked area' or 'Line' graph, when you use the bin() function. Hence, you were able to get the stacked area chart in your second query only.For queries, where you group by fieldName and not use bin() function, stacked area and line charts cannot be visualised. Such queries generate bar charts only. This restriction is mentioned on AWS documentation here.To be able to plot a stacked area chart with grouping for different fields - you can modify the query to include aggregation across the fields' possible values in your stats statement. This can be done by having different taskName(s) specified across the function you use for aggregation.For example, in the query below I have used sum() function across different taskName(s):fields @message| parse @message "[*] something*,*" as hash, taskName, restOfMessage| display @timestamp, taskName, restOfMessage| filter ispresent(taskName)| stats sum(taskName = 'task1') as task1, sum(taskName = 'task2') as task2, sum(taskName = 'task3') as task3 by bin(30s)Change the above query accordingly to include as many taskName(s) necessary, and by using the appropriate values for taskName (task1, task2 etc.) in the sum() function's attributes.This should allow for a stacked area chart to show up, with stacks for each different taskName. Hope this workaround helps!CommentShareSUPPORT ENGINEERShreyas_Manswered 9 months ago"


Question: Transfer server - bulk import - rsync

"Hello, I'd like to ask what is the recommended way for bulk import of files into the AWS Transfer service.We'd like to migrate all files from one of our current SFTP servers into the AWS S3 bucket using Transfer server and use that transfer server for future sftp uploads. What would you recommend to use for such use case.I'm not sure if it's possible to use tools like rsync, since it seems that rsync needs remote ssh shell on the sftp server to do that, but AWS Transfer doesn't seem to allow that.Is it possible to utilize rsync here or is there any other way?ThanksFollowComment"

Answer: "0Hi petergh,One way you could migrate files from your on-prem storage server (NFS) into your S3 buckets is by using AWS DataSync (https://aws.amazon.com/datasync/). Once you've seeded your bucket with data, you can use the same bucket(s) for access through AWS Transfer for SFTP.Please let me know if you have any questions about this set up or run into issues.Thanks,SmithaCommentShareAWS-User-9826533answered 4 years ago0Proposed solution with AWS DataSync seems reasonable, however we didnt choose it as a way to go. We were also thinking about using simple aws s3 sync command.However in the end we will be transferring 10+ TB of data so we might end up with the AWS Snowball service. ThanksCommentSharepeterghanswered 4 years ago0petergh:Can you share your pros/cons of using Snowball over DataSync?ThanksPaulCommentSharePaul_Ranswered 4 years ago0I guess most significant reason for snowball was the bandwith.We couldnt consume all of 1Gbps bandwith just for this transfer and with limiting bandwith it would take at least 3 weeks to transfer 10+ TB and this is with the transfer running non-stop the entire time.With the snowball this can be achieved in less time even with the shipping times included.CommentSharepeterghanswered 4 years ago"


Question: Selectively Exposing ECS Fargate Volumes Between Containers

"Questions:What is the best way to selectively expose volumes between containers of the same ECS Fargate task? My intention is to access data from another container, but don't need access to all of its volumes.Can the secondary container mount path be changed when using volumesFrom? It appears that all of the volumes from the source container automatically mount to their same path in the secondary container.Intended Scenario:We would like our Nginx container to have readonly access to our PHP containers application root - which I imagine is a pretty common use case.The PHP container mounts the following volumes with full read/write access:/app/web (Exposed via the Docker VOLUME directive)/app/web/sites/default/files (EFS Access Point Volume mounted to this directory)The Nginx container needs readonly access to the full /app/web directory. However, when importing the PHP container volumes using volumesFrom with readOnly set to true, the /app/web/sites/default/files directory is not mounted (likely because the directory /app/web is a readonly mount). Additionally, adding /app/web/sites/default as a separate mountPoint (using the same EFS Access Point and attempting to point the mountPoint to the containerPath of /app/web/sites/default/files), doesn't appear to work - again, I assume this might be an issue with the /app/web volume being mounted as readonly.I have also attempted to mount the /app/web/sites/default/files EFS Access Point to a directory (/app/public_files) outside of the /app/web volume mount, and having an entrypoint script create a symlink from /app/web/sites/default/files to /app/public_files; however, if the /app/web volume is mounted as readonly, then of course the symlink cannot be created.My only other solution is to not mount the volumesFrom as readonly, but that wouldn't prevent nginx from writing to those directories.Thanks in advance for your help.Edited by: soleson on Jul 1, 2021 4:22 PMEdited by: soleson on Jul 2, 2021 8:22 AMEdited to better clarify the issue, also changed the title as it was not really that relevant to the context of the question.FollowComment"

Answer: "0I'm still looking for a bit of an assit here as I've spent a couple days researching this topic.Either of the following solutions would resolve my issue if they are possible:How do you mount a single EFS Volume Mount from one container into another container within the same Fargate task.Is it possible to overwrite a mount created via volumesFrom by specifying a separate mount with the same containerPath?CommentSharesolesonanswered 2 years ago0So I had a complete misunderstaning of how the bind mounts had to be set up in order to selectively mount directories inside other containers of the same Fargate task. I've since resolved this issue by:Adding the volumes decalared in the Dockerfile with VOLUME to the container, using the containerPath as specified in the Dockerfile and the same sourceVolume as defined in the volumes property of the task definition.Then we mounted the volume via a mountPoint on the desired container by specifying the containerPath and using the same sourceVolume.We were then able to specify that the mountPoint should be readOnly.Hopefully, this helps someone else running into a similar issue.CommentSharesolesonanswered 2 years ago"


Question: Cannot see files in S3/Glacier when using Synology Glacier app for backup

"HiI'm using my new Synology NAS and its app Glacier to backup my files to AWS Glacier. Everything is fine. Glacier vaults are in place and files are in there.I was curious to see how Synology use S3 Glacier. So, I tried to find the corresponding S3 bucket used by Synology App.... but there is no bucket ...Question : How can I have all my files in Amazon Glacier and not having a S3 bucket with my files ?ThanksFollowComment"

Answer: "0Hi Luc!if you don't find any S3 bucket containing your backup files inside (tagged with Glacier Storage Tier), for my understanding, this means Synology uploads your files directly to the vault as a single full backup (not incremental).During the restore process, Synology triggers a set of API calls to query that vault and restoring a particular set of files you need.Cheers,NicoCommentShareNicoMarinoanswered a year ago"


Question: When will CodeBuild offer nodejs v18 (or higher)?

"As the title says.Highest nodejs runtime currently available is v16, which is quite old. https://docs.aws.amazon.com/codebuild/latest/userguide/runtime-versions.htmlI have dependencies with important security updates that I cannot use with nodejs v18 or higher.FollowComment"

Answer: "1All CodeBuild images use the n command to install the Node version.This command is available to you during the build. The delay is negligible in my experience, and it takes just a few seconds to upgrade Node.Docs: https://github.com/tj/nAdd this to your Install phase:n install 18node --versionI prefer to do this regardless of the available versions in the image, just to make sure the same Node version is used in all environments.I use .nvmrc file to maintain the version in the project.Then in every CodeBuild project, I install the exact version this way:n install $(cat .nvmrc)node --versionAnd if you use GitHub Actions, it has support for that as well:That way, I just need to change the version in one place.CommentSharem0ltaranswered 4 months ago"


Question: Load balancer cannot connect to on-premise server connected by openvpn

"Hi, I have an elastic beanstalk website and I want to direct some of the traffic to an on-premise server.  The website is supported by an application load balancer.I have an OpenVPN Access Server, behind it is an on-premise web server running gunicorn directly (no nginx), listening on 0.0.0.0:80The ip of on-premise server is 172.27.160.2.  I can access the on-premise server using another computer connected to the OpenVPN (172.27.160.3)Firewall on the on-premise server is disabled (sudo ufw disable)I have the following routes in VPC IP Table0.0.0.0/0igw-{internet gateway interface}172.27.160.0/20eni-{interface of the instance running openvpn}...I have run VPC Reachability Analyzersource: 172.31.28.193/32 (an instance spawned by elastic beanstalk)target: 172.27.160.2Reachable (after turning off Source/dest check)I have added 172.27.160.2 as a Target to a Target Group.  It says "unhealthy" and "Request timed out"I think the reachability analyzer suggest that I have configured the openvpn server correctly, problem seems to be on the load balancer refusing to reach the 172.27.160.2 subnetAny help is much appreciated.FollowComment"

Answer: "0I'm not 100% sure this will work but I'm also not 100% sure it won't.What subnet(s) is(are) the load balancer on? If it is different to the workload subnet then make sure the routes on both subnets are the same.CommentShareEXPERTBrettski-AWSanswered 15 days agohayena zingh 15 days agothanks, from "Network Mapping", load balancer is on a VPC with subnet 172.31.0.0/16. Availability Zones:  172.31.16.0/20,  172.31.0.0/20,  172.31.32.0/20. I don't know what you mean by workload subnet, is it the one where the beanstalk instance resides? p.s.I don't know how to run reachability analysis from load balancer to the on-premise server, or it would make things easier. I don't even know the ip of the load balancerShareBrettski-AWS EXPERT14 days agoIf you've only got three subnets (one per AZ) then the ALB will have an interface (and an IP address) on each; so testing reachability from an EC2 instance on that subnet is a good start. Any chance there is a security group on the ALB that is preventing access?Share"


Question: EC2 instance unexpectedly reboots itself

"Hi,Instance unexpectedly rebooted itself at 5:07, and we cannot figure out what is the root cause./var/log# journalctl --list-boots-1 d1c45ee0e2f44522a4bb13374340bfc6 Wed 2020-06-03 09:25:34 UTC—Thu 2020-06-04 04:55:06 UTC 0 3f210ffe0ea24afe83d81cd99e8fba81 Thu 2020-06-04 05:07:47 UTC—Thu 2020-06-04 14:51:20 UTCAttaching syslog if that could be of any help.Instance id: i-01ced54cdba63ac89Could someone from Amazon please check this?Thank youFollowComment"

Answer: "0Hello,I have looked at instance, and found there was an underlying hardware issue at the time(2020-06-04 04:00:00 UTC to 2020-06-04 05:00:00 UTC) where it experienced unexpected reboot. It has been stable since.For additional information , please refer to the below details:System status checksMonitor the AWS systems on which your instance runs. These checks detect underlying problems with your instance that require AWS involvement to repair. When a system status check fails, you can choose to wait for AWS to fix the issue, or you can resolve it yourself. For instances backed by Amazon EBS, you can stop and start the instance yourself, which in most cases results in the instance being migrated to a new host. For instances backed by instance store, you can terminate and replace the instance.The following are examples of problems that can cause system status checks to fail:Loss of network connectivityLoss of system powerSoftware issues on the physical hostHardware issues on the physical host that impact network reachabilityCommentShareAWS-User-5718909answered 3 years ago0Thanks for clarification on this issue. Stopping and starting the instance solved the problem indeed, even though we experienced the same unexpected reboot with some other instances as well. Now upgraded our AWS Support Plan so will check with support engineers directly in the future to determine the root cause.Thank you!Edited by: 3Libras on Aug 28, 2020 6:53 AMCommentShare3Librasanswered 3 years ago"


Question: Debian buster : EE certificate key too weak

"Hello,I tested yesterday the Debian Buster 10 with a connection to DocumentDB with pymongo (python3).I got an error with openssl that failled any connection to DocumentDB :pymongo.errors.ServerSelectionTimeoutError: docdb-XXXXXXXX.eu-west-1.docdb.amazonaws.com:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: EE certificate key too weak (_ssl.c:1076)openssl version 1.1.1Do you know if the certificate will be updated or if it requires to configure openssl to not get this exception?RegardsFollowComment"

Answer: "0We are in the process of upgrading our root certificate. In the meantime, depending on your requirements, an additional option is to modify (/etc/ssl/openssl.cnf) from “CipherString = DEFAULT@SECLEVEL=2” to “CipherString = DEFAULT@SECLEVEL=1”CommentShareAWS-User-2073714answered 4 years ago0{ "organizations:ListRoots : zachryiixixiiwood@gmail.com" }CommentShareZACHRY T WOODanswered 4 months ago0run::/'-''  '-'"{ '"organizations:ListRoots : arn:aws:iq:global::request/MDZJSVZNHS :cr12753750.00bitore341731337@gmail.com" '}":','' 'return'' ':'' 'run''CommentShareZACHRY T WOODanswered 4 months ago0run::/{ "Gunit/truffle-rb.mn/rouges-den./package.yaml/API : cr12753750.00bitore341731337@gmail.comCommentShareZACHRY T WOODanswered 4 months ago"


Question: Company URL's are down need help

"www.albcommercialcapital.com- Company websitehttps://www.albcommercialcapital.com/auth- Company CMS SiteBoth sites are not coming up on internet and I am told that AWS went down, but that was 2-3 days ago.FollowComment"

Answer: "2Hello! The web server that is hosting that website is returning the HTTP code 200 ("OK"), which means there's no communication issue and that technically the website is up, despite showing a blank page.As AWS does not have visibility inside the instances for your own security and privacy https://aws.amazon.com/compliance/shared-responsibility-model/ I recommend that your website administrator takes a look at the web server  files and Apache logs to determine what's causing this issue.CommentShareSUPPORT ENGINEERFrancisco_Lanswered a year agoFrancisco_L SUPPORT ENGINEERa year agohello! I just rechecked and noticed that your website is now displaying the full page without issue. I'm glad you were able to solve this! Have a great dayShare"


Question: Configuring Edge device for direct or via gateway communication

"Hello,I would to know about the aggregation/gateway functionality of Greengrass and how I could apply this in the following scenario.I have setup a single Greengrass core device, A group and a core and I have added 2 devices (AWS IOT SDK is running in 2 ubuntu 18.04 Docker containers on a physical machine in the same network as the Greengrass core device). The communication between the edge devices (containers) and the IoT Core is working fine with MQTT message sent and recieved both by edge devices and IoT core.I would like to knowif the MQTT messages could be made to be sent through the Greengrass core device acting as a gateway instead of direct connectivity to the IoT core from the edge device.Could the edge device be configured so that communication can be switched between direct connectivity and via the gateway/aggregator based on presence of internet connectivity between edge device and IoT core?Thank you,FollowComment"

Answer: "0Hi,if the MQTT messages could be made to be sent through the Greengrass core device acting as a gateway instead of direct connectivity to the IoT core from the edge device.Greengrass V1 supports Greengrass Aware Device (GGAD) which are Greengrass aware IoT Things. GGAD's can send messages to IoT Core via GGC Core (Greengrass core device acting as a gateway). Developer guide : https://docs.aws.amazon.com/greengrass/latest/developerguide/module4.htmlGreengrass V2 unfortunately does not provide GGAD yet. We are actively working on addressing this gap and hope to release it in the coming months. Until that time, you can use Greengrass version 1 or you could use this example code for V2 (https://github.com/aws-greengrass/aws-greengrass-component-examples/tree/main/mqtt-bridge) as a skeleton for implementing your own MQTT broker on V2 in order to support remote devices.Could the edge device be configured so that communication can be switched between direct connectivity and via the gateway/aggregator based on presence of internet connectivity between edge device and IoT core?The option for GGAD to switch between direct connectivity and connecting via Greengrass core based on internet connectivity is NOT supported.Regards,FahadCommentShareAWS-User-3001960answered 2 years ago0Thank you for your reply Fahad,I noticed that even when the GG core is not started, the GGADs of the group can send messages to IoT core.Please let me know how I could strictly route the messages via the Greengrass core when internet connectivity of one or both of the GGAD's is disrupted. Im guessing i would have to have a Lambda running on the Greengrass core that subscribes to a common topic which all GGAD's publish to, The GG core will then publish that to another topic which can be subscribed by the IoT core. The IoT core will have all the subscriptions setup for the above communication paths. Is this possible?Also please point me to resources where the GG core is used as a gateway to multiple GGAD's. I do not need inter-device communication in my use-case.Edited by: avikurup on Feb 3, 2021 5:49 AMCommentShareavikurupanswered 2 years ago"


Question: How to export the variable when connecting via session manager connect

"Hi Team,How to export the variable when connecting via session manager connect for linux OS.I tried adding to the bashrc, /etc/environment, and /etc/profile did not work.FollowComment"

Answer: "0You can use Allow configurable shell profiles - https://docs.aws.amazon.com/systems-manager/latest/userguide/session-preferences-shell-config.htmlYou can either set variables directly under Linux shell profile, or you can create a script on the EC2 instance to set the variables and add a step to invoke that script in configurable shell profile.CommentShareVaibhav Janswered 2 months ago"


Question: Github release deployment ( Amplify )

"Hello, I'm using GitHub source control to manage all source code. I have set up 3 branches in our AWS amplify ( within APP ).3 connected branches list :develop, staging, mainI need to generate a release in GitHub from the staging branch and then deploy that release in the main branch using amplifyIt's possible to deploy the GitHub release via AWS Amplify? Or do I need to generate PR from staging to main then I need to merge code in main and then amplify will deploy code?FollowComment"

Answer: 0This should help get you going in github hereCommentSharejthornes-awsanswered 10 months ago


Question: AWS Cloudshell - Highlighting Bug

"Hi Guys, I'm very new to this, and I come from a UNIX BASH background.I'm playing around in CloudShell, and if I double-click on a text string, I would expect it to highlight that string. In actual fact, it *nearly highlights that string instead.Let's say I have the string: "I really like badgers".If I were to double click on "badgers", the highlighting would visually shunt to the left by two characters, so this would be highlit: "e badge". However, if I then copy and paste this, it would paste the string "badgers".Similarly, If I MANUALLY tried to drag highlight the word "badgers", it would not highlight the last two characters, like this: "badge". When I copy/paste that it would paste the phrase "dgers".Can anyone else verify this bug?FollowComment"

Answer: "0It seems that there is a visual highlighting bug in CloudShell that occurs when double-clicking on a text string. The highlighting shunts to the left by two characters, but copying and pasting the selection still copies the correct string. Similarly, manually dragging to highlight a word may not include the last two characters, leading to incomplete copying and pasting.CommentShareAWS_Guyanswered 2 months ago"


Question: Failed smtp server

"email was working well on my server until I was asked to change by AWS.I am getting this errow and can no longer sent email. AWS said nothing is wrong at their end.Here is the error:Failed to authenticate smtp server with username "....."   using 2 possible authenticators. authenticator login returned expected code. The authenticator PLAIN return expected response code 235 but got code "535", with message 55 authentication credentials invalid.FollowComment"


Question: SES Complains not being logged by SNS

"In AWS SES I have a complaint rate of 0.18% which isn't too bad, but I want to figure out who is complaining and I just can't do that.  If I look in cloudwatch I can see several complaints coming in each day.  The only daily SES emails going out are from a wordpress plugin I have setup.  I've confirmed this by matching email numbers in AWS SES and in my wordpress plugin.  I've also setup AWS SES+SNS to send me an email for both bounces and complaints.  All the tests I've ran using the amazon sandbox emails get reported.  I've also seen a bad email being submitted to my website getting properly reported by AWS SNS to my email.  However, I just don't get complaints showing up in cloudwatch reported via SNS.  The other weird thing is all the recent emails sent out are things almost nobody would complain about (order updates, tracking numbers, and stuff like that).  I just can't figure out where these complaints are coming from.Are there a certain class of complaints that can't get reported through SNS or do you have any ideas on things I should look into?  (I don't know much about these amazon services, but I am trying to learn.)  Thanks!FollowComment"


Question: Deeplens Registration

I am trying to register a DeepLens v1.1.  I have created a boot usb drive and did a Factory Reset.  The device will still not register (either via the 1.1 or the 1.0) method.When I try the 1.0 method I get stuck with "The security token included in the request is invalid".   Therefore I can't create roles or get certificates.I can log into the DeepLens just fine -- and apt and apt-get work fine -- I have followed all the reset instructions on the AWS site -- and there is very little info there or anywhere (all info on this site does not work or is not answered)Please Help !FollowComment

Answer: 1I debugged this with AWS support and after spending many hours the "The security token included in the request is invalid" is caused by not enabling Multi-Factor-Authentication MFA on your root or user account.CommentSharematt_the_hatanswered a year agoBrock 10 months agoJust got back to this -- you were spot-on -- activated MFA and no problem from there.  Thank you !!!!!Share0I am having the exact same issue. No results so far. Raised a ticket with support. If I get some progress will update. Feel your painCommentSharematt_the_hatanswered a year ago


Question: Opening encrypted object url in browser gives error

"I have encrypted my S3 bucket with AWS-KMS. The idea is that when a user clicks an export button on web page the api is going to create an excel sheet of the data > upload it on the S3 and return the uploaded sheet url back to user (opening it on a new tab) so the user can download the excel sheet.We are using lambda + api gateway for this project. The code looks something like this://...excel is generated    const s3 = new aws.S3({maxRetries: 10, signatureVersion: "v4"});  const stream = new Stream.PassThrough();    let uploadedFileName = excelFileName _ "_" _ Date.now() + '.xlsx';    await workbook.xlsx.write(stream);  let uploadResponse = await s3.upload({      Key: uploadedFileName,      Bucket: process.env.awsBucket,      Body: stream,      ACL: 'public-read',  }).promise();    return { url: uploadResponse.Location };  So the api gateway sends the following response:{"success":true,"response":"https://my-bucket.amazonaws.com/the-excel-file.xlsx","errorCode":0,"message":"Success"}The front end then opens the response link in a new tab where it gets downloaded.Before the AWS-KMS encryption, this method was working well. However since I have encrypted the buckets when the file url is opened it gives the following error on the browser:<Error>  InvalidArgument  <Message>Requests specifying Server Side Encryption with AWS KMS managed keys require AWS Signature Version 4.</Message>  <ArgumentName>Authorization</ArgumentName>  <ArgumentValue>null</ArgumentValue>  <RequestId>0M40K5V3CKDG6V3R</RequestId>  <HostId>JmKng3cm+HKNxFL8Pa0dZroosasBJy/8xxTsNqoFhOa/bR8inWeWeSr5iHTtPReOpIp5ayh3tw4=</HostId>  </Error>  Is there a way to return the decrypted file url to user or any other alternate solution to this?FollowComment"

Answer: 0Apparently it seems that we can do a getSignedUrl method and it will automatically return the signed url for the file which can be used to download it.CommentShareneeraj87answered 2 years ago


Question: Payload size limit on API Gateway

"A customer is using API gateway, Lambda, and DynamoDB to build an API. They need an image uploading function and expect to receive 100-1000 images in the range of 5-50MB in size. API Gateway has a "payload size" limit of 10MB. Is there a way for them to implement the file upload functionality on the API and not be restricted by the payload size limit? What workarounds have other customers implemented?FollowComment"

Answer: "0Accepted AnswerInstead of posting the data directly to the API endpoint, they could implement their client to upload the image to S3 storage first and provide API Gateway a pointer to the bucket and key. If the operation can be asynchronous, you could use API Gateway to vend a signed URL for S3 to the client and use S3 notifications to handle the image processing via Lambda after the upload is completed.CommentShareEXPERTAWS-User-0860851answered 6 years ago"


Question: Urgent - Issue with Last Name

"Hi,I have upcoming PSI exam for SAA-C02 on 13 Oct 2020 in Singapore, at one of the testing center. My full name is only one name 'Kasim' without any last name. During the account / exam registration, I need to use '.' for registration.As my valid ID only contains Kasim (without .), can I still be admitted to the test center to take my exam?Please advise whether I need to postpone or reschedule my exam.My details:Candidate ID: AWS01670495Registration Number: AAK3RNWRThanks,KasimEdited by: Kasim on Oct 11, 2020 6:25 AMFollowComment"

Answer: 0The problem had been resolved and I had attended and passed the exam. ThanksCommentShareKasimanswered 3 years ago


Question: AWS Pinpoint seems to be sending multiple copies of the same SMS (though API was called just once)

We have noticed that in some cases some users are getting the same sms repeatedly. We can see from our logs that the request was made to PINPOINT just once and even the callback we received is a single one.Are these kinds of cases common? What are the possible scenarios?FollowComment

Answer: "0Hello Sudip,I understand that you have noticed Pinpoint sending duplicate SMS messages to some users, even though API was called only once.Pinpoint service does not send multiple copies of same SMS message. Pinpoint SMS service, instead, relays messages to downstream provider and phone carrier. In oder to investigate this issue, we need to troubleshoot based on your specific scenario. Since we cannot discuss account specific troubleshooting on re:Post, we suggest to reach out to AWS Support with specific details, including message ids and timestamp of duplicate messages.CommentShareSUPPORT ENGINEERIsha_Kanswered a year ago"


Question: Directory deregister is not possible even though all workspaces have been deleted

"For testing, I registered Directory to Workspaces.After completing the test, I deleted Workspaces and tried Directory deregister.However, deregister failed with the following error message.==An Error Has Occurred.If you continue to experience an issue contact the AWS Support Team on the community forums and via AWS Premium Support at: AWS Support Center.When checking the corresponding DeregisterWorkspaceDirectory event in CloudTrail's event history, the following error message was confirmed.=="errorMessage": "There are WorkSpaces assigned to this directory. You must remove the WorkSpaces before you deregister the directory.",Contrary to the error message, all WorkSpaces associated with the directory are in a state of being deleted.Even if I commanded the describe-workspaces command through the AWS CLI, it is confirmed that there are no Workspaces in the current target region.Is there anything else that can be checked in that situation?If the issue you are experiencing is caused by a bug, is there a way to report the bug?FollowComment"

Answer: "0To answer your question, we require details related to your account that are non-public information. Please open a support case with AWS using the following link.CommentShareAWS-User-8431964answered 3 months ago"


Question: AWS Sagemaker splitting between training and validation and ClientError

"Dears,I started working with Sagemaker! In other words, I am new with this service.I have a db contains some facial images for three races black/white/asian and two genders male/female. I would like to use sagemaker AWS to train/model it. I created train and validation labels and sepreated data into 6 classess for training and validation: (asian female af/black male bf/white male wm/etc)s3://dbimgraces/af/s3://dbimgraces/am/s3://dbimgraces/bf/s3://dbimgraces/bm/s3://dbimgraces/wf/s3://dbimgraces/wm/The first question is that we only have 20 channeles in sagemaker, 6 trainings+6 validations+6 train lables+6 validation lables=24 channels which wont be accepted by aws sagemaker. How can I solve this issue? Is any advice for splitting and structuring about the model?The second question is that with every combination (train/validation/train-lb/validation-lb), I get the following error? why?ClientError: Unable to initialize the algorithm. Failed to validate input data configuration. (caused by ValidationError) Caused by: Additional properties are not allowed ('validation-lb-bm', 'validation-lb-bf', 'train-lb-bf', 'train-lb-bm' were unexpected) Failed validating 'additionalProperties' in schema: {'$schema': 'http://json-schema.org/draft-04/schema#', 'additionalProperties': False, 'anyOf': [{'required': ['train']}, {'required': ['validation']}, {'optional': ['train_lst']}, {'optional': ['validation_lst']}, {'optional': ['model']}], 'definitions': {'data_channel': {'properties': {'ContentType': {'type': 'string'}}, 'type': 'object'}}, 'properties': {'model': {'$ref': '#/definitions/data_channel'}, 'train': {'$ref': '#/definitions/data_channel'}, 'train_lst': {'$ref': '#/definitions/data_channel'}, 'validation': {'$, eClientError: Unable to initialize the algorithm. Failed to validate input data configuration. (caused by ValidationError) Caused by: Additional properties are not allowed ('lb_bf', 'valid_af', 'valid_bm', 'lb_wm', 'tr-bm', 'valid_wm', 'tr-am', 'tr-wf', 'lb_bm', 'lb_am', 'lb_wf', 'tr-af', 'tr-bf', 'valid_bf', 'valid_wf', 'lb_af', 'valid_am', 'tr-wm' were unexpected) Failed validating 'additionalProperties' in schema: {'$schema': 'http://json-schema.org/draft-04/schema#', 'additionalProperties': False, 'anyOf': [{'required': ['train']}, {'required': ['validation']}, {'optional': ['train_lst']}, {'optional': ['validation_lst']}, {'optional': ['model']}], 'definitions': {'data_channel': {'properties': {'ContentType': {'type': 'string'}}, 'type': 'object'}}, 'properties': {'model': {'$ref': '#/definitions/data_channel'}, 'train': {'$ref': '#/definitions/data_channel'}, , eClientError: Unable to initialize the algorithm. Failed to validate input data configuration. (caused by ValidationError) Caused by: Additional properties are not allowed ('train-lst', 'validation-lst' were unexpected) Failed validating 'additionalProperties' in schema: {'$schema': 'http://json-schema.org/draft-04/schema#', 'additionalProperties': False, 'anyOf': [{'required': ['train']}, {'required': ['validation']}, {'optional': ['train_lst']}, {'optional': ['validation_lst']}, {'optional': ['model']}], 'definitions': {'data_channel': {'properties': {'ContentType': {'type': 'string'}}, 'type': 'object'}}, 'properties': {'model': {'$ref': '#/definitions/data_channel'}, 'train': {'$ref': '#/definitions/data_channel'}, 'train_lst': {'$ref': '#/definitions/data_channel'}, 'validation': {'$ref': '#/definitions/data_channel'}, , eFollowComment"

Answer: "0A channel in SageMaker Training job is not defined as a class. It's defined as a source type. You can have EFS as a channel or S3 as a channel. For S3 type, if you set prefix as s3://dbimgraces, everything under this bucket will be downloaded into /opt/ml/input/data/channel_name of the training instance.The main task of channel is provided a download source and pattern. You could further process your data in your training script.This error is related to how you put your input data config. If you could show this corresponding section, we could take a further lookCommentShareAWS-User-5210721answered 5 months agogreencomputing 5 months agoThanks for your comment. Suppose that I use the image classification algorithem for training. How can I config my training script? Actually, inside my bucket s3://dbimgraces/output/ , there are 6 folders for 6 classess and 12 lables files (6 for traning lables+6 for validation lables).Sharegreencomputing 5 months agoMy valid and training lables are like:1 1./output/af/af05.tif2 1./output/af/af08.tif3 1./output/af/af11.tif4 1./output/af/af09.tif5 1./output/af/af12.tif6 1./output/af/af07.tif7 1./output/af/af10.tif8 1./output/af/af02.tif9 1./output/af/af06.tif10 0./output/am/am01.tif11 0./output/am/am06.tif12 0./output/am/am07.tif13 0./output/am/am03.tif14 0./output/am/am05.tif15 3./output/bf/bf12.tif16 3./output/bf/bf09.tif17 3./output/bf/bf04.tif18 3./output/bf/bf15.tif19 3./output/bf/bf06.tif20 3./output/bf/bf10.tif...Share"


Question: I am a new AWS user - how do I set powers / permissions for an IAM?

HiWe are trying to set up using the AWS SES services and are struggling to see how / where we set the permissions for each user - any chance of someone giving an answer configured for a rookie pleaseFollowComment

Answer: 0It can be created by navigating to Policies from the IAM screen.The documentation is below.https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.htmlPlease check the following document for instructions on how to create an IAM user.https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months ago


Question: Basic question about Route 53 Resolver

"Can I set up an internal endpoint in one VPC to forward queries from a DNS resolver in a second VPC, where there's a peering connection between the two VPCs? Or are internal endpoints just used to forward queries from private networks that are connected via Direct Connect or Site-to-Site VPN?FollowComment"

Answer: "0Yes, you can forward queries to the Route 53 Resolver in another VPC as long as VPCs are peered, as also documented here.CommentShareweidianswered 3 months ago"


Question: Amazon Comprehend built-in model as endpoint

"I want to set up an endpoint for classifying sentiment, is it possible to do this using the built-in model used from Amazon Comprehend? Or do I have to make a custom model if I want to deploy it as an endpoint?Thanks!FollowCommentKapilAtAWS 7 months agoYou shouldn't be needing to setup up an endpoint for pre-built models as there are synchronous inference APIs already present.I'm curious why are you even asking for it ? is it to have control over the max throughput you can get from the endpoint ?Share"

Answer: "4Accepted AnswerHi,With the the built in model, you can use the APIs for classifying sentiment as currently there isn't an option to deploy a built-in model as an endpoint. You are correct that if you want to deploy as an endpoint it will need to be a custom model.https://docs.aws.amazon.com/comprehend/latest/dg/using-the-api.htmlCommentSharehamltmanswered 7 months ago"


Question: [Announcement] AWS CloudTrail for Amazon S3 adds new fields for enhanced security auditing

"AWS CloudTrail for Amazon Simple Storage Service (S3) now captures additional request parameters and event data for your bucket-level and object-level operations for enhanced security auditing. The new fields added to AWS CloudTrail for Amazon S3 include: host, signature version, cipher suite, and authentication method.AWS CloudTrail for Amazon S3 provides a record of actions taken by a user, role, or an AWS service against your Amazon S3 resources, including detailed API tracking for Amazon S3 bucket-level and object-level operations. By using AWS CloudTrail, you can determine the request that was made to Amazon S3, the IP address from which the request was made, who made the request, when it was made, and additional details.With this enhancement, you can use the signature version field to identify if the requests made against your Amazon S3 resources are being authenticated using signature version 2 (SigV2) or signature version 4 (SigV4). This is especially important in context of previous post on AWS Discussion Forums detailing the plan to end support for requests to Amazon S3 authenticated using SigV2 in all AWS regions on June 24, 2019.Other new fields in AWS CloudTrail for Amazon S3 can also help you identify if clients are using HTTPS with the cipher suite field, or if clients are using a specific S3 endpoint, for example FIPS endpoints or dual stack endpoints, with the host field.To learn more about monitoring Amazon S3 API calls using AWS CloudTrail, please visit the S3 Developer Guide.To learn more about AWS CloudTrail, including how to configure and enable it, see the AWS CloudTrail User Guide.AWS CloudTrail for Amazon Simple Storage Service (S3) is available in all commercial AWS regions and AWS GovCloud (US) regions.FollowCommentNguyen_M SUPPORT ENGINEERa year agoThis is an announcement migrated from AWS Forums that does not require an answerShare"


Question: How can you capture Linux systemd logs using the CloudWatch Agent?

"I want to use the CloudWatch agent to capture events in systemd's Journal.  I checked the CloudWatch agent docs but couldn't find anything relevant.  I did find some old 3rd party projects on Github (journald-cloudwatch-logs, systemd-cloud-watch) that looked like they might work but I wanted to see if there was something native before I started down the path of "unknown" code.A possible workaround might be to have journalcrl save service.unit to a log file and then ingest that with a normal "logs" CloudWatch agent config.  But that seems pretty messy and would require some maintenance (rotate log files, etc.)FollowCommentdozenyommer a year agoDid you see this gist?  Is this relevant to what you are trying to do?ShareLH-RNHurt_DevOps a year ago@dozenyommer - I did not see that gist, however it does look interesting.  Thanx!Share"

Answer: "0One solution might be to use Datadog's Vector product to facilitate logging.  Vector can use journald as a "source" and CloudWatch Logs and a "sink".Another thought is to modify the systemd service file to save logging events to a physical file and then configure the CloudWatch agent to process that file.  However, this requires us to manage a log file, and on a long running system that is tedious.  I don't really want to worry about filling up the disk with old log information.  And it seems much more efficient to just process journald directly.However, I've never used Vector and can't be sure how it will work in practice.  It may be that using a physical log file is easier and more reliable.Wouldn't it be great if CloudWatch logs could talk to journald directly?  Or even process a STDOUT stream?  That way we could pipe information directly into CW without having to go through all this trouble.CommentShareLH-RNHurt_DevOpsanswered a year ago"


Question: CreateOTAUpdate AWS IOT

Hello!I try to do CreateOTAUpdate (https://docs.aws.amazon.com/iot/latest/apireference/API_CreateOTAUpdate.html) in lambda function IotClient.create_ota_update()I see in a response that all values except aws_iot_job_id aws_iot_job_arn - goodWhy aws_iot_job_id and aws_iot_job_arn can be nil?FollowComment

Answer: "1Hi,you should get back the awsIotJobArn in case the job has been successfully created. Did the API call return a 200 status code which means it was successful?You can also use the DescribeJob API to verify your job has been created successfully.Cheers,PhilippCommentSharePhilipp Sanswered 6 months ago"


Question: Unsubscribe URLs in SNS http(s) notifications broken

"Hello,today I noticed that the UnsubscribeURLs in notifications sent to HTTP(S) endpoints no longer get populated correctly. It seems there is a problem with the string expansion. Here is an example:"UnsubscribeURL":"https://sns.eu-west-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=CLOUDCAST_SUBSCRIPTION_GUID_PLACEHOLDER"As you can see from the example, this occurred in eu-west-1 but I have not examined any other regions. Please look into this and fix, as our product has to rely on this information.Regards, ChristophFollowComment"

Answer: 0As of 1/22/19 ~14:00 UTC it seems the issue has been fixed by AWS.CommentShareChristoph Wienandsanswered 4 years ago


Question: Cognito: multi region support

Is there a way to synch cognito user pool  across 2 regions ? I have api gateway with cognito and cannot do x-region as cognito is specific to a regionFollowComment

Answer: "1There is no out of the box way to sync all of the details from one region to another using Cognito. There are solutions like the Cognito user profiles export reference architecture. However, that won't sync the passwords.You should be able to have API Gateway and the Cognito User Pool in different regions without a problem. https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enable-cognito-user-pool.htmlCommentShareEsteban_Hanswered a year ago1So there is no way to have a 100% cross region resilience. In region 1 and 2 will share the cognito of region 1. I have a serverless stack api gateway > lambda > dynomodb - but because of cognito cannot call it a resilient system.CommentShareAWS-User-0064181answered a year ago0basically aws forces you to run app in single-region but telling to run in multi region during the re:invent etc. What's the point of that dev guide to "sync" cross-region if passwords won't sync and users won't be able to login?....Related: https://repost.aws/questions/QUrDBg73LJTxydp3BFhu8VYw/multi-region-cognitoCommentShareAWS-User-9744199answered a year ago"


Question: Error while importing OVA file . Case ID 12737395501 |

"Hi Team,We have customer who needs this OVA to be restored and on working conditions in AWS EC2 console.This OVA file is created from running EC2 Machine only, 2-3 weeks back. Now restoration is not working ?We are getting error while:  "StatusMessage": "ClientError: Unsupported kernel version 5.15.0-1019-aws",Please help.{"ImportImageTasks": [{"Description": "IMD-Dashboard","ImportTaskId": "import-ami-011c03650183e37b9","SnapshotDetails": [{"DeviceName": "/dev/sde","DiskImageSize": 41561256960.0,"Format": "VMDK","Status": "completed","Url": "s3://ihub-storage-ohio/export-i-0ddfc02fd15dae69e.ova","UserBucket": {"S3Bucket": "ihub-storage-ohio","S3Key": "export-i-0ddfc02fd15dae69e.ova"}}],"Status": "deleted","StatusMessage": "ClientError: Unsupported kernel version 5.15.0-1019-aws","Tags": []}]}FollowComment"

Answer: "1"Unsupported kernel version" means that the AWS VM Import/Export service does not support the Linux kernel version used by the VM you're trying to import.The VM Import/Export service supports importing VMs with specific versions of certain Linux distributions, including RHEL, CentOS, SUSE Linux, Ubuntu Server, and Debian.You can check the following document for supported OS and kernel versionshttps://docs.aws.amazon.com/vm-import/latest/userguide/prerequisites.html#vmimport-operating-systems-linuxIf possible, you could try updating the kernel of the VM you're trying to import to a supported version. You would need to do this before creating the OVA file. However, be aware that updating the kernel can have other impacts on your system, so it's important to test this thoroughly.CommentShareEXPERTsdtslmnanswered 17 days ago"


Question: Lookout for Vision - Model resilience to rotated input image

"Dear experts,I was looking into trying to start using AWS Lookout for Vision for some use cases and I have one doubt that I could not solved when looking into the documentation - so forgive me if that is specified somewhere and kindly point me to the source in such case -.As written in the subject, I am wondering if when performing inference the model is resilient to things such as image rotation by design, or if there is some trick to take into account for such use case.Thank you!FollowComment"

Answer: "1During the training phase, augment your dataset with rotated versions of your images. You can include various rotations like 90, 180, and 270 degrees or even smaller increments if needed. This will help the model learn to recognize the objects of interest despite their orientation in the input image. If you expect images with varying rotations during inference, you can apply pre-processing techniques to detect the orientation of the image and correct it before passing it to the Lookout for Vision model. You can use image processing libraries like OpenCV or PIL in Python to detect and correct image orientation.  Another approach is to create multiple models, each trained on images with different orientations. During inference, you can run the input image through each model and aggregate their predictions to determine the final output. This can help improve the overall performance and resilience of your solution to handle rotated images.CommentShareEXPERTsdtslmnanswered a month ago"


Question: Mutual AUTH and Certificate creation

"https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/client-authentication.html#mutualI followed the documentation, even chasing down an older version of OpenVPN/easy-RSA. All were created and uploaded to the AWS cert-manager. The server and client certs show in the Cert Manager interface but when trying to create the Client VPN endpoint the Server certificate ARN does not show in the interface. A search reveals no ARN.I then backed off and followed the client VPN tutorial video. Downloaded the EasyRSA-3.0.7-win64, followed the instructions but I believe there are some gaps between producing the certs (no configuration of the certs) and the coping for the production directory to the director he uploaded to the directory.I'm sincerely at a loss.FollowComment"

Answer: 0I figured out a work aroundCommentSharejlw-kmernovaanswered 3 years ago


Question: Update EKS 1.16 managed worker nodes with 1.16 AMI do not join the cluster

"Hello all,we had a working EKS 1.15 Cluster and did an update to 1.16. After the update I did an update for the managed worker nodes to use the latest 1.16 AMI. Unfortunately nodes with the available 1.16 AMI do not join the cluster now. For now we run the nodes with 1.15 AMI and that works fine. The nodes are in two managed node groups (one for 1.15 and the other for 1.16). So they are managed completely by AWS. They all run in a private subnet that has a NAT gateway attached.When I do a kubectl describe node <WORKER_NODE> I get the following error message:KubeletNotReady              runtime network not ready: NetworkReady=false reason:NetworkPluginNotReady message:docker: network plugin is not ready: cni config uninitializedMy question is, what do I need to configure to get my managed worker nodes with 1.16 up and running? There must be some differences regarding 1.15 and the needed network setup that I do not know or could find in the documentation.Some more details:kubectl get nodesNAME                                              STATUS     ROLES    AGE   VERSIONip-192-168-112-139.eu-central-1.compute.internal   Ready      <none>   14d    v1.15.10-eks-bac369ip-192-168-151-23.eu-central-1.compute.internal    Ready      <none>   14d    v1.15.10-eks-bac369ip-192-168-170-31.eu-central-1.compute.internal    Ready      <none>   14d    v1.15.10-eks-bac369ip-192-168-173-63.eu-central-1.compute.internal    Ready      <none>   14d    v1.15.10-eks-bac369ip-192-168-188-165.eu-central-1.compute.internal   NotReady   <none>   4h1m   v1.16.8-eks-fd1ea7If you need more information please let me know. If someone can point me to the correct documentation link, that solves this issue, would be greatly appriciated.THX for any help here because I am lostFollowComment"

Answer: "1We found out that we need to update the CNI on ower own. AWS does not do it on an existing Cluster.This is documented by AWS here: https://docs.aws.amazon.com/eks/latest/userguide/cni-upgrades.htmlHopefully this will help others to tackle down this kind of issues faster.Edited by: michaelz2020 on Jul 16, 2020 4:00 AMCommentSharemichaelz2020answered 3 years ago"


Question: Consolidated billing without being part of the OU in AWS Organization

"Hello,currently, we have an AWS account A, which is a root account in AWS Organizations with consolidated billing for all account members.Plan: create account B, it's billing joins the billing under account A Organizations and it's other members, but at the same time, it will be independent root account in it's own AWS organizations.So, the accounts A and B are not members of the same Organization, but have linked billing.Is that doable?Thanks,MichalFollowComment"

Answer: "1Accepted AnswerNo, this is not possible. You can organize by OUs within one organization.CommentShareEXPERTkentradanswered 5 months agoEXPERTTushar_Jreviewed 5 months agorePost-User-7827747 5 months agothank you for confirmationShare"


Question: How to automate access key rotation for IAM users

"Hello everyone,I am trying to figure out a way to automate access key rotation for IAM users.  We have several users that have their own IAM programmatic access key and I am trying to figure out a way to force the user to rotate their access key after 90 days.  It would be nice to also have some sort of SNS topic that will inform the user.I attempted to use the ASA Key Rotation document that AWS provided but kept on running into CloudFormation template errors which include Malformed Document and missing resources in the .PY files.https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/automatically-rotate-iam-user-access-keys-at-scale-with-aws-organizations-and-aws-secrets-manager.htmlAny guidance on this would be awesome.Thank you!FollowComment"

Answer: "1If the credentials are for users, a best practice would be to use temporary credentials. Access keys are long-term credentials that you may not need.Here is a blog that shows you how to get temporary credentials with AWS IAM Identity Center.You can also get temporary credentials with the AWS CLI and AWS IAM Identity center. Here is a knowledge center article.If you still want to use the aws-iam-access-key-auto-rotation solution, it looks like the files are on the GitHub repo.CommentShareJeremy_Sanswered 3 months ago0You might want to also consider transitioning these IAM Users to IAM Roles Anywhere.CommentShareEXPERTkentradanswered 3 months ago"


Question: ECS-to-CodeDeploy deployment

"Assuming the following tutorial:https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-ecs-ecr-codedeploy.htmlQuestion, there is a possibility to have a CodeBuild stage after source which dynamically generate the taskdef.json and export it into artifactory zip. Code/Deploy stage to use this one into blue/green deployment? ThanksFollowComment"

Answer: "0Yes it will be able to use, as it will create the file in s3 but that needs to be mentioned as the output artifacts in s3 bucket. In the artifacts we need to add all the required files like taskdef.json .CommentSharerePost-User-7669352answered a month ago"


Question: WAF Error problem I tried plenty of stuff it doesn't work please help

"Hi can you please help me solve this waf error problem, I'm frusturated at this point and would like to ask a few questions as well. When I hit rebuild project I'm getting WAF error. I checked every solution on this topic in forums. I got VS 2019 and has that MPS or something package I can't remmember it's name but I got that, I tried changing code in WAF settings according to a post I read here, didn't worked, I uninstalled Lumberyard and reinstalled it and it just insists on not working.Unreal Engine 5 for instance, also in Early Access, you hit download, you hit install and boom, it just works.I like Lumberyard, I like it's UI, it's entity system, excellent renders but why install process has to be so counter-intuitive? If people are currently working on Lumberyard, they should work on improving initial installment before adding new features. I have not seen a worse installment process than Lumberyard, might as well building it myself from the source code seems like it would have been easier. This is ridiculous.Also what the hell WAF stands for anyway?I was going to upload screenshot but apparently "new users cannot upload files"So here's a drive link that includes log txt aswell. Only thing missing in "Install Software" section is Speedtree.It just doesn't work I tried a lot of stuff please helphttps://drive.google.com/file/d/18Pr5z8Z7pMusZg8oWcAn3FYmTNy5o7ih/view?usp=sharingEdit: Also I use VS2019 do I need VS2017 ???Edit 2: Lumberyard is not installed on C instead it's intalled in ssd drive S should I move it to C ?Edit 3: Lumberyard Setup Assistant has a green check on everything required so why the hell this thing is not working?!?! 😃Edit 4:[WARN] Unable to copy s:\lumberyard\shared\3rdparty\qt\5.15.1.1-az\msvc2019_64\bin\qt5core.dll to c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5core.dll: [Errno 13] Permission denied: 'c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5core.dll'[WARN] Unable to copy s:\lumberyard\shared\3rdparty\qt\5.15.1.1-az\msvc2019_64\bin\qt5gui.dll to c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5gui.dll: [Errno 13] Permission denied: 'c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5gui.dll'[WARN] Unable to copy s:\lumberyard\shared\3rdparty\qt\5.15.1.1-az\msvc2019_64\bin\qt5network.dll to c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5network.dll: [Errno 13] Permission denied: 'c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5network.dll'[WARN] Unable to copy s:\lumberyard\shared\3rdparty\qt\5.15.1.1-az\msvc2019_64\bin\qt5qml.dll to c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5qml.dll: [Errno 13] Permission denied: 'c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5qml.dll'[WARN] Unable to copy s:\lumberyard\shared\3rdparty\qt\5.15.1.1-az\msvc2019_64\bin\qt5quick.dll to c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5quick.dll: [Errno 13] Permission denied: 'c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5quick.dll'[WARN] Unable to copy s:\lumberyard\shared\3rdparty\qt\5.15.1.1-az\msvc2019_64\bin\qt5svg.dll to c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5svg.dll: [Errno 13] Permission denied: 'c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5svg.dll'[WARN] Unable to copy s:\lumberyard\shared\3rdparty\qt\5.15.1.1-az\msvc2019_64\bin\qt5widgets.dll to c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5widgets.dll: [Errno 13] Permission denied: 'c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5widgets.dll'[WARN] Unable to copy s:\lumberyard\shared\3rdparty\qt\5.15.1.1-az\msvc2019_64\bin\qt5qmlmodels.dll to c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5qmlmodels.dll: [Errno 13] Permission denied: 'c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5qmlmodels.dll'[WARN] Unable to copy s:\lumberyard\shared\3rdparty\qt\5.15.1.1-az\msvc2019_64\bin\qt5qmlworkerscript.dll to c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5qmlworkerscript.dll: [Errno 13] Permission denied: 'c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5qmlworkerscript.dll'[WARN] Unable to copy s:\lumberyard\shared\3rdparty\qt\5.15.1.1-az\msvc2019_64\bin\qt5xml.dll to c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5xml.dll: [Errno 13] Permission denied: 'c:\lumberyard\1.28.0.0\dev\bin64vc142\qt5xml.dll'It says "Check the file permissions or any process that may be locking it." I did checked the file permissions, it is not read only, users have full access and I'm running Project Configurator admin mode.Edit 5: About Error no 13 Permission denied error in another post someone says restart fixes it so I restarted the PC and it's not solved. Lumberyard hates me 😃 I have tried so much stuff it just does't work.Edit 6: I revert folder properties of lumberyard, I uncheck "read only" but when I try to rebuild project it automaticall reverts back to read only and gives error.Edit 7: At this point, I don't know what else to do. I installed this QT software thinking maybe it would solve it. It didn't, why permission is denied? Who knows! I guess I have to prepare the perfect condition for it to run with scientific precision like as if I'm trying to discover higgs boson. Do I need a hadron collider to run this thing?Follow"

Answer: "0Accepted AnswerOnce again thank you! Hadron collider is working now, I have finnaly discovered higgs boson 😃SharerePost-User-0851421answered 2 years ago0It is for managing directory and compiling. I think they will move to CMake now not WAF. If you just upgraded recently. Better have fresh download of everything. Erase all recent files and uninstall. restart. then a fresh download of everything will work. This engine looks easier to use than any other game engine. It looks smoother and light also. But this process before you can use it is a bit problematic. It is in beta for too long. They should release a separate one that is not modular but with all stable features.SharerePost-User-2061097answered 2 years ago0Thanks for the reply, alright I'll install vs2017, and then have a new Lumberyard install and see if it works.SharerePost-User-0851421answered 2 years ago0Yes that problem is solved, unfortunately now I'm facing yet another error and there is no log file this time either. When I launch the editor, it says, "Engine, Game or Editor Crash" "Lumberyard has encountered an error and needs to close"I once again googled it and there was posts about high dpi problems for previous versions so I changed that to compability mode but it didn't worked. I changed screen resolution didn't worked either.Edit: I made sure asset procceccor from previous launch was closed and did not worked either. And windows language is english.It says Refreshing the asset catalogue for a while and then gives the error.SharerePost-User-0851421answered 2 years ago0The first thing you can try is delete the Cache folder under the dev folder on your project, do not worry it just takes a little to relaunch the project nothing gets deleted that will not recompile. If that does not work I would say if you have a level open when you start up your project sometimes a level could get corrupted, and to check this just delete the level from the levels folder in you project folder, or move it out of the levels folder, and if it opens up fine, and you try and jump back to the level and it crashes that is a corrupted level, which is usually pretty difficult to fix, I usually if this happens just go to a backup I made and copy the level and paste it in the level folder in my project.SharerePost-User-7556027answered 2 years ago0They can release a separate stable or almost stable version (with no dependencies). And make gems, sdks, sample projects just downloadable. gems are just plugins. sdks are just for people who knows programming and needs certain output of their project. Sample Projects are just for reference. At least with this approach people can use the engine with just around 10gb downloads or maybe less. Rather than downloading all the crap that you wont use. Saving other people from mess of compiling. It is still modular in a sense that the user needs to download specific thing he wants.SharerePost-User-2061097answered 2 years ago0I fully agree with you with the starter project. That does have a lot of extra gb that are not needed for expierenced users. But say they did exactly what you are saying. You would be able to download the engine on its own with no sdks that are not needed for any of the gems, so this now comes down to what gems you plan on using, because say you want to use gamelift and if they make it so you no longer have to build the gems you would just add gamelift to your project after downloading the prebuilt gem from their server. Now you issue comes in without the correct sdks gamelift will not work. So the reason of the large file size only comes in because a lot of the dependencies you download are used for gems that may need them. If you do not need those gems though, I do see what you are talking about of the unnecessary size, but to fix this a lot of work would need to be done each release just to get the small file size usable for the public without all the sdks. I think after C-Make comes out, the file size is going to shrink a little because waf is a little bigger, and also way less time and waf errors will no longer occur. I like how you are thinking though, and would not complain if it becomes a thing, there is just a lot that would have to be rewritten for this to be a reality.SharerePost-User-7556027answered 2 years ago0Ralph is right, within a version or two C Make will be out which gets us out of all waf related building. I assume you do not want to wait until that is out, so my biggest advice is use vs2017. A lot of people had issues with 2019, you need a certain version of 2019, not the newest. And for 2017 everything seems to just have a lot less bugs with it. But for ralph, if they made a seperate release that is not modular with all the gems built in each project would be massive, and nothing would be usable for mobile creators. Also a lot of gems are used for AWS Services, and a lot of people do not use half of them, but it just adds gb to your game if the projects were created with everything built in, that is most likely why that has not became a thing, also the beta thing is because the engine is changing too much to ever be in a full release. A new renderer, math, C-Make, and much more is all coming in the next few versions of lumberyard. Just trying to clear up a few things here.SharerePost-User-7556027answered 2 years ago0Btw problem is continuing, I'm trying lots of different stuff, but it just doesn't work.Bin142 doesn't work at all I suppose it's for that specific version of VS2019, it gives gem errors and no matter what I do Bin64vc141 says "Refreshing Asset Catalogue" and then gives that error. I mean error after error, in almost every single part of installment process I've encountered a rich assortment of errors, an open buffet of errors. Great work Lumberyard devs! Pick the error you like, there are so many of them, they come in so many variety. It's like a Christmas feast comprised of errors. Dark Souls boss designers are not as creative at coming up with challenge variety as Lumberyard at producing error variety.SharerePost-User-0851421answered 2 years ago"