Question: Disable Xray feature  on local dev machine(Java Spring boot AOP project)

"HI,I have a spring boot application (2.3.1) running in a AWS EC2 instance. I followed AWS documentation for Spring and AOP:https://docs.aws.amazon.com/xray/latest/devguide/xray-sdk-java-aop-spring.htmlI am able to see the traces and service map after I deploy on my AWS EC2 instance.But when I run my code on my local machine in dev environment(NOT on EC2), it throws an error.=================================================================================2020-08-19 10:22:55.655 [pool-1-thread-1] INFO  c.a.x.s.sampling.pollers.RulePoller -Polling sampling rules.2020-08-19 10:22:56.670 [pool-1-thread-1] ERROR c.a.x.s.sampling.pollers.RulePoller -Encountered error polling GetSamplingRules:com.amazonaws.SdkClientException: Unable to execute HTTP request: Connect to 127.0.0.1:2000 [/127.0.0.1] failed: Connection refused: connectat com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleRetryableException(AmazonHttpClient.java:1175)at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1121)at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:770)at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:744)at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:726)at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:686)at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:668)at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:532)at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:512)at com.amazonaws.services.xray.AWSXRayClient.doInvoke(AWSXRayClient.java:1257)at com.amazonaws.services.xray.AWSXRayClient.invoke(AWSXRayClient.java:1226)at com.amazonaws.services.xray.AWSXRayClient.invoke(AWSXRayClient.java:1215)at com.amazonaws.services.xray.AWSXRayClient.executeGetSamplingRules(AWSXRayClient.java:568)at com.amazonaws.services.xray.AWSXRayClient.getSamplingRules(AWSXRayClient.java:539)at com.amazonaws.xray.strategy.sampling.pollers.RulePoller.pollRule(RulePoller.java:65)at com.amazonaws.xray.strategy.sampling.pollers.RulePoller.lambda$start$0(RulePoller.java:46)at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)at java.base/java.util.concurrent.FutureTask.runAndReset(FutureTask.java:305)at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:305)at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)at java.base/java.lang.Thread.run(Thread.java:834)=======================================================================================Questions:1.) We do not need the traces to be generated and sent to aws. How do we TURN OFF/DISABLE Xray tracing feature on our dev machines ?FollowComment"

Answer: "0Hello,For context, this is happening because the daemon is not running in your dev environment and so the SDK cannot contact it to retrieve centralized sampling rules. Disabling the SDK a known feature request that we have in our backlog, we hope to add support for an environment variable that can disable the SDK soon: https://github.com/aws/aws-xray-sdk-java/issues/178As a workaround, you could have your own development environment variable and set the sampling strategy to a no-op strategy using it:AWSXRayRecorderBuilder builder = AWSXRayRecorderBuilder.standard();if (inDevEnvironment) {builder.withSamplingStrategy(new NoSamplingStrategy());}CommentShareAWS-User-2079090answered 3 years ago"


Question: Read only access to specific Kibana dashboards

"I am running Kibana via AWS OpenSearch Service with user management via Cognito. Is it possible to create a user that only has read only access to Kibana dashboards? And additionally, to only specific dashboards?FollowComment"

Answer: "1Accepted AnswerHi,From your question I understand that you would like to create a user who only has read access to specific Kibana dashboards.I am attaching the following documentation that goes over securing access to Kibana here (1). With this setup you can grant access to users for each ElasticSearch domain. I am also attaching the following documentation for fine grained access controls for OpenSearch (2). For read only access to OpenSearch you can use the AWS managed policy "AmazonOpenSearchServiceReadOnlyAccess" as a guide. You can then craft a policy such as the following to limit read actions to a specific domain.{"Effect": "Allow","Action": ["es:Get*","es:List*","es:Describe*"],"Resource": "arn:aws:es:us-east-1:XXXXXXXXXXXX:domain/NAMEGOESHERE"}I hope you have a great rest of your day!References(1)https://aws.amazon.com/blogs/database/configuring-and-authoring-kibana-dashboards/(https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html)CommentShareSUPPORT ENGINEERPatrick_Vanswered a year ago"


Question: s3 no sign request didn't work

"I use aws s3 --no-sign-request --region us-west-2 ls s3://aws-cloudtrail-logs-01-*******,An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied.but aws s3 ls working. why?FollowComment"

Answer: "1AWS has the ability to generate a policy based on CloudTrail logs, which you obviously are using.  See the following documentation on how to use that.  https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation.html  Hope this helps.(Should have posted this as an answer.  Sorry.)CommentSharejschwar313answered a year ago0Do you have the bucket configured for public read access? The --no-sign-request is doing just that, not using credentials to sign the request. This means that the bucket and/or its objects need to be configured to allow public access. There are a number of ways to do this as described in this AWS Support post How can I grant public read access to some objects in my Amazon S3 bucket?.I must add that AWS strongly discourages making buckets public except in some specific use-cases such as setting permissions for website access.For your example you would need toDisable block public access settings for your bucket.Add a bucket policy like:{  "Version":"2012-10-17",  "Statement":[    {      "Sid":"PublicObjectRead",      "Effect":"Allow",      "Principal": "*",      "Action":["s3:GetObject","s3:GetObjectVersion"],      "Resource":["arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"]    },   {      "Sid":"PublicBucketList",      "Effect":"Allow",      "Principal": "*",      "Action":["s3:ListBucket"],      "Resource":["arn:aws:s3:::DOC-EXAMPLE-BUCKET"]    }   ]}Note that s3:ListBucket is the IAM permission needed to call the S3 API function ListObjectsV2This will allow listing the contents of the bucket.$ aws s3 ls s3://DOC-EXAMPLE-BUCKETand reading all objects from the bucket:$ aws s3 cp s3://DOC-EXAMPLE-BUCKET/someobject ./someobjectCommentShareScott_Kanswered a year ago"


Question: How to get all accounts in an Organization verified?

"How can we get all accounts in an organization verified rather than going into each one and manually requesting it.Background: I'm helping a client adopt a multi-account structure. The management account, Control Tower, and all OUs and member accounts have been created. But we keep running into issues with account verification. For example, trying to create a CloudFront distribution, where we get an error that the account needs to be verified. I've tried requesting from the management account's support, which has business support, to verify all the accounts, but support marks ticket as resolved without saying anything and without it being resolved.  I've tried going into each of the urgent accounts and requesting them. But there are many, such as sandbox accounts, and I would like to avoid going into about 50 accounts and requesting it. The whole experience with support has been very frustrating.FollowComment"

Answer: "-1This actions can be implemented via AWS SDK or AWS CLI.The following blog shows you the overall process that an account goes through in AWS Organization, at then end there's a cloudformation template you could use for automating the process you're requesting:https://aws.amazon.com/blogs/security/how-to-use-aws-organizations-to-automate-end-to-end-account-creation/CommentSharevtjeananswered a month agosmacintyre a month agoSorry, that doesn't help at all. All these accounts were created by Account Factory as described. But that has nothing to do with verification of the accounts. All accounts create through Account Factory are not being verified even though the management account is verified. How do avoid having to request for each new account that it be verified?Share"


Question: Docker installation makes EC2 instance unresponsive

"Steps to reproduce:run EC2 instance usingregion - Frankfurtami-05c26ae4789875080 (Canonical, Ubuntu, 20.04 LTS, amd64 focal), ami-0ac05733838eabc06 (Canonical, Ubuntu, 18.04 LTS, amd64 bionic), or ami-04cf43aca3e6f3de3 (CentOS Linux 7 x86_64 HVM EBS ENA 1901_01)AZ - eu-central-1atype - m5, c5 (but seems like it doesn't matter)follow official docker engine installation guide https://docs.docker.com/engine/install/ubuntu/installation for ubutnu stucks after stepCreated symlink /etc/systemd/system/sockets.target.wants/docker.socket → /lib/systemd/system/docker.socketEC2 instance becomes unresponsive, ssh drops with timeout. On centos - installation completes, but after starting docker behavior is the same.Reboot doesn't help.Similar with installation via snap (on ubuntu).If you change AZ to eu-central-1b, issue is not reproduced, installation is successful.Anyone knows what could be a root cause?Edited by: bberenice on May 15, 2020 12:10 AMEdited by: bberenice on May 16, 2020 4:35 AMFollowComment"

Answer: "0Dear bberenice,Just for test, I've run same type of instance/AMI on the same availability zone. aws ec2 run-instances \    --image-id ami-05c26ae4789875080 \    --count 1 \    --instance-type m5a.large \    --key-name awshakantestkey01  \    --subnet-id subnet-3a266c51 \    --security-group-ids sg-0cb88d91d7b4ff0d4 \    --placement Availabilityzone=eu-central-1aInstance running...ssh -i "awshakantestkey01.pem" ubuntu@ec2-xx-xxx-xxx-xx.eu-central-1.compute.amazonaws.com    Welcome to Ubuntu 20.04 LTS (GNU/Linux 5.4.0-1009-aws x86_64) * Documentation:  https://help.ubuntu.com * Management:     https://landscape.canonical.com * Support:        https://ubuntu.com/advantage  System information as of Sat May 16 16:42:49 UTC 2020  System load:  0.08              Processes:             121  Usage of /:   16.2% of 7.69GB   Users logged in:       0  Memory usage: 2%                IPv4 address for ens5: 172.31.100.35  Swap usage:   0%0 updates can be installed immediately.0 of these updates are security updates.The list of available updates is more than a week old.To check for new updates run: sudo apt updateThe programs included with the Ubuntu system are free software;the exact distribution terms for each program are described in theindividual files in /usr/share/doc/*/copyright.Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted byapplicable law.To run a command as administrator (user "root"), use "sudo <command>".See "man sudo_root" for details.Docker Installedubuntu@ip-172-31-100-35:~$ sudo snap install dockerdocker 18.09.9 from Canonical✓ installedbuntu@ip-172-31-100-35:~$ sudo docker infoContainers: 0 Running: 0 Paused: 0 Stopped: 0Images: 0Server Version: 18.09.9Storage Driver: overlay2 Backing Filesystem: extfs Supports d_type: true Native Overlay Diff: trueLogging Driver: json-fileCgroup Driver: cgroupfsPlugins: Volume: local Network: bridge host macvlan null overlay Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslogSwarm: inactiveRuntimes: runcDefault Runtime: runcInit Binary: docker-initcontainerd version: 894b81a4b802e4eb2a91d1ce216b8817763c29fbrunc version: N/Ainit version: fec3683Security Options: apparmor seccomp  Profile: defaultKernel Version: 5.4.0-1009-awsOperating System: Ubuntu Core 16OSType: linuxArchitecture: x86_64CPUs: 2Total Memory: 7.53GiBName: ip-172-31-100-35ID: POEJ:RK3I:6YKL:4MYP:CMDN:62OA:CIMB:FVHT:766W:4HRS:FT4G:GU7RDocker Root Dir: /var/snap/docker/common/var-lib-dockerDebug Mode (client): falseDebug Mode (server): falseRegistry: https://index.docker.io/v1/Labels:Experimental: falseInsecure Registries: 127.0.0.0/8Live Restore Enabled: falseWARNING: No swap limit supportIts working fine on eu-central-1a...CommentShareawshakananswered 3 years ago0awshakan, thanks for your attention to my question.The root cause of the problem was in network setup that was relevant only for our project. We had a VPC peering setup:VPC1, Requester CIDRs=172.17.0.0/16 -> VPC2, Accepter CIDRs=172.20.0.0/16EC2 instances, where the issue was reproduced, were located in VPC2 while we were trying to reach them from VPC1.By default 172.17.0.0/16 is a CIDR used by docker, and when the service was starting - iptables rules were updated, here is a piece of log with strace from dockerd start:...DEBU[2020-05-18T07:05:24.901044552Z] /sbin/iptables, [--wait -t filter -C DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2] DEBU[2020-05-18T07:05:24.902118925Z] /sbin/iptables, [--wait -t filter -I DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2] DEBU[2020-05-18T07:05:24.903236955Z] /sbin/iptables, [--wait -t filter -C DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP] DEBU[2020-05-18T07:05:24.904343697Z] /sbin/iptables, [--wait -t filter -I DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP] After that access to EC2 instance was lost from VPC1.Resolution in this case: to use custom CIDR for docker.CommentSharebbereniceanswered 3 years ago"


Question: Storage Gateway won't load disks

"Hey all,I'm trying to setup a Storage Gateway and the setup is all good until I have to wait for the AWS Console to load up the disks. For context the machine I'm doing this on is Oracle Linux 8.5 and the Gateway is a VM in Ubuntu 18.04. Can't seem to progress because the console simply won't load the disks.FollowComment"

Answer: "0Accepted AnswerI was able to fix the issue quite simply. It seems like the setup was stuck but I went back in the console and clicked the Gateway directly and was able to visualize and assign the disks.CommentShareAxel Pinaanswered a year ago0Hello,I'm Mike with the Storage Gateway team.The issue you are describing is can have a lot of causes, so more detail would be needed to give you a solid troubleshooting direction.  The issue with recognizing disks may be as simple as first rebooting your gateway VM (to make sure the local OS has recognized the added disks) and then trying the console again.  If that doesn't work, I strongly recommend opening a case with premium support if you have a contract with them.  If not, please provide the following so we can better understand your environment:What Hypervisor are you using? KVM, VMware, or Hyper-V?  Since you mention Linux, I suspect a KVM system, but please clarify.Are you deploying a File, FSx, Tape, or Volume gateway?How many disks have you added to the downloaded gateway image?  What size(s)?When the gateway VM is running, if you go to the VM console, are you able to pass the network connectivity test?  Below I provide the test for file gateway, but all gateway types have a similar test:** https://docs.aws.amazon.com/filegateway/latest/filefsxw/manage-on-premises-fgw.html#MaintenanceTestGatewayConnectivity-fgw **Have you successfully activated the gateway?  The console allows for activation without the additional disks and they can be added later.Please let me know if you have any follow up questions I can provide answers to.Mike H., AWS SGW, SECommentShareMike-HAWSanswered a year agoAxel Pina a year agoHey Mike, thanks for your reply. I was able to fix the issue quite simply. It seems like the setup was stuck but I went back in the console and clicked the Gateway directly and was able to visualize and assign the disks.Share"


Question: Some Tool to work with Lineage between AWS and SnowFlake

"Hi, i need a tool that can be implemented easely to control the lineage between external sources like SnowFlake and AWS(Glue,lambda etc), thanks for your helpFollowComment"

Answer: "0To control the lineage between external sources like Snowflake and AWS services such as AWS Glue and Lambda, you can consider using a metadata management tool or a data catalog. These tools help track the lineage and metadata of your data, providing visibility into its origins and transformations. Here are a few options you can explore:AWS Glue Data Catalog: The AWS Glue Data Catalog is a fully managed metadata repository that integrates with various AWS services. It allows you to define tables, schemas, and metadata for your data sources. By using AWS Glue Crawlers, you can automatically discover the schema and metadata of your data in Snowflake and other sources, and then create a unified metadata catalog that includes lineage information.Apache Atlas: Apache Atlas is an open-source metadata management and data governance tool. It provides capabilities for capturing, organizing, and governing metadata across various data sources, including Snowflake and AWS services. With Apache Atlas, you can define entities, relationships, and lineage information to understand how data flows between systems.Alation: Alation is a popular enterprise data catalog solution that offers metadata management, data lineage, and data governance capabilities. It can integrate with Snowflake and AWS services, allowing you to capture and visualize the lineage of your data pipelines. Alation provides a user-friendly interface and collaborative features for data discovery and understanding.Collibra: Collibra is an enterprise data governance platform that includes metadata management and lineage features. It offers integration options with Snowflake and AWS services, enabling you to capture and track the lineage of your data assets. Collibra provides comprehensive data governance capabilities and collaboration features for data stewards and users.These tools provide various features beyond lineage tracking, such as data discovery, data quality management, and data governance. Consider your specific requirements, integration needs, and budget while selecting the tool that best fits your use case.CommentSharehimanshustallongmailcomanswered 18 days agoWilli5 17 days agoThanks Himan for your explanation, do you know DataHub?, i was trying to test that tool that is open source that shows data dictionary and lineage in a good way, but it's a bit complicated.Share"


Question: Are API Gateway Websocket Connection Ids Region-Specific?

We are building a multi-region application that uses websockets. It looks like we need to store the region the users connect from and use that when posting a message back to the websockets? Is that correct?FollowComment

Answer: "0Hopefully helping someone else out here - storing the region, stage, and apiId from the connection and using that - we were able to get cross-region chat to work.Example:export interface ConnectionRecord {connectionId: string;userId: string;connectedAt: string;apiId: string;stage: string;region: string;}function getGatewayAPI(connection: ConnectionRecord) {if (GATEWAY_APIS[connection.region]) {return GATEWAY_APIS[connection.region];}const endPoint = `https://${connection.apiId}.execute-api.${connection.region}.amazonaws.com/${connection.stage}`;  const apiGatewayManagement = new AWS.ApiGatewayManagementApi({      apiVersion: '2018-11-29',      endpoint: endPoint,      region: connection.region  });  GATEWAY_APIS\[connection.region] = apiGatewayManagement;  return apiGatewayManagement;  }CommentSharekjohnstonadeptanswered 2 years ago"


Question: AWS IVS API Rate limit

"Hi Team,I was trying to integrate IVS for one of my project. I will be streaming atleast 300 concurrent video streams. Each video stream might last 10-15mins. Once the stream is over (stopped), I would either delete the channel or reset the stream key.According to service quota page, limits are as followsStream keyCreateStreamKey            5 TPSStream keyDeleteStreamKey            5 TPSStream           StopStream                      5 TPSChannel       CreateChannel                  5 TPSChannel       DeleteChannel                  5 TPSI have following doubts regarding IVS rate limits.Since, I might be deleting and re-creating 300 streamkeys/second and 300 channels/sec.Are these hard-limits?Do I need to implement a queue to handle these use-cases?FollowComment"

Answer: "0The IVS rate limits you've mentioned are soft limits, which means they can be increased by contacting AWS Support and requesting a limit increase. However, it's essential to evaluate if the new limits align with your use case.Given that you expect to delete and recreate 300 stream keys/sec and 300 channels/sec, it exceeds the default rate limits. You should consider implementing a queue to handle these use-cases or optimize your architecture.Possible approaches:Request a limit increase: Contact AWS Support to request an increase in the rate limits for your specific use case.Implement a queue: You can use a service like Amazon SQS to manage the creation and deletion of stream keys and channels. With a queue in place, your application can process requests at a rate within the IVS limits, while still allowing a larger number of streams to be managed over time.Optimize your architecture: Evaluate if it's necessary to create and delete channels and stream keys for every streaming session. Instead, you might reuse channels and stream keys, reducing the number of API calls you need to make.Remember to consider the cost implications and operational complexity when selecting the best approach for your use case.CommentShareEXPERTsedat_salmananswered 2 months ago"


Question: Need help in configuring and accessing env variables in aws code build

"Hi all,I've the following situation here. I'm new to this code build. Basically what i'm trying to achieve is to define the environment variables in the 'environment variable tab in code build' and use those environment variables defined in buildspec.yaml. The objective of doing that is to access in the react app with proces.env.REACT_APP_SOME_SPACE which should provide the value as expected.buildspec.yamlenv:variables:REACT_APP_SOME_TOKEN: '${SOME_TOKEN}' // I understand this is plain textREACT_APP_SOME_SPACE: ${SOME_SPACE}REACT_APP_BASE_URL: 'https://cf-api.oasissystems.com.au/api/v1'REACT_APP_REQUEST_TIMEOUT: '10000'REACT_APP_SERVICE_API_KEY: '${SERVICE_API_KEY}'...phases:install:commands:- echo "Building ${CODEBUILD_WEBHOOK_TRIGGER}"What i see in process.env.REACT_APP_SOME_TOKEN is "${SOME_TOKEN}' or whatever that is provided as a plaintext, but not the env variable defined in the environment tabI tried with the following variationsREACT_APP_SOME_SPACE: ${SOME_SPACE}REACT_APP_SOME_SPACE: '${SOME_SPACE}'REACT_APP_SOME_SPACE: {SOME_SPACE}Questions:Is this correct way of doing? If not, Please adviseWhat is the other ways of defining the secret keys in the env variables and how do i refer it in the process.env in react appPlease see the attachment what I meant by environment tab mean at aws code build. I know you guys know that. But just to make things clear. Please advise at the earliest as i'm lil not sureEdited by: baranit on May 20, 2020 2:32 AMEdited by: baranit on May 21, 2020 1:27 AMFollowComment"

Answer: "0Hi,I couldn't find the attachment anywhere in this page.The environment variables you defined in the buildspec will override what you defined in the project environment configuration (environment tab in console) if they have the same name. The recommend way is to use either ParameterStore or SecretsManager to store your secrets and specify that in the buildspec. Documentation for how to use these in the buildspec:https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html#parameter-store-build-spechttps://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html#secrets-manager-build-specRegards,KaixiangEdited by: Kaixiang-AWS on May 21, 2020 2:32 PMCommentShareAWS-User-5639455answered 3 years ago0@Kaixiang-AWSThanks for the reply and the reference. I've attached the screenshots where the environment tab that i'm referring to.But just to let you know that REACT_APP_CONTENTFUL_TOKEN down below is the environment variable I use it for the front end to access via process.env.REACT_APP_CONTENTFUL_TOKEN and theCONTENTFUL_TOKEN down below is what is defined in the project environment variables in the aws console. And so both are different.Secondly based on the example below  I've defined the project environment variable in aws console as  CONTENTFUL_TOKEN as "123#$$" in plain text and I provided the reference in the buildspec.yml as mentioned below. And when I try to access process.env.REACT_APP_CONTENTFUL_TOKEN, my expectation is it should show "123#$$". But rather It is showing as string "${CONTENTFUL_TOKEN}". The main question here is how do I access the environment variables defined in the project environment console, so it can be accessed on the front end in react.The above question applies for parameter store as wellenv:variables:REACT_APP_CONTENTFUL_TOKEN: ${CONTENTFUL_TOKEN} //...Kindly adviseRegards,BtCommentSharebaranitanswered 3 years ago0Hi,The environment variable section in buildspec doesn't allow evaluating a variable. The recommend way for your use case would beDirectly specify REACT_APP_CONTENTFUL_TOKEN in the environment tab or in buildspec. I don't see a reason why you need an intermediate CONTENTFUL_TOKEN variable. An example in the buildspec would beenv:  variables:    REACT_APP_CONTENTFUL_TOKEN: "123#$$"You can keep what you did for CONTENTFUL_TOKEN and assign its value to REACT_APP_CONTENTFUL_TOKEN in install phase. An example would bephases:  install:    commands:      - REACT_APP_CONTENTFUL_TOKEN=$CONTENTFUL_TOKENHope this could solve your issue.Regards,KaixiangCommentShareAWS-User-5639455answered 3 years ago0@Kaixiang-AWSThanks for your reply. My use case was to get the token or secret_key from process.env.token from the react front end, so I can make API calls. Also the reason why I don't want to specify the token or secret key directly in the builspec.yml is, I don't want to expose this in my commit in the repo. But I found export the variables like the following does the job.phases:install:commands:- export REACT_APP_CONTENTFUL_TOKEN=${CONTENTFUL_TOKEN}CommentSharebaranitanswered 3 years ago0I found that variables in the build command phase can be exported in order to access it outside (i.e,, from the front end via process.env.somethingimportant) provided the environment variables are defined in the proeject environment variables consoleCommentSharebaranitanswered 3 years ago"


Question: Any benefit of using Pinpoint vs. SNS vice versa for transactional Push Notifications?

"If not using any of the campaign/journey features of Pinpoint and solely using the transactional push notification feature, is there any benefit of still using Pinpoint over SNS? How about SNS over Pinpoint?I see explicit support for deep linking in Pinpoint but not in SNS docs so maybe that's one of the pros for Pinpoint...FollowComment"

Answer: "1AWS provides two services that support SMS messaging: Amazon SNS and Amazon Pinpoint. Here are some factors to consider when deciding which service is the best fit for your needs:Amazon SNS (Simple Notification Service): Originally designed for machine-to-machine communications, it is suitable for organizations that primarily send transactional messages without the need for marketing messages. If you only require SMS messaging and don't plan to use other channels like email or voice, and if advanced messaging and engagement analytics are not a significant requirement, then Amazon SNS may be a suitable choice.Amazon Pinpoint: This multi-channel customer engagement service is specifically designed for application-to-person (A2P) communications. It supports SMS, email, push notifications, voice, and custom channels such as messenger apps and chat widgets. If you have a diverse range of communication needs, including bulk, transactional, and marketing communications, and if you require advanced features like campaigns, journeys, segmentation, analytics, and personalization, Amazon Pinpoint is a recommended choice.One crucial distinction is the self-managed opt-out feature, which is available in Amazon Pinpoint but not in Amazon SNS. With self-managed opt-outs, you have the ability to handle opt-outs in a granular manner. For example, when a customer texts "STOP," instead of opting out globally, you can provide them with options to choose which message types they want to unsubscribe from. This flexibility allows you to avoid a scenario where a customer blocks all subsequent messages. Without self-managed opt-outs, using Amazon SNS, replying with "STOP" would lead to a global opt-out for all messages.Consider your specific messaging requirements, future scalability, and the need for granular opt-out management when evaluating Amazon SNS and Amazon PinpointCommentShareroberezeanswered 16 days ago-1Hello there,From the note, I understand that you would like to know the use of Pinpoint vs SNS. Please correct me if I misunderstood your query here.Please note that Pinpoint is for promotion emails for marketing so if you do wish to do campaign therefore there will be no need to use Pinpoint[1]. On the other hand, SNS is generally used for sending plain text to subscribers of topics via multiple protocol[2] and you can publish a message once, and deliver it one or more times. So you can choose to direct unique messages to individual Apple, Google or Amazon devices, or broadcast deliveries to many mobile devices with a single publish request.I hope you find the above information useful. If you have any questions or require assistance, please feel free to reach out to me and I will gladly assist you.Have a great day ahead!References:[1]https://docs.aws.amazon.com/pinpoint/index.html[2]https://docs.aws.amazon.com/sns/latest/dg/sns-system-to-system-messaging.htmlCommentShareNonkululekoanswered a year agottandss a year agoSo is it fair to say that if not using the promotional/marketing aspects of Pinpoint, there is no appreciable benefit to using Pinpoint over SNS?Just wanted to use it potentially as an interface for APNs/FCM in this case.Share"


Question: How to enforce Tag presence for AWS RDS

"i have created following scp to enforce tag key on certain resources. It is working fine in case of EC2,Lambda .But for RDS AWS Console donot provide a way to add tags while creating RDS instance How to accomplish this enforcement in case of RDSThis is SCP{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "DenyEC2CreationInfraOwnerTag",      "Effect": "Deny",      "Action": [        "ec2:RunInstances",        "ec2:StartInstances"      ],      "Resource": [        "arn:aws:ec2:*:*:instance/*",        "arn:aws:ec2:*:*:volume/*"      ],      "Condition": {        "Null": {          "aws:RequestTag/InfraOwner": "true"        }      }    },    {      "Sid": "DenyEC2CreationProductTag",      "Effect": "Deny",      "Action": [        "ec2:RunInstances",        "ec2:StartInstances"      ],      "Resource": [        "arn:aws:ec2:*:*:instance/*",        "arn:aws:ec2:*:*:volume/*"      ],      "Condition": {        "Null": {          "aws:RequestTag/Product": "true"        }      }    },    {      "Sid": "DenyEC2CreationNameTag",      "Effect": "Deny",      "Action": [        "ec2:RunInstances",        "ec2:StartInstances"      ],      "Resource": [        "arn:aws:ec2:*:*:instance/*",        "arn:aws:ec2:*:*:volume/*"      ],      "Condition": {        "Null": {          "aws:RequestTag/Name": "true"        }      }    },    {      "Sid": "DenyLambdaCreationInfraOwnerTag",      "Effect": "Deny",      "Action": [        "lambda:Create*"      ],      "Resource": [        "*"      ],      "Condition": {        "Null": {          "aws:RequestTag/InfraOwner": "true"        }      }    },    {      "Sid": "DenyLambdaCreationProductTag",      "Effect": "Deny",      "Action": [        "lambda:Create*"      ],      "Resource": [        "*"      ],      "Condition": {        "Null": {          "aws:RequestTag/Product": "true"        }      }    },    {      "Sid": "DenyLambdaCreationNameTag",      "Effect": "Deny",      "Action": [        "lambda:Create*"      ],      "Resource": [        "*"      ],      "Condition": {        "Null": {          "aws:RequestTag/Name": "true"        }      }    },        {        "Sid": "DenyRDSCreationInfraOwnerTag",        "Effect": "Deny",        "Action": [            "rds:CreateDBInstance",            "rds:CreateDBCluster"        ],        "Resource": [            "*"        ],        "Condition": {            "Null": {                "aws:RequestTag/InfraOwner": "true"            }        }    },        {        "Sid": "DenyRDSCreationProductTag",        "Effect": "Deny",        "Action": [            "rds:CreateDBInstance",            "rds:CreateDBCluster"        ],        "Resource": [            "*"        ],        "Condition": {            "Null": {                "aws:RequestTag/Product": "true"            }        }    },        {        "Sid": "DenyRDSCreationNameTag",        "Effect": "Deny",        "Action": [            "rds:CreateDBInstance",            "rds:CreateDBCluster"        ],        "Resource": [            "*"        ],        "Condition": {            "Null": {                "aws:RequestTag/Name": "true"            }        }    },        {        "Sid": "DenyDynamoDBCreationNameTag",        "Effect": "Deny",        "Action": [            "dynamodb:CreateTable"        ],        "Resource": [            "*"        ],        "Condition": {            "Null": {                "aws:RequestTag/Name": "true"            }        }    }  ]}Also, please check the SCP i am giving tag Name for dynamodb but not able to create it gives an errorUser: arn:aws:iam::458225596744:root is not authorized to perform: dynamodb:CreateTable on resource: arn:aws:dynamodb:us-east-1:458225596744:table/ashish0001 with an explicit deny in a service control policyFollowComment"

Answer: "0There are a few issues going on here.For DynamoDB - You will not be able to perform the action for creating the table as currently listed due to not having the permission to TagResource and it is likely you will need UpdateTable and UntagResource depending on if there is an error in tagging. If you intend to create global tables, you will also need to add the CreateGlobalTable IAM permission as well.For the RDS requirement, it would be recommended to create a CloudFormation template with the required tags as parameters for input that are required. When an RDS instance or cluster is required, have the RDS template create the new instance or cluster and the tags will be enforced and the SCP will deny the removal of the tags from RDS. You can use the solution outlined in this documentation that provides notifications for RDS creation and tag enforcement.https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/enforce-automatic-tagging-of-amazon-rds-databases-at-launch.htmlCommentShareJoe Melfianswered a month ago"


Question: AWS VPN Client on macOS - DNS not resolving

"Hi there,We have a client VPN endpoint that we are trying to connect to using the AWS Client VPN application (https://aws.amazon.com/vpn/client-vpn-download/).On macOS, we are running into an issue where DNS for the VPC resources is not being resolved, despite being connected to the VPN successfully. We are using the client configuration file as downloaded from the AWS console.On Windows this configuration file worked correctly with the AWS VPN Client application.On Linux we had to make the following change to the configuration to have working DNS: adding the linedhcp-option DOMAIN-ROUTE .However, this change did not have the same positive effect on macOS.Does anyone know how to get DNS to resolve correctly when using the AWS VPN Cient app on macOS?Thanks and regards.FollowCommentZiad 9 months agoI had a similar issue and in my case I had to enable DNS in the AWS VPN client setup, and at least provide x.x.x.2 (second IP in the client CIDR range) as the one of DNS servers.Share"

Answer: "0Hi @chamath-vetstoria, I'm facing a similar issue, we have some Macs able to resolve the DNS records and other ones that are not able to, even though they have the same config.Did you get any luck resolving this issue?Thank youCommentSharerePost-User-8996696answered 6 months agochamath-vetstoria 6 months agoUnfortunately no, we abandoned trying to get the AWS VPN Client working on Mac. We are using Tunnelblick instead.Share0Hello,What is the error that you are getting in the log files ? I would recommend reaching out to the AWS Premium Support team with the necessary logs as mentioned in the below link to get detailed information on why is this issue happening. Once the files are received, they will be better to engage & check the logs.Link- https://docs.aws.amazon.com/vpn/latest/clientvpn-user/macos-troubleshooting.htmlCommentShareSUPPORT ENGINEERAWS-User-Chiraganswered a year ago"


Question: SageMaker Serverless on AWS Marketplace?

"Hi,Can I use serverless inference as a pricing model for selling a SageMaker Model Package on the AWS Marketplace?FollowComment"

Answer: "0Accepted AnswerNo, quoting from SageMaker documentation:…features currently available for SageMaker Real-time Inference are not supported for Serverless Inference, including GPUs, AWS marketplace model packages…Reference: https://docs.aws.amazon.com/sagemaker/latest/dg/serverless-endpoints.html#serverless-endpoints-how-it-works-exclusionsCommentShareTheofilos Papapanagiotouanswered 5 months ago"


Question: "MySQL RDS 'max_connections_per_hour' error, what are my options?"

"I'm getting the following error for a DB I have. (db.t2.micro)“1226 (42000): User ‘?????????’ has exceeded the ‘max_connections_per_hour’ resource (current value: 85)”What can I do to increase max connections per hour?I did see possible solutions on here but they don't seem to work in RDS.Most of the solutions that I read about include upgrading the instance, which I am willing to do but for my current application it would be overkill. Most of my open and close connections are simple api request.85 connections in an hour doesn't seem like much, there has to be another solution.FollowComment"

Answer: "0In RDS max_connections is dependent on instance size. For MySQL the calculation is{DBInstanceClassMemory/12582880}A t2.micro has 1GB of memory.If you make the division it comes to 85.3.So choosing a larger instance will give you more connections.Doc: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Limits.html#RDS_Limits.MaxConnectionsCommentShareJaccoPKanswered a year agorePost-User-9598391 a year agoI'm getting a max_connections_per_hour, not max_connections. Does that concept still apply? We only have 1-3 connections at at time.SharerePost-User-2370401 9 months agoHaving the same error. This is not the parameter max_connections. It's max_connections_per_hour. I wish to remove it or set it to 0/small number. I do not see the parameter under my.sql.user, but I am getting the error nonetheless.Share0One option to increase your max_connections is to add db connection pooling using RDS Proxy.https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-proxy.htmlThe database connections will remain open meanwhile the application (I assume that is serverless) will be connecting to RDS Proxy without hitting the max_connection limit.CommentShareAgusti_Lumbrerasanswered a year agorePost-User-2370401 9 months agoHaving the same error. This is not the parameter max_connections. It's max_connections_per_hour. I wish to remove it or set it to 0/small number. I do not see the parameter under my.sql.user, but I am getting the error nonetheless.Share"


Question: CodeBuild LOCAL_CUSTOM_CACHE not caching

For the CodeBuild resource within CloudFormation I have:      Cache:        Type: LOCAL        Modes:          - LOCAL_CUSTOM_CACHE          - LOCAL_SOURCE_CACHEIn buildspec.yaml:version: 0.2phases:  install:    commands:    - ./install-bazel    - PATH=$PATH:$HOME/bin  pre_build:    commands:    - mkdir -p .local_cache/bazel/disk    - mkdir -p .local_cache/bazel/repo    - ls .local_cache/bazel/disk    - ls .local_cache/bazel/repo  build:    commands:    - bazel build ... --disk_cache=.local_cache/bazel/disk --repository_cache=.local_cache/bazel/repo    - bazel test ... --disk_cache=.local_cache/bazel/disk --repository_cache=.local_cache/bazel/repo  post_build:    commands:    - ls .local_cache/bazel/disk    - ls .local_cache/bazel/repoartifacts:  files:  - '**/*'cache:  paths:  - '.local_cache/**/*'The ls in the post_build phase shows files in those cached directories. The pre_build phase shows zero files in those cached directories on subsequent builds.FollowComment

Answer: "0Accepted AnswerI was able to get local caching working by disabling privileged mode in the project.CommentSharejwardanswered 4 years ago0I do have a custom service role on this build, so I'm curious if there is an undocumented IAM permission it needs.CommentSharejwardanswered 4 years ago"


Question: URGENT. AWS Root Account Hacked. AWS recovered our account. But EC2 and backup no traces of it in Account. Does AWS backup their systems to recover our website ?

"We discovered the AWS root account hack on 6/20/22. We could not login to our account as the hacker email hasspen@proton.me replaced our email.We had to open a new AWS account to be able to reach AWS support and submit a ticket to the security team. But by the time AWS support recovered our account 6/24/22, by replacing the hacker email with our original email.The hacker had plenty of time to wipe out our account, when we accessed our account today 6/24/22 there was no EC2 instances.  So at this point, we have lost all our WordPress Law Firm code. My question is can AWS support team recover our website to include EC2 instances ? Any feedback is greatly appreciated.NOTE: we have no backups on the account anywhere.FollowComment"

Answer: "0No. You should open up a ticket with AWS support to make sure, but the answer is going to be 'No'. Imagine the ramifications if the answer was 'Yes'. The answer has to be 'No'.CommentShareEXPERTkentradanswered a year ago"


Question: Changing Platform Python version 3.6 to 3.8

"If Python 3.8 is not listed in the list of available platforms in the AWS Management Console, how do you update the Platform Python version from 3.6 to 3.8 on Elastic Beanstalk running on 64bit Amazon Linux/2.10.14.usingAWS CLI  &using the AWS Console )thank you in advance for your helpful responseFollowComment"

Answer: "0Hi,Look at this https://docs.aws.amazon.com/elasticbeanstalk/latest/platforms/platforms-supported.html#platforms-supported.python : Python is in the listYou can have the level that you want also via CloudFormation : see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticbeanstalk-environment.html#cfn-elasticbeanstalk-environment-solutionstacknameCommentShareDidier_AWSanswered 25 days ago"


Question: Why can S3 access the KMS key resource under my account?

"Hello, As the title says, when I use SSE-KMS, S3 can directly access the KMS key I specify without authorizing S3 to assume any role, why is that?FollowComment"

Answer: "0Accepted AnswerWhen performing operations in an S3 bucket with KMS encryption enabled, the related KMS operations are performed in the context of the IAM principal that initiated the S3 operation [1].For example, if you upload an object using the console while logged in as an IAM user, a kms:GenerateDataKey request will be sent to KMS using the IAM user principal, not a service role. The principal being used will still need permission to perform kms:GenerateDataKey in the IAM policy, as well as the key policy.By default, a customer managed key policy will allow access to the key from any principal in the account, and an AWS managed S3 KMS key allows any principal in the account when calling via S3 (using "kms:ViaService": "s3.us-east-1.amazonaws.com").A service role would only be required when S3 is performing the operations itself, e.g. replication. In this case, the replication role would need to be allowed these same permissions [2].--[1] https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-access-default-encryption/[2] https://aws.amazon.com/premiumsupport/knowledge-center/s3-troubleshoot-replication/CommentShareEdanswered a year agoAWS-User-5536133 a year agoThank you for your answer, in my understanding, since I am using AWS Signature Version4, S3 should not be able to get my secretKey, how can S3 use the IAM user principal? Does this mean that S3 can access resources of other services under my account in the context of this request?ShareEd a year agoIt looks like this all happens internally, so it doesn't need access to your secret key. I can't find it explained in a lot of detail anywhere but it's partially explained here: https://docs.aws.amazon.com/accounts/latest/reference/security-iam.html"Cross-service access – Some AWS services use features in other AWS services. For example, when you make a call in a service, it's common for that service to run applications in Amazon EC2 or store objects in Amazon S3. A service might do this using the calling principal's permissions, using a service role, or using a service-linked role.""Principal permissions – When you use an IAM user or role to perform actions in AWS, you are considered a principal. Policies grant permissions to a principal. When you use some services, you might perform an action that then triggers another action in a different service. In this case, you must have permissions to perform both actions."Share"


Question: block sending email to a specific address

"Hi,I use amazon ses stmp on Wordpress to send emails. I use wp mail smtp plugin for that. I sell digital products. When a customer buys something, he gets automatically an email with his files and another email about his account. Sometimes people type a wrong email by mistake like xxx@gnail.com or xxx@yaho.com.When someone types a wrong email, I get a notification from amazon ses in my bounce email address that the email is not sent.This email goes automatically in amazon ses global suppression list and after 14 days Amazon SES automatically removes the address from the global suppression list and WordPress tries to send again emails to this wrong address.This impacts my bounce rate on amazon ses, so I want to know how to block a wrong email definitely on amazon ses so it will not be removed from the global suppression list after 14 days. ThanksFollowComment"

Answer: "0Hi emyabdel,You can use the account-level suppression list to prevent sending email to addresses that previously produced a bounce or complaint event. When Amazon SES adds an address to your account-level suppression list, it remains there permanently (or until you delete it manually).You can find more information about setting up the account-level suppression list at https://docs.aws.amazon.com/ses/latest/DeveloperGuide/sending-email-suppression-list.html.Hope this helps. Thanks for using Amazon SES!Brent @ AWSCommentShareAWS-User-4207280answered 3 years ago0Thanks for your replay. I know just the global suppression list it's the first time I know about the Account-Level Suppression List. My Amazon SES is created before November 25, 2019 so I don't have it by default. This tutorial is very complicated for me, is there an easiest tutorial to learn how to configure the account-level suppression list?CommentShareemyabdelanswered 3 years ago0Hi,I am also new to Amazon. I found this videos helpful:https://www.youtube.com/watch?v=Pk5x1diFwg8This blog also explain how to install: https://cloudacademy.com/blog/how-to-use-aws-cli/Once you finish installing AWS CLI, at the command line, enter the following command to create the Account-Level Suppression List:aws sesv2 put-account-suppression-attributes --suppressed-reasons BOUNCE COMPLAINTYou get more commands and info here:https://docs.aws.amazon.com/ses/latest/DeveloperGuide/sending-email-suppression-list.htmlI hope it helps!CommentSharehorseguardsanswered 3 years ago0Ah, thanks so much, the tutorial that you gave me was easy and it's configured now. I have just a last question: if there's a bounce, the email address is added automatically to the account level suppression list or I should add it manually?CommentShareemyabdelanswered 3 years ago0Yes, bounces and complaints are added automatically to the list.You must be aware that Gmail doesn't provide complaint data to Amazon SES. If a recipient uses the Spam button in the Gmail web client to report a message that they receive from you as spam, they aren't added to the account-level suppression list.When you send for the fist time, you can check if Amazon SES is adding complaints and bounces with this command:aws sesv2 list-suppressed-destinationsAnd you will get something like this, with all the mails added by Amazon SES: (I have only one in my list)C:\>aws sesv2 list-suppressed-destinations{    "SuppressedDestinationSummaries": [        {            "EmailAddress": "info@domain.net",            "Reason": "BOUNCE",            "LastUpdateTime": 1587170927.661        }    ]}C:\>```You can get more info here:    **https://docs.aws.amazon.com/ses/latest/DeveloperGuide/sending-email-suppression-list.html]**     I hope it helps!CommentSharehorseguardsanswered 3 years ago0Yes you help me a lot really thanks so much.CommentShareemyabdelanswered 3 years ago"


Question: "seeing lots of 4xx errors in s3 bucket metrics, but not on the client side"

"we are seeing lots of 4xx errors in the s3 bucket metricsthe error count is roughly aligned with the put trafficbut on the client side, we don't see any error on our side.is the 4xx error internal? how do i interpret the numbers?Thanks!FollowComment"

Answer: "0May I suggest that you temporarily enable S3 server access logging, so as to identify the root cause through fields HTTP status and Error Code?For instance, the following entry indicated a HTTP status 404 with Error Code NoSuchBucketPolicy. Visit this documentation for more information.79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be DOC-EXAMPLE-BUCKET1 [06/Feb/2019:00:00:38 +0000] 192.0.2.3 79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be A1206F460EXAMPLE REST.GET.BUCKETPOLICY - "GET /DOC-EXAMPLE-BUCKET1?policy HTTP/1.1" 404 NoSuchBucketPolicy 297 - 38 - "-" "S3Console/0.4" - BNaBsXZQQDbssi6xMBdBU2sLt+Yf5kZDmeBUP35sFoKa3sLLeMC78iwEIWxs99CRUrbS4n11234= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader DOC-EXAMPLE-BUCKET1.s3.us-west-1.amazonaws.com TLSV1.2 - Yes CommentShareweidianswered 4 months ago"


Question: User Permission management across multiple AWS Accounts

"Suppose there are 4 different AWS accounts, lets say accounts are aws1, aws2, aws3, aws4, aws5.aws1 is kind of parent account through which all other accounts are managed through aws organization and SSO setup in aws1. Also if we need to give permission to any user for any aws resources in any aws account,then we do it from aws1 account only. so its kind of hectic managing permissions for each and every user from aws1 account for all other aws accounts.is there a way, we can streamline this user permission things across different aws accounts in a more efficient ways.Thanks in Advance !FollowComment"

Answer: "1I am not exactly sure what is your requirement.We have option to delegate administration of users in a registered member account e.g. aws2 to perform most IAM Identity Center (previously called SSO) administrative tasks. Please see doc at https://docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.htmlDo you also want to allow member account to administer their own users and group? If this is the requirement, they can continue to do that in their respective aws account using IAM.CommentShareronald_lanswered 5 months agoRavi Shanker 5 months agoas per your answer I understand that aws1 is the delegated administrator account in my case. So my question is how can i manage permissions for different users across different account from one account. Currently AWS organization is setup in aws1 and also SSO is enabled in aws1. For giving permissions to any users we have to login to aws1.Shareronald_l 4 months agoFor your case, aws1 will be the delegated administrator account, this will be used to manage access to all other aws accounts that is part of the AWS organization. Do you want more aws accounts to be used instead of just aws1?Shareronald_l 4 months agoFor your case, aws1 will be the management account, this is used to manage access to all other aws accounts that is part of the AWS organization. You can also delegate another aws account e.g. aws2Share0Based on your background description, I think AWS control tower service will be beneficial to your multi-account management, please refer to the relevant service introduction.https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.htmlAt the same time, AWS proserver team can provide the solution deployment, then help Customer quickly build the environment.CommentSharerePost-User-0782469answered 5 months ago0will cross account roles will be helpful in my scenario ?CommentShareRavi Shankeranswered 4 months ago"


Question: SEPA Payment method still unavailable even after payment in EUR

This still shows up even after I changed the billed currency to EUR and after my Invoice arrived.How to unlock it??FollowComment

Answer: "0Hi there,I'm sorry to hear about this trouble that you're having adding your SEPA payment method.Here's an article that has some troubleshooting tips that may assist you with this: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-debit-emea.html.If you have any questions, please reach out to our Support team for assistance. You can reach out via our Support Center: http://go.aws/support-center. Or, you can get assistance by completing the following contact form: http://go.aws/account-support.Kind regards,— Aimee K.CommentShareEXPERTAWS Support - Aimeeanswered 4 months ago"


Question: How does hibernation impact snapshots within EC2?

"Under the limitations page for hibernation within EC2 [1], it is mentioned that: "If you create a snapshot or AMI from an instance that is hibernated or has hibernation enabled, you might not be able to connect to the instance.". Could anyone clarify the meaning of this statement.Does it mean:You might not be able to connect to the instance whilst the snapshot or AMI creation is in progressYou might not be able to connect to the instance after restoring the snapshot or launching a new instance from the AMISomething elsehttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-hibernate-limitations.htmlFollowComment"

Answer: "1Accepted AnswerAn instance that is hibernated is literally "stopped in its tracks" - there will be open files, structures in memory, processes that are running and potentially disk volumes that aren't in a healthy state - because the operating system didn't know it was supposed to flush things to disk.So if you take a snapshot of it while hibernated and then try to launch an AMI from that, it's going to launch from exactly the state it was in; which isn't necessarily where the operating system expects to start from. So it might work. But it might not.CommentShareEXPERTBrettski-AWSanswered a year agoAWS-User-1977876 a year agoThank you, that makes sense to me. Is there a supported method for running automated snapshots on instances that may or may not be hibernated?I am concerned about the possibility of not being able to trust backups for instances that are likely to be hibernated when backups are taken. Obviously this possibility, if it exists, is untenable in most cases.ShareBrettski-AWS EXPERTa year agoA snapshot of a running or hibernated instance carries the same risk - the filesystem(s) may not be in a stable (shutdown) state. This is particularly true for applications such as databases which at any point in time are not necessarily completely flushed to disk. With a running instance you might send it a single (or use Systems Manager) to temporarily halt writes to the disk, flush buffers then snapshot; but that's not possible with a hibernated instance.ShareAWS-User-1977876 a year agoAre you saying that the risks posed when snapshotting a hibernated instance are no greater than the risks posed when snapshotting a running instance? If I were to run a snapshot on a hibernated instance and find that I could not connect to the instance after restoring from the snapshot, my assumption would be that a hard reboot would resolve the issue. I would lose the processes that were in memory when the snapshot occurs but the instance itself would be recoverable. Am I missing anything that would void this assumption. Thank you for taking the time to answer my queries.ShareBrettski-AWS EXPERTa year agoIn both cases, a reboot might fix the issue. In general, modern file systems are pretty resilient and a reboot is highly likely to fix any issues. The same can't be said for all application data structures. Again, many (if not most!) applications are good at recovering from being interrupted (a power failure would give the same experience) but there are no guarantees.Share"


Question: EXT-X-PLAYLIST-TYPE:VOD Setting

"Hi there,I'm using the web xonsole to test MediaConvert before building it out with the API.At the moment the m3u8 manifest files have the following at the top:#EXTM3U#EXT-X-VERSION:3#EXT-X-PLAYLIST-TYPE:VOD#EXT-X-MEDIA-SEQUENCE:0#EXT-X-INDEPENDENT-SEGMENTSHowever i'm looking to have them marked as VOD content, so for example:#EXTM3U#EXT-X-VERSION:6#EXT-X-PLAYLIST-TYPE:VOD#EXT-X-MEDIA-SEQUENCE:0#EXT-X-TARGETDURATION:4#EXT-X-INDEPENDENT-SEGMENTSI've looked through all the settings and can't see anything that would make this happen.My job JSON is included below (with a few things xxx'd out)Many thanks in advance,Stuart{"Queue": "xxx","UserMetadata": {},"Role": "xxx","Settings": {"TimecodeConfig": {"Source": "ZEROBASED"},"OutputGroups": [{"Name": "Apple HLS","Outputs": [{"ContainerSettings": {"Container": "M3U8","M3u8Settings": {"AudioFramesPerPes": 4,"PcrControl": "PCR_EVERY_PES_PACKET","PmtPid": 480,"PrivateMetadataPid": 503,"ProgramNumber": 1,"PatInterval": 0,"PmtInterval": 0,"Scte35Source": "NONE","Scte35Pid": 500,"NielsenId3": "NONE","TimedMetadata": "NONE","TimedMetadataPid": 502,"VideoPid": 481,"AudioPids": [482,483,484,485,486,487,488,489,490,491,492]}},"VideoDescription": {"ScalingBehavior": "DEFAULT","TimecodeInsertion": "DISABLED","AntiAlias": "ENABLED","Sharpness": 50,"CodecSettings": {"Codec": "H_264","H264Settings": {"InterlaceMode": "PROGRESSIVE","NumberReferenceFrames": 3,"Syntax": "DEFAULT","Softness": 0,"GopClosedCadence": 1,"GopSize": 90,"Slices": 1,"GopBReference": "DISABLED","SlowPal": "DISABLED","EntropyEncoding": "CABAC","FramerateControl": "INITIALIZE_FROM_SOURCE","RateControlMode": "QVBR","CodecProfile": "MAIN","Telecine": "NONE","MinIInterval": 0,"AdaptiveQuantization": "AUTO","CodecLevel": "AUTO","FieldEncoding": "PAFF","SceneChangeDetect": "ENABLED","QualityTuningLevel": "MULTI_PASS_HQ","FramerateConversionAlgorithm": "DUPLICATE_DROP","UnregisteredSeiTimecode": "DISABLED","GopSizeUnits": "FRAMES","ParControl": "INITIALIZE_FROM_SOURCE","NumberBFramesBetweenReferenceFrames": 2,"RepeatPps": "DISABLED","DynamicSubGop": "STATIC"}},"AfdSignaling": "NONE","DropFrameTimecode": "ENABLED","RespondToAfd": "NONE","ColorMetadata": "INSERT"},"AudioDescriptions": [{"AudioTypeControl": "FOLLOW_INPUT","CodecSettings": {"Codec": "AAC","AacSettings": {"AudioDescriptionBroadcasterMix": "NORMAL","Bitrate": 96000,"RateControlMode": "CBR","CodecProfile": "LC","CodingMode": "CODING_MODE_2_0","RawFormat": "NONE","SampleRate": 48000,"Specification": "MPEG4"}},"LanguageCodeControl": "FOLLOW_INPUT"}],"OutputSettings": {"HlsSettings": {"AudioGroupId": "program_audio","AudioOnlyContainer": "AUTOMATIC","IFrameOnlyManifest": "EXCLUDE"}}}],"OutputGroupSettings": {"Type": "HLS_GROUP_SETTINGS","HlsGroupSettings": {"ManifestDurationFormat": "INTEGER","SegmentLength": 6,"TimedMetadataId3Period": 10,"CaptionLanguageSetting": "OMIT","Destination": "xxx","TimedMetadataId3Frame": "PRIV","CodecSpecification": "RFC_6381","OutputSelection": "MANIFESTS_AND_SEGMENTS","ProgramDateTimePeriod": 600,"MinSegmentLength": 0,"MinFinalSegmentLength": 0,"DirectoryStructure": "SINGLE_DIRECTORY","ProgramDateTime": "EXCLUDE","SegmentControl": "SEGMENTED_FILES","ManifestCompression": "NONE","ClientCache": "ENABLED","AudioOnlyHeader": "INCLUDE","StreamInfResolution": "INCLUDE"}},"AutomatedEncodingSettings": {"AbrSettings": {"MaxAbrBitrate": 8000000,"MinAbrBitrate": 400000}}}],"AdAvailOffset": 0,"Inputs": [{"AudioSelectors": {"Audio Selector 1": {"Offset": 0,"DefaultSelection": "DEFAULT","ProgramSelection": 1}},"VideoSelector": {"ColorSpace": "FOLLOW","Rotate": "DEGREE_0","AlphaBehavior": "DISCARD"},"FilterEnable": "AUTO","PsiControl": "USE_PSI","FilterStrength": 0,"DeblockFilter": "DISABLED","DenoiseFilter": "DISABLED","InputScanType": "AUTO","TimecodeSource": "ZEROBASED","FileInput": "xxx"}]},"AccelerationSettings": {"Mode": "DISABLED"},"StatusUpdateInterval": "SECONDS_60","Priority": 0}FollowComment"

Answer: "1Hi Stuart,What is the issue you are trying to resolve? Are you trying to add "#EXT-X-PLAYLIST-TYPE:VOD" in your manifest? This tag is already added in the child manifest.Following is the master and child manifest running with your JSON.#EXTM3U#EXT-X-VERSION:3#EXT-X-INDEPENDENT-SEGMENTS#EXT-X-STREAM-INF:BANDWIDTH=942707,AVERAGE-BANDWIDTH=461799,CODECS="avc1.4d401e,mp4a.40.2",RESOLUTION=640x364,FRAME-RATE=24.000big_buck_bunny_1_1.m3u8#EXTM3U#EXT-X-VERSION:3#EXT-X-TARGETDURATION:8#EXT-X-MEDIA-SEQUENCE:1#EXT-X-PLAYLIST-TYPE:VOD#EXTINF:8,big_buck_bunny_1_1_00001.tsIf you want to set #EXT-X-TARGETDURATION:4, you can change the follow setting."FramerateControl": "INITIALIZE_FROM_SOURCE""GopSize": from 90 to 50 (if source's framerate is 50/25) or 60 (if source's framerate is 60/30/)"SegmentLength": from 6 to 4,Thanks,SamEdited by: samuelaws on Nov 25, 2020 12:11 AMCommentSharesamuelAWSanswered 3 years ago1Hi Sam,Many thanks for the help - i'm a little embarrased as I should have checked the child manifests, it's just the ones I was comparing against had it in the main manifest so was expecting to see it there - so thanks for letting me know and it seems fine to have it just there.Thank you also for the direction in EXT-X-TARGETDURATIONMuch appreciated!StuartCommentShareStukerranswered 3 years ago"


Question: Enable awsvpctrunking at container instance level

"I am using terraform to create an ecs cluster backed by ec2 instance type c5.large.  I need the container instances to have the awsvpctrunking option enabled to utilize the limit of 10 elastic network interfaces attached to each container instance instead of the limit of 3 when it is not enabled. In order to make my deployments as isolated as possible, I would like to only enable the awsvpctrunking option at the container instance level rather than changing the awsvpctrunking account setting that will possibly affect resources not managed by my terraform. The documentation states:Your account or container instance IAM role must opt-in to the awsvpcTrunking account setting. This can be done in the following ways:Any user can use the PutAccountSettingDefault API to opt-in all IAM users and roles on an accountA root user can use the PutAccountSetting API to opt-in the IAM user or container instance role that will register the instance with the clusterA container instance role can opt itself in when the PutAccountSetting API is run on an instance prior to it being registered with a clusterI am attempting to do the 3rd option (bolded above) by including a command in the user data for the launch configuration:user_data = <<-EOF#!/bin/bashaws ecs put-account-setting --name awsvpcTrunking --value enabled --region ${var.region} --principal-arn ${aws_iam_role.container_instance_role.arn}echo ECS_CLUSTER=${aws_ecs_cluster.api_cluster.name} >> /etc/ecs/ecs.configEOFThe iam role referenced in the user data is being used by the iam instance profile attached to this launch configuration. However, this command is not working as expected, since the ENI limit is still 3. I verified that awsvpctrunking works in general by enabling it at the account level. Does anyone have an idea of why the setting is not being enabled?ThanksFollowComment"

Answer: 0I needed to add "ecs:PutAccountSetting" to container instance iam role. Then you can modify account setting through user data like this:aws ecs put-account-setting --name awsvpcTrunking --value enabled --region ${var.region}CommentSharera-rearc123answered 4 years ago


Question: My Postgresql RDS instance drains CPU credits despite no activity

"Recently I observed some database connection errors in my (mostly idle) application. Monitoring showed that my db cpu credit balance had gradually decreased to 0 starting a few weeks ago, when the instance's CPU utilization crept above 10% (it's a t2.micro). This was constant usage, despite the only application (/EC2 instance) that uses the database being idle. The application was noticeably slower than normal, despite monitoring on the EC2 showing no issues. I tried rebooting both database and EC2 instance - since then (~1 day later) the database CPU credits have remained at zero, although the "CPUSurplusCreditBalance" is slowly increasing, the CPU utilisation remains slightly above 10%.I have enabled enhanced monitoring and performance insights. Post-restart, they don't show any activity beyond RDS-controlled queries (and those aren't frequent). Furthermore, the OS process list shows "RDS processes" as the highest contributor to CPU usage, although that's only around 4% (I guess it's hard to reconcile a snapshot of processes against overall CPU% usage). There are no open or idle connections to the database.Looking at monitoring and logs from when the credit drainage first started (April 10th), I don't see anything special happening at all (performance insights doesn't go back that far).My case seems somewhat similar to this one from 2015, though this is now occuring post-reboot (i.e. it's not caused by a single burst of activity). https://dba.stackexchange.com/a/118939Rather frustrating that despite being a paying customer, I am unable to open a technical support case. Hoping this forum can help!FollowComment"


Question: Route 53 consumption from On-Prem

"Hello Team, How can we consume the Route 53 hosted zone from On-prem?FollowComment"

Answer: "0Accepted AnswerHi,Yes you can. For private hosted zones, you can make use of the Route 53 resolver service, as long as the associated VPC is reachable from your network over Direct Connect, VPNhttps://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.htmlFor resolving records in your private hosted zone from on-prem, you can do so by configuring the DNS resolvers on your network to forward queries to Inbound endpoints in your VPC to resolve records in your private hosted zone. Please refer to the link below for guidance on this;https://aws.amazon.com/premiumsupport/knowledge-center/route53-resolve-with-inbound-endpoint/CommentShareAWS-User-5927523answered 2 years ago"


Question: AWS Backup - S3 failed: access denied

"we've a S3 bucket with policy enabled to permit access to specific IAM user only.then we create a backup plan to run a daily backup job for this S3 resource.i added the following statement in our existing bucket policy to allow also the  AWS default backup role that was setup in the backup plan's resource selection   "Sid": "Stmt1663835336196",  "Action": "s3:*",  "Effect": "Allow",  "Resource": [    "arn:aws:s3:::<BucketName>",    "arn:aws:s3:::<Bucketname>/*"  ],  "Principal": {    "AWS": [      "arn:aws:iam::<AccountNumber>:role/service-role/AWSBackupDefaultServiceRole"    ]However, we are getting a failed (access denied) backup job.hope someone can guide me to verify concernTIAFollowComment"

Answer: "0I upload my backups to my S3 bucket regularly and it works just fine.  I think you need the s3:PutObject permission.  I also have other ones, like                 s3:PutObjectAcl, but I'm not sure you need that.  You might want s3:GetObject permissions, too, if you want to download it or read it.  Let me know how it goes.CommentSharejschwar313answered 8 months agojschwar313 8 months agoIf this answer helped you, please accept my answer or upvote it.  It will help others know it worked that way.ShareUser-HN 8 months agoHi, thank you for you reply..we don't have issue reading & writing files / object to S3 from our application.the problem is, we intend to create a regular backup job for that particular bucket using AWS Backup Servicehowever the AWS Backup Service job fails and getting access denied due to S3 bucket policy.we tried to follow this documentation, and add the RoleID of the default backup role but to no availhttps://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/Share0Did you follow this document for creating the roles?  https://docs.aws.amazon.com/aws-backup/latest/devguide/iam-service-roles.htmlCommentSharejschwar313answered 8 months agoUser-HN 8 months agoThanks for your reply SirI believe the AWSBackupDefaultServiceRole is automatically created when we make a backup plan and choose the default role.Share0If my answer helped you, please accept the answer or upvote it.  It will help others that way, too.  Thanks.CommentSharejschwar313answered 8 months ago0There is a way to generate a policy based on Cloud Trail logs.  That might help you.  See this article.  Hope it helps.  https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation.htmlCommentSharejschwar313answered 8 months ago0we are using the AWSBackupDefaultServiceRole with the following attached AWS managed policiesAWSBackupServiceRolePolicyForBackupAWSBackupServiceRolePolicyForRestoresAWSBackupServiceRolePolicyForS3BackupAWSBackupServiceRolePolicyForS3Restorehowever, still getting a failed backup job with access denied errorCommentShareUser-HNanswered 8 months ago0my posted concern here is now resolved, I updated the bucket policy and added a statement with the following conditioncondition:  ArnLikeKey: aws:SourceArnValue:  arn:aws:iam::<Account Number>:role/service-role/AWSBackupDefaultServiceRoleour backup job is now running.CommentShareUser-HNanswered 8 months ago"


Question: What happenes to ec2 classic resources after Aug 15th 2022?

"I am curious what will happen to ec2 classic resources after the August 15th deadline. The "How to Prepare" doc just mentionsOn August 15, 2022 we expect all migrations to be complete, with no remaining EC2-Classic resources present in any AWS account.What will happen to resources that are remain in the AWS account? Will the resources be available for migration or backup after this deadline or will all resources and their data be lost?FollowComment"

Answer: "0As you can read in our Blog Post here: https://aws.amazon.com/blogs/aws/ec2-classic-is-retiring-heres-how-to-prepare/ we will not disrupt any customer workload running on AWS EC2 Classic. We are notifying this more than 12 months in advance with lots of tools and resources.My recommendation is to contact your account team from AWS (TAM or Solutions Architect) in case you may have any doubt or risk on how to migrate the VMs you may have using EC2 classic.Best regards,CommentShareJuanEn_Ganswered a year ago"


Question: ALB instead of Cloudfront in front of single server

"Hi,AWS Recommends adding cloudfront in front of single server applications for security and performance see https://aws.amazon.com/blogs/networking-and-content-delivery/dynamic-whole-site-delivery-with-amazon-cloudfront/I want to add it for an existing web app but the max time out of cloudfront is 180 seconds and I have some calls which are longer and will time out.I'm mainly interested in the security upside and less in the performance upside of this setup since this is for a web panel which does not require high speed delivery.My question is - Is it a good solution to add an Application load balancer instead of dynamic cloudfront in front of the server in order to get the security benefits such as hiding the end server IP address , getting WAF and DDOS mitigation without the 180 seconds timeout issue ?Are there downsides to doing it ?ThanksFollowComment"

Answer: "2The biggest thing you'll be missing here is caching; and specifically caching at the edge. As a secondary thing you'll lose the performance that comes with traffic being transferred over the AWS backbone rather than the Internet - but you can regain that by using Global Accelerator.I would suggest that the DDoS protection from CloudFront is somewhat better than that from a single ALB only because CloudFront appears as multiple IP addresses in many different geographic regions.It's not clear from your question but I'm going to assume that the 180 second timeout you're experiencing is an idle timeout. I would definitely test that against ALB; you can increase timeouts to 4,000 seconds (documentation is here) but I would suggest that three minutes is a long time for users/applications to wait for a response.While it would take some effort to re-architect things it might make sense to decouple the front end and back end so that you can move to a design where the front end can wait indefinitely (using some sort of request identifier and a status page for the user) while the back end provides updates in some way. That would also remove the challenge you're having with CloudFront and give a bunch of flexibility in dealing with long queries.Definitely worth a conversation with your local AWS Solutions Architect as this is a conversation that can be long and detailed.CommentShareEXPERTBrettski-AWSanswered a year agoAWS-User-0822786 a year agoThanks for the answerCaching is not needed since the content is dynamic. Good tip about global accelerator as a solution for faster global access. I may use it in front of the ALB.the 180 second is not enough for some specific calls in the app where the user expects long wait e.g. for a report generation. Its not that the app is slow and not a UI problem. And I prefer no to re write it with polling or something. Not worth the effort.From your answer I gather that besides a bit less DDOS attack capabilities compared to cloudfront it does make sense to use ALB for this case. Assuming its the only downside.Share1HelloIt is advisable to use ALB with Multiple instances in multiple AZ with Cloud-front as ALB as orign, in this case what happens your Ec2 instances are in the private subnet so you have more security to your web servers.Please look at the sample architecture design https://d2908q01vomqb2.cloudfront.net/22d200f8670dbdb3e253a90eee5098477c95c23d/2020/10/18/Enhance-Amazon-CloudFront-Origin-Figure-1.pngWell architected workshop https://www.wellarchitectedlabs.com/security/200_labs/200_cloudfront_for_web_application/1_config_cloudfront/CommentShareGKanswered a year agoAWS-User-0822786 a year agoThanks for the answer.I know it is advisable to use ALB with multiple instances. However in this case I need to have one instance for this server. The question is whether I can gain the same security advantage as I get with cloudfront by using ALB instead.ShareGK a year agoWhen you use the Single Ec2 you must run the Ec2 in public subnet instead of using ALB your machines are in private networkShareAWS-User-0822786 a year ago@GK As far as I know Its OK that the subnet is public as long as security groups are used to block it from the outside world (and allow only white listed developers to access)Share"


Question: Amazon Managed Service for Prometheus

I deployed Amazon Managed Service for Prometheus and I'm trying to get metrics for ECS and EB. But I can't understand if need to setup a Prometheus server to send the metrics to and have the data source set to remote write to AMP? Or do I need to install and setup node exporter?Can you someone please explain the difference between the Amazon Managed Service for Prometheus vs Prometheus server?FollowComment

Answer: "0https://aws.amazon.com/blogs/opensource/metrics-collection-from-amazon-ecs-using-amazon-managed-service-for-prometheus/Taken from aboveThe Prometheus Server gets installed in the ECS cluster as a collector (agent) that forward metrics to AMP.  Prometheus supports dynamic discovery of Kubernetes resources so you need to deploy Prometheus server on an Amazon ECS cluster, dynamically discover the set of services to collect metrics from, and send the metrics to AMP for subsequent query and visualization as well as long-term storage. This solution will also enable Amazon ECS customers to leverage libraries and servers that help in exporting existing metrics from third-party systems as Prometheus metrics.CommentShareRolyanswered 3 months ago0How do I get the metrics for AWS Elastic Beanstalk? The beanstalk application is using docker containers.CommentShareSamanswered 3 months ago"


Question: Send mail as spam

"Hi aws:The emails we send using amazon ses are treated as outlook spam, but gmail is not treated as spam, I have set up DomainKeys Identified Mail (DKIM) or Sender Policy Framework (SPF) in aws ses, our The email subject and content do not include any URL, similar to the following:Email Subject:Your X verification codecontent of email:Your X verification code is: x.Please complete the account verification process in x minutes.At the same time, the dedicated IP address of aws ses is in the application.Do you have any good suggestions or opinions for us?By ningning.FollowComment"

Answer: "1Hi,A message placed in a spam folder indicates that Amazon SES has successfully delivered the message to the recipient’s mail server (ISP). At this stage, Amazon SES has no control over the message and can’t guarantee inbox placement. The ISP decides whether the email is categorized as spam and determines the overall mailbox placement. If the ISP flags the email message as spam, then the email might be placed in the recipient’s spam or junk folder.When you say you have set up SPF, do you mean that you have set up a Custom MAIL FROM domain that allows SES server in it’s SPF record? If you have not already set up a Custom MAIL FROM domain, I would recommend setting it up as it aligns your FROM domain with the MAIL FROM domain which ensures higher deliverability : https://docs.aws.amazon.com/ses/latest/dg/mail-from.htmlAdditionally, make sure that you are maintaining a good reputation of your Dedicated IP by sending consistent and predictable volumes of email.Here is a link for other best practices that you can follow while using SES : https://docs.aws.amazon.com/ses/latest/dg/best-practices.htmlFrom the SES end, we can follow the best practices such as authentication (SPF,DKIM) and maintaining high message quality so as to ensure high deliverability, however, we cannot influence the ISP’s decision. The ISPs have multiple filters unknown to us, which decide inbox placement. For further insight, I would recommend reaching out to the ISP(Outlook) to understand what is triggering their email filters and causing the email to land in spam.Please feel free to reply if you have further queries.CommentShareSUPPORT ENGINEERajita-awsanswered 8 months ago"


Question: Can we create native delta lake tables only through crawler

"hello,AWS recently announced that Glue crawlers can now create native delta lake tables (last December, https://aws.amazon.com/blogs/big-data/introducing-native-delta-lake-table-support-with-aws-glue-crawlers/). We tested and it works fine. However, we would like to not use crawlers.Is this the only way to create a native delta lake table for now? Is this planned to allow this through the Glue console table creation screen?As a side note, it looks like terraform is still missing a "CreateNativeDeltaTable" option in their latest provider (they have an open issue for that).Thanks.Cheers,FabriceFollowComment"

Answer: "0Thanks Gonzalo for your answer. Actually, my question is really about "delta" tables. I am able to create tables through the console, or the CLI. I am doing it multiple times :)Through the console, I cannot select a "delta" format. I can select Avro, CSV, Parquet amongst others, but not Delta.When I create a replicate of the table created by the Delta source crawler, I get errors when querying the table (through Athena, or any other Glue job).   When querying the mimicked table I get the error:HIVE_CANNOT_OPEN_SPLIT: Error opening Hive split s3://.../part-00000-c3e64f54-ed8a-459c-8157-4235f25595b4.c000.snappy.parquet (offset=0, length=182912) using org.apache.hadoop.mapred.SequenceFileInputFormat: s3://com.diabeloop.dev.dta.lake/technical_logs/v3/curated_logs/resampled_information/environment=clinical/year=2022/part-00000-c3e64f54-ed8a-459c-8157-4235f25595b4.c000.snappy.parquet not a SequenceFileAlthough querying the delta table created by the crawler (classification indeed equals to "delta") is working like a charm (both Athena and glue job).CommentSharerePost-User-2429154answered 4 months agoGonzalo Herreros 4 months agoI see your point, you could use the wizard but then have to update the table using "ALTER TABLE" until it looks like the one from the crawler. You can do it Athena for instance, copying the DDL from another tableShare0There is nothing stopping you creating the table yourself and doing the same the crawler does, as long as you enter the right parameters and configuration.You can do it via the console, AWS CLI or boto3 or Athena.It's easier if you get the table definition the crawler created and use it as a template, either using "aws glue get-table" or asking Athena to provide the DDL for an existing table.CommentShareGonzalo Herrerosanswered 4 months ago"


Question: Usage of named shadow

"Hi,I am using aws-io-device-sdk-python package: https://github.com/aws/aws-iot-device-sdk-python/tree/e0f9eef8aafdf6319022d7972d3f1f65eefb784d for an AWS shadow purpose.I want to use named shadow, however, I have seen that this library only send message for unamed shadow:self._topicGeneral = "$aws/things/" + str(self._shadowName) + "/shadow/" + str(self._actionName) ( found in https://github.com/aws/aws-iot-device-sdk-python/blob/e0f9eef8aafdf6319022d7972d3f1f65eefb784d/AWSIoTPythonSDK/core/shadow/shadowManager.py ) while the shape of the topic for a named shadow should be:$aws/things/thingName/shadow/name/shadowName/actionNameIs there any way to use this library without modifying for named shadow?Thank you in advanceFollowComment"

Answer: "1Hi,you are looking at an older version of the AWS IoT Device SDK for Python which does not get feature updates.The current AWS IoT Device SDK v2 for Python has methods to interact with named shadows.Cheers,PhilippCommentSharePhilipp Sanswered 8 months agoEXPERTGreg_Breviewed 8 months ago0Thank you very much Philipp.I never saw there was a v2 of the SDK.Best regardsTomCommentSharetomanswered 8 months ago"


Question: Python KeyError

"Hello AWS Team,Can some one please help me here, I am trying to deploy the solution as advised in the blog https://aws.amazon.com/blogs/contact-center/recovering-abandoned-calls-with-amazon-connect/ , however when I run a test on Python 3.7 Lambda code as given, I am getting below error:Response{"errorMessage": "'Records'","errorType": "KeyError","stackTrace": ["  File "/var/task/ACR.py", line 18, in lambda_handler\n    for record in event['Records']:\n"]}Can some one please assist me with correct "Test Event" i should configure and also how can i get this error resolved?Thanks,AnchalFollowComment"

Answer: "0Hi there,I have checked the code in the example and event you are looking for is "Kinesis record event", here is an example from documentation:https://docs.aws.amazon.com/lambda/latest/dg/with-kinesis.htmlYou can create an example event for to test your Lambda function locally.Kind regards,AlexCommentShareAlexander Melnykanswered a year ago0Hello Thanks for sharing the test event, however please if you can run the code and test it, its giving that KeyError can you please check and validate code provided is correct?As its not recognizing 'Records' in the library for Python?Regards,AnchalCommentShareAWS-User-4387413answered a year ago0Hi Again,As you can see after the Kinesis Record, test event i run, the below error i get :{"fail_code": "decode data fail","result": "fail","ctrs_processed": 0,"ctrs_skipped": 0}Seems its giving payload error in the Lambda function provided?Decode the data and parse the json    try:        payload = base64.b64decode(record['kinesis']['data'])        payload_data = json.loads(payload)        # Log a decode failure and break out of loop    except:        response.update({'fail_code':'decode data fail'})        response.update({'result':'fail'})Please if you can help, will be apreciated.Thanks,AnchalCommentShareAWS-User-4387413answered a year ago"


Question: Upgrade the python version in App Runner Service?

"Is it possible to upgrade the python version in an App Runner service created from source code repo? If so how? If not, what is the best alternative to run an app that requires python >= 3.10.10 ?FollowComment"

Answer: "1In the AppRunner service configuration (apprunner.yaml) there is an option of a container or runtime version (e.g. runtime: python3.10).  You can use a CI/CD pipeline to build a container with the required Python version, then add the container to ECR and import it when creating a new AppRunner service.More infoAppRunner/Repos: https://docs.aws.amazon.com/apprunner/latest/dg/service-source-image.htmlDocker/CodeBuild: https://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker.htmlCommentShareFranke-AWSanswered 2 months agoEXPERTalatechreviewed 2 months agoJulian 2 months agoMany thanks!Share"


Question: Is there anything more fun than the Captcha game at AWS login?

"I must say, I do enjoy the average of 3-5 times it takes to accurately complete the random character captcha security check each time I try to login to AWS from the web console or the mobile app.  Nothing says "convenience" like authenticating against bots on my own mobile device or trusted workstation.In case you missed the tone of the above, this is sarcasm.  Now for the constructive criticism:Captcha image checks are supposed to protect against rogue hacking scripts.  I wouldn't mind it as much if the images were clear and accurate, but, as I indicated above, they rarely translate into the accepted answer.  Additionally, AI is making these types of checks obsolete as well, so image checks are starting to show their age.AWS, please accept this constructive criticism and an area that would make your customer experience improve dramatically.FollowCommentadkboomer a year agoI have to agree - the AWS captcha is really, really sucky - I get the captcha 100% of the time when logging in, and can almost never figure out what the characters are. It fails about 90 percent of the time. (and I have 20/20 vision) I have to resort to the audio version of the captcha which obviously takes tons of time. Really hope the Amazon will fix this because this visual captcha is totally useless today. Very frustrating.I also tried to turn on MFA in hopes of getting rid of the captcha all together - no luckShareAWS-User-4588059 a year agoAgree - just took me > 10 tries to login. Completely ridiculous..ShareHonzaPoboril a year agoIt would also will be less anoying if that session will survive more then a few hours. Or captha will not be used when account has MFA.Sharemsxtj a year agoI agree. When I have 2FA, I don't think that this captcha that is terribly annoying, is anywhere useful. Even on my Android phone, I get this captcha. Imagine logging on your Android phone, or into your bank app on your phone required, beside the fingerprint sensor, an Amazon-quality captcha :(SharerePost-User-5011668 5 months agoCompletely agree, the captcha is incredibly annoying and can cause logging in to take 10 minutes of repeated tries at matching the 6 characters.  Relieved to hear that even people with 20/20 vision have trouble with this.  I was hoping to find a config setting that would turn this off for our account, but I don't see one mentioned here.Hoping enough people complain that AWS will allow turning off captcha.Share"

Answer: "6In my experience, I only get the captcha challenge when using the the root account login.  AWS IAM Security best practices recommend the use of IAM Admin User accounts for day-to-day use.When configured with MFA, IAM Users don't get challenged by captcha.CommentShareDaniel Craigieanswered a year agoMetalDave DP a year agoThat's a great tip, Daniel, and, certainly, one worth exploring.  I'm familiar with superuser best practices, but I can see how a good portion of users are utilizing their root account (especially if they are in a set-and-forget-it situation with their application).Thanks for the link!Share"


Question: API hosted on railway throws error on API Request to my Lambda

"Hello I'm making a simple API request to my lambda endpoint from another server that's hosted on railway.app and everytime I make a request to my lambda I get the following error.
403 ERROR

The request could not be satisfied.

Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.

Generated by cloudfront (CloudFront)Request ID: _-bskwhg7aCgBL3YAH7_MazAyGiMiE1dfA5i7xa1wg_uRvNzMFVTiQ==
this is just an snippet of the request error from an axios request from my server to my lambdaI haven't used cloudfront before nor have I configured anything to use Cloudfront, I used the Serverless package for typescript to create an S3 bucket for my API, and I don't know how to resolve this issue, because the same request I'm making from my railway server can be completed by using a get request with postman.Any help would be greatly appreciatedFollowComment"

Answer: 0It looks as though you were using an edge-optimized API gateway which automatically configures CloudFront for you. I would suggest checking your API Gateway logs  to find out why it was returning a 403 error.CommentSharePaul_Lanswered 3 months ago


Question: Data transfer out s3-cloudfront

"There are 2 different accounts belonging to different customers. One of the customer has one cloudfront distribution in the account and another have s3 bucket. They have enabled cross account s3 access. Now , we know that data transfer out is free from s3 to CF. But will this be free even in case of resources belonging to different account?FollowComment"

Answer: "1Accepted AnswerFor public commercial regions at least (I'm not sure for when accounts are across partitions, for example in GovCloud and China), the billing system tracks only that the destination is CloudFront, not the owner of the CloudFront distribution. Therefore, the S3 account owner will not be charged for data transfer to a distribution in another AWS account.CommentShareEXPERTLeeAtk@AWSanswered 4 years agoNataliya_G EXPERT2 years agoJust a clarification: it will be free only provided that both CloudFront distribution and S3 bucket are in the same AWS Region :)Share"


Question: Plex Showing Stopped

Plex Showing StoppedFollowComment


Question: Spring boot application on Elastic beanstalk Upload Large files

"Hallo guys, I'm writing to you in hope to get a help on a problem I'm facing, so basically I created a spring boot rest API for my app and I used AWS Elasticbeanstalk  to deploy, now when I try to upload a file to my S3 bucket using the rest API, I'm facing an error saying that the body of my request is too large, even for some image files not larger than 1MB. So please how can I solve that issues.Here's the error part of the logs of the app:2023/03/21 05:12:26 [error] 2736#2736: *56 client intended to send too large body: 3527163 bytes, client: ..., server: , request: "POST /mobile/create_post HTTP/1.1", host: "..."FollowComment"

Answer: "0Hello,Thank you for your query.I understand that you have deployed a spring boot REST API on Elastic Beanstalk however when using the API to upload a file in S3 bucket, you are getting the error saying that the request body is too large.Proceeding further, if you are using Nginx proxy for the application, so be default the max size for client request is set to 1MB and you will get an error when a larger file is uploaded.From the error itself we can see that a file of size 3527163 bytes (~ +3Mb) is sent and hence the error. Therefore, can you please confirm which proxy you are using, and refer this link for increasing the request body size.https://repost.aws/knowledge-center/elastic-beanstalk-nginx-configurationIf you are using Apache, you can follow the same approach to increase the limits as well.[] Extending Elastic Beanstalk Linux platforms - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/platforms-linux-extend.htmlHoping that the above helps. Thank you.CommentShareSUPPORT ENGINEERAWS-User-arpitanswered 2 months agorePost-User-1906376 2 months agoI've tried your solution like this:1- created myapp/.platform/nginx/conf.d/client_max_body_size.conf.client_max_body_size 50M; in my application source code using IntelliJ IDE2- then I built jar file in target directory using "mvn clean install"3- then uploaded the jar file to elastic beanstalk.But still the problem isn't solvedShare"


Question: EC2 Will not Force Stop

"Instance ID: i-078894d966ad944d0Received the following email last night,Hello,EC2 has detected degradation of the underlying hardware hosting your Amazon EC2 instance (instance-ID: i-078894d966ad944d0) associated with your AWS account (AWS Account ID: 114294567307) in the us-east-1 region. Due to this degradation your instance could already be unreachable. We will stop your instance after 2021-07-14 12:00:00 UTC. Please take appropriate action before this time.The affected instances are listed below:i-078894d966ad944d0Sure enough my instance is hosed. Tried to stop, will not stop, tried to force stop, will not force stop. Please advise.Thanks,ChadFollowComment"

Answer: 0It has finally stopped.ThanksCommentShareChadHDanswered 2 years ago


Question: [kvs]stream automatically drawn

"How to configure with one click, so that all video streams under the account are automatically drawni know some infomation about make one stream sampling, can i use wildcard like "" to make all of the stream in my account sampling?if "" can't use, what should i do to let all of my stream samplinghttps://aws.amazon.com/cn/blogs/china/integration-and-analysis-of-video-stream-detection-scheme-based-on-amazon-kinesis-video-stream-images/FollowComment"


Question: "[Action Required] Upgrade Amazon Aurora PostgreSQL 11.12, 12.7, and 13.3 minor versions by March 15, 2023"

"Newer versions of Amazon Aurora PostgreSQL-compatible edition are now available and database cluster(s) running Aurora PostgreSQL minor versions 11.12, 12.7, and 13.3 need to be upgraded by March 15, 2023. These newer minor versions include important updates that will improve the operations of your Aurora PostgreSQL instances and workloads. We strongly encourage you to upgrade to at least a recommended minimum minor version at your earliest convenience.For PostgreSQL Minor Version 11.12, the recommended minimum minor version is 11.17.For PostgreSQL Minor Version 12.7, the recommended minimum minor version is 12.12.For PostgreSQL Minor Version 13.3, the recommended minimum minor version is 13.8.Starting on or after 12:00 PM PDT on March 15, 2023, if your Amazon Aurora PostgreSQL cluster has not been upgraded to a newer minor version, we will schedule the relevant recommended minimum minor version to be automatically applied during your next maintenance window. Changes will apply to your cluster during your next maintenance window even if auto minor version upgrade is disabled.Restoration of Amazon Aurora PostgreSQL 11.12, 12.7, and 13.3 database snapshots after March 15, 2023 will result in an automatic upgrade of the restored database to a supported version at the time.How to Determine Which Instances are Running These Minor Versions?In the Amazon RDS console, you can see details about a database cluster, including the Aurora PostgreSQL version of instances in the cluster, by choosing Databases from the console's navigation pane.To view DB cluster information by using the AWS CLI, use the describe-db-clusters command.To view DB cluster information using the Amazon RDS API, use the DescribeDBClusters operation. You can also query a database directly to get the version number by querying the aurora_version() system function i.e., "SELECT * FROM aurora_version();".How to Apply a New Minor VersionYou can apply a new minor version in the AWS Management Console, via the AWS CLI, or via the RDS API. Customers using CloudFormation are advised to apply updates in CloudFormation. We advise you to take a manual snapshot before upgrading. For detailed upgrade procedures, please see the available User Guide [1]. Please be aware that your cluster will experience a short period of downtime when the update is applied.Visit the Aurora Version Policy [2] and the documentation [3] for more information and detailed release notes about minor versions, including existing supported versions.If you have any questions or concerns, the AWS Support Team is available on AWS re:Post and via Premium Support  [4].[1] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_UpgradeDBInstance.PostgreSQL.html[2] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.VersionPolicy.html[3] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Updates.20180305.html[4] https://aws.amazon.com/supportFollowComment"