Question: Text not recognized as "HANDWRITING" in Textract

"Hi everyone,I have an issue with a code that was working fine in production using Textract and which does not work anymore.When using Textract, it does not detect anymore that a line or a word is handwritten and not printed.In the output of  textract.analyze_document(Document={'Bytes': file_content},FeatureTypes=["FORMS"]) (Python), when there is a "TextType" field, there is always a "PRINTED" value even though the word is obviously handwritten and that for any document i used as an input.Does anyone have the same issue ? Is it a change with boto3 or Textract itself ?Thanks in advance,QuentinFollowCommentgazanfer 7 months agoHi everyone,I have the same issue. Using textractClient.startDocumentAnalysis(startDocumentAnalysisRequest) all words are set to PRINTED.But using StartExpenseAnalysisRequest the textType is set correctly.{"BlockType": "WORD","Confidence": 35.711299896240234,"Text": "Untaborist","TextType": "HANDWRITING",...}Best regardsShare"

Answer: "0Thank you for using Textract. We would like to help with the issue you are facing. Can you create a case through AWS Support Center in your AWS account so that you can share some sample documents in which you are seeing issue if nature documents is not sensitive.CommentShareAWS-User-6928662answered 6 months agorePost-User-9288867 6 months agoAs my company only have the Basic Support plan, we cannot contact the AWS Technical Support about this issue.Best regards,QuentinShareAWS-User-6928662 6 months agoCan you share image or document here?Share"


Question: Unable to create a CodeCatalyst project in new space

"When I create an empty project in a new space, I receive the following error message:"We can't create a project because you have reached the maximum number of projects allowed for a space. You must delete one or more projects before you can create projects in this space."I don't currently have any projects in my space.FollowComment"

Answer: 1Accepted AnswerWe noticed similar instances. This typically happens when the connect AWS account didn't get set as your billing account. Can you navigate to the billing tab and click the button "Associate AWS account" in the banner? Then select the AWS account you had previous added." Once you complete that step you should see current tier of "free" and an account status of "Connected". Then retry creating your project.CommentShareMODERATORSundaresh_Ianswered 6 months ago0I'm sorry you encountered this error. We are currently investigating this issue. We will get back to you as soon as we have identified the root cause of this error.CommentShareMODERATORSundaresh_Ianswered 6 months ago


Question: App with 2 microservices - should they run in two ECS clusters or two services in single ECS cluster

I am building an application with two processes that talk to the same database. They don't interact directly. I am setting them up to run in ECS fargate. Should I be using a single cluster with two services each pointing to a different task or should I have two different clusters? What do I need to consider when making that decision? Scaling requirements for both processes are going to be similar. They don't necessarily need to be isolated from each other.FollowComment

Answer: 0Accepted Answer1 cluster and 1 service with 2 task definitions. You don't need 2 clusters.CommentSharemyronix88answered 12 days ago


Question: Printing to DCV printer from Appstream will result in .xps file where .pdf is expected

"We use Appstream 2 to host an application, which is accessed by our users via a browser. Within this environment, users have a DCV printer available.For most users, printing to the DCV printer results in a PDF file to become available in a separate browser tab.But for 1 user printing results in a XPS file.I can't find how to change this to PDF for him.FollowComment"

Answer: "0The link below discusses printing DCV files from Appstream 2.0 and Adobe Cloud, and mentions that having client authorization is needed, with a subordinate link for configuring that needed authorization.  It discusses Default vs Custom permissions situations. If only 1 client of many has the problem, and you have ensured the correct printer was chosen for printing, then permissions review would be the next step in trouble-shooting.DCV PrintingCommentShareAWSdaveanswered 4 months ago"


Question: Disabling records within Route53

"Is there a way to disable a record within a route 53 instead of deleting the record? An example would be that a user is sending a lot of requests that are flowing through route 53, but instead of just completely deleting their record and stopping any flow of data permanently, disable their record so that their flow is paused and investigation is done to confirm if deletion should happen.FollowComment"

Answer: "0Hello,There is currently no such feature to temporarily disable a DNS record in Route53. Deleting a record is the only way you can stop a route. However, I will forward this as a feature request for the service.Unfortunately this will be on best effort basis, and we will not be able to provide any ETA for this. You can keep a tab on our What's new page to be aware of new features being incorporated in AWS - https://aws.amazon.com/about-aws/whats-new/2022/Thanks.CommentShareSUPPORT ENGINEERRuhisar_Tanswered a year agoMonica_Lluis SUPPORT ENGINEERa year agoThank you ruhisarAtAWS for forwarding the feature request.AWS-User-4066528 ,Thank you for using re:Post. Let us know if this answers your question. If so, please remember to click on the "Accept" button to let the community know that your question is resolved. This helps everyone. Thank you in advance.Share0For most purposes you might prepend the record name with _delete_ or _disable_ which will effectively prevent successful queries.for example www becomes _disable_wwwBeware this might not work as intended with all types of records - like PTR records. Should work fine for A, CNAME, NS, MX etc.CommentShareAWS-User-2792393answered a year ago"


Question: AWS EKS EC2 instance outbound connection issue

"I have created a EKS cluster having 3 nodes under a single node group.one of the EC2 instance can able to reach an external endpoint (https://api.keywordseverywhere.com), meanwhile the other two instances unable to reach the external endpoint. I have checked the security groups and network ACL. What am i missing here?FollowComment"

Answer: "0If you have already checked the security groups and network ACLs and verified that the configuration is the same for all three EC2 instances, then there may be other factors that could be causing the issue.Here are some additional troubleshooting steps you can try:Check the routing table of the VPC: Verify that the routing table for the VPC is correctly configured and all the subnets have the same route. You can check the routing table in the Amazon VPC console.Check the DNS settings: Make sure that the DNS settings for the EC2 instances are configured correctly. You can check the DNS configuration in the EC2 console or by logging into the instance and running the command "cat /etc/resolv.conf".Check the NACL rules: Verify that the Network ACL rules are correctly configured and allow outbound traffic from all the subnets.Check the logs: Check the logs of the EC2 instances and the EKS cluster to see if there are any error messages or issues related to network connectivity.Check the instance metadata: Verify that the instance metadata is correctly configured and that the instance has access to the correct IAM role and security credentials.If you have tried these steps and still cannot resolve the issue, you may need to reach out to AWS support for further assistance.CommentShareYasseranswered 18 days ago"


Question: "Cloud9 failure, exit code 100, possibly relate to tmux(?)"

I am new to cloud9. Just created an environment and opened it. It seems installing several things to my EC2 (which I usually access using ssh from my PC at home) but eventually left below message in red and obviously failed. How can I fix this?(message)(~)/.c9/bin/tmux: error while loading shared libraries: libevent-2.1.so.7: cannot open shared object file: No such file or directoryInstalled tmux does not appear to work:exiting with 100Failed Bash. Exit code 100.One or more errors occured. Please try to resolve them and restart AWS Cloud9 or visit https://forums.aws.amazon.com/forum.jspa?forumID=268(end of message)Any information is welcome please.FollowComment

Answer: "0Hello, thank you for reaching out here.If you are creating a SSH Cloud9 Environment (e.g. connecting to existing EC2 instance in personal account), please follow steps in this user guide https://docs.aws.amazon.com/cloud9/latest/user-guide/ssh-settings.html to make sure that required system libraries are available to connect to instance with Cloud9.If problems persist, we recommend to create new EC2 Cloud9 environment.CommentShareshcherbavanswered 2 months ago"


Question: Amazon Textract

Is it possible to use Amazon Textract as a simple service in a manual fashion? Can you use it through the console and get billed. I dont have the knowledge to program.FollowComment

Answer: "0The demo might suit your needs: https://console.aws.amazon.com/textract/home#/demoYou can upload your own documents (with a few limits) and get the results directly in the console.CommentShareEdanswered a year agorePost-User-0145522 a year agoMy concern is that it is a demo. Can you use this for an instance for 100 documents? Will this be against AWS Terms of Service?Share0Hi! You can use the console to try out your documents.Under the hood it is calling the service APIs for you tied to your account. So you can use it with all the documents you want, but bear in mind if you go over the free tier you will be charged!As part of the AWS Free Tier, you can get started with Amazon Textract for free. The Free Tier lasts for three months, and new AWS customers can analyze up to:Detect Document Text API: 1,000 pages per monthAnalyze Document API:100 Pages per month when using Forms or Tables featureAdditional 100 pages per month when using Queries feature NEWAnalyze Expense API: 100 pages per monthAnalyze ID API: 100 pages per monthHope this helps :)CommentShareDani Manswered a year ago0I had the same problem! Developers wanted to charge me $3k++ do design it. Check out nanonets.com - It did exactly what I wanted it to do (just like the demo page from another answer, but without the 11 page limit) Nanonets is free up to 100 pages then monthlyCommentSharerePost-User-0863095answered a year ago"


Question: Intermittently unable to resolve DNS address within a VPC.

"I have an application running on ECS (Fargate) within a VPC. The application is packaged with a docker container.The ECS service has 2 subnets, each connected to an Internet gateway, and the routing table looks correct: https://i.imgur.com/zu6uQKu.pngThe application is supposed to talk to LetsEncrypt to issue SSL certificates.Now, quite often, I'm seeing bursts of log entries that look like this:(ConnectionFailure Network.Socket.getAddrInfo (called with preferred socket type/protocol: AddrInfo {addrFlags = [AI_ADDRCONFIG], addrFamily = AF_UNSPEC, addrSocketType = Stream, addrProtocol = 0, addrAddress = <assumed to be undefined>, addrCanonName = <assumed to be undefined>}, host name: Just \\\"acme-v02.api.letsencrypt.org\\\", service name: Just \\\"443\\\"): does not exist (No address associated with hostname))\")\nReq:Nothing\n"}Which looks like DNS issues to me.This is a fairly high traffic service and these errors seem to come and go, without warning.The ECS service is also set to auto-scale, so some containers may be in different subnets (each with the same routing table).What problems should I be looking at?Does this seem something specific to this service or could it just be a temporary DNS outage?FollowComment"

Answer: "0Fargate will not natively route to the internet unless you assign a Public IP Address. For a fargate service to access the internet, it must attach to a subnet that has a route 0.0.0.0/0 to a NAT Gateway or have a public IP in a subnet with a default route to a IGW.Its not clear from your image if the fargate task is attached to that subnet.Worth checking which subnets your ECS tasks are attached too?Fargate tasks will use the Route53 resolver for DNS resolution which can resolve internet addresses.No internet connectivity could cause this issue. I would first move your ECS task to a subnet which has a route to a NAT Gateway if it doesnt have a public IP.If this helps, please be sure to accept the answer to help others and me.CommentShareGary Mcleananswered 2 months ago0Based on the error message you provided, it seems that the application is unable to resolve the DNS address of LetsEncrypt intermittently. There are several potential causes for this issue, including:DNS resolution issues: This is the most likely cause of the problem. DNS resolution may fail due to various reasons such as network connectivity issues, DNS server problems, or misconfiguration. You can check if the DNS resolution is working correctly by performing a DNS lookup on the LetsEncrypt domain from within the VPC.Firewall issues: It is possible that a firewall or security group is blocking outbound traffic from the ECS service to the LetsEncrypt domain. Check your security groups and network ACLs to ensure that the necessary ports are open for outbound traffic.Load balancer issues: If the application is using a load balancer, it could be experiencing issues that are causing intermittent DNS resolution problems. Check the load balancer logs to see if there are any errors or issues that could be causing the problem.It is also possible that the issue is temporary and could be caused by a DNS outage or other temporary network issue. You can check with your DNS provider or network administrator to see if there are any known issues or outages.Hope that helps!CommentShareMina Gobrialanswered 2 months ago"


Question: "We can't sign in to your account" window appears.

"I am trying to create two NimbleStudio in Organizations and share AD.I VPC peered each of them and successfully connected AD, but when I start the workstation in NimbleStudio, "We can't sign in to your account" appears.What is the problem with this?Can anyone come up with any ideas?The NimbleStudio login screen and the workstation login screen pass through without any problems.The desktop will then display "We can't sign in to your account."FollowComment"

Answer: "1If you have successfully peered the VPCs and connected the AD, the issue with the "We can't sign in to your account" error message could be related to the following:Network connectivity: Make sure that the security groups, network ACLs, and routing tables are configured correctly for the VPC peering connection. Check if the necessary ports are open for the AD communication and that the network settings are correctly configured in NimbleStudio.AD configuration: Check if the AD configuration is correctly set up, including the trust relationship between the AD domains in the two VPCs, DNS resolution, and user permissions. Make sure that the AD users have the necessary permissions to access the NimbleStudio workstations.Workstation configuration: Verify that the NimbleStudio workstations are configured correctly and have the necessary permissions to access the AD. Make sure that the correct user credentials are entered during the workstation login.NimbleStudio configuration: Check the NimbleStudio configuration, including the user roles and permissions, and ensure that the NimbleStudio instance is set up correctly to connect to the AD.If you have checked the above and are still experiencing issues, it may be helpful to review the NimbleStudio documentation and contact AWS Support for further assistance.CommentShareAWS_Guyanswered 3 months ago"


Question: Second User not working correctly

"Hi there,I have a small business which requires 2 email address accounts@.......co.uk and info@......co.uk.I have setup my organisation on Work Mail and both accounts@ and info@ send and receive emails using the  web client https://........awsapps.com/mail.I usually use Mac OS Mail as my email client and I have updated detail for accounts@ and this works fine.  I repeated the process for info@ and there is some kind of server error.I have the server set to imap.mail.eu-west-1.awsapps.com for both accounts.Can anyone help?Best RegardsFollowComment"

Answer: "0I had a typo in my password!!!Edited by: Andrew I Stillie on Mar 14, 2019 12:48 AMCommentShareAndrew I Stillieanswered 4 years ago"


Question: job timeout inconsistency

"We have the attemptDurationSeconds set to 2 days, but the termination we got was 1 job at 2 days, 1 job at 6 days, 2 at 7 days. No other jobs were running during those 2~6 day period.I know the doc says it's on a best-effort basis and not to expect accurate timing, but this is wild. Is there any way to determine whether this is just a hiccup?  Should my effort goto writing something that sweeps and checks for job with duration longer than 2 days?FollowComment"


Question: Opensearch search

We have 7 rows of data in DynamoDB and we assigned lambda trigger.......the most of tables are working fine but recently made few tables are not working properly.Even if I added new data it has only one single document showing.........CloudWatch indicates no errors............I have no idea......Any one has clue where to look into?FollowComment


Question: AWS Control Tower failed to set up your landing zone completely

"I received an error "AWS Control Tower failed to set up your landing zone completely: AWS Control Tower is unable to assume the AWSControlTowerExecution role in the account. Add the role to your account if it's not present, and try again." after "Retry" of setting Landing zone.Control tower decommission was also done previouslyFollowComment"

Answer: "2When you deprivation your landing zone in Control Tower the AWSControlTowerExecution role is removed. However, the organization and the accounts remain. Therefore, in order to set up a new landing zone with Control Tower you must follow these steps.Preparatory steps to bring an account into the same organization as AWS Control TowerDrop the account from its existing organization. You must provide a separate payment method if you use this approachInvite the account to join the AWS Control Tower organization. For more information, see Inviting an AWS account to join your organization in the AWS Organizations User Guide.Accept the invitation. The account shows up in the root of the organization. This step moves the account into the same organization as AWS Control Tower. and establishes SCPs and consolidated billing.ORSteps to fulfill the remaining prerequisites:Create the necessary AWSControlTowerExecution role.Clear out the default VPC. (This part is optional. AWS Control Tower doesn't change your existing default VPC.)Delete or modify any existing AWS Config configuration recorder or delivery channel through the AWS CLI or AWS CloudShell. For more information, see Example AWS Config CLI commands for resource status and Enroll accounts that have existing AWS Config resourcesThe following YAML template may assist you in creating the required role in an account, so that it can be enrolled programmatically.AWSTemplateFormatVersion: 2010-09-09Description: Configure the AWSControlTowerExecution role to enable use of your  account as a target account in AWS CloudFormation StackSets.Parameters:  AdministratorAccountId:    Type: String    Description: AWS Account Id of the administrator account (the account in which      StackSets will be created).    MaxLength: 12    MinLength: 12Resources:  ExecutionRole:    Type: AWS::IAM::Role    Properties:      RoleName: AWSControlTowerExecution      AssumeRolePolicyDocument:        Version: 2012-10-17        Statement:          - Effect: Allow            Principal:              AWS:                - AdministratorAccountId            Action:              - sts:AssumeRole      Path: /      ManagedPolicyArns:        - arn:${AWS::Partition}:iam::aws:policy/AdministratorAccesshttps://docs.aws.amazon.com/controltower/latest/userguide/enroll-account.html CommentShareabemusaanswered 2 months ago0Hi TherePlease double check you have addressed all of the items in Setup after decommissioning a landing zone before retrying.Are you bringing your own log archive and Audit accounts or is Control Tower creating new ones?CommentShareEXPERTMatt-Banswered 2 months agorePost-User-1950377 2 months agoI bring ones created by Control Tower in previous set up.I tried to close these account the and create new ones but I received "ConstraintViolationException You have exceeded close account quota for the past 30 days. " errorShare"


Question: invalid input syntax for type interval: "1 microsecond"

"This works:to_date('2020-11-02','YYYY-MM-DD') + interval '1 days' => 2020-11-03 00:00:00.000000And this works:DATEADD( 'microsecond', 1, to_date('2020-11-02','YYYY-MM-DD') ) => 2020-11-02 00:00:00.000001But this doesn't:to_date('2020-11-02','YYYY-MM-DD') - interval '1 microsecond'=> \Amazon Invalid operation: invalid input syntax for type interval: "1 microsecond"; \[SQL State=22007, DB Errorcode=500310]Seems a bit inconsistent? Is this expected behaviour?Edited by: BiasedEU on Nov 3, 2020 2:53 AMFollowComment"

Answer: 0Microsecond is not currently supported for INTERVAL operations. DATEADD is the work around as you've noted.We've made a note of this and will consider adding to our roadmap. When new features are released they are noted in our regular maintenance announcements at the top of the forum.CommentShareAWS-User-2965899answered 3 years ago


Question: DNS MX records not working

My domain is through google workspace and I am trying to activate gmail. My name servers use AWS and that's why I have to use AWS console to propagate MX records for gmail. My records are correct according to google workspace technician so there is something wrong from AWS route 53. somebody please help me.FollowCommentAWS-User-0357409 2 months agoCloud you please post the domain you are working with?ShareAS 2 months agoearthspta.comShareAWS-User-0357409 2 months agoSo far it looks as though MX records for that domain are not resolvable.  Could you share the records that you have created in AWS?  You can redact any information that may be sensitive.ShareAS 2 months agoits not letting me post hereSharerePost-User-2159644 2 months agoWere you able to resolve this? I am having the exact same issue. Bumping this.ShareShow 1 more comment

Answer: "0Accepted AnswerHi there, i had the same issue and was able to resolve it by removing the @ in the hostname from the MX record in route53, then try re-activation from google. Hopefully that helps.CommentSharejideolaanswered 23 days agoAS 21 days agoThank you for your reply, I cannot find any "@" sign anywhere in my MX record.Sharejideola 20 days agoAfter creating the mx record, click on editMake sure the record name is left blank, don't add an @ sign there.In the value field, add both values you get from google together at once.1 SMTP.GOOGLE.COM15 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.MX-VERIFICATION.GOOGLE.COMTTL = 86400Routing Policy = Simple RoutingSave.Head over to google verification to re-try verification.Also you can verify if your mx record values have fully propagated correctly by testing it at https://mxtoolbox.com/Share0Using dig, I was not able to find your MX record(s). Can you run this command and share the results?aws route53 list-resource-record-sets \    --hosted-zone-id \        $(aws route53 list-hosted-zones --query HostedZones[?Name==\`earthspta.com.\`].Id --output text) \    --query ResourceRecordSets[?Type==\`MX\`]Can you run this command in CloudShell and share the results?aws route53 list-resource-record-sets \  --hosted-zone-id \    $(aws route53 list-hosted-zones --query HostedZones[?Name==\`earthspta.com.\`].Id --output text) \  --query ResourceRecordSets[?Type==\`NS\`]CommentShareEXPERTkentradanswered 2 months agoAS 2 months agowhere do I have to run this command?ShareAS 2 months agowhen I run a test record in hosted zone it gives NOERROR message.ShareAS 2 months agofor both MX and NS records, there is a NOERROR message but still in gmail it says missing records all five of the MX records.its not letting me post the MX commands hereShareAS 2 months agodig aws route53 list-resource-record-sets \--hosted-zone-id \    $(aws route53 list-hosted-zones --query HostedZones[?Name==\`earthspta.com.\`].Id --output text) \--query ResourceRecordSets[?Type==\`MX\`]-bash: aws: command not foundInvalid option: --hosted-zone-idUsage:  dig [@global-server] [domain] [q-type] [q-class] {q-opt}{global-d-opt} host [@local-server] {local-d-opt}[ host [@local-server] {local-d-opt} [...]]Sharekentrad EXPERT2 months agoYou run the command I provided in CloudShell.ShareShow 4 more comments"


Question: Recommended batch automated workflow for updating docker containers

"How do I update the docker image for a Batch Job Definition using CLI or API?It looks like the APIs for RegisterJobDefinition are "create only".  You can't update a Job Definition from what I can tell from the documentation, so you can't change the reference to the Docker Image.The JobDefinition really wants to be defined in the CDK Constructs area (or CFT) because it ties in a bunch of stuff I already have in the CDK such as databases and EFS and Secrets.   That is fine, as that all that stuff is fairly static.But Docker images are meant to change all the time, and quickly as my devs iterate code.  I really don't want to specify the final Docker Image at creation time in CDK or CFT, but it looks like that's the only place to do it.  I do not want to re-deploy a CDK/CFT instance just to change some code in a Docker container, that would be a slow and bad practice.Note:  a similar was asked on the old forum, but didn't really get an answer.  "use :latest" isn't always the best answer for Docker version management.  My devs need to be able to iterate quickly and not walk over each other.I would like my devs to be able to change to a new Docker image and then test a batch.   How can they do this quickly and easily?Note:  Here's a blog post on stable tagging versus unique tagging.   For deployments they recommend unique.  Which isn't supported with BATCH, AFAICT.FollowComment"

Answer: "0Job definitions (much like ECS task definitions) are versioned. This means there isn't one task/job def where you can apply standard CRUD operations but rather you are creating a new revision. When you use the job def it will use the "latest" rev by default OR you can specify a previous revision. Correct me if I am wrong but the workflow you'd use isn't tremendously different between an "update" or a "register/create" (considering that the way you will launch it won't change because it will by default always run your last rev)?CommentShareEXPERTmreferreanswered a year agoPaulSPNW a year agoThe Batch API does not provide a function to create a new revision.I think what you are saying is one must read the JobDefinition, modify only the docker image name, and then write the result using the registerJobDefinition() function.   This also means one should ignore drift on the CFT stack that created the JobDefinition in the first. place.  Do I have that right?Sharemreferre EXPERTa year agoYes Batch does not provide a way to update a job def (IIRC ECS does not provide one either for tasks def and what you see on the ECS console when you create a new task rev is just a UI facility that imports the old one and then register the new one under the same task def name with the rev at +1).Sharemreferre EXPERTa year agoI can think of a couple of ways to do this (assuming you deployed with CFN): 1) read the job def, change the image name (or likely the tag?), ignore the drift. Or 2) update the CFN stack with the new image name/tag (this will save you from reading the job def and seeing the drift but will force you to do updates via CFN).Let's see if someone can chime in with better ideas.SharePaulSPNW a year ago(1) is ok, except some will not like 'ignore the drift'.   It also could lead to inadvertent errors or races with someone updating the CFT/CDK.  (2) as I mentioned in  my comments is unacceptable due to very slow iteration time (and developer separation of concerns for that matter).Consider a feature request to allow the image (or at least tag) to be overridden in the Job, just like environment variables.  That would make the image late binding, which is what it should tends to be, unlike say the VPC or IAM permissions.Share"


Question: "Windows updates, disable automatic scheduling"

"Good day,I’m running a game server on Windows server 2019 version of lightsail.Today the instance did it’s auto update without any warning right after I closed rdp.Fortunately we’re in a beta stage so no huge loss, but I want to prevent it from doing this as it does cause loss of data to the users of the game without proper server shutdowns.FollowComment"

Answer: "0Accepted AnswerHi YulRun,From my understanding you would like to turn off/disable automatic updates on your Windows 2019 server. The Local Group Policy Editor allows you to disable automatic updates.To disable automatic updates on Windows permanently, you can use these steps:•Right-click Start and click Run.•Type gpedit.msc, and click OK.•Expand Local Computer Policy.•Expand Computer Configuration.•Expand Administrative Templates.•Expand Windows Components.•Double click Windows Update•Double-click the Configure Automatic Updates policy on the right side•Check the Disabled option to turn off automatic updates permanently -> If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start.•Click the Apply button.•Click the OK button.After you complete the steps, the system will stop downloading updates automatically. However, the ability to check for updates manually will still continue to be available on Settings > Update & Security > Windows Update, and clicking the Check for updates button to download the most recent patches.If (in the future) you want to enable automatic updates again, you can use the exact instructions outlined above, but on step/bullet No. 9, make sure to select the Not Configured option.For more ways to disable automatic updates on Windows you can check: https://www.windowscentral.com/how-stop-updates-installing-automatically-windows-10 (remember this is not an official AWS link which means you use it at your own risk)I hope this helps!CommentShareamz99answered 2 years ago"


Question: ElastiCache for Redis single node from Reader endpoint

"During my initial tests I found a potential issue with scaling out ElastiCache Reader endpoint for reads.In my setup I used a set of 1 primary with 3 replicas in 2 availability zones (that’s cluster disabled mode).Our code uses the primary endpoint for writes and reader endpoint for reads.With that in mind I expected the reader endpoint to distribute reads acrossall 3 reader nodes in round-robin fashion. The documentation confirms it:Finding a Redis (Cluster Mode Disabled) Cluster's Endpoints (Console)
...A reader endpoint will evenly split incoming connections to the endpoint between all read replicas in a ElastiCache for Redis cluster....A reader endpoint is not a load balancer. It is a DNS record that will resolve to an IP address of one of the replica nodes in a round robin fashion.Using a jump box host I noticed this is not the case (always getting the same DNS reply):
ubuntu@ip-10-5-33-208:~$ host react-region-redis-rep-group-dev-ro.dbvymf.ng.0001.use1.cache.amazonaws.com ns-699.awsdns-23.netUsing domain server:Name: ns-699.awsdns-23.netAddress: 205.251.194.187#53Aliases:react-region-redis-rep-group-dev-ro.dbvymf.ng.0001.use1.cache.amazonaws.com is an alias for react-region-redis-rep-group-dev-002.dbvymf.0001.use1.cache.amazonaws.com.react-region-redis-rep-group-dev-002.dbvymf.0001.use1.cache.amazonaws.com has address 10.5.27.242I was expecting either :
multiple “has address” ip addresses (3 to be exact) returned in random order for each queryone “has address” ip, which is different for every DNS request.What I see instead is the same IP address for every DNS queries, which is not inline with the documentationand it does not allow distributing reads using the reader endpoint. My tests are also confirmed by the metricsfor ElastiCache service, where, despite using the Reader endpoints my application running in AWS ECSis only sending “Get Type commands” (like get, mget, hget etc..) to one of the replica:Note all the reads are sent to the same replica node (react-region-redis-rep-group-dev-002) as returned by the dns query.
Thanks in advance for any pointers,PiotrFollowComment"


Question: Anomaly Detection in Quicksight

"Hi All, Can anyone explain how the "expected value" is set in the Anomaly Detection ML functionality in Quicksight.?FollowComment"

Answer: "1In QuickSight, ML-powered anomaly detection identifies the causations and correlations to enable you to make data-driven decisions. You still have control over defining how you want the job to work on your data. You can specify your own parameters, and choose additional options, such as identifying key drivers in a contribution analysis. Or you can use the default settings.You can also refer to Adding an ML insight to detect outliers and key drivers - https://docs.aws.amazon.com/quicksight/latest/user/anomaly-detection-adding-anomaly-insights.htmlCommentShareEXPERTAWS-User-Nitinanswered 7 months ago"


Question: CDK alpha modules

"How dependable are CDK alpha modules?  Specifically, if something works how likely is it to keep working? Yes, API changes may happen since they are "experimental". (Noted, as Jean-Luc Picard would say)Currently, I care about aws-apigatewayv2-integrations-alpha. but this applies to all of them.Read:https://aws.amazon.com/blogs/developer/experimental-construct-libraries-are-now-available-in-aws-cdk-v2/ 08 NOV 2021https://github.com/aws/aws-cdk READMEhttps://docs.aws.amazon.com/cdk/api/v2/docs/aws-apigatewayv2-integrations-alpha-readme.html which is the one I care about currentlyhttps://github.com/aws/aws-cdk/projects/12 which is closedTop level AWS CDK docs: https://docs.aws.amazon.com/cdk/api/v2/FollowComment"

Answer: 0Accepted AnswerCDK builds on top of Cloudformation. Items that are not in the Cloudformation spec use Cloudformation Custom Resources to call AWS API's.So once deployed it will be stable based on the particular Service API's that it uses and for any Cloudformation Custom Resources the lambda runtime environment that it runs in. (Ie if a particular service changes a API it could break and if the particular runtime environment that the custom resource is using goes out of support. Such as a particular node version no longer supported.)As far as CDK still being able to synth/deploy the same Cloudformation template. It is stable for the particular version but any upgrade to a later version of CDK or the bootstrapping have no guarantees. You can go to the AWS-CDK Github Releases to pull a older version of code it implement your own that you maintain and build an adapter if you want to upgrade the CDK version but still provide backwards compatibility.CommentShareMichael_Kanswered a year ago


Question: Do you have any control for the Agent Statuses without Control Contact Panel Api?

"https://github.com/amazon-connect/amazon-connect-streams this is my temporarily solutionproblem is, it's a hassle in the UI side.so is there a way for me, to change all the agent statuses without accessing the CCP panel?FollowComment"

Answer: "1Accepted AnswerThis is now possible via the PutUserStatus API call. Added within the last month.https://docs.aws.amazon.com/connect/latest/APIReference/API_PutUserStatus.htmlCommentShareledgeanswered a year ago1It is not clear what you are trying to achieve can you explain further?CommentSharem66rusanswered 2 years ago1There is no API from the server-side to do this, so you would need to have a listener on the client to capture the events.You could debug https://instanceid.awsapps.com/connect/real-time-metrics?tableType=skill to see how the supervisor changes the agent's state from this portal which impacts the specific agent.CommentSharem66rusanswered 2 years ago0What I'm trying to do, is to change the Agent State in the AWS Lambdaso I wouldn't need to Access the CCP then Change state therebecause at the moment,it can only change 1 agent status/state of the current online agent,using the CCP which is activated in the Frontend Website,so in order for me to change the states of many agents,I need to create a websocket on the website, then emit the changes on each statuseshoping that the agent that I want to change the status is Online and is using the website.which is I'm trying to prevent.What  I want to do, is to change the agent status/state in the AWS Lambda,what is happening in the SDK is that, I could only get the List of the Current Agents and all their info,but I couldn't Manipulate let's say, Change the Agent's routes or  status/states.So what I'm asking is,is there a way to change the status of the agent usingthe SDK provided by AWS which out activated the Contact Control Panel, which is a IFrame for the WebsiteCommentShareNinjaCoderanswered 2 years ago0that's just, sad, oh well, i'll just stick to the old code then.they should have done that, so it's easier to manage agent status in backend to avoid overloading the website.oh well can't complain.thank you for the helpCommentShareNinjaCoderanswered 2 years ago"


Question: Best practice of secrets rotation on multi region database

"Customer uses aurora global table on multi region and their configuration is Active-Active.  They use Aurora global table.Customer wants to rotate their secrets for Aurora and wants to know best practices how to implement that.Their application also sit in two regions, the app connects the database instance which is in same region when both region are alive.There is a blog post which explains how to setup secrets manager for Active-Standby configuration. But my customer wants to implement ACTIVE-ACTIVE configuration.Is there any best practices and tips for using Secrets Manager with ACTIVE-ACTIVE database configuration?FollowComment"

Answer: "0Accepted AnswerQuick clarification...  When you say "Active-Active", Aurora doesn't support active writer nodes in multiple regions at the same time with its' "Global Database" feature.  There can be only one writer node in the primary region although secondary regions can all have many active reader nodes.With respect to secrets, Secrets Manager now support multi-region secrets natively.  See the docs here.  Like Aurora, there is a primary region for the secrets which are then replicated to the secondary regions.  This is now the preferred approach and architecturally similar to Aurora's.CommentSharePThawleyanswered 2 years ago"


Question: Unable to configure SageMaker execution Role with access to S3 bucket in another AWS account

"Requirement: Create SakeMaker GroundTruth labeling job with input/output location pointing to S3 bucket in another AWS accountHigh Level Steps Followed:  Lets say, Account_A: SageMaker GroundTruth labeling job and Account_B: S3 bucketCreate role AmazonSageMaker-ExecutionRole in Account_A with 3 policies attached:AmazonSageMakerFullAccessAccount_B_S3_AccessPolicy: Policy with necessary S3 permissions to access S3 bucket in Account_BAssumeRolePolicy: Assume role policy for arn:aws:iam::Account_B:role/Cross-Account-S3-Access-RoleCreate role Cross-Account-S3-Access-Role  in Account_B with 1 policy and 1 trust relationship attached:S3_AccessPolicy: Policy with necessary S3 permissions to access S3 bucket in the this Account_BTrustRelationship: For principal arn:aws:iam::Account_A:role/AmazonSageMaker-ExecutionRoleError: While trying to create SakeMaker GroundTruth labeling job with IAM role as AmazonSageMaker-ExecutionRole, it throws error AccessDenied: Access Denied - The S3 bucket 'Account_B_S3_bucket_name' you entered in Input dataset location cannot be reached. Either the bucket does not exist, or you do not have permission to access it. If the bucket does not exist, update Input dataset location with a new S3 URI. If the bucket exists, give the IAM entity you are using to create this labeling job permission to read and write to this S3 bucket, and try your request again.FollowComment"

Answer: "0Hi Kalmesh,The labeling job will not assume other roles, so granting access via AssumeRolePolicy and TrustRelationship will not work in this case. The permissions need to be granted directly to AmazonSageMaker-ExecutionRole.The easiest way to accomplish this is:Attach a policy to AmazonSageMaker-ExecutionRole granting appropriate permissions to the bucket in Account B. (It sounds like you have already done this via Account_B_S3_AccessPolicy)Define a corresponding bucket policy on the S3 Bucket in Account B to allow access for the principal arn:aws:iam::Account_A:role/AmazonSageMaker-ExecutionRoleThere is also a more detailed explanation of the setup required in this knowledge center article: How can I grant a user in another AWS account the access to upload objects to my Amazon S3 bucket?CommentShareJamesBanswered a year agokalmesh a year agoHi James,Thanks for the reply. Before trying out the Assume Role approach, I had tried the same step of attaching the below policy to S3 bucket directly which provides access to SageMaker-Execution role. But even that threw the same error message.{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "s3:GetObject",                "s3:PutObject",                "s3:DeleteObject",                "s3:AbortMultipartUpload",                "s3:ListBucket",                "s3:GetBucketAcl",                "s3:PutBucketAcl"            ],            "Resource": [                "arn:aws:s3:::account_b_s3_bucket",                "arn:aws:s3:::account_b_s3_bucket/*"            ],            "Principal": {                "AWS": "arn:aws:iam::Account_A:role/AmazonSageMaker-ExecutionRole"            }        }    ]}ShareJamesB a year agoThat looks right - double check the permissions against the list in the documentation and make sure there is nothing missing from the IAM policy or the bucket policy. Also depending on the encryption settings on the S3 Bucket you might need to add KMS permissions as well.Share0Reverted back to original approach where access to the SageMaker execution role was provided through direct S3 bucket policy.While creating the GT job from console:Expects the user creating the job also to have access to the data in cross account S3 bucket; Updated bucket policy to have access for both SageMaker execution role as well as userExpects the manifest in own account's S3 bucket; Fails with 403 if manifest is in cross account S3 bucket even though SageMaker execution role had access to the cross account S3 bucketWhile creating the GT job from CLI: Above restrictions doesn't apply and was able to create the GT job.CommentSharekalmeshanswered a year ago"


Question: Configure EC2 Instance Connect via CDK

"I have a CDK deployment that includes an Elastic Beanstalk environment. I'd like to move the EC2 instances in the Beanstalk ASG to a private subnet while allowing SSH via EC2 Instance Connect. I know this is possible based on this AWS blog entry and this LinkedIn article, but I'm struggling to get things configured correctly.My VPC definition looks like:        vpc = aws_ec2.Vpc(            self,            "Vpc",            vpc_name="vpc_name",            max_azs=4,            subnet_configuration=[                aws_ec2.SubnetConfiguration(                    name="Public",                    subnet_type=aws_ec2.SubnetType.PUBLIC,                ),                aws_ec2.SubnetConfiguration(                    name="Egress",                    subnet_type=aws_ec2.SubnetType.PRIVATE_WITH_EGRESS,                ),                aws_ec2.SubnetConfiguration(                    name="Isolated",                    subnet_type=aws_ec2.SubnetType.PRIVATE_ISOLATED,                ),            ],        )I then have a security group that looks like:        self.eb_security_group = aws_ec2.SecurityGroup(            scope,            "SecurityGroup",            vpc=self.vpc,        )        self.eb_security_group.add_ingress_rule(peer=aws_ec2.Peer.ipv4("0.0.0.0/0"), connection=aws_ec2.Port.tcp(22))This security group is associated with the EC2 instances in the Auto Scaling Group. When I configured the Elastic Beanstalk environment, I include:                    "aws:autoscaling:launchconfiguration": {                        "InstanceType": "t3.medium",                        "IamInstanceProfile": instance_profile.ref,                        "SecurityGroups": vpc_resources.eb_security_group.security_group_id,                    },                    "aws:ec2:vpc": {                        "VPCId": vpc_resources.vpc.vpc_id,                        "Subnets": ",".join([subnet.subnet_id for subnet in vpc_resources.vpc.private_subnets]),                        "ELBSubnets": ",".join([subnet.subnet_id for subnet in vpc_resources.vpc.public_subnets]),                    },That all works, but if I try to connect to the instance using the EC2 Instance Connect CLI, there's no response and the connection times out. I think I need to modify the security group configuration to allow traffic to the EC2 Instance Connect service, but I don't know how to do that.I do something that might be similar with the ALB security group, which only allows traffic from CloudFront:        self.load_balancer_security_group = aws_ec2.SecurityGroup(            scope,            "AlbBalancerSecurityGroup",            vpc=self.vpc,        )        self.load_balancer_security_group.add_ingress_rule(            peer=aws_ec2.Peer.prefix_list(cloudfront_prefix_list.get_response_field("PrefixLists.0.PrefixListId")),            connection=aws_ec2.Port.tcp(443),            description="Limit ALB access to CloudFront prefix list",        )Is there a similar ingress rule I need to add for EC2 Instance Connect, maybe?FollowComment"

Answer: "1Accepted AnswerActually I found that Session Manager is probably a better solution for me. All I needed to do to get that working was add the AmazonSSMManagedInstanceCore manged policy to my instance profile, and it works on the private subnet with no additional configuration.CommentShareAWS-User-5344994answered 2 months ago"


Question: How to Visualize a custom metrics for a ProcessingStep on Sagemaker Pipeline UI

"When selecting a step from a running Sagemaker pipeline, the right-side panel has an "Output" tab.  We know that if the step is created from an Estimator, we can display all metrics from specifying metric_definitions parameter.  However there is no equivalent parameter for Processor or other types of steps.  How can we display metrics for a Sagemaker ProcessingStep then?FollowComment"

Answer: "0Hi there,Thanks for reaching out and for the question.Unlike the Estimator subclass which takes 'metric_definitions ' as a parameter, the ProcessingStep does not take on this parameter. An alternative  is to make use of the the property_files parameter within the ProcessongStep (see link [1.]) to store information from the output of a processing step which can later be processed using the 'JsonGet' (see link [2.]). At best this will allow you to persist the metrics you'd like to capture and you can fetch the json file from the s3 output location, however this will not be published to the UI like your training jobs. Link [3.] provides an example of how this propertyfile can be defined and passed in the ProcessingStep.[1.]  https://sagemaker.readthedocs.io/en/stable/workflows/pipelines/sagemaker.workflow.pipelines.html#sagemaker.workflow.steps.ProcessingStep[2.]  https://docs.aws.amazon.com/sagemaker/latest/dg/build-and-manage-propertyfile.html[3.]  https://github.com/aws/amazon-sagemaker-examples/blob/main/sagemaker-pipelines/tabular/customizing_build_train_deploy_project/modelbuild/pipelines/customer_churn/pipeline.py#L183CommentShareAWS-User-930116answered 4 months ago"


Question: INTERNAL_ERROR_QUERY_ENGINE after upgrade Athen engine to version 3

"I received INTERNAL_ERROR_QUERY_ENGINE error with existing query after upgrade athena engine to version 3.The same query works fine with version 2.The data size scan is 40.37 MB for the query below, and I have 5 TB limit per query.SELECT DISTINCT sourceFROM production_data.eventsThe weird part is thatIf I add LIMIT in the query, it works without any error.If I use same select with different table then also works (why only this table?)I couldn't find any log that explain the reasons why that is the case. Is it possible to get detail log?Any thought? ThanksFollowComment"

Answer: "0Hello,I understand that query running on Athena engine V3 errors out however with V2 it is successful.Also similar query works on a different table or same table with limited data.In order to further troubleshoot the issue, please create a support ticket here with query IDs run on Athena Engine V2 and V3.CommentShareSachin_Kanswered 3 months ago"


Question: SSH broken as of 1st March

"We have an automated codepipeline that builds packer images based on amazon linux AMI updates. This pipeline has worked flawlessly for several years. Yesterday however it broke with :==> amazon-ebs: Waiting for instance (xxxxxxx) to become ready...==> amazon-ebs: Using ssh communicator to connect: xx.xx.xx.xx==> amazon-ebs: Waiting for SSH to become available...==> amazon-ebs: Error waiting for SSH: ssh: handshake failed: ssh: unable to authenticate, attempted methods [publickey none], no supported methods remainWe have changed nothing , something in the base AWS Li2 image has broken this we think.FollowCommentAWS-User-1253586 a year agoInterestingly if I run the image created on a T2 micro instead of a T3 micro , I can ssh to it.ShareAnuragChilukuri MODERATORa year agoPlease don't post any personal information in the question. If you would like to share personal information, create a support case instead.Share"

Answer: "0Hello,Thank you for asking your question in AWS re:Post. I will recommend to create a Support Case so we can investigate further.Amazon Linux 2 Public AMIs will have necessary pre-requisites for running t3.micro or any Nitro system instances. You may also investigate the CloudTrail logs for CodePipeline or any EC2 API calls for the EC2 instance.CommentShareSUPPORT ENGINEERAWS-User-8128162answered a year ago0I raised it with support at the same time as posting on here.   They came back yesterday to say there is a problem with the latest  AMI , which breaks ssh on T3 , and for anyone interested here's the workaround:-                                            ****************************************Creating derived AMIs (by creating AMIs from EBS snapshots of EC2 instances) and not cleaning up cloud-init cached state may experience issues with cloud-init executing in AMIs derived from the amzn2-ami-hvm-2.0.20220218.0 Amazon Linux 2 AMI (released on 2022-02-28) .We recommend the following workaround currently, until the issue is fixed:Remove cloud-init's cached state using cloud-init clean.Create an empty file at /etc/systemd/system/cloud-init-local.service.d/skip.conf before creating an EBS snapshot/AMI.This file will allow AMI's derived from amzn2-ami-hvm-2.0.20220218.0 Amazon Linux 2 AMI to not run into this issue.Example commands to run before snapshotting an AMI:cloud-init cleanmkdir -p /etc/systemd/system/cloud-init-local.service.dtouch /etc/systemd/system/cloud-init-local.service.d/skip.confNo other versions of the Amazon Linux 2 AMI contains this issue hence, you may also consider rolling back to previous AMI version if the above shared workaround is not feasible to you.                                            *************************************************We sincerely apologize for any inconvenience this may have caused, and regret that it has affected your production.CommentShareAWS-User-1253586answered a year ago"


Question: Cloudformation-based update of RDS DBSnapshotIdentifier fails with "failed validation constraint for keyword [pattern]"

"We are attempting to update the snapshot identifier of a MySQL DBInstance via Cloudformation (via CDK, but that does not appear relevant to the error). The current diff is as follows:Resources[~] AWS::RDS::DBInstance AbcDatabase AbcDatabase6789 replace └─ [~] DBSnapshotIdentifier (requires replacement)     ├─ [-] arn:aws:rds:eu-central-1:12345:snapshot:downsync20220125030153     └─ [+] arn:aws:rds:eu-central-1:12345:snapshot:downsync20220126030040Unfortunately, this unexpectedly started to fail last night:a-stack | 0/8 | 3:18:53 AM | UPDATE_IN_PROGRESS   | AWS::CloudFormation::Stack | a-stack User Initiateda-stack | 0/8 | 3:19:22 AM | UPDATE_FAILED        | AWS::RDS::DBInstance       | AbcDatabase (AbcDatabase6789) Properties validation failed for resource AbcDatabase6789 with message:#: #: only 1 subschema matches out of 2#/DBSnapshotIdentifier: failed validation constraint for keyword [pattern]a-stack | 0/8 | 3:19:22 AM | UPDATE_ROLLBACK_IN_P | AWS::CloudFormation::Stack | a-stack The following resource(s) failed to update: [AbcDatabase6789]. a-stack | 1/8 | 3:19:26 AM | UPDATE_COMPLETE      | AWS::RDS::DBInstance       | AbcDatabase (AbcDatabase6789) a-stack | 2/8 | 3:19:27 AM | UPDATE_ROLLBACK_COMP | AWS::CloudFormation::Stack | a-stack a-stack | 3/8 | 3:19:28 AM | UPDATE_ROLLBACK_COMP | AWS::CloudFormation::Stack | a-stack This is an operation that we perform every night. The last successful update was at about 2022-01-25 03:16:25 +01:00, the first failing attempt at 2022-01-25 03:18:53 +01:00.Looking at the CloudTrail logs, Cloudformation does not attempt to call any RDS APIs during the failing update. (For example: We do not see a RestoreDBInstanceFromDBSnapshot event which is normally triggered during successful runs by the Cloudformation service user.) We therefore conclude, that the failure is within Cloudformation.Based on this other issue, the message looks like a JSON spec validation error, but in the relevant CloudFormationResourceSpecification.zip we could not find any validation rules in aws-rds-dbinstance.json ... especially no 'pattern' disallowing the specified snapshot ARN.Does anyone have an idea what is going wrong? Or even better: What hidden restrictions the snapshot identifier suddenly has to conform to? (We can adjust the snapshot names, if that would help.)Example of a successful update:Resources[~] AWS::RDS::DBInstance AbcDatabase AbcDatabase6789 replace └─ [~] DBSnapshotIdentifier (requires replacement)     ├─ [-] arn:aws:rds:eu-central-1:12345:snapshot:downsync20220124031945     └─ [+] arn:aws:rds:eu-central-1:12345:snapshot:downsync20220125030153resulting ina-stack | 0/8 | 3:15:55 AM | UPDATE_IN_PROGRESS   | AWS::CloudFormation::Stack | a-stack User Initiateda-stack | 0/8 | 3:16:24 AM | UPDATE_IN_PROGRESS   | AWS::RDS::DBInstance       | AbcDatabase (AbcDatabase6789) Requested update requires the creation of a new physical resource; hence creating one.a-stack | 0/8 | 3:16:25 AM | UPDATE_IN_PROGRESS   | AWS::RDS::DBInstance       | AbcDatabase (AbcDatabase6789) Resource creation Initiated0/8 Currently in progress: a-stack, AbcDatabase6789a-stack | 1/8 | 3:31:34 AM | UPDATE_COMPLETE      | AWS::RDS::DBInstance       | AbcDatabase (AbcDatabase6789) [...]a-stack | 7/8 | 3:32:44 AM | UPDATE_COMPLETE_CLEA | AWS::CloudFormation::Stack | a-stack [...]a-stack | 3/8 | 3:32:48 AM | DELETE_IN_PROGRESS   | AWS::RDS::DBInstance       | AbcDatabase (AbcDatabase6789) 3/8 Currently in progress: a-stack, AbcDatabase6789[...]a-stack | 3/8 | 3:39:56 AM | DELETE_COMPLETE      | AWS::RDS::DBInstance       | AbcDatabase (AbcDatabase6789) a-stack | 4/8 | 3:39:57 AM | UPDATE_COMPLETE      | AWS::CloudFormation::Stack | a-stack FollowCommentAWS-User-1089766 a year agoThe issue resolved itself tonight, so it appears to have been a transient issue somewhere within CloudFormation.ShareAWS-User-1089766 a year agoThe problem has returned today. The error message is unchanged:#: #: only 1 subschema matches out of 2#/DBSnapshotIdentifier: failed validation constraint for keyword [pattern]ShareAWS-User-1089766 a year ago... aaand it works again. Obviously flaky. Very annoying! :-(Share"


Question: FailedMount on emr eks virtual cluster while executing a job.

FailedMount on emr eks virtual cluster while executing a job.I am facing issue while submitting a sample job (pi.py). Its giving following warning. Could you please suggest the reason for this.WarningFailedMount7 minuteskubeletMountVolume.SetUp failed for volume "config-volume" : object "my-eks-namespace"/"fluentd-qcpzy7oglu651b70thts0u0tf-00000003035s3k842vo" not registeredWarningFailedMount7 minuteskubeletMountVolume.SetUp failed for volume "podtemplate-00000003035s3k842vo" : object "my-eks-namespace"/"podtemplate-00000003035s3k842vo" not registeredWarningFailedMount7 minuteskubeletMountVolume.SetUp failed for volume "00000003035s3k842vo-spark-defaults" : object "my-eks-namespace"/"00000003035s3k842vo-spark-defaults" not registeredWarningFailedMount7 minuteskubeletMountVolume.SetUp failed for volume "kube-api-access-dbwg6" : object "my-eks-namespace"/"kube-root-ca.crt" not registeredI have followed below DevelopmentGuide for setting up cluster.https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/setting-up-eks-cluster.htmlhttps://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/virtual-cluster.htmlThanksFollowComment


Question: AWS Client Unable To Uninstall or Or Connect

"AWS Client VPN use to work until today. It stop working with the following -AWS VPN Client Helper Tool is required to establish the connection.- I've tried reinstalling the Client found here and it still didnt resolve the issue. I tried to uninstall and i get the same error.I've check resource here https://docs.aws.amazon.com/vpn/latest/clientvpn-user/macos-troubleshooting.html and it didnt help either as i kept getting the same error. I currently use saml(sso) openvpn or tunnelblick didnt work.Other people in my office are able to connect to the vpn successfuly FYI.I've restart the mac(M1) multiple times, Reinstall The Monterray OS(didn't removed all applications** don't know why).I've tried checking the logs and found the following.AWS Client VPN use to work until today. It stop working with the following -AWS VPN Client Helper Tool is required to establish the connection.- I've tried reinstalling the Client found here and it still didnt resolve the issue. I tried to uninstall and i get the same error.I've restart the mac(M1) multiple times, Reinstall The Monterray OS(didn't removed all applications** don't know why).I've tried checking the logs and found the following. tail -f /Users/saviourgidi/.config/AWSVPNClient/logs/aws_vpn_client_20221018.log2022-10-18 15:36:27.254 +02:00 [DBG] Helper app --init output: Helper failed to install.2022-10-18 15:36:27.254 +02:00 [DBG] Helper failed to install or was canceled.2022-10-18 15:36:27.254 +02:00 [DBG] Stopping DNS monitoring thread2022-10-18 15:36:27.254 +02:00 [DBG] Releasing DNS monitoring lock2022-10-18 15:36:27.255 +02:00 [DBG] Metric agent started2022-10-18 15:36:27.255 +02:00 [DBG] Received exception for connection state Disconnected. Show error message to user2022-10-18 15:36:27.255 +02:00 [ERR] Exception recieved by connection view controllerACVC.Core.OpenVpn.HelperToolInstallationFailedException: AWS VPN Client Helper Tool is required to establish the connection.  at ACVC.Core.OpenVpn.OvpnOsxProcessManager.Start (System.String openVpnConfigPath, System.String managementPortPasswordFile, System.Int32 timeoutMilliseconds) [0x001f6] in <122123b2b3914e32b2c06bd2a2d00f27>:0  at ACVC.Core.OpenVpn.OvpnConnectionManager.Connect (ACVC.Core.Metadata.OvpnConnectionProfile configProfile, ACVC.Core.GetCredentialsCallback getCredentialsCallback, System.Int32 timeout) [0x0020f] in <122123b2b3914e32b2c06bd2a2d00f27>:02022-10-18 15:40:00.882 +02:00 [DBG] Clean up connections. Connection state: Connecting2022-10-18 15:40:00.884 +02:00 [INF] Validating schema for OpenVPN config: /Users/saviourgidi/.config/AWSVPNClient/OpenVpnConfigs/test-eu2022-10-18 15:40:01.889 +02:00 [DBG] Caught exception when getting connection status. Exception information: System.TimeoutException: The message did not respond within the expected timeframe or was cancelled  at ACVC.Core.OpenVpn.OvpnConnectionManager.SendMessage (System.String message, System.Int32 timeout, System.Threading.CancellationToken cancellationToken) [0x001ca] in <122123b2b3914e32b2c06bd2a2d00f27>:0  at ACVC.Core.OpenVpn.OvpnConnectionManager.GetConnectionStatus () [0x0007c] in <122123b2b3914e32b2c06bd2a2d00f27>:0  at ACVC.Core.Metrics.MetricsClient.RecordBytesMetricsAndAnalytics (ACVC.Core.IConnectionManager connectionManager) [0x00077] in <122123b2b3914e32b2c06bd2a2d00f27>:02022-10-18 15:40:01.890 +02:00 [DBG] Stopping DNS monitoring thread2022-10-18 15:40:01.890 +02:00 [DBG] Releasing DNS monitoring lock2022-10-18 15:40:01.892 +02:00 [INF] Terminating connection2022-10-18 15:40:01.892 +02:00 [WRN] Acs did not stop correctly!2022-10-18 15:40:01.892 +02:00 [DBG] 🏞 Ending connection details reporting.2022-10-18 15:40:01.892 +02:00 [WRN] We are calling GracefulKill in a method that is not supposed to change Connection state.2022-10-18 15:40:01.892 +02:00 [DBG] GracefulKill2022-10-18 15:40:01.893 +02:00 [DBG] Cancelling socket listen token2022-10-18 15:40:01.893 +02:00 [DBG] Dispose socket2022-10-18 15:40:01.893 +02:00 [DBG] Signal process kill with helper tool.2022-10-18 15:40:01.893 +02:00 [DBG] Starting process2022-10-18 15:40:01.926 +02:00 [DBG] Start to read process output2022-10-18 15:40:01.962 +02:00 [DBG] End reading process output2022-10-18 15:40:02.028 +02:00 [DBG] Helper app --kill output: Kill success.2022-10-18 15:40:02.028 +02:00 [DBG] Release process manager start lock2022-10-18 15:40:02.028 +02:00 [DBG] Release process manager stop lock2022-10-18 15:40:02.028 +02:00 [DBG] Disconnected2022-10-18 15:40:02.028 +02:00 [DBG] Stopping DNS monitoring thread2022-10-18 15:40:02.028 +02:00 [DBG] Releasing DNS monitoring lock2022-10-18 15:40:06.195 +02:00 [INF] Saving profile store to /Users/saviourgidi/.config/AWSVPNClient/ConnectionProfiles2022-10-18 15:40:06.197 +02:00 [INF] Connecting /Users/saviourgidi/.config/AWSVPNClient/OpenVpnConfigs/test-eu2022-10-18 15:40:06.198 +02:00 [DBG] validationString: /Users/saviourgidi/.config/AWSVPNClient/OpenVpnConfigs/test-eu16661004162022-10-18 15:40:06.198 +02:00 [DBG] Shutting down metrics agent2022-10-18 15:40:06.198 +02:00 [DBG] Metrics agent shut down2022-10-18 15:40:06.354 +02:00 [INF] Starting OpenVpn process2022-10-18 15:40:06.354 +02:00 [DBG] Starting process2022-10-18 15:40:06.375 +02:00 [DBG] Start to read process output2022-10-18 15:40:10.553 +02:00 [DBG] End reading process output2022-10-18 15:40:10.617 +02:00 [DBG] Helper app --init output: Helper failed to install.2022-10-18 15:40:10.617 +02:00 [DBG] Helper failed to install or was canceled.2022-10-18 15:40:10.617 +02:00 [DBG] Stopping DNS monitoring thread2022-10-18 15:40:10.617 +02:00 [DBG] Releasing DNS monitoring lock2022-10-18 15:40:10.618 +02:00 [DBG] Metric agent started2022-10-18 15:40:10.618 +02:00 [DBG] Received exception for connection state Disconnected. Show error message to user2022-10-18 15:40:10.618 +02:00 [ERR] Exception recieved by connection view controllerACVC.Core.OpenVpn.HelperToolInstallationFailedException: AWS VPN Client Helper Tool is required to establish the connection.  at ACVC.Core.OpenVpn.OvpnOsxProcessManager.Start (System.String openVpnConfigPath, System.String managementPortPasswordFile, System.Int32 timeoutMilliseconds) [0x001f6] in <122123b2b3914e32b2c06bd2a2d00f27>:0  at ACVC.Core.OpenVpn.OvpnConnectionManager.Connect (ACVC.Core.Metadata.OvpnConnectionProfile configProfile, ACVC.Core.GetCredentialsCallback getCredentialsCallback, System.Int32 timeout) [0x0020f] in <122123b2b3914e32b2c06bd2a2d00f27>:02022-10-18 15:40:11.802 +02:00 [DBG] Clean up connections. Connection state: Connecting2022-10-18 15:40:11.803 +02:00 [INF] Validating schema for OpenVPN config: /Users/saviourgidi/.config/AWSVPNClient/OpenVpnConfigs/test-eu2022-10-18 15:40:12.806 +02:00 [DBG] Caught exception when getting connection status. Exception information: System.TimeoutException: The message did not respond within the expected timeframe or was cancelled  at ACVC.Core.OpenVpn.OvpnConnectionManager.SendMessage (System.String message, System.Int32 timeout, System.Threading.CancellationToken cancellationToken) [0x001ca] in <122123b2b3914e32b2c06bd2a2d00f27>:0  at ACVC.Core.OpenVpn.OvpnConnectionManager.GetConnectionStatus () [0x0007c] in <122123b2b3914e32b2c06bd2a2d00f27>:0  at ACVC.Core.Metrics.MetricsClient.RecordBytesMetricsAndAnalytics (ACVC.Core.IConnectionManager connectionManager) [0x00077] in <122123b2b3914e32b2c06bd2a2d00f27>:02022-10-18 15:40:12.807 +02:00 [DBG] Stopping DNS monitoring thread2022-10-18 15:40:12.807 +02:00 [DBG] Releasing DNS monitoring lock2022-10-18 15:40:12.809 +02:00 [INF] Terminating connection2022-10-18 15:40:12.809 +02:00 [WRN] Acs did not stop correctly!2022-10-18 15:40:12.809 +02:00 [DBG] 🏞 Ending connection details reporting.2022-10-18 15:40:12.809 +02:00 [WRN] We are calling GracefulKill in a method that is not supposed to change Connection state.2022-10-18 15:40:12.809 +02:00 [DBG] GracefulKill2022-10-18 15:40:12.810 +02:00 [DBG] Cancelling socket listen token2022-10-18 15:40:12.810 +02:00 [DBG] Dispose socket2022-10-18 15:40:12.810 +02:00 [DBG] Signal process kill with helper tool.2022-10-18 15:40:12.810 +02:00 [DBG] Starting process2022-10-18 15:40:12.842 +02:00 [DBG] Start to read process output2022-10-18 15:40:12.875 +02:00 [DBG] End reading process output2022-10-18 15:40:12.943 +02:00 [DBG] Helper app --kill output: Kill success.2022-10-18 15:40:12.944 +02:00 [DBG] Release process manager start lock2022-10-18 15:40:12.944 +02:00 [DBG] Release process manager stop lock2022-10-18 15:40:12.944 +02:00 [DBG] Disconnected2022-10-18 15:40:12.944 +02:00 [DBG] Stopping DNS monitoring thread2022-10-18 15:40:12.944 +02:00 [DBG] Releasing DNS monitoring lockFollowComment"


Question: Site-to-Site VPN

"Hello,My question might sound odd. I apologize for that in advance.Does using site-to-site VPN dependent on my data center internet bandwidth limit? Say I have 50 Mbps internet from my ISP, when I set up site-to-site VPN to AWS I get 1.25Gbps bandwidth tunnel. So my question is regardless of your bandwidth allocated to you from ISP you will always get 1.25Gbps (for workloads going through the tunnel) if you setup VPN connection? Who provides you this bandwidth?Thank you.FollowComment"

Answer: "0Accepted AnswerOne clarification on top of the previous answer as an FYI. One VPN connection would have 2 Tunnels for high availability and if you use BGP based Active-Active tunnels and your CGW device supports ECMP routing then you can effectively get aggregate 2.5 Gbps of bandwidth per VPN when you terminate the VPN connection on Transit Gateway (VGW does not support ECMP)In your use-case though highly likely that your ISP would throttle your bandwidth at 50 Mbps; if your application needs more bandwidth you will likely need to upgrade your internet circuit.CommentShareEXPERTTushar_Janswered 3 months ago0Hello,In the AWS VPN FAQ, you will see: "Each AWS Site-to-Site VPN connection has two tunnels and each tunnel supports a maximum throughput of up to 1.25 Gbps".If, on your side, you are limited to less than 1.25 Gbps (e.g. 50 Mbps), the available bandwidth for the connection will be limited to your value (e.g. 50 Mbps).But, if you have more bandwidth available on your side (e.g. 2 Gbps), the maximum bandwidth will still be limited to 1.25 Gbps.CommentShareVincentanswered 3 months agoAman 3 months agoThank you very much for the response Vincent.A follow up question. If we are doing migration of our Web, App and Database servers and may be Archive Tapes to AWS with very limited time (discount Snow devices and direct connect for this example), how can we facilitate the migration in terms of bandwidth? Is there a way? And consider as we are doing the migration we don't want our daily business workload to be affected by the bandwidth bottleneck.Thank you!ShareVincent 3 months agoIf you want to send data from on-prem to AWS but if you exclude Direct Connect or Snow devices, the remaining option is VPN. You could use multiple VPN tunnels in parallel as explained here (https://youtu.be/qmKkbuS9gRs?t=835) terminating on a Transit Gateway. It is important to understand that a single flow will still be limited to 1.25 Gbps. But if you have multiple flows, they will be able to use the multiple tunnels at the same time (ECMP). On you on-premises side, you need to work with your Internet Service Provider to get a higher bandwidth if you are limited to 50 Mbps. I don't know the quantity of data that you want to upload to AWS but if it's in the order of 50TB or more, it is strongly advised to use Snow devices (there is also a section related to Tape Data Migration in the Snowball FAQs: https://aws.amazon.com/snowball/faqs/).Share"


Question: Beanstalk Network configuration - This environment is not part of a VPC.

"Hi,I tried to follow. https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/vpc-rds.html for creating an application in VPC.But after creating a test sample application, I click the environment --> configuration. The Network section gave me this info "This environment is not part of a VPC."I had created a VPC ready with subnets across availability zones.Any advice would be highly appreciated.FollowComment"

Answer: 0Accepted Answerare you sure you are in the same region as your VPC ?CommentShareEXPERTEldenanswered 6 months ago


Question: Details about Lightsail Certificate verification & duration

"After creating a container deployment in Lightsail I added a domain and then requested a certificate in order to attach a custom domain to said deployment.With close to an hour since the certificate is still in state PENDING_VALIDATION, with the only message being Auto validation record successfully added (the records I can see in the DNS console).Is there any way to get more information about the state of the certificate validation and/or steps I can take to speed this up?FollowComment"

Answer: "0Accepted AnswerWhoever might read this: verify, twice if needed, that the DNS servers AWS provides for the custom domain match what you've configured.CommentSharePeter Lanswered 3 months ago0You can follow the docs below to understand what needs to be done to validate your certificate on container service.https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-validating-container-services-certificatesCommentShareAWS-User-2776000answered 3 months ago"


Question: SDK and ChainableTemporaryCredentials

"Hi,I already posted my problem in:https://stackoverflow.com/questions/73702466/chainabletemporarycredentials-getpromise-and-missing-credentials-in-config-if-uBasically it is the following.When I use    const credentials = new ChainableTemporaryCredentials({    params: {         RoleArn: 'arn:aws:iam::${this.accountId}:role/${this.targetRoleName}',        RoleSessionName: this.targetRoleName,    },    masterCredentials: new WebIdentityCredentials({    RoleArn: 'arn:aws:iam::<proxyAccountId>:role/<proxyRoleName>',    RoleSessionName: this.proxyRoleName,        WebIdentityToken: token,        }),    })    await credentials.getPromise()   with token a a token received from GCP-cloud do I still need some kind of AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY in my environment?I don't think so, since the idea of the token is to grant access exactly without such credentials. Right?(In the codeblock above I had to manipulate some charaters because the code-template here in the forum had some difficulties withe original 1:1 code...)At runtime I get always an error message:Missing credentials in config, if using AWS_CONFIG_FILE, set AWS_SDK_LOAD_CONFIG=1I think I have not to use AWS_CONFIG_FILE: My application runs in GCP and just want access AWS via STS.My token looks good so far as I would assess:    {        "aud": <here my email address of the service account in GCP>,        "azp": "21 digit number",        "email": <same email as under "aud">,        "email_verified": true,        "exp": <10 digit number>,        "iat": <10 digit number>,        "iss": "https://accounts.google.com",        "sub": "<same number as under azp>"    }Are my expectations wrong? What is the reason for the error message?Best regardsThomasFollowComment"

Answer: "0Maybe a stacktrace is helpfull.Exception is triggered by the await credentials.getPromise() call.CommentSharerePost-User-7623370answered 8 months ago0Solved it.Missing credentials in config, if using AWS_CONFIG_FILE, set AWS_SDK_LOAD_CONFIG=1was totally misleading.In reality it was a problem with the field-names in the GCP-JWT-token und the policy in aws.See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_audCommentSharerePost-User-7623370answered 8 months ago"


Question: AXI4 bvalid not asserted sometimes after wready && wvalid && wlast

"I have an 8-kernel awsxclbin that sometimes hangs when multiple kernels are active. The kernels are identical RTL-kernels and the awsxclbin is generated using Vitis 2020.1. Each kernel has one AXI-MM interface to access the FPGA DDR.Using hw_emu mode I found that sometimes bvalid does not get asserted after wvalid && wready && wlast and causes our RTL Kernel to hang. This behavior (bvalid not being asserted) is sporadic and only happens when multiple kernels are accessing FPGA DDR. Also, not all the kernels hang and different kernels hang at different times.Any idea on what could be causing this and how to get around the issue?Also, is there any documentation on when bvalid is/isn't asserted by the shell on f1?FollowComment"

Answer: "0Hello,The DDR Controllers provided in the AWS Dev Kit follow AXI4 Protocol and returns Write Response (BRESP) upon successful completion of write request from the master logic. The following simulation example may help you to understand behavior of the controller's AXI4 interface:https://github.com/aws/aws-fpga/tree/master/hdk/cl/examples/cl_dram_dma/verif#dram-dma-cl-example-simulationFollowing are quick items to check based on your description of the issue:Check the AXI4 request size and ensure it does not cross 4K Boundary.Ensure that there are no other AXI4 Protocol Violations.Check AWID/BID from each RTL Kernel.Here's some more info on DDR4 AXI4 interface:https://github.com/aws/aws-fpga/blob/master/hdk/docs/AWS_Shell_Interface_Specification.md#ddr4-axiPlease contact us if you seek any additional info.Thanks!ChakraCommentShareawschakraanswered 2 years ago0Thanks for the link to simulation example.Answering your questions:Both read/write requests don't cross 4K boundary. Write/Read request sizes are 1KB.There doesn't seem to be any protocol violations. What would be the simplest way to confirm axi4 protocol compliance? Should we add a protocol checker to each kernel?The awid/bid signals are always tied to 0.Some more relevant information:The 8 kernels are attached to DDR banks - 0,0,1,3,3,0,0,2. There's only one kernel attached to bank1 and bank2 and these kernels also hang.I modified our RTL Kernel to not wait for bvalid. However, wready was not asserted for the next transaction and the kernel would still hang. I figured this our from hw_emu mode. I have not tried adding ILAs and testing on FPGA to verify this yet.3. The same RTL code when compiled with 2019.2 does not hang and passes our tests.Things I can try next:attach ILAs to the kernel and verify if bvalid/wready not being asserted is the only issue.add protocol checker to the kernels.CommentSharehsharmaanswered 2 years ago0Thanks for the details.Please try adding protocol checkers to the RTL kernels.Also, if you could build a debug counter to track how many Write Requests were made, and how many responses were received, will help us to identify when it starts to break.Does this issue happen when only one Kernel is attached to a single DDR?Thanks!ChakraCommentShareawschakraanswered 2 years ago0We reduced the number of kernels to 4 (connected to bank 0,0,1,3) and attached protocol checker and an ILA to each kernel.We see these errors:kernel 0 and 1 (bank 0): XILINX_RECS_WRITE_TO_BVALID_MAX_WAIT followed by AXI_RECM_RREADY_MAX_WAIT, XILINX_RECS_CONTINUOUS_RTRANSFERS_MAX_WAIT, and XILINX_RECM_CONTINUOUS_WTRANSFERS_MAX_WAITkernel 2 and 3 see no protocol violations and do not hangDoes this help narrow down the issue?Again, the same code on 2019.2 Vitis seems to work and hangs with the above protocol violations when using 2020.1 Vitis.I will add counters for AXI requests/responses and also try 1kernel per DDR bankCommentSharehsharmaanswered 2 years ago0I added counters to the AXI interfaces in our RTL kernels. With four kernels connected to bank 0,0,1,3:For read channels (AR/R): I see about 129K read requests (arvalid && arready) after which rready goes low. The ILA waveform shows that the last two read requests do not finish (rvalid && rready && rlast).For write channels (AW/W/B): I see about 156K write requests (awvalid && awready). bvalid is not asserted for the last request and the kernel get stuck waiting for bvalid.When each of the four kernels is connected to a separate bank, all our tests pass.CommentSharehsharmaanswered 2 years ago0Hi,Are you using 2019.2 Vitis with the AR73068 patch? That is one difference between 2019.2 and 2020.1 that we know of. With our developer kit, we apply the patch automatically for 2019.2 and 2020.1 tools have that fix built in.Another thing to check is to take the 2019.2 xo and recompile using 2020.1 tools and create an AFI. This is to check if there is a problem in synthesis between the two different tool versions.-DeepCommentShareDeep_Panswered 2 years ago0We use our local installations to generate xclbin and awsxclbin. We do not have the AR73068 patch applied to 2019.2 Vitis locally.I will try generating xclbin/awsxclbin using 2020.1 Vitis with 2019.2 xo.CommentSharehsharmaanswered 2 years ago0Hi hsharma,Please let us know if recompiling from a 2019.2 xo using 2020.1 helped? If not, we can pursue next debug steps.-DeepCommentShareDeep_Panswered 2 years ago0We get this exception when trying to using 2019.2 xo with 2020.1 vitis:ERROR: [v++ 17-70] Application Exception: The XO file './sdx_kernel_Gorilla_256bus.xo' was created in version 2020.1, which is later than the software version you are currently running: 2019.2. Forward compatibility is not supportedCan you suggest something else?CommentSharehsharmaanswered 2 years ago0Hello,The warning suggests that you have a 2020.1 xo that is being linked for the platform using 2019.2. So let's first confirm that it is a 2019.2 xo being linked using 2020.1.The hangs might also suggest changes in register addressing between kernels generated on 2019.2 vs 2020.1. Have you had a chance to look at those in case that needs a host code change?-DeepCommentShareDeep_Panswered 2 years ago0Hi Deep,You're right. I fixed our scripts to compile with 2019.2 xo and 2020.1 Vitis for xclbin generation. It seems we still have the hang issue when running 8-kernels at the same time.Can you elaborate on the register addressing changes? Our host code uses OpenCL so I assume we won't have to make changes in host code.We're using FPGA 1.7.1 AMI for our tests. Do we need to switch to a different AMI?CommentSharehsharmaanswered 2 years ago0Hello,I sent you a PM about further debug. Another thing is that XRT is quite different for 1.8.1 AMI onwards. For 2020.1, I'd definitely suggest using 1.9.x AMI.-DeepCommentShareDeep_Panswered 2 years ago0The following workaround fixed the hang issue for us:We added FIFOs in our RTL kernel for read/writes to off-chip memory. Throttling the read requests (AXI AR channel) based on the available space in on-chip FIFOs and write requests (AXI AW channel) based on data available in on-chip FIFOs did the trick. It seems when there are a lot of outstanding read AXI requests, the write AXI requests would not get completed and that would hang our kernel.Thanks Deep!CommentSharehsharmaanswered 2 years ago"


Question: call AWS SES API from AWS API Gateway without AWS Lambda

"Hi @allwe are building a solution to send emails from snowflake which is hosted on AWS.components used are snowflake external function, AWS API Gateway, and AWS Lambda.below is the existing solution that worked and was tested:Snowflake external function ->API Gateway -> AWS Lambda-> AWS SESbut we are trying to avoid using AWS Lambda in the above workflow, and call SES using API gateway from snowflakecan you provide new workflow would work ?FollowComment"

Answer: "0To send production email through Amazon SES, you can use the Simple Mail Transfer Protocol (SMTP) interface or the Amazon SES APIYou can call the API in the following ways:Make direct HTTPS requests—This is the most advanced method, because you have to manually handle authentication and signing of your requests, and then manually construct the requests.Use an AWS SDK—AWS SDKs make it easy to access the APIs for several AWS services, including Amazon SES. When you use an SDK, it takes care of authentication, request signing, retry logic, error handling, and other low-level functions so that you can focus on building applications , lambda perhaps is doing this for you.Use a command line interface—The AWS Command Line Interface is the command line tool for Amazon SES. We also offer the AWS Tools for Windows PowerShell for those who script in the PowerShell environment.if you remove lambda you may want to see Make direct HTTPS requests and if API gateway integration with AWS services will work. A POC can be done to test out.CommentShareEXPERTAWS-User-Nitinanswered 4 months ago0So, this is probabaly technically possible.The API Gateway supports the AWS Service integration type which lets you directly integrate with other AWS services by invoking API actions.This can be challenging since there are certain parameters (destination, source, message body, etc) that you need to ensure are correct and are transformed from whatever format Snowflake is using to what the API is expecting.Is there any reason you are not wanting to use a Lambda? It would simplify this flow dramatically in my opinion.ReferencesAWS API Gateway Docs - Set up an API integration requestAWS API - SES SendEmailCommentShareCarlo Mencarellianswered 4 months ago"


Question: How to make neural voice of my own by Amazon Polly

"I'd like to create my neural voice of my own by Amazon Polly. But even I open Amazon Polly Console, there are only 3 menu on the left side pane such as text-to-speech function, lexicon, S3 synthesis task. PLS let me know the procedures how to make a neural voice of my own. I want to do it from voices and scripts extracted from existing movies which I acted and spoke in them.Regards,Michael YamaguchiFollowComment"

Answer: "0Accepted AnswerHi Michael, for your project I suggest to use Amazon Polly Custom Voicehttps://aws.amazon.com/it/blogs/machine-learning/build-a-unique-brand-voice-with-amazon-polly/CommentShareLBajardanswered 2 months agorePost-User-0875274 2 months ago@LBajard Thank you for your advice. I try to contact to Brand Voice.Share"


Question: Http response with body is threat as Data Transfer ?

"Hello,We build some app where our java job sent request to external app and in response we have some body as xml or json with data what we need. This is classified as Data Transfer ?FollowComment"

Answer: "1Accepted AnswerYes, if the API you're calling is outside AWS then that will count as data transfer.CommentShareEXPERTBrettski-AWSanswered a year agoAWS-User-0800405 a year agoThank you very much :)Share"


Question: Domain Not working

"Hi,I registered the domain name as "rfidinventoryapp.co.za" on April 6th, 2023 but it's not working.FollowComment"

Answer: 1Do the NS servers specified in the Route 53 hosted zone equal the NS servers returned from a WhoIs query?CommentShareEXPERTkentradanswered 7 days ago


Question: Setting encrytion

"Hello and apologies in advance if this is an obvious / newbie question but I'm really nervous about updating my running instance of RDS in case I can't revert it.  I've done an RTFM and understand believe I should be able to just set an encryption option on RDS (I'm using SQL Server, called from an ASP.NET application running on Beanstalk) and then the data is encrypted at rest, that's it.  I don't have to make any other changes to my web app that access it.  Is it as simple as that or do I have to get key pairs to decrypt the data before my web site can use it?  Or any other option?Would this have any impact on the https settings?It's partly reassurance but mostly education I'm after as this is a burgeoning business and I don't want to change what's currently working smoothly.  However, I do need to encrypt the data in preparation for more data that will be added soon.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.htmlFollowComment"

Answer: "0Accepted AnswerEncryption is enabled by default for RDS.You can confirm this by looking on the Configuration tab from the Console, under storage you should see Encryption Enabled = YES.If you do not specify custom KMS keys, you will get a default KMS key that RDS manages for you.hth,PhilCommentShareMODERATORphilawsanswered 4 years ago0Thanks very much for that Phil and a big 'phew' from me.CommentSharekamdarcanswered 4 years ago"


Question: Using Google App Scripts to connect with Amazon S3

I have a Google Sheets add-on which let users get stock price in Google Sheets. I am trying to copy users' request in the spreadsheet to S3. I am using the same library as in this question on Stackoverflow and I encounter the exact same error:AWS Error - SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing methodJust wondering whether anyone has experience with this? The solution in that question does not work for meFollowComment

Answer: "0Hey,When you use AWS services such as S3, your request is authenticated using an algorithm called SigV4. This should be done automatically by the library you're using (in your case S3-for-Google-Apps-Script) but this error message suggests that this process has been done incorrectly.This is most likely an issue with the library you are using and so you'll probably have the most luck if you reach out to the authors e.g. by creating an issue on their GitHub page.However, I've had a quick look through their code and it looks like their SigV4 code is hard-coded to use the AWS us-east-1 region Therefore, you may find it works if you try using an S3 bucket located in us-east-1 (N. Virginia)Thanks,Marrick.CommentShareMarrickanswered 10 months ago"


Question: Reverse DNS with BYOIP

"Hi there,We have a couple of BYOIP pools we've imported into AWS and need to set up reverse DNS. For all of the IPs we allocate from that pool the "Update reverse DNS" option is disabled. The IPs have A records and the option is available for all of the other elastic IPs. Just wondering how we set up reverse DNS for these BYOIPs?CheersFollowComment"

Answer: "0You need to find who is the DNS authority for reverse DNS (i.e. name servers for the subnet). Ideally it's a full class C (or larger, i.e. /24) - if not it can get more complex and may eliminate option A below.Remember DNS reads right to left, so lookup name server for 3.2.1.in-addr.arpa if your IP was 1.2.3.0/24 (i.e. 1.2.3.4 is one of your IPs).I did a couple queries via CloudShell:sudo apt install bind-tools -ydig NS 3.2.1.in-addr.arpaOnce you find the authoritative name server then you can either request:a) Move it to route 53 (I've never done this but it's likely why your option is disabled)b) Request changes in the name server manually / outside of AWSBelow is a sample output, This one is managed by cais so I would have to contact them to make changes / assign the NS to Route 53 if I had the /24:[cloudshell-user@ip-10-6-21-56 ~]$ dig NS 10.177.205.in-addr.arpa.; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.amzn2.5.2 <<>> NS 10.177.205.in-addr.arpa......;; ANSWER SECTION:10.177.205.in-addr.arpa. 300    IN      NS      ns.cais.com.10.177.205.in-addr.arpa. 300    IN      NS      ns2.cais.com.You may end up with no NS entries listed, if that's the case you need to go back to whomever manages your IP addresses and ask them why there is no authoritative name server for the IP subnets.Good luck!CommentShareSteve Radichanswered 6 months ago"


Question: Put friends in same team in GameLift/FlexMatch when game is created

"I want to put a group of people in the same game session and team regardless of where in the world they are. I do not see in flex match docs how to force some player Ids to be in the same match or anything like that. For example, in a game like Dota, you create a party with your friends, and then any game you join you will be in the same team as your friends. Is there any way to achieve this on flex match?Thanks a lot for any help.FollowComment"

Answer: "0Yes you can prefill a team and let FlexMatch handle finding matching players for another team(s).If you know everyone in the match then you can just skip flexmatch and handle the placement yourself (ie StartGameSessionPlacement).CommentSharerePost-User-5332620answered 2 years ago0See https://forums.awsgametech.com/t/how-to-implement-a-party-matchmaking/6732/2 for lots of information and links to other useful threads.CommentSharerePost-User-5332620answered 2 years ago0Can i just prefill a part of team?  For example, in a 5-vs-5 game like Dota, I create a party with just one friend, can FlexMatch support this situation?Thanks a lot.CommentSharerePost-User-0493574answered 2 years ago"


Question: KMS key policy principal not detected

"Hi team,I have an SFTP user that uses a Sftp_role to put s3 objects inside an encrypted S3 bucket (SSE-KMS / my own KMS key).I modified the key policy to add another statement :sftp_role as principalactions =[                "kms:Encrypt",                "kms:Decrypt",                "kms:ReEncrypt*",                "kms:GenerateDataKey",                "kms:DescribeKey"            ]resource = [myencryptedBucketArn, myencryptedBucketArn/*]the sftp user got an access denied when copying files into the bucketwhen I moved this policy to put it directly on the sftp_role it worked and user was able to put files :new policy under sftp_role :{    "Version": "2012-10-17",    "Statement": [        {            "Action": [                "kms:Encrypt",                "kms:Decrypt",                "kms:ReEncrypt*",                "kms:GenerateDataKey",                "kms:DescribeKey"            ],            "Resource": "arn:aws:kms:region:7sj14575037811:key/dafsf-ceasfasf4asf-asfaf-asfasfas123",            "Effect": "Allow"        }    ]}I'm just wondering why it doesn't work when I put the role as principal on the key policy, but it worked when I added new policy to the sftp_role itself to give him permission to the key.Kind RegardsFollowComment"

Answer: "0It looks like the ARNs specified in the resource element could be for the S3 bucket ([myencryptedBucketArn, myencryptedBucketArn/*]), rather than the KMS key, as in the second policy.To allow the KMS actions, the resource in the policy will need to be the ARN of the associated KMS key.CommentShareEdanswered a year agoJess a year agosorry, I did not understand the first part of the answerShareEd a year agoSorry! On reading your question again, it sounds like you might be talking about two different types of policy - the KMS key policy, and the IAM role policy. The action will need to be allowed in both of these for it to work.In the KMS key policy, the resource can be "*", which refers to the KMS key the policy is applied to, and in the IAM policy for the role, the resource will need to be the KMS key, as you already have done.Share"