Question: AWS IoT Policy - using * in combination with a text string or variable

"When using * in combination with a variable or text string the resource is not working as expected.When using a allow effect for action iot:Connect on a resource"arn:aws:iot:*:*:client/${iot:Connection.Thing.ThingTypeName}-*"I'am expecting to be able to connect using a client id based on the thing name and a string seperated by a dash.Eg. "MyThingName-client1" or "MyThingName-abc" based on the condition that the thing name is "MyThingName".The behaviour i experiance is that i can not connect using the wildcard in combination with variable or a string.A full reproducing example is shown below.  I can connect using only the thing name bu not using the thing name dash any string.{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "iot:Connect"      ],      "Resource": [        "arn:aws:iot:*:*:client/${iot:Connection.Thing.ThingTypeName}",        "arn:aws:iot:*:*:client/${iot:Connection.Thing.ThingTypeName}-*"      ]    },    {      "Effect": "Allow",      "Action": [        "iot:Receive"      ],      "Resource": [        "*"      ]    },    {      "Effect": "Allow",      "Action": [        "iot:Publish"      ],      "Resource": [        "arn:aws:iot:*:*:topic/${iot:Connection.Thing.ThingTypeName}/input/${iot:Connection.Thing.ThingName}",        "arn:aws:iot:*:*:topic/${iot:Connection.Thing.ThingTypeName}/event/${iot:Connection.Thing.ThingName}"      ]    },    {      "Effect": "Allow",      "Action": [        "iot:Subscribe"      ],      "Resource": [        "arn:aws:iot:*:*:topic/${iot:Connection.Thing.ThingTypeName}/output/${iot:Connection.Thing.ThingName}"      ]    }  ]}FollowComment"

Answer: "0Thanks for using AWS IoT. As our docs(https://docs.aws.amazon.com/iot/latest/developerguide/thing-policy-variables.html) say, to use thing-policy variables these two things must be true.ClientId must match with ThingName.Certificate must be associated with the Thing (specified in the clientId).A certificate can be associated with more than one thing so we depend on device giving the thing name while connecting to IoT core in clientId field. This is needed even if certificate is attached to a single thing because if the certificate is attached to another thing in its lifetime (maybe accidentally), we don't want existing devices to break as policy variables cannot be resolved if we cannot identify the thing uniquely.We have a feature request in our backlog to support multiple client ids. We cannot give exact dates but we are working hard to get the features out based on the priorities.CommentShareAWS-User-3247576answered 3 years ago0I had overlooked the fact that the thing name should be equal to the client id.Thanks!CommentSharesavnikanswered 3 years ago"


Question: I got Instance status checks fail in EC2

I got Instance status checks fail in EC2 ubuntu 20.04when I check syslog log will be show  as below before status fail pls help to find root cause and how to fix itApr 18 13:46:19 ip-172-31-28-165 systemd-networkd[18468]: ens5: ConfiguredApr 19 07:07:01 ip-172-31-28-165 systemd-networkd[18468]: ens5: FailedFollowComment

Answer: 0I just launched a Ubuntu 20.04 instance with no issues. From your logs I see that ens5 failed which is the enhanced networking interface - are you trying to add secondary interfaces? Or do something else?For troubleshooting: I'd start with the base image and then work forwards until you get to the command/module that fails.CommentShareEXPERTBrettski-AWSanswered a year ago


Question: Table & Pivot Table Header Formatting No Longer Working

"Has anyone experienced existing analyses formatting of the headers is no longer in place and using the configuration options under edit for headers no longer alters the table headers? This is very recent, the analyses were formatted for background color and text wrapping. Neither are in working now even with the settings in place. Efforts to re-format cause no change onscreen. :(FollowComment"


Question: how do i delete a lambda@edge that isn't attached to a cloudfront?

"hiI only have two cloudfront distributions in my account, neither of them reference my edge lambda, and yet when I try to delete it I get this error message:Lambda was unable to delete arn:aws:lambda:us-east-1:???:function:???:1 because it is a replicated function. Please see our documentation for Deleting Lambda@Edge Functions and Replicas.The cloudfront it was associated with was deleted over a week ago and I am still getting this error when I try to delete.How can I disassociate it from cloudfront when the cloudfront it was attached to is already gone?FollowCommentperekrestov a year agoI have the same error.There are no associated CloudFront distributions for this Lambda for at least several months.It's 100% true, I've checked using https://former2.com/ - there are no associations.But I'm not able to delete the Lambda@Edge function.Share"

Answer: "0Are you sure you have checked all the behaviors of your CloudFront distributions, to make sure the function is not associated anywhere?If you are confident that is the case, and you've followed all the instructions in the documentation: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-delete-replicas.html then I'd recommend opening a case with AWS support to investigate further.CommentSharePaul_Lanswered a year agocctommyvn a year agoI only have 2 origins in this account so there aren't a lot of places this could hide, i'm fairly sure i've checked everywhere it could be and it's not there, and it's certainly had more than a few days to figure itself out.I don't have a support plan tho, so i'm not sure how to contact support about this. I certainly don't want to subscribe to a support plan just to tidy this up. ?Do you know how I raise this without one?Share0Because the lambda@edge are replicated to edge location, you need to wait for a while.Detache it from CloudFront distribution and wait for a while for AWS to remove replicates.Normally it should take no more that few minutes.But I also had a situation when I was not able to remove it even after days, then I recommend to contact support and they will remove it for yourCommentShareMGanswered a year ago"


Question: Where is my April Badge?

AWS Repost had a special badge on offer for 10 unanswered questions with one accepted.I met the criteria but never recieved the badge. Anyone else had this issue/know whats  happened to the badges?FollowComment

Answer: 0Accepted AnswerCongratulations on meeting the criteria and winning the badge. The badge will be granted soon.CommentShareEXPERTIsraa-Nanswered 17 days agoGary Mclean 16 days agoThank you very much for your response. Look forward to receiving it.Share


Question: Stop RDS db.r6g.2xlarge charges after changing to Serverless V2

"Hi, I am new to AWS. I set up an AWS Aurora database and my initial instance class was  Memory optimized classes (includes r classes) - db.r6g.2xlarge. After three days, I realized my usage was too low and the instance class was too expensive. I, therefore, decided to change to Serverless V2 but my bill is still adding db.r6g.2xlarge charges. How can I stop these charges from accruing?Kindly assist.FollowComment"

Answer: "0Hi there!It'd be best to open a case in the Support Center to have this investigated on an account level.Please reach out to our Account and Billing Support team to review the charges linked to your db.r6g.2xlarge instance and also help confirm if this is still running and accruing any unintended charges.You can use this link to quickly visit the Support Center: https://console.aws.amazon.com/support/home.Regards,Kraig E.CommentShareEXPERTAWS Support - Kraiganswered 7 months ago"


Question: Upstream timed out 110: Connection timed out on elastic beanstalk

"I have a node.js server hosted on Amazon Linux 2/5.4.9 elasticbeanstalk. This API server is running fine for the past year. But lately I found that the server was in severe condition and had to be restarted first so that things got better. In the logs file I get lots of error codes like the following:2022/12/27 16:42:07 [error] 23659#23659: *7403 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 172.31.24.78, server: , request: "GET /url-my-api HTTP/1.1", upstream: "http://127.0.0.1:8080/url-my-api", host: "api.mydomain.com", referrer: "https://mydomain.com/"I've never done any updates. Is there a solution that I should do?Additional information:Instance types : t2.smallScaling cooldown : 180sServers live 24 hoursFollowComment"

Answer: "0Are you using cloudwatch for any metric monitoring of your elastic beanstalk environment or servers? Have you also tried to integrate x-ray to determine further latency problems?CommentShareCloud_Ganswered 5 months agotoyotaintercom 5 months agoI haven't used it and don't know how to use itShare0Hello,Are you using nginx and configured proxy_pass with upstream server. If so you have some issue on resolving DNS.After a time, the upstream is not reachable and you have to restart to have access again. Is that the issue you have ?https://distinctplace.com/2017/04/22/nginx-upstream-timed-out/CommentShareIsmahelanswered 4 months ago"


Question: "Lightsail instance stops loading Wordpress site, requiring instance reboot"

"Wordpress website (bitnami package) running on Lightsail instance stops displaying after 2-3 days, requiring a restart.  Bitnami offers a built-in diagnostic tool which states that ports 22, 80 and 443 are not accessible remotely at the time this issue persists. Lightsail instance networking/firewall settings show that the ports in question are enabled.  Rebooting the Lightsail instance resolves the issue, but the problem repeats itself after 2-3 days.  We have to keep restarting the server every couple days to keep the website live.  Would like to find a reasonable solution.FollowCommentrePost-User-7512181 11 days agoI have same problem Any solution?Share"


Question: How to update a WebACL in WAFV2 using either PHP SDK or AWS CLI without losing important configuration

"When working with WAFV2 and making a call to GetWebACL the CustomResponse configuration is missing.If this configuration is subsequently used in a call to UpdateWebACL then the CustomResponse is lost.This appears to be a serious bug that would potentially cause undetected loss of configuration as the response from both API calls is successful.The API documentation states:To modify a web ACL, do the following:1) Retrieve it by calling GetWebACL2) Update its settings as needed3) Provide the complete web ACL specification to UpdateWebACLhttps://docs.aws.amazon.com/aws-sdk-php/v3/api/api-wafv2-2019-07-29.html#updatewebaclFor example a WAFV2 Rule with the following configuration:{   "Name":"RateLimit-3000",   "Priority":8,   "Statement":{      "RateBasedStatement":{         "Limit":3000,         "AggregateKeyType":"IP"      }   },   "Action":{      "Block":{         "CustomResponse":{            "ResponseCode":429,            "CustomResponseBodyKey":"TooManyRequests"         }      }   },   "VisibilityConfig":{      "SampledRequestsEnabled":true,      "CloudWatchMetricsEnabled":true,      "MetricName":"RateLimit-3000"   }}Is returned from an API call to GetWebACL as this:{   "Name":"RateLimit-3000",   "Priority":8,   "VisibilityConfig":{      "MetricName":"RateLimit-3000",      "CloudWatchMetricsEnabled":true,      "SampledRequestsEnabled":true   },   "Action":{      "Block": { }   },   "Statement":{      "RateBasedStatement":{         "AggregateKeyType":"IP",         "Limit":3000      }   }}If that configuration is then passed back to an API call to UpdateWebACL then the CustomResponse in the Block Action is removed.Is this a known bug or is there another way to correctly update a WebACL without loss of configuration?FollowCommentkumo-hiyori 2 months agoI would open a support ticket and bring to service team's attention.ShareEsteban_S 2 months agoExcellent question and the right place to put it!I am breaking down the answer in 4 easy steps:First of all, I suggest that you try the procedure below on a test/non-production WEBACL to get familiarized with the process.Even though it easy to enable custom response code using AWS WAFv2 web console, I understand that is some cases it can be convenient using AWS CLI to change the WAF WebACL programmatically.For testing purposes I disable custom response created with the AWS WAFv2 web console before starting and I'm going to enable custom response using AWS CLI. I'm going to change some parameters to highlight the difference with the custom response code generated using the web console.[1] First of all, we need to get some additional information from our WebACL such as theWebACL ID and the Locktoken. Please run the following command as shown below:$ aws wafv2 list-web-acls --scope REGIONALYou should get an output as shown below:“…{…“WebACLs”:[{“Name”: “ACL-NAME”“Id”:”123456789-idid-1234-1234-id12345678910”“Description”: “description”,“LockToken”: “id345678-1234-1234-idid-1234567891011”,“ARN”: “arn:aws:wafv2:region:awsaccount:regional/webacl/ACLNAME/ARN”},…”ShareEsteban_S 2 months ago[2] Copy the Web ACL ID and the LockToken.AWS WAF returns a token to your GET and LIST requests, to mark the state of the entity at the time of the request. To make changes to the entity associated with the token, you provide the token to operations like UPDATE and DELETE, with this you can add the “CustomResponse”. AWS WAF uses the token to ensure that no changes have been made to the entity since you last retrieved it. If a change has been made, the update fails with a WAFOptimisticLockException. If this happens, perform another get, and use the new token returned by that operation. So, make sure that you get the latest LockToken before running aws wafv2 update-web-acl.This is what happens when you don’t use the proper LockToken:“…User$ aws wafv2 update-web-acl –name ACLNAME –scope REGIONAL –default-action Allow={} –id 123456789-idid-1234-1234-id12345678910 –lock-token id345678-1234-1234-idid-1234567891011 –visibility-config SampleRequestEnabled=true,CloudWatchMetricsEnabled=true,MetricName=TestWebAcl-Metric –cli-input-json file://directory/WebAclJsonFile.jsonAn Error occurred (WAFOptimisticLockException) when calling the UpdateWebACL operation: AWS WAF couldn’t save your changes because someone changed the resource after you started to edit it. Reapply your changes.…”ShareEsteban_S 2 months ago[3] Once you get the Web ACL ID and the LockToken, you will need to run aws wafv2 update-web-acl using the following cli-skeleton. Modify the file accordingly and save it as “.json”==================================================={"Name": "<WebACL_Name>","Scope": "REGIONAL","Id": "123456789-idid-1234-1234-id12345678910 ","DefaultAction": {"Allow": {}},"Rules": [{Rule statement},"Action": {"Block": {"CustomResponse": {"ResponseCode": <StatusCode_selected>,"CustomResponseBodyKey": "<CustomResponseBodyName>","ResponseHeaders": [{"Name": "<CustomHeader(Optional)>","Value": "<CustomHeader_Value>"}]}}},"VisibilityConfig": {"SampledRequestsEnabled": true,"CloudWatchMetricsEnabled": true,"MetricName": "<Metric_name for the rule>"}}],"VisibilityConfig": {"SampledRequestsEnabled": true,"CloudWatchMetricsEnabled": true,"MetricName": "<Metric Name for the WebACL>"},"LockToken": "Latest LockToken gotten using "aws wafv2 list-web-acls --scope REGIONAL" ","CustomResponseBodies": {"<CustomResponseBodyName>": {"ContentType": "TEXT_HTML","Content": "HTML_Code/PlainText or Json"}}}ShareEsteban_S 2 months ago[4] In order to update the WebACL run "aws wafv2 update-web-acl", using the saved “.json” file, including your CustomResponse, as below:aws wafv2 update-web-acl --name <WebACL_Name> --scope REGIONAL --default-action Allow={} --id <WebACL ID> --lock-token <Latest LockToken> --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=<Metric_Name_for_WebACL> --cli-input-json file://<path>/Filename.jsonOnce you run the command, you should get the next LockToken. This confirms that your changes were successfully applied. See:“…User$ aws wafv2 update-web-acl –name ACLNAME –scope REGIONAL –default-action Allow={} –id 123456789-idid-1234-1234-id12345678910 –lock-token id345678-1234-1234-idid-1234567891012 –visibility-config SampleRequestEnabled=true,CloudWatchMetricsEnabled=true,MetricName=TestWebAcl-Metric –cli-input-json file://directory/WebAclJsonFile.json{“NextLockToken”: “id345678-1234-1234-idid-12345678910id”}…“After the above , feel free to check the WAF web console to confirm that our changes were applies successfully.Additional information is available at:Custom responses for Block actionshttps://docs.aws.amazon.com/waf/latest/developerguide/customizing-the-response-for-blocked-requests.htmlUpdateWebACLhttps://docs.aws.amazon.com/waf/latest/APIReference/API_UpdateWebACL.htmlShare"

Answer: "0Accepted AnswerThanks for all the suggestions. After contacting AWS Support, this issue has now been solved by updating both PHP SDK and AWS CLI to their latest versions. Hopefully this answer will help others as using an older version of either PHP SDK or AWS CLI will still work but using them will be destructive and cause configuration to be inadvertently lost.CommentSharePeteranswered 2 months ago0Hi,Thank you for contacting AWS Re:post .I understand you have some clarifications regarding updating a WebACL in WAFV2 using either PHP SDK or AWS CLI without losing important configurationLooking at the issue, This would require further analysis and troubleshooting. I would suggest you to open a case with the WAF premium support team and provide details such as:--> WAF configuration--> Any supported Logs (Access logs)Thanks and have a nice day!CommentShareSUPPORT ENGINEERAnsh_C answered 2 months ago"


Question: Allow alternative login

"Often people don't have personal AWS accounts and do not want their re:Post profile to be a hostage of their current employment! Please, allow alternative authentication! And maybe linking AWS accounts (more than one).FollowComment"

Answer: "5Would suggest the team to add social media logins as well.While the team is working to add more login methods, one alternative is to create a new, personal AWS account, and leveraging the 1 year free tier one might be getting some additional AWS knowledge that might help them professionally down the road.CommentShareJason_Sanswered a year agoJon Bonso a year agoI think this is a good workaround. Yes, having a new login method is pretty convenient but underneath that convenience lies the risk of having bogus profiles and lots of spam in this new platform.Sharelocalghost a year agoHow would one add their cert badges from Credly if the emails don't match?Share5Thank you for your suggestion for more flexible login/account capabilities. We hear your feedback on this, and this enhancement is already on our priority list -- please stay tuned for more around this request. We appreciate your feedback and continued participation in the re:Post community!Kind Regards,Monica L.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago4Hi, using an account to log in ensures that you are a customer of AWS and have accepted terms and conditions.  I understand that this is the reason behind requiring an account.The concern about loosing your profile when switching jobs sounds reasonable, my advice is to create a personal free account and leverage the free tier to practice.About login with social media (once you have initially authenticated with your AWS account), could be a good request for enhancement. I'll channel this request internally.Hope my answer helps. Please remember to choose an accepted answer.CommentShareDario_Ganswered a year agozachjonesnoel a year agoCertainly having a personal account and using that for re:Post makes sense that way you will also get use AWS env for some hands-on experience.Share0It is now possible to register for re:Post using an Amazon Builder ID.CommentShareEdanswered 6 months ago"


Question: CodePipeline - how to pass and consume multiple artifacts across CodeBuild Steps?

"Hello.  I know I can pull multiple Source actions (e.g. 2 GitHub repos) into a CodeBuild step by adding multiple Source Artifacts. It would seem that i should follow the same pattern (e.g. $CODEBUILD_SRC_DIR__<secondary_artifact_name>) where individual CodeBuild actions are producing and consuming artifacts. In my case, my consuming step needs the following inputs:Source input (primary source, to get my buildspec.yml)The output of a prior CodeBuild step (a couple of files).I am successful in setting up the Input/Output artifacts in my pipeline and validating that the zipped files are placed into the pipeline s3 bucket. Its all good up until that point.However, when I run the consuming step and troll the file system I do not see anything like $CODEBUILD_SRC_DIR__<secondary_artifact_name>.Is this scenario supported? if so, how do I reference the secondary artifacts in my CodeBuild buildspec?Thanks DaveFollowComment"

Answer: "0It is supported and the name you're looking for is correct. So I think you just have a small error.Here's an example (CDK Typescript): https://github.com/awslabs/aws-greengrass-labs-component-for-the-things-stack-lorawan/blob/main/cicd/lib/cicd-stack.tsThe output from the build stage is passed as an extra input to the deploy stage. Both of which are CodeBuild actions:        const buildAction = new codepipeline_actions.CodeBuildAction({            actionName: `${Names.PREFIX_DASH}-build`,            project: buildProject,            input: source,            outputs: [build]        });        const deployAction = new codepipeline_actions.CodeBuildAction({            actionName: `${Names.PREFIX_DASH}-deploy`,            project: deployProject,            input: source,            extraInputs: [build],            outputs: [deploy],            environmentVariables: {                "GREENGRASS_CORE_NAME": { value: context.greengrassCoreName }            }        });And the buildspec for the deploy stage, that consumes the output from the build stage: https://github.com/awslabs/aws-greengrass-labs-component-for-the-things-stack-lorawan/blob/main/cicd/deployspec.yaml      # Get the recipe file generated by the build stage      - RECIPE_FILE=$(ls $CODEBUILD_SRC_DIR_Build/aws.greengrass.labs.*.json)CommentShareEXPERTGreg_Banswered a year agoDaveC a year agoHey Greg - many apologies for not touching base back sooner.  I saw your answer but was getting some weirdness in the portal.My scenario is specific to using CodeBuild within CodePipeline. There are some constraints with this that are not applicable with CodeBuild so I dont think this example will work for me.ShareGreg_B EXPERTa year agoDave, the example above is indeed CodeBuild within CodePipeline.Share0How about caching in AWS CodeBuild. A cache can store reusable pieces of your build environment and use them across multiple builds. Your build project can use one of two types of caching: Amazon S3 or local.CodeBuild also supports secondaryArtifacts. These artifacts use the secondary-artifacts block of the buildspec file that is nested inside the artifacts block.CommentShareRoBanswered a year agoDaveC a year agoHey RoB - thanks, I looked into caching and that appears to be an optimization for a single codebuild step - i need a normal workflow with separate producing and consuming steps.  As for secondary artifacts, I'm using that feature - it just doesn't behave the way I would expect.Share"


Question: Amplify + Nextjs 12: CloudFront error 503 on API routes

"I've deployed a Nextjs v12 app on Amplify but I got error 503 on nextjs API routes:ISSUEThe Lambda function associated with the Cloudfront distribution is invalid or doesn't have the required permissions. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.If you provide content to customers through Cloudfront, you can find steps to troubleshoot and help prevent this error by reviewing the Cloudfront documentation.MY TRIESI tried to add permissions for lambda functions to the Amplify role but it doesn't work. Also can't find a policy specific to lambda@edge.I can see on the linked Cloufront the lambda@edge.I found different documentation on this issue but the only solution proposed was to downgrade Nextjs to v11, something I wan to avoid.No issues logged in the Amplify deploy:2023-03-21T18:42:58 [INFO]: Deployed the following resources to your account:2023-03-21T18:42:58 [INFO]: - CloudFront Domain ID: xxx2023-03-21T18:42:58 [INFO]: - SSR Lambda@Edge: xxx2023-03-21T18:42:58 [INFO]: - API Lambda@Edge: xxx2023-03-21T18:42:58 [INFO]: - Image Optimization Lambda@Edge: xxx2023-03-21T18:42:58 [INFO]: - S3 Bucket: xxx2023-03-21T18:42:59 [INFO]: Deployment completeSPECSI'm using Amplify 'web dynamic', Nextjs v12, prisma (I do 'npx prisma generate' in the build phase).FollowComment"


Question: "Using a ConditionExpression in UpdateItem, without granting Write permission to the attribute used in the ConditionExpression"

"I have a DynamoDB database where I'm trying to lock down access to a table (MyTable) to only allow certain updates to be performed by certain users. So the table has items with attributes such as Name, Email, ItemStatus, PrivateAttr1, PrivateAttr2 etc. UserA is allowed to update the Name,  Email etc. but not ItemStatus, PrivateAttr1, PrivateAttr2 etc.To achieve this, UserA belongs to a group to which I have applied a number of IAM policies including one which allows "UpdateItem" with the following Condition:"Condition": {"ForAllValues:StringEqualsIfExists": {"dynamodb:Attributes": ["Name","Email"]}}This all works correctly - I'm using the C++ SDK - and allows UserA to change ONLY the Name and Email attributes but without allowing them to update ItemStatus, Attr1 and Attr2.What I want to do now is only allow this change based on a specific value of the "ItemStatus" attribute. But this particular user is not allowed to CHANGE the ItemStatus attribute. But I want them to be able to only update other attributes if the ItemStatus attribute (as set by another user) is a certain value (say 2).So I have added a ConditionExpression "ItemStatus = :status" and added a AttributeValue of (:status = 2). But instead of getting a failure along the lines of "Conditional Request failed", I am getting a permissions failure: "User: .../UserA is not authorized to perform: dynamodb:UpdateItem on resource: ....:table/MyTable"It appears that in order to allow the UpdateItem expression to include a ConditionExpression based on the ItemStatus, I need to include ItemStatus in the "UpdateItem" IAM Policy - surely this is not the case, as it also allows UserA to be able to edit the ItemStatus, which I DON'T want to allow.Thanks in advance for any pointers on how to achieve this!FollowComment"

Answer: "1Hi,What you are trying to achieve is not currently possible in a single operation with DynamoDB, as ConditionExpression is not a read operation, its a write operation. As you have blocked this user from UpdateItem on that attribute, they will be unable to do a conditional check on it. You would need to read the item first, making your assertion on the client side before updating.Let me know if you would like me to raise a Feature Request with the team for this functionality.CommentShareEXPERTLeeroy Hannigananswered a year agoLiam a year agoHi Leeroy, many thanks for the quick reply. That makes sense, although I do think that Condition Expression should be treated as a "read" operation even when it's part of a "Write" operation. So yes, please do raise a feature request - and if you can, I'd be grateful if you could let me know how I could keep track of whether that functionality is going to be included! In the meantime I'll find a way around this by doing a "read" first, but ideally I'd be able to do it all as part of the same request. Thanks!ShareLeeroy Hannigan EXPERTa year agoI can raise the FR for you, consider that done. But unfortunately there is no way to track requests. Rest assured the team implement requests based on demand and customer needs.You can keep up with the latest feature releases on the AWS Portal https://aws.amazon.com/new/Share"


Question: "API Gateway/OpenAPI 3.0 deploy warning, what is ComposedSchema?"

"Hello all!I am trying to use the allOf keyword to inherit attributes of one schema model into another as such:providerIdentityExpansion:      description: ID of the Provider Identity with fields possibly expanded.      allOf:        - $ref: '#/components/schemas/providerIdentityNoExpansion'      properties:        oft_confused_with:          oneOf:          - $ref: '#/components/schemas/oft_confused_with'          - $ref: '#/components/schemas/oftConfusedWithExpansionArray'      title: ProviderIdentityExpansion      type: objectI previously just duplicated the model, but changed the names (one with expansion, one without). But using allOf, when I use swagger-cli to bundle all OpenAPI 3.0 Spec docs together into one file and deploy on API Gateway, it responds with following warning:"Unsupported model type 'ComposedSchema' in 200 response to method 'GET /providers/{id}/identity'. Ignoring.",        "Unsupported model type 'ComposedSchema' in 200 response to method 'GET /providers/{id}/identity/children'. Ignoring."Is anyone familiar with the model type ComposedSchema, and how to utilize the allOf keyword without triggering this error in AWS?FollowComment"


Question: Java Deployment across multiple machines - best practice

"So I have a few server farms running Glassfish/Payara and we are moving off letting developers on the box's for numerous reasons and we want to automate the deployment ..The WAR file can reside on S3 or an EFS that all servers have access to so trying to think of the best way.  The process would simply be they develop on a staging box, confirm things work, then say go live.   With Bash and SSH I was able to cycle through the machines but had to put the servers in an array, and just removed from the target group, deployed and added, but we are also moving to more autoscaling groups, and the servers should really be able to be terminated and new ones just start from the launch template, deploy the latest version (as it maybe old), then put in the target group so I won't have the ability to do this in an array.So, I thought about in bash someway to query where the tag was X, get the IP's and cycle though but that still seems a bit legacy.  I have SSM up and in place, so trying to think of what the developers can do when there done, have a WAR file that needs to go to X number of servers and just say go.   From there, it goes to server 1, 2, X amount and naturally sequential so they all don't get pulled out at once.The other thought I used for some basics is code-deploy and have them just commit the WAR file.  That would trigger the copy down, using the webhooks we could do a script after to say run this deploy now which I think maybe easier and cleaner all based on tags, etc.   The only question I have on this path is that if the group says have 5 servers, 1 fail's and gets terminated, when the group starts a new one from the template, the code would be outdated, so how do I ensure on startup that its the latest codebase.Thank you for all the help and thoughts in this.FollowComment"

Answer: "1Accepted AnswerHi, I think this is the solution when using CodeDeploy for newly launched instances: https://docs.aws.amazon.com/codedeploy/latest/userguide/integrations-aws-auto-scaling.htmlCommentShareDidier_AWSanswered 14 days agolraymond 14 days agoPerfect, exactly what I was needing!Share"


Question: MediaLive not respecting RTMP Bitrate

"I am using medialive and mediaconnect to restream srt streams to multiple destinations.I realized that the RTMP output is not respecting the bitrate specified and even sometimes is not respecting the resolution.Is there a special setting to enable for it to output with the specified resolution and bitrate?Current setttings:Width : 1920  Height: 1080 Codec: H264Rate Control: CBR 6 500 000Frame Rate: Specified 30000 / 1001 ProgressiveGOP Size : 60 Frames B-Frames 0Scaling Default AFD Passtrough--> Received stream : 1920x1080 or 1280x720 / 1.3 to 1.6 mbps** EDIT/UPDATE**I tried to create a brand new channel from a workflow, selecting twitch as a destination but replacing the endpoint with my own RTMP destination. The only output option was 1080p@30/4.5mbps output.Didn't change anything except the endpoint. Start the flow.And I'm still receiving 1.5mbps video.I was hoping to avoid rolling my own encoder to forward streams to our clients, but if there's no way to control the output of medialive, I don't see how I can achieve it witihin AWS.FollowCommentB-Wilkinson 10 months agoA few comments. Not sure why you have 0 B frames. B frames are needed for efficient compression. Either way not the problem you are having.I am almost certain that you did these tests with static content. RTMP generally ramps itself down when content is static such as color bars and a slate.I would define all aspect of the Media Live encode and not allow "same as source". Pixel shape should be 1 to 1.Semi curious how are you getting SRT into Media Live. The only way I can think of is through an SRT listen in Media Connect. Media Live does not accept SRT.ShareTechSol 10 months agoYes, sorry I was unclear. SRT in from mediaconnect, then vpc input from mediaconnect to medialive.I stream the same content from my computer to the RTMP destination, I get 1080p and 6.5mbps.I stream out of mediaconnect with SRT to my machine, I get 1080p.But when I do mymachine->mediaconnect->medialive->RTMP 3rd party provider.  I get ~1.5mbps and sometimes 1280x720.Also, I tried with static content and moving text and the infamous twitch sync footage you can find somewhere on the internet.As for the B frames, it's been a habit to remove them to lower the lookahead as it would require the full GOP to be downloaded before being displayed. Not sure in this case it changes much though.Share"


Question: Getting error while connecting EKS cluster error: You must be logged in to the server (Unauthorized)

"Hi All,I have create a EKS cluster . and i am trying to connect this cluster from my local machine .I am getting this error while executing kubectl command .Required your support .]# kubectl describe -n kube-system configmap/aws-autherror: You must be logged in to the server (Unauthorized)FollowComment"

Answer: "0Accepted AnswerDid you update your kubeconfig ?https://docs.aws.amazon.com/eks/latest/userguide/create-cluster.htmlStep 3After you create your cluster with eksctl, you want to update your Kubeconfig withaws eks update-kubeconfig --region region-code --name my-clusterCommentShareRolyanswered 3 months agorePost-User-1891481 3 months agoThis file is updated .still facing same issue .aws eks update-kubeconfig --region eu-west-1 --name  vikas1Updated context arn:aws:eks:eu-west-1:912603790734:cluster/vikas1 in /root/.kube/configShare0Are you logged into AWS as well ? can you issue ?aws s3 ls.?CommentShareRolyanswered 3 months ago"


Question: "aws swf register-domain" output argument

"My use case  is region build services chain reaction plugin - aws cli.  My objective is to reduce the number of tasks to automate.  I'd like to execute one command and receive feedback about success or failure to enable workflow continuation or do retry enforcement.I am using aws swf register-domain for its intended purpose and I'd like to understand if it is at all possible to invoke a response from the command execution other than none.  I look longingly at the --output argument which, according to documentation, allows one to determine an output format.   Does this imply that using the argument enables one to invoke a json response from the execution of a sequence that looks like this aws --region xyz-northeast-1  swf register-domain --name unique-domain-name --workflow-execution-retention-period-in-days 90 --output json ?FollowComment"


Question: getBucketNotificationConfiguration not returning filters

"Hi,We put the topic configuration using 'putBucketNotificationConfiguration' but when we tried to get it back with getBucketNotificationConfigurationIt returns everything but the Filters and there are filters, I can see those on the web and when creating the event we pass the topic config with the filters.Here is what we send to the putBucketNotificationConfiguration as topic configuration{"Id": "my-id","TopicArn": "arn:aws:sns:eu-west-1:account-number:my-id","Events": ["s3:ObjectCreated:*"],"Filter": {"Key": {"FilterRules": [{"Name": "prefix","Value": "data-lake/scada_mdb"}]}}}And this is what we get back{"Id": "my-id","Events": ["s3:ObjectCreated:"],"Event": "s3:ObjectCreated:","Topic": "arn:aws:sns:eu-west-1:account-number:my-id"}As you can see the filters are missing and for us this is the most crucial part. Any reason those are not coming back?We know for sure that the bucket is configured correctly because we can see the notification working as expected but we need to be able to get the right configuration back.FollowComment"

Answer: "0My bad, I was running 'getBucketNotification' instead of 'getBucketNotificationConfiguration' but as I was promisifying I didn't notice >.<CommentSharealietors-sennenanswered 2 years ago"


Question: Instance reachability failed!

"RHEL 7 on t2micro instance i-07b7f0529c9ae72dcStatus checks 1/2INSTANCESTATUSimpairedDETAILS2019-04-17T18:19:00.000ZreachabilityfailedAll I did was stop and start it. What happened??!! More importantly, how to fix it?I stop/started it thrice.Looked at the system log and nothing seems wrong. I'm trying not to panic. I've been customizing the instances for hours and hours.FollowComment"

Answer: "0Update from support agent-The kernel changed and that may be the cause of the instance failing.The question is how did it spontaneously change? Only I use it and I've only been running some Python scripts. Pretty innocuous stuff.CommentShareBallstoneanswered 4 years ago0Hi Ace4plasticoMan,I noted that the Instance in question was failing Instance Status Checks but has since recovered and is now passing both Status Checks.As noted here [1], Instance Status Checks monitor the software and network configuration of your individual instance. Amazon EC2 checks the health of the instance by sending an address resolution protocol (ARP) request to the ENI. Unfortunately, due to our privacy and security policy, we do not have access to our Customers' resources therefore I cannot confirm the root cause.I would recommend reviewing your OS level logs such as /var/log/messages during the same timeframe of the issue for any errors, warnings, etc. If you have any further concerns, please let me know.Thanks![1] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-system-instance-status-check.html#types-of-instance-status-checksCommentShareAWS-User-5964800answered 4 years ago0Shot self in foot. 100% my fault. I edited fstab days before the reboot and forgot.Issue was resolved with support case.One agent thought the kernel had changed but second agent did not agree. Commenting out the bad line in /etc/fstab resolved the issue.CommentShareAce4plasticoMananswered 4 years ago"


Question: Mysql does not run in my Cloud9 EC2 environment

The instructionec2-user:~/environment $ mysql-ctl startGives this result:bash: mysql-ctl: command not foundFollowComment

Answer: "1It looks like mysql is not yet installed in your cloud9 environment. You can validate this using mysql --version command. If it's not yet there, you can install mysql depending on which distribution you have. You may refer to this link for the instructions specific to mysql.https://docs.aws.amazon.com/cloud9/latest/user-guide/sample-lamp.html#sample-lamp-install-toolsCommentSharejoahnaanswered a year ago"


Question: Way to split up lengthy glue job scripts?

"There are many lengthy (> 1000 LOC) glue job scripts for our customers, and they are sharing common code blocks that are identical in all of them. The glue jobs are not executed interactively by a person, but instead triggered for execution at a particular point in time.Is there a way how to split up these lengthy glue job scripts in several smaller scripts, in order to isolate the common code blocks as python functions?Can you give an example?Having this common code blocks just in one place instead in all of the glue scripts would make maintenance much easier.FollowComment"

Answer: "1I see that there are many repetitive blocks of code in your Glue jobs and you would like to extract these pieces of code and implement them as functions. For this purpose, I would suggest you to bundle up these code blocks into python modules and then get them imported into your Glue jobs whenever there is a need.Make a python module of your generic functions.Next, .zip the module and upload it into a s3 bucket.Add the s3 path to your module (.zip file) to the "Python library path" field present in job details section.To know more about this, please refer this documentation.In this way, I think you can decrease the number of lines in your Glue jobs by pushing the redundant code to s3 bucket and then fetching it whenever required.I hope this helps you in your usecase.CommentShareSUPPORT ENGINEERChaituanswered 7 months ago"


Question: UnauthorizedOperation in WAFv2 WebACL listing panel using an user with AWSWAFFullAccess

"I was trying to create an user with specific permissions to access and modify their own WAF ACL, and I ran into issues by starting to see UnauthorizedOperation without any kind of information (not even if some permission was faulty) in the Web ACLs panel even having full listing and read capabilities or even any other panel more than the initial one.I changed the user to use AWSWAFFullAccess and tried several times using other web browser and re-login to avoid any kind of session cache, but it seems that still don't have access to WAF panels.With another account, with the AdministratorAccess policy, I have full acccess.I looked for information in AWS official documentation but found nothing related with some kind of hard-blocking to these panels.FollowComment"

Answer: "1Accepted AnswerYou will need to add the AWSWAFConsoleFullAccess policy to the users' permissions.AWSWAFFullAccess only grants access to resources. Here is documentation on using identity-based policies (IAM policies) for AWS WAF (https://docs.aws.amazon.com/waf/latest/developerguide/access-control-identity-based.html)CommentShareShahnaanswered 9 months agoSUPPORT ENGINEERMonica_Lluisreviewed 9 months agoEchedeyLR 9 months agoSeems that the specific needed access was related to listing regions, which was a permission grouped inside EC2.I had to compare both policies and try/catch to find the specific permission.Share"


Question: Can I load in DeepLens two models at the same time

"I am trying to load two MXNet well-trained models into one project. My goal is first detecting the objects and recognized them by the "object-detection" model. Then if there exits "person" in it and I will let the frame predicted by another "face-recognization"  model to located the human faces. Otherwise it will pass the face detection model directly.So my goal is to load two different models into a Deeplens Device. But when I operated on the project manage website(DeepLens>Projects>Object-detection>Edit>Add Model),I found out it can only load one model at the same time.I am wondering if I can load two model at the same time ? Or I should load them manully put the model into the deeplens locally not by the website. Or it is totally not working.Regards!REdited by: RuiAcc on Nov 12, 2020 12:21 AMFollowComment"

Answer: "0Hi RuiAcc,Through the console, you can only load one model. However, you can load multiple models manually into DeepLens locally and use them in your project.You can see how that is done here:https://aws.amazon.com/blogs/machine-learning/build-a-work-from-home-posture-tracker-with-aws-deeplens-and-gluoncv/CommentShareAWS-User-6762945answered 3 years ago0I see. Thanks for your helping!CommentShareRuiAccanswered 3 years ago"


Question: Is it possible to change the assignPublicIp setting of running ecs fargate to disable?

"I would like to operate the currently operating fargate as a private network.So I want to set assignPublicIp to disable, but I wonder if there is a way to do it with console or cli.You can re-edit and redistribute it, but please inquire if there is an easier way.FollowComment"

Answer: "0Hi,I see that you are asking if it is possible to change the assignPublicIp setting of running ecs fargate to disable.As at present, you cannot update a running task. You can stop it and start another one with the correct network changes.Refer to all the AWS CLI ECS commandsCommentShareOlawale-AWSanswered 9 months ago"


Question: Changing Monitoring Level

"How do I change the monitoring level after a MSK cluster has been created ? Is this something that is possible on the CLI ? I did not see any documentation around this.Thanks,JasonFollowComment"

Answer: "0Currently you can not update the monitoring level of an existing cluster, but we will support that feature in the future.  You can set the monitoring level of clusters during the create work flow today.  ThanksCommentShareAWS-User-6643836answered 4 years ago0Is it still not possible to change the monitoring?We have a production MSK cluster in use where PerTopic monitoring is costing more than running the cluster itself.Re-creating and migrating the cluster ins't feasible at this time.CommentSharetaylorbroadwinganswered 4 years ago0Updating your monitoring level is now supported using the update monitoring API or from the MSK console.CommentShareAWS-User-6643836answered 3 years ago"


Question: Cannot install greengrass-cli after updating Nucleus

"I updated the configuration of aws.greengrass.Nucleus by deploying it from IoT console to my core device, which is a Raspberry pi. After that, the directory (/greengrass/v2/packages/artifacts-unarchived/aws.greengrass.Cli/2.0.5/aws.greengrass.cli.client/cliclient-2.0.0-SNAPSHOT/bin/greengrass-cli) greengrass-cli was linked to disappeared. So I tried to deploy greengrass-cli from IoT console and it fails. The greengrass log file looks like this:2021-03-16T20:26:40.983Z [INFO] (Serialized listener processor) com.aws.greengrass.componentmanager.ComponentStore: plugin-load. Digest from store: DhhOGRdYaJ00U39VF1PHPdR9MFecLDvP4QW25GNPPDw=. {}2021-03-16T20:26:40.983Z [INFO] (Serialized listener processor) com.aws.greengrass.componentmanager.ComponentStore: plugin-load. Digest from recipe: DhhOGRdYaJ00U39VF1PHPdR9MFecLDvP4QW25GNPPDw=. {}2021-03-16T20:26:40.994Z [INFO] (Serialized listener processor) com.aws.greengrass.cli.CLIService: Waiting for the desired state list. {serviceName=aws.greengrass.Cli, currentState=NEW}2021-03-16T20:26:40.995Z [ERROR] (Serialized listener processor) com.aws.greengrass.lifecyclemanager.GenericExternalService: Error while setting up dependencies from subscription. {serviceName=main, currentState=FINISHED}com.aws.greengrass.lifecyclemanager.exceptions.ServiceLoadException: Can't create Greengrass Service instance CLIServiceat com.aws.greengrass.lifecyclemanager.Kernel.lambda$locate$2(Kernel.java:450)at com.aws.greengrass.dependency.Context$Value.computeObjectIfEmpty(Context.java:557)at com.aws.greengrass.lifecyclemanager.Kernel.locate(Kernel.java:360)at com.aws.greengrass.lifecyclemanager.GreengrassService.getDependencyTypeMap(GreengrassService.java:546)at com.aws.greengrass.lifecyclemanager.GreengrassService.setupDependencies(GreengrassService.java:585)at com.aws.greengrass.lifecyclemanager.GreengrassService.lambda$initDependenciesTopic$0(GreengrassService.java:168)at com.aws.greengrass.config.Topic.fire(Topic.java:246)at com.aws.greengrass.config.Topic.lambda$withNewerValue$0(Topic.java:235)at com.aws.greengrass.dependency.Context$1.run(Context.java:67)Caused by: java.lang.IllegalArgumentException: Can't create instance of com.aws.greengrass.lifecyclemanager.GreengrassServiceat com.aws.greengrass.dependency.Context$Value.constructObjectWithInjection(Context.java:484)at com.aws.greengrass.dependency.Context$Value.get(Context.java:431)at com.aws.greengrass.dependency.Context.lambda$put$2(Context.java:175)at java.util.concurrent.ConcurrentHashMap.compute(ConcurrentHashMap.java:1877)at com.aws.greengrass.dependency.Context.put(Context.java:171)at com.aws.greengrass.lifecyclemanager.Kernel.lambda$locate$2(Kernel.java:439)... 8 moreCaused by: java.lang.NoSuchMethodException: No usable injection constructor for class com.aws.greengrass.lifecyclemanager.GreengrassServiceat com.aws.greengrass.dependency.Context$Value.pickConstructor(Context.java:539)at com.aws.greengrass.dependency.Context$Value.constructObjectWithInjection(Context.java:472)... 13 more2021-03-16T20:26:41.638Z [INFO] (Serialized listener processor) com.aws.greengrass.componentmanager.GreengrassComponentServiceClientFactory: initialize-greengrass-client. {service-region=us-west-2, service-endpoint=https://greengrass-ats.iot.us-west-2.amazonaws.com:8443}2021-03-16T20:26:44.286Z [INFO] (Serialized listener processor) com.aws.greengrass.componentmanager.GreengrassComponentServiceClientFactory: initialize-greengrass-client. {service-region=us-west-2, service-endpoint=https://greengrass-ats.iot.us-west-2.amazonaws.com:8443}2021-03-16T20:26:44.509Z [INFO] (Serialized listener processor) com.aws.greengrass.componentmanager.ComponentStore: plugin-load. Digest from store: DhhOGRdYaJ00U39VF1PHPdR9MFecLDvP4QW25GNPPDw=. {}2021-03-16T20:26:44.509Z [INFO] (Serialized listener processor) com.aws.greengrass.componentmanager.ComponentStore: plugin-load. Digest from recipe: DhhOGRdYaJ00U39VF1PHPdR9MFecLDvP4QW25GNPPDw=. {}2021-03-16T20:26:44.518Z [INFO] (Serialized listener processor) com.aws.greengrass.cli.CLIService: Waiting for the desired state list. {serviceName=aws.greengrass.Cli, currentState=NEW}2021-03-16T20:26:44.519Z [ERROR] (pool-2-thread-30) com.aws.greengrass.deployment.activator.DeploymentActivator: merge-config. Deployment failed. {deploymentId=arn:aws:greengrass:us-west-2:308868511064:configuration:thing/myPiThing:13}com.aws.greengrass.lifecyclemanager.exceptions.ServiceLoadException: Can't create Greengrass Service instance CLIServiceat com.aws.greengrass.lifecyclemanager.Kernel.lambda$locate$2(Kernel.java:450)at com.aws.greengrass.dependency.Context$Value.computeObjectIfEmpty(Context.java:557)at com.aws.greengrass.lifecyclemanager.Kernel.locate(Kernel.java:360)at com.aws.greengrass.deployment.DeploymentConfigMerger$AggregateServicesChangeManager.startNewServices(DeploymentConfigMerger.java:295)at com.aws.greengrass.deployment.activator.DefaultActivator.lambda$activate$0(DefaultActivator.java:67)at com.aws.greengrass.dependency.Context.lambda$runOnPublishQueueAndWait$6(Context.java:293)at com.aws.greengrass.dependency.Context$1.run(Context.java:67)Caused by: java.lang.IllegalArgumentException: Can't create instance of com.aws.greengrass.lifecyclemanager.GreengrassServiceat com.aws.greengrass.dependency.Context$Value.constructObjectWithInjection(Context.java:484)at com.aws.greengrass.dependency.Context$Value.get(Context.java:431)at com.aws.greengrass.dependency.Context.lambda$put$2(Context.java:175)at java.util.concurrent.ConcurrentHashMap.compute(ConcurrentHashMap.java:1877)at com.aws.greengrass.dependency.Context.put(Context.java:171)at com.aws.greengrass.lifecyclemanager.Kernel.lambda$locate$2(Kernel.java:439)... 6 moreCaused by: java.lang.NoSuchMethodException: No usable injection constructor for class com.aws.greengrass.lifecyclemanager.GreengrassServiceat com.aws.greengrass.dependency.Context$Value.pickConstructor(Context.java:539)at com.aws.greengrass.dependency.Context$Value.constructObjectWithInjection(Context.java:472)... 11 more2021-03-16T20:26:44.521Z [INFO] (pool-2-thread-30) com.aws.greengrass.deployment.activator.DeploymentActivator: merge-config. Rolling back failed deployment. {deploymentId=arn:aws:greengrass:us-west-2:308868511064:configuration:thing/myPiThing:13}I made sure my JAVA_HOME is pointing to the correct directory. Other components appear to be running fine. Thanks!FollowComment"

Answer: "0Hello,Thank you for bringing this to our attention. We are aware of this issue and it is being patched in an upcoming version of Greengrass. In the meantime, could you try restarting Greengrass and then attempting the deployment again? That should resolve this.AVEdited by: av-aws on Apr 6, 2021 5:36 PMCommentShareavipinkuanswered 2 years ago0Thank you, I will give it a try.CommentSharejcaianswered 2 years ago"


Question: NotFoundException: API

"I have a django project that uses codebuild that was set up previously by other web developers. I made changes to my repository on codecommit and when code pipeline tries to run, I have this error message. raise error_class(parsed_response, operation_name)botocore.errorfactory.NotFoundException: An error occurred (NotFoundException) when calling the GetRestApi operation: Invalid API identifier specified. I checked API gateway but couldn't find any API identifier with that name and since it runs through codebuild and code pipeline, I can't change that manually myself. I am not sure how to fix this and would love to rollback to a version of my website that worked because now I have an "internal server error" whenever anyone tries to go on the website.FollowComment"

Answer: "0Hello,From your query, I understand that you have made changes to your repository on code commit and when the code pipeline tries to run, you were observing the below message:error message. raise error_class(parsed_response, operation_name) botocore.errorfactory.NotFoundException: An error occurred (NotFoundException) when calling the GetRestApi operation: Invalid API identifier specifiedThis kind of message generally occurs when you are using boto3 client for 'apigatewayv2' with REST API. Kindly note that REST API is not V2 API and you need to use boto3 client for 'apigateway' with REST API. API Gateway V2 is used to deploy and create websocket APIs, whereas Version 1 is used to deploy and create REST APIs.A sample snippet will be something like this:==========import boto3client = boto3.client('apigateway')response = client.get_rest_api(restApiId='string')==========[+] https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/apigateway/client/get_rest_api.html#CommentShareSUPPORT ENGINEERrePost-User-2673297answered 2 months ago"


Question: Allow communication between EC2 instances running under different AWS Accounts

"Hello,I am trying to setup SSO between an EC2 instance running Gitlab and an EC2 instance with Active Directory following this documentation : "https://docs.gitlab.com/ee/ci/cloud_services/aws/".I have tried to add our Gitlab address in IAM Identity Providers but I have this message "could not connect to openid configuration of provider".The issue, I think, is that our Active Directory EC2 instance is running under a different account than our Gitlab EC2 instance.Also, our Gitlab EC2 instance is registered in a private zone in Route 53 , under this different account.Do you know how we can allow communication between EC2 instances running under different account ?RémiFollowComment"

Answer: "1I think that the key here is that you're using a private zone in Route 53 - SSO requires that the identity provider be public and that means being publicly resolvable and having a publicly accessible endpoint.As far as different accounts go: Most networking components in AWS are account-agnostic once connectivity is established between them. For private networks that means things like VPC Peering, Transit Gateway and other mechanisms. For publicly accessible services accounts don't matter at all.CommentShareEXPERTBrettski-AWSanswered 2 months ago"


Question: How to make a AppConfig-managed configuration file on S3 available to an ECS service on Fargate?

"Dear community,I am trying to create a application with the following properties:the different components of the app will be shipped in docker containers and are hosted on ECReach container will have some configuration file hosted on S3 that will be updated dynamically during deploymentthe containers will be deployed with ECS on Amazon Fargate as a serviceCurrently, I am running a minimal version of the app in the following way:Uploaded an image to ECR that contains the config file due to copying (static config)FROM eclipse-mosquittoCOPY ./mosquitto.conf /mosquitto/config/mosquitto.confDefined a task with only this image and deployed it with ECS on FargateLoaded the configuration file into an S3 BucketCreated a configuration profile on AppConfigHere I got stuck. In my mind, several question arise:How do I connect the config file in the container to the AppConfig managed file on S3?When a configuration file is updated, can I hook into this process to restart the server inside the container?Is using AppConfig appropriate here? Or would it be easier to restart the container and use a pull command from S3 on container startup to update the file?I appreciate your help!Best regards,FollowComment"

Answer: "1Accepted AnswerAppConfig may not be the best fit for this use case as described: it doesn't deliver configuration files to disk, but instead requires the application to call its API to refresh the configuration. (So you would then update your configuration in AppConfig, deploy it, and your application would, on next refresh*, receive the updated configuration.) Your application would need to be modified to call the AppConfig API instead of loading the configuration off disk. If you're happy reading Python, there's a sample library which you can dig in to to see how you might do it.However, if you can arrange for a script to run inside your container, you could use the AWS CLI (or another language with an SDK, e.g. Python/boto3) to fetch the configuration from the API and store it in the file for your application, and then notify the application it should reload. An alternative for the last step would be to have the application monitor the modification time of the file, and reload when it is updated. AppConfig itself does not provide any native tooling to do this, I'm afraid, but the documentation has sample AWS CLI commands to get you started.If neither of those options suit you, then the option you suggest in your third point may be the most straightforward to get you unblocked, although of course you lose some of AppConfig's benefits like validation and automatic rollbacks.(* subject to your deployment rate)CommentShareEXPERTJames_Sanswered 7 months agoSebastian 7 months agoThank you for the quick reply. I will try to modify my setup to work with the suggested "pull"-workflow as I really like the functionality provided by AppConfig. At least I am on the right track now!Share"


Question: Application Load Balancer IP Change Event

"My customer is experience an issue of their Application Load Balancer IP change.  They're using external DNS to point to the ALB CNAME.  But when the IP address changed, somehow the external DNS cannot return the correct IP in the right time.  While we're investigating this issue on the external DNS server, I am wondering whether there is a way to get notified from EventBridge, in regarding the IP address change of ALB.  In that way, such an event could trigger an action that (might) manually refresh the external DNS record.FollowComment"

Answer: "1When the IP address of the ALB changes, a NetworkInterface creation event is issued to CloudTrail.I would need to create a Lambda or something that triggers that event and checks the IP address of the ALB.However, as mentioned in other answers, it is not recommended to set the IP address of the ALB directly, so we recommend using NLB or Global Accelerator to fix the IP address.CommentShareEXPERTRiku_Kobayashianswered 4 days ago0The recommendation would be to use AWS Network Loadbalancer on top of your application loadbalancer. Network Loadbalancer will have a static IP address and It works on Layer 4 hence your request will be forwared to the ALB and all the ALB configured rules would still work.It is not a recommended practice to map the ALB IP to your DNS Records.CommentShareGovind Kumaranswered 4 days ago0Could AWS Global Accelerator could be another approach.CommentShareEXPERTkentradanswered 4 days ago"


Question: RDS Storage upgrade - failure Error: Error modifying DB Instance: InvalidParameterCombination: Invalid storage size for engine name postgres and storage type gp2: 2400

When we are attempting to upgrade the storage on our RDS instance from 2200GB to 2400GB we are met with the following error. This is strange as I thought there were no storage limitations in an upgrade for non-autoscaling storage.InvalidParameterCombination: Invalid storage size for engine name postgres and storage type gp2: 2400What are the minimum values we can upgrade an RDS instances storage by?FollowComment

Answer: "2Accepted AnswerAccording to the documentation, Working with storage for Amazon RDS DB instances:"When you increase the allocated storage, it must be by at least 10 percent. If you try to increase the value by less than 10 percent, you get an error."Increase it by 220.CommentShareEXPERTkentradanswered a year ago1Note that the error indicates that the target storage size is invalid. When you increase the allocated storage, it must be by at least 10 percent. If you try to increase the value by less than 10 percent, you get an error. Try with a bigger increment and it should work.Good luck!CommentShareD-Raoanswered a year ago"


Question: Include s3:ListObjectsV2 as action in bucket policy

"For some reason I'm not able to include ListObjects or ListObjectsV2 as action in a S3 bucket policy. When trying to save a policy including:    {          "Sid": "aaaa",          "Effect": "Allow",          "Principal": "*",          "Action": "s3:ListObjectsV2",          "Resource": "arn:aws:s3:::_bucket_"      }  I get an error:Unknown Error - An unexpected error occurred.API response  - Policy has invalid actionThe same happens with ListObjects. Including other actions is ok, including GetObject and PutObject:{"Sid": "aaaa","Effect": "Allow","Principal": "","Action": ["s3:PutObject","s3:GetObject"],"Resource": "arn:aws:s3:::bucket/"}I try to access files from a bucket assessible to authenticated users via the aws cli. I'm able to download files using aws cp, but when trying aws ls, I get the error message:An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access DeniedI've been searching the web without finding an answer, so I hope somebody can help....Edited by: jehake on Mar 5, 2021 12:11 AMFollowComment"

Answer: "1Hi,Kindly note ListObjects or ListObjectsV2 is the name of the API call that lists the objects in a bucket. You will need to use s3:ListBucket in the action element to allow a user to list the objects in a bucket.https://aws.amazon.com/premiumsupport/knowledge-center/s3-access-denied-listobjects-sync/Here is how I would write the policy to list the objects in a bucket.{"Version": "2012-10-17","Id": "S3PolicyId1","Statement": [{"Sid": "AllowList","Effect": "Allow","Principal": "*","Action": "s3:ListBucket","Resource": "arn:aws:s3:::bucketname"}]}Regards,PavithraCommentSharePavithra-AWSanswered 2 years ago0Hello jehake, Has your problem of your code been resolve? Let us know. Also, remember to click on the "Accept" button when an answer provided in the community helped you. This allows other community members to also benefit from it. Thank you for your participation.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago"


Question: Unable to create new OpsItems from EventBridge when using Input Transformer for deduplication and adding category and severity values

"Apologize to all for the duplicate post.  I created my login under the wrong account when I initially posted this question.I’m able to generate a new OpsItem for any EC2, SecurityGroup, or VPC configuration change using an EventBridge rule with the following event pattern.{ "source": "aws.config", "detail-type": "Config Configuration Item Change", "detail": { "messageType": "ConfigurationItemChangeNotification", "configurationItem": { "resourceType": "AWS::EC2::Instance", "AWS::EC2::SecurityGroup", "AWS::EC2::VPC" } } }The rule and target work great when using Matched event for the Input but I noticed that launching one EC2 using the AWS wizard creates at least three OpsItems, one for each resourceType. Therefore I’d like to implement a deduplication string to cut down on the number of OpsItems generated to one if possible and I’d also like to attach a category and severity to the new OpsItem. I’m trying to use an Input Transformer as recommended by the AWS documentation but even the most simplest of Input Transformers when applied prevent any new OpsItems from being generated. When I've tested, I've also ensured that all previous OpsItems were resolved. Can anyone tell me what might be blocking the creation of any new OpsItems when using this Input Transformer configuration?Here’s what I have configured now.Input path { "awsAccountId": "$.detail.configurationItem.awsAccountId", "awsRegion": "$.detail.configurationItem.awsRegion", "configurationItemCaptureTime": "$.detail.configurationItem.configurationItemCaptureTime", "detail-type": "$.detail-type", "messageType": "$.detail.messageType", "notificationCreationTime": "$.detail.notificationCreationTime", "region": "$.region", "resourceId": "$.detail.configurationItem.resourceId", "resourceType": "$.detail.configurationItem.resourceType", "resources": "$.resources", "source": "$.source", "time": "$.time" }Input template { "awsAccountId": "<awsAccountId>", "awsRegion": "<awsRegion>", "configurationItemCaptureTime": "<configurationItemCaptureTime>", "resourceId": "<resourceId>", "resourceType": "<resourceType>","title": "Template under ConfigDrift-EC2-Dedup4", "description": "Configuration Drift Detected.", "category": "Security", "severity": "3", "origination": "EventBridge Rule - ConfigDrift-EC2-Dedup", "detail-type": "<detail-type>", "source": "<source>", "time": "<time>", "region": "<region>", "resources": "<resources>", "messageType": "<messageType>", "notificationCreationTime": "<notificationCreationTime>", "operationalData": { "/aws/dedup": { "type": "SearchableString", "value": "{"dedupString":"ConfigurationItemChangeNotification"}" } } }Output when using the AWS supplied Sample event called “Config Configuration Item Change” { "awsAccountId": "123456789012", "awsRegion": "us-east-1", "configurationItemCaptureTime": "2022-03-16T01:10:50.837Z", "resourceId": "fs-01f0d526165b57f95", "resourceType": "AWS::EFS::FileSystem","title": "Template under ConfigDrift-EC2-Dedup4", "description": "Configuration Drift Detected.", "category": "Security", "severity": "3", "origination": "EventBridge Rule - ConfigDrift-EC2-Dedup", "detail-type": "Config Configuration Item Change", "source": "aws.config", "time": "2022-03-16T01:10:51Z", "region": "us-east-1", "resources": "arn:aws:elasticfilesystem:us-east-1:123456789012:file-system/fs-01f0d526165b57f95", "messageType": "ConfigurationItemChangeNotification", "notificationCreationTime": "2022-03-16T01:10:51.976Z", "operationalData": { "/aws/dedup": { "type": "SearchableString", "value": "{"dedupString":"ConfigurationItemChangeNotification"}" } } }FollowComment"

Answer: "0Accepted AnswerHi, and thanks for reaching out!To look in to this question, I set up a similar workflow as yours:1. EventBridge rule to detect "Config Configuration Item Change" events from the Config service, using your same event pattern.2. Target is a Systems Manager Ops Item3. Target configured with Input Transformer to send data formatted as you have specified.I was able to replicate the same behavior you described: in my first few tests without utilizing the input transformer, the Ops items were created correctly (I triggered the rule by just modifying a Security Group). But when implementing the Input Transformer configuration you supplied, I ran in to the same blocker where the Ops Item was not created, and the rule reported a Failed Invocation.I set up a DLQ on the EventBridge rule target, and found that the Failed Invocation was due to the following error being thrown:'ERROR_MESSAGE': {'stringValue': 'Invalid input for target.'}Checking the required parameters for the CreateOpsItem API, it turns out the Ops Items are failing to create due to the parameters being passed by the event rule. Creating Ops Items requires a specific set of parameters, some of which were being supplied by your input transformer, but the rest of the fields being passed are not supported as part of a CreateOpsItem call.Without the Input Transformer, it looks like the raw event data just gets passed as the "operationalData" field. But when using the Input Transformer, it appears to be necessary to specify the correct expected fields.To test this, I stripped the Input Paths down to just fields expected by the CreateOpsItem call's top level fields. As well, to be sure you can pass other custom event data as part of the Ops Item, I used other variable event data as Operational Data keys. Note: Operational data keys can't begin with the following: amazon , aws , amzn , ssm , /amazon , /aws , /amzn , /ssm, so I changed them to simply "account" and "region"Input Path:{  "awsAccountId": "$.detail.configurationItem.awsAccountId",  "awsRegion": "$.detail.configurationItem.awsRegion",  "configurationItemCaptureTime": "$.detail.configurationItem.configurationItemCaptureTime",  "detail-type": "$.detail-type",  "messageType": "$.detail.messageType",  "notificationCreationTime": "$.detail.notificationCreationTime",  "region": "$.region",  "resourceId": "$.detail.configurationItem.resourceId",  "resourceType": "$.detail.configurationItem.resourceType",  "resources": "$.resources",  "source": "$.source",  "time": "$.time"}Input Template:{"title": "Template under ConfigDrift-EC2-Dedup4","description": "Configuration Drift Detected.","category": "Security","source": "EC2","severity": "3","operationalData": {"/aws/dedup": {"type": "SearchableString","value": "{\"dedupString\":\"ConfigurationItemChangeNotification\"}"},"account": {"value": "<awsAccountId>"},"region": {"value": "<awsRegion>"}}}Invoking the rule again with this Input Transformer configuration, the Ops Item was successfully created, including the dedupString as an OpsItem detail, and the account and region variables passed in the Operational Data fields.If you wish to pass more of your original custom fields that are not expected top-level fields of a CreateOpsItem call, you can pass them as custom Operational Data key-value pairs as seen above.Hope this helps!CommentShareSUPPORT ENGINEERJustin_Banswered a year agoAWS-User-1369b 10 months agoThe deduplication worked just as you advised in my environment but I ended up redesigning the EventBridge rules entirely and no longer needed the deduplication.  However, the insights I gained from your extremely helpful response helped me write and troubleshoot the Input Transformers I needed for my new EventBridge rules.  Thank you!Share"


Question: CNAME record redirection

Helloi have deployed Redcap Cloudformation in ELB in a hosted zone example.net and my application is pointed to staging.example.net and it works perfectly.i have another hosted zone name mydomaine.org and would like to redirect prod.mydomaine.org to staging.example.net.What's the best practice ?i tried several configurations without success. When i try to reach the website prod.mydomaine.org i get connection refused error on the browser.The Redcap Cloudformation generate certificate if this information can help to debugThanksFollowComment

Answer: "1Accepted AnswerThe first thing to check is to make sure that your DNS is working. You can do this with nslookup or dig or there are many third-party tools - just make sure that prod.mydomaine.org resolves to staging.example.net and then to the IP address of the ELB.Next, if you're using HTTPS the ELB must offer both certificates. That's because the browser will try to connect to prod.mydomaine.org but the ELB doesn't know that the connection has been redirected from there. If it is expecting the browser to connect to staging.example.net that's the certificate that it will offer. And the browser doesn't know about staging.example.net so it will throw an error about certificates being invalid.This blog post covers multiple certificates using AWS Certificate Manager but it might help you with your custom certificate.CommentShareEXPERTBrettski-AWSanswered a year agoEXPERTToni_Sreviewed a year agoBabs a year agoThank you very much . This work perfectlyShare"


Question: CodeBuild build failed with no log generated

"Hi,I have a CodeBuild project which was failing and no log seems to be output from "Build logs". However in "Phase details" tab, It was shown that the failure comes from "Build" phase. Since there is no log available. It seems kind of strange that the log does not get generated. Am I missing something here? It was not mentioned in CodeBuild FAQ either. Appreciate the helps provided.Thank you.FollowComment"

Answer: "1You have the option to enable logging to Cloudwatch and / or S3. Check if you have these enabled. Nothing shows up in Build logs tab if Cloudwatch logs are disabledCommentShareSydanswered 9 months agoNorazfizal 9 months agoHi Syd,Thanks for the answer. I have however checked CloudWatch logs. Is there any other permissions which could be missing here?ShareSyd 9 months agoYou need to ensure that the Service Role used by CodeBuild has permissions to send logs to Cloudwatch. Codebuild can do it for you if you select the check box. BTW didnt understand what you meant by checked Cloudwatch logs. Does it mean you checked logs but didnt find any entry, or nothing useful in Cloudwatch logs even though it's enabled?Just wanted to mention that if CodeBuild is set to configure sent to Cloudwatch, those logs are visible in Codebuild - Buildlogs tab itself for the subsequent run.ShareNorazfizal 9 months agoIn project settings, Under Logs section. I checked and configure 'Group name' and 'Stream name'CloudWatch logs - optionalChecking this option will upload build output logs to CloudWatch.Service role permission was checked as well. "Allow AWS CodeBuild to modify this service role so it can be used with this build project"And when I refer to the policy. This part is defined:-        "Sid": "",        "Effect": "Allow",        "Action": [            "logs:PutLogEvents",            "logs:CreateLogStream",            "logs:CreateLogGroup"        ],        "Resource": "*"What puzzled me is, it was working before and stop working since 4 days ago. I compared the latest run to the successful run but nothing changes on configuration part.ShareNorazfizal 9 months agoI'm not sure if this is relevant. Under "Phase details"  on "FINALIZING" phase whilst shown as 'Succeeded' inside context there is an error belowRequestError: send request failed caused by: Post "https://logs.us-east-2.amazonaws.com/": net/http: TLS handshake timeoutI am not sure what this means.ShareSyd 9 months agoPolicy is correct. The TLS error is related to Cloudwatch logs endpoint. It could be a transient error unless you see it on every build. In which case it's difficult to identify the cause is with the limited info available. Is the test build showing a status of Successful despite the context text in FINALIZING phase? It would mean apart from the logging aspect the build completes.Share"


Question: How to find redshift cluster version details

I am facing lot of redshift problems lately which has been boiled down to a redshift cluster upgrade that occurred. The problem is to search for details for the old and new cluster versions.Previous redshift cluster version: 1.0.34922Current redshift cluster version: 1.0.34928Can someone please help me with the documentation of these two cluster versions?What I tried and failed: visiting this page(https://docs.aws.amazon.com/redshift/latest/mgmt/rs-mgmt-cluster-version-notes.html) and then re:post redshift announcements (https://forums.aws.amazon.com/forum.jspa?forumID=155&start=0) to search for the cluster details.FollowComment

Answer: "0Hi ,the two version you mention are the last minor release of tow different different Major releases, you were looking in the right places:Previous redshift cluster version: 1.0.34922 : Major Version (10/20/2021)Current redshift cluster version: 1.0.34928: Major Version (11/15/2021)hope this helps,CommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: MSK Connect Postgres connector fails during getting Glue avro schema details

"I have problem using MSK Postgres Debezium connector with Glue Schema Registry avro serialisation, and getting "connect timed out" to GSR. Logs are following:[Worker-051272e114b69c525] [2022-08-17 08:47:55,387] ERROR [route-events-connector|task-0] WorkerSourceTask{id=route-events-connector-0} Task threw an uncaught and unrecoverable exception. Task is being killed and will not recover until manually restarted (org.apache.kafka.connect.runtime.WorkerTask:191)...com.amazonaws.services.schemaregistry.kafkaconnect.AWSKafkaAvroConverter.fromConnectData(AWSKafkaAvroConverter.java:97)[Worker-051272e114b69c525] at org.apache.kafka.connect.storage.Converter.fromConnectData(Converter.java:63)[Worker-051272e114b69c525] at org.apache.kafka.connect.runtime.WorkerSourceTask.lambda$convertTransformedRecord$2(WorkerSourceTask.java:313)[Worker-051272e114b69c525] at com.amazonaws.services.schemaregistry.kafkaconnect.AWSKafkaAvroConverter.fromConnectData(AWSKafkaAvroConverter.java:95)[Worker-051272e114b69c525] ... 15 more[Worker-051272e114b69c525] Caused by: com.amazonaws.services.schemaregistry.exception.AWSSchemaRegistryException: Failed to get schemaVersionId by schema definition for schema name = key-schemacom.amazonaws.services.schemaregistry.common.AWSSchemaRegistryClient.getSchemaVersionIdByDefinition(AWSSchemaRegistryClient.java:144)[Worker-051272e114b69c525] ... 28 more[Worker-051272e114b69c525] Caused by: java.net.SocketTimeoutException: connect timed out[Worker-051272e114b69c525] at java.base/java.net.PlainSocketImpl.socketConnect(Native Method)Related to GSR connector config:...key.converter.region=eu-central-1key.converter.registry.name=my-schema-registrykey.converter.schemaAutoRegistrationEnabled=truekey.converter.schemaName=key-schemakey.converter.avroRecordType=GENERIC_RECORDkey.converter=com.amazonaws.services.schemaregistry.kafkaconnect.AWSKafkaAvroConvertervalue.converter.region=eu-central-1value.converter.registry.name=my-schema-registryvalue.converter.schemaAutoRegistrationEnabled=truevalue.converter.schemaName=value-schemavalue.converter.avroRecordType=GENERIC_RECORDvalue.converter=com.amazonaws.services.schemaregistry.kafkaconnect.AWSKafkaAvroConverterWe have already configured MSK connect json Postgres connectors which are working fine and publishing data to MSK topics.Has anyone successfully configured MSK Connect with Glue Schema Registry for avro serialization? Thanks.FollowComment"

Answer: "1Hi,Please note that it is possible to configure MSK Connect with Glue Schema Registry for avro serialization as seen below:-- https://github.com/awslabs/aws-glue-schema-registry#using-kafka-connect-with-aws-glue-schema-registryAfter following the above instructions if you still face issues, I request you to please open a case with AWS Support with the following information:ARN of MSKARN of failed connectorCloudwatch logs of connectorConnector configurationPlease open a support case with AWS Support using the following link:https://support.console.aws.amazon.com/support/home?#/case/createCommentShareSUPPORT ENGINEERAWS-User-2071047answered 9 months agoValeriy 9 months agoHi, thank you, submitted case to AWS support.ValeriyShare0In our case VPC endpoint creation for GSR helped whereas all services were within same VPC. Following connector property pointing to that endpoint made connector work properly:value.converter.endpoint=https://vpce-XYZ.glue.our-region.vpce.amazonaws.comhope this will help someone as well.CommentShareValeriyanswered 8 months ago"


Question: Default username for WordPress in LightSail

I created a WordPress app in LightSail and got the password from here - https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-quick-start-guide-wordpress - but what's the default username ?FollowComment

Answer: "1Accepted AnswerFrom that guide, it looks like the default username should be user.CommentShareEdanswered a year ago0HelloTry with UserName userCommentShareGKanswered a year agoallcareerguru a year agoThank You very much.Share"


Question: How to get traffic from a public API Gateway to a private one?

"I would like to use private API Gateways to organise Lambda functions into microservices, while keeping them invisible from the public internet.  I would then like to expose specific calls using a public API Gateway.How do I get traffic from my public API Gateway to a private API Gateway?What I've looked at so farIn the past, for container-based resources, I've used the following pattern:Internet -> API Gateway -> VPC Link -> VPC[NLB -> ECS]However, I can't find an equivalent bridge to get specific traffic to a private API Gateway.  I.e.Internet -> API Gateway -> ? -> Private Gateway -> LambdaMy instinct tells me that a network-based solution should exist (equivalent to VPC Link), but so far the only suggestions I've had involve:Solving using compute ( Internet -> API Gateway -> VPC[Lambda proxy] -> Private Gateway -> Lambda )Solving using load balancers ( Internet -> API Gateway -> VPC Link -> VPC[NLB -> ALB] -> Private Gateway -> Lambda )Both of these approaches strike me as using the wrong (and expensive!) tools for the job.  I.e. Compute where no computation is required and (two!!) load balancers where no load balancing is required (as Lambda effectively self-loadbalances).Alternative solutionsPerhaps there's a better way (other than a private API Gateway) to organise collections of serverless resources into microservices.  I'm attempting to use them to present a like-for-like interface that my container-based microservices would have.  E.g. Documented (Open API spec), authentication, traffic monitoring, etc.If using private API Gateways to wrap internal resources into microservices is actually a misuse, and there's a better way to do it, I'm happy to hear it.FollowComment"

Answer: "3Accepted AnswerThe only way to get from API Gateway to private resources is using VPC Link, and VPC Link requires an NLB (No need for an ALB between the NLB and the endpoints). So your path will be: Public API -> VPC Link -> NLB -> Private API VPC Endpoint -> Private API.Saying that, you don't really must use private APIs. you could just protect the internal APIs' endpoints using IAM and the ones that you want public using some other approach (e.g. Cognito).CommentShareEXPERTUrianswered a year agoANeeson a year agoIt's unfortunate that the NLB is still required, but at least it's better than both my current suggestions (+1).  If no alternatives present themselves in the next 24 hours, I'll mark this as the accepted answer.  Thanks!Also, you're right about strict IAM + Cognito.  And I will be using both in this solution.  But I've seen enough loose/misconfigured IAM policies in my time that I'll be a lot more confident with the additional network isolation.ShareANeeson a year ago@Uri what type of target group would you add to the NLB?ShareUri EXPERTa year agoLook at point #4 in this blog. It talks about custom domain names for private APIs, but the same idea applies.ShareANeeson a year agoAh!  Perfect.  That's exactly what I was looking for.  Marking as accepted.  Thank you.ShareSteef 4 months agoI've tried to configure the suggested way (public API's protected by Cognito and private using IAM Authorization) but when configuring a http_proxy from the public (Cognito protected) to the private (IAM protected) I keep getting 'forbidden' errors because a Role with correct policies are not part of the request. How would you configure the integration request to the API Gateway that is protected by IAM Authorization?Share"


Question: Get all A Records from route 53 using CLI and export to CSV

I've been trying to get all the listed A records on our system due to us having a mismatch between our instances and the number of A records we have.I have asked in numerous places and look online and it seems to be quite difficult to do.I either get only a partial listing or a listing with out extraneous information.What would be an aws cli command to get only a recordsFollowComment

Answer: "2There isnt a way to do this nativelyYou can try this cli command (from here)aws route53 list-resource-record-sets --hosted-zone-id "/hostedzone/Z#################" | jq -r '.ResourceRecordSets[] | [.Name, .Type, (.ResourceRecords[]? | .Value), .AliasTarget.DNSName?] | @csv'You may have issues if there are more than 1000 record sets as you will hit the pagination limit.You can also try a third party too like cli53 that can export the zone to BIND formatCommentShareEXPERTMatt-Banswered 9 months agoEXPERTChris_Greviewed 9 months ago"


Question: ".Net SDK upload file API, requires that the stream must be seek able and support Length property"

"I have a .NET web application that receives a stream over http from a client. The stream received from the client does not support the Length or Seek functionality. I need to upload this stream to S3. Therefore I am using the .net SDK https://www.nuget.org/packages/AWSSDK.S3/3.7.102According to the documentation from AWS S3 RestAPI, it seems that the length and seek functionality is not required:https://docs.aws.amazon.com/AmazonS3/latest/API/API_UploadPart.htmlOn this above link, the required parameters are marked with "Required: yes", but for "Content-Length", there is no requirement.I am using "UploadPartRequest" and "PutObjectRequest" but both of these requests do not work even by setting following parameters:DisablePayloadSigning = true,DisableMD5Stream = true,CalculateContentMD5Header = false,UseChunkEncoding = false,Could you please check this problem and fix it in SDK because without this fix, I must download the stream from client in an intermediate stream and must face a performance issues. Thanks.FollowComment"

Answer: "0Hi, @niaz.Could you please check this problem and fix it in SDKYou want to report a bug instead of asking a question?We can still have a discussion here, but perhaps it would be better to add the product team to the conversation.The AWS SDK for .NET is issue and version managed on GitHub and the .NET on AWS team is participating.https://github.com/dotnet/sdkYou can contribute to a quick fix by filing a bug report here.Additionally, the AWS Developers Slack has a .NET on AWS channel, so we can discuss improvements there as well.https://twitter.com/dotnetonAWS/status/1620180080377925632?s=20CommentShareEXPERTiwasaanswered 4 months ago0Hello, First I want to know if the documentation is correct or I am understanding it wrong. What should be the expected behavior from the Upload API. If you could please first make sure the expected behavior then I can submit a bug request.So the question is: Do I need the length and seek capability of the stream when I call PUT to upload an object with stream?ThanksCommentShareniazanswered 4 months ago0@niaz,Based on your description you want to pass through a file received over HTTP to S3. Naturally, seeking will not be supported because you are receiving a NetworkStream which streams content in chunks. The entire stream does not arrive at the client all at once. The Stream or NetworkStream object may not support reporting its length, but you can still determine the length. Your HTTP client will have received the Content-Length header and that will tell you the length of the stream. If absolutely necessary, you could wrap the stream with a custom Stream implementation that has the length from Content-Length and passes through all other operations to the original stream.The UploadPart API is for using a MIME-encoded, multipart documentation which is necessary send multiple files at once. Are you trying to send multiple, received files? Your description makes no mention of that. If you're not sending multiple files, why not just use PutObject?CommentShareChris Manswered 4 months ago0Thanks for the answer.A wrap stream like you wrote with Content-Length can be used, but this is unfortunately not possible. In some situations, our client does not provide the "Content-Length" to the Web API. The only solution then I see is the intermediate cache. Therefore I asked, if the "Content-Length" property is really required by S3 RestAPI, if not then I can add a bug report for .net SDK.The other thing related to Seek, there seems to be a bug for multipart upload but the simple object upload works. I have downloaded the code of .net SDK and debugged a bit, this bug I will report.Yes, we do use multi-part upload. In this case again the client decides, if a stream can contain the length or not. Under normal conditions, the multiple parts of the same file are uploaded simultaneously and the "Content-Length" is also available for me on the server. But in order to use this property I need to change the existing code and all the interfaces...Thanks,CommentShareniazanswered 4 months ago"


Question: Does opting out a phone number for SMS trigger any event?

"For a  "STOP"  reply to SMS, the phone number is opted out and it is added to opted out numbers list in AWS SNS. We need to capture this event to handle some logic in our application. Does the opting out action trigger any event that can be captured asynchronously?FollowComment"

Answer: "0According to this documentation: you can query to find out what numbers have opted out via ListPhoneNumbersOptedOut API or you can check an individual number with the CheckIfPhoneNumberIsOptedOut API. I don't see an event documented. An approach to take would be to use a scheduled event in AWS Event Bridge that would process this list and invoke events for each number, or new number, if you keep a list elsewhere.CommentShareRodney Lesteranswered 9 months ago"


Question: SSH Issues with instances launch in AZ US-EAST-1

"Hello,I am unable to SSH into instances launched in AZ US-EAST-1. When I launch the instance in AWS and I SSH into the instance I get a connection lost errorFollowComment"

Answer: "0Hello Oluwasegun,Please check the following:Security group allows incoming traffic on port 22Network Access Control List (NACL) is allows traffic on port 22More information can be found here:https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-resolve-ssh-connection-errors/Do also check If your EC2 instances are launched in the private or public subnets? If they are launched on the private subnets, you can use a bastion host to ssh.To configure a bastion host, you can follow this link:https://aws.amazon.com/blogs/security/securely-connect-to-linux-instances-running-in-a-private-amazon-vpc/Hope this helps!CommentSharepehjxanswered 3 months ago"


Question: Unable to sync file to WorkDocs with emojis in filename

"Hi everyone! Is there a way to sync files that have an emoji in the file name with the Mac application ? I would like the application to automatically sync my Obsidian vault, but it only uploads files with text-only filenames.FollowComment"


Question: Processing environmental data with netCDF files

"I'm looking for some experience, reference architecture, best practices about the processing of environmental data stored in netCDF files.FollowComment"


Question: AWS Cloud Practitioner Challenge -- Not Receiving Exam Discount Code

"I have several coworkers who registered for the AWS Cloud Practitioner Challenge and never received an exam discount code. They registered in early August 2022 (several on/around August 2), received a confirmation email for registering, but they still haven't received any kind of discount code via email (they checked their junk folders). It's been several business weeks without any kind of communication about the discount code. I even had one person register another time after not receiving any code, but they still didn't receive a code.We see that the terms and conditions say AWS will provide codes "while supplies last." Does anyone know if AWS is still passing out exam discount codes for the Cloud Practitioner exam? I didn't see anything else from the terms/conditions that explain why they wouldn't be qualified.FollowComment"

Answer: "0Hello,You can reach out to the Training & Certification team directly and check with them by raising a TT.Link- https://support.aws.amazon.com/#/contacts/aws-trainingCommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months ago"