Question: Is it possible to HTTP POST files to AWS Elastic File System?

"I need to process large files, 100MB-10GB, files using lambda function.  Files will first need to be uploaded to AWS EFS and then accessed/manipulated via AWS Lambda functions as shown in this diagram. The workflow is a little like processing videos on demand.Does AWS EFS support direct uploading of files similar to S3 signed URL uploads? if the answer is NO, then what is the easiest way to allow customers to upload files to EFS using a browser?FollowComment"

Answer: "1Accepted AnswerYou cannot transfer files to EFS directly using HTTPS. But you could transfer it to an S3 bucket and then use AWS DataSync to copy it into EFS. More information can be found here:https://docs.aws.amazon.com/efs/latest/ug/trnsfr-data-using-datasync.htmlThat said, you could also use S3 to store the file and then use AWS Lambda to process it using its ephemeral storage: https://aws.amazon.com/blogs/aws/aws-lambda-now-supports-up-to-10-gb-ephemeral-storage/CommentSharedspanswered 6 months ago"


Question: My site is offline

"I rebooted my site on lightsail because was offline and everything was fine again.And now is offline again and i can´t put it online again. It last less than 3 hours online after start to work again.I don´t know what is happening.Can someone help me?ThanksFollowCommentCarlo Mencarelli 5 months agoThis isn't easy to answer without any additional information. Can you give us any more details? Such as the type of Lightsail app deployed, what is the health of the instance and other components. Do you have any logs you can share?Share"

Answer: "2If your instance is unresponsive, review the status checks instance metrics to determine troubleshooting steps. Amazon Lightsail monitors the health of each instance with two status checks:System status check: The system status check detects issues with the underlying host that your instance runs on. If the underlying host is unresponsive or unreachable due to network, hardware, or software issues, then this status check fails.Instance status check: An instance status check failure indicates a problem with the instance due to operating system-level errors. OS-level errors include the following:Failure to boot the operating system.Failure to mount volumes correctly.File system issues.Incompatible drivers.Kernel panic.Instance status checks might also fail due to over-utilization of resources. The following are three of the most common reasons that your health check might fail due to over-utilization of resources:Your instance might operate in the burstable zone when under heavy load, This can make the instance unresponsive or cause the instance to crash.The root device is 100% full and the instance became stuck while booting.The processes running on the instance used all its memory, preventing the kernel from running.CommentShareOleksii Bebychanswered 4 months agoPauloSergio 4 months agoI´ll check all it out. I´m new on AWS and still learning how to use. Thanks a lot.Share0I´ll check all it out. I´m new on AWS and still learning how to use properly. Thanks a lot.CommentSharePauloSergioanswered 4 months ago0Hi,Thanks for using Lightsail. To add to the previous comment, we have some docs regarding instance metrics here:https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-viewing-instance-health-metricsIn particular, this may be of interest for you as we believe is the problem you are running into:https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-viewing-instance-health-metrics#cpu-utilization-zonesCommentShareAWS-Leslieanswered 4 months ago"


Question: Lambda not functioning during the process of Greengrass redeployment

"I have a long-lived Lambda function that publishes MQTT messages once every second to the IoT Core. And I can see the messages coming using the MQTT test client (under AWS IoT) in the AWS Console.However, I noticed that messages are not showing up (at least for quite a while) when I redeploy the Greengrass group. The messages showed up again once the redeployment had been finished. I can reproduce this simply by (re)deploying the current Greengrass group version in the AWS console, without changing anything.It seems that the Lambda function is frozen during the redeployment process. And this can last half a minute, or even longer than a minute, depending on how long the redeployment takes.This can cause big problems, especially when it is critical to respond immediately in some production scenarios.By the way, we are using Greengrass version 1.Thank you for your help.YuciFollowComment"

Answer: "0I think this is the expected behavior during deployments. We have also realized that Greengrass-aware devices got disconnect once a deployment starts (the core MQTT broker closes all connections).In general, I would say your solution cannot rely on 100% connectivity. Devices and cores can be offline or unreachable in some periods of time. If you have critical processes that cannot live with the nature of distributed systems, then you'd better handle them at the edge instead of on the cloud.CommentSharerodmazanswered 2 years ago0Hi rodmaz, thanks for your insights.As you mentioned, we do intend to handle them at the edge. The issue is that when we have a new version to redeploy to Greengrass Core at the edge, the Lambda functions running at the edge stops functioning during the redeployment process, which can be as long as a couple of minutes, depending on how long the redeployment process takes.Just would like to know what would be the best practice if this is a general issue with Greengrass (we are using Greengrass v1 at the moment.)Edited by: Yuci on Aug 11, 2021 7:03 AMCommentShareAWS-User-0654272answered 2 years ago0Hi,In Greengrass V1 any deployment starts by shutting everything down, then doing the deployment, and then starting everything back up again. There is no way around this.If you use Greengrass V2 most deployment do not take anything down unless you are changing versions of your software; even then it is only down for the minimal time between shutting down the current version and starting the newer version.Hope that helps a bit,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago"


Question: "Additional Verification Required" when requesting ACM Certificate

I'm getting the "Additional Verification Required" error when requesting a new certificate. Please let me know what I need to do to get this certificate.The domain in question is 'showsnear.by'FollowComment

Answer: "0Hi,Before the Amazon certificate authority (CA) can issue a certificate for your site, AWS Certificate Manager (ACM) must verify that you own or control all of the domains that you specified in your request.ACM verifies domain ownership by sending an email to the domain owner's email address listed in the WHOIS database or a specific email address set up for domain verification purposes. The email contains instructions for verifying domain ownership.ACM sends email messages to the three contact addresses listed in the WHOIS database and to five common system addresses for each domain that you specify. That is, up to eight email messages will be sent for every domain name and subject alternative name that you include in your request. For example, if you specify only one domain name, you will receive up to eight email messages. To validate, you must act on one of these eight messages within 72 hours. If you specify three domain names, you will receive up to 24 messages.To validate, you must act on at least three of these emails, one for each name that you specified, within 72 hours.Once you have completed the verification process, ACM will issue the certificate.More details can be found here: https://docs.aws.amazon.com/acm/latest/userguide/email-validation.htmlThanks,ArunCommentShareArunanswered 3 months ago0This is a fraud-protection measure AWS uses to protect domains with high levels of traffic. You can request that your domain be added to an allow-list by creating a Certificate Manager technical support case as outlined here:https://aws.amazon.com/premiumsupport/knowledge-center/acm-domain-certificate-allow-list/Regards,KosolCommentShareKosolanswered 3 months ago0I know the process for ACM verification, but I only have a Basic support account and can't make technical support cases so the docs said to post the question on the forum to get support help.CommentSharefalconertcanswered 3 months ago"


Question: Clock gating / using "highly discouraged" constraint

"I have a wide and deep shift register in my design that I want to control using a gated clock. Its size and distribution throughout the entire device make a clock enable an inferior option from a routability and resource usage perspective. I tried the below and believe my design is working but have misgivings about using a constraint that is "highly discouraged" without truly understanding what I'm doing and if there's a recommended alternative.Guidance on the suitability of my approach / why the constraint is "highly discouraged" would be appreciated.I sequentially tried:Inferring from Verilog RTL code in various ways. Nothing looked good.Instantiating a BUFGCE primitive alone.CRITICAL WARNING: [DRC HDPR-59] Clock Net Rule Violation: Illegal clock load 'WRAPPER_INST/CL/BUFGCE_unknown' found on PR boundary clock net 'WRAPPER_INST/SH/kernel_clks_i/clkwiz_sys_clk/inst/CLK_CORE_DRP_I/clk_inst/clk_out1'. Boundary clock nets are not fully supported to drive loads of type BUFGCE inside a reconfigurable region. This type of connection may cause downstream tool issues. The recommended solution is to add an MMCM as the clock load driving the original BUFGCE load.Instantiating a MMCME4_BASE primitive before a BUFGCE primitive.Phase 1.2 IO Placement/ Clock Placement/ Build Placer DeviceERROR: [Place 30-718] Sub-optimal placement for an MMCM/PLL-BUFGCE-MMCM/PLL cascade pair.If this sub optimal condition is acceptable for this design, you may use the CLOCK_DEDICATED_ROUTE  constraint in the .xdc file to demote this message to a WARNING. However, the use of this override is highly discouraged. These examples can be used directly in the .xdc file to override this clock rule. set_property CLOCK_DEDICATED_ROUTE ANY_CMT_COLUMN [get_nets WRAPPER_INST/SH/kernel_clks_i/clkwiz_sys_clk/inst/CLK_CORE_DRP_I/clk_inst/clk_out1] WRAPPER_INST/SH/kernel_clks_i/clkwiz_sys_clk/inst/CLK_CORE_DRP_I/clk_inst/clkout1_buf (BUFGCE.O) is locked to BUFGCE_X1Y181 (in SLR 1)The loads are distributed to 1 user pblock constraints. In addition, there are 0 loads not in user pblock constraints.Displaying the first 1 loads for pblock constraint 1WRAPPER_INST/CL/MMCME4_BASE_inst (MMCME4_ADV.CLKIN1) is provisionally placed by clockplacer on MMCM_X0Y5 (in SLR 1)The above error could possibly be related to other connected instances. Following is a list of all the related clock rules and their respective instances.Clock Rule: rule_bufgce_bufg_conflictStatus: PASS Rule Description: Only one of the 2 available sites (BUFGCE or BUFGCE_DIV/BUFGCTRL) in a pair can be used at the same time WRAPPER_INST/CL/BUFGCE_unknown (BUFGCE.O) is provisionally placed by clockplacer on BUFGCE_X0Y120 (in SLR 1)Clock Rule: rule_mmcm_bufgStatus: PASS Rule Description: A MMCM driving a BUFG must be placed in the same clock region of the device as the BUFG WRAPPER_INST/CL/MMCME4_BASE_inst (MMCME4_ADV.CLKOUT0) is provisionally placed by clockplacer on MMCM_X0Y5 (in SLR 1) WRAPPER_INST/CL/BUFGCE_unknown (BUFGCE.I) is provisionally placed by clockplacer on BUFGCE_X0Y120 (in SLR 1)Clock Rule: rule_bufgce_bufg_conflictStatus: PASS Rule Description: Only one of the 2 available sites (BUFGCE or BUFGCE_DIV/BUFGCTRL) in a pair can be used at the same time WRAPPER_INST/SH/kernel_clks_i/clkwiz_sys_clk/inst/CLK_CORE_DRP_I/clk_inst/clkout1_buf (BUFGCE.O) is locked to BUFGCE_X1Y181 (in SLR 1)Clock Rule: rule_mmcm_bufgStatus: PASS Rule Description: A MMCM driving a BUFG must be placed in the same clock region of the device as the BUFG WRAPPER_INST/SH/kernel_clks_i/clkwiz_sys_clk/inst/CLK_CORE_DRP_I/clk_inst/mmcme3_adv_inst (MMCME4_ADV.CLKOUT0) is locked to MMCM_X1Y7 (in SLR 1) WRAPPER_INST/SH/kernel_clks_i/clkwiz_sys_clk/inst/CLK_CORE_DRP_I/clk_inst/clkout1_buf (BUFGCE.I) is locked to BUFGCE_X1Y181 (in SLR 1)Clock Rule: rule_bufgce_bufg_conflictStatus: PASS Rule Description: Only one of the 2 available sites (BUFGCE or BUFGCE_DIV/BUFGCTRL) in a pair can be used at the same time WRAPPER_INST/SH/kernel_clks_i/clkwiz_sys_clk/inst/CLK_CORE_DRP_I/clk_inst/clkout2_buf (BUFGCE.O) is locked to BUFGCE_X1Y183 (in SLR 1)Clock Rule: rule_bufgce_bufg_conflictStatus: PASS Rule Description: Only one of the 2 available sites (BUFGCE or BUFGCE_DIV/BUFGCTRL) in a pair can be used at the same time WRAPPER_INST/SH/kernel_clks_i/clkwiz_sys_clk/inst/CLK_CORE_DRP_I/clk_inst/clkout3_buf (BUFGCE.O) is locked to BUFGCE_X1Y172 (in SLR 1)Clock Rule: rule_bufgce_bufg_conflictStatus: PASS Rule Description: Only one of the 2 available sites (BUFGCE or BUFGCE_DIV/BUFGCTRL) in a pair can be used at the same time WRAPPER_INST/SH/kernel_clks_i/clkwiz_sys_clk/inst/CLK_CORE_DRP_I/clk_inst/clkout4_buf (BUFGCE.O) is locked to BUFGCE_X1Y171 (in SLR 1)Resolution: The MMCM/PLL-BUFGCE-MMCM/PLL cascade pair can use the dedicated path between them if they are placed in vertically adjacent clock regions and in the same column (LEFT/RIGHT) of the device.Instantiating a MMCME4_BASE before a BUFGCE primitive and constraining the design with set_property CLOCK_DEDICATED_ROUTE ANY_CMT_COLUMN [get_nets WRAPPER_INST/SH/kernel_clks_i/clkwiz_sys_clk/inst/CLK_CORE_DRP_I/clk_inst/clk_out1] in cl_pnr_user.xdc. This met with success.FollowCommentljp0101 a year agoSome observations and follow up question now that I've been working with the gated clock design:It solved my primary timing problem and seems to be a good choice for my design, though there are secondary issues.The post MMCM clock has an inferior pessimism of ~0.10ns vs the clock_main_a0 so is generally inferior.The Xilinx tools treat clock_main_a0 differently than the MMCM clocks so I'm having timing problems at the interface between the shell and CL, which I can work around by inserting a register and constraining that register to the same SLR as the shell signal (without the constraint the tools kept putting the register after a SLR crossing and failing timing).I'm kind of surprised by 3 and curious if this is the expected behavior or there's something I should be doing with the MMCM to get the post MMCM clocks treated as effectively the same as clock_main_a0? The design didn't have any timing problems at these points before.Share"

Answer: "0Dear customerThank you so much for your interest in AWS. Just to make sure, so you tried few different approaches and some of them seem to be working. But just wanted to make sure, if any of the working apporaches is okay and why using "clock gating" is a highly discouraged option. Is that correct?ThanksCommentShareAWS-User-7905434answered a year ago0Thanks for looking into this.Suppose my questions at this point are:What is the canonical way to implement a gated clock on F1? Spitballing but maybe I should be gating something other than clock_main_a0, e.g. whatever clock drives it if it's accessible in the CL.If the MMCM cascade pair is the canonical approach, why is using an MMCM cascade pair highly discouraged? (Clock gating itself is fully supported and not discouraged by Xilinx.)If the MMCM cascade pair is the canonical approach, is there a way to have the MMCM output clock treated as the same as the MMCM input clock from a Xilinx tools perspective? They are the same clock even in phase from what I can tell but place and route isn't behaving like they're different.What I'm doing now is workable but suboptimal for my design, especially around question 3, as I need to put two registers or false path between the shell and post MMCM CL clock transition to make anything meet 250 MHz timing.CommentShareljp0101answered a year ago0Dear customer1.) clk_main_a0 is generated inside the shell and the clock driving clk_main_a0 is not accessible to CL.2.) MMCM connected to clk_main_a0 with set_property CLOCK_DEDICATED_ROUTE ANY_CMT_COLUMN is a valid possible option for clock gating on F1. It is discourage because of the "extra delay", which is expected with this clocking structure. One possibility is to try PLL Vs MMCM to see if the delay improves.3.) Cross clock crossings timing paths are expected as a new clocking structure is created with MMCM or PLL.  Clk_main_a0 is different than the new clocking structure so it’s timed differently.  However, it is recommended to make sure that these paths can be set_false_path as normally they are true paths that need synchronizersThanksCommentShareAWS-User-7905434answered a year ago0Thanks. Seems like the MMCM cascade pair is just a weird thing to do from a Xilinx content but makes sense for the F1 use case. For anyone else looking into this, I ended up treating the shell and CL clocks as async and run my design off the CL clocks as it wasn't a huge deal with my design. I did notice thought that using the MMCM feedback clock with a post BUFG generated mirror clock brought down the clk_main_a0 to CL clock skew so it was possible to rely on the phase relationship to cross clock domains for 250 MHz but didn't seem to be the case at 500 MHz.CommentShareljp0101answered a year ago"


Question: FSx for lustre with AWS Sagemaker Error - Artifact upload failed:Please ensure that the subnet's route table has a route to an S3 VPC endpoint or a NAT device

"Hi,I am trying to use FSx for Lustre for my Sagemaker training. I followed this tutorial: https://aws.amazon.com/blogs/machine-learning/speed-up-training-on-amazon-sagemaker-using-amazon-efs-or-amazon-fsx-for-lustre-file-systems/.Code:import sagemakerfrom sagemaker import get_execution_rolefrom sagemaker.estimator import Estimatorsess = sagemaker.Session()estimator = Estimator(image_uri='image-uri',                      role='my-role',                      base_job_name='training-job',                      instance_count=1,                      sagemaker_session=sess,                      instance_type='ml.m5.xlarge',  # ml.p3.2xlarge                      subnets=['subnet-id'],                      security_group_ids=['sg-id', 'sg-id'],                      hyperparameters={...}                      )from sagemaker.inputs import FileSystemInputtrain_input = FileSystemInput(file_system_id = 'fs-id',                              file_system_type = 'FSxLustre',                              directory_path = '/mount-idea/dataset',                              file_system_access_mode = 'rw')estimator.fit(train_input)First issue is that I don't have internet connection in the container, and second is this error:UnexpectedStatusException: Error for Training job training-job: Failed. Reason: ClientError: Artifact upload failed:Please ensure that the subnet's route table has a route to an S3 VPC endpoint or a NAT device, and both the security groups and the subnet's network ACL allow uploading data to all output URIsI have create a custom VPC for this with private and public subnets. I enabled NAT and S3 endpoint. I am using one of the public subnet so that I can have access to internet. I created custom security group rules (inbound/outbound) with Custom TCP for port 988 and ports 1018 - 1023 for the security groups I use.The code is running in a sagemaker notebook that has as VPC, the custom VPC I created and uses same subnet and security groups as the ones pass to the estimator.What should I do to fix this error?Thank you!FollowComment"

Answer: "0What are your security group outbound rules?There is no problem if all communication is permitted.You may also want to check network ACLs.Also check if the route to the S3 VPC endpoint is set in the route table.CommentShareEXPERTRiku_Kobayashianswered 12 days agorePost-User-8013031 11 days agoThank you for responding!Security outbound and inbound rules of my-sg-id:Custom TCPTCP988                my-sg-idCustom TCPTCP1018 - 1023my-sg-idIPv4All trafficAllAll                    0.0.0.0/0Network ACLs outbound and inbound rules:Rule number         Type         Protocol        Port range        Source      Allow/Deny100                      All traffic        All          All                0.0.0.0/0Allow                All traffic       All  All        0.0.0.0/0DenyIn the subnet I use (subnet-id), this is the route table:Destination      Target10.0.0.0/16  local0.0.0.0/0  igw-0a053be26059959b2pl-63a5400a  vpce-06fd1bab012e09723with vpce-06fd1bab012e09723 the S3 endpoint:Service name = com.amazonaws.us-east-1.s3Endpoint type = GatewayPrivate DNS names enabled = NoPolicy = {"Version": "2008-10-17","Statement": [{"Effect": "Allow","Principal": "","Action": "","Resource": "*"}]}The subnet I use is a public subnet, is that okay?I have made some progress with those configurations and don't get the "S3 VPC endpoint or a NAT device" error anymore. However, I still don't have internet access in the container (tested it with simple request to google.com in train.py).ShareRiku_Kobayashi EXPERT11 days agoIf the container is running on an appropriate public subnet, it would be accessible to the outside world.If you are running on a public subnet and have security groups and network ACLs configured correctly, you may want to check with AWS support.Share"


Question: EMR with GP3 EBS storage and M6i Instance Types

When does EMR support GP3 EBS storage and M6i instance types???FollowComment

Answer: "0Accepted AnswerThe way AWS works is by gathering data on customers' needs and prioritizing the development of the most needed and requested features. Just asking "when..." without providing the background to the request regarding your workload and scale needs is not going to work.EMR is the service that is supporting the largest number of versions both of application and instance types compared to any other AWS service. Maintaining that many configurations and testing that everything works for every possible combination is a big challenge. You need to sell your need to prioritize its release.CommentShareMLGuyanswered a year agojayaram a year agoWe are trying to work on Reducing our EBS costs as most of our servers use upward of 1TB Volumes.  So we wanted to know if there is a timeline. But it looks like it will be whenever it will be. So I will accept your answer and close this one. thank youShare0EMR GP3 support is released in most of the regions, currently EMR supports default throughput of 125MB/s and configurable throughput will be released later this year. No ETA on M6i instance support.CommentShareBharatanswered a year agoAWS-User-8922956 a year agoHi Bharat, do you have the AWS announcement of this gp3 feature availability now supported on EMR? thank youShare"


Question: Does Athena support a similar function like STRING_AGG in querying tables?

"I wanted to concatenate string values from different rows in Athena using STRING_AGG function in SQL. Athena complains that STRING_AGG is not registered.SYNTAX_ERROR: line 1:8: Function string_agg not registeredIs there a way to register STRING_AGG function? Or, is there an alternative way to get what I want?Below is my SQL statement:select STRING_AGG(item, ","), STRING_AGG(event_subtype,","), STRING_ADD(event_dt_utc, ",") from ((select user_id as user,advertiser_id as advertiser,tracked_item as item,event_subtype,event_dt_utcfrom fact_mouse_conversions_gluewhere total_product_sales > 0and user_id IS NOT NULLand tracked_item IS NOT NULL)union all(select user_id as user,advertiser_id as advertiser,tracked_item as item,event_subtype,event_dt_utcfrom fact_clickstream_conversions_gluewhere user_id IS NOT NULLand tracked_item IS NOT NULL))group by userFollowComment"

Answer: "1Accepted AnswerSTRING_AGG is not supported in Athena. To check which functions are supported in Athena, please check https://docs.aws.amazon.com/athena/latest/ug/functions.html based on the V2 or V3 of the engine you are using. Maybe LISTAGG may solve your problem in V3. see https://trino.io/docs/current/functions/aggregate.html#listaggSELECT id, LISTAGG(value, ',') WITHIN GROUP (ORDER BY o) csv_valueFROM (VALUES    (100, 1, 'a'),    (200, 3, 'c'),    (200, 2, 'b')) t(id, o, value)GROUP BY idORDER BY id;Let me get to your other question.Yes, it is possible to register a custom function in Amazon Athena. Athena allows you to create custom scalar functions, which are defined in a Java or Scala JAR file and registered with Athena. These custom functions can then be used in SELECT, FROM, WHERE, and HAVING clauses in Athena queries.To create a custom function, you will need to follow these steps:Write the function code in Java or Scala and package it into a JAR file. The function must implement the org.apache.hadoop.hive.ql.exec.UDF interface and include the @UDFType and @Description annotations.Create an Amazon S3 bucket to store the JAR file.Upload the JAR file to the S3 bucket.Create the function in Athena by running a CREATE FUNCTION statement. The syntax for this statement is as follows:CREATE FUNCTION [function_name]AS 'com.example.MyFunction'USING JAR 's3://[bucket_name]/[jar_file_name]';Replace function_name with the name you want to give to the function, com.example.MyFunction with the fully qualified name of the function class in the JAR file, and s3://[bucket_name]/[jar_file_name] with the location of the JAR file in S3.Once the function has been created, you can use it in your Athena queries by calling it like any other function. For example:SELECT my_function(column) FROM table;I hope this helps! Let me know if you have any questions. If the answer helps, please accept/upvote answer so that others in this forum benefit from this.CommentShareAnanth Tirumanuranswered 5 months agorePost-User-0565696 5 months agoThis is really advanced and helpful as well. Thanks a lot!Share"


Question: CostAndUsage - Inadequate permission for linked account

"Hey everyone!I'm currently trying to poll for costs of the current account with the cost explorer service but I'm receiving following error:Error: AccessDeniedException: Inadequate permission for linked account to see the cost with EDP discounts appliedWhile I'm aware, that I might have to grant or be granted permissions I don't know where even though I tried some variations like adding policies to the account user. Do I have to enable something at the payer account level or specify a linked account in the request parameters?The code is the following:          input := &costexplorer.GetCostAndUsageInput{  Metrics: aws.StringSlice(\[]string{  "NetUnblendedCost",  }),  TimePeriod: &costexplorer.DateInterval{  Start: aws.String(start),  End:   aws.String(end),  },  Granularity: aws.String("MONTHLY"),  }  result, err := costService.GetCostAndUsage(input)Edited by: DennisLeanix on Nov 2, 2020 2:12 AMFollowComment"

Answer: "0Nevermind. The input request doc required a metric value like "NetUnblendedCost" which does not work.You have to do it like NET_UNBLENDED_COSTCheersCommentShareDennisLeanixanswered 3 years ago0See replyCommentShareDennisLeanixanswered 3 years ago0Hi Dennis,How did you fix that? I tried to change NetUnblendedCost metric into NET_UNBLENDED_COST one but nothing happens.CommentShareariefapriliantoanswered 2 years ago"


Question: Experience of using AWS.

"I managed to upload and run a node JS project on AWS.My next project was a Python project which again uploaded ok but the link to run it came up with error 403.I worked my way through the AWS forums trying to get answers but no one replied to my messages.Seems not many messages are answered looking at the stats.Then gave up and paid for support.First reply took 3 days (not 12 hours as suggested) and they just gave same answers I found in AWS help so useless.So another 4 days go by after uploading project for them to have a look at.After a few days they then asked for logs, I replied logs are fine as it uploads fine.Please take a look at my project where the problem liesMy experience of AWS is its very slow, very complicated and support arent willing to look at my project despite asking twice.The project isnt even mine its just a Microsoft Python template with some python and some html.FollowComment"

Answer: "0Even with paid support you will not get the answers you need. A lot of the information then provided is incorrect or contrary to what you have been told in the past. We have paid support which we cancelled. Unless you are true Enterprise client you get nothing.After 25 years of running a hosting business the worst decision I ever made was moving to AWS. Should have kept my "old" setup. Nothing but pain for clients with little upside. AWS are too big, too powerful and at the end of the day don't actually care, unless for are a true Enterprise client.CommentShareAWS-User-8986118answered a year ago0AWS support refused to look at my project (a Microsoft python template, not my code)He said he wasnt qualified to look at it and was an expert on AWS only.Been trying to get something to run on AWS for about 10 days now.Its so slow, it runs at about 100KBPS upload speed.Azure is considerably faster but more expensive.I am going through a similar pain to what I had with node js, I just break down code until I find what crashes AWS or Azure.With node js it was "alert" and any popup code as its server side only.With python so far its PYMSSQL which refuses to connect to an outside database.AWS have created a monster, too slow, too bloated and too complicated.You might have thought visual studio with aws toolkit would just work but it doesnt.I am having to zip up my files to post on AWS which is a pain.CommentShareAWS-User-4029920answered a year ago"


Question: "EC2 - Bitnami WordPress - t2.large - Crashing constantly, requires reboot"

Can't find a solution to this online. It's been happening once every few weeks. Thanks for any help.FollowComment

Answer: "0Hi there,I see that you have issues with your EC2 instance that keeps on crushing frequently.There are many possible causes that can lead to this such as:- Memory being over utilized by your applications.- Application errors/bugs.- Kernel panics.Since these are based on the Operating System level, I would recommend that you review /var/log/syslog or /var/log/messages logs which records all activities within your system. I would further recommend that you also benchmark the memory and CPU needs of your applications using some bench-marking tools available like SAR utility. Please refer to the this[1,2] public documentation to learn more about the tools and how to utilize them. Then based on the results of bench-marking, you can either fine tune your application according to the available resources or you could upgrade[3] to an instance with better memory and CPU capabilities.[1] How do I configure the ATOP and SAR monitoring tools for my EC2 instance running Amazon Linux - https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-configure-monitoring-tools/[2] linux server administration/sar - https://en.wikiversity.org/wiki/Linux_server_administration/sar#:~:text=sar%20(System%20Activity%20Report)%20is,and%20recent%20recorded%20system%20performance.[3] Change the instance type - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-resize.htmlCommentShareKaraboanswered a year ago"


Question: celebrity recognition result issue

"We have been testing the celebrity recognition service and have noticed one issue when we upload the picture of a famous Indian actor, Salman Khan.The last name that comes up in the response is actually an abusive word of local language in India.You can test it for yourself by uploading the following image.https://www.bollywoodhungama.com/wp-content/uploads/2021/10/salman-khan.jpgHow the response can be fixed, if at all?FollowComment"

Answer: "0Thanks for reporting this issue, we’re actively investigating this and will provide another update by end of day.CommentShareRohitanswered a year ago0The issue has been resolved, thanks for reporting it.CommentShareJerrick_Canswered a year ago"


Question: AWS MSK - Creating a client Machine

"Have created an AWS MSK Cluster and created an AWS Client Machine Windows 2019 t2.xlarge instance type.Both the MSK Cluster and the AWS Client Machine reside on the same VPC and the appropriate security groups have being assigned.I am unable to connect from the client machine, its giving client socket connection issues ( though the security groups looks proper)The Tutorial @https://docs.aws.amazon.com/msk/latest/developerguide/create-topic.html is mostly for Linux. So instead of it I am using the equivalent windows batch files in \kafka\bin\windows/ E.g. kafka-topics.bat file.For the Windows Version, do we have to start the Kafka Server and Zookeeper ? Can you please let me know if in Windows Client Machine the commands are different ?FollowComment"

Answer: 0Since you started MSK cluster are you sure that the cluster is at the correct VPC and subnet?Make sure the Subnet has proper NACL and Security Group set with corresponding Routing table in VPC. If all are good then finally you can move to your client.properties .client.properties has many flavours you can go with PLAINTEXT or SASL_SSL . If your MSK has public endpoint then you probably cannot do PLAINTEXT but if its private then you can use PLAINTEXT make sure to keep "security.protocol" to either one of those value.Client properties settings Reference:Tutorial for PlainText : https://docs.aws.amazon.com/msk/latest/developerguide/create-topic.htmlTutorial For SASL :  https://docs.aws.amazon.com/msk/latest/developerguide/create-serverless-cluster-client.htmlCommentShareprivatejavaanswered a year ago


Question: Is there any SAP GUI virtualization solution alternative to Citrix?

Is there any SAP GUI virtualization solution alternative to Citrix?“NOTE: This is a common question asked by AWS customers. The AWS team is posting it to provide an answer that can benefit everyone.”FollowComment

Answer: "0Accepted AnswerYes, customers can use AWS AppStream 2.0 (https://aws.amazon.com/appstream2/). for deploying SAP GUI and other front end components in a virtualized application environment. AWS Workspaces (https://aws.amazon.com/workspaces/) can also be used for a virtualized desktop environment and SAP GUI can also be installed here.Further information can be found in the Deploying SAP GUI on Amazon AppStream 2.0 blog (https://aws.amazon.com/blogs/desktop-and-application-streaming/deploying-sap-gui-on-amazon-appstream-2-0/).NOTE: This answer is provided by the SAP on AWS speciality team and is accurate at the time of publish. Please check comments as the answer may have changed/services evolved.CommentShareKhaliluddin_Sanswered a year ago"


Question: How do i write a AWS IoT Core rule for subscribing & unsubscribing to a topic.

I want to invoke a lambda when a user subscribes & unsubscribes to one of my topic's on IoT.Could someone tell me how to do this?If this isn't possible yet it should really be added to the IoT service.FollowComment

Answer: 1Accepted AnswerYou can have the rule get triggered based on the relevant reserved topic.For example:SELECT * FROM '$aws/events/subscriptions/subscribed/+'CommentShareEXPERTgoldericanswered 9 months agoGreg_B EXPERT9 months agoSee also: https://docs.aws.amazon.com/iot/latest/developerguide/iot-events.htmlShare


Question: Ordered message delivery to downstream consumers when transient faults occur

"Hi,We are architecting a solution, and considering Kinesis. One of the primary reasons is the guaranteed message ordering per shard (SQS Fifo is too slow). Our likely exception handling process would be:Invocation faults get handled as per event source mapping policyApplication non-transient faults (invalid payload) get caught and manually forwarded to SQS to prevent pointless retriesApplication transient faults are uncaught, and event source mapping policy will be configured with maximum message age (e.g. 5 minutes) and then move failed batch metadata to SQS (awaiting replay) and continue.So, IF a network / db fault occurs, the shard will be blocked on the current message until the message age expires. If that happens, then messages can be delivered to downstream consumers (by our lambda) out of order.The best we can achieve is to provide something like an SLA that can be considered / designed around for each consumer?Have I missed anything obvious in my conclusion?TiaFollowComment"

Answer: "0A thought based on the question: Kinesis and SQS operate differently. So when you say "the shard will be blocked" - individual consumers on the shard might choose not to consume the next message in the stream but there's no concept of "blocking". Unlike SQS, messages in the stream are visible to all of the consumers so they can choose what they're going to do with each message - which is great if you have several different processes that need to happen on a single message - you can use different consumers and they don't get in each other's way.So in the Kinesis world, if you want to maintain ordering you can only have a single consumer on the stream (shard, really). If there is a fault the blocking happens in the consumer, not in Kinesis.Probably not helpful - but I'd question why Kinesis is better than SQS FIFO in this case.Finally: I'm a little concerned about the comment "SQS FIFO is too slow" - have you tested Kinesis to ensure that it meets your performance requirements?Given the complexity of the question and the challenges you appear to be facing I'd contact your local AWS Solutions Architect to discuss further...CommentShareEXPERTBrettski-AWSanswered a year agonexbe-kc a year agoHi there, thanks for replying.Regsarding SQS Fifo being too slow, it's bee a long time since I checked FIFO throughput. Checking now, 3000msg/sec is a lot higher than it was, so probably not a concern any longer, but i'd like to focus on Kinesis. Yes, we have run soak tests through Kinesis and we're very happy with throughput.Regarding "shard will be blocked" comment - Of course, not the shard itself, i meant the consumer will not be able to continue receiving new batches.You mention "So in the Kinesis world, if you want to maintain ordering you can only have a single consumer on the stream (shard, really)." this is not what i understand? If multiple consumers are reading from a single shard, they are all receiving the same data completely independantly from other consumers, but the shard guarantees order, so they all get ordered data?Finally, I have reached out to AWS locally - it's just taking some time and i was looking to expedite.CheersShare"


Question: Amazon Lex V2 Context

"Hi all,Apologies in advance for the simple question, i am still learning lexv2. I currently have an intent that has an output context, as I’d like to be able to use the slots from that intent in future intents. However when i set the context slot value as a default value for my slot in a different intent, and test it, the value only gets set as default when i set the input context as the specific context.This is not what i want as i want the user to be able to invoke the intent regardless of the context. Is there any ways to get the slot value to default to context value without specifying an input context, or is it a lambda problem?FollowComment"

Answer: "0Yes, it is possible to set the slot value to default to the context value without specifying an input context.Here are a few things you can try:In your intent definition, you can set the "Default Value" of the slot to the context variable. This will set the default value of the slot to the value of the context variable, regardless of the input context.In your Lambda function, you can check if the context variable is set and if so, set the slot value to the context variable. This way, the slot value will be set to the context variable if it is present, but will not require an input context.In your Lambda function, you can also check if the context variable is set and if not, set the context variable with the value of the slot. This will ensure that the context variable is always set and can be used as a default value for the slot in future intents.It's also worth checking the value of the context variable in the Lambda function, to ensure that it has the expected value, also make sure that you are setting the context variable in the correct scope (e.g. session, request) and that the lambda function has the correct permissions to read and write context variables.It's also worth checking the documentation of the specific service you are using for more information on how to set the default value for a slot using context variables.CommentShareVarun Mittalanswered 4 months ago"


Question: archiving directly to glacier

"We are developing a glacier archive solution, but now wondering whether it would be better to upload to S3 then use lifecycle rules to move the files to glacier. We would be uploading terrabytes of data every day which include files that could be 50G and files that could be 1M. Now wondering if anyone actually goes straight to glacier or if that is not really a thing any more.FollowComment"


Question: "No ocean showing up, even with gem enabled and built"

"I went through the project configurator and adjusted the gems, I followed the steps and built the project, (I am using Visual Studio 2017), it went successfully, but now I can't open the editor, I found that enabling Windows 8 comparability mode on Windows 10 worked and it opened, but when it does open, all of my levels have no ocean what so ever. Can someone help me, I don't want to have to build my project again because it takes nearly 2 hours! this is kind of annoying now. (I'm trying really hard not to get annoyed at the engine and give it a chance, but it's getting a bit hard to defend, I know it's probably I didn't build it correctly, or didn't press a button or tick a box, but I'm just saying)REMOVEDUPLOADAlso, I get this annoying "Bus is already connected" message show up every time the editor opens.Follow"

Answer: "0Accepted AnswerWhen you add the water gem the default ocean is removed, you need to add a new entity with an Infinite Ocean component.SharerePost-User-4372553answered 5 years ago0I am using VS 2015, and ocean was working perfectly until I enabled Water Gem to test the river tool. After adding the gem and compiling the ocean disappeared from my level and moreover, the ocean-related options are missing from the Terrain Editor:REMOVEDUPLOADThere are no warnings/errors related to any Gem in the console during project loading.SharerePost-User-8496731answered 5 years ago0OK? So what does that mean then? How can I fix it, that was my question, am I supposed to rebuild it again? Remove the gem? What?SharerePost-User-9232254answered 5 years ago0Never mind I read the response quickly without thinking, I'm sure I can figure it out and I'll give it a go.SharerePost-User-9232254answered 5 years ago0Thank you, that was it, I wish I saw that sooner, it is kind of annoying, but a little bit better to have more control over the ocean. Do you know how to stop the "Bus is already connected" message from showing up when the engine starts?SharerePost-User-9232254answered 5 years ago0I don't get that message, it's showing on the console?SharerePost-User-4372553answered 5 years ago"


Question: Lambda You do not have sufficient permission. Access denied. on root account.

"When I try to access Lambda Dashboard/Functions from root account, I get this error: You do not have sufficient permission. Access denied.FollowCommentrePost-User-5050533 9 months agoHello, have you had this resolved? I'm currently experiencing the same issue. Neither root nor my previous admin IAM user are able to view or create Lambdas. Also created a new IAM user with Lambda full access with no success. I followed the suggested route below of opening an account support case.Share"

Answer: "1Is your account part of an AWS organization? In that case it is possible that a Service Control Policy has been set at your OU or higher level in the organization hierarchy that prevents even account root users in that hierarchy from accessing lambda functionshttps://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 10 months agorePost-User-5245460 10 months agoNo, I'm not in any AWS organization. I want to reach the AWS tech team to fix this problem. But my plan is basic support so I have no way :(.ShareIndranil Banerjee AWS EXPERT10 months agoWIth Basic Support you won't be able to open a Technical Support case. You should be able to open a case under Account and Billing - https://support.console.aws.amazon.com/support/home?#/Please open a case for Support to take a look because you should be able to access resources in your account as a root user, although it is not recommended. You should create an IAM user and grant the user the required permissions and try to access as IAM user.Share"


Question: Managed updates feature in elastic beanstalk

"If we enable the managed updates feature in elastic beanstalk environment, will it install the windows security updates released by Microsoft on the Windows EC2 instances?FollowComment"

Answer: "1Accepted AnswerIn short yes - see here"Releases patch, minor, and major updates of operating system (OS), runtime, application server, and web server components typically within 30 days of their availability. Elastic Beanstalk is responsible for creating updates to Elastic Beanstalk components that are present on its supported platform versions. All other updates come directly from their suppliers (owners or community)."There is no reason you cannot additionally configure SSM Patch Manager for beanstalk managed instances to double check these instances are meeting your patch baselinesCommentShareEXPERTPeter_Ganswered a year ago"


Question: Sagemaker Pipeline strange warning message

"Using Sagemaker's Python SDK 2.11 when I run my pipeline, I see this strange warning message:/personal_dir/lib/python3.8/site-packages/sagemaker/workflow/pipeline_context.py:233: UserWarning: Running within a PipelineSession, there will be No Wait, No Logs, and No Job being started.Before, I ran the exact same pipeline script with LocalPipelineSession without any problems and without any kind of weird warning messages.This is how I am creating the PipelineSession object:def get_session(region, default_bucket):    boto_session = boto3.Session(region_name=region)    sagemaker_client = boto_session.client("sagemaker")    return PipelineSession(        boto_session=boto_session,        sagemaker_client=sagemaker_client,        default_bucket=default_bucket    )Im getting the region in the following way:import boto3region = boto3.Session().region_nameI have tried to search the web for the meaning of that warning message, but could not find anything. What does that warning message means?? Am I doing something wrong and what can I do to make that warning disapearFollowComment"

Answer: "1Accepted AnswerHi, this warning is simply to clarify that running in a pipeline session will defer execution of jobs - generating pipeline step definitions instead of kicking off the jobs straight away.For example calls such as Estimator.fit() or Processor.run() when using a pipeline session won't start a job (or wait for it to complete, or stream logs from CloudWatch), just prepare a definition to build up a pipeline that can be started later.If you're already familiar with how PipelineSession works, I would say you can ignore it :-)  If not, can refer to the SDK docs here for more details.Could be that there's an inconsistency between LocalPipelineSession versus PipelineSession in showing the message? Or that you disagree this message should be at warning level... Either way I'd suggest raising an issue on the SageMaker Python SDK GitHub might be a good way to log that feedback with the team!CommentShareEXPERTAlex_Tanswered 6 months ago"


Question: Cannot upgrade lightsail instance

"When I take a snapshot I try to create a larger instance I receive this errorSorry, your account can not create an instance using this Lightsail plan size. Please try a smaller plan size or contact Customer Supportif you need to use a larger plan.What I should do?Also I cannot find how I can send ticket to customer supportI receive the message you could not send ticket due to basic planFollowComment"

Answer: "0These errors typically appears for newly created accounts when trying to access some services in specific regions which require additional verifications to be completed.  Unfortunately, without support ticket I don't find an option to upgrade the lightsail instance.CommentShareRam_AWSanswered 2 months agoGerasimos-A 2 months agoThank you,The account is not new. It is at least 5 years old.Also how I can create a ticket?When I try to do so it I go the error msg you don;t allow to customer support due to basic plan.I can not see how to proceed with the lightsail plan upgradeShare"


Question: Multiple SQS messages of the same group in one batch

"Hello,I am getting multiple messages from a same SQS FIFO group in a single receive request with MaxNumberOfMessages set to > 2. Is this correct behavior? I don't understand, the API contract says:When receiving messages from a FIFO queue with multiple message group IDs, Amazon SQS first attempts to return as many messages with the same message group ID as possible. This allows other consumers to process messages with a different message group ID. When you receive a message with a message group ID, no more messages for the same message group ID are returned unless you delete the message or it becomes visible.https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/FIFO-queues-understanding-logic.htmlMy code dispatches the messages directly to the workers without any group checking logic. It looks like I either need to implement such feature, or simply make all SQS receive requests with maxMessages set to 1 which sounds like a waste of resources. I am confused, because on the very same documentation page that says above, there is this box:It is possible to receive up to 10 messages in a single call using the MaxNumberOfMessages request parameter of the ReceiveMessage action. These messages retain their FIFO order and can have the same message group ID.That breaks the above contract which literally says: "unless you delete the message or it becomes visible". In my testing, I see those messages immediately returned in a single receive call, yet they are set to expire in 30 seconds. I don't understand, is there some kind of log that could tell me why a message was delivered that fast? I am probably missing something in here.Thanks for helpFollowComment"

Answer: "1Accepted AnswerThis is exactly how it should work. SQS FIFO maintains the order of all messages with the same group ID. To make sure that the order is preserved, if one consumer got a message with a specific group ID, no other consumer will be able to get messages with the ID until the message is deleted or becomes visible again. Otherwise, the messages can be processed out of order.Nothing prevents a single consumer to get more than one message for the same group ID as the consumer knows the order of the messages (the order of the messages in the array) and it can process them in order.If your code sends the messages to be processed in an asynchronous manner, you will break the order. You should process the messages one at a time. In order to process the messages quicker you should have multiple consumers, each will get messages from different groups IDs and this is how you will maintain the order and process the messages quicker.CommentShareEXPERTUrianswered a year agolzap a year agoThanks, makes sense. So even if a consumer receives 10 messages from a single group and only confirms (deletes) the first one and dies, SQS will re-deliver the remaining 9 after the timeout regardless they were already delivered in a batch. I guess I will process them synchronously then.ShareUri EXPERTa year agoCorrect. Even if you receive a batch of messages, only the ones that are deleted will not be visible again. The other message will become available after the visibility timeout.Share"


Question: AWS VTL Gateway

"Our server team deployed a storage gateway VTL appliance about a month ago. I am just now getting to setting it up. When creating the VTL gateway in the AWS console and entering the IP address of my on-prem gateway, it connot reach the site. The gateway is up and pingable. No firewalls or proxy.  A qucik scan of the VTL gateway and it only shows port 111 open. No other ports open. Is there a time limit between deploying the gateway and setting it up on AWS?Edited by: PMS on Apr 3, 2019 8:54 AMFollowComment"

Answer: "0Accepted AnswerHi PMSThere are two things:We need port 80 to be open specifically for storage gateway activation. This is the port the gateway uses to obtain the activation key.Looking at your statement that your port scan shows only 111 is open, its used for NFSv3 connection. VTL does not use NFSv3. My guess is that you must be using a File Storage Gateway image and trying to activate it as VTL gateway which wont work. In any case, you will be better off to download a new Tape Gateway (VTL) image from our console and use it to instantiate a VTL gateway on your server.If you are having issues, please PM me your gateway Id, region you are planning to activate it, and your AWS account id and I will take a look at it.ThanksSanjaya-AWSCommentShareAWS-User-4828478answered 4 years ago0Hi,I am assuming you haven't activated storage gateway VTL appliance before already. There's no time limit as such, so if you haven't activated that gateway (with same IP) before, you should be able to activate it.I would recommend to visit the page below to make sure you have the networking requirements in place.https://docs.aws.amazon.com/storagegateway/latest/userguide/Requirements.htmlRegards,BhavinCommentShareAWS-User-4940880answered 4 years ago0I have not activated it before with the same IP. I have done everything in the 'Requirements' link you gave. My only thought now is to remove the appliance and redeploy.CommentShareMarkSanswered 4 years ago0Thanks!  The wrong OVA was downloaded and the File Storage Gateway was deployed instead of VTL.CommentShareMarkSanswered 4 years ago"


Question: Application LB Health Check CLI

"The below command is not working in the CLI...no error..it keeps thinking...no output at all. I had to ctrl c to kill it. Why?aws elbv2 describe-target-health --target-group-arn arn:aws:xxxxxxxFollowCommentRoB a year agoOne of the first things you can do when the AWS CLI produces results that you don't expect, is get more detail by running the command again and including the --debug option at the end of the command line. This causes the AWS CLI to report details about every step it takes to process your command, send the request to the AWS servers, receive the response, and process the response into the output you see.ShareAWS-User-5291433 a year agothanks. I know the issue now. I always remember debug & dry-run but I don't use the CLI frequently.Share"

Answer: "0Hello -I understand you were having trouble with the CLI command for application health check.I found this article that reviews CLI commands for the describe-target-health in more detail.https://docs.aws.amazon.com/cli/latest/reference/elbv2/describe-target-health.htmlTry updating your AWS CLI. Check out this link on how to install or update the AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.htmlAlso, you can run the CLI command again and add --debug option at the end of the command line. When the AWS CLI reports an error that you don't immediately understand, or produces results that you don't expect, you can get more detail about the error by running the command again with the --debug option. With this option, the AWS CLI outputs details about every step it takes to process your command. The details in the output can help you to determine when the error occurs and provides clues about where it started.https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-troubleshooting.htmlI hope that helps you with the CLI commands needed for your application health check.CommentShareamandahyanswered 10 months agoSUPPORT ENGINEERMonica_Lluisreviewed 10 months ago"


Question: "Regarding rescheduling AWS Certified Developer - Associate (Retiring Feb 27, 2023) DVA-C01"

"Hi Guys,I have used the 100% voucher for registering the Developer associate exam (I have received the voucher from my company), now I need to cancel this exam and reschedule this exam at a different time.Would I be able to reuse the same voucher?Also DVA-C01 is retiring while rescheduling can I choose new exam DVA-C02 using old voucher coupon?FollowComment"

Answer: "1Hi Swapnil,Generally rescheduling an exam (even with new version) should allow you to keep your voucher.Check with below guide: https://repost.aws/questions/QUps8xJqyJRui-XlJXszvltQ/aws-certification-voucher-status-on-exam-cancellation-and-rescheduleI would add that if I you are rescheduling twice you could also check the training support, hope it helpsCommentShareEXPERTalatechanswered 4 months agoSwapnil Ahire 3 months agoHi ,Thanks for quick replay i have reschedule my exam with new version using old couponOnce again thanksSharealatech EXPERT3 months agoNo worries Swapnil, if you think above answers helped you, I would appreciate if can be accepted too, so that community can benefit for clarity. Glad it helped and thanksShare"


Question: AWS Iot v1 updateCredentials API alternative

"In v1 SDK for java we uses mqttClient updateCredentials API to refresh the credentials post expiration, But in V2 sdk we dont have UpdateCredentials API, so we did manual disconnect and used refreshed AwsSessionCredentials to create a new mqttClient and maps it to the old MQttWrapper. For creating the new client we uses AwsIotMqttConenctionBuilder which takes CredentialsProvider.Questions.Does the V2 SDK supports automatic refresh of AWSSessionCredentials or do we need to manually do it.If we need to do it manually Is there any way other than manual disconnect and connect again.As the manual disconnect and connect can cause intermittent issues and Latency issue do we have any other alternative for it.FollowComment"

Answer: "0Hi. The V2 IoT Device SDKs are all built on top of the AWS Common Runtime. The aws-c-auth module handles the credentials provider. The provider chains that source session credentials handle refreshing internally.For instance, you can see the setup of the refreshing here: https://github.com/awslabs/aws-c-auth/blob/5c2d39e69a39eeead2f1e1508cd02d45d8921cc1/source/credentials_provider_default_chain.c#L376CommentShareEXPERTGreg_Banswered 9 months ago"


Question: Shared drive for Windows EC2 instances launched within an autoscaling group

"I am looking to be able to share a single network storage between my fleet of Windows EC2 instances that are used as application webservers running IIS. These instances need to be able to access the drive either by UNC or a mapped drive letter. The instances are created dynamically through autoscaling, so they need to either be preconfigured to already have the connection in the AMI that they are created from, or be able to connect as part of their startup process (if they are connected as part of startup, the connection must be established quickly so they can serve webpages without much downtime between startup and ready state, 2-3 mins max). Files are created/ modified/ deleted at runtime and need to be accessible to the other instances in the fleet so preconfiguring the AMI to have all the files already loaded up will not work.Things we have used (or attempted to use) so far are:A separate EC2 instance that serves as a fileserver that our EC2 AMI is preconfigured to connect up to through windows fileshare. While quick and easy, this is not a great solution since it is a single point of failure.An S3 bucket mounted through RClone to the EC2s (mounted during the startup process of the EC2). Was too slow in its initial connecting and subsequent retrieving files. It also did not appear to follow any Windows file locks set by other EC2s in the fleet (most likely due to VFS caching, my understanding of this is that every server loads up its own local version of the file for use).Attaching to FSx through an AWS managed Active Directory. Sort of works if AMIs are preconfigired as connected to the directory, however after 30 days that connection expires, the EC2s loose access, and a new AMI needs to be configured with the connection to spin up new EC2s with since the previous connection is no longer valid. I understand that this is due to not disconnecting from the AD and sysprepping the instance before AMI creation, meaning the AD connection established is seen as the same computer account on each EC2 that was created from the AMI. However if EC2s are sysprepped and configured to connect to the AD using a "User Data" script provided in my EC2 launch template, establishing the connection to FSx takes far too long. (Set up like this blog post: https://aws.amazon.com/blogs/compute/managing-domain-membership-of-dynamic-fleet-of-ec2-instances/)FollowComment"

Answer: "3Use Amazon Elastic File System (EFS) as shared network storage between your Windows EC2 instances as one possible solution to your problem. EFS is a scalable, highly available, and fully managed file storage service that supports NFSv4 and SMB protocols, making it an excellent choice for your needs.To use EFS with your Windows EC2 instances, use the SMB protocol to mount the file system, which allows you to access the file system via UNC paths or mapped drive letters. You can mount the file system during the startup process of your instances by using a PowerShell script or an instance startup script.https://learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3?tabs=server# Install the EFS clientAdd-WindowsFeature FS-SMB1,FS-SMB2# Mount the EFS file systemNew-PSDrive -Name E -PSProvider FileSystem -Root "\\fs-01234567.efs.us-west-2.amazonaws.com\my-efs" -PersistCommentShareEXPERTsedat_salmananswered a month agorePost-User-8040867 a month agoThank you, I will try this out. Just to be clear though, the EFS documentation states it is not supported on Windows EC2s so I assume this is a bit of an "unofficial" solution. Are there any caveats you are aware of that I should know?ShareRob_H EXPERTa month agoThis would not be the recommended way to do this. It introduces less secure connection protocols for Windows.Share0If you're using Active Directory then doing your original method with FSx (Or your own managed file server) would be the right option. To get over the computers not joining the domain correctly you may want to take a look at : https://catalog.us-east-1.prod.workshops.aws/workshops/ace21ec3-c22b-484d-8e0d-4b497eadfc66/en-US/1-managing-microsoft-workloads-at-scale-on-aws/scalingmanagement  Which can help you step through setting up how to leverage lifecycle hooks of the EC2 instance to take a fresh AMI and join it to the domain for you. This way you don't have to implement less secure protocols to use SMBv2-SMBv2 protocols for EFS, which is not designed to be used on Windows systems.CommentShareEXPERTRob_Hanswered a month ago"


Question: lambda versioning

"When my model triggers a call to a lambda, I can't currently specify a version number or alias.  Could this be added for a future release of Events?At present, can I assume this is calling the $LATEST version?FollowComment"

Answer: "0You can specify a specific lambda function version or alias by providing a qualified function ARN in the detector model definition. An unqualified ARN will call the $LATEST version.You can see more on qualified and unqualified function ARN here:https://docs.aws.amazon.com/lambda/latest/dg/configuration-versions.htmlCommentShareAWS-User-6914679answered 4 years ago0Thanks for the reply!When I'm using the Events model editor, I believe it currently only lets me specify a lambda action, it only lets me specify the lambda by name, not ARN.  Right?And currently, it doesn't let me specify the name with 'my-lambda:3' or 'my-lambda:devel'.One way or another, it would be handy to specify the specific version/alias to call.  Does that seem reasonable?CommentShareMcMikeanswered 4 years ago0The console does not support adding versions yet. For now you can set version in function ARN in detector model definition through CLI. We are working on adding this feature to console.Example in adding versions:You can add version to Lambda function ARN like the example below, and then update your detector model through update-detector-model command{    "lambda": {        "functionArn": "arn:aws:lambda:<REGION>:<YOUR_ACCOUNT_ID>:function:<FUNCTION_NAME>:<VERSION>"    }}You can check full detector model definition in attachmentFor more info regarding update-detector-model command, please visit https://docs.aws.amazon.com/iotevents/latest/developerguide/iotevents-commands.htmlCommentShareAWS-User-5857602answered 4 years ago0you can create function aliases. please see https://docs.aws.amazon.com/lambda/latest/dg/configuration-aliases.htmlCommentSharearkatawsanswered 3 years ago"


Question: Codecatalyst dev environments and changing devfiles

"Hi there,I've been playing with the devfile.yaml setup and had some issues getting changes recognised. Eventually I did the sensible thing and RTFM or at least the article at https://repost.aws/articles/ARBTATztMgQOeYyMZ9IAmxDw/configuring-codecatalyst-dev-environments.I'd been editing the devfile and then stopping/re-starting the environment, but this didn't pick up any changes. In the article, it states that after changing the devfile, you need to create a new dev environment to pick up the changes. For myself, this meant first deleting the existing dev env since I got a message about not creating two environments with the same IDE and branch, but after creating the new env I could see the new changes.I'm assuming this means the devfile is cached somewhere, or that restarting an existing environment doesn't check for changes? Are there any plans to provide a method of 'refreshing' an existing dev environment?FollowComment"

Answer: "2Accepted AnswerI think you will need to commit the devfile.yaml to the repository , then stop & kill the Cloud9 instance/dev envronment.A completely newly created DevEnvironment should then use the devfile.yaml - did you try that?CommentShareLockheadanswered 4 months agoSimon Hanmer 4 months agoHi. yes as mentioned above, I've got it working that when creating a new environment it picks up the devfile. It would just be good if there was some mechanism where we could force an environment to pick up a refreshed devfile - but it's a minor pain point.Share2As @Lockhead mentioned, commit your changes and then start the Dev Environment. Let us know if the issue persists.From our documentation, https://docs.aws.amazon.com/codecatalyst/latest/userguide/devenvironment-devfile.htmlWe recommended that you edit the devfile in a supported IDE and then update your Dev Environment, but you can also edit the devfile from the root of the source repository in CodeCatalyst. If you edit the devfile in a supported IDE, you must commit and push your changes to the source repository or create a pull request so a team member can review and approve the devfile edits.CommentShareRahul_AWSanswered 4 months ago0Hi there,yes, if I make the changes to the devfile and then start a new environment, the changes get picked up.I realise that devfiles are probably not going to change very often, so it's just a minor friction point that we have to create a new environment rather than being able to 'refresh' an existing environment.CommentShareSimon Hanmeranswered 4 months ago"


Question: Cron Trigger CLI

"I am working on creating our entire CodeBuild environment through the CLIIt looks like it is not currently possible to create Cron triggers through the CLI and those have to be created via the console?If this is correct, is this going to change?FollowComment"

Answer: "0Accepted AnswerCodeBuild build triggers are simply CloudWatch event rules.When creating build triggers through the console, what is actually being created is a CloudWatch event rule. You can create CloudWatch event rules using the CLI, for example:aws events put-rule \    --name run-codebuild \    --schedule-expression 'rate(1 hour)' \    --role-arn arn:aws:iam::000000000000:role/service-role/AWS_Events_Invoke_CodeBuild_124052220                            aws events put-targets \    --rule run-codebuild \    --targets '[    {        "Id": "some_id",        "Arn": "arn:aws:codebuild:us-east-1:000000000000:project/some-codebuild-project",        "RoleArn": "arn:aws:iam::000000000000:role/service-role/codebuild-some-codebuild-project-service-role"    }]'If the CW event rule is associated with a CodeBuild project, that event rule will show up under the project's build triggers.CommentSharelouis-awsanswered 4 years ago"


Question: Does AWS Control Tower have integrations with the AWS VPC IPAM service?

"If I start using IPAM and later on use Control Tower, will Control Tower use my IPAM integration? Or would i have to make a significant changes to for Control Tower to deploy VPCs using the AWS Pool CIDR that I provide?FollowComment"

Answer: "4Currently, as of Control Tower the 2.7 version of the Landing Zone does not use IPAM, but with all things AWS that could change down the road. While Control Tower does not directly use IPAM it doesn't mean it can't be incorporated as the Account Factory and Account Factory for Terraform (AFT) provide both Cloudformation and Terraform methods to customize your Control Tower controlled organization. You could disable the default Control Tower Network Configuration and instead implement your own customized version.CommentShareJeremyanswered a year ago"


Question: Notebook stopped working. Cannot access and shows in notebook instances only intermittently.

"I was working on a Sagemaker notebook when suddenly it stopped working. I stopped and notebook and started it again, but now I cannot access it, getting the following error:AccessDeniedExceptionUser: arn:aws:sts::755460267215:assumed-role/voclabs/user1672114=9540446637 is not authorized to perform: sagemaker:ListNotebookInstances with an explicit deny in an identity-based policyCan somebody please help? I should note that I am pretty new to the Sagemaker environment.FollowComment"

Answer: "0It looks like the AWS IAM identity that you're logged in to the AWS Console with (going by your error message, the assumed Role voclabs) does not have permission to list SageMaker notebook instances.If you use multiple Roles (or a combination of your own IAM User and assumed Roles), you may need to switch roles back to the identity you were previously using to access SageMaker.If you always use the same role, it may be that the attached access policies have been changed (reference list of SageMaker IAM actions and resources here). You'll need sagemaker:ListNotebookInstances to list notebook instances in the console and sagemaker:CreatePresignedNotebookInstanceUrl to open Jupyter/JupyterLab on an instance. From the error message it looks like there's a permission policy attached to your role that's explicitly denying this access. Your administrator should be able to help with this, or can refer to the AWS IAM documentation and IAM service console if you manage the account yourself.CommentShareEXPERTAlex_Tanswered a year ago"


Question: "Error: You have exceeded your monthly credit limit, please see our FAQs to learn more."

"Hello,I am trying to publish a new batch of respondents on my MTurk requester account. I keep getting the error message of: You have exceeded your monthly credit limit, please see our FAQs to learn more.My AWS quota appears to say 2,500 and the amount I am requesting is below this. I even tried changing it to just 10 workers and I get the same error message. Is there any advise on how to fix this? This is the first HIT I am requesting workers for so I have not reached any quota thus far.Thanks!FollowCommentrePost-User-2091390 4 months agoDid you find out how to fix this? I'm having the same issue and publishing my survey is really time-sensitive :(Share"


Question: How to use Application Load Balancer to route traffic to different backend services

I have two boxes let's say box A and Box B. Both has seperate service applications with its own dbs. Both boxes should do calls to third-party legacy websocket /rest endpoints which cannot be changed in anyway.This third party endpoint is called through ALB and ALB IP is whitelisted on their endWhen a box A make (rest/websocket) request to 3rd party endpoint relative response should arrive in Box Asame applies to Box B how to achieve this? Would Application Load Balancer know how to deliver each response to it's correct requester? Note application in A and B are background services not browsers.FollowComment

Answer: "1Based on your question, you want an AWS Application Load Balancer (ALB) to route incoming traffic from a third-party source to either box A or box B, depending on which box made the initial request to the third-party service.this type of request-reply correlation is not inherently supported by ALB. The main function of an ALB is to distribute incoming application traffic across multiple targets, such as EC2 instances, in multiple Availability Zones. It doesn't inherently manage state or handle the correlation of requests and responses in the way you're describing.For REST API calls, each request-response cycle is typically independent and stateless. Therefore, if box A and box B are making separate requests to a third-party service, each will receive its own response directly, without the involvement of ALB.For WebSocket connections, it's a little more complex because these are stateful connections. If box A opens a WebSocket connection to a third-party service through the ALB, and then box B does the same, each box will have its own separate WebSocket connection and will receive responses on that connection.However, if you are trying to route third-party responses that come independently of any request (i.e., asynchronous responses), the ALB will not be able to direct those responses based on prior requests.If you need to handle complex routing based on your application's internal logic or based on request-reply correlation, you might consider implementing a service mesh with AWS App Mesh or using AWS Lambda with AWS Step Functions to manage the state and routing logic. These services provide more granular control over request routing and state management.It's also important to note that, in some scenarios, you might need to modify the design of your application services or discuss with the third-party service provider to support the routing needs.CommentShareEXPERTsedat_salmananswered 16 days agorePost-User-9416263 16 days agoThanks for your answer. Can I use APi Gateway instead of appmesh and intergrate with lambda to do complex route decision making? If so could you kindly share any links how I can do this or point me what should I be doing/searching to go about itShare"


Question: How to enable DNSSEC public/private key on Route53?

The unhelpful Route53 instructions tell me I need to generate the public/private key on my "DNS provider". But Route53 is in fact my DNS provider. My domain is hosted on Digital Ocean. Do I need to generate public/private key there?FollowComment

Answer: 0This article might help you.https://repost.aws/knowledge-center/route-53-configure-dnssec-subdomainCommentSharerePost-User-5208427answered 2 months agoEXPERTalatechreviewed 2 months ago


Question: Remapped header from AWS Lambda response

"I have a web app with HTTP API deployed on AWS Lambda. The Lambda has both AWS API Gateway proxy integration and function URL. I'm calling it directly using function URL, without API Gateway. One of the endpoints uses basic HTTP authentication and returns 401 in case of invalid credentials. I'm adding "WWW-Authenticate" header set to "Basic" to the 401 response, so that web browser can handle it properly. The problem is that the header in response is remapped to "x-amzn-Remapped-www-authenticate".I found an information that using API Gateway it's expected behaviour, but I cannot find any info how it should work using function URL directly. Is there any way to fix it and disable header remapping?FollowComment"

Answer: "1Ref Links:https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-override-request-response-parameters.htmlserverlessThe remapping of certain HTTP headers, such as "WWW-Authenticate", to "x-amzn-Remapped-*" is designed to prevent certain types of potential security vulnerabilities.However, the AWS API Gateway is able to return headers without remapping. Therefore, when a service like AWS Lambda is integrated with AWS API Gateway, it's possible to have more control over HTTP headers. AWS API Gateway can add or modify HTTP headers before the client receives them.In your specific case, since you're invoking the Lambda function directly using its ARN, the function's response will always be subject to Lambda's automatic header remapping. One workaround could be to use AWS API Gateway even though you are currently avoiding it.CommentShareEXPERTsedat_salmananswered 16 days agoMieszko 16 days agoUsing API gateway is also okay, as long as I it doesn't remap the header. How to do it? Is it doable without custom lambda authorizer and having a proxy integration?Share1Yes, both API gateway and Lambda function url remap "WWW-Authenticate" to "x-amzn-Remapped-www-authenticate" in case of 401. If you are using cloud front then one possible way could be to move your basic authentication to cloudfront lambda@edge.CommentSharedinsajwaanswered 16 days ago"


Question: EC2 Auto Domain Join using wrong DNS Servers

"I'm using an AD Connector in a lab environment and have configured it to use internal lab AD Servers and I've specified the internal DNS server IPs.  Domain join fails and I notice  that the EC2 instance is using the default VPC DNS server not the DNS servers specified in the AD Connector or the same ones in (domain join json document).  The DNS IP's listed below are correct but in a different region than the EC2 instance but the VPC's are peered and the ec2 instance can perform nslookup operations on both dns servers.Any idea why new ec2 servers are not given these IP addresses when requested to join to this domain?  Do they have to be in the same VPC?aws ssm get-document --name "awsconfig_Domain_d-9067434477_SteveCoOregon.com"{    "Name": "awsconfig_Domain_d-9067434477_SteveCoOregon.com",    "CreatedDate": "2022-03-11T03:27:45.633000+00:00",    "DocumentVersion": "1",    "Status": "Active",    "Content": "{\"schemaVersion\": \"1.0\",\"description\": \"Automatic Domain Join Configuration created by EC2 Console.\",\"runtimeConfig\": {\"aws:domainJoin\": {\"properties\": {\"directoryId\": \"d-9067434477\",\"directoryName\": \"SteveCoOregon.com\",\"dnsIpAddresses\": [\"**10.100.130.16**\", \"**10.100.146.64**\"]}}}}",    "DocumentType": "Command",    "DocumentFormat": "JSON"}FollowComment"

Answer: "0I suggest running the SSM command document AWS-JoinDirectoryServiceDomain from the ssm console where you can then get output error message - see hereAlternatively a great way to continue to use the default VPC resolver is to configure route53 outbound endpoints and rules. In this model you would not need to supply the dns values and has the added advantage of allowing vpc privatelink endpoints to utilise dns integrationCommentShareEXPERTPeter_Ganswered a year agoAWS-User-6219716 a year agoThe route53 suggestion worked to resolve AD DNS using the default vpc DNS settings.  It didn't fix the auto join problem.Share0I ran the command manually as you suggested and received the output below.  If I manually change the DNS on the instance and do a manual join from the OS, the join works.I will look at the other suggestion you made but wanted to see if I could get this working first.Failed to create domain computer account 'EC2AMAZ-JT656AN', Message=Could not create computer. RequestId: 1fa37045-9c5d-43a5-bfe0-f01e56873cc9 : RequestId: 1fa37045-9c5d-43a5-bfe0-f01e56873cc9,ErrorCode=InvalidParameterException,ErrorType=Unknown,StatusCode=BadRequestAmazon.DirectoryService.Model.InvalidParameterException: Could not create computer. RequestId: 1fa37045-9c5d-43a5-bfe0-f01e56873cc9 : RequestId: 1fa37045-9c5d-43a5-bfe0-f01e56873cc9 ---> Amazon.Runtime.Internal.HttpErrorResponseException: The remote server returned an error: (400) Bad Request. ---> System.Net.WebException: The remote server returned an error: (400) Bad Request.   at System.Net.HttpWebRequest.GetResponse()   at Amazon.Runtime.Internal.HttpRequest.GetResponse()   --- End of inner exception stack trace ---   at Amazon.Runtime.Internal.HttpRequest.GetResponse()   at Amazon.Runtime.Internal.HttpHandler`1.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.Unmarshaller.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.ErrorHandler.InvokeSync(IExecutionContext executionContext)   --- End of inner exception stack trace ---   at Amazon.Runtime.Internal.HttpErrorResponseExceptionHandler.HandleExceptionStream(IRequestContext requestContext, IWebResponseData httpErrorResponse, HttpErrorResponseException exception, Stream responseStream)   at Amazon.Runtime.Internal.HttpErrorResponseExceptionHandler.HandleException(IExecutionContext executionContext, HttpErrorResponseException exception)   at Amazon.Runtime.Internal.ErrorHandler.ProcessException(IExecutionContext executionContext, Exception exception)   at Amazon.Runtime.Internal.ErrorHandler.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.CallbackHandler.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.EndpointDiscoveryHandler.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.RetryHandler.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.CallbackHandler.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.CallbackHandler.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.ErrorCallbackHandler.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.MetricsHandler.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.Internal.RuntimePipeline.InvokeSync(IExecutionContext executionContext)   at Amazon.Runtime.AmazonServiceClient.Invoke[TResponse](AmazonWebServiceRequest request, InvokeOptionsBase options)   at Amazon.EC2Services.Config.Plugins.DomainJoin.Ec2SDomainJoin.CreateComputer(DomainJoinDto domainJoinDto, String desiredComputerName, String accountCreationPassword)Domain join failed with exception: Domain Join failed, ComputerName:EC2AMAZ-JT656AN; Message:Could not create computer. RequestId: 1fa37045-9c5d-43a5-bfe0-f01e56873cc9 : RequestId: 1fa37045-9c5d-43a5-bfe0-f01e56873cc9; ErrorCode:InvalidParameterException; ErrorType:Amazon.DirectoryService.Model.InvalidParameterException; StatusCode:BadRequestexit status 1CommentShareAWS-User-6219716answered a year ago"


Question: Metric filter for logs JSON data with @ property names

"For Logs Insights, it seems rather straightforward to query/filter against JSON data with property names prefixed with '@'| filter @@level like /Error/ and @@msgtxt in ["event 1", "event 2"]However when it comes to defining filter patterns for custom metrics, the JSON property matching selector does not appear to like '@'https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html{ $.@msgtxt = "event 1" || $.@msgtxt = "event 2" }will throwAn error occurred while testing the subscription filter.Invalid character(s) in term '$.@'How should the proper metric filter pattern be like?Edited by: icelava on Oct 5, 2021 11:33 PM TypoFollowComment"

Answer: "0The documentation does not explicitly state so, but OR filters can also apply to whole phrases instead of just standalone words.?"Event 1" ?"Event 2"So have to fall back to plain text-phrase matching instead of JSON selector matching.Edited by: icelava on Oct 6, 2021 4:28 AMCommentShareicelavaanswered 2 years ago0I need to filter on JSON properties with @ as a prefix as well. Can Amazon come out and explicitly say whether they don't support fields which start with special characters and that it was a significant oversight or give us a way around this? It's already painful to use this tool after coming from other log providers which support this or show logs from recent to oldest instead.CommentShareSD123answered 2 years ago"


Question: CodeBuild is not authorized to perform: sts:AssumeRole

"I am trying to switch from creating CodeBuild jobs manually to creating them using the CLI.However I am running into issues doing this.Command I am running:aws codebuild create-project --name "PROJECTNAME" --region "us-east-1" --source type=GITHUB,location="GITHUBURL",gitCloneDepth=1 --artifacts type=NO_ARTIFACTS --environment type=LINUX_CONTAINER,image=aws/codebuild/docker:18.09.0,computeType=BUILD_GENERAL1_SMALL --service-role SERVICE_ROLEFor this the SERVICE_ROLE is a role that I am currently using in another CodeBuild job. But when I try to run it from the CLI I am getting:An error occurred (InvalidInputException) when calling the CreateProject operation: CodeBuild is not authorized to perform: sts:AssumeRole on [ARNTO_SERVICE_ROLE]I tried adding the permission for sts:AssumeRole to that service role, but that did not fix the issue.The CLI is using an admin role and should any rights necessary for it to be able to do this.FollowComment"

Answer: "1Hi,I recently faced same issue and I was able to resolve it by doing the following :Open the IAM console at https://console.aws.amazon.com/iam/ and select your IAM role. (e.g SERVICE_ROLE)Click on the Trusted Relationships tab and verify that your IAM role has the correct trust policy for AWS CodeBuild. See example JSON below :{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "Service": "codebuild.amazonaws.com"            },            "Action": "sts:AssumeRole"        }    ]}For more information refer to this documentation: Create a CodeBuild service roleCommentSharesyumaKanswered 5 months ago0Hi jonwis, I am Yong from AWS CodeBuild team.Do you still see this error? My suggestion is to follow this troubleshooting guide. https://docs.aws.amazon.com/codebuild/latest/userguide/troubleshooting.html#troubleshooting-assume-roleIf you still see the same error, can you please run the command with debug logging turned on and private message me the entire response payload? I can then help troubleshoot on our side.aws codebuild --debug create-project ...CommentShareAWS-User-1310785answered 4 years ago"


Question: Secrets Manager rotation failure retry details

"In the secrets manager documentation it states:If any rotation step fails, Secrets Manager retries the entire rotation process multiple times.I've also seen conflicting reports that it will retry the current step of rotation that it was on.Is it possible to more clearly document how Secrets Manager retries rotation failures, with specific details? When writing a custom rotation lambda to manage resources that don't fall into one of the generic templates AWS provides, it is necessary to understand how lambda invocation failures are handled by the Secrets Manager service. Without this information, it is impossible to write robust rotation logic that can handle transitive failures of the rotation lambda.FollowComment"


Question: Thing group limit

Documentation https://docs.aws.amazon.com/general/latest/gr/iot-core.html#thing-limits states that a thing can belong to at most 10 groups.Does this mean only 10 static groups or only 10 combined static and dynamic groups?FollowComment

Answer: 0As such the assumption is that the thing group limit is global and applies to static and dynamic groups together.CommentShareNikitaKHanswered 2 years ago0Turns out this is mentioned as a limitation on both pages:https://docs.aws.amazon.com/iot/latest/developerguide/dynamic-thing-groups.htmlhttps://docs.aws.amazon.com/iot/latest/developerguide/thing-groups.htmlCommentShareNikitaKHanswered 2 years ago


Question: Stop SNS from sending emails

"I had a Lambda function send a test message to an SNS topic to be emailed to two email addresses. It somehow created an infinite loop, and I'm getting 10-20 emails per minute. I deleted the Lambda function and the SNS topic, but the emails keep coming. The SNS topic's subscriptions to the two emails cannot be deleted because they are listed as "Pending confirmation". I tried deleting and unsubscribing them with CLI, but it says that it cannot delete or unsubscribe subscriptions that are "Pending confirmation." Any suggestions on how to stop these emails?FollowComment"

Answer: "1The problem was created by "an SNS triggering the Lambda function and the Lambda function publishing to the same SNS topic. For example, SNSTopicOne => LambdaFunction => SNSTopicOne."Apparently, according to AWS support, the email messages were put into queue before I deleted the Lambda function and it just took a long time for the queue to be cleared. Support may have cleared the queue manually at some point. Nice to have this resolved since I received a few thousand emails!CommentSharekparkeranswered 3 months ago"


Question: EKS AWS Load Balancer Controller -getting error while provisioning  AWS ALB LBR in EKS

"Hello All,to provision aws alb Ingress i am following belowhttps://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.5/https://repost.aws/knowledge-center/eks-alb-ingress-controller-setupAfter performing all steps i am getting below error{"level":"error","ts":"2023-05-18T01:04:02Z","logger":"controllers.ingress","msg":"unable to determine AWS Shield subscription state, skipping AWS shield reconciliation","error":"AccessDeniedException: User: arn:**************************3935 is not authorized to perform: shield:GetSubscriptionState on resource: arn:aws:shield:::subscription/ because no permissions boundary allows the shield:GetSubscriptionState action"}Can Anyone give me some insights around this??RegardsAnoopFollowComment"

Answer: "0Do you know what user "User: arn:**************************3935" is?It seems that this user lacks the "field:GetSubscriptionState" permission, so why not try to set it up in IAM?CommentShareEXPERTRiku_Kobayashianswered 17 days agoUser-8563926 16 days agoThanks for responding RinkuThe  User: arn:**************************3935 is associated to AWS ALB controller .........what sort of permission shall i require??? and why does that require that permission that is not clear to meShareRiku_Kobayashi EXPERT16 days agoI don't know exactly either, but it may be that AWS Load Balancer Controller is getting information from AWS Shield and using it for DDos protection, etc.The only way to know for sure is to explore the information in the "AWS Load Balancer Controller".In the meantime, it would be a good idea to attach privileges to the user and see if the error disappears.The "GetSubscriptionState" is not a permission to delete or create anything, so there is little danger in attaching it.Share"


Question: Cannot SSH into any EC2s a few minutes after starting

"Hello,I am running into the same problem as the link here https://forums.aws.amazon.com/thread.jspa?threadID=319773&tstart=0.  I am able to SSH into an EC2 instance for 1-2 minutes right after it is provisioned and starts up, but then my SSH connection stalls and I am unable to log back in.Could someone from AWS please refer me to customer support to check my account?  I have already submitted a support ticket (caseID 6933607841), but was asked to post here as my ticket was classified as a technical ticket and I only have basic support.Thanks!EdFollowComment"

Answer: "0For anyone that's wondering what happened, I was able to resolve this with AWS support.  What happened was that I had previously closed and reopened my account several years ago.  When I closed my account, there were some things that were disabled/blocked.  When I reopened my account, the blocks were still in place, and AWS support was able to help get those things unblocked.CommentShareEddddanswered 3 years agorp3 a year agoConfirmed exact same story for me here as well.Share"


Question: [IAM] Programmatically list all users with console access enabled

ListUsers only contains 'PasswordLastUsed' which isn't suitable to use for this purpose.FollowComment

Answer: "0Accepted AnswerA login profile is required for console access, so any IAM user with a login profile has access to the console.So, using the CLI or API that fits your use case:list-usersfor each userget-login-profile --user-name <user>If no login profile then they do not have console access.CommentShareMike_Oanswered a year ago0You can find this information in a Credentials Report. See: Getting credential reports for your AWS account. You will need to parse the report but the data you are looking for is in there.CommentShareEXPERTkentradanswered a year ago"


Question: RDS Supported Database Engines

"Does RDS support Aurora?I'm not getting consistency from a couple of resources that I'm reading.  One resource indicates that RDS is compatible with MySQL, PostgreSQL, MariaDB, Microsoft SQL Server, and Oracle.  A different resource add Aurora to that list.FollowComment"

Answer: "2Accepted AnswerYes,  Amazon Aurora with MySQL compatibility and Amazon Aurora with PostgreSQL compatibility are two of the supported databases engines along with the others you referenced.https://aws.amazon.com/rds/CommentShareMODERATORphilawsanswered 6 months agoEXPERTAWS-User-Nitinreviewed 6 months agoTLChandler 6 months agoThanks Philaws.  Your response was quicker than quick - expeditious!!!Share"


Question: Postgres Migration 10.6 -> 11.1:  "permission denied for schema public"

"We have increased our storage from 600GB to 1 TB and migrated from Postgres 10.6 to 11.1.After the migration all the Postgres roles including the master role cannot access objects in the public schema any more.E.g.:select * from public.spatial_ref_sys;results in 42501 ERROR: permission denied for schema publicThis query executed as master shows false for create and usage permissions:WITH "names"("name") AS (  SELECT n.nspname AS "name"    FROM pg_catalog.pg_namespace n      WHERE n.nspname = 'public') SELECT "name",  pg_catalog.has_schema_privilege(current_user, "name", 'CREATE') AS "create",  pg_catalog.has_schema_privilege(current_user, "name", 'USAGE') AS "usage"    FROM "names";I have triedGRANT ALL ON DATABASE dwh TO master;which is executing without errors. ButGRANT ALL ON SCHEMA public TO master;would result in permission denied error.Does anyone have an idea, how this can be resolved?FollowComment"

Answer: "0Accepted AnswerHello,Can you try running the following first as a role that has rds_superuser:ALTER SCHEMA public OWNER to master;And if that resolves your issue?Thanks!John HEdited by: awsatjohnh on Apr 12, 2019 6:15 PMCommentShareAWS-JohnHanswered 4 years ago0I could resolve it.I had to run as master:ALTER SCHEMA public OWNER TO master;GRANT ALL ON SCHEMA public TO master;Now I can access the objects in public again. However, it is strange why it happened that no role could access the public object anymore. Did the migration procedure change the owner and revoke the grants?Edited by: vimlech on Apr 15, 2019 1:57 AMCommentSharevimlechanswered 4 years ago"


Question: Does AWS ID Center 2FA QR Code Work?

Perhaps we grossly misunderstood the documentation at https://docs.aws.amazon.com/singlesignon/latest/userguide/how-to-register-device.html This is the issue we are confronted with:https://1password.community/discussion/comment/671435#Comment_671435Can't seem to be able to get this completed for me or users.Will appreciate any insight that I might be missing.ThanksFollowComment

Answer: "0Hi,Make sure you enable the Authenticator Apps option in your MFA types within IAM Identity Center. For 1password you will need to select Authenticator Apps, not Security Keys and built-in authenticators.Here is the documentation on where to configure this setting: https://docs.aws.amazon.com/singlesignon/latest/userguide/how-to-configure-mfa-types.htmlCommentShareRian Brooks-Kaneanswered 5 months ago"


Question: Can't migrate from snapshot to aurora

"I'm trying to migrate my postgresql to aurora through a snapshot as detailed here, but the "Migrate Snapshot" option under actions is greyed out.The snapshot postgre version is 12.9 and I've checked it's supported by aurora. Before, it was version 12.8 and I tried upgrading the db to see if it would solve the problem but had no luck.FollowComment"

Answer: "1Accepted AnswerI have successfully created an Aurora cluster with the AWS CLI.Depending on the engine version, it seems that it can only be done with the AWS CLI.aws rds restore-db-cluster-from-snapshot \--snapshot-identifier {snapshot ARN} \--engine-version 12.9 \--db-cluster-identifier {cluster name} \--engine aurora-postgresqlaws rds create-db-instance \--db-cluster-identifier {cluster name} \--db-instance-class db.t3.medium \--db-instance-identifier {instance name} \--engine aurora-postgresqlCommentShareokadarhianswered a year agorePost-User-9089843 a year agoThis solved it. I've even manage to use aurora serverlerss with this solution, but had to upgrade to 13.6 first.Share"


Question: Snowball Edge Support only aws-cli-1.6.14

"HelloTeam,i am stuck on configuring the older version of aws-cli-1.6.14  ,  i tried all the possible ways as guided on the snowball help page.FollowComment"

Answer: "0There are two valuable documents and a three videos that can aid you.First is the AWS Snowball Data Migration Guide which is a step-by-step guide to configuring and making a copy using the cli.Second is the Best Practices for Accelerating your Data Migration  blog.The three videos are:Snowball Edge Unlocking and UnboxingCopying data to AWS Snowball Edge using S3Copying Data to Snow Using NFS on WindowsIf you still have questions, please reach out to your AWS account team or support.CommentSharephr0stByteanswered a year ago"