Question: Could not transfer .com.au domain out from Route 53

"Hi there,I'm trying to transfer a single .com.au domain away from Route 53, but I am unable to.The console lists the domain "Transfer lock" as "Enabled", but the usual link to disable the lock is not thereThere is a note "Transfer lock isn't supported for .com.au domains".The status code is: clientTransferProhibitedI have generated an auth code and given to the other registra but they say it is failing.I see a number of other posts in the route53 forum about this same issue with .com.au domains, and notes from AWS saying they will get in touch directly. Could I get that help please?I could not post new thread or reply an exiting thread in the forum. Forum is in read-only mode. Hope this is the right place for me to post the question.Thanks in advance.FollowComment"

Answer: "0Please raise a support case in the AWS Console for this - the support team can interact directly with the Route 53 service team and assist you with this.CommentShareEXPERTBrettski-AWSanswered a year agoAWS-User-0355948 a year agoHi Brettski,Thank you for your reply. But I didn't purchase support plan, I could not create a case under Basic Support Plan in support center. Could you let me know where or how I could do it in AWS Console, please?Thank you.ShareAWS-User-0355948 a year agoI have waited 2 days and no more help given.I could not transfer my domain out of Route 53, because AWS could not give me an option to unlock the domain. But without unlocking the domain, I could get an auth code in Route 53. I believe that this is a problem of AWS.I could not pay for the support to let AWS fix its problem. I think AWS could not force me to use Route 53 and I should have my right to transfer my domain in or out of Route 53. Maybe it is the time for me to seek legal help. I already took enough screenshots to approve what I said above.Share"


Question: How can we install awslogs agent for python version 3.8.10

How can we install awslogs agent for python version 3.8.10FollowComment

Answer: "0Hello,CloudWatch Logs agent works watching log files from Amazon EC2 instances running Linux or Windows Server.According to your question, I understand that you have an application written in Python 3.8.10 and you would like to ingest logs into Cloudwatch Logs.You must write the log entries in files and setup CloudWatch Logs agent to watch the logs files and ingest the content published.Here some docs that can guide you:Use the unified CloudWatch agent to get started with CloudWatch LogsCreate the CloudWatch Agent Configuration File with the WizardYou will need to add a section like the following (described here), in your config file:"collect_list": [   {    "file_path": "/opt/aws/amazon-cloudwatch-agent/logs/test.log",     "log_group_name": "test.log",     "log_stream_name": "test.log"  },  .....]Best regards!CommentShareNightCrawleranswered 2 months ago"


Question: periodOverPeriodDifference does not take into account leap years if done in Year level

"In the following blog post:https://aws.amazon.com/blogs/big-data/add-comparative-and-cumulative-date-time-calculations-in-amazon-quicksight/under Advanced use case 3: Partial period comparisons for partialQoQQTDSales comparisons if this formula is used in conjunction with RunningSum to measure partial year this year to date vs last year to date and if one of the year is a leap year, the calculations will take into account one more or less day (depending if the leap year is a prior year or this year).Using the blogpost example, to replicate this issue, one can try this:PartialYoYYTDSales=periodOverPeriodPercentDifference(runningSum(sumIf(Sales, {Order Date} <= addDateTime(dateDiff(truncDate("YYYY",now()), now(), "HH"), "HH", truncDate("YYYY", {Order Date}))),[truncDate("HH",{Order Date}) ASC],[truncDate("YYYY",{Order Date})]),{Order Date}, YEAR, 1)if now() is a date in a leap year ,the prior year invoked will have 1 more day being added into the running sum calculation for last year.i.e. if now() is Mar 6 2020, prior year running sum calculation will include Mar 7 2019 as an extra day (from Feb 29 2020) is added into the periodOverPeriodPercentDifference calculation.This also affects all periodOverPeriod series of functions.Please advise if this could be fixed or looked into. Thank you.FollowComment"


Question: Secrets Manager lambda call get_secret_value couldn't connect to endpoint URL

"Endpointconnectionerror while retrieving secret using Lambda function.When tried to access using the endpoint URL directly via web browser, got "<UnknownOperationException/>"(https://docs.aws.amazon.com/general/latest/gr/asm.html)Checked AWS service health dashboard - no services are down as of now.See the code below:client = session.client(service_name = "secretsmanager", region_name = region_name)get_secret_value_response = client.get_secret_value(SecretId = secret_name)FollowComment"

Answer: "1Is the Lambda VPC enabled? If yes, have you created a VPC endpoint for Secrets Manager in the VPC - https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.htmlIf you haven't enabled a VPC endpoint, is there a NAT Gateway configured on the VPC?CommentShareEXPERTIndranil Banerjee AWSanswered a year ago"


Question: Error: Failed to load dynamic library at path

"Hi, I created a new project and have the following Gems enable: Certificate Manager, Gamelift, Camera, Gestures, In-App Purchases, Multiplayer, UI Basics, User Login, and Video Playback. After configuring and building, the following error message shows up when I try to open up the project:An error has occurred!d:\ly\workspace\PKG_v1_7\dev\Code\Framework\AzCore\AzCore\Component\ComponentApplication.cpp(1058): 'void_cdeclAZ::ComponentApplication::InitDynamicModules(void)'Failed to load dynamic library at path"D:/Amazon/Lumberyard/1.7.0.0/dev/Bin64vc120/Gem.VideoPlayback.632473900ed84df3a2bad2887a3bff56.v0.1.0.dll".Press OK to continue, or Cancel to debugI can't find a way to solve this issue. When I go into the directory that is supposed to contain Gem.VideoPlayback.632473900ed84df3a2bad2887a3bff56.v0.1.0.dll, it isn't there. It IS in Bin64vc140 though.Follow"

Answer: "0Accepted AnswerOkay, I figured it out. Basically, Bin64vc120 is for Visual Studio 2013 while Bin64vc140 is for Visual Studio 2015. I'm using Visual Studio 2015 but the shortcut on my desktop was for Visual Studio 2013. I just had to delete the shortcut and make a new one from Editor.exe in Bin64vc140.SharerePost-User-0869499answered 6 years ago0Glad you figured it out @REDACTEDUSERSharerePost-User-8353690answered 6 years ago0i cant fix this problem ,anyone can help me~~i cant find the Gem.VideoPlayback.632473900ed84df3a2bad2887a3bff56.v0.1.0.dll...in the bin64vc141 folderREMOVEDUPLOADSharerePost-User-5528132answered 4 years ago0hey @REDACTEDUSER"Changing settings for Code & Assets Gems will require a rebuild of your project."Follow this guide:https://docs.aws.amazon.com/lumberyard/latest/userguide/building-your-lumberyard-game-project.htmlSharerePost-User-3337236answered 4 years ago"


Question: How to correctly deploy a NodeJS Lambda Function from Visual Studio 2022

"Hello,I've been using AWS Lambda function for a while, using VS2022 as IDE, but only today I've realized that the published packages contains a lot of useless node_modules.I've created the project using the VS Template and selecting AWS Lambda Function (Node.js).My lambda function in this particular example only wtites data using AWS.DynamoDB.DocumentClient(); but when it's uploaded it's 10 MB, that's almost the size of the zipped folder..The npm installed are the default ones that I've when creating a project, so the zip package can just contain the js file.Any suggestion?FollowComment"


Question: Lake Formation blueprint for database ingestion fail with SPARK-31404

"Hello,I'am trying to run a Lake Formation blueprint for database ingestion (Aurora PostgreSQL, Glue Connection working, snapshot mode), but I got the following error:An error occurred while calling o471.pyWriteDynamicFrame. You may get a different result due to the upgrading of Spark 3.0: writing dates before 1582-10-15 or timestamps before 1900-01-01T00:00:00Z into Parquet INT96 files can be dangerous, as the files may be read by Spark 2.x or legacy versions of Hive later, which uses a legacy hybrid calendar that is different from Spark 3.0+'s Proleptic Gregorian calendar. See more details in SPARK-31404. You can set spark.sql.legacy.parquet.int96RebaseModeInWrite to 'LEGACY' to rebase the datetime values w.r.t. the calendar difference during writing, to get maximum interoperability. Or set spark.sql.legacy.parquet.int96RebaseModeInWrite to 'CORRECTED' to write the datetime values as it is, if you are 100% sure that the written files will only be read by Spark 3.0+ or other systems that use Proleptic Gregorian calendar.I've found that adding --conf spark.sql.legacy.parquet.int96RebaseModeInWrite=CORRECTED would solve. However, it is not possible to change the Glue ETL Job (got putObject: AccessDenied: Access Denied).FollowComment"

Answer: "0Hello,I understand that you are trying to update a Glue job with  parameter --conf spark.sql.legacy.parquet.int96RebaseModeInWrite=CORRECTED, however you are getting the following error"putObject: AccessDenied: Access Denied"This error is generally seen when the IAM user/role used to edit the job does not have permissions to upload to the S3 bucket containing the script.Ideally we will need to have the permissions specified in the following document for the user that is used while editing the jobhttps://docs.aws.amazon.com/glue/latest/dg/attach-policy-iam-user.htmlFor the above error specifically, we will need to allow s3:PutObject permission on the "arn:aws:s3:::<scriptBucketName>/* in the IAM policy.CommentShareSUPPORT ENGINEERSantosh_S_Sanswered 7 months ago"


Question: Available training metrics for built-in algorithms SageMaker

"Hello,I use built-in algorithms SageMaker and I search about the training metrics for each algorithms in SageMaker, is there a list the training metrics built-in algorithms SageMaker where I can review?Thank you.Regards.FollowComment"

Answer: "0Hi msvm,Thanks for your interest in SageMaker algorithms. You can find a list of metrics published by each algorithm on the "Model Tuning" page of respective algorithms.For example:Linear learner: https://docs.aws.amazon.com/sagemaker/latest/dg/linear-learner-tuning.htmlNTM: https://docs.aws.amazon.com/sagemaker/latest/dg/ntm-tuning.htmletc.Thanks,SageMaker Algorithms TeamCommentShareAWS-User-9864487answered 3 years ago0Hello,thank you for your answer. I have other doubt, can I customize the metrics for built-in algorithms, for example Object Detection during training??Thank you for your attention.RegardsCommentSharemsvmanswered 3 years ago0The set of metrics emitted by built-in algorithms during training is fixed and cannot be customized by customers.Regards,SageMaker Algorithms teamCommentShareAWS-User-9864487answered 3 years ago"


Question: Websocket issue - sync server time with javascript time

"Hello,We have implemented API Gateway web socket (with serverless AWS Lambda) and it works well.  However, we have encountered a critical issue explained below and would highly appreciate if anybody can provide a solution / workaround:We want to sync server time with client/javascript time and wanted to use web sockets to send timestamp to all connected clients at regular intervals.  However, we found that without an input action from a client, we cannot push data to the clients automatically.  Is this understanding correct?  If yes, is there any workaround for this issue, as we are using serverless architecture with AWS Lambda?Thanks in advance,KrishnaFollowComment"

Answer: "0Accepted AnswerOh, I see. You're asking how to run your Lambda periodically like cron job.First, you have to use $connect route to store connectionIds to somewhere (e.g. DynamoDB).There would be multiple ways to execute Lambda periodically, but an easiest way would be using CloudWatch event to trigger your Lambda.https://docs.aws.amazon.com/lambda/latest/dg/tutorial-scheduled-events-schedule-expressions.htmlYour Lambda function needs to retrieve connectionIds, then iterate to invoke pushToConnection to each connectionId. You may use HTTP/2 streaming to send multiple requests same time.CommentShareAWS-User-3921561answered 4 years ago0Hello,Can anybody please advise on this issue?ThanksEdited by: KrishnaMK on Mar 27, 2019 4:05 AMCommentShareKrishnaMKanswered 4 years ago0You can use @connections API to send a message from your backend service.https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-how-to-call-websocket-api-connections.htmlHere is a API in SDKs:Java SDKhttps://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/services/apigatewaymanagementapi/AmazonApiGatewayManagementApiClient.html#postToConnection-com.amazonaws.services.apigatewaymanagementapi.model.PostToConnectionRequest-JavaScript SDKhttps://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/ApiGatewayManagementApi.html#postToConnection-propertyPlease take a look at an example to use postToConnection (written in JavaScript)https://github.com/aws-samples/simple-websockets-chat-app/blob/master/sendmessage/app.jsCommentShareAWS-User-3921561answered 4 years ago0Many thanks for your response, we are using PostToConnection method mentioned to respond back when a client request comes in. However the issue is that as we are working with a full server-less architecture using AWS Lambda and we don't have the 'back-end service' to trigger messages from as and when we want.  Does this makes sense, please let us know your comments?CommentShareKrishnaMKanswered 4 years ago0Thank you very much jwaataws!!!  I think this is what we were looking for, highly appreciate your quick and great response!!!CommentShareKrishnaMKanswered 4 years ago"


Question: How get security profile and routing profile arn from connect instance in a cloudformation template

"Hi,I want to get these attributes to use it in a resource type "AWS::Connect::User" in the same cloudformation template.FollowComment"

Answer: "0Please refer the documentation link. It shows  It has detail about attributes for security profile/routing profile for your cloudformation template.https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-connect-user.htmlCommentShareSanjay Aggarwalanswered 3 months ago0Hi, thank you for your answer. Maybe I didn´t express myself quite well. I mean I want to access these defaults arn's (security profile and basic profile) at the same time, in the same cloudformation, and use that parameters to create a functional user to be  ready in the instance.Thanks again.CommentSharePabloanswered 3 months ago"


Question: Keeps getting timeout error when loading websites from my ap-south-east2 EC2 instance with node.js

"It is a t2.medium, the website is "http://lq3.titan007.com/". This does not happen on my laptop, so I am guessing it is related to ec2 instance or the region?Any help would be appreciated, thanks.FollowComment"

Answer: "0If you are experiencing timeout errors when loading websites from your EC2 instance in the Mumbai region using Node.js, there could be several reason for this issue. Here are some possible solutions to troubleshoot and resolve the problem:Since the website is working good on the laptop, hence I am assuming that the Security Group configuration, NACL configuration, Internet Connectivity, Outbound rules and DNS Resolution is all working great.It can be a application specific issue. Hence review your Node.js application code and configurations. Ensure that there are no errors or bottlenecks causing the timeouts, such as inefficient network requests, long-running operations, or improper handling of async/await or callback functions.AWS Service Health can be checked. Check for AWS Service Health Dashboard for any ongoing issues or service disruptions in the Mumbai region that could be affecting connectivity.If the issue still persists after check the above, I think it would be helpful to review the logs and error messages from your Node.js application to gain more insights into the cause of the timeouts.CommentSharehimanshustallongmailcomanswered 13 days ago"


Question: Vitis AI on  EC2 F1 instance: xbutil shows only device as not ready

"Hi,I'm currently trying to follow along this guide to setup Vitis AI on an Amazon EC2 F1 instance: https://github.com/Xilinx/Vitis-AI/tree/master/docs/awsBut I think I might be missing something as by the end, I try to follow one of the tutorials linked at the end (the resnet50 one) but it does not work, complaining about how it cannot acquire a CU when I try to run the compiled example.Now, after looking around a bit, I tried running xbutil scan which found one device, as expected, but unfortunately it said this device was not ready and I cannot for the life of me figure out what exactly is wrong, although I have a few ideas:While following the Vitis AI aws guide, after building XRT, I try to install it with the command sudo apt install ./Release/*-xrt.deb, but at the end this fails to install xclmgmt because of some unkown symbols. I found some threads which said this driver shouldn't be needed for Vitis AI though, and I also then managed to by installing linux-modules-extra-5.4.0-1054-aws like mentioned in https://forums.aws.amazon.com/thread.jspa?messageID=950464, but this did not help (I also did not try a different kernel as mentioned, since I was unsure if this was a good idea, especially if said driver ends up being unnecessary).I've seen AFI's mentioned a lot while reading through documentation, but I don't really know how they fit in with using Vitis AI, I was under the impression I wouldn't need to deal with them, from following the examples, but maybe this is the problem? I would appreciate any resources so I can understand their role in all this.I am also wondering if it even is possible to use Vitis AI with the aws fpga devices. It's my understanding that ec2 f1 instances have access to vu9p fpgas, but when I look at the Vitis AI page,  I see no specific mention of this model, which is leaving me a bit confused.Hopefully my problem makes sense, I am more than happy to post some logs/command outputs, I'm just not sure what might be helpful to see right now.Thanks in advance for any help.FollowComment"

Answer: "1I have now managed to fix the problem. After looking through the available AFIs with the aws ec2 describe-fpga-images command, I found one under the name "dpdpuv3_wrapper.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2" with global id agfi-0e168992b12da45f9 which seems to work well.So I suppose the main issue was that no AFI was loaded on startup, I don't know whether that's something that should be expected or not.Something else worth noting, I did find an older AFI with the same name but different global id which did not return reasonable results when running some of the Vitis-AI examples, so that's something worth keeping in mind for people getting silly results.Thanks for the help Deep!CommentSharebrunopaivaanswered 2 years agoAWS-User-6214137 a year agoHi brunopaiva,I also intend to run Vitis-AI examples on AWS f1 instances. So far we followed the vector addition example (https://github.com/aws/aws-fpga/tree/master/Vitis) and also separately tried to quantize and compile an example model using Vitis-AI. However, I have a doubt on how to deploy the compiled model on an f1 instance.Can you please provide some guidance regarding this?Thanks in advance!Share0Hello,The Alveo DDR supported DPU's should work on the VU9P on F1.With AWS F1, there is a concept of AFI's and awsxclbins as opposed to bitstreams/xclbins you are used to on other platforms. AWSXCLBIN's also have AFI metadata in them that let xclmgmt load the AFI on the FPGA. So to answer your question, you need XRT and XRT-AWS built and installed and working for using F1 instances with Vitis AI.Now on to debugging your issue, Did you build XRT on the same Ubuntu host? Can you share the region in which you launched the F1 instance? What does journalctl -u mpd say. These would let me help you further on getting things running.-DeepCommentShareDeep_Panswered 2 years ago0Hi Deep, thanks for the help!Yes I built XRT on the same Ubuntu host. After building and installing the relevant .deb package, I get the followingubuntu@host:~/XRT/build$ sudo apt install ./Release/*-xrt.deb  Reading package lists... Done  Building dependency tree         Reading state information... Done  Note, selecting 'xrt' instead of './Release/xrt_202110.2.11.0_18.04-amd64-xrt.deb'  The following NEW packages will be installed:    xrt  0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.  Need to get 0 B/12.4 MB of archives.  After this operation, 64.3 MB of additional disk space will be used.  Get:1 /home/ubuntu/XRT/build/Release/xrt_202110.2.11.0_18.04-amd64-xrt.deb xrt amd64 2.11.0 \\[12.4 MB\]  Selecting previously unselected package xrt.  (Reading database ... 103036 files and directories currently installed.)  Preparing to unpack .../xrt_202110.2.11.0_18.04-amd64-xrt.deb ...  Unpacking xrt (2.11.0) ...  Setting up xrt (2.11.0) ...  Unloading old XRT Linux kernel modules  rmmod: ERROR: Module xocl is not currently loaded  rmmod: ERROR: Module xclmgmt is not currently loaded  Invoking DKMS common.postinst for xrt  Loading new xrt-2.11.0 DKMS files...  Building for 5.4.0-1054-aws  Building initial module for 5.4.0-1054-aws  Done.    xocl:  Running module version sanity check.   - Original module     - No original module exists within this kernel   - Installation     - Installing to /lib/modules/5.4.0-1054-aws/updates/dkms/    xclmgmt.ko:  Running module version sanity check.   - Original module     - No original module exists within this kernel   - Installation     - Installing to /lib/modules/5.4.0-1054-aws/updates/dkms/    depmod....    DKMS: install completed.  Finished DKMS common.postinst  Loading new XRT Linux kernel modules  modprobe: ERROR: could not insert 'xclmgmt': Unknown symbol in module, or unknown parameter (see dmesg)  Installing MSD / MPD daemons  ubuntu@host:~/XRT/build$ dmesg | grep -e xclmgmt  \\[ 1491.933240\] xclmgmt: loading out-of-tree module taints kernel.  \\[ 1491.933862\] xclmgmt: module verification failed: signature and/or required key missing - tainting kernel  \\[ 1491.933980\] xclmgmt: Unknown symbol fpga_mgr_create (err -2)  \\[ 1491.934125\] xclmgmt: Unknown symbol fpga_mgr_unregister (err -2)  \\[ 1491.934195\] xclmgmt: Unknown symbol fpga_mgr_register (err -2)  \\[ 1491.934218\] xclmgmt: Unknown symbol fpga_mgr_free (err -2)  The region the instance was launched in is eu-west-2.After finishing going through the guide I mentioned before, running journalctl -u mpd outputsubuntu@host:~$ journalctl -u mpd  -- Logs begin at Wed 2021-08-11 17:54:31 UTC, end at Mon 2021-08-16 10:00:36 UTC. --  Aug 16 09:56:12 ip-172-31-154-75 systemd\\[1\]: Started Xilinx Management Proxy Daemon (MPD).  Aug 16 09:56:12 ip-172-31-154-75 mpd\\[19312\]: started  Aug 16 09:56:12 ip-172-31-154-75 mpd\\[19312\]: found mpd plugin: /opt/xilinx/xrt/lib/libmpd_plugin.so  Aug 16 09:56:12 ip-172-31-154-75 mpd\\[19312\]: aws: load default afi to 0000:00:1d.0  CommentSharebrunopaivaanswered 2 years ago0Hi, so one obvious thing I don't see here is the installation of xrt-aws.deb. Could you try installing both xrt and xrt-aws debs and restarting mpd after?-DeepCommentShareDeep_Panswered 2 years ago0Sorry I didn't mention it, but I have also installed aws-xrt, as per the guide, see:ubuntu@hostname:~/XRT/build/Release$ sudo apt install ./xrt_202110.2.11.0_18.04-amd64-aws.deb   Reading package lists... Done  Building dependency tree         Reading state information... Done  Note, selecting 'xrt-aws' instead of './xrt_202110.2.11.0_18.04-amd64-aws.deb'  xrt-aws is already the newest version (2.11.0).  0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.  I don't seem to be able to start the mpd service again though. I turned off the instance while I was away and now that I've come back to it, the mpd service is not starting, see the end of the output of journalctl -u mpd (I have a file with the rest, but it's around 380 lines total):Aug 16 11:10:10 hostname mpd\\[19312\]: udev msg arrived on fd 4  Aug 16 11:10:10 hostname mpd\\[19312\]: udev msg arrived on fd 4  Aug 16 11:10:10 hostname mpd\\[19312\]: udev msg arrived on fd 4  Aug 16 11:10:10 hostname mpd\\[19312\]: mpd caught signal 15  Aug 16 11:10:10 hostname systemd\\[1\]: Stopping Xilinx Management Proxy Daemon (MPD)...  Aug 16 11:10:10 hostname mpd\\[19312\]: failed to select: Interrupted system call  Aug 16 11:10:10 hostname mpd\\[19312\]: aws mpd plugin fini called  Aug 16 11:10:10 hostname mpd\\[19312\]: ended  Aug 16 11:10:10 hostname systemd\\[1\]: Stopped Xilinx Management Proxy Daemon (MPD).  -- Reboot --  Aug 16 20:44:08 hostname systemd\\[1\]: Started Xilinx Management Proxy Daemon (MPD).  Aug 16 20:44:08 hostname mpd\\[932\]: started  Aug 16 20:44:08 hostname mpd\\[932\]: found mpd plugin: /opt/xilinx/xrt/lib/libmpd_plugin.so  Aug 16 20:44:08 hostname mpd\\[932\]: aws: load default afi to 0000:00:1d.0  Aug 16 20:48:34 hostname mpd\\[932\]: mpd caught signal 15  Aug 16 20:48:34 hostname systemd\\[1\]: Stopping Xilinx Management Proxy Daemon (MPD)...  Aug 16 20:50:04 hostname systemd\\[1\]: mpd.service: State 'stop-sigterm' timed out. Killing.  Aug 16 20:50:04 hostname systemd\\[1\]: mpd.service: Killing process 932 (mpd) with signal SIGKILL.  Aug 16 20:50:04 hostname systemd\\[1\]: mpd.service: Main process exited, code=killed, status=9/KILL  Aug 16 20:50:04 hostname systemd\\[1\]: mpd.service: Failed with result 'timeout'.  Aug 16 20:50:04 hostname systemd\\[1\]: Stopped Xilinx Management Proxy Daemon (MPD).  CommentSharebrunopaivaanswered 2 years ago0Ok I think I found the issue. The default AFI was unavailable in eu-west-2.Can you retry mpd:sudo systemctl restart mpdYou shouldn't see the signal 15 this time around.-DeepCommentShareDeep_Panswered 2 years ago0I tried restarting mpd after turning my instance back on and this was the result from systemctl status mpd:Loaded: loaded (/etc/systemd/system/mpd.service; enabled; vendor preset: enabled)Active: failed (Result: timeout) since Wed 2021-08-18 09:17:50 UTC; 3min 19s agoCondition: start condition failed at Wed 2021-08-18 09:17:50 UTC; 3min 19s ago└─ ConditionDirectoryNotEmpty=/dev/xfpga was not metProcess: 989 ExecStart=/opt/xilinx/xrt/bin/mpd (code=killed, signal=KILL)Main PID: 989 (code=killed, signal=KILL)Aug 18 09:14:35 hostname mpd\[989]: startedAug 18 09:14:35 hostname mpd\[989]: found mpd plugin: /opt/xilinx/xrt/lib/libmpd_plugin.soAug 18 09:14:35 hostname mpd\[989]: aws: load default afi to 0000:00:1d.0Aug 18 09:16:20 hostname mpd\[989]: mpd caught signal 15Aug 18 09:16:20 hostname systemd\[1]: Stopping Xilinx Management Proxy Daemon (MPD)...Aug 18 09:17:50 hostname systemd\[1]: mpd.service: State 'stop-sigterm' timed out. Killing.Aug 18 09:17:50 hostname systemd\[1]: mpd.service: Killing process 989 (mpd) with signal SIGKILL.Aug 18 09:17:50 hostname systemd\[1]: mpd.service: Main process exited, code=killed, status=9/KILLAug 18 09:17:50 hostname systemd\[1]: mpd.service: Failed with result 'timeout'.Aug 18 09:17:50 hostname systemd\[1]: Stopped Xilinx Management Proxy Daemon (MPD).If I reboot the instance though, then mpd starts up fine (and if I try to restart it, then it breaks again).CommentSharebrunopaivaanswered 2 years ago"


Question: Need WAF Dashboard for Logs easy visibility

I am following this tutorialhttps://aws.amazon.com/blogs/security/deploy-dashboard-for-aws-waf-minimal-effort/but when I select my region and load a template I get errorapi_error_message_500Why I am getting this error?Is there any other quick way to start getting WAF logs on Kibana Dashboard?FollowCommentDan_H a year agoWhat's your region? Just checking some fundamentals...Share

Answer: "0Accepted AnswerHi,This was answered in this repostCommentShareEXPERTTushar_Janswered a year ago"


Question: kubectl error You must be logged in to the server (Unauthorized) when accessing EKS cluster

Hi guys!I am doing the hands-on lab on AWS EKS and CodePipeline topic. See the link belowhttps://000062.awsstudygroup.com/I am stuck in step 4.6 when I create a Pipeline using CloudFormation template. The Code Build failed because of an error as I attached in the photo.Please help me check!FollowComment

Answer: "1Accepted AnswerHello there,The error: You must be logged in to the server (Unauthorized) you encountered is because the kubectl in the CodeBuild is not configured properly for Amazon EKS or the IAM user or role credentials that you are using do not map to a Kubernetes RBAC user with sufficient permissions in your Amazon EKS cluster.Things to check:The Service role for CodeBuild service: eks-CodeBuildServiceRole should have this permission below. It gives it full access to EKS.    {      "Sid": "EKSAccessPolicy",      "Effect": "Allow",      "Action": [        "eks:*"      ],      "Resource": "*"    }Mapping of the Service role for CodeBuild to a Kubernetes RBAC user.From terminal Cloud9 to which you have connected EKS cluster, verify the configMap aws-auth has the right entry for the IAM role: eks-CodeBuildServiceRole with the command:kubectl edit configmaps aws-auth -n kube-systemThe eks-CodeBuildServiceRole should be mapped to masters. Be sure your AWS_ACCOUNT_ID is substituted in the snippet below:- groups:  - system:masters  rolearn: arn:aws:iam::{$AWS_ACCOUNT_ID}}:role/eks-CodeBuildServiceRole  username: codebuild-eksI was able to reproduce the steps in the guide. See the CodeBuild result.CommentShareOlawale-AWSanswered 9 months agoSteven 9 months agoThanks for your helps! Let me check again! I think the problem is in Mapping of the Service role for CodeBuild to a Kubernetes RBAC user.ShareSteven 9 months agoHi,I substituted my AWS_ACCOUNT_ID in aws-auth.yaml file but the same error still occur. Please help me check!groups:- system:mastersrolearn: arn:aws:iam::47314953xxxx:role/eks-CodeBuildServiceRoleusername: codebuild-eksShare"


Question: "periodOverPeriodPercentDifference(sum(Sales), {Order Date}, WEEK, 1)"

"I want to change the 'WEEK' period to Mon - Sun , how do I change it?Or is there any formula to calculate WoW growth?FollowComment"

Answer: "0Hello,QuickSight defines Sunday as the start of the week, by default. Upon checking internally, we can make use of the following calculated field formula to group dates by weeks starting on Monday. Please replace {date} with the field name at your endaddDateTime(    1,     'DD',     truncDate(        'WK',        ifelse(            extract(                'WD',                {date}            ) = 1,             addDateTime(                -1,                 'DD',                 {date}            ),             {date}        )       ))There is an existing feature request internally to support custom week start day/date and the internal QuickSight product team is working on it. Unfortunately, we do not have an ETA at the moment for when this feature would be available, but would I recommend you to refer to the following for further updates :[+] https://aws.amazon.com/it/blogs/aws/category/amazon-quicksight/[+] https://docs.aws.amazon.com/quicksight/latest/user/WhatsNew.htmlReference:[+] https://stackoverflow.com/questions/55117362/start-week-on-monday-in-aws-quicksight/55857785#55857785==========Regarding WoW growth calculation, we can make use of the percentDifference calculated field like the below. Please replace Value, Date with the field names at your end.percentDifference(Value, [Date ASC], -1)[+] percentDifference - https://docs.aws.amazon.com/quicksight/latest/user/percentDifference-function.htmlThanksCommentShareSUPPORT ENGINEERPujitha_N2376933answered 6 months ago"


Question: Use Cloudwatch log insight make a timeseries line

"In my log group struct islog stream1:{    "timestamp": "2023-04-14 01:19:15,918+0000"    "F1": "v1",    "F2": "v1.1",    "F3": "v1.2",    "data": "12"}log stream1.1:{    "timestamp": "2023-04-14 02:00:00,000+0000"    "F1": "v1",    "F2": "v1.1",    "F3": "v1.2",    "data": "15"}log stream2:{    "timestamp": "2023-04-14 01:19:15,918+0000",    "F1": "v2",    "F2": "v2.1",    "F3": "v2.2",    "data": "334"}log stream3:{    "timestamp": "2023-04-14 01:19:15,918+0000",    "F1": "v3",    "F2": "v3.1",    "F3": "v3.2",    "data": "2"}......I want to convert this data into a linear time-series list, according to the above example, there are three lines in the table(Suppose the aggregation time is 1h):Line 1:  named "v1-v1.1-v1.2", and there will be a data point at 2023-04-14 01:00:00 with value 12, a data point at 2023-04-14 02:00:00 with value 15Line 1:  named "v2-v2.1-v2.2", and there will just one data point at 2023-04-14 01:00:00 with value 334Line 1:  named "v3-v3.1-v3.2", and there will just one data point at 2023-04-14 01:00:00 with value 2This problem has confused me for a long time, thank you very much for your help!!FollowComment"

Answer: "0I understand you have multiple streams which reports a single datapoint aggregated over a period of one hour, and you would like to use Cloudwatch log insight  to convert this data into a linear time-series list.Inorder to achieve your objective I used the below insight query:fields @timestamp, @message, @logStream, @log| stats sum(data) by @logStream, F1, F2, F3, bin(1h)| sort @timestamp descThis will produce an output as shown here:NOTE:It is not possible to concat the F1, F2, F3 labels as you wanted “v1-v1.1-v1.2”. However, you can list them in the output next to the data.Secondly, I gather you want Line 1 to be named "v1-v1.1-v1.2”, "v2-v2.1-v2.2", and "v3-v3.1-v3.2”. However, it would not be possible to list them horizontally, it can be shown in a column in vertical formal.Let me know if the above helps in addressing your concerns. If not, feel free to elaborate the kind of output you are expecting out of insight query?CommentShareSUPPORT ENGINEERNatasha_Sanswered a month ago"


Question: How to diagnose Control Tower Landing Zone setup failure due to incorrect bucket policy for logging bucket?

"I tried to perform a basic setup using Control Tower and got the error below.  I encountered this error the first time I ran it, and then again after retrying to setup the landing zone.AWS Control Tower failed to set up your landing zone completely: AWS Control Tower cannot deploy the required stack set because the bucket policy for the logging bucket, aws-controltower-logs-1111111111111-us-west-2, is incorrect.How can I diagnose this problem?  If I'm relying on Control Tower to create the buckets and policies for me, then shouldn't this be something I don't need to worry about?  Is it a bug in Control Tower?Should I change the bucket policy somehow, and if so, is there guidance on how to change it so Control Tower can finish setting up the landing zone?Any insight is greatly appreciated.Thanks.FollowComment"

Answer: "1We had the same issue when setting up control tower with KMS encryption enabled.We found the issue to be that AWS Config could not use the KMS key due to the KMS key resource policy being set up wrong by us when creating the key.When using the policy documented for AWS Config our issue was that we did not use the correct account as the sourceAccountID.We typed in the controltower account id, but what fixed it for us was changing that to the Log Archive account id.KMS key policy granting config access to the key (cloudtrail also needs access as described in the control tower doc){    "Id": "Policy_ID",    "Statement": [        {            "Sid": "AWSConfigKMSPolicy",            "Effect": "Allow",            "Principal": {                "Service": "config.amazonaws.com"            },            "Action": [                "kms:Decrypt",                "kms:GenerateDataKey"            ],            "Resource": "<myKMSKeyARN>",            "Condition": {                 "StringEquals": {                    "AWS:SourceAccount": "<myLogArchiveAccountID>"                }            }        }    ]}CommentShareThomas Finstadanswered 4 months agoChristson Johnny S 2 months agoIf the error persists, you'll also need to to add permission for AWS Config with sourceAccount as Audit account. Check my answerShare0It sounds like you have encountered an issue with the bucket policy for the logging bucket during the setup of your Control Tower Landing Zone. Here are a few things you can try to diagnose and resolve the issue:Review the bucket policy: Check the bucket policy for the logging bucket, "aws-controltower-logs-1111111111111-us-west-2", to see if it is incorrect or if there are any issues with the permissions. Verify that the policy allows the necessary permissions for Control Tower to write logs to the bucket.Check the IAM roles: Verify that the IAM roles used by Control Tower have the necessary permissions to access the logging bucket.Check the stack set: Review the CloudFormation stack set used by Control Tower to see if there are any issues with the parameters or settings. This can be done in the AWS Systems Manager, under the “StackSets” page.Check the CloudTrail: Check if there are any CloudTrail logs that might provide more information on the failure, specifically the Control Tower Management Events.Contact AWS Support: If you are unable to diagnose and resolve the issue, you may want to contact AWS Support for further assistance.It's important to note that Control Tower is designed to create the necessary resources and policies automatically during the setup process, but in some cases, issues may occur that prevent the setup from completing successfully. If you find out that it's a bug in the Control Tower, please contact AWS Support with the details of the issue, so they can investigate and fix the problem.CommentSharejayamaheizenberganswered 4 months agoMultiverse 4 months agoThank you for these recommendations, @jayamaheizengerg, especially about the specific types of events to focus on.  In this case Control Tower is responsible for creating all artifacts, including all policies, roles, and resources to which those apply, so I was expecting it all to be created self-consistently.  The only artifact I created myself was an encryption key during the Control Tower wizard, and then told it to use that.  I'm surprised CT is working for anyone right now for creating the initial "well-architected" org structure.  I didn't expect to be debugging CT stacksets as my initiation to AWS.ShareMultiverse 4 months agoHow does one search CloudTrail for events of type "Control Tower Management"?  There are only a few attributes I can search for in CloudTrail / Event History.  For example, there are attributes Event name, Event Source, and Resource Type, but none of these have any entries that resemble "Control Tower" or even "Control...".ShareMultiverse 4 months agoIn the following section:CloudFormation / StackSets / AWSControlTowerBP-BASELINE-CONFIG: StackSet detailsthere is an instance listed with Detailed Status:  FAILEDThe Status Reason is given as:ResourceLogicalId:ConfigDeliveryChannel, ResourceType:AWS::Config::DeliveryChannel, ResourceStatusReason:Insufficient delivery policy to s3 bucket: aws-controltower-logs-..., unable to write to bucket, ... (Service: AmazonConfig; Status Code: 400; Error Code: InsufficientDeliveryPolicyException; Request ID: ...).Why would ControlTower create a bucket it can't use?ShareMultiverse 4 months agoIn AWS Systems Manager, there is no page called "StackSets".Share0I am having the same issue.CommentShareM Lehneranswered 4 months ago0I had a similar issue when upgrading from Control Tower 2.9 to 3.1. Just selecting the KMS key encryption option caused the update to fail. (I selected an existing key thinking Control Tower had obviously created it for this purpose as it had alias of "ControlTowerV3"). Unselecting the option enabled the update to work but leaves me without customer-managed KMS key encryption for now and will check with support if I should be getting Control Tower to create a new key or if I should amend the policy on the existing key...CommentShareKrisHanswered 3 months ago0Hi, I just got this working after enabling encryption to the AWS Control Tower update.{            "Sid": "AWSConfigCloudTrailKMSPolicy",            "Effect": "Allow",            "Principal": {                "Service": ["config.amazonaws.com", "cloudtrail.amazonaws.com"]            },            "Action": [                "kms:Decrypt",                "kms:GenerateDataKey"            ],            "Resource": "<KMS_ARN>" }Check this for more fine-grained permissionsCommentShareChristson Johnny Sanswered 2 months ago"


Question: Best practices for finding specific words in documents

"Hi,One of my team's use cases with Textract is to use the presence of a certain word in the document to categorize the documents. We do this using a query - "Is <word> in the document?". We tested this extensively with several test documents and it never returned an incorrect response.However, in production, we started noticing that Textract returned "Yes" for many documents even though the specific word was nowhere to be found in them. The confidence scores for these false positives go up to 65%, so setting a threshold on that can potentially reject true positives as well.I wanted to know if there are any best practices around this type of query and how I can improve its accuracy. I would also appreciate any insight into how and where Textract finds values from the document, like whether it looks into metadata or employs any sort of edit distance matching to find words.FollowComment"

Answer: "2Hello,Amazon Textract Queries uses a large language model under the hood so it may also pick up synonyms of the key word you are searching for.If you are mostly looking for exact word matches, I'd recommend trying the following techniques (against the raw text extracted by Textract):Pattern matchingLevenshtein distance matchingCommentShareNZanswered a month agorePost-User-6113138 a month agoThis is definitely a great option to consider, but it'll require some redesign of our generic service as it is set up to work only with queries right now. I was hoping for some way to improve our use of queries itself before focusing on bigger enhancements.Share"


Question: Clipboard problems in Amazon workspaces

"Hi,I'm trying to Set the text into the Clipboard using .net (Clipboard.SetText()) from my local machine and when i try to pass the sendkeys (Ctr + V) into a Notepad which was opened in Amazon workspace but the data is not getting pasted there / earlier copied data gets pasted. Is there a solution to this, can someone help on this please?FYI, i'm using Amazon workspaces client Version: 3.0.8.1536FollowComment"

Answer: "1I'm staggered this hasn't attracted more attention. It's killing us - just using windows copy/paste is a hit and miss random affair at the best of times, but until today it worked at least half the time - tho NEVER directly between workspaces.I just updated the client today and hit-and-miss is now just miss. There is no longer anything I can do to copy/paste between my desktop and workspace and that's a total deal breaker.And I can lose an hour a day just trying to get them to open, it's literally the worst software I've seen in 32 years of coding - for example, why won't it just display the REG code or custom name we gave it so we know which one we're logging in to?!As if all that isn't bad enough, just having a workspace open up suddenly wipes out the host's windows key and all sorts of things, it's a nightmare. I copied something out of jira, hit windowskey-run to run 'cmd' but windows key had been disabled by the workspace (giving it focus and coming back usually fixes it but... c'mon... a dozen updates a month and NONE benefit the user?) and it overtyped what I copied with the letter 'r' :(Edited by: infieldg on Sep 29, 2020 8:49 PMCommentShareinfieldganswered 3 years agorePost-User-8375722 5 months ago2 years later still same...Share"


Question: ongoing 502 (Bad Gateway) error

"I am consistently getting a 502 (Bad Gateway) error on an AWS website which, up until recently, had been running quite reliably for more than three years.  I had one episode a month or so ago where I got the 502 for a few hours, and then it went away, not due to anything I did as far as I know.  Now I have been getting the 502 consistently for several weeks.  The architecture is:Bitnami WordPressEC2 (t3a.small) with an Elastic IPCloudFrontCertificate ManagerR53S3 (only for W3 Total Cache)(no Application Load Balancers)I have reviewed the AWS documentation on this error and tried to investigate.  Here are some details on my efforts:In Chrome DevTools when going to the site I see:failed to load source map: Could not load content for chrome-extension://gighmmpiobklfepjocnamgkkbiglidom/browser-polyfill.js.map: System error: net::ERR_FILE_NOT_FOUNDI tried going to the domain in Safari and still got the 502.I tried going to the elastic IP directly, which redirects me to mydomain.org and the 502.The EC2 instance has been consistently running, no alarms, 2/2 checks passed.  I stopped and restarted the EC2 instance and continued getting the 502.I invalidated the cache for the CloudFront distribution associated with mydomain.org, but continued receiving the 502.I invalidated the cache for the CloudFront distribution associated with W3 Total Cache, but continued receiving the 502.One thing at I don't understand is when checking SSL certificate at sslshopper.com, it came back telling me that the domain resolves to an IP I don't recognize:https://www.sslshopper.com/ssl-checker.html#hostname=www.mydomain.orgwww.mydomain.org resolves to 12.34.567.8 Server Type: CloudFront The certificate should be trusted by all major web browsers (all the correct intermediate certificates are installed). The certificate will expire in 324 days. The hostname (www.mydomain.org) is correctly listed in the certificate.Going to the above IP (12.34.567.8), I get:403 ERRORThe request could not be satisfied.Bad request. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.Generated by cloudfront (CloudFront)Request ID: QELc0fvzKvqx58Xrw2S6g3KWMAbkHx66hyxbkDne2Y1GOu7wGb6yGg==I am able to log in to the apache server on the EC2 instance using SSH using the Mac Terminal appThere I confirmed that MySQL is runningtest -d /opt/bitnami/mariadb && echo "MariaDB" || echo "MySQL"shows MySQLI stopped and restarted apacheI stopped and restarted all servicesI ran the bitnami diagnostic tool (sudo /opt/bitnami/bndiagnostic-tool) and got: ✓ Mysql: No issues found    ? Apache: Found possible issues    ? Resources: Found possible issues    ✓ Php: No issues found    ✓ Connectivity: No issues found [Apache]Found recent error or warning messages in the Apache error log.[Sun Nov 06 08:50:26.178264 2022] [authz_core:error] [pid 19192:tid 139683803522816] [client 41.216.183.144:58606] AH01630: client denied by server configuration: /opt/bitnami/apps/phpmyadmin/htdocs/scripts [Sun Nov 06 14:55:55.162136 2022] [authz_core:error] [pid 18963:tid 139684130838272] [client 129.151.230.90:54786] AH01630: client denied by server configuration: /opt/bitnami/apps/phpmyadmin/htdocs/index.php [Tue Nov 08 00:55:34.423247 2022] [authz_core:error] [pid 18962:tid 139683702810368] [client 70.73.26.178:45923] AH01630: client denied by server configuration: /opt/bitnami/apps/phpmyadmin/htdocs/index.phpPlease check the following guide to troubleshoot server issues: https://docs.bitnami.com/general/apps/wordpress/troubleshooting/debug-errors-apache/A high number of incoming requests originate from one or more unique IP addresses. This could indicate a bot attack. The following guide shows how to check for and block suspicious IP addresses. https://docs.bitnami.com/bch/apps/moodle/troubleshooting/deny-connections-bots-apache/[Resources]Your instance has little available RAM memory. total used free shared buff/cache available Mem: 1968 713 192 83 1062 960 Swap: 0 0 0You could try to increase your instance's memory. Please check your cloud provider's documentation for more information.You can also enable swap memory to improve performance. https://docs.bitnami.com/installer/faq/linux-faq/administration/increase-memory-linux/Following up on some of the info from the bitnami diagnostic tool, I disabled pagespeed by commenting out two lines in /opt/bitnami/apache2/conf/httpd.conf#Include conf/pagespeed.conf#Include conf/pagespeed_libraries.confThat did not seem to help or change anything.Also in the httpd.conf file I saw this:ServerName mydomain.org:80and wondered whether that is correct considering that the website is only accessed via HTTPS.  Should that perhaps be:ServerName mydomain.org:443I can get into phpMyAdmin by creating an SSH tunnel as described here:https://docs.bitnami.com/aws/faq/get-started/access-phpmyadmin/Everything looks normal to me in phpMyAdmin.I have not tried to get help from bitnami yet because it seems like this is an AWS problem?FollowComment"

Answer: "0In general, 5xx and 4xx errors indicate that the website is running but there is some internal error that is happening. The exception here is when using CloudFront where it cannot contact the origin (your website). But in this case it looks like you've confirmed that everything is running.My first impression is that the error message in the logs client denied by server configuration is the key here. Apache is getting the request but it is somehow configured to deny that request.You can probably confirm this by browsing directly to the website and bypassing CloudFront. If that works then there may be something in the Apache config which is explicitly denying CloudFront access. For example, there might be some configuration which looks at the UserAgent header and denies access based on that.CommentShareEXPERTBrettski-AWSanswered 7 months agomikeh100 7 months agoThank you, Brettski-AWS, for taking the time to help me!I assume I can  browse directly to the website and bypass CloudFront by going to the CloudFront origin, e.g.''ec2-12-345-67-89.us-west-2.compute.amazonaws.com''When I do that, initially I get''Your connection is not private''with a link:''Go to advanced''When I click "Go to advanced"I see''This server could not prove that it is ec2-12-345-67-89.us-west-2.compute.amazonaws.com; its security certificate is not trusted by your computer's operating system. This may be caused by a misconfiguration or an attacker intercepting your connection.Proceed to ec2-12-345-67-89.us-west-2.compute.amazonaws.com (unsafe)''When I click the "proceed" link, I get''This site can’t be reachedCheck if there is a typo in www.ec2-12-345-67-89.us-west-2.compute.amazonaws.com.DNS_PROBE_FINISHED_NXDOMAIN''I'm not sure what else to try beyond that.ShareBrettski-AWS EXPERT7 months agoThe first part of your output is all about the certificate on the web server not matching the hostname. For testing purposes that's ok but it does show that the instance is responding to requests. The "site can't be reached" part is interesting because clearly it can be reached. Your webserver is redirecting you to the host that you reached but is prepending www onto the beginning. And that lookup is failing. So check your configuration because I think your webserver is doing a rewrite of the URL, adding www to the beginning and that's causing the web browser to fail because that DNS entry doesn't exist.Share0Once again, thank you Brettski.  I really appreciate your efforts on my behalf.  I double-checked, and in the DNS in R53, there is a CNAME record with the name www.mydomain.org and the value mydomain.org.  The two mydomain.org records (A and AAAA records) have the CloudFront distribution as their value. So the request only goes to CloudFront after the www has been eliminated.  So I don't see how the www could be causing a problem for CloudFront.CommentSharemikeh100answered 7 months agoBrettski-AWS EXPERT7 months agoThat's because the redirect is going to www.ec2-12-345-67-89.us-west-2.compute.amazonaws.com - not to www.mydomain.org. Check your Apache config to see if it is picking up the local hostname or doing some sort of reverse DNS lookup. Either way, the web server is trying to redirect you which may not be what you want.Share0I also looked at the free memory, since the bndiagnostic tool mentioned that.  I'm not really sure what's considered normal or adequate.  I guess it depends on the particular website.  Somewhere I read that this is generally only a problem if you have 1GB or less of RAM.  I have 2GB.with pagespeed disabled:free -m         total    used    free  shared  buff/cache   availableMem:     1968     755     166      92    1046         910Swap:      0       0       0with pagespeed enabled:free -m          total    used    free  shared  buff/cache   availableMem:       1968     714     121     142    1131         900Swap:      0       0       0CommentSharemikeh100answered 7 months ago"


Question: Glue transform columns limit

"A customer has a schema with 183 columns, When running a transform job on Glue we are faced with an error:"Number of columns in schema exceeded the maximum allowed number"I was able to re-produce.I can't find in the Glue documentation such a limit.Is there a way to increase. the limit or  a workaround?FollowComment"

Answer: 0Accepted AnswerAs stated here: https://docs.aws.amazon.com/glue/latest/dg/machine-learning.htmlThe data source table that you choose for the job can't have more than 100 columns.CommentShareAWS-User-8730979answered 3 years ago


Question: session manager logging not working

"Hi, my team currently testing session manager feature to adopt our environment and client's environment.basic session manager feature seems to working very well, we dont have any troulbe to connect ec2 via session manager.but after we enable the session manager logging feature on AWS UI ->AWS Systems Manager->Session Manager-> prefereanceconencting to ec2 instance via session manager took almost 3 minutes (if we turn the logging feature disable, connecting to ec2 happen instantly) and logging seems to not working on our specified target (currently we set the target to cloudwatch log-groups)is there some more process we should done to work this out?fyiso far we doneDNS features enabled on VPCcreate 3 endpoints (ssm, ssmmessages and ec2messages) and put the security group allow httpsuse Amazon supplied basic AMI (Amazon linux AMI)made role with two policies attaced and put this on ec2 instancesAmazonSSMManagedInstanceCorecustom policy to work with cloudwatch with following statesments{"Version": "2012-10-17","Statement": [{"Action": ["logs:CreateLogStream","logs:DescribeLogStreams","logs:DescribeLogGroups","logs:PutLogEvents"],"Effect": "Allow","Resource": "*"}]}FollowComment"

Answer: "0Accepted Answerjust found answer myself, forgot to create the endpoint for cloudwatch or s3 :)hope this will help to future idiot like myself XDCommentSharerePost-User-2566695answered 4 months ago"


Question: AWS DMS - FATAL_ERROR - Stream component failed at subtask - SQL Server to Redshift

"Hello AllI am migrating RDS for ms sql server to redshift and getting below error.  When checked with 'Table Statistics', one of them is showing as 'Table error'.  please advise to resolve the issueError :Last failure messageLast Error Fatal error has occurred Task error notification received from subtask 7, thread 0 [reptask/replicationtask.c:2883] [1022505] Error executing source loop; Stream component failed at subtask 7, component st_7_ORXNENHJMUOQANKGRR5D3EZGLL2UWEW2C5MXXZY; Stream component 'st_7_ORXNENHJMUOQANKGRR5D3EZGLL2UWEW2C5MXXZY' terminated [reptask/replicationtask.c:2891] [1022505] Stop Reason FATAL_ERROR Error Level FATALplease find the below cloudwatch logs and advise if there is any issue2022-07-26T13:01:15 [SOURCE_UNLOAD   ]E:  RetCode: SQL_ERROR  SqlState: 42000 NativeError: 102 Message: [Microsoft][ODBC Driver 17 for SQL Server][SQL Server]Incorrect syntax near 'FTP'. Line: 1 Column: -1 [1022502]  (ar_odbc_stmt.c:3932)2022-07-26T13:01:15 [SOURCE_UNLOAD   ]E:  sqlserver_fill_table_partitioners_names(...) Failed to create statement:  select pf.name AS PartitionFunctionName, c.name AS PartitionKey FROM sys.dm_db_partition_stats AS pstats INNER JOIN sys.partitions AS p ON pstats.partition_id = p.partition_id INNER JOIN sys.destination_data_spaces AS dds ON pstats.partition_number = dds.destination_id INNER JOIN sys.data_spaces AS ds ON dds.data_space_id = ds.data_space_id INNER JOIN sys.partition_schemes AS ps ON dds.partition_scheme_id = ps.data_space_id INNER JOIN sys.partition_functions AS pf ON ps.function_id = pf.function_id INNER JOIN sys.indexes AS i ON pstats.object_id = i.object_id AND pstats.index_id = i.index_id AND dds.partition_scheme_id = i.data_space_id AND i.type <= 1 INNER JOIN sys.index_columns AS ic ON i.index_id = ic.index_id AND i.object_id = ic.object_id AND ic.partition_ordinal > 0 INNER JOIN sys.columns AS c ON pstats.object_id = c.object_id AND ic.column_id = c.column_id WHERE pstats.object_id = OBJECT_ID(N'[dbo].['FTP Actions International$']', N'table') group by pf.name, c.name [1022505]  (sqlserver_endpoint_metadata.c:1517)2022-07-26T13:01:15 [SOURCE_UNLOAD   ]E:  sqlserver_construct_select_statement(...) unable to resolve partitioners names for table dbo.'FTP Actions International$' [1022505]  (sqlserver_endpoint_unload.c:637)2022-07-26T13:01:15 [SOURCE_UNLOAD   ]E:  SQL Server source. Cannot init table workspace for iMetaDataTableid- '27' [1022505]  (sqlserver_endpoint_unload.c:415)2022-07-26T13:01:15 [SOURCE_UNLOAD   ]E:  Error executing source loop [1022505]  (streamcomponent.c:1873)2022-07-26T13:01:15 [TASK_MANAGER    ]E:  Stream component failed at subtask 4, component st_4_QQMN67PX7YCFOKBMLC6N2VUUZYDNUVLMALF3VBY [1022505]  (subtask.c:1414)2022-07-26T13:01:15 [SOURCE_UNLOAD   ]E:  Stream component 'st_4_QQMN67PX7YCFOKBMLC6N2VUUZYDNUVLMALF3VBY' terminated [1022505]  (subtask.c:1594)2022-07-26T13:01:15 [TASK_MANAGER    ]W:  Table 'dbo'.''FTP Actions International$'' (subtask 4 thread 0) is suspended  (replicationtask.c:2550)2022-07-26T13:01:15 [TASK_MANAGER    ]I:  Task - 2QFN76MQVCH2LN5WWULZTGTJJSH6Q6OBTQKHLLQ is in ERROR state, updating starting status to AR_NOT_APPLICABLE  (repository.c:5102)2022-07-26T13:01:15 [TASK_MANAGER    ]E:  Task error notification received from subtask 4, thread 0 [1022505]  (replicationtask.c:2883)2022-07-26T13:01:15 [TASK_MANAGER    ]E:  Error executing source loop; Stream component failed at subtask 4, component st_4_QQMN67PX7YCFOKBMLC6N2VUUZYDNUVLMALF3VBY; Stream component 'st_4_QQMN67PX7YCFOKBMLC6N2VUUZYDNUVLMALF3VBY' terminated [1022505]  (replicationtask.c:2891)2022-07-26T13:01:15 [TASK_MANAGER    ]E:  Task '2QFN76MQVCH2LN5WWULZTGTJJSH6Q6OBTQKHLLQ' encountered a fatal error  (repository.c:5196)FollowComment"

Answer: "0the error is not clear from the messages available. Please refer to earlier log entries in cloudwatch log for the task. It could be query failure or conversion failure which could result in fatal error. If the logs not conclusive then you might want to open a case with aws premium support who could help troubleshoot the issueCommentShareAWS-User-8174525-subhashanswered a year agoKiran 10 months agoHi, thanks for checking.  Updated cloudwatch logs, if you find any issues kindly adviseShare"


Question: AWS Certificate Manager(ssl certificate)

I have requested for an ssl certificate with certificate id :92260d29-8a31-4d7c-b44d-8a1ad0cda7ac and it is in pending state and it is now 72 hoursFollowComment

Answer: 1Have you consulted this document?https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-pending-validation/?nc1=h_lsCommentSharemoritalousanswered a year agoAWS-User-8507162 a year agoyes but no useShare


Question: How to Accommodate Portrait Video in Video on Demand on AWS Solutions

"I am running Video on Demand on AWS solutions infrastructure (the complete one, not the Foundation one). When I tried uploading portrait video the ending result is a landscape video but with left and right black padding wrapping the original portrait video. I would like to have landscape video to be converted to landscape video and portrait to portrait when played in the device. How do I achieve that?FollowComment"

Answer: "3Accepted AnswerThe solution provide some job Template that you could modify under Mediaconvert Page -> Job Templates.Anyways Add "Rotate": "AUTO" to VideoSelector in inputs. In this case, EMC will try to automatically rotate the video based on metadata if it's available.and : https://docs.aws.amazon.com/mediaconvert/latest/ug/auto-rotate.htmlCommentShareGiuseppe_Banswered a year ago"


Question: Does RI sharing in orgs apply to RDS RIs too?

"Does RI sharing between accounts in orgs apply to RDS RIs too? And for that matter ElastiCache RIs, OpenSearch, etc? This knowledge article just refers to RIs, so I would assume they mean all types of RIs, but the URL says EC2: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-ri-consolidated-billing/FollowComment"

Answer: "3Accepted AnswerHey yann,Yes. You can see an example here -> https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/consolidatedbilling-other.html#consolidatedbilling-rdsCommentSharefercunhaanswered 6 months ago"


Question: AWS Patch Manager Patching Task failing

"I have 2 EC2 Servers in a patch group using AWS-DefaultPatchBaseline Baseline to patch and reboot if needed but they seem to be failing, looking at the setup it all seems ok and has completed successfully the 1st time it was setup:Invoke-PatchBaselineOperation : The install operation did not complete successfully. Additional failure informationfrom Windows Update:HResult: -2145124318 | Result Code: orcFailedAt C:\ProgramData\Amazon\SSM\InstanceData\i-0563ac941c30a1a19\document\orchestration\d2914f06-8429-4bfa-a4cd-3dfd0b0ef6e7\PatchWindows_script.ps1:237 char:13$response = Invoke-PatchBaselineOperation -Operation Install -Snapsho ...        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~CategoryInfo          : OperationStopped: (Amazon.Patch.Ba...UpdateOperation:InstallWindowsUpdateOperation) [Invoke-PatchBaselineOperation], ExceptionFullyQualifiedErrorId : Exception Level 1:Error Message: The install operation did not complete successfully. Additional failure information from Windows Update:HResult: -2145124318 | Result Code: orcFailedStack Trace:    at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.InstallWindowsUpdateOperation.DoWindowsUpdateOperation()at Amazon.Patch.Baseline.Operations.PatchNow.Implementations.WindowsUpdateOperation.DoBeginProcessing(),Amazon.Patch.Baseline.Operations.PowerShellCmdlets.InvokePatchBaselineOperationfailed to run commands: exit status 0xffffffffFollowComment"

Answer: "0This error could be related to the Windows Update components, or to a lack of connectivity to the Windows Update Catalog or Windows Server Update Services (WSUS).Confirm that the managed node has connectivity to the Microsoft Update Catalog through an internet gateway, NAT gateway, or NAT instance. If you're using WSUS, confirm that the managed node has connectivity to the WSUS server in your environment. If connectivity is available to the intended destination, check the Microsoft documentation for other potential causes of HResult  This might indicate an operating system level issue.Please check the below document if it helps:https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-troubleshooting.html#patch-manager-troubleshooting-windowsCommentShareGautam Kumaranswered 7 months ago"


Question: Elastic Beanstalk Memory usage monitoring with CloudWatch agent

"With the deprecated monitoring scripts I was able to monitor memory in Elastic Beanstalk monitoring Dashboard:Now with CloudWatch agent. I get it to report "mem_used_percent" with namespace "CWAgent", I can confirm this in Cloudwatch.I'm configuring the mem_used_percent, just as explained in the documentation:Publishing Amazon CloudWatch custom metrics for an environmentBut that metric never gets listed to pick up in my Monitoring dashboard, so I can't add a chart for it.FollowComment"

Answer: "0I managed to get it to work by changing the namespace to "System/Linux" (which matches what the previous monitoring scripts were sending).This is my new configuration:{  ..  "metrics": {    "namespace": "System/Linux",    "append_dimensions": {      "AutoScalingGroupName": "${aws:AutoScalingGroupName}",      "InstanceId": "${aws:InstanceId}"    },    "aggregation_dimensions": [      ["AutoScalingGroupName"],      ["InstanceId"]    ],    "metrics_collected": {      "mem": {        "measurement": [          { "name": "mem_used_percent", "rename": "MemoryUtilization" }        ]      }   }}Now my dashboard shows memory graph just like before.CommentSharepmolerianswered 10 months agoMatt-B EXPERT10 months agoSystem/Linux Namespace in CLoudwatch is coming from the deprecated monitoring scripts.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-scripts-intro.html#script_viewmetricsSharepmoleri 10 months agoYes @Matt-B, it looks like Elastic Beanstalk monitoring dashboard hasn't been updated and it supports only the old namespace for memory metric.By inspecting the REST calls made by Beanstalk UI, I think there's another possible workaround that is publishing them in namespace: "AWS/ElasticBeanstalk" and add a custom dimension with the EnvironmentName within mem metric, but this is a bit more cumbersome to set up because it requires fetching the EnvironmentName during setup and manually replacing it in the config file whereas with "System/Linux" namespace it works out of the box.Share0Hi ThereThe custom metrics aren't going to appear in the ElasticBeanstalk console.  From the documentation:**Viewing metrics in the CloudWatch console**After deploying the CloudWatch configuration file to your environment, check the Amazon CloudWatch console to view your metrics. Custom metrics will be located in the CWAgent namespace.For more information, see [Viewing available metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/viewing_metrics_with_cloudwatch.html) in the Amazon CloudWatch User Guide.You can build a CloudWatch dashboard and aggregate all of the metrics that you are interested in.  See this blog post for a tutorial:https://aws.amazon.com/blogs/aws/cloudwatch-dashboards-create-use-customized-metrics-views/In fact, CloudWatch will have an "Automatic Dashboard" already configured for your EB environment, and you can easily add your custom metrics to it.In Cloudwatch, navigate to "All Metrics" and look for Elastic Beanstalk.Hover over it and click "View Automatic Dashboard3.Then you can click "Add to Dashboard" to create your own custom dashboard for your EB app.  It will copy all of the current metrics to your new custom dashboard.  From there, you can add your custom metrics like mem_used_percentCommentShareEXPERTMatt-Banswered 10 months agopmoleri 10 months agoThanks @mthwbarb,That's helpful but it feels like I'm loosing functionality when upgrading to the recommended CloudWatch Agent.I mean, having monitoring dashboard right there in the environment is an elastic beanstalk feature, and I'm loosing that for "memory" metric which is a metric that I've found very useful to monitor.I think I found a workaround, I'm posting a separate answer because there's a limit for comments length.I'd be grateful if you can check it out, just in case I'm screwing up something. Thanks.Share"


Question: Cannot modify RDS SQL Server Web instance class in us-east-1e

"We've been trying for weeks to change the RDS instance class from db.t2.medium to db.t3.medium or db.t3.large but keeps on getting the same error. Anyone knows when will the t3 instances will be available for us-east-1e? Thank you.Engine: SQL Server Web EditionEngine version: 12.00.6439.10.v1Region: us-east-1eError Message:We're sorry, your request to modify DB instance <instance name> has failed.Cannot modify the instance class because there are no instances of the requested class available in the current instance's availability zone. Please try your request again at a later time.FollowCommentAWS-User-9032900 3 months agoWere you able to find a solution to this ? We are facing the same issue in us-east-1 and SQL Server Web edition for db.t2.small to db.t3.smallShare"

Answer: "0There are two possible causes for this error:The AZ does not have capacity for the target instance class you choose.The target instance class is not supported in the AZ.In this case, the Az does not have capacity for the instance type you are requesting.As the rds sql server edition is web, multi Az feature is not supported. Below are the option you have:Launch an instance in a different availability zone and migrate the database to the new RDS.Purchase a reserved instance (for that instance type) in the desired availability zone. This will also prevent you from receiving this error in the future.CommentSharerePost-srikarkranswered a month ago"


Question: Game leaderboard

"I am trying to create a leaderboard server and currently have a Dynamo db table with id , score and timestamp field. I want to sort all the players position based on score and time. Also want to query a single players position. I want the queries to be fast.( trying to avoid scan operation). What are my options to achieve this?I am aware of AWS GameSparks but unfortunately its in preview.FollowComment"

Answer: "3While DynamoDB can implement a leader-board, it would not be my first service of choice. Elasticache for Redis would provide more features to implement the leader-board more effectively while also providing lower latency reads. More info in this blog:Build a real-time gaming leaderboard with Amazon ElastiCache for Redis.Should you still wish to proceed with DynamoDB then there are also some blog posts which you may find useful:How to Build a Real-Time Gaming Leaderboard with Amazon DynamoDB and RocksetAmazon DynamoDB: Gaming use cases and design patternsCommentShareEXPERTLeeroy Hannigananswered 9 months agoEXPERTFabrizio@AWSreviewed 9 months ago0HiHave you seen this page in the documentation (https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/GSI.html) - it uses a leaderboard implementation as an example so will hopefully help.HTHNickCommentShareNickanswered 9 months agorePost-User-1119824 9 months agoHey thanks for your comment,  I have seen this documentation however I am not sure this would satisfy my circumstances as I need all player positions. Please feel free to share if you think this is possible.Share"


Question: Elastic Beanstalk setup Celery Beat so that it only runs on one node? (Prevent task duplication)

"I have a django app which uses celery beat to scan the DB and trigger tasks accordingly. I want to deploy this to elastic beanstalk, but simply applying leader_only to my celery beat invocation won't be enough as we need a way to implement protection such that the beat instance is not killed during autoscaling events.So far I've found the following options onlineRun a separate ec2 that runs celery beat - not ideal but I could make this a cheap instance since the functionality required is so simple and lightweight. I assume that if I point this at an SQS queue and have my workers pulling from that queue everything will work fine. However, it's not clear to me how to have this instance discover the tasks from my Django app short of deploying it again to the second instance and then having that beat instance interact with my queue.Use some sort of leader selection lambda like described here (https://ajbrown.org/2017/02/10/leader-election-with-aws-auto-scaling-groups.html) for my EB autoscaling group. This seems a bit extra complicated, in order to implement this I'm guessing the idea is to have a script in my container commands that checks if it is the leader instance (as assigned by the leader tag in the above tutorial) and only execute celery beat if this is the case.Ditch SQS and use an Elasticache Redis instance as my broker, then install the redbeat scheduler (https://github.com/sibson/redbeat) to prevent multiple instances of a beat service from running. I assume this wouldn't affect the tasks it spawns though correct? My beat tasks spawn several tasks of the same 'type' with different arguments (would like an idiot check on this if possible).My question is, can anyone help me assess the pros and cons of these implementations in terms of cost and functionality? Is there a better, more seamless way to ensure that celery beat simply runs on one instance alone, while my celery workers scale with my autoscaling infrastructure? AWS newbie so would greatly appreciate any help!FollowComment"


Question: Remove zombie databases from RDS

"I have a couple of Aurora database clusters that didn't create properly several years ago, and cannot be deleted using the API or console. They are both MySQL 5.6.10a regional clusters (with no instances) but also can't be upgraded.They're probably not doing any harm but I'd like to get rid of them anyway, especially as I'm getting frequent messages about compulsory upgrades.One cluster is in us-east-1, stuck with status "Creating".  The other cluster is in ap-southeast-2, and is stuck with status "Incompatible-restore" (whatever we were trying to restore doesn't matter now anyway).If I attempt to delete them in the console, I get a banner notification "The <name> cluster is being deleted.", but it never does delete.If I attempt to delete them using the aws cli tool, I get a response with the cluster details, but again, they are not deleted.aws rds delete-db-cluster --profile develop --region us-east-1 --skip-final-snapshot --db-cluster-identifier develop-globaldb-instance-1-clusteraws rds delete-db-cluster --profile develop --region ap-southeast-2 --skip-final-snapshot --db-cluster-identifier snowflake-clusterIdeas welcome!FollowCommentRWC 2 months agoWhat happens if you let the threatened compulsory upgrades happen? Presumably the upgrades will fail, but it may leave each cluster in a known state (even if that's a known bad state) rather than the inconclusive/unknown states they are in now.ShareMC a month agoHey RWC, I guess we're going to find out!Share"

Answer: "0Here are some ideas:Use the AWS CLI to force delete the clusters. You can use the following command to force delete the clusters:aws rds delete-db-cluster --profile develop --region us-east-1 --skip-final-snapshot --db-cluster-identifier develop-globaldb-instance-1-cluster --forceaws rds delete-db-cluster --profile develop --region ap-southeast-2 --skip-final-snapshot --db-cluster-identifier snowflake-cluster --forceUse the AWS CloudFormation template to delete the clusters. You can use the following AWS CloudFormation template to delete the clusters:{  "Resources": {    "DevelopGlobalDbInstance1Cluster": {      "Type": "AWS::RDS::DBCluster",      "Properties": {        "DBClusterIdentifier": "develop-globaldb-instance-1-cluster",        "Engine": "MySQL",        "EngineVersion": "5.6.10a",        "Region": "us-east-1",        "DeletionPolicy": "ForceDelete"      }    },    "SnowflakeCluster": {      "Type": "AWS::RDS::DBCluster",      "Properties": {        "DBClusterIdentifier": "snowflake-cluster",        "Engine": "MySQL",        "EngineVersion": "5.6.10a",        "Region": "ap-southeast-2",        "DeletionPolicy": "ForceDelete"      }    }  }}Use the AWS API to delete the clusters. You can use the following AWS API call to delete the clusters:DELETE /rds/clusters/develop-globaldb-instance-1-clusterDELETE /rds/clusters/snowflake-clusterNote: If you are using the AWS API to delete the clusters, you will need to make sure that you have the appropriate permissions.Contact AWS Support. AWS Support can help you troubleshoot and delete your database clusters.CommentShareMarawan Mamdouhanswered a month agoMC a month agoHi Marawan, these were great suggestions, thank you! Unfortunately they haven't helped this time.I can't see the --force option among the delete-db-cluster parameters, and if I try to use it I get an error that it's not supported. aws-cli v2.11.13 so I think I'm up to date (well I was when I tested this yesterday).This looked promising! Unfortunately the stack creation fails with the message "DB cluster isn't available for modification with status incompatible-restore" (status "creating" for the other cluster). So basically the same result as the cli.Both the cli and the console are using the API to perform the task, so I'd say that's where the error is generated.This looks like my next step! ThanksShare"


Question: Initializing Kotlin libraries in lambda

"Typically, to reduce code execution times, we'll initialize an AWS library outside of the function. In the Kotlin AWS SDK, this is done with something like EventBridgeClient.fromEnvironment(). However, this is a suspended call, so it's awkward to call in this context, and I'd have to wrap it with a runBlocking or something similar. Is this really how I'd need to initialize a service client in lambda using the Kotlin SDK?private val eventBridge = runBlocking { EventBridgeClient.fromEnvironment() }FollowComment"

Answer: "0Hello,If you’re trying to make cold starts quicker or prevent cold starts by running code in your handler’s initialization code during the provisioned concurrency boot the code looks fine.For your handler, since all methods of the client can be suspended, you’ll need a runBlocking around the entire handler logic. The handler should be synchronous because anything that has not finished executing before the handler returns will be frozen until the Lambda is re-triggered (or may never re-run if the lambda shuts down before being retriggered since it’s never guaranteed you’ll re-invoke the same lambda execution environment).If you peek at this link, AWS Lambda execution environment - Shutdown phase - https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtime-environment.html#runtimes-lifecycle-shutdown , it mentions the following:•Background processes or callbacks that were initiated by your Lambda function and did not complete when the function ended resume if Lambda reuses the execution environment. Make sure that any background processes or callbacks in your code are complete before the code exits.As far as any Kotlin specific questions, I’d recommend getting consults from the Kotlin SDK Team on GitHub: https://github.com/awslabs/aws-sdk-kotlin . You’ll get the information directly from the source there!It’s currently in developer preview and not intended for production workloads, so if you’re running into issues that don’t operate with exact parity as other AWS SDKs, this could be why and we’d certainly like to hear about it by having a GitHub issue raised: https://github.com/awslabs/aws-sdk-kotlin/issuesCommentShareSUPPORT ENGINEERTim_Panswered a year ago"


Question: how to generate shared link after uploading file with rest API in asp Core.

"in AWS, there's one option to generate a pre-signed URL for the object specified.I want a shared URL for the object I'm uploading through the rest API.Is that possible to get a shared link through rest API, If yes, What could be the possible solution?I don't want to add  AWS S3 SDK dependency.Framework: ASP dot net core.language: C#FollowComment"

Answer: "2Accepted AnswerYes, it is possible to generate a pre-signed URL for an object in AWS S3 through the REST API without adding the AWS S3 SDK as a dependency. One way to do this would be to use the AWS S3 REST API's "PutObject" or "GetObject" endpoint, along with the "X-Amz-Signature" header to sign the request using your AWS S3 access key and secret key. Once you have the pre-signed URL, you can share it with others to give them temporary access to the object. An example of how to generate a pre-signed URL using the AWS S3 REST API in C# without the AWS S3 SDK can be found in the AWS documentation. https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.htmlCommentShareAhmad Ul Islamanswered 5 months agoEXPERTiwasareviewed 5 months ago"


Question: Can't SSH to EC2

"I am struggling to SSH to my instance and repeatedly asks me for a password.EVEN THOUGH I NEVER MADE ONE :c  I'm doing an assignment for class and my teacher specifically said to choose "Proceed without key pair" since we opened all ports and used 0.0.0.0/0. I opened my SSH connections with 0.0.0.0/0 as well. I can't connect no matter what I use. I've tried Instance Connect, Putty, and Terminal but they all uniformly ask me for a password... I've read while researching for solutions that a key pair is needed for a SSH connection. I can't create a new instance since, my teacher asked us to attach specific files and the current instance was migrated from Bitnami. Please help me I have been big struggling for hours and I am about to mental breakdown.  TY.FollowComment"

Answer: "0If you don't have a key pair associated to your instance, the connection using SSH is not possible (Amazon EC2 key pairs and Linux instances).One alternative is to use the AWS Systems Manager Session Manager service. For that the AWS SSM agent must be installed in your instance (many of the common AWS instances have it already installed by default). For more info check the AWS Session Manager prerequisites.Another alternative is to add a new key pair to your existing instance. For this, check the following guide: I've lost my private key. How can I connect to my Linux instance?.CommentShareigsalvaranswered a month ago"


Question: lambda@edge origin-response handler with cloudfront + s3 origin custom headers

"Hello, I've a function that works for origin-response.I've added in my Cloudfront distro custom header, call it X-My-Header with a custom value (say a)I want to read this custom header in the origin-response function (by using Typescript, shouldn't matter).This header is no where to be found in either request.origin.s3.customHeaders nor request.origin.custom.customHeaders.This is super difficult to debug. If someone has a suggestion or a direction I'll be extremely happy to hear.ThanksFollowComment"

Answer: "0Accepted AnswerOh man, I was just missing creating a new invalidation :facepalm:CommentShareamitizleanswered a year ago0Have you tried accessing the header via the event?For example belowconst response = event.Records[0].cf.response;const headers = response.headers;console.log('Headers: "${headers}"');If you still cant see them log the event and then view the json offline and confirm your header is actually present in the event.CommentShareRoBanswered a year ago0Thanks for the response, but no it's not that.I've created manually a function + λ distro and seems like it logs everything correctly in the freshly created one, in the origin-response invocation in request.origin.s3.customHeaders.CommentShareamitizleanswered a year ago"


Question: All of a sudden my LightSail Instance/Website is not working

"Hi,My LightSail instance is not getting connected. I cannot RDP to the server, it say's instance is taking time to connect.  The website is not working either. It was working fine previous day. What should be the problem?More investigationAs you can see here, the instance status check failures is 1.ThanksFollowComment"

Answer: "0I have one suggestion based on the information provided:Under the "Metrics" tab on your instance management page, there is a graph showing the average CPU usage of your instance. Notice that there is a sustainable zone and a burstable zone. If your instance CPU usage is consistently in the burstable zone (or if a given burst is too high), you may experience issues with instance availability. Depending on your use-case, it may be worthwhile to upgrade to a more powerful instance type in order to increase availability by remaining in the sustainable zone.CommentSharejsctaanswered 4 months agorePost-User-1831829 4 months agoThank you for the suggestion,When checked "Matrics", CPU Burst capacity percentage is 100 even though the server was not in used for the past few days.I created a new instance (upgraded) using a snapshot of the current instance. Even the new instance not working.Any idea why?Share"


Question: Instance i-09e40ed2e3967760d is stuck in stopping state

"Our production EC2 instance(i-09e40ed2e3967760d) is stuck in the "Stopping" state.  I attempted to force stop twice, but the instance is still stopping.  This began when the instance became unavailable about 11 hours ago. How can I proceed to stop, then restart this instance?FollowComment"

Answer: "0After I posted this thread, I checked the EC2 status and found that it had stopped.  I am attempting to restart now.CommentShareAslanPaulanswered 2 years ago0This instance is now restarted and responding.CommentShareAslanPaulanswered 2 years ago"


Question: What is the best AWS service to help my nonprofit analyze our donor data?

"My nonprofit has hundreds of donors, but the data is spread across multiple sources. How can I compile the data and run analytics to understand more about our donors?FollowComment"

Answer: "2This is an interesting question and I'm really excited that this you're looking into this! AWS has a breadth of data and analytics tools, but it really depends on what your data looks like presently. The page linked above will help narrow down your choices.If the data needs to be normalized as it's spread across multiple sources, you'd likely need to do some normalization using something like AWS Glue.Is the data already in a database or csv file and you just want to visualize it using an easy to use interface? Check out Amazon QuickSight.  It's our cloud-native, completely serverless BI service and one of my favorites! I'm far from an analytics pro and I use this constantly to visualize existing data.Maybe you really want to get in the weeds and do something with Amazon SageMaker. SageMaker allows you to build, train, and deploy machine learning (ML) models for any use case with fully managed infrastructure, tools, and workflows. This might have a bit of a learning curve, but there's also a feature called Amazon SageMaker Canvas. In my opinion this is our most underrated service. It expands access to machine learning (ML) by providing business analysts with a visual point-and-click interface that allows them to generate accurate ML predictions on their own — without requiring any machine learning experience or having to write a single line of code.All in all, it really depends on what your goal is, what your data looks like, and what your abilities are. Feel free to click through our current offerings and see what interests you. We have tons of Quick Starts and Free Trainings to help you get started and of course you can request help through your AWS console or right here on re:Post!CommentShareAWSJoeanswered a year agoEXPERTFabrizio@AWSreviewed a year ago"


Question: Help with AWS Network firewall rule

"I have a requirement to create below rule in AWS network firewall. I am not sure if this is supported given the destination ports are non standard (i.e. not 80/.443). and if supported can this be stateful rule and if so how?Source - IP address of an EC2 (x.x.x.x/32)Destination domain: .example.comDestination port range: 5661-5662Destination IP is unknown or keeps changing.Any guidance here will be greatly appreciated.Purpose for this type of request:We have a requirement to enable a Microsoft PowerBI related domain from an EC2 which would contain Microsoft On-premises Data Gateway. This domain needs access to non standard ports other than 443. Due to data sensitivity, we are mandated to only allow outbound access from EC2 to specific domain/port and block everything else. Hence looking for a solution to define a AWS NW FW rule which caters to this specific requirement.FollowCommentRishi 6 months agoCan you please add a the purpose behind this, asking so as to be able to recommend in a better way.ShareCarlosGP-AWS 5 months agoHI there,I might be able to help you here. Can you confirm if the traffic or packets are HTTP-based? Doesn't matter if its not going through standard ports as Suricata is able to inspect packets up to Layer 7.If it's not HTTP, which protocol is it using to establish the connection?Thanks,CarlosShare"

Answer: "0You could look into using suricata based rules like this example for domain filtering.You could also do it with 5-tuple settings being constantly updated by a lambda function that checks the IP for a domain and updates the Network Firewall RuleCommentSharePablo Guzmananswered 6 months agoAWSuser 6 months agoHi Pablo, thanks for the response. I am keeping 5-tuple/lambda option as a last resort.Are you able to help with a Suricata based rule for my example (pasted again below)? I am not sure how to use/pass port details. Or point me to any examples. The link which you have posted above (which I had seen) doesn't provide this informationSource - IP address of an EC2 (x.x.x.x/32)Destination domain: .example.comDestination port range: 5661-5662Type of rule: ALLOWShare"


Question: Can't Import Modules In Sagemaker Jupyter Notebook

"I've tried to use the pip install librosa command within a jupyter notebook, yet I get a modulenotfounderror. Is there a place where I can use pip install librosa?Thanks.FollowComment"

Answer: "2Tested in one of the notebook in my account and it works with!pip install librosaPlease review the configuration of your notebook instances, under the Network section, you should see the result as below:*No custom VPC settings applied.Direct internet access*CommentShareJadyanswered 10 months agoEXPERTFabrizio@AWSreviewed 10 months ago"


Question: Exact semantics of IVS Player getLiveLatency()?

"What exactly is getLiveLatency() measuring for a live stream?https://aws.github.io/amazon-ivs-player-docs/1.7.0/web/interfaces/player.html#getlivelatencyGiven:content recorded (A) --> content received at AWS IVS ingest endpoint (B) ---> presumably some processing in AWS (C) ---> content available for a viewer to view on AWS IVS servers (D) ----> viewer downloads live data, a HLS segment (E) ---> viewer watches segment (F)getLiveLatency gives the difference between which of the following?1: A and E?2: B and E?3: D and E?4: Other?How is that number actually being computed?FollowComment"

Answer: "0Thank you for using the Amazon Interactive Video Service. The IVS Player's getLiveLatency method (https://aws.github.io/amazon-ivs-player-docs/1.7.0/web/interfaces/player.html#getlivelatency) measures the latency between when the content is received by Amazon IVS (B) and when the viewer watches the segment (F). The delay/latency before the content enters the IVS system is unknown to IVS, thus it cannot be calculated into the final live latency value.CommentShareriley-awsanswered a year ago"


Question: Editing Quicksight cost intelligence dashboard

"How do I change the date of the current billing summary, cost summary and compute summary to reflect current month and time within the quicksight cost intelligence dashboard?Thank youFollowComment"

Answer: 0So in the CID dashboard you will find the filter option (filter icon) on the widget. Click on it and then select "view dashboard filters". Once you click on "view dashboard filters" on the right side of the page you will see filter options wherein you should see an option to filter basis "billing period"CommentShareAWS-User-4371564answered a month ago


Question: Allowing Role and Policies creation for Development team

"I'm sensing an anti-pattern in my company when it comes to creating roles and policies for a given workflow.I'm sitting on a development team, we are far from experts in AWS but we are learning fast.We are building an application and trying to follow as much as possible all AWS's security standards.As we develop we need to create specific roles bearing proper policies.There is security team in my company who owns the IAM side when it comes to creating policies therefore the development team doesn't have permissions to create/edit/delete policies to assign to the roles.Development team is only allowed to create/edit/delete/read roles and read policies.Development team faces a lot of frustration with this situation as it cannot proceed with our developments independently.After questioning the security team about the reasons it was stated that:In the past people would go wild in creating policies, so we had to cut them short as it was easily becoming a total messWe needed to protect the AWS account from its users.We needed to protect the team from himself.I would really appreciate the community input on this to understand what/how other companies are organizing themselves when it comes to "allowing" creation of policies.FollowComment"

Answer: 2Accepted AnswerYou are absolutely right that this is an antipattern for Cloud and something that should be addressed. It is also not an easy task.A few various path that could be adopted:prevent use of unused services via SCP (any policies allowing those services will have no effect)use IAM boundaries to restrict what roles developers can create and assignuse IaC to create rolesdefine strict governance rules around IAM roles including naming conventionsuse compliance to detect non-compliant roles and remove themmonitor creation of IAM roles via CloudTrail and alert on usageOther ways I have seen but wouldn't recommend is to have a custom API available to developers to allow them to request a role. I personally prefer the compliance route with detective controls in place to identify undesired roles.CommentShareteknivoranswered 5 months agoBrettski-AWS EXPERT5 months agoI'd add here that your company should engage with your local AWS account team as they can provide guidance.Share


Question: Add a custom domain to AWS Amplify react-app

"Hi all!I've successfully built my react-app with AWS Amplify (step 1 is completed)Now I need to add a custom domain that I already own (purchased not with aws route 53).What I've done:I hosted a zone with my domain name using Route 53.I changed my domain's DNS-servers to given by Route 53 four name servers under "Value/Route traffic to" (step 2 is now marked as completed in amplify console)Before I did this, when I entered my domain name into the browser I could see a message "This domain was purchased from companyname" and their logo.Now DNS records seem to have changed, but domain stopped working.. Google Chrome says: "This site can’t be reached. DNS_PROBE_FINISHED_NXDOMAIN"Edited by: MikhailOG on Jan 17, 2021 11:24 PMI managed to make it work adding a subdomain (CNAME record route 53). But root domain still doesn't work.. Amplify says I need to add an ANAME record to the root. Route 53 added type A record to the root when I added root URL to amplify. But I can only access my web page using subdomain.FollowComment"

Answer: 0Add URL (subdomain) to your domain in amplify console. Then it adds a record (ANAME) in route 53 hosted zone.CommentShareMikhailOGanswered 2 years ago


Question: Athena and Analytics

"What is the best way to Create a subset of factory location dataCurrent process: Query location data for specific factories, save in a new Athena table with a direct insert statementGet factory data and generate statistics about the factoriesObjective: save statistics in a database that automatically updates to a visualization toolIs it possible to do a batch insert to put the contents of a pandas dataframe into Athena?What is the best tool to connect Athena data to excel?FollowComment"


Question: The server is not sending the required intermediate certificate

"I have an Amazon issued certificate in ACM that is being used on an application load balancer.  Both the certificate and load balancer are in the same region, and the certificate shows as valid in Firefox and Chrome on my machine.  Other users have reported that the certificate is invalid.  When I check it at www.digicert.com/help/, it shows an error with the first certificate in the chain:  "The server is not sending the required intermediate certificate".  Does anyone know why this is happening?FollowComment"

Answer: "1I believe the error is not caused by a missing intermediate certificate, but because DigiCert’s tool logic performs checks thinking that ACM certificates are DigiCert certificates. Even though DigiCert is a vendor in the AWS process that performs some hosting; DigiCert is not the Certificate Authority for ACM certificates.  Because of this hosting relationship, the DigiCert systems powering their tool thinks that ACM issued certificates are DigiCert certificates, and therefore, require the DigiCert intermediate certificate. To summarize, the error on the digicert site is because digicert is comparing the intermediate certificate to their intermediate certificate and it doesn't match because the above certificate is an amazon issued certificate and not a digicert issued certificate. So there is nothing to worry there. It is just that some certificate checkers will require some intermediate certificates which are not necessary.Please check with other 3rd party SSL checker such as https://www.sslshopper.com/ssl-checker.html?hostname=web.hotline.io, and verify if, certificate has all the necessary chains.CommentShareSUPPORT ENGINEERNirmal_Kariaanswered a year ago"