Question: neuron compiling a bert model

"Hi,I want to neuron compile a bert large model(patentbert from google) which has sequence length 512. How do I do this?Also I want to call the model as before or need to know what I should change while calling it.I compiled the anferico/bert-for-patents using the instructions here https://awsdocs-neuron.readthedocs-hosted.com/en/latest/src/examples/tensorflow/huggingface_bert/huggingface_bert.html.Also is it the same to use patentbert from google and huggingface anferico/bert-for-patents ??The saved model cli output forGoogle's patentbertMetaGraphDef with tag-set: 'serve' contains the following SignatureDefs:signature_def['serving_default']:The given SavedModel SignatureDef contains the following input(s):inputs['input_ids'] tensor_info:dtype: DT_INT64shape: (-1, 512)name: input_ids:0inputs['input_mask'] tensor_info:dtype: DT_INT64shape: (-1, 512)name: input_mask:0inputs['mlm_positions'] tensor_info:dtype: DT_INT64shape: (-1, 45)name: mlm_positions:0inputs['segment_ids'] tensor_info:dtype: DT_INT64shape: (-1, 512)name: segment_ids:0The given SavedModel SignatureDef contains the following output(s):outputs['cls_token'] tensor_info:dtype: DT_FLOATshape: (-1, 1024)name: Squeeze:0outputs['encoder_layer'] tensor_info:dtype: DT_FLOATshape: (-1, 512, 1024)name: bert/encoder/layer_23/output/LayerNorm/batchnorm/add_1:0outputs['mlm_logits'] tensor_info:dtype: DT_FLOATshape: (-1, 39859)name: cls/predictions/BiasAdd:0outputs['next_sentence_logits'] tensor_info:dtype: DT_FLOATshape: (-1, 2)name: cls/seq_relationship/BiasAdd:0Method name is: tensorflow/serving/predictMetaGraphDef with tag-set: 'serve, tpu' contains the following SignatureDefs:signature_def['serving_default']:The given SavedModel SignatureDef contains the following input(s):inputs['input_ids'] tensor_info:dtype: DT_INT64shape: (-1, 512)name: input_ids:0inputs['input_mask'] tensor_info:dtype: DT_INT64shape: (-1, 512)name: input_mask:0inputs['mlm_positions'] tensor_info:dtype: DT_INT64shape: (-1, 45)name: mlm_positions:0inputs['segment_ids'] tensor_info:dtype: DT_INT64shape: (-1, 512)name: segment_ids:0The given SavedModel SignatureDef contains the following output(s):outputs['cls_token'] tensor_info:dtype: DT_FLOATshape: unknown_rankname: TPUPartitionedCall:5outputs['encoder_layer'] tensor_info:dtype: DT_FLOATshape: unknown_rankname: TPUPartitionedCall:6outputs['mlm_logits'] tensor_info:dtype: DT_FLOATshape: unknown_rankname: TPUPartitionedCall:4outputs['next_sentence_logits'] tensor_info:dtype: DT_FLOATshape: unknown_rankname: TPUPartitionedCall:7Method name is: tensorflow/serving/predictNeuron compiled anferico/bert-for-patentsMetaGraphDef with tag-set: 'serve' contains the following SignatureDefs:signature_def['__saved_model_init_op']:The given SavedModel SignatureDef contains the following input(s):The given SavedModel SignatureDef contains the following output(s):outputs['__saved_model_init_op'] tensor_info:dtype: DT_INVALIDshape: unknown_rankname: NoOpMethod name is:signature_def['serving_default']:The given SavedModel SignatureDef contains the following input(s):inputs['input_1'] tensor_info:dtype: DT_INT32shape: (-1, 512)name: serving_default_input_1:0inputs['input_2'] tensor_info:dtype: DT_INT32shape: (-1, 512)name: serving_default_input_2:0The given SavedModel SignatureDef contains the following output(s):outputs['output_1'] tensor_info:dtype: DT_FLOATshape: (-1, 2)name: StatefulPartitionedCall:0Method name is: tensorflow/serving/predictConcrete Functions:Function Name: 'call'Option #1Callable with:Argument #1DType: listValue: [TensorSpec(shape=(None, 512), dtype=tf.int32, name='input_1'), TensorSpec(shape=(None, 512), dtype=tf.int32, name='input_2')]Function Name: '_default_save_signature'Option #1Callable with:Argument #1DType: listValue: [TensorSpec(shape=(None, 512), dtype=tf.int32, name='input_1'), TensorSpec(shape=(None, 512), dtype=tf.int32, name='input_2')]Function Name: 'aws_neuron_function'Option #1Callable with:Argument #1args_0Argument #2args_0_1Function Name: 'call_and_return_all_conditional_losses'Option #1Callable with:Argument #1DType: listValue: [TensorSpec(shape=(None, 512), dtype=tf.int32, name='input_1'), TensorSpec(shape=(None, 512), dtype=tf.int32, name='input_2')]This is the stack trace when I replace the original bert model with neuron compiled model.Traceback (most recent call last):File "/home/ubuntu/venv/lib/python3.7/site-packages/tensorflow/python/eager/function.py", line 1645, in _call_with_flat_signatureargs.append(kwargs.pop(compat.as_str(keyword)))KeyError: 'input_1'During handling of the above exception, another exception occurred:Traceback (most recent call last):File "/home/ubuntu/venv/lib/python3.7/site-packages/tensorflow/python/eager/function.py", line 1615, in _call_implcancellation_manager)File "/home/ubuntu/venv/lib/python3.7/site-packages/tensorflow/python/eager/function.py", line 1651, in _call_with_flat_signatureraise TypeError(f"{self._flat_signature_summary()} missing required "TypeError: signature_wrapper(input_1, input_2) missing required arguments: input_1, input_2.During handling of the above exception, another exception occurred:Traceback (most recent call last):File "main.py", line 319, in <module>verbose)File "main.py", line 223, in process_each_projectverbose=verbose)File "/home/ubuntu/ranking_pipeline/rank_utils.py", line 437, in rankresponse, inputs, _ = self.model.predict(search_sentences)File "/home/ubuntu/ranking_pipeline/bert_utils.py", line 292, in predictinputs['mlm_ids'], dtype=tf.int64),File "/home/ubuntu/venv/lib/python3.7/site-packages/tensorflow/python/eager/function.py", line 1601, in callreturn self._call_impl(args, kwargs)File "/home/ubuntu/venv/lib/python3.7/site-packages/tensorflow/python/eager/function.py", line 1617, in _call_implraise structured_errFile "/home/ubuntu/venv/lib/python3.7/site-packages/tensorflow/python/eager/function.py", line 1611, in _call_implcancellation_manager)File "/home/ubuntu/venv/lib/python3.7/site-packages/tensorflow/python/eager/function.py", line 1688, in _call_with_structured_signatureself._structured_signature_check_missing_args(args, kwargs)File "/home/ubuntu/venv/lib/python3.7/site-packages/tensorflow/python/eager/function.py", line 1707, in _structured_signature_check_missing_argsraise TypeError(f"{self._structured_signature_summary()} missing "TypeError: signature_wrapper(*, input_2, input_1) missing required arguments: input_1, input_2.Thanks in advanceWarm regardsAjayFollowComment"

Answer: "0Due to the 512 length limit, you have basically two options:You cut the longer texts off and only use the first 512 Tokens. The original BERT implementation (and probably the others as well) truncates longer sequences automatically. For most cases, this option is sufficient.You can split your text in multiple subtexts, classify each of them and combine the results back together ( choose the class which was predicted for most of the subtexts for example). This option is obviously more expensive.You can read about these options here.is it the same to use patentbert from google and huggingface anferico/bert-for-patents ?Yes, both versions will work with the given use case. You can look at a simplified comparison between the services here.CommentShareVatsal Manswered 7 months ago"


Question: Greengrass V2: Have component reload latest configuration settings upon new deployment.

"Hi,We have a number of custom Greengrass V2 components that we'd like to automatically load in the latest set of configuration settings that may have been changed andsince  deployed to one or more devices. I'm assuming the correct way to do this is by triggering a component restart? Or is there a better way?FollowComment"

Answer: "2Accepted AnswerYou can achieve this using Greengrass IPC, specifically SubscribeToConfigurationUpdates and GetConfigurationCommentShareEXPERTMichaelDombrowski-AWSanswered 7 months agocgddrd 7 months agoExcellent - makes sense. Many thanks!Share"


Question: Kernel panic during EC2 launch

"During deployment of new app version on new EC2 with template from AMI image I got following error:[    1.670047] No filesystem could mount root, tried: [    1.670048] [    1.677170] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)[    1.685026] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.14.181-140.257.amzn2.x86_64 #1[    1.692532] Hardware name: Amazon EC2 t3a.nano/, BIOS 1.0 10/16/2017previously it was working like charm - I haven't change any AMI or template setting - just added new SSL certs to nginxI found this troubleshooting article but cannot move with it since I cannot access instance terminal.I've tried to boo new instance with add different kernel ID but got this error:You cannot launch multiple AMIs with different virtualization styles at the same time.I believed during AMI kernel has somehow changed and it causes problem - is it possible?What can cause that issue and how to solve?FollowComment"

Answer: 0It is impossible to suggest any resolution with the data that you provided.I suspect that the issue is related to error in /etc/fstab file.There might be also an error in launch template for Disk1 and wrong device nameOr the Snapshot / EBS volume is corrupted.If you added nginx certs then obviously you updated AMI so I suspect there was an issue during new image building process.CommentShareMaciej Malekanswered a year ago


Question: Dynamic port mapping - health check failures for target group in ECS cluster

"We have our application hosted in ECS cluster as container. Also we have nginx running in a container to reverse proxy.0.0.0.0:80->8080/tcp   - application0.0.0.0:81->80/tcp  - nginxI have a target group having my instances running on port 80 and health check settings configured to use override option and port mentioned as 81 - so that health passesI am trying to use ECS blue green code deploy option in code pipeline to automate deployments.To achieve this,I have changed my application port mapping to dynamic so that it runs in a random port - for ex: 0.0.0.0:32768:8080I created a task definition to use dynamic port mapping like 0:8080I have an application load balancer which listens on 80 and 443 and redirect traffic to target group .While trying to create a service using the above ALB andd TG, I am getting error as the task definition uses dynamic port mapping but the target group uses particular port specified in health check settings.So I have changed the health check setting option to use traffic port option - but doing so the health check always fails.Could you please help me in configuring a health check for dynamic port mapping or how to configure the resources for blue green deployments to my container.Note : My application does not need any task to be running and its just deploying once.Verified security group inbound rules to allow traffic from load balancerFollowComment"

Answer: 0Have you checked the security groups on the containers allows access on the ports by the health check?CommentShareGary Mcleananswered a month agorePost-User-2225618 a month agoI have followed the steps in the below linkhttps://repost.aws/knowledge-center/dynamic-port-mapping-ecsThe security group for the EC2 instance inbound rules allow All traffic and the source I have mentioned as load balancer security group.Share


Question: Getting invocation statistics for a Lambda function.

"I have a moderate collection of Lambda functions that have been developed over a period of several years and I'm attempting a clean up and rationalisation. As part of this, I am attempting to run some reports on the frequency of invocation and success of these functions over time. I would like to do this programmatically - initially from the command line and subsequently from a Python program. I'm calling "aws cloudwatch get-metric-statistics" with input from a json file :"aws cloudwatch get-metric-statistics --cli-input-json file://get-stats.json"where the input file is:"{"Namespace": "AWS/Lambda","MetricName": "Invocations","Dimensions": [{"Name": "FunctionName","Value": "serverWatchdog"},{"Name": "Resource","Value": "serverWatchdog"}],  "StartTime": "2020-12-01T00:00:00",  "EndTime": "2020-12-05T00:00:00",  "Period": 360,  "Statistics": \[      "Average"  ],  "Unit": "Count"  }"I know that this function is being called several times per hour - I can see it on the Cloudwatch console. But my CLI command always returns:{"Label": "Invocations","Datapoints": []}Any suggestions as to what I'm doing wrong?TIAMartinFollowComment"

Answer: "0get rid of this section (and the leading comma):{"Name": "Resource","Value": "serverWatchdog"}..and try that.the return is a little lacking, in that what it should say is "function not found"..but instead it looks like it's returning no data for that time range.CommentSharecloudbuttonanswered 2 years ago0Thanks for that - it did fix it. It is an aspect of AWS that is not well documented!MartinCommentShareMabyanswered 2 years ago"


Question: Does Custom Domain Work for WebSocket APIs ?

"I created a Sample Websocket Chat App using this https://github.com/aws-samples/simple-websockets-chat-appThe websocket connection is working fine.But when I connect a API Gateway Custom Domain to this api.The connection is successfull, the messages are sent from client to server, but the messages from server are not received at the clientFollowComment"

Answer: "0Hello Raghavendra,Custom Domain is definitely supported for Websocket API. Here is a documentation you can refer to setup custom domain.Regarding, the messages from server not being received at the websocket client, this could be due to missing route response.WebSocket routes can be configured for two-way or one-way communication. If a route has a route response, it is configured for two-way communication. Otherwise, it is configured for one-way communication. Route responses are used to enable two-way communication, in which your API can send a response back to the client in the context of the client's message.https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-route-response.htmlhttps://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-integration-responses.htmlCommentShareSUPPORT ENGINEERIsha_Kanswered 4 months agoRaghavendra K R 4 months agoI found out that , the issue was in the server side , the connection url was wrong when used post response in the Lambda functionShare"


Question: Does Workspace support RSA SecurID as MFA?

"Does RSA SecurID supported by Workspace? A customer encountered message "Error" when attempt to configure RSA SecurID and so would like to check if that is possible?What are the VPC ports required, and is there any additional configuration information needed on the Workspace?FollowComment"

Answer: "0Accepted AnswerAmazon WorkSpaces support MFA with AD Connector directory service.  A key requirement is an MFA solution that is a Remote Authentication Dial-In User Service (RADIUS) server or a plugin to a RADIUS server. Instruction for configuring MFA is available in the online docs.Specifically RSA SecurID is supported by WorkSpace since it also supports a RADIUS server. I have a customer that has this implemented successfully.What you should do is to troubleshoot the connectivity from the AD Connector Directory Service to the RADIUS server and ensure the proper ports used for RADIUS communication are enabled. Confirm your shared secret is correct. By default, the radius port is set to 1812.If the RADIUS server is configured to use a different port, then you will need to adjust as appropriate.CommentShareEXPERTDzung_Nanswered 4 years ago"


Question: Cognito Authorization using ASP.Net Core

"I'm trying to get my ASP.Net Core Web App to authenticate/authorize using AWS Cognito.  I'm using the following example as a guideline: https://github.com/aws-samples/aws-netcore-aspnetmvc-amazon-cognito-authentication-authorization-samplesSo far, I haven't been able to get the sample working and I've noticed at least one other person who has a similar issue redeeming the token.I'm using Visual Studio 2022 and have migrated to the latest version of .Net.When I attempt to login, I'm getting the following, any idea what might be wrong?Thank youFollowCommentrePost-User-9370027 6 months agoI duplicated the sample using a new ASP.Net Core MVC Web App using .Net 7.0, made the necessary changes to migrate from Program.cs + Startup.cs to just the Program.cs.  I'm getting the same error.I can zip up the solution and send if needed.Share"

Answer: "0Hi,Please take a look at our documentation per endpoint. For example for the Token endpoint request [ https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html ] the error means:Client authentication failed. For example, when the client includes client_id and client_secret in the authorization header, but there's no such client with that client_id and client_secret.There is a high chance you did not provide the Authorization header for a confidential client in the form of Basic <Base64 format of  'client_id:client_secret'JeffCommentShareJeff Lombardo-AWSanswered 2 months ago"


Question: Update Existing Lambda Function using SAM.

"we have multiple lambda functions already created manually, now we wanted to move on SAM. rather then creating any new lambda functions from SAM, we wanted to update existing one. is there any way to move those existing lambda function via SAM, so that we can update and manage those existing lambda function via SAM.FollowComment"

Answer: "1Accepted AnswerAs SAM is based on CloudFormation, you can import resources to it.You'll need to use the CLI for it, as the console doesn't support the import when the template has the Transform section (reference).Here is more information on how to do the import: Import an existing resource into a stack using the AWS CLI.Check the overview of the import process.CommentShareEduardoanswered a year agorePost-User-5774217 a year agoThanks, I also got to know about this approach but still I have one question, existing lambdas have already connected with API Gateways, Step functions, Cloud watch events as triggers. is there any way to import these all also cloud formation stack?? Like I wanted to move these lambdas with all it's triggers to sam.Share1Try exporting the existing Lambda function's SAM template:Under Actions > Export Function then choose "Download AWS SAM File" to download the function SAM template. I think you should be able to tweak it to your needsCommentShareDror Helperanswered a year ago"


Question: UNPARSABLE_MANIFEST in MediaTailor but Playback Works?

Working in MediaTailor I received the following response:MediaTailor encountered an issue while parsing the manifest from https://fastbucket1.s3.amazonaws.com/hls/shes_got_minenew.m3u8BUT the manifest was created in MediaConvert and plays back seamlessly from the link. Any ideas on how to fix / correct / modify? Any assistance appreciated.FollowComment

Answer: "0Accepted AnswerThe .m3u8 file you list seems to point to a child playlist (stream manifest) and not the top level manifest. The to level manifest will define the resolutions, bitrate and encoding of the stream. Though a player can consume a stream manifest directly, try pointing AWS MediaTailor to the top level manifest instead of the stream manifest.CommentShareMike-MEanswered 8 months agoRadiant RePoster 8 months agoProblem solved! Thanks so much for your assistance.Share"


Question: How to add/suppress custom scope in AWS Pre-Token Generation trigger ?

"I have Cognito user pool with one Allowed custom scopes for my app client i.e.  admin-only. I have two kinds of users 1. Users in Admin Group 2. Non-Admins users. For my one of the AWS API Gateway Routes, I need to deny the access if user from non admin group is hitting the API Url, basically its allowed only for users which are part of Admin User group.I can achieve it through adding an Authorization scope on API gateway route with this custom scope and then adding a scope manually when I request an Authorization token in Hosted UI popup.  But in my app, I don't want to add this scope manually, rather want to add this scope when the token is generated. I explored Pre-Token Generation Trigger but not able to see the way to override or add scope attribute in it. Also tried below code in Pre-Token Generation Trigger lambda.exports.handler = async (event, context, callback) => {event.response = {        "claimsOverrideDetails": {            "claimsToSuppress": ["admin-only"]        }    };    callback(null, event);    };Question is, is there a way to add/override custom scope in pre-token generation trigger ? If yes then how ? But if there is no way, then how to solve my use case ?FollowComment"

Answer: "0You're definitely heading in the right direction, you can use the Pre-token generation Lambda trigger to add claims to your ID tokens. You would use the 'claimsToAddOrOverride' property for that. You can find more information here in the documentation here.I've created a sample application in the past which demonstrates how to add a 'department' claim (and use it for ABAC), it might give you an idea on how to implement it. The repository is here, and in particular, the pre-token-trigger.js shows how to use the 'claimsToAddOrOverride'.Hope that helps :)CommentShareLaurens_Banswered a year ago"


Question: Glue Crawler - skip adding partitions

"Partitioned data in S3 as below -some-dataset/2019-12-28/some-dataset/2019-12-29/some-dataset/2019-12-30/some-dataset/2019-12-31/some-dataset/2020-01-01/some-dataset/2020-01-02/some-dataset/2020-01-03/When running a Glue crawler against the above dataset to create the schema in the catalog, how can we configure the crawler to avoid adding partitions for year 2019 into the table?If that is not possible, is there a way to totally avoid registering ANY partitions and only create the table schema?FollowComment"

Answer: "0Accepted AnswerYou can add excludes to the crawler, e.g. for anything 2019 "**/2019-**" The second question doesn't make any sense to me, if you have a partitioned table you need at least one partition. You can disable the crawler once the table is created with at least one.CommentShareGonzalo Herrerosanswered 3 years ago"


Question: Rotate objects to normal?

I'm trying to rotate my object to match the normal of the ground. I can get the normal with a ray from a physx node but I do not know how to convert that into rotation for character or decal. The effect I am trying to achieve would be like bullet holes on a wall or making a Mario Galaxy Style game where I reorientate around an object like a sphere. Any guidance would be appreciated.Follow

Answer: "0Hi @REDACTEDUSERI think the best way to do this is to create a new orthonormal basis for the vector and then use that to apply the rotation to your object.There's a pretty neat way to do this using an algorithm by John F. Hughes and Tomas Möller. It's in the Real Time Rendering book (3rd edition, 4.24), we use a version of it in the White Box code in one of the util files you might be able to find too.This paper could also be useful - https://www.google.com/url?sa=t&source=web&rct=j&url=http://cs.brown.edu/research/pubs/pdfs/1999/Moller-1999-EBA.pdf&ved=2ahUKEwik1eiJx-7rAhVxTxUIHfHgD0EQFjAJegQICBAB&usg=AOvVaw3S0kJSjnIWZrzIT_PmpDz9SharerePost-User-0765265answered 3 years ago0Hello phil_blackwood,to rotate an object so that it follows the terrain slope is totally easy, at least the basic function.You could do it with a lookat rotation. You get the forward vector of your object, Then forward cross normal (from hit) you get the right vector. Then cross normal with the up vector, to get forward. Dont forget to normalize your vectors. Then use Transform::CreateFromColumns(right,forward,normal,position) and this is your new transform.I don't know if it is possible in Lumberyard to get the Triangle hit or the u and v vectors of the triangle hit. But if you get these, you could build your Transform or Geometry easily.JoergSharerePost-User-8147840answered 3 years ago0REMOVEDUPLOAD @REDACTEDUSERSo I'm new to the matrices Vector math. Based on what you said this is what I came up with, with scrip canvas nodes. I'm also pretty newest script canvas nodes so I'm not sure if I'm using things properly. Any input you could provide to help me fix this code would be appreciated. it does not seem to do anything.SharerePost-User-6701439answered 3 years ago0After thinking about it I realized my solution won't work exactly how you'd want. I did a little digging and stumbled across these posts which are great and might also come in handyhttps://iquilezles.org/www/articles/noacos/noacos.htmhttps://gist.github.com/kevinmoran/b45980723e53edeb8a5a43c49f134724 (links to the previous article)SharerePost-User-0765265answered 3 years ago0Hello phil_blackwood,I can say that your solution will not work for several reasons.First doing it on the OnHeld event will only execute as long as this event gets fired.Then you do a RayCast on Local Space. As far as I know you should take RayCastWorldSpace. If local space means the Entity local space (my understanding), then you have to transform all other Entities in your Local Space. If you do it in World Space, all Entities should be in the right Space.You create a Transform and convert the Transform to a Euler Vector. This Vector values are angles, so you can't plug this into World Gravity and Position.I assume you want to do some sort of movement animation. You can't do it this way. Do it on the OnHeld Event will only execute as long you held the button or whatever. You should set some sort of flag and then handle the jumping in an OnTick handler, so you have the Frame Delta Value as well. This Delta is the frame time from your rendering (and other computations) and you have to use it on animation and movement to get a similiar speed on different systems with different computation speed.The LookAt Transform is useful if you have to align a car to the slope of a hill. You need two Vectors for it, the Forwars vector and the Up Vector as example. I use the Forward of my Entity and the hit normal to create a transform to rotate a car on the slope. This works for basic testing, but it is not flawless.Here I made the RotateAlign from the links Tom provided. But it is not tested and I saved many values, which was not necessary.REMOVEDUPLOADAnd this is my prototyping for my Horse Movement. I use ScriptCanvas only for prototyping, so expect nothing really useful.REMOVEDUPLOADJoergSharerePost-User-8147840answered 3 years ago0I'm a bit late to the party here, but I think you should also be able to do this with the "Shortest Arc Between" node in Script Canvas.  I haven't tested it, but I think you could set the A Vector to 0, 0, 1 and the B vector to the normal you got from your raycast.  Then use the resulting quaternion to set your transform rotation.Best wishes,DavidSharerePost-User-0033699answered 3 years ago0id have to say I'm getting really promising results with your method @REDACTEDUSERSharerePost-User-6701439answered 3 years ago"


Question: Cognito with API gateway integration

Hiwe are using Cognito user pool for the API gateway but somehow it shows below error{"message":"Unauthorized"}we are using token ID which works fine in test with API gateway but in case of URL call back it says {"message":"Unauthorized"}.[Authorizers][1]we have no idea what we are missing hereThanksSiddharth MaheshwariFollowCommentfouad 3 months agoPorbably you facing the same issue https://repost.aws/questions/QUzf0Jka7rTHi4AkZ4G8YmzA#AN7qxwmkUUQFKVQIrmhV4EdgShare

Answer: "1Did you add the token to the Authorization header with a "Bearer " prefix? If you did, I suggest that you enable execution logs on the API and check why it is failing.CommentShareEXPERTUrianswered 8 months agoupon cloud 8 months agoHiwe are getting  a below URL  after Cognito signinghttps://o0gv1hfg9i.execute-api.us-east-1.amazonaws.com/test/myresource#id_token=xxxxx&access_token=yyyyy&expires_in=3600&token_type=Bearerand output is {"message":"Unauthorized"}please advise if this is correctShareUri EXPERT8 months agoThis is not correct. The token should be added to the Authorization header like this:Authorization: Bearer id_token (or maybe the access token)Shareupon cloud 8 months agoHiBelow is our Cognito URL which provides us sign in pagehttps://yyyyy.auth.us-east-1.amazoncognito.com/login?client_id=xxxx&response_type=token&scope=openid&redirect_uri=https%3A%2F%2Fo0gv1hfg9i.execute-api.us-east-1.amazonaws.com%2Ftest%2Fmyresourcethe output of the above URL is  below the URLhttps://o0gv1hfg9i.execute-api.us-east-1.amazonaws.com/test/myresource#id_token=xxxxx&access_token=yyyyy&expires_in=3600&token_type=Bearerwe are not changing anything hereplease adviseThanksShare0Please take a look at this page - https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enable-cognito-user-pool.htmlAre you sending an identity token or an access token in the Authorization header in the request to API Gateway?If you are sending the access token, you need to specify OAuth Scopes? Can you check if you have configured that in the API Gateway methods where you are enabling Cognito User Pools based authentication?CommentShareEXPERTIndranil Banerjee AWSanswered 8 months agoupon cloud 8 months agoHIWe are sending an identity token. below are the detailsCognito URL which provides us sign in pagehttps://yyyyy.auth.us-east-1.amazoncognito.com/login?client_id=xxxx&response_type=token&scope=openid&redirect_uri=https%3A%2F%2Fo0gv1hfg9i.execute-api.us-east-1.amazonaws.com%2Ftest%2Fmyresourcethe output of the above URL is  below the URLhttps://o0gv1hfg9i.execute-api.us-east-1.amazonaws.com/test/myresource#id_token=xxxxx&access_token=yyyyy&expires_in=3600&token_type=Bearerwe have configured that in the API Gateway methods with Cognito User Pools-based authentication. below are detailsMyAuthorizer Authorizer ID: m9a1oeCognito User PoolMyFirstUserPool - TpeUcTTj1 (us-east-1)Token SourceAuthorizatonToken Validationplease adviseThanksShareIndranil Banerjee AWS EXPERT8 months agoOnce the user signs in to the Cognito login page, the front-end application needs to include the generated token either identity or access token in the header of the API call to API Gateway using the header Authorization, as Uri explained. Are you doing that?We have a good hands-on workshop that gives you a good feel of how you can make Cognito work with API Gateway - https://auth.serverlessworkshops.io/setup.htmlShare0Hiwe have tried all possible ways, but are still struggling to fix it.please advise some solutionThanksSiddharth MaheshwariCommentShareupon cloudanswered 6 months ago"


Question: Support for ubuntu 20.04

"Hi AWS,I'll try to revive this post (https://forums.aws.amazon.com/thread.jspa?threadID=331002) from ex aws forum.A big update for aws Opsworks Stacks was scheduled around end 2021, including new version of chef and support for ubuntu 20.04.Do you have any update, list of expecations, message of hope to transmit. I believe that a lot of company are waiting this for a long time now and we need some visibility to be able move on.Best regardsQuentinFollowCommentjhundley9109 a year ago+1 I too would like an update on this.ShareAlexj12 a year agoMe too! Would be great to get an update!Sharejmckee a year ago+1 - We really need an update on OpsWorks Stacks.  Is an update coming or do we need to migrate to another solution?Sharebscheld a year agoCertainly is feeling like a dead product these days...Sharebscheld a year agoGoing to comment again to keep this post around.  Still seems like a dead product.  Might as well skip ahead to 22.04, but I have my doubts that any update will ever appear.ShareShow 2 more comments"

Answer: "1Hi Dorra,thanks for your answer, that's a great news. I tried to send you a private message but I could not find any way to do that.Anyway I think many people would be very pleased to have updates about Stack. Are you able to give us an ETA for those major changes.Regards,QuentinCommentShareQuentinD-Capsensanswered a year ago1We recently got a notification that the "Ubuntu 18.04" images provided in OpsWorks are being  deprecated soon (end of July 2022) due to being created over 2 years ago (e.g. "ami-095192256fe1477ad" in us-east-1).Do you have any updates on this matter?CommentSharevicentanswered a year ago0Hi QuentinD-Capsens, thank you for sharing your concern. Supporting new OS and Chef versions is in our current timeline. if you want to have more updates regarding OpsWorks stacks, please feel free to contact me privately.CommentShareDorra Mlouhianswered a year agojmckee a year agoHey Dorra,This is great news. I can't see how to message you directly.I see a number of people have followed questions about OpsWorks stacks and a timeline had previously been shared.  Can you please share an ETA or provide a method for us to reach you directly?Thanks,JoeShare"


Question: Glue job hudi-init-load-job with script HudiInitLoadNYTaxiData.py fails

"Hello.WE have some sort of POC and currently evaluating capability of Glue.As a part of that evaluation I've recently activated the latest version  of "AWS Glue Connector for Apache Hudi" which is 0.9.0 . To be precise I speak about the results of implementation of the  steps from the [article] (https://aws.amazon.com/blogs/big-data/writing-to-apache-hudi-tables-using-aws-glue-connector/) . We currently don't use AWS Lake Formation. So I've successfully implemented every step except the part related to  AWS Lake Formation. Once I got the work of CloudFormation successfully accomplished I kicked off hudi-init-load-job JOB. But a result was somewhat frustrating! The job failed with the following result:2021-12-24 08:50:56,249 ERROR [main] glue.ProcessLauncher (Logging.scala:logError(70)): Error from Python:Traceback (most recent call last):File "/tmp/HudiInitLoadNYTaxiData.py", line 27, in <module>glueContext.write_dynamic_frame.from_options(frame = DynamicFrame.fromDF(inputDf, glueContext, "inputDf"), connection_type = "marketplace.spark", connection_options = combinedConf)File "/opt/amazon/lib/python3.6/site-packages/awsglue/dynamicframe.py", line 653, in from_optionsformat_options, transformation_ctx)File "/opt/amazon/lib/python3.6/site-packages/awsglue/context.py", line 279, in write_dynamic_frame_from_optionsformat, format_options, transformation_ctx)File "/opt/amazon/lib/python3.6/site-packages/awsglue/context.py", line 302, in write_from_optionsreturn sink.write(frame_or_dfc)File "/opt/amazon/lib/python3.6/site-packages/awsglue/data_sink.py", line 35, in writereturn self.writeFrame(dynamic_frame_or_dfc, info)File "/opt/amazon/lib/python3.6/site-packages/awsglue/data_sink.py", line 31, in writeFramereturn DynamicFrame(self._jsink.pyWriteDynamicFrame(dynamic_frame._jdf, callsite(), info), dynamic_frame.glue_ctx, dynamic_frame.name + "_errors")File "/opt/amazon/spark/python/lib/py4j-0.10.7-src.zip/py4j/java_gateway.py", line 1257, in callanswer, self.gateway_client, self.target_id, self.name)File "/opt/amazon/spark/python/lib/pyspark.zip/pyspark/sql/utils.py", line 63, in decoreturn f(*a, **kw)File "/opt/amazon/spark/python/lib/py4j-0.10.7-src.zip/py4j/protocol.py", line 328, in get_return_valueformat(target_id, ".", name), value)py4j.protocol.Py4JJavaError: An error occurred while calling o115.pyWriteDynamicFrame.: java.lang.NoSuchMethodError: scala.Predef$.refArrayOps([Ljava/lang/Object;)[Ljava/lang/Object;at org.apache.hudi.DataSourceOptionsHelper$.$anonfun$allAlternatives$1(DataSourceOptions.scala:749)at org.apache.hudi.DataSourceOptionsHelper$.$anonfun$allAlternatives$1$adapted(DataSourceOptions.scala:749)at scala.collection.immutable.List.foreach(List.scala:392)at org.apache.hudi.DataSourceOptionsHelper$.<init>(DataSourceOptions.scala:749)at org.apache.hudi.DataSourceOptionsHelper$.<clinit>(DataSourceOptions.scala)at org.apache.hudi.HoodieWriterUtils$.parametersWithWriteDefaults(HoodieWriterUtils.scala:80)at org.apache.hudi.DefaultSource.createRelation(DefaultSource.scala:157)at org.apache.spark.sql.execution.datasources.SaveIntoDataSourceCommand.run(SaveIntoDataSourceCommand.scala:45)at org.apache.spark.sql.execution.command.ExecutedCommandExec.sideEffectResult$lzycompute(commands.scala:70)at org.apache.spark.sql.execution.command.ExecutedCommandExec.sideEffectResult(commands.scala:68)at org.apache.spark.sql.execution.command.ExecutedCommandExec.doExecute(commands.scala:86)at org.apache.spark.sql.execution.SparkPlan$$anonfun$execute$1.apply(SparkPlan.scala:131)at org.apache.spark.sql.execution.SparkPlan$$anonfun$execute$1.apply(SparkPlan.scala:127)at org.apache.spark.sql.execution.SparkPlan$$anonfun$executeQuery$1.apply(SparkPlan.scala:155)at org.apache.spark.rdd.RDDOperationScope$.withScope(RDDOperationScope.scala:151)at org.apache.spark.sql.execution.SparkPlan.executeQuery(SparkPlan.scala:152)at org.apache.spark.sql.execution.SparkPlan.execute(SparkPlan.scala:127)at org.apache.spark.sql.execution.QueryExecution.toRdd$lzycompute(QueryExecution.scala:80)at org.apache.spark.sql.execution.QueryExecution.toRdd(QueryExecution.scala:80)at org.apache.spark.sql.DataFrameWriter$$anonfun$runCommand$1.apply(DataFrameWriter.scala:676)at org.apache.spark.sql.DataFrameWriter$$anonfun$runCommand$1.apply(DataFrameWriter.scala:676)at org.apache.spark.sql.execution.SQLExecution$$anonfun$withNewExecutionId$1.apply(SQLExecution.scala:78)at org.apache.spark.sql.execution.SQLExecution$.withSQLConfPropagated(SQLExecution.scala:125)at org.apache.spark.sql.execution.SQLExecution$.withNewExecutionId(SQLExecution.scala:73)at org.apache.spark.sql.DataFrameWriter.runCommand(DataFrameWriter.scala:676)at org.apache.spark.sql.DataFrameWriter.saveToV1Source(DataFrameWriter.scala:285)at org.apache.spark.sql.DataFrameWriter.save(DataFrameWriter.scala:271)at com.amazonaws.services.glue.marketplace.connector.SparkCustomDataSink.writeDynamicFrame(CustomDataSink.scala:43)at com.amazonaws.services.glue.DataSink.pyWriteDynamicFrame(DataSink.scala:65)at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)at java.lang.reflect.Method.invoke(Method.java:498)at py4j.reflection.MethodInvoker.invoke(MethodInvoker.java:244)at py4j.reflection.ReflectionEngine.invoke(ReflectionEngine.java:357)at py4j.Gateway.invoke(Gateway.java:282)at py4j.commands.AbstractCommand.invokeMethod(AbstractCommand.java:132)at py4j.commands.CallCommand.execute(CallCommand.java:79)at py4j.GatewayConnection.run(GatewayConnection.java:238)at java.lang.Thread.run(Thread.java:748)I'm quite new to the AWS stack so could someone please give me a hand to fix itFollowComment"

Answer: "0Accepted AnswerI've just changed the version of glue within job hudi-init-load-job. At the beginning it was Glue 2.0 but i switched to 3.0 and the job  succeeded!CommentShareAWS-User-0316168answered a year agoFabrizio@AWS EXPERTa year agoWhen subscribing to the latest Glue connectors, please make sure to note the version you are subscribing to (there should be one for Glue 1.0/2.0 and one for Glue 3.0) and then make sure you use the correct engine in your job as you noticed.Share0some more warnings/errors related to the job run:main WARN JNDI lookup class is not available because this JRE does not support JNDI. JNDI string lookups will not be available, continuing configuration. java.lang.ClassNotFoundException: org.apache.logging.log4j.core.lookup.JndiLookupCommentShareAWS-User-0316168answered a year ago0WARN ApacheUtils: NoSuchMethodException was thrown when disabling normalizeUri. This indicates you are using an old version (< 4.5.8) of Apache http client. It is recommended to use http client version >= 4.5.9 to avoid the breaking change introduced in apache client 4.5.7 and the latency in exception handling.CommentShareAWS-User-0316168answered a year ago0WARN EC2MetadataUtils: Unable to retrieve the requested metadata (/latest/user-data/). The requested metadata is not found at http://IP/latest/user-data/CommentShareAWS-User-0316168answered a year ago0ERROR UserData: Error encountered while try to get user dataCommentShareAWS-User-0316168answered a year ago0WARN TaskSchedulerImpl: Initial job has not accepted any resources; check your cluster UI to ensure that workers are registered and have sufficient resourcesCommentShareAWS-User-0316168answered a year ago"


Question: API Gateway > Custom Domain Name > TooManyRequestsException

"I have just created a HTTP API and would like to setup a custom domain name somedomain.mysite.comIn Console under Create Domain Name, when I select mutual TLS option and enter truststore URI in S3, using ACM public certificate which I have requested earlier for same domain name, there is an error of Too Many Requests.Under Route53, there is an A record pointing to somedomain.mysite.com and a CNAME record to validate the DNS for the certificate under same domain. Using the certificate ARN, I have copied the certificate chain as a PEM file and uploaded to S3I'm not sure where is the exception coming from as I have not done any updates on API Gateway so farFollowComment"

Answer: "0I am not sure where. the error is coming from, but, do you need mutual TLS? Usually you do not need mutual TLS for custom domain names. You only need it when you also have client certificates that you want to validate on the server.CommentShareEXPERTUrianswered 10 months ago"


Question: Amplify Auth with CookieStorage - support for httpOnly flag

"Hi,Is it possible to use Amplify Auth with CookieStorage and httpOnly flag? Our plan is to prevent XSS with the httpOnly flag but looks like this isn't supported (current config example below). Do you have any plans to add this feature in near future?If you can advise any other alternative(s), that'll be much appreciated.cookieStorage: {        domain: '.yourdomain.com',        path: '/',        expires: 365,        sameSite: "strict" | "lax",        secure: true},Ref: https://docs.amplify.aws/lib/auth/start/q/platform/js/#re-use-existing-authentication-resourceThanks,FollowComment"


Question: Can't select Availability Zone

"I can't select the Availability Zone while launching a new instance in EC2-Classic, the dropdown menu is stuck at "Loading...".I tried in other web browsers but it does not work.FollowComment"

Answer: "0Hi,Regarding your query, With EC2-Classic, your instances run in a single, flat network that you share with other customers. Having said this, since this is a single network its not divided and hence there are no AZ's available to select while launching instances via the launch wizard.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-classic-platform.html  I hope this helps.CommentShareSanjnaAWSanswered 3 years ago0Did that change this month? I could do it two weeks ago.I am updating and migrating legacy systems step by step, but I still have production services in EC2-Classic mode.CommentSharejackshoemakeranswered 3 years ago0It works again! It seems that it was fixed.CommentSharejackshoemakeranswered 3 years ago"


Question: Are there plans to improve spam filtering in WorkMail?

"For the last two years, I have been battling it out with a clever spamming operation that utilizes budget VPS hosts globally. I've worked with hosting providers and organizations like SpamCop to stop some spam, but it always returns, and the level of effort is far more than the return. I've taken a brute force approach using SES IP filter rules to block the worst offenders, and while that is effective for a time, within two months the spammer is back on a different host with new IP addresses. My desktop e-mail clients identify and filter spam effectively, but it's not the case on mobile. For example, Apple Mail requires the user to select and mark each message as spam individually. Desktop clients are configured to filter on receipt and the user rarely, if ever, sees a spam message in their inbox. The rate of false negatives from WorkMail is about 10 messages per day. I'd like to push more of that back to the server side because the messages are clearly spam, and a well-trained, server-side filter should catch them easily. I recently enabled DMARC to see if it helps, but based on what I can see in CloudWatch Logs Insights, it isn't going to do much. Others share my concern, as expressed in other posts from the past several months:So much spam incoming to WorkMailSpam volume through WorkMail has significantly increased, with no end in sightHuge Increase in SPAMWhy antispam in Workmail/SES is garbage?Here are my suggestions to improve the situation:Publish SES IP Filter metrics to CloudWatch. This helps me decide if I can remove older filters. Right now, I'm flying blind and reluctant to remove filters because doing so may increase spam volume. If I could see which rules were actively blocking vs. taking up a slot in the quota, it would be very easy for me to prune old filters.Publish SES logs to CloudWatch. This ties into, and extends, my first suggestion. Logs from SES could give me additional insights.Give me a trainable, per-user Naive Bayes filter. The best antispam solution I ever used was a defunct project called Dspam. It took a little time to train it correctly, but once it was trained, very little spam made it through and the false positive rate was low, too. bogofilter is another good one.I think the best solution, but likely most difficult to implement, is the Bayesian filter. I think that would put WorkMail on par with other e-mail providers, and make me less likely to consider migrating. The other two suggestions would help, and would reduce some of my manual effort, but there really needs to be better spam filtering. It is wholly inadequate in its current state.FollowComment"


Question: Issue with lambda when connecting to vpc for static ip

"Hello All,I have created my lambda function with serverless framework , and want to add it to a static IP for other service  useI have configured everything acc to aws blog for static ipBut when I am attaching than VPC to my lambda , my lambda function stope behaving normally , it gives response time out issue with 502 statusAnd when I detach the VPC its works fineFollowCommentalatech EXPERT3 months agoDoes this help you? https://repost.aws/questions/QUrmtLpnvWRJeDeeSbJZ6H2g/static-ip-for-lambdaShare"

Answer: "0Hi there,I understand that you have placed your Lambda inside a VPC in order to assign it a static IP, however you are observing a 502 time out error as a result.Since the timeout error only occurs when you place the Lambda inside your VPC, this suggests that there may be a misconfiguration in your Lambda-VPC setup. To resolve this, please ensure that your setup is configured as follows: 1. Your Lambda must reside inside a private subnet (s). A private subnet is one which has a route to a NAT Gateway in it's routing table. Please review the subnets in which you have placed your Lambda function, and ensure that they are private.  2. If you already have a route to the NAT Gateway, ensure that the NAT Gateway itself resides inside a public subnet. A public subnet is one which is has  a route to an Internet Gateway in its routing table. Please review the subnet in which you have placed your NAT Gateway, and ensure that it is public.  In summary, when you place a Lambda function inside a VPC, it must be configured as mentioned above for it to be able to access public endpoints (over the internet), otherwise, a time out error is expected.For more detailed guidance on setting up your Lambda with a VPC, please see: https://aws.amazon.com/premiumsupport/knowledge-center/internet-access-lambda-function/Kind Regards,AhmadCommentShareAhmad Tariqanswered 3 months ago"


Question: Can't access technical support despite having a developer plan

"Whenever I try to create a technical support case I receiveTechnical support is unavailable under the Basic Support planIn the upper left of the page it saysSupport plan: Basic  ChangeWhen I click "Change", the page I'm brought to tells me I have the "Developer" plan which should include technical support and is obviously not the "basic" plan the previous page said I had.FollowComment"

Answer: 0Hi.I would suggest that you open an "Accounts and Billing" case and have them look into your account and confirm whether you subscribed to the developer plan to access Technical support.CommentShareSUPPORT ENGINEERLundianswered a year ago


Question: Backup -  explained to a 5 year old

"I have 3 websites hosted with AWS, but I cannot see how they can be backed up (I need a remote (ie, my Google Drive) copy of each.I've tried installing a plugin (Updraft), but have got an error "Installation failed, could not create directory."If there's an easy way of fixing this, could you please explain it to me like I was 5 years old (or maybe a little bit older)?FollowCommentalatech EXPERT3 months agoThe above error "Could not create directory" seems related to lack of permissions to execute the plugin installation. Could you revise this guide and see if clarifies which permissions you need? https://updraftplus.com/faqs/what-settings-should-i-use-for-amazon-s3-and-how-should-i-configure-my-amazon-s3-account/Share"


Question: Can't Run 1.8.0.1 on Nexus 7 Device Without Crashing

"I'm able to build a very simple project (create new project, add single ui canvas with 1 button on it) and run this on my Nexus 7. I get the Lumberyard splash screen then black screen then the app crashes. I suspect the shader compiler is not actually working since I don't see it doing anything when I launch the app. So I have a few questions - does anyone have this running on device, and if so, are you able to provide some guidance? Is the problem for me actually the shader compiler? How can I verify that the SC is actually doing anything useful and providing any necessary utility? Finally I'd love to not need a shader compiler at all - is there a way to build everything into the apk and not require a shader compiler at all, ever? All the apps I'll be doing initially will be strictly 2D UI + code. Also, the behavior I described above is the same when running the SamplesProject or any other project on device.Any help will be greatly appreciated.Thanks.-KevinFollowComment"

Answer: "0Accepted AnswerHere is my hardware specs.CommentSharerePost-User-9373806answered 6 years ago0Hi @REDACTEDUSERThank you for your interest in Lumberyard on Android. May I ask which version of the Nexus 7 are you using?The version released in 2012, which uses the Tegra 3 chipset, does not meet the min hardware specs of OpenGL ES 3.0. The 2013 version, however, does but unfortunately there is currently a bug in the ES 3.0 support we are working on and planning on releasing in the near future.In the meantime, an ES 3.1 or newer device is required to run Lumberyard on Android. Apologies for any inconveniences this may cause.CommentSharerePost-User-6730542answered 6 years ago0Thanks for the hardware spec - that looks like it should run Lumberyard. You will want to check the system_android_es3.cfg to make sure that it has r_ShaderCompilerServer set to the IP address of the PC where you are running the remote shader compiler.Also you will want to create a file called config.ini in the same directory where the remote shader compiler executable is located and in that file add the line:whitelist=[Android IP Address]Replacing [Android IP Addess] with the actual IP address of your android device. An example would be: whitelist=192.168.0.1In the window where the remote shader compiler is running you should see it print out lines that it is processing the shader requests from the device.Also you will want to run the following command from the command line: adb logcat -s "LMBR"That will dump to the command line output from the engine as it starts up. Attaching this output to a question will help us better answer your questions/help figure out what is going wrong with your setup.As for not needing the remote shader compiler it is difficult at the moment because we generate shader permutations at runtime. Since the permutations are run-time dependent we don't know what shaders to generate/compile for you at compile time. This is why in the docs it talks about flying around your level. Once you have done that you can package up the shaders and pack them into your APK. You will need to do this to release your game on Android.So... once you have the UI showing up on your Android device you could technically run the process to generate that shader pak file and then you would not need the remote shader compiler. The problem will come if you add a new UI component that triggers the creation of a new shader permutation that you don't have already. In that case the game may hang (depends on what values you have in the system_android_es3.cfg file). :)Thanks,ChrisCommentSharerePost-User-1597227answered 6 years ago0Are there any plans in the future to remove the need for a shader compiler entirely? For example, if I opt to use only a few, pre-built shaders in my app for everything; then I wouldn't need to use a running shader compiler? I'd also like to know, when running live, in production, would all of my apps require our backend to have a shader compiler running and accessible to all users globally?Thanks.-KevinCommentSharerePost-User-9373806answered 6 years ago0I think the point is to generate these paks - apps get submitted with the paks built, right? Sorry, I asked a kind of dumb question because I have never worked with a shader compiler before and have no reference for why one would be needed... I've even written my own, simple shaders in used in Unity; but even the largest game I've ever worked on only had a couple hundred shaders.CommentSharerePost-User-9373806answered 6 years ago0Yeah, we are not big fans of the remote shader compiler either but I cannot state what are plans are for it at this time.As for when you release your game you won't need to have your customers connect to the shader compiler. The remote shader compiler is only for development and when you release your game you will put the compiled shaders into the APK. Here is the documentation that describes that process (look for the section labeled: Generate and Retrieving Shaders and read from there on): http://docs.aws.amazon.com/lumberyard/latest/userguide/android-shaders-building.htmYou can use that same process now in your development process to pack up the shaders and not connect to the remote shader compiler every time.CommentSharerePost-User-1597227answered 6 years ago0No dumb questions here - the remote shader compiler is not a traditional way of handling shaders and so if you are confused by it, welcome to the club. :)As for why we use it - mainly a legacy pipeline we inherited from CryEngine. What it helps in is converting the HLSL shaders into GLSL/Metal. Unity does a similar thing, though it is better hidden/handled than the remote shader compiler solution. This makes it easier to maintain shaders as we don't have to write the same shader three or more times for each shader language. We write it once then use the remote shader compiler to convert it to the native shader language for the device that is requesting it.CommentSharerePost-User-1597227answered 6 years ago0I could not get it running on the device above. Attached is a log file of it running. Also, when running on the N7, it doesn't even try to compile shaders (no Shader Compiler activity).Somewhat of a success though - I was able to get the SamplesProject running on the device below.When running on that device, I get hundreds of this log messages a second:04-26 11:26:48.404 4766 4787 I LMBR : $4[Error] OpenGLError: Source: Other Type: Performance Id: 2147483647 Severity: High Message: Namespace collision detected, using slow pathnexus7log.txtCommentSharerePost-User-9373806answered 6 years ago0Looking through the log and I see this line which explains why it is not running on the Nexus 7:04-26 11:12:03.222 11420 11457 I LMBR : The available graphic adapters don't meet the minimum requirements for running the game. Device Qualcomm Adreno (TM) 320 doesn't support the minimum version needed of OpenGL (ES). Required 310, found 300.We are currently improving our OpenGL ES 3.0 support and this should be resolved in a future release. For now you will have to work on the Snapdragon device for Android development. That or update the Nexus 7 to a newer version of Android that has OpenGL ES 3.1 support.As for the OpenGL errors we have been trying to track those down and obviously have not had much luck in doing so. We are still digging into them and will hopefully figure out what the driver is telling us and get things running on the non-slow path.CommentSharerePost-User-1597227answered 6 years ago"


Question: Source IP using PrivateLink and NLB

"Setup: Server1 (VPC-A)  -> PrivateLink (VPC-B)-> NLB (VPC-B) -> Server2 (VPC-B)The application (server 2) needs to know the source IP of the consumer (server 1). What will be the visible source IP on server2? Is it the private IP of server1 or the NLB if not, then how can we get it?FollowComment"

Answer: "0Accepted AnswerServer 2 will see the connection initiated from one of the NLB private IP address. If you need the IP addresses of the service consumers (server1) and their corresponding interface endpoint IDs, enable Proxy Protocol on your NLB and get the client IP addresses from the Proxy Protocol header.CommentShareEXPERTmhjworkanswered 4 years agoAishwar 10 months agoThis link seems to be out of date. This one contains details on how to enable Proxy ProtocolSharerePost-User-1793262 10 months agoI am facing a similar issue. I have enabled Proxy Protocol on my Network Load Balancer and my ingress understands Proxy Protocol. However, the IP Address seen is only a local address from within the VPC. How do I get the client's IP Address?Share"


Question: Account created via control tower not shown

"Using control tower I set up an account calling it $account-name and I saw from cloudtrail that the creation properly started, but I can't seem to find it anywhere.I can see the other accounts I created with no problems, but if I'm not finding $account-name anywhere and if I try to create an account with the same name, the creation fails telling me "A stack named $account-name already exists"The issue is that calling both aws organizations list-accounts and aws organizations list-create-account-status, $account-name is not listed and therefore I can't delete the stack and recreate it.Has this happened to anyone else? Where can I find the account stack to delete it and recreate it?FollowComment"

Answer: "0The word "stack" generally would refer to CloudFormation stacks so that would be the first place I would check.It would be in the Control Tower management account. It's possible that a CloudFormation stack was created to help provision some of the Control Tower resources for the account, but something failed along the way.It's strange that you don't see the account on the organizations page, though. I would also try to recover the account using "Forgot Password" with the root user email you selected to determine if the account was created. Perhaps the Cloudformation stacks were created (and failed) before the account was 100% finished leaving the account in a state where it was rolled back (deleted by AWS) but the CloudFormation stacks were not.CommentShareCarlo Mencarellianswered 4 months ago0Did you use Account Factory within Control Tower to create the account? If so you can verify the status of the account in AWS Service Catalog under Provisioned products list.CommentShareAWS-User-9543277answered 4 months ago"


Question: "Troubleshooting SAML 2.0 Federation, Invalid SAML Response"

"Hello everyone,I'm trying to SSO into AWS through my IdP (Keycloak). I'm stuck with the error Your Request Included an Invalid SAML Response. To Logout, Click Here that is thrown from AWS SingIn. This specific error is described in the AWS Documentation and states that the response from the identity provider does not include an attribute with the Name set to https://aws.amazon.com/SAML/Attributes/Role.But as you can see in the authentication response below (at the very end) this is set. Any help is appreciated here :)ThanksCarsten<?xml version="1.0"?><samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Destination="https://signin.aws.amazon.com/saml" ID="ID_c1b23a5d-0b90-4a2a-b88d-50b5c854bbe7" IssueInstant="2019-10-14T14:06:43.661Z" Version="2.0"><saml:Issuer>https://auth.acme.org/auth/realms/master</saml:Issuer><dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:SignedInfo><dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><dsig:Reference URI="#ID_c1b23a5d-0b90-4a2a-b88d-50b5c854bbe7"><dsig:Transforms><dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><dsig:DigestValue>!REMOVED!</dsig:DigestValue></dsig:Reference></dsig:SignedInfo><dsig:SignatureValue>!REMOVED!</dsig:SignatureValue><dsig:KeyInfo><dsig:KeyName>!REMOVED!</dsig:KeyName><dsig:X509Data><dsig:X509Certificate>!REMOVED!</dsig:X509Certificate></dsig:X509Data><dsig:KeyValue><dsig:RSAKeyValue><dsig:Modulus>!REMOVED!</dsig:Modulus><dsig:Exponent>AQAB</dsig:Exponent></dsig:RSAKeyValue></dsig:KeyValue></dsig:KeyInfo></dsig:Signature><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion" ID="ID_17ff48a3-e794-4b66-a237-c93820afccea" IssueInstant="2019-10-14T14:06:43.661Z" Version="2.0"><saml:Issuer>https://auth.acme.org/auth/realms/master</saml:Issuer><dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:SignedInfo><dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><dsig:Reference URI="#ID_17ff48a3-e794-4b66-a237-c93820afccea"><dsig:Transforms><dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><dsig:DigestValue>!REMOVED!</dsig:DigestValue></dsig:Reference></dsig:SignedInfo><dsig:SignatureValue>!REMOVED!</dsig:SignatureValue><dsig:KeyInfo><dsig:KeyName>!REMOVED!</dsig:KeyName><dsig:X509Data><dsig:X509Certificate>!REMOVED!</dsig:X509Certificate></dsig:X509Data><dsig:KeyValue><dsig:RSAKeyValue><dsig:Modulus>!REMOVED!</dsig:Modulus><dsig:Exponent>AQAB</dsig:Exponent></dsig:RSAKeyValue></dsig:KeyValue></dsig:KeyInfo></dsig:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">G-367233d6-89a5-417b-9f1a-a4fa98f04a9c</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2019-10-14T14:07:41.661Z" Recipient="https://signin.aws.amazon.com/saml"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2019-10-14T14:06:41.661Z" NotOnOrAfter="2019-10-14T14:07:41.661Z"><saml:AudienceRestriction><saml:Audience>urn:amazon:webservices</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2019-10-14T14:06:43.661Z" SessionIndex="9909c433-23c8-44c1-a0d2-dbd862289b37::d87788fb-e8d3-4f93-b1f0-c638546a7a8e" SessionNotOnOrAfter="2019-10-15T00:06:43.661Z"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute FriendlyName="Session Name" Name="https://aws.amazon.com/SAML/Attributes/RoleSessionName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">firstname.lastname</saml:AttributeValue></saml:Attribute><saml:Attribute FriendlyName="Session Duration" Name="https://aws.amazon.com/SAML/Attributes/SessionDuration" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">28800</saml:AttributeValue></saml:Attribute><saml:Attribute FriendlyName="Session Role" Name="https://aws.amazon.com/SAML/Attributes/Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">admin</saml:AttributeValue><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">arn:aws:iam::MY_REMOVED_ACCOUNTID:role/AssumeRoleSAML,arn:aws:iam::MY_REMOVED_ACCOUNTID:saml-provider/MYPROVIDER</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>Edited by: Bob The Builder on Oct 17, 2019 4:02 PMFollowComment"

Answer: 0This was solved by attaching the roles to a group which the user is assigned to. Instead of directly attaching the role to the user.CommentShareBob The Builderanswered 4 years ago


Question: Apprunner fails on Health check

"05-19-2022 09:29:04 PM [AppRunner] Health check on port '8080' failed. Service is rolling back. Check your configured port number. For more information, read the application logs.05-19-2022 09:22:49 PM [AppRunner] Performing health check on port '8080'.05-19-2022 09:22:39 PM [AppRunner] Provisioning instances and deploying image.05-19-2022 09:22:27 PM [AppRunner] Successfully pulled image from ECR.05-19-2022 09:19:34 PM [AppRunner] Successfully created pipeline for automatic deployments.05-19-2022 09:19:23 PM [AppRunner] Service status is set to OPERATION_IN_PROGRESS.05-19-2022 09:19:22 PM [AppRunner] Service creation started.I try to setup a new AppRunner service, I use ecr to upload my docker image. on my local pc the docker image is running fine on http://localhost:8080/ but when I try to upload it to AppRunner it always fails. I searched online for a solution but could find something that helped me.Is there ant possibility that the issue is on aws side?FollowCommentiwasa EXPERTa year agoHi, AWS5er.Share your health check configuration.https://docs.aws.amazon.com/apprunner/latest/dg/manage-configure-healthcheck.htmlAnd if possible, can you also share the Docker File?ShareHari 10 months agoHi @AWS5er,Can you please the ARN of this AppRunner service so we can look into this issue? ThanksShare"

Answer: "0@Hari, I ran into this issue as well. I can share my ARN with you but don't want to share it here publicly. How can we exchange that information in a secured way?CommentSharerePost-User-3387005answered 6 months ago"


Question: Which AWS service is best for a proxy http service (architecture strategy)

"Hello all.I have a need for a small service that serves as an intermediate http proxy between my clients (mobile app) and a Database server (outside of AWS - receiving http requests).I can think of a small NodeJS function that accepts the clients' http requests, routs them to the DB server, listens for the response coming back from the DB server and sends it back to the client.The anticipated load is not much at all, maybe 1,000 such requests every day.No need for extraordinary security measures, nor load balancing or multi region CDN's and such.I mostly need this solution to bypass CORS limitation with the target DB service that requires some middle-ware and can't serve my Angular app directly from my dev machine / mobile.There is a secret token to be sent to the target DB server, that can maybe be served from this intermediate proxy service, instead of including it with the client request.I can see multiple possibilities to implement in AWS, differ in price and implementation, and I cannot decide which would serve me best with the minimum costs (if any). Some examples I could think of:AWS API GWAWS API GW + LambdaLambda (is it possible without the API GW service)NodeJS on an EC2AWS Amplify (sounds like an overkill for this usecase?)Amazon LightRail (looks expensive, though?)Please advise on the most suitable service to use, in your mind, that will bear minimum costs and be relatively easy to configure/implement.Thank you!MorFollowCommentAleksandr Iziumov EXPERTa year ago#3: Yes, Lambda with HTTPs endpoints is available: https://aws.amazon.com/blogs/aws/announcing-aws-lambda-function-urls-built-in-https-endpoints-for-single-function-microservices/ShareAleksandr Iziumov EXPERTa year agoIf your DB is "talking" HTTP -> why not to consider CloudFront with DataBase as custom Origin? You could configure whatever CORS you need in CF, and you could add Customer header for Auth on CF as well. In this case CF will be your proxy. No need for Lambdas. If you need some code - you could add L@E for additional logic. I dont think CF here as overkill as CDN - it's just transport you need with some features. CloudFront also have FreeTier: 1 TB of data transfer out10,000,000 HTTP or HTTPS RequestsShare"

Answer: "2Accepted AnswerYour best solution will probably be API Gateway + Lambda functions. At the rate you specified it may even fall within the free tier (API Gateway - 1M free requests/month for the first year, Lambda functions - 1M invocations + 400,000 GBs / month always).CommentShareEXPERTUrianswered a year agomor a year agoThank you, Uri !Share1I would suggest AWS API GW - HTTP Type + Lambda.One more possible approach to add to the above list is, AWS Application Load balancer + Target as Lambda. But as you said that you do not need load balancing I will not recommend this approach. Also, this approach will be a bit expensive when compared with API Gateway + AWS Lambda given that the AWS ALB will cost some $ per hourCommentShareRajasanswered a year agomor a year agoThank you, Rajas!Share"


Question: Post confirmation cognito trigger is not working

I am using the "adminCreateUser" function to create a user and get a temporary password over email. After submitting the password and generating a new password "Post confirmation" lambda should have triggered but it's not getting triggered. I have read this StackOverflow thread and it says in the case of "adminCreateUser" it will not trigger the lambda. Can you please guide the correct solution?FollowComment

Answer: "0Post Confirmation Lambda triggers will only trigger for the following API calls: ConfirmSignUp, AdminConfirmSignUp,ConfirmForgotPassword.[1][1] https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-post-confirmation.html#user-pool-lambda-post-confirmation-flowsCommentShareAWS-User-7083746answered 9 months agorePost-User-0344037 4 months agoThis doesn’t seem to be  a desired behaviour.  Post Confirmation trigger should be invoked when a user is created via AdminCreateUser API as well.Share"


Question: Can't creat cloudfront origin

"Your account must be verified before you can add new CloudFront resources. To verify your account, please contact AWS Support .If i creat cloudfront i see this massage whyFollowCommentMfanelo a year agoHi there Mohamed, I personally value your feedback and would be happy if you could accept my answer if my response worked for you, thank you.Share"

Answer: "1Hello There,I understand that you're unable to launch Cloudfront resource and getting the message: "Your account must be verified before you can add new CloudFront resources. To verify your account, please contact AWS Support"As the error message indicates that your account must be verified to create a CloudFront Distribution, please reach out to AWS support team to get your account verified by following the below steps:Create an issue at Support Center - https://console.aws.amazon.com/support/home/Share the error message in the case.Wait for the service team to get your account verified.I hope the above information is helpful.CommentShareMfaneloanswered a year ago"


Question: Stream not starting when sending OpenVidu rtmp to medialive/mediapackage

"Hello i created a medialive/mediapackage stack using the worflow wizard as an rtmp push to push a stream from an OpenVidu application to the mediapackage channel, but when i start the stream i only get the preview, that one minute video in the mediapackage channel. From the logs of the server is used the following ffmpeg command to send the stream:{  "Image": "openvidu/openvidu-recording:2.26.0",  "name": "broadcast_SessionABC",  "Env": [    "DEBUG_MODE=false",    "CONTAINER_WORKING_MODE=BROADCAST",    "BROADCAST_URL=MEDIA_LIVE_INPUT_URL",    "ONLY_VIDEO=false",    "RESOLUTION=640x360",    "FRAMERATE=30",    "BROADCAST_COMMAND=ffmpeg <./stop -y -progress pipe:1 -f alsa -i pulse -f x11grab -draw_mouse 0 -framerate $FRAMERATE -video_size $RESOLUTION -i :$DISPLAY_NUM -c:a aac -c:v libx264 -preset ultrafast -tune zerolatency -copyts -f flv $BROADCAST_URL"  ],  "HostConfig": {    "AutoRemove": false,    "networkMode": "host",    "Binds": [      "/opt/openvidu/recordings/:/recordings"    ],    "Ulimits": [      {        "Name": "core",        "Soft": -1,        "Hard": -1      }    ],    "RestartPolicy": {      "Name": "no"    }  }}The channel acts as if the rtmp signal never started, but if i send the same signal to Twitch for example it displays normal.This are the medialive channel settings:{  "name": "teste-opv-2",  "inputAttachments": [    {      "inputId": "3280994",      "inputAttachmentName": "teste-opv-2",      "inputSettings": {        "sourceEndBehavior": "CONTINUE",        "inputFilter": "AUTO",        "filterStrength": 1,        "deblockFilter": "DISABLED",        "denoiseFilter": "DISABLED",        "smpte2038DataPreference": "IGNORE",        "audioSelectors": [],        "captionSelectors": []      }    }  ],  "state": "RUNNING",  "pipelinesRunningCount": 1,  "destinations": [    {      "id": "mediapackage-destination",      "settings": [],      "mediaPackageSettings": [        {          "channelId": "teste-opv-2"        }      ]    }  ],  "egressEndpoints": [    {      "sourceIp": "source"    }  ],  "encoderSettings": {    "audioDescriptions": [      {        "codecSettings": {          "aacSettings": {            "inputType": "NORMAL",            "bitrate": 64000,            "codingMode": "CODING_MODE_2_0",            "rawFormat": "NONE",            "spec": "MPEG4",            "profile": "HEV2",            "rateControlMode": "CBR",            "sampleRate": 44100          }        },        "audioTypeControl": "FOLLOW_INPUT",        "languageCodeControl": "USE_CONFIGURED",        "languageCode": "pt",        "name": "audio_2k0ok",        "streamName": "portuguese"      }    ],    "captionDescriptions": [],    "outputGroups": [      {        "outputGroupSettings": {          "mediaPackageGroupSettings": {            "destination": {              "destinationRefId": "mediapackage-destination"            }          }        },        "name": "mediapackage",        "outputs": [          {            "outputSettings": {              "mediaPackageOutputSettings": {}            },            "outputName": "emp_360p30",            "videoDescriptionName": "video_640x360",            "audioDescriptionNames": [              "audio_2k0ok"            ],            "captionDescriptionNames": []          }        ]      }    ],    "timecodeConfig": {      "source": "EMBEDDED"    },    "videoDescriptions": [      {        "codecSettings": {          "h264Settings": {            "afdSignaling": "NONE",            "colorMetadata": "INSERT",            "adaptiveQuantization": "AUTO",            "bitrate": 600000,            "bufSize": 750000,            "bufFillPct": 90,            "entropyEncoding": "CABAC",            "flickerAq": "ENABLED",            "forceFieldPictures": "DISABLED",            "framerateControl": "SPECIFIED",            "framerateNumerator": 25,            "framerateDenominator": 1,            "gopBReference": "ENABLED",            "gopClosedCadence": 1,            "gopNumBFrames": 2,            "gopSize": 1,            "gopSizeUnits": "SECONDS",            "subgopLength": "FIXED",            "scanType": "PROGRESSIVE",            "level": "H264_LEVEL_AUTO",            "lookAheadRateControl": "MEDIUM",            "maxBitrate": 1500000,            "numRefFrames": 3,            "parControl": "SPECIFIED",            "profile": "HIGH",            "rateControlMode": "QVBR",            "qvbrQualityLevel": 7,            "syntax": "DEFAULT",            "sceneChangeDetect": "ENABLED",            "slices": 1,            "spatialAq": "ENABLED",            "temporalAq": "ENABLED",            "timecodeInsertion": "PIC_TIMING_SEI"          }        },        "height": 360,        "name": "video_640x360",        "respondToAfd": "NONE",        "sharpness": 50,        "scalingBehavior": "STRETCH_TO_OUTPUT",        "width": 640      }    ]  },  "inputSpecification": {    "codec": "AVC",    "resolution": "HD",    "maximumBitrate": "MAX_20_MBPS"  },  "logLevel": "DISABLED",  "tags": {    "MediaLive-Workflow": "teste-opv-2",    "MSAM-Diagram": "teste-opv-2",    "aws:cloudformation:stack-name": "teste-opv-2",    "aws:cloudformation:logical-id": "MediaLiveChannel",    "MSAM-Tile": "teste-opv-2",  },  "channelClass": "SINGLE_PIPELINE",  "pipelineDetails": [    {      "pipelineId": "0",      "activeInputAttachmentName": "",      "activeInputSwitchActionName": "",      "activeMotionGraphicsUri": "",      "activeMotionGraphicsActionName": ""    }  ],  "maintenanceWindow": "THURSDAY_0700",  "maintenanceStatus": "",  "maintenance": {    "maintenanceDay": "THURSDAY",    "maintenanceStartTime": "07:00"  }}I would like to know if there are some possible causes to this or if i am configuring the service wrong, thank you.FollowComment"

Answer: "0Once the AWS MediaLive channel has been started, you can view status, Health information and Alerts from the AWS MediaLive channel console.First, confirm that the Pipelines running are green.Next review the Alerts tab to see if there are any indication of input source issues.Then validate in Health tab that the input bitrates are as expected and consistent.Several minutes of running channel will be needed to see proper status.Once the MediaLive channel is determined to be running properly, you can go to the MediaPackage channel in the AWS Console. Select the endpoint your are looking to use (HLS, DASH, CMAF) and copy the CloudFront URL into a player(s) for viewing the stream.The Preview function in MediaPackage may only run for a short time and you should use another player to view the stream.CommentShareMike-MEanswered 2 months ago"


Question: How to associate Web ACL rule to EB/ALB on creation?

"I created a Web ACL rule that allows traffic to two exact URI paths and blocks everything else. I am able to manually associate it to my Application Load Balancer, but when I terminate my Elastic Beanstalk environment (which the Application Load Balancer is a part of) and recreate the Elastic Beanstalk environment the rule is not associated with the new Application Load Balancer that is created.Is there a way to configure it so that my Web ACL rule is associated with the Application Load Balancer with the Elastic Beanstalk environment is created?FollowComment"

Answer: "0This sounds like a good fit for Firewall Manager: https://aws.amazon.com/firewall-manager/ - it does require that you are using AWS Organizations and AWS Config, but it is possible to enable these even if you only have a single account. Firewall Manager can automatically associate a WAF WebACL with newly created resources.CommentSharePaul_Lanswered a year agoJeff a year agoI was hoping there was a way to do it in the Elastic Beanstalk config. Spending $100 a month to use Firewall Manager isn't an option for me.SharePaul_L a year agoIn that case, could you use Eventbridge to trigger a Lambda function, which associate the WebACL with your ALB? You should be able to do this once the Create operation is complete in Elastic Beanstalk: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.eventbridge.htmlShare"


Question: MySQL Master Long Running `set @slave_uuid = ?`

"My MySQL master DB is replicating to my slave just fine, but I have a long running query that does not go away after a reboot:set @slave_uuid = ?My show processlist doesn't have anything suspicious or long running, so I don't know where this is coming from.Curiously, my show slave status query returns an empty list. Not sure why it wouldn't show the slave that's configured already.Anyone have any ideas or areas I could poke on to help figure this out? I'm puzzled.Thanks!FollowComment"

Answer: "0Probably related and what I'm currently investigating, the top wait is:wait/synch/cond/sql/MYSQL_BIN_LOG::update_condAgain, all related to master/slave, but still not sure what's causing this or how to clear it.CommentSharemressleranswered 3 years ago0Greetings,This may be related to a bug in MySQL Performance Schema [1] if you are using any of the following MySQL versions:=>5.6.46=>5.7.28=>8.0.18It's not really a long running query, just a misrepresentation on the PI dashboard as the query is not actually executing or consuming any resources. Since, Performance Insights is capturing thread information from "performance_schema.threads", the PI console displays this query "SET @slave_uuid= ?" as being executed and consuming resources on the instance.It doesn't really affect instance performance and is safe to be ignored. If you wish to remove it, take logical dump of the database and restore it to an RDS MySQL version not mentioned in the above list.[1] PSI thread info not getting updated after statement execution - https://bugs.mysql.com/bug.php?id=99039Hope this helps!DhanrajEdited by: DhanrajAtAWS on Oct 23, 2020 10:47 AMCommentShareAWS-User-4079358answered 3 years ago"


Question: Lex Error message "There is no alias named "

"Hello,I'm trying to use postman to try out my LexBot. Ive followed this https://tutorials.botsfloor.com/test-an-amazon-lex-chatbot-using-a-rest-client-postman-c2d9ce81dcad which connects straight to the bot via the rest API but I keep getting the below error.Ive tried the Bot name and ID and the Alias name and ID and a combination of them. The alias and bot are associated correctly (as far as i can tell).Has anyone seen this before? Im sure im doing something wrong and its probably very basic."message": "There is no alias named MyBotName for the bot named myMyAlias. Choose another alias."FollowComment"

Answer: "1Accepted AnswerDid you build the Lex v2 bot? If so, you need to use the Lex v2 API endpoint. The documentation you referred to is a bit old and uses the v1 endpoint. I recommend trying out the v2 API endpoint and see if you still have the same issue.Amazon Lex endpoints and quotasAmazon Lex V2 API ReferenceCommentShareTaka_Manswered 7 months agoEXPERTAWS-samfredreviewed 2 months ago0Thank you Taka_M. Yup, that was my issue.Also, for anyone else reading this I struggled a little to find the new endpoint URL, depending your region you will find it https://docs.aws.amazon.com/general/latest/gr/lex.html.However, I have hit an issue where in v2 the SessionID is required. Is there a way to generate a SessionID in Postman?CommentSharedowen93to98answered 7 months agoTaka_M 7 months agoYou will need to supply the sessionId on your own. You can use an id like test just for testing purpose. For your application, you can generate a random ID using a uuid package, etc.Length Constraints: Minimum length of 2. Maximum length of 100.https://docs.aws.amazon.com/lexv2/latest/APIReference/API_runtime_PutSession.html#API_runtime_PutSession_RequestParametersShare0Thanks Taka, am hitting the below issue now. from my post call, https://runtime-v2-lex.us-east-1.amazonaws.com/bots/botID/botAliases/botAliasID/botLocales/en_GB/sessions/test{"message": "The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details."}CommentSharedowen93to98answered 7 months ago0I managed to get this working.The error i was getting around the signature was due to my access key. You need to use user who has 'AmazonLexReadOnly' & 'AmazonLexRunBotsOnly' permissions.CommentSharedowen93to98answered 6 months ago0hello @dowen93to98 I had a similar issues, but I got this error:{    "message": "Credential should be scoped to correct service: 'lex'. "}How did you give access? I'm kinda new in AWS i read a lot and I can't figure out what's going on, i did the following:Create a CLI aws account (test user)I added the permissions: AmazonLexReadOnly and AmazonLexRunBotsOnly I even added another that I read in another website ( I Created a new policy) with this json:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "lex:GetSession",                "lex:RecognizeText",                "lex:PutSession",                "lex:DeleteSession",                "lex:StartConversation",                "lex:RecognizeUtterance"            ],            "Resource": "*"        }    ]}I created an access api key/secret keyAdded to postman as AWS identification and hitting this urlhttps://runtime-v2-lex.us-east-1.amazonaws.com/bots/KVI5WI1AAA/botAliases/UZA1JMDAAA/botLocales/en_US/sessions/random/text (the last letters I replaced with AAA just to hide the complete url and check if is the name or the ID)I got the botId from lex website, the alias I think is the correct (same from lex but I'm not sure if is the name or this ID), the (access key 1 is the one I'm using, and says Access key last usedNeverI can't figure out what's wrong, I tried to read a lot of tutorials but I have no luck, could you please help me out and telling me how I can setup the user? ThanksCommentShareAutoZenanswered 2 months ago"


Question: aws iot core thing provisioning

"I have a certificate generated by AWS IoT Core. I have a thing group created by AWS IoT Core.Certificates and thing groups are linked. A policy is also configured. However, the thing is not registered.I pass the certificate generated by AWS IoT Core to the device developer. Is there a way for device developers to register things in AWS IoT Core through the passed certificate?If I create only thing groups and certificates without registering things, I hope the thing requested by the device developer to be registered is included in the thing group. Is there any way to register things like this?thank youFollowComment"

Answer: "1Hi. This page of the device provisioning whitepaper covers your options: https://docs.aws.amazon.com/whitepapers/latest/device-manufacturing-provisioning/provisioning-identity-in-aws-iot-core-for-device-connections.htmlMore information here: https://docs.aws.amazon.com/iot/latest/developerguide/iot-provision.htmlIs there a way for device developers to register things in AWS IoT Core through the passed certificate?JITP/JITR is kind of a fit, but you need your own CA. The device certificate is registered (and the Thing is created) in IoT Core when the device connects the first time.CommentShareEXPERTGreg_Banswered a month ago"


Question: Iot Core -> SiteWise ingestion question

"I have some messages that look like this:{  "measurement":"observation",  "timestamp":"2022-03-08T18:04:48.389Z",  "fields": {     "rms0": 0.22936178743839264,     "max0": 0.22936178743839264,     "rms1": 0.2076568752527237,     "max1": 0.2076568752527237,     "rms2": 0.20974993705749512,     "max2": 0.20974993705749512  },  "tags": {     "bucket":"powermon",     "address":"CA64"  }}Using basic ingestion, I'm sending them to this topic:$aws/rules/PowerMonRuleI added three actions to that rule.  One was to write the message to CloudWatch Logs for both the normal and the error condition.  The second rule attempts to write that data to SiteWise.  This is where I'm having a problem.  No data ever actually shows up, and I'm not quite sure how to figure out why.   What I'm logging now is what comes out of the rule; is there some way to log what happens when it goes into SiteWise so I can figure out what SiteWise is doing with the data?My timestamp is in an ISO style format so for every property that I write I repeat the conversion.   I tested this by writing an IoT Rule that writes to Timestream and that worked correctly, so I think it should work here.  For the same reason I think select * then referring to the values as ${fields.rms0} should work OK.My model has these measurements:        {            "id": "5fd1be48-f8ab-44a1-9d93-2c8102f80e02",            "name": "Irms0",            "dataType": "DOUBLE",            "unit": "Amp",            "type": {                "measurement": {}            }        },        {            "id": "085dfa46-3b8a-47a2-b325-1d211b33a6f4",            "name": "Irms1",            "dataType": "DOUBLE",            "unit": "Amp",            "type": {                "measurement": {}            }        },        {            "id": "1ec8a6c6-a9cc-4bde-9ae5-4394b09914c8",            "name": "Irms2",            "dataType": "DOUBLE",            "unit": "Amp",            "type": {                "measurement": {}            }        }so what I did was set up an alarm rule with this action (see below).  What it does is to take the message (the rule is just SELECT *) and pull out the three fields, which are stored in attributes with IDs matching the above.  For now, the rule is set up to write to a specific, hard-coded asset ID, and the property IDs pulled from the model.{  "iotSiteWise": {    "putAssetPropertyValueEntries": [      {        "assetId": "e6739e7d-248e-47cd-ba53-bf369126d482",        "propertyId": "5fd1be48-f8ab-44a1-9d93-2c8102f80e02",        "propertyValues": [          {            "value": {              "doubleValue": "${fields.rms0}"            },            "timestamp": {              "timeInSeconds": "${time_to_epoch(ts,\"yyyy-MM-dd'T'HH:mm:ss.SSS'Z'\")}"            }          }        ]      },      {        "assetId": "e6739e7d-248e-47cd-ba53-bf369126d482",        "propertyId": "085dfa46-3b8a-47a2-b325-1d211b33a6f4",        "propertyValues": [          {            "value": {              "doubleValue": "${fields.rms1}"            },            "timestamp": {              "timeInSeconds": "${time_to_epoch(ts,\"yyyy-MM-dd'T'HH:mm:ss.SSS'Z'\")}"            }          }        ]      },      {        "assetId": "e6739e7d-248e-47cd-ba53-bf369126d482",        "propertyId": "1ec8a6c6-a9cc-4bde-9ae5-4394b09914c8",        "propertyValues": [          {            "value": {              "doubleValue": "${fields.rms2}"            },            "timestamp": {              "timeInSeconds": "${time_to_epoch(ts,\"yyyy-MM-dd'T'HH:mm:ss.SSS'Z'\")}"            }          }        ]      }    ]  }}FollowComment"

Answer: "1Accepted AnswerWhat I'm logging now is what comes out of the rule; is there some way to log what happens when it goes into SiteWise so I can figure out what SiteWise is doing with the data?I'm unclear on this part. Have you enabled IoT logging?https://docs.aws.amazon.com/iot/latest/developerguide/configure-logging.htmlIf you haven't, enabling this will give you a new AWSIotLogsV2 log group in CloudWatch. This will log many IoT event types, including rule executions (and failures on any rule actions): https://docs.aws.amazon.com/iot/latest/developerguide/cwl-format.html#rule-engine-logsCommentShareEXPERTGreg_Banswered a year agowz2b a year agoahhhhhh so I was looking for the logs in the wrong log group!!!It doesn't like this:    "logLevel": "ERROR",    "status": "Failure",    "eventType": "RuleExecution",    "ruleAction": "FunctionEval",    "resources": {        "FunctionName": "time_to_epoch"    },Sharewz2b a year agoI feel like I"m very close to this working.{    "logLevel": "INFO",    "traceId": "d4c13dc1-79c9-6da1-66aa-0db7a43b8312",    "status": "Success",    "eventType": "RuleExecution",    "clientId": "bay1",    "topicName": "$aws/rules/PowerMonRule",    "ruleName": "PowerMonRule",    "ruleAction": "IotSiteWiseAction",    "resources": {},    "details": "No requests were sent. PutAssetPropertyValueEntries was empty after performing substitution templates. Message arrived on: , Action: iotSiteWise"}Share"


Question: Default name server

HelloI had a working dns with emails for zoho mail etc decided to use lightsail to make a wordpress blog and changed the registry ns to lightsail but then realised it doesn't support all the record types I need. Didn't record the original r53 ns and now nothing works.FollowComment

Answer: "0I'm an idiot.Saved all the records, deleted the hosted zone then recreated the hosted zone for the domain and imported the records I backed up above.Lowered the tll then after it refreshed to the desired / correct record and then increased to 2dEdited by: vincentdoe on Dec 11, 2020 10:40 PMCommentSharevincentdoeanswered 2 years ago"