Question: How to stop being charged for Amazon Relational Database Service

Hey AWS community!I keep getting charged for these services:$ 1.17 per RDS db.m5d.xlarge Multi-AZ (two readable standbys) instance hour (or partial hour) running PostgreSQL$ 0.3 per IOPS-month of Multi-AZ Provisioned IOPS running PostgreSQL$ 0.375 per GB-month of Multi-AZ Provisioned IOPS Storage running PostgreSQLThis is the breakdown of Cost explorer:I don't have any database running or snapshots:The only weird thing I see is that there's still an Option Group and Parameter group that I can't delete (my guess is because I deleted the DB that was associated to it)Any advice on how to stop being charged for these services that I'm not using?Thanks in advance for your help!FollowComment

Answer: "0The charges you have there are only a partial month of usage, so something was spun up and spun down like you mentioned and therefore you were billed for that time period of usage. 156hrs of the instances is a little over 4.5days of them running (Which aligns with your Cost Explorer view May6th-10th). You should not be charged any longer after the instance and all associated resources were deleted from the account.If you continue to see charges, open a support case for billing to get them to assist.CommentShareEXPERTRob_Hanswered 20 days agorePost-User-6894653 20 days agoThanks Rob! I had all my instances deleted 2 days ago and during that night I got charged, I definitely need to open a ticket.Also, Do you know how to delete the Option Group and Parameter group since all the DB are deleted? I keep getting an error when I try to delete themShare-1Based on the information you provided, it appears that these charges are related torunning a PostgreSQL database on Amazon Web Services (AWS) using Multi-AZ (multiple availability zones) and Provisioned IOPS (input/output operations per second) storage.The first charge of $1.17 per hour is for running an RDS db.m5d.xlarge instance with Multi-AZ, which provides high availability and automatic failover in case of a hardware or software failure. This charge is calculated per hour or partial hour that the instance is running.The second charge of $0.3 per IOPS-month is for the number of input/output operations per second provisioned for the Multi-AZ instance running PostgreSQL. This charge is calculated per month based on the number of IOPS provisioned.The third charge of $0.375 per GB-month is for the amount of Provisioned IOPS storage used by the Multi-AZ instance running PostgreSQL. This charge is calculated per month based on the amount of storage provisioned.To rectify these charges, you can review your AWS usage :You are checking in US East (Ohio) Region for resources - Please change the region to US East (Northern Virginia) region to check for active RDS Resources.To terminate an RDS resource, you can follow these steps (In US East (Virgina) region as well as the ohio region - if you dont want the resources anymore:Open the Amazon RDS console at https://console.aws.amazon.com/rds/.In the navigation pane, choose Databases.Select the RDS instance that you want to terminate.Choose Actions, and then choose Delete.In the Delete DB instance confirmation box, choose Delete.Note that when you delete an RDS instance, all automated backups, manual snapshots, and read replicas are also deleted. If you want to keep any of these resources, you should create a manual snapshot before deleting the RDS instance.To list all the RDS resources in one place, you can use the AWS Command Line Interface (CLI) or the AWS Management Console.Using the AWS CLI, you can run the following command to list all RDS instances in your account:aws rds describe-db-instances``This command returns a list of all RDS instances in your account, along with their details such as instance identifier, engine type, status, and endpoint.Using the AWS Management Console, you can navigate to the RDS dashboard and view a list of all your RDS instances. From there, you can also view details about each instance, such as its status, engine type, and endpoint.Hope this helps.CommentShareNithin Chandran Ranswered 20 days agorePost-User-6894653 20 days agoPlease notice that I shared an image showing that there are no DBs or Snapshots. Also, I know why I got charged, we created DBs with deployment options as Multi-AZ DB Cluster. There were 7 DB created under 2 clusters and 1 independant and all those were deleted after few hours. I keep getting charged for Multi-AZ Provisioned storage with Postgres but there are no DBs or Snapshots or anything running. I usted the CloudShell to list DBs but it didn't find anything.Share"


Question: Configure CMSInitiatingOccupancyFraction value for Elasticsearch service

ElasticSearch Service have a useful metric JVM memory pressure that specifies the percentage of the Java heap occupied in a cluster node. CMSInitiatingOccupancyFraction is the threshold value on which Garbage collection activity starts to clean deleted items from ES node memory to reduce JVM Memory pressure.  refer article for more informationOur application have clean up tasks executed on weekly basis and we are exploring options to lower down CMSInitiatingOccupancyFraction (which is by default set to 75%) value. As cleanup tasks gets executed we are thinking of setting this threshold to 65-70%. We didn't found any configuration options to fix this value. Is there any other mechanism to activate Garbage collector?Does AWS Elastic search service provide options to configure these default values? If yes then guide us through steps.FollowComment


Question: "IAM policy for specific user on r,w,e permissions of a specific environment"

"I have 3 environment dev stage and prod.I want a specific user policy which gives a user permission to env like this below.dev- read onlyStage- read writeProd -r,wFollowComment"

Answer: "0You can create IAM roles and when user groups.User groups will act as parents while the users that you add in the user groups would act like child.User groups will have IAM role associate to it and the same role would be applied to the user present in the user groupsFor Example,User X - Belongs to Dev EnvironmentUser Y - Belongs to Stage EnvironmentUser Z - Belongs to Prod EnvironmentUser X can be in a User Group Dev which has IAM role READ ONLYUser Y can be in a User Group Stage which has IAM role READ and WRITE ONLYUser Z can be in a User Group Prod which has IAM role READ and WRITE ONLYYou can even allow different perimeter role policies for an example, user x present in the group dev environment can read all the resources but not the S3 resources or user y present in the group stage environment can read/write all the resources but cannot write the resources in the S3 bucket.AWS has very well architected the IAM roles and permissions, would be good to understand if my explanation helps you.Let me know in case you have any other questions.CommentSharehimanshustallongmailcomanswered 13 days ago"


Question: DataBrew recipe job fails on file with single record

"Hi,I have noticed that when running the DataBrew recipe job for data masking, the job is failing when the parquet file has a single record in it.The error is following:"Exception: Error: Unable to detect MIME type for file"FollowComment"

Answer: "0This error message indicates that DataBrew is having trouble determining the file format of the input data when the file contains only a single record. This is likely due to the fact that some file formats rely on having a certain number of records present in order to determine the file format.One potential workaround for this issue would be to add a dummy record to the file so that it contains more than one record. This should allow DataBrew to properly detect the file format and run the recipe job successfully.Another option would be to change the file format to a format that is more resilient to single-record files, such as CSV or JSON. This would require converting the input data to the new format before running the DataBrew job.If neither of these options are feasible, you may need to reach out to AWS Support for further assistance in troubleshooting this issue. They may be able to provide more information about the specific cause of the issue and potential solutions.CommentShareAWS-User-6509414answered 3 months ago"


Question: expose ec2 public IP over VPN

"I want to expose the public IP of my ec2 over VPN, I already have a NAT instance that is reachable over VPN with elastic IP below my routes :TGW routes table1.2.3.4/32 -> VPC attachment,5.6.7.8/32-> VPC attachment.public route table1.2.3.4/32 -> eni-nat,5.6.7.8/32 -> eni-instance.Private subnet route table10.0.0.0/16->local,0.0.0.0/0 ->eni-nat.When I try to ping the nat elastic IP it works, but the elastic IP of the instance is not workingFollowComment"

Answer: "0No, you can't do that because the Elastic IP is not directly "attached" to the instance. The instance only "knows" about its private IP address, not the Elastic IP.You could potentially get this working by doing some really interesting iptables work on the instance but it would be super complex because you wouldn't want outbound traffic to use the public IP directly from the instance except when replying to traffic that is going out the VPN - so you'd need some way to identify that. In short, I wouldn't do this.CommentShareEXPERTBrettski-AWSanswered a year agoAWS-User-9309468 a year agoThank you for your reply, that is mean that I can not use public IP for VPN, because our third-party provider wants us to use only public IP and the connection (to our web server) should be done by VPN only. can please advise the best way to achieve that?Share"


Question: Is it possible to pass headers in Nodejs Lambda API

"Hi,I have created a Nodejs Lambda, which require header parameters. Lambda deployed by the 'serverless.yml' file and corresponding API Gateway created for all APIs with lambda proxy integration. When I execute those APIs with headers parameters it throws CORS error like this,Request header field 'abc' is not allowed by Access-Control-Allow-Headers in preflight responseI have given 'Allow Headers' in entry component.app.use(function (req, res, next) {res.header("Access-Control-Allow-Origin", "*");res.header("Access-Control-Allow-Methods", "GET,HEAD,OPTIONS,POST,PUT,DELETE");res.header("Access-Control-Allow-Headers", "Content-Type");next();});Is there any solution to pass headers ?FollowComment"

Answer: "0Please take a look at this troubleshooting guide to see if any of these reasons are responsible - https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-cors-errors/Have you configured CORS on your API Gateway API?CommentShareEXPERTIndranil Banerjee AWSanswered a year agoIndranil Banerjee AWS EXPERTa year agoTake a look at this - https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-cors.htmlShareAWS-User-9476241 a year agoYes, I have configured .The problem is solved. I gave  Access-Control-Allow-Headers as '*' in API Gateway CORS. Then it works.Share"


Question: Query JSON files from S3 with Athena

"Hello,Can someone please help?I set up a trail to audit all TLS calls in the account and saved all logs in S3. I tried to query the logs from S3 with Athena. This is the query I created:CREATE EXTERNAL TABLE cloudtrail_logs_tls_calls (    eventVersion STRING,    userIdentity STRUCT<        type: STRING,        principalId: STRING,        arn: STRING,        accountId: STRING,        accessKeyId: STRING,        sessionContext: STRUCT<            sessionIssuer: STRUCT<                type: STRING,                principalId: STRING,                arn: STRING,                accountId: STRING,                userName: STRING>>>,    eventTime STRING,    eventSource STRING,    eventName STRING,    awsRegion STRING,    sourceIpAddress STRING,    userAgent STRING,    requestParameters STRUCT<maxResults: STRING>,    responseElements STRING,    requestId STRING,    eventId STRING,    eventType STRING,    managementEvent STRING,    recipientAccountId STRING,    eventCategory STRING,    tlsDetails STRUCT<        tlsVersion: STRING,        cipherSuite: STRING,        clientProvidedHostHeader: STRING>)COMMENT 'CloudTrail table for <bucket_name> bucket'ROW FORMAT SERDE 'com.amazon.emr.hive.serde.CloudTrailSerde'STORED AS INPUTFORMAT 'com.amazon.emr.cloudtrail.CloudTrailInputFormat'OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'LOCATION 's3://<bucket_name>/AWSLogs/<Acccount_Number>/CloudTrail/'TBLPROPERTIES ('classification'='cloudtrail');Then, when preview the table. I get this error:Thank you in advance for help,FollowComment"

Answer: "2Accepted AnswerAmazon Athena lets you parse JSON-encoded values, extract data from JSON, search for values, and find length and size of JSON arrays.You get this error if you used an incorrect SerDe during table definition. For example, the table might be using a JSON SerDe, and the source data includes Parquet objects. [1]https://aws.amazon.com/premiumsupport/knowledge-center/athena-hive-cursor-error -- [1]To resolve this error, check the source data and confirm that the correct SerDe is used. For more information, see Supported SerDes and data formats [2]Link- https://docs.aws.amazon.com/athena/latest/ug/supported-serdes.html -- [2]CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months agoEXPERTFabrizio@AWSreviewed 9 months ago1Hi,Thanks for response.I changed the ROW FORMAT serde  to 'org.openx.data.jsonserde.JsonSerDe'. Now I am getting the information I need.Really appreciate your help.CommentSharerePost-User-5974005answered 9 months ago1No problem. Happy to help. :)CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months ago0Hi ThereIn addition to the above answer, are you able to see TLSDetails in Athena?  Take a look at this blog post which mentions that TLSDetails isn't yet supported in Athena.Amazon Athena: You can query AWS CloudTrail logs in Amazon Athena, and we will be adding support for querying the TLS values in your CloudTrail logs in the coming months. Look for updates and announcements about this in future AWS Security Blog posts.https://aws.amazon.com/blogs/security/tls-1-2-required-for-aws-endpoints/One recommendation is to use AWS CloudTrail Lake: You can follow the steps, and use the sample TLS query, in the blog post Using AWS CloudTrail Lake to identify older TLS connections. There is also a built-in sample CloudTrail TLS query available in the AWS CloudTrail Lake console.CommentShareEXPERTMatt-Banswered 9 months ago"


Question: Problems with CORS when creating Creating API's from CloudFormation / SAM

"I have a lambda that looks up a DynamoDB table and returns a lists based on a value that is posted it.   It is quite simple but i've run into a problem with CORS and im not sure how to fix it. I'd ideally like to be able to configure in the CF / SAM templates and just deploy it..  But i'm not sure what is stopping this from working.The lambda is looks like thisimport jsonimport boto3from boto3.dynamodb.conditions import Key, Attrfrom botocore.exceptions import ClientErrordef lambda_handler(event, context):    dynamodb = boto3.resource("dynamodb")    table = dynamodb.Table('learning-values')    _class = "widgets"      body = json.loads(event['body'])    _subclass = body['widget']    try:        response = table.get_item(            Key={                'class': _class,                'subclass': _subclass                }        )    except ClientError as e:        print(e.response['Error']['Message'])    else:        item = response['Item']['data']['options']        return {            "statusCode": 200,            "headers":                     {                        "Access-Control-Allow-Origin": "*",                        "Access-Control-Allow-Headers": "Content-Type",                        "Access-Control-Allow-Methods": "OPTIONS,POST,GET"                    },            "body": json.dumps(                        {                        "message": itemI used Cloudformation to deploy the API.   it creates it, and i'm able to post a value to it and get the expected list back.  I have tested it using this small piece of python.import requests, json, sys, base64url = 'https://0r746huw6b.execute-api.ap-southeast-2.amazonaws.com/prod/widget' # learn11widget = sys.argv[1]payload = {"widget": widget}header = {"Content-type": "application/json"}r = requests.post(url, data=json.dumps(payload))#, headers=header)items = r.json()['message']print(items)The response I get is like thisZ:\sam\learning\sandbox\widget>py testmessage.py shape['round', 'square', 'triangle', 'diamond']Z:\sam\learning\sandbox\widget>py testmessage.py smell['fowl', 'stinky', 'nothing', 'fresh-linen', 'vanilla', 'tropical', 'cut-grass']Z:\sam\learning\sandbox\widget>py testmessage.py colours['red', 'green', 'blue', 'yellow', 'grey', 'black', 'white']When i attempt to get that same data from javascript using this html. ( either hosted on S3, or locally) I get CORS errors in the browser.widget.html:1 Access to XMLHttpRequest at 'https://0r746huw6b.execute-api.ap-southeast-2.amazonaws.com/prod/widget' from origin 'null' has been blocked by CORS policy: Request header field content-type is not allowed by Access-Control-Allow-Headers in preflight response.<!DOCTYPE html>
Get Colours

{{message}}

The template i am using to deploy from is relatively simple.AWSTemplateFormatVersion: '2010-09-09'Transform: AWS::Serverless-2016-10-31Description: '  Sample SAM Template for learning  'Globals:  Function:    Timeout: 3  Api:    EndpointConfiguration: REGIONAL    Cors: '''*'''Resources:  LearningAPI:    Type: AWS::Serverless::Api    Properties:      StageName: prod  LearningFunction3:    Type: AWS::Serverless::Function    Properties:      CodeUri: s3://XXXXXXX-lambda-packages/0ab6dbfb0a46f18f11e43af73ee5d578      Handler: app.lambda_handler      Runtime: python3.7      Events:        Learning:          Type: Api          Properties:            Path: /widget            Method: post            RestApiId:              Ref: LearningAPIFollowComment"

Answer: 0My Cors configuration was incomplete.  now resolved.Globals:Function:Timeout: 3Api:EndpointConfiguration: REGIONALCors:AllowMethods: "''"AllowHeaders: "'Content-Type'"AllowOrigin: "''"CommentSharemrpacketheadanswered 4 years ago


Question: Connecting to Ubuntu EC2 Instance Timed Out

"Hi there, I started an instance of Ubuntu EC2. I initially connect it via EC2 Instance Connect and installed Nginx into it. Then I change the security groups and created a new one. Inside it I allowed ;All traffic from IPv4,All traffic from IPv6 ,SSH from port 22 for IPv4,SSH from port 22 for IPv6,as both inbound and outbound rules.After that I was convenient to visit my public IP address from my browser by going to http://MY_PUBLIC_IP_ADDRESS and I can see the Nginx screen. Everything was okay. Then, I checked my all subnets and route tables. All of them has 0.0.0.0/0 as destination and an Internet Gateway as target.Then I go to my Network ACLs and allowed the SSH from port 22 and SSH from ports between 1024 - 65535 for both inbound and outbound rules.Then I installed OpenSSHServer package to my Windows laptop and started it. Closed the firewall...However, when I try to use Putty for SSH connection I get connection timed out. When I try to connect with SSH Client, it timed outs too.I tried with different internet connection too, nothing changed.I'm really freaked out and really don't know what to do. So please help me...FollowComment"

Answer: "0Hi, you said you could initially connect via EC2 Instance Connect.  Can you still do this from the AWS console?If you're not able to connect at all have you tried using Session Manager?Have you tried using a key pair to connect with SSH?Have you tried opening up your NACLs again temporarily to diagnose which changes are causing you trouble?  For just SSH purposes you should only need port 22 inbound and ports 1024-65535 outbound.  Your Security Group should only need port 22 inbound, nothing outbound as it's stateful.CommentShareEXPERTskinsmananswered 4 months agoutkuonursahin 4 months agoHi, thanks for your answer.No, I can't connect via EC2 Instance Connect anymore.Session Manager gives warning: The required IAM instance profile isn't attached to the instance. You can attach a profile using AWS Systems Manager Quick Setup.Yes, I'm trying to connect via my converted-key.ppk file.With your said, I changed my NACLs as SSH 22 for inbound and 1024-65535 for outbound only. And set to my security group just SSH 22 inbound and deleted all outbound rules.Unfortunately, nothing changed.Share0I would try getting back to a known-good state, undoing everything you've done since last being able to connect via EC2 Instance Connect.Also try creating another temporary EC2 instance in a different subnet with a different NACL that's fully open, and a new different Security Group with all inbound open, and verify you can connect to it.  Then bit by bit make this more like your original instance until you find what breaks it.CommentShareEXPERTskinsmananswered 4 months ago"


Question: Please provide amazon connect daily actual pricing as per my use case

"Use Case“An end customer call using an Amazon Connect Italian direct inward dial (DID) number in the EU (Frankfurt) region, answered by an agent on the Amazon Connect softphone.The call lasts five minutes.”i calculated pricing considering inbound call are originated from Italy ( where DID is registered)need to know if i calculated correct pricing per day as per usage in attached file.I need to know what all pricing will add or what pricing modification will be applied if inbound calls comes from USA or India or any other country. ( consider that DID belong to italy)FollowComment"

Answer: "0Hi,I suggest reaching out to our Account & Billing team directly: go.aws/support-center. They have the tools and resources to assist you.I also found this information on Amazon Connect pricing that may help: https://aws.amazon.com/connect/pricing/.Sage A.CommentShareEXPERTAWS Support - Sageanswered 2 months ago0Hi ,Total charge per month = 22.80$ ( month =30 days )Total charges per year = 273.60$ ( Year = 22.80*12 )Total charge per day = 0.76$Best Regards,Ramy HusseinCommentShareRamyHanswered 2 months ago"


Question: Certificate Validation LighSail

"Hi,Editing my question.On LightSail I created a certificate and got two values to be configured as a CNAME for validation. I have a public hosted zone on Amazon Route53 (public domain). Now my question is do I need to create a hosted a DNS zone with the same domain name that is hosted on Route53 and create the CNAME records there on LightSail or do I create the CNAME records on Route53 or on both?* The problem I am getting is the progress is stuck on "validating...."Any suggestions please?Thank you.-----------------------------------------------------------------The SSL certificate validation is taking ages on Validating state I am using Lightsail and I have done the below configurations.I configured  wp-config.php file correctly to use https. This is the running configurationdefine('WP_SITEURL', 'https://' . $_SERVER['HTTP_HOST'] . '/');define('WP_HOME', 'https://' . $_SERVER['HTTP_HOST'] . '/');if (isset($_SERVER['HTTP_CLOUDFRONT_FORWARDED_PROTO'])&& $_SERVER['HTTP_CLOUDFRONT_FORWARDED_PROTO'] === 'https') {$_SERVER['HTTPS'] = 'on';I have a domain hosted on Route53 and I created a CNAME for both (abc.com and www.abc.com)But the SSL still not validated now its more than 12 hours.Any ideas?Thanks.FollowComment"


Question: "I added A and AAA record from AWS Lightsail on Cloudflare, how do I get Wordpress running on Lightsail?"

"After adding A and AAA record from AWS Lightsail on Cloudflare, what else do I need to do to get my Wordpress site running on AWS Lightsail?FollowComment"

Answer: "1Accepted AnswerIf you've already launched a Lightsail instance running WordPress, refer to this guide for assistance: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/getting-started-with-wordpress-and-lightsail. Replace the <PublicIP> mentioned in the guide with your domain name.If you're starting from scratch, or if you would like to learn more details configuring DNS, I would highly recommend consulting the following resource: https://aws.amazon.com/getting-started/hands-on/launch-a-wordpress-website/CommentShareweidianswered a month ago"


Question: [Announcement] Amazon Redshift Maintenance (March 3rd 2022 - April 5th 2022)

"Major Version (03/03/2022)We will be patching your Amazon Redshift clusters during your system maintenance window in the coming weeks. The timing of the patch will depend on your region and maintenance window settings. You can view or change your maintenance window settings from the AWS Management Console. After your cluster has been patched, the new cluster version will be Build 1.0.36236. Please contact us at redshift-feedback@amazon.com if you have any questions.This version includes the following new features and improvements:• Amazon Redshift: Copy query now supports an IGNOREALLERRORS keyword. This will ignore all the errors encountered while scanning and parsing the records in COPY query.• Amazon Redshift: Customers are now able to leverage Azure Active Directory natively to manage their Redshift identities and simplify authorization based on their Azure Active Directory group memberships.• Amazon Redshift: Role-based access control is now supported in Redshift. Customer can create roles, grant privileges to roles and grant roles to database users.Additionally, the following fixes are included:• Fixes an issue that causes some data sharing queries being stuck when running on Concurrency Scaling clusters.(03/15/2022)We will be patching your Amazon Redshift clusters during your system maintenance window in the coming weeks. The timing of the patch will depend on your region and maintenance window settings. You can view or change your maintenance window settings from the AWS Management Console. After your cluster has been patched, the new cluster version will be Build 1.0.36433. Please contact us at redshift-feedback@amazon.com if you have any questions.This version includes the following new features and improvements in addition to what is available in the major version:• Miscellaneous fixes(03/25/2022)We will be patching your Amazon Redshift clusters during your system maintenance window in the coming weeks. The timing of the patch will depend on your region and maintenance window settings. You can view or change your maintenance window settings from the AWS Management Console. After your cluster has been patched, the new cluster version will be Build 1.0.36926. Please contact us at redshift-feedback@amazon.com if you have any questions.This version includes the following new features and improvements in addition to what is available in the major version:• Miscellaneous fixes(04/04/2022)We will be patching your Amazon Redshift clusters during your system maintenance window in the coming weeks. The timing of the patch will depend on your region and maintenance window settings. You can view or change your maintenance window settings from the AWS Management Console. After your cluster has been patched, the new cluster version will be Build 1.0.37176. Please contact us at redshift-feedback@amazon.com if you have any questions.This version includes the following new features and improvements in addition to what is available in the major version:• Miscellaneous fixesFollowCommentSrikanth_N SUPPORT ENGINEERa year agoThis is an announcement migrated from AWS Forums that does not require an answer.Share"


Question: sending data from Cloudwatch 1 log stream of 20 to Firehose

"Hi.I want to send data from a cloudwatch logstream of a log group that posses 20 different log streams. The idea is to only send the data from that specific log stream and not the whole log group, but the I can only make a subscription to the whole log group. How can I separate it?FollowComment"

Answer: "1Hello,The Kinesis Firehose Subscription Filters are created to filter the incoming log events that are applied on the entire log group and not on per log stream basis. Unfortunately, this subscription filtering is currently restricted to per log group level. [1]In order to achieve your use-case to forward log events only from a specific log stream to a destination, I suggest you using a lambda function or writing a script that runs the command get_log_events[2] every 5 minutes. Through the Getlogevents CLI command, you can obtain the logs of a specific log stream and then push these logs to the firehose using the script. We recommend reaching out to AWS Support or your AWS point of contact for any production workloads related guidance.Let me know if this answers your questions. Thank you for your interest in re:Post community.Regards,TejaswiniReference documents:[1] Real-time processing of log data with subscriptions - https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Subscriptions.html[2] GetLogevent CLI command - https://docs.aws.amazon.com/cli/latest/reference/logs/get-log-events.htmlCommentShareTejaswini_Ganswered 8 months agoEXPERTFabrizio@AWSreviewed 7 months ago"


Question: How do I terminate SageMaker Services

"Hello.I had unexpected billing due to some SageMaker instances still running (see screenshot).I don't know how to terminate it. I have followed the documentation on how to find and terminate running instances. I've looked at my billing dashboard and found that there are still running processes associated with SageMaker.I've deleted resources associated with the respective regions including endpoints / models / notebook instances / s3buckets / cloudwatch log groups  /  domains  / usersI thought it would be safe to delete the domains and users, although that might have been a bad call on my part.I would really like to STOP the SageMaker instances. What should I do. Please help.FollowComment"

Answer: "0Are you deleting resources in the region where you are incurring charges?The invoice in the image appears to show charges for two regions.Please refer to the following procedure for cleanup.https://docs.aws.amazon.com/sagemaker/latest/dg/ex1-cleanup.htmlCommentShareEXPERTRiku_Kobayashianswered a month agorePost-User-2421695 a month agoYes, I did make sure to delete resources in the mentioned regions. Thank you for mentioning that! I'm sorry I didn't mention it in my question.Share"


Question: S3 client segmentation fault in NodeJS worker thread

"I am trying to use the @aws-sdk/client-s3 inside a worker thread in NodeJS.It creates a segmentation fault when the worker exits, killing the main process with it.Here is a sandbox that you can replicate locally to try it out: https://codesandbox.io/s/aws-s3-worker-jjl4z9How can I avoid this segmentation fault?FollowComment"


Question: How to remove an Instance from Auto Scaling group

"Hi, Help needed, for some reason I now have 6 instances running vs 1 previously, which is costing me a lot more money.  I have tried to stop 5 of the instances but as they are part of an Auto Scaling group they have all kicked in again.  I cannot see how to remove the instances from the Auto Scaling group they are part of.How do I remove the instances from the Auto Scaling group?ThanksFollowComment"

Answer: "1Accepted AnswerI think you have two options. Firstly you can adjust your Auto Scaling Group to have a smaller maximum size. https://docs.aws.amazon.com/autoscaling/ec2/userguide/asg-capacity-limits.htmlAlternatively you can remove nodes from the Auto Scaling Group and then terminate them as you wish:https://docs.aws.amazon.com/autoscaling/ec2/userguide/detach-instance-asg.htmlCommentShareAlex_Kanswered 12 days agorePost-User-6650419 12 days agoHi Alex K, thanks for your answer, I have tried the first option and I have now been able to reduce the maximum capacity on 2 of my Auto scaling groups and already my total instances running have reduced from 6 to 4 - thank you very much.  I will also try your second option later so hopefully I can reduce my total instances running to 1.Share0Hi Alex, thanks very much, I did the 2nd option too and have now further reduced my instances down to 2.CommentSharerePost-User-6650419answered 8 days ago"


Question: Bug Report: Python Lamba Environment Failure of Isolation?

"I implemented the singleton design pattern in a python 3.6 lambda and found that a previous lambda execution impacted the current execution. Specifically, the instance of the singleton class was the same across multiple lambda environments.  Im curious what these means for how python lambdas are isolated?I followed the singleton implementation described in 'Method 3' of this popular stack overflow post: https://stackoverflow.com/questions/6760685/creating-a-singleton-in-pythonHere is an example.Lamba code:import jsonclass Singleton(type):_instances = {}def __call__(cls, *args, **kwargs):      if cls not in cls._instances:          cls._instances\[cls] = super(Singleton, cls).__call__(*args, **kwargs)      return cls._instances\[cls]    class Foo(metaclass=Singleton):def init(self):self.bar = []print(f"'bar' attribute is {self.bar}")def lambda_handler(event, context):foo = Foo()    print(f"after instantiating 'foo', bar attribute is {foo.bar}")  foo.bar.append(0)  print(f"after append, bar attribute is {foo.bar}")  Resulting Cloudwatch Logs after manually triggering the lamba several times in a row.  I believe a new instance is not being instantiated in lambdas beyond the first as the 'bar' attribute contains data from the previous lambda.01:57:14 START RequestId: 69e78a31-4a5e-4e84-abd9-44108f390838 Version: $LATEST01:57:14 'bar' attribute is \[]01:57:14 after instantiating 'foo', bar attribute is \[]01:57:14 after append, bar attribute is [0]01:57:14 END RequestId: 69e78a31-4a5e-4e84-abd9-44108f39083801:57:14 REPORT RequestId: 69e78a31-4a5e-4e84-abd9-44108f390838 Duration: 1.49 ms Billed Duration: 100 ms Memory Size: 128 MB Max Memory Used: 56 MB Init Duration: 114.96 ms01:57:21 START RequestId: adacf02b-39b8-468e-a7a5-f4c09bda5758 Version: $LATEST01:57:21 after instantiating 'foo', bar attribute is \[0]01:57:21 after append, bar attribute is \[0, 0]01:57:21 END RequestId: adacf02b-39b8-468e-a7a5-f4c09bda575801:57:21 REPORT RequestId: adacf02b-39b8-468e-a7a5-f4c09bda5758 Duration: 1.38 ms Billed Duration: 100 ms Memory Size: 128 MB Max Memory Used: 56 MB01:57:22 START RequestId: d66468cd-f09d-4c28-9343-0eeb52b316e9 Version: $LATEST01:57:22 after instantiating 'foo', bar attribute is \[0, 0]01:57:22 after append, bar attribute is \[0, 0, 0]01:57:22 END RequestId: d66468cd-f09d-4c28-9343-0eeb52b316e901:57:22 REPORT RequestId: d66468cd-f09d-4c28-9343-0eeb52b316e9 Duration: 1.62 ms Billed Duration: 100 ms Memory Size: 128 MB Max Memory Used: 56 MB01:57:23 START RequestId: 89813b23-9cb1-4284-ab11-472b84151666 Version: $LATEST01:57:23 after instantiating 'foo', bar attribute is \[0, 0, 0]01:57:23 after append, bar attribute is \[0, 0, 0, 0]01:57:23 END RequestId: 89813b23-9cb1-4284-ab11-472b8415166601:57:23 REPORT RequestId: 89813b23-9cb1-4284-ab11-472b84151666 Duration: 1.39 ms Billed Duration: 100 ms Memory Size: 128 MB Max Memory Used: 56 MBEdited by: lookatthisgraph on Jan 20, 2020 8:44 PMEdited by: lookatthisgraph on Jan 20, 2020 8:44 PMEdited by: lookatthisgraph on Jan 20, 2020 8:44 PMEdited by: lookatthisgraph on Jan 20, 2020 8:46 PMFollowComment"

Answer: "0Accepted AnswerHi Lookatthisgraph,It looks like you are experimenting with Lambda runtime environments!== A Short Answer And Why It Is Not A Bug But A Feature ==Well, according to the mighty internet:Possibly the simplest design pattern is the singleton, which is a way to provide one and only one object of a particular type...https://python-3-patterns-idioms-test.readthedocs.io/en/latest/Singleton.htmlAnd based on the fact you have created it outside of the handler, and also according to the following article (it's using node as an example but this behaviour is same across different runtimes):The first time a function executes after being created or having its code or resource configuration updated, a new container with the appropriate resources will be created to execute it, and the code for the function will be loaded into the container. In nodejs, initialization code is executed once per container creation, before the handler is called for the first time.https://aws.amazon.com/blogs/compute/container-reuse-in-lambda/So this is the normal behaviour from the Lambda container, and in fact, many of our customer is utilizing this feature actively.== How Can I Use This Feature ==So, the takeaway from the best-practices:Take advantage of execution context reuse to improve the performance of your function. Initialize SDK clients and database connections outside of the function handler, and cache static assets locally in the /tmp directory. Subsequent invocations processed by the same instance of your function can reuse these resources. This saves execution time and cost.To avoid potential data leaks across invocations, don’t use the execution context to store user data, events, or other information with security implications. If your function relies on a mutable state that can’t be stored in memory within the handler, consider creating a separate function or separate versions of a function for each user.https://docs.aws.amazon.com/lambda/latest/dg/best-practices.htmlHope this answers your question.CommentShareLuyang Lianswered 3 years ago"


Question: How System Manager will work without PORT 80 to Open

"Problem Statement: We are using System Manager Service for patching our servers, but we are facing one challenge , The process of upgrading the servers are same like updating and patching server via downloading packages from UBUNTU repo over https .i.e. on PORT 80, but we can't open the port 80 as a security compliance on our servers.Pls help and guide us, then how SMS will upgrade the servers and patch them.if PORT 80 is closed then "defaultbasepatchline" fails over the servers.Thanks.FollowComment"

Answer: "0I'm guessing you mean port 80 outbound, so the host can connect to the repo and and download the packages? (Also do you mean port 443, since you mention HTTPS?) If allowing outbound traffic from your hosts to the internet isn't acceptable for your security compliance, you might be able to work around this by setting up a web proxy host in your VPC (e.g. running Squid). You can configure rules on the host to only allow clients to connect to trusted URLs, such as Ubuntu's repos, and then configure the clients to connect via that proxy.You don't need port 80 open inbound (or any ports open inbound) for any component of SSM to operate, assuming that your firewall is stateful and allows return packets for connections which are created outbound.CommentShareEXPERTJames_Sanswered a year ago"


Question: RDS native backup to S3 does not change Lifecycle status (remains 0%)

"Everything is set for the backup of RDS to S3. But when executed :exec msdb.dbo.rds_backup_database @source_db_name='altahrirVersion', @s3_arn_to_backup_to= 'arn:aws:s3:::mumbaisqlserverbakup1/back1.bak', @overwrite_S3_backup_file=1;the % complete remained as 0% till next dayThen I used:exec msdb.[dbo].[rds_cancel_task] @task_id= 1the task now shows: CANCEL_REQUESTED and 0%Now i am stuck. I cannot create a new backup or cancel the standing one!Please help me ThanksFollowComment"

Answer: 0Accepted AnswerIt worked. I had to rebuild the options group and let it make its own new IAM roleCommentSharesabdultawabanswered a year ago


Question: Best way to share common code between EC2 containers in a monorepo

"Hello,I am working on a project that involves running multiple services on EC2 instances, each of which is built from a separate package within a monorepo. The services share some common code and packages (Typescript), and I am trying to find the best way to manage this shared code.I have considered using a shared file system like EFS, but I am wondering if there are any other recommended approaches. Specifically, I am wondering if there is a way to manage shared dependencies using a package manager like PNPM or a build system like Turborepo.Could you provide any guidance or best practices for sharing code between EC2 containers in a monorepo? I would appreciate any suggestions you may have.Thank you for the help.FollowComment"


Question: SES and Bounce Reputation

"Hello,I am a volunteer for our Democratic organization and have set up email distribution for us. We do not send a lot of emails, however for the June Primary we are increasing. Because the Historic Bounce Rate is based on representative volume, I think our increase is influencing the numbers. We are still healthy but our Historic Bounce Rate crept up. I have two questions.What is the period of time that determines that representative volume period?Has AWS SES considered adding a paid validation service? I would find value in having emails run through a validation before sending.Thanks,MikeFollowComment"


Question: S3 bucket name is not configured while creating stack through CloudFormation template.

"In my use case we are creating S3 bucket in the user's account through CloudFormation template. The concern is while creating stack in user's account, S3 bucket physical Id is not getting generated but while verifying the CloudWatch logs, the name is getting generated, even S3 bucket is not creating in the user's account & the user account gets onboarded into the database when the S3 bucket is showing in creation progress. Another issue is while deleting the stack, S3 bucket deletion is showing successfully even though the bucket was not created.Also, I've tried to onboard the account with different AWS accounts & different regions and it's onboarding successfully. Is this a glitch from the AWS side?FollowComment"

Answer: "0Hello sp018,I understand that you are trying to create an S3 bucket using a CloudFormation template but are unable to create it or get its physical id.Could you please provide the name of the bucket from the CloudWatch logs you mentioned, so we can verify its creation.The issue could be related to the permissions of the IAM user. Are you getting any "access denied" messages?. If so, make sure the user account has access to the bucket.Also check if you getting an error related to the bucket name. It could have already been taken.https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.htmlResources: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-policy.htmlhttps://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.htmlCommentSharePrithvidhar_Panswered 10 months ago"


Question: Receive incoming calls from long codes

"Hello,I want to know whether or not its possible to change the fact that when  someone tries calling my pinpoint long code number (the number that just texted them),When calling this number, always it says the number is invalid and does not exist.Is it or is it not possible to make the number get forwarded to another phone number? for example, a landline that is not managed by amazon. I want the number to forward there when its called.FollowComment"

Answer: "0It's not currently possible to receive incoming phone calls in Amazon Pinpoint. In other words, the Pinpoint voice channel is outbound-only.For more information, see the documentation for the Amazon Pinpoint Voice Channel.CommentShareEXPERTBrentAtAWSanswered 4 months ago"


Question: ThrottlingException from Step Function triggered through API Endpoint

"I have made a Step Functions State Machine the target of an API Gateway endpoint. The endpoint is supposed to trigger the State Machine. I made two or three requests to the endpoint. The first one failed with a 500 error. Right after that request, I have been getting the following response consistently (for over a day now):<ThrottlingException>    <Message>Rate exceeded</Message>  </ThrottlingException>  The throttling on my Gateway API is disabled, so that can't be it. Am I doing anything wrong? Is there a limit I need raised? If that's the case, I would be surprised - as I said, this has been happening every time after that first request. Needless to say, when I go to the Step Function, no execution is listed.FollowComment"

Answer: "0This was my bad. My API Gateway endpoint was of type PUT, so I specified PUT in the integration settings as well. However, the integration settings request methods specifies how the Step Functions API endpoint should be hit - for this action, it should be POST.CommentSharelxbbcanswered 3 years ago"


Question: Elasticsearch + Kibana + Cognito session error 403

"Hi folks,we have created an Elasticsearch (version 7.10) cluster with Cognito enabled fined grained authentication for Kibana.We have replicated (via terraform IaC) a configuration already present on another AWS account that is working fine.In this new cluster we have Kibana session issues, for example when we click "Log out" in Kibana we got an 403 error (I'll post it at the end of my message as LOGOUT_ERROR).Another error happens when the Cognito session token expires and we got another 403 error (another small snippet at the end of my message as LOGIN_ERROR).We cannot see the Cognito login page if we don't remove the cookie in the browser (we tested different browsers).Everything else is working fine: we are able to use Elasticsearch and Kibana with no other issues.Since the error is originating from "AWSSecurityTokenService" (an interface in the AWS Java SDK) we smell this as a possible bug that we're not able to address on our side.The fact that the Elasticsearch cluster is in eu-south-1 region and Cognito is in eu-west-1 could be an issue?Can you please help us by pointing us to any resource that may help resolve this issue?RegardsMarcoLOGOUT_ERROR<!DOCTYPE html>    <meta charset="utf-8">    <meta name="viewport" content="width=device-width, initial-scale=1.0">    <meta name="description" content="403 Forbidden">    <title>Kibana Authentication Error</title>    <link rel="stylesheet" href="//maxcdn.bootstrapcdn.com/bootstrap/3.3.4/css/bootstrap.min.css ">    <link rel="stylesheet" href="//maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css ">

 Sorry!

Something went wrong during authentication between Kibana and Amazon Cognito.

Log in to Kibana

What happened?

cognito:revoke_tokens:ErrorUser: x:x:x::xx:x is not authorized to perform: sts:AssumeRole on resource: x:x:x::xx:x (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: 432dbf6a-126f-43f4-be02-69c3657b3016; Proxy: null)

What should I do?

Try logging in again. If the problem persists, please review the troubleshooting guide for information on resolving common issues.

END LOGOUT_ERRORLOGIN_ERROR...
What happened?

com.amazonaws.services.securitytoken.model.AWSSecurityTokenServiceException: User: x:x:x::xx:x is not authorized to perform: sts:AssumeRole on resource: x:x:x::xx:x (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: d3bbebd3-a5ba-4406-9d75-5b78cd1c92bc; Proxy: null)
...END LOGIN_ERRORFollowComment"

Answer: "0We were able to fix this issue by adding a regional endpoint to the trust relationship policy of the Elasticsearch assumed role for Cognito:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "",            "Effect": "Allow",            "Principal": {                "Service": [                    "es.amazonaws.com",                    "es.eu-south-1.amazonaws.com"                ]            },            "Action": "sts:AssumeRole"        }    ]}So the fact that the Elasticsearch cluster is in eu-south-1 region and Cognito is in eu-west-1 is an issue!I'm wondering if this is expected behaviour or it can be considered a bug....Cheers!MarcoCommentShareMarcoanswered a year ago"


Question: Redirect spark-submit output to s3

"I don't seem to be able to redirect stderr from spark-submit to a file on S3...1. As a basic test, this works:sh-4.2$ cat ./testit.sh#!/bin/shecho hellosh-4.2$ ./testit.sh | aws s3 cp - s3://mybucket/test.out2. This creates a file in s3 upon submission, but it is empty file when the command completes:sudo spark-submit --class ${PACKAGE}.${CLASS} --deploy-mode client --master yarn --jars $JARS --executor-cores 2 --conf spark.ui.enabled=false --conf spark.network.timeout=1200000 $JAR $ARGS | aws s3 cp - s3://mybucket/test.out3. This does not even create a file at all:sudo spark-submit --class ${PACKAGE}.${CLASS} --deploy-mode client --master yarn --jars $JARS --executor-cores 2 --conf spark.ui.enabled=false --conf spark.network.timeout=1200000 $JAR $ARGS 2> aws s3 cp - s3://a206739-etls3-dsdc-ci-use1/test.out4. This creates a file locally. I could then copy to s3, but that's not what I want to do:sudo spark-submit --class ${PACKAGE}.${CLASS} --deploy-mode client --master yarn --jars $JARS --executor-cores 2 --conf spark.ui.enabled=false --conf spark.network.timeout=1200000 $JAR $ARGS 2> test.outI don't understand why #2 creates the file, but does not send output to it. Is there a way to make this work like that?FollowComment"

Answer: "0Hello,Thank you for contacting AWS. We were able to test and confirm the behavior as mentioned in your question.Unfortunately, there is no workaround for this behavior and this is the only option from spark side to route the content to S3.Please feel free to write back to me if you have any further queries. I would be more than happy to help.CommentShareSUPPORT ENGINEERAjinkya B-AWSanswered a year ago"


Question: Not able to get "status" : "200 OK" for Bulk Load API Call using aws neptune

"I am not able to do Neptune bulk load from AWS S3 using curl command Bulk Load API Call ?Command:curl -X POST-H 'Content-Type: application/json'https://**.cluster-c4brigvg3m9m.us-east-2.neptune.amazonaws.com:8182/loader -d'{"source" : "s3://*/Unsaved/2022/12/13/4a873928-9910-47b0-85ca-de593ace4f4a.csv","format" : "csv","iamRoleArn" : "arn:aws:iam::959061167427:role/NeptuneLoadFroms3","region" : "us-east-2","failOnError" : "FALSE",}'This is the error I am getting:{"code":"AccessDeniedException","requestId":"f6243cd3-2a4f-48a2-9d91-13803c199ef1","detailedMessage":"Missing Authentication Token"}Can annyone please help me why I am getting this error and How can I resolve it ?FollowComment"

Answer: "0The curl utility does not have a means to pass IAM credentials.  The error message you are getting is because you're using a Neptune cluster with IAM Authentication enabled.  To resolve this issue, you can use awscurl [1], a utility that will sign the request with IAM credentials that you pass either directly as parameters, credentials that you have stored as environment variables, or credentials that you have stored as a profile in the AWS CLI.awscurl -X POST --service neptune-db -H 'Content-Type: application/json' --region us-east-2 \https://**.cluster-c4brigvg3m9m.us-east-2.neptune.amazonaws.com:8182/loader -d'     {        "source" : "s3://*/Unsaved/2022/12/13/4a873928-9910-47b0-85ca-de593ace4f4a.csv",         "format" : "csv",         "iamRoleArn" : "arn:aws:iam::959061167427:role/NeptuneLoadFroms3",         "region" : "us-east-2",         "failOnError" : "FALSE"}'[1] https://github.com/okigan/awscurlCommentShareTaylor-AWSanswered 5 months ago"


Question: StatusMessage": "ClientError: Unsupported architecture. 32-bit architecture is not supported in this region."

"Hello, there. I am trying to migrate my windows 7 vm from my local computer to an amazon AMI. The vm is 32 bit based. I get the error below when monitoring the import image task.{    "ImportImageTasks": [        {            "Description": "Windows 7 DA",            "ImportTaskId": "import-ami-xx",            "Platform": "Windows",            "SnapshotDetails": [                {                    "Description": "Windows 7 DA",                    "DeviceName": "/dev/sde",                    "DiskImageSize": xx,                    "Format": "VHD",                    "Status": "completed",                    "Url": "s3://xx.vhd",                    "UserBucket": {                        "S3Bucket": "xx",                        "S3Key": "images/xx"                    }                }            ],            "Status": "deleted",            "StatusMessage": "ClientError: Unsupported architecture. 32-bit architecture is not supported in this region.",            "Tags": []        }    ]}FollowComment"

Answer: 0The error message is clear here - 32-bit operating systems aren't supported. Windows 7 is also very old - support ended in 2020.I'd suggest instead using a newer 64-bit Windows version and migrating your applications to it.CommentShareEXPERTBrettski-AWSanswered 5 months ago


Question: Why do the CDK APIGWV2/Route53 docs say generate an A record rather than CNAME?

"Why in the example from @aws-cdk-aws-route53-targets does the apigwv2 sample generate an A record rather than a CNAME record?/* Example from @aws-cdk-aws-route53-targets, doesn't work - makes CDK hang */import * as apigwv2 from '@aws-cdk/aws-apigatewayv2';declare const zone: route53.HostedZone;declare const domainName: apigwv2.DomainName;new route53.ARecord(this, 'AliasRecord', {    zone,    target: route53.RecordTarget.fromAlias(        new targets.ApiGatewayv2DomainProperties(domainName.regionalDomainName, domainName.regionalHostedZoneId)    )});What I have always done (manually) is create a CNAME record to the API Gateway domain name listed under API Gateway / Custom Domain names in the console.  I am not following this example or why you would want it to be an ARecord.I changed the above code to this for my own and it seems to work:/* my version, which works */return new CnameRecord(this, `autofrog-phone-api-cname`, {    recordName: 'phone',    zone: this.zone,    domainName: this.apiGatewayDomainName.regionalDomainName, /* instance of @aws-cdk/aws-apigatewayv2-alpha:IDomain */    deleteExisting: false,    comment: "added by cdk"});FollowComment"

Answer: 0Accepted AnswerI didn't know what an Alias record was until a few minutes ago.Now I understand what they were doing.CommentSharewz2banswered 6 months ago


Question: RDS Proxy closes the connection unexpectedly

"We have deployed a Django application in EKS and used RDS PostgreSQL with RDS proxy as a database backend.Over the last month, we have started noticing occasional 500 "Internal Server Error" responses from our web app with the following error coming from Django:django.db.utils.OperationalError: connection to server at "<proxy DNS name>" (<proxy IP address>), port 5432 failed: server closed the connection unexpectedlyThis suggests that RDS proxy closed the client connection. In Django settings, the configured value of CONN_MAX_AGE parameter is the default 0, which means Django opens a new database connection for every query - this means that the observed failures cannot be related to RDS proxy's  idle client connection timeout setting, which we have set to 30 minutes.To deal with this issue, we have implemented retries on the service mesh level (Istio). However, we would like to know more about the root cause of the failures and why we have seen an increased frequency of them during the last month - this almost never happened previously.Looking at the proxy and the database metrics in Cloudwatch, it doesn't look like there was increased traffic during the failures. Nevertheless, could the proxy close a client connection during a scaling operation? How can we get more insight into RDS Proxy internal operations? Turning on Enhanced Logging keeps it enabled only for 24 hours and there is no guarantee that the error will occur during that time window - we are also a bit nervous enabling it on production since it can slow down performance.FollowComment"

Answer: "0The error message "connection to server at "<proxy DNS name>" (<proxy IP address>), port 5432 failed: server closed the connection unexpectedly" suggests that the RDS proxy is closing the client connection unexpectedly. This issue could be caused by a number of factors, including increased traffic, scaling operations, or issues with the RDS proxy or the database.Regarding the scaling operation, the RDS proxy is not affected by the scaling of the database instances. RDS proxy does not close the client connection during a scaling operation.To get more insight into the RDS proxy internal operations, you can enable Enhanced Logging for the RDS proxy. This will provide more detailed logs and metrics, which can help you identify the root cause of the connection failures. However, it is important to note that enabling Enhanced Logging can slow down performance, so it's best to perform this step during a maintenance window or when the traffic is low.You can also check the CloudWatch Metrics for the RDS proxy and the database. It could be that some metrics like Connections, CPU Utilization, Memory utilization, and so on are at high levels during the failures.Another approach is to look into the RDS proxy error logs which you can find in the RDS console under the 'Logs and Events' tab. This will give you more information about the connection failures.In addition, you can also check the RDS proxy connection pool settings, make sure that the connection pool is not too small for the number of connections you are trying to establish.Finally, you may want to contact AWS support to get more information or help with troubleshooting the problem.CommentSharejayamaheizenberganswered 4 months ago"


Question: Is it bad to create pre-signed URLs every time for frequently S3 object access?

Previously I have asked a question about s3 presigned URL. One expert replied that s3 presigned urls are only for download purpose. He said Typically we recommend to generate the presigned URLs only when you want to download the object.. I just want to access s3 objects frequently with presigned URLs.FollowComment

Answer: "1Accepted AnswerHi Amplify_lover,Presigned URLs are typically used for download purposes, but they can also be used for upload.That said, there isn't any cost associated with presigned urls so there isn't a problem with generating many of them, so if it suits your use-case, use it to your heart's content!CommentSharePablo Guzmananswered 6 months agoEXPERTkentradreviewed 6 months agoAmplify_lover 6 months agoI mean can I create billion times presigned URL per day per object and let's say my bucket has 10 billions objects. In one day I will be creating 10billions X 1billion presinged URLs and in a month 10billions X 1billion X 30daysShare"


Question: Build stuck at status "Cancelling"

"A build failed and Amplify Console started spamming me with duplicate email notifications of its status, so I cancelled it via the web interface. It's now been in state "Cancelling" for at least an hour.How long should I wait? It appears to be preventing subsequent builds from starting.The failure, in case it matters:2019-03-27T17:52:17.849Z [INFO]: Cloning repository: git@gitlab.com:redacted.git2019-03-27T17:52:18.275Z [WARNING]: Cloning into 'redacted'...2019-03-27T17:52:19.015Z [WARNING]: Host key verification failed.2019-03-27T17:52:19.015Z [WARNING]: fatal: Could not read from remote repository.Please make sure you have the correct access rightsand the repository exists.2019-03-27T17:52:19.018Z [ERROR]: !!! Unable to clone repository.2019-03-27T17:52:19.019Z [INFO]: # Starting Environment Caching...2019-03-27T17:52:19.019Z [INFO]: # Environment Caching completedTerminating logging...No idea why that happened, but I can't even begin to troubleshoot it.FollowComment"

Answer: "0Accepted AnswerDoes this issue still bother you? Please attach your appArn and send email to aws-amplify-customer@amazon.com.Thanks,GaryCommentShareAWS-User-0568200answered 4 years ago0Thanks, I've contacted that address.The affected build is still stuck, but after starting and cancelling the next, all later builds have run successfully: • Build #25: Success• Build #24: Success• Build #23: Success• Build #22: Cancelled• Build #21: Cancelling• Build #20: SuccessCommentShare8B141165answered 4 years ago"


Question: Access S3 files from Unity for mobile development

"I'm trying to configure the AWS S3 service to download the included files in a bucket using Unity for mobile.I downloaded the SDK package and I got it installed.From AWS console I set up a IAM policy and roles for unauth usersI created a Cognito IdentityPool and got the relative idI set up the S3 bucket and its policy using the generator, including the arn:aws:iam::{id}:role/{cognito unauth role} and the resource arn:aws:s3:::{bucket name}/*.In code  I set credentials and region and create CognitoAWSCredentials (C# used)_credentials = new CognitoAWSCredentials(IdentityPoolId, _CognitoIdentityRegion);then I create the client: _s3Client = new AmazonS3Client(_credentials, RegionEndpoint.EUCentral1);  // the region is the same in _CognitoIdentityRegionI then try to use the s3Client to get my files (in bucketname subfolders)private void GetAWSObject(string S3BucketName, string folder, string sampleFileName, IAmazonS3 s3Client)    {        string message = string.Format("fetching {0} from bucket {1}", sampleFileName, S3BucketName);        Debug.LogWarning(message);        s3Client.GetObjectAsync(S3BucketName, folder + "/" + sampleFileName, (responseObj) =>        {            var response = responseObj.Response;            if (response.ResponseStream != null)            {                string path = Application.persistentDataPath + "/" + folder + "/" + sampleFileName;                Debug.LogWarning("\nDownload path AWS: " + path);                using (var fs = System.IO.File.Create(path))                {                    byte[] buffer = new byte[81920];                    int count;                    while ((count = response.ResponseStream.Read(buffer, 0, buffer.Length)) != 0)                        fs.Write(buffer, 0, count);                    fs.Flush();                }            }            else            {                Debug.LogWarning("-----> response.ResponseStream is null");            }        });    }At this point I cannot debug into the Async method, I don't get any kind of error, I don't get any file downloaded and I even cannot check is connection to AWS S3 has worked in some part of the script.What am I doing wrong?Thanks for help a lot!FollowCommentDmitry Balabanov a year agoCould you please elaborate which SDK version you use? In the current V3 API, I don't see any IAmazonS3.GetObjectAsync() method signature that would match your usage (using a callback). Is GetObjectAsync an  extension method here?ShareHuli1984 a year ago@Dmitry BalabanovThank you for the comment!I'm using the aws sdk for unity v3.3.802.0So it's a unitypackage and not the sdk for .NET; maybe the difference among the methods are due to that. For example the unity version lacks of the all Transfer methods including IAmazonS3.Transfer.TransferUtility...At the moment I'm gonna try to find a method to understand if at least my connection attempt goes right.Thank you again, best regards.ShareHuli1984 a year ago@Dmitry BalabanovOk, I assume I misunderstood your words.I'm following the AWS Amazon guidelines for GetObjecAsync().It has the following possible args (including callback):void IAmazonS3.GetObjectAsync(string bucketName, string key, AmazonServiceCallback<Amazon.S3.Model.GetObjectRequest, Amazon.S3.Model.GetObjectResponse> callback, [AsyncOptions options = null]).Am I missing to pass the options? Cause the callback, the objectResponse, nor other args, asks me for signature.ShareDmitry Balabanov a year agoIf you are using Unity 2018.1 or later, please use the AWS SDK for .NET binaries. The AWS Mobile SDK for Unity is for legacy Unity support, use at your own risk. Please consider migrating your app to a newer version of Unity, and use the AWS SDK for .NET - .NET Standard 2.0 binaries.Share"

Answer: "0Per the discussion in the comments, leaving an answer to this question to remove it from the unanswered column. Please let us know if you need further assistance!CommentShareSierra Washingtonanswered 8 months ago"


Question: "When accessing an object from the console, I can't find the object. & Ask about QoS"

"Get object, list object, etc. with s3 api works well.But when approached from the console, there was a problem that the object could not be found.I think it's an encoding problem.. Is there any limit?Additionaly, when 'get object' with s3 api,at software.amazon.awssdk.core.exception.AbortedException$BuilderImpl.build(AbortedException.java:84)at software.amazon.awssdk.core.exception.AbortedException.create(AbortedException.java:38)at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptTimeoutTrackingStage.handleInterruptedException(ApiCallAttemptTimeoutTrackingStage.java:142)at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptTimeoutTrackingStage.translatePipelineException(ApiCallAttemptTimeoutTrackingStage.java:106)at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptTimeoutTrackingStage.execute(ApiCallAttemptTimeoutTrackingStage.java:90)at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptTimeoutTrackingStage.execute(ApiCallAttemptTimeoutTrackingStage.java:42)at software.amazon.awssdk.core.internal.http.pipeline.stages.TimeoutExceptionHandlingStage.execute(TimeoutExceptionHandlingStage.java:78)at software.amazon.awssdk.core.internal.http.pipeline.stages.TimeoutExceptionHandlingStage.execute(TimeoutExceptionHandlingStage.java:40)at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptMetricCollectionStage.execute(ApiCallAttemptMetricCollectionStage.java:50)at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptMetricCollectionStage.execute(ApiCallAttemptMetricCollectionStage.java:36)this error occurs.Is there a maximum number of times per second that can be accessed per account, per ip, or per bucket?Thanks!FollowComment"


Question: How do I receive emails sent to aliases in WorkMail?

"I'm super new to AWS, but I've been trying to set up a basic organization for myself, in attempt to have something for professional correspondence that's not Gmail. I've registered multiple domains in Route 53, set up records in hosted zones as needed from creating an organization with WorkMail and with certificates. Everything seems to work fine with my user email for the default domain. I can send emails out from the default email domain and aliases with other verified domains, and I've confirmed that they make it to their destination. I can only receive emails to the default email domain address. Any emails sent to aliases do not land in my WorkMail.I've done a lot of searching on the old AWS forums and I wasn't able to find anything regarding this issue in re:Post. I found issues where people weren't receiving email at all, but I know that I at least have some of the MX records correct since I can receive emails.I can continue to use just the default domain, but I'd like to be able to use the aliases as well. Is there something within my AWS Organization/Route 53 that's not set up correctly?FollowComment"

Answer: "2Hi,I'm sorry to hear you're experiencing problems with receiving mail on your aliases. Some easy things you can verify to debug the problem are:Check that the MX record for all your domains point to WorkMailEnsure the alias is added to the userEnable Message logging to see if the mails arrive: Message logging in CloudwatchKind regards,RobinCommentShareMODERATORrobinkawsanswered a year agoAlex McNabb a year agoWell the MX records for the alias domain look exactly like the MX record for the default domain that actually works.The alias is added to the user.If I'm looking at the data correctly, there is no log entry of it hitting WorkMail in the organization sending to the alias.Anymore suggestions, Robin?Sharerobinkaws MODERATORa year agoHi, sorry for the late response. I did not get a notification for this.If there is no record of a received message for the alias in the message logs something prevented it from reaching WorkMail. Do you have any other Inbound rules configured in the SES console for the alias domain?Kind regards,RobinShare"


Question: Regression in Cloudwatch Dashboard? iframe embed stopped working

"Up until recently, I was able to embed a public cloudwatch dashboard into a webpage using an iframe.  Recently it started throwing javascript errors in the browser console.  Tested in both FF and Chrome 111.  A minimal repro is the following html file.  Replace the <public dashboard url> with a valid cloudwatch public dashboard url.  Mine is in us-west-2<title>Dashboard test</title> <iframe src="<public dashboard url>" title="Dashboard">If I hit the public dashboard url directly it loads.  In a iframe, it gets credentials but then there are JS errors and it errors out.  See screenshot:FollowComment"

Answer: "0Accepted AnswerAWS reached out to me directly and made an update so dashboards once again work in iframes.CommentShareperpilanswered 2 months ago0Usually CloudWatch Dashboards need AWS  access (IAM user or role) however as you are embedding this I am assuming these dashboards would have been made publicly shared without AWS access. Check if the settings have been changed.https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-dashboard-sharing.htmlCommentShareEXPERTVijay Shekhar Raoanswered 2 months agoperpil 2 months agoNo settings were changed and the public url loads if you hit it directly in the browser.  There is an IAM role, access is provided via Cognito.  You only get the cross-origin error in an iframe.  Note the repro is a local html file that to my knowledge should not be impacted by CORS issues like a html file hosted on a domain would.Share"


Question: Status Paused SES Account

"Hi,My SES Account paused several times for the same issue but finally i learn many exciting solutions for PHPMailler. I want to try but my account paused. I don't want to change my region for that. Is there any way to open my SES account again ?FollowComment"

Answer: 0You have to raise a support case with SES team with proper justification. One review pass by SES team they will reopen sending limitCommentShareNitin Goyalanswered 5 months ago


Question: AWS Kinesis Video Streams

"I used Kinesis Video Streams using Cloud9.When I checked the payment details, there was a Data Transfer item.And there was data transmission to Tokyo and Ireland. Tokyo, I never set up delivery to Ireland, so why did this happen? Does the data transfer to any country happen automatically?below is actual my billing details :AWS Data Transfer APN2-APN1-AWS-Out-Bytes$0.00$0.080 per GB - Asia Pacific (Seoul) data transfer to Asia Pacific (Tokyo)0.000013 GB$0.00AWS Data Transfer APN2-EU-AWS-Out-Bytes$0.00$0.080 per GB - Asia Pacific (Seoul) data transfer to EU (Ireland)0.000004 GB$0.00Is ec2 charge charged because of cloud9 in this case? Or is it because of kvs?FollowComment"

Answer: "0Hello,  When you provision a Cloud9 environment a cloudformation stack is deployed which in turn deploys an EC2 instance.  The EC2 instance will incur charges.  By default a provisioned Cloud9 environment is stopped after 30 minutes.Regarding the data transfer charges; it's hard to to tell from the data provided if indeed those data transfer charges are related to Kinesis.  You may need to query the Cost and Usage Reports using Amazon Athena with a SQL query such as below (Note: Using Athena and running queries will incur additional costs):SELECT DISTINCT line_item_product_code ,          line_item_usage_type ,          product_from_location,          product_to_location,          line_item_resource_id,          sum(line_item_usage_amount)/1024 AS "TB's", sum(line_item_blended_cost) AS cost FROM <YOUR_CUR_TABLE> WHERE line_item_usage_type LIKE '%Bytes%'         AND (line_item_usage_type LIKE '%In%'         OR line_item_usage_type LIKE '%Out%'         OR line_item_usage_type LIKE 'Nat%')         AND (product_from_location = ''         OR product_from_location LIKE '%(%') GROUP BY  line_item_product_code, line_item_usage_type, product_from_location, product_to_location, line_item_resource_id ORDER BY  sum(line_item_blended_cost) descHope this helps,Alex W (AWS)CommentSharealekse_wanswered a year ago"


Question: Is it possible to map the group as an attribute?

"Hi,I am using AWS IAM as IDP from Root account with AWS SSO  (not AD or external), so I have AWS SSO and a SAML application for Jenkins configured on the root account.I have configured the SAML Jenkins app with the following attributes:And i need propagate to Jenkins the groups to which that user belongs in the AWS SSO, to assign permissions in Jenkins according to the groups that the user has.Is it possible?Regards!FollowComment"

Answer: "0I answer myself, I finally managed to get the AWS SSO groups ID with this configuration.CommentShareZeus Ariasanswered 4 months ago"


Question: Does Network Firewall logging tell me the policy rule that was enforced?

"I have alert logging enabled on my network firewall. Is there a way I can tell which stateful rule has caused the alert? I don't see anything obvious in the log json.Reading the docs:The event is controlled by Suricata, the open source intrusion prevention system (IPS) that the stateful rules engine runs on. Suricata writes the event information in the Suricata EVE JSON output format.Does Suricata know which rule in my policy was triggered?{    "firewall_name": "firewall",    "availability_zone": "ap-southeast-2a",    "event_timestamp": "1656600550",    "event": {        "timestamp": "2022-06-30T14:49:10.144362+0000",        "flow_id": 1056350291768298,        "event_type": "alert",        "src_ip": "..snip..",        "src_port": 20133,        "dest_ip": ".snip..",        "dest_port": 1604,        "proto": "UDP",        "alert": {            "action": "blocked",            "signature_id": 2804670,            "rev": 3,            "signature": "VMware vCenter Chargeback Manager Information Disclosure",            "category": "Attempted Information Leak",            "severity": 2,            "metadata": {                "created_at": [                    "2012_03_13"                ],                "updated_at": [                    "2012_03_13"                ]            }        },        "app_proto": "failed"    }}FollowComment"

Answer: "0Hello,It appears that you are trying to find the rule that was triggered by your Network Firewall which prompted the event in your logs. This is possible by looking at the signature_id or sid value in the JSON event output, in the text provided it would be "signature_id": 2804670. Each Suricata rule has a unique signature id which is used to determine the order in which the rules are enforced. This id is chosen when the rule is imported into the rule group. You can use the signature id to find the rule with the matching id which caused the alert.Resources:https://suricata.readthedocs.io/en/suricata-6.0.0/rules/meta.html#sid-signature-idhttps://doc.emergingthreats.net/bin/view/Main/SidAllocationCommentShareJacob_Ranswered 10 months ago0One correction to @Jacob_R's answer. The Signature ID (sid) does not determine the order in which the rules are enforced. It is purely a unique identifier. The rule evaluation order is determined by the settings in your firewall policy and rule group.Resources:https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-rule-evaluation-order.htmlhttps://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-examples.html#suricata-example-rule-orderinghttps://suricata.readthedocs.io/en/suricata-6.0.1/rule-management/suricata-update.htmlhttps://doc.emergingthreats.net/bin/view/Main/SidAllocationCommentShareBrian_AWSanswered 10 months ago"


Question: Support for CDC on Azure SQL Database sources

"The document at https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.AzureSQL.html says:"AWS DMS doesn't support change data capture operations (CDC) with Azure SQL Database.",but the release notes for DMS version 3.4.7 at https://docs.aws.amazon.com/dms/latest/userguide/CHAP_ReleaseNotes.html#CHAP_ReleaseNotes.DMS347 says:"For RDS SQL Server, Azure SQL Server, and self-managed SQL Server — DMS now provides automated setup of MS-CDC on all tables selected for a migration task that are with or without a PRIMARY KEY"Is the "Azure SQL Server" part referring to Azure SQL Database, or Azure SQL Managed Instance? I'm presuming the latter. When I did try to do a full load and incremental load I got somewhat cryptic message implying that Azure SQL Database is NOT able to do incremental loads with CDC (as the first doc I linked to says).If that is the case, does anyone know why Azure SQL Database is not supported, even though Azure SQL Database itself supports CDC? At this point in my investigation of database migration services (of any flavour) I would love it to be supported...FollowComment"


Question: fetch message from AWS Iot greengrass component

I would like to develop an video detection application that can let user to choose for cloud computing or edge computing. How can I fetch the MQTT message from greengrass?FollowComment

Answer: "0Hello,I'm not sure I get the whole picture here, but I'm assuming that you are planning to have a video detection app in an edge device (probably raspberry pi) with some ML inference capability deployed on Greengrass. If the user prefer edge computing, where the image captured will be analyzed locally without sending it to cloud services, you can use AWS IoT Core to receive the mqtt message from the edge device as seen in this documentation : [https://docs.aws.amazon.com/iot/latest/developerguide/connecting-to-existing-device.html].Let say if a particular object detected, your device will send an mqtt message to IoT Core, and trigger a workflow.CommentShareFrankanswered 5 months ago"


Question: Reserved instance used in another account

"When a customer has consolidated billing, if a reserved instance is not used in the account where it was purchased, it will be used in the best suitable linked account that maps with the same characteristics.Is there a way to trace that account/instance-id where it was used. It is challenging to know who is taking the unused reserved instances for internal budgeting.FollowComment"

Answer: "1Accepted AnswerYou can trace it by using Cost and Usage Report. It shows customers how the RIs are applied. The Discounted Usage line item describes the instance usage that received a matching RI discount benefit, and is added to customer's bill when they have usage that matches one of their RIs.CommentShareAWS-User-2481746answered 5 years agoEXPERTNataliya_Greviewed a year ago"


Question: Are Dynamodb conditional expressions consistent across nodes?

"I am trying to lock an object in a table with a function that looks like this:def lock():dynamodb = boto3.resource('dynamodb', endpoint_url="http://localhost:8000")table = dynamodb.Table('table')response = table.update_item(    Key={        'id': "id1",        'created_at': "2022-02-06T12:07:45.602721617Z"    },    UpdateExpression="SET #O.L  = :locked",    ConditionExpression="object.locked <> :locked",    ExpressionAttributeValues={':locked': True},    ReturnValues="UPDATED_NEW")return responseGiven that several workers might be trying to get the lock at the same time and there is no way to have consistent write in Dynamodb. Is it possible for multiple workers to acquire the lock at the same time?FollowComment"

Answer: "1Accepted AnswerAll writes to DynamoDB are singleton and consistent. There is only a chance for a single thread to acquire the lock, all others will fail. More here.Reads on the other hand can be both Eventually Consistent or optionally Strongly Consistent. More here.CommentShareEXPERTLeeroy Hannigananswered a year ago"


Question: AWS SAM CLI: Continue debugging automatically following start in VS Code?

"When using AWS SAM CLI to debug Lambda function locally, the process in VS Code goes like this:Click Run / Press F5(SAM initializes in background, spins up docker container)VSCode opens a new tab called "index.js" with the entry point in it, and the debugger attaches and pauses.You must press Run / F5 again at this point, and close the "index.js" tab if you're not using it.Is there any way to get this tool to skip step 4? I don't want it to open a new tab with entry point code in it - I'm not looking at that code or debugging it. It would also be really nice if the debugger just continued automatically following the attach. I find myself pressing F5 and closing index.js thousands of times per day.Am I doing this wrong, or does everyone have to suffer through this?FollowComment"

Answer: "0Hello,Tim here with the AWS Support Team!Yes, I too ran into the same issue and was able to recreate this and understand what you’re running into and why this interrupts the debugging workflow.I was able to do a bit of investigative work on my end, and I believe I traced the origins of this issue. I noticed when I inspected the call stack in Visual Studio Code it said “PAUSED ON DEBUGGER STATEMENT”, however I had set no breakpoint in that index.js file (located at /var/runtime/index.js according to the debugger).Interesting I thought…so I began to dig around online what this message means, and I stumbled across an article online located here:https://stackoverflow.com/questions/57357498/vscode-stops-on-invisible-breakpoint-on-async-hooks-js-while-debugging-a-node#:~:text=%22paused%20on%20debugger%20statement%22%20means,%3B%22%20statement%20in%20the%20code.Now it appears the fix is to go into your Visual Studio Codes debug configuration and add a “skipFiles” section, and some documentation on that is located here: https://code.visualstudio.com/docs/nodejs/nodejs-debugging#_skipping-uninteresting-codeWhat thickens the plot a bit, when I went to add this “skipFiles” it said it was not supported, however digging into some GitHub issues, it appears it should be able to be ignored, and indeed I do see that other items are being ignored in the debug stack after I add some other folders to be ignored, so by all accounts its working on some spots: https://github.com/Microsoft/vscode-react-native/issues/620Now with all that said, I was still not able to get past this specific file being ignored, I regret to inform you.Still, I hope the information I shared above can help you pick up the investigation further..from all indications it appears to be more of a VS Code item rather than the AWS Toolkit (perhaps even the node.js debugger being at fault), so as the next steps I recommend opening an issue with the Visual Studio Code team and check if that can yield some results: https://github.com/microsoft/vscodeCommentShareSUPPORT ENGINEERTim_Panswered a year ago"


Question: Quicksight: Calculation Field - decimal places truncated

"I am posting a question which is related to a dashboard development on Quicksight. It includes a calculation field which uses sumover's in a sumover.  However, I encountered a problem that Quicksight can't produce accurate result when it take multiplication operations on two float number fields.I am sharing a simple example to describe the problem. As you see, there would be two steps in the calculation. I.e. 1.) sum(cost)/sum(cost2), and 2.) pre-result * 10,000. I suspect the float number is truncated in the first step so that the displayed result is not accurate.I tried some workaround solutions. E.g. re-write the calculation as sum(cost)*10000/sum(cost2). It seems to be using much a lot computation power; thus, this workaround results in overflow error in my real case.Note: the 10,000 in my real case is not constant.FollowComment"

Answer: "0As per SPICE Limitaion, "QuickSight enables you to create calculations that are based on DECIMAL data having more than four decimal places to the right of the decimal point. However, QuickSight can display no more than four decimal places to the right of the decimal point. The value is truncated, not rounded, when displayed in data preparation or analyses and when imported into SPICE."[+] Supported data types and values - Numeric data - https://docs.aws.amazon.com/quicksight/latest/user/supported-data-types-and-values.html#numericOne workaround for the issue is to use the formula :(sum(cost^1)/sum(cost2^1))*10000Which basically puts a dummy power function on the column, whose result is Double type.Please try the above and let me know if it helps. Thank you!CommentShareShatakshianswered 8 months ago"


Question: DKIM Settings for Email Addresses

"Hi :)After I verify emailaddresses, do I have to generate DKIM Settings for every emailaddress I make and add those keys to my domain´s DNS?Kind RegardsTom LøkkaFollowComment"

Answer: "0Accepted AnswerHello Tom,You need to set up DKIM for every email address that you verify in SES and add the respective DKIM CNAME records to your domain’s DNS records.If all the email address that you will be verifying belong to a single domain that you own, then you can just verify the domain in SES instead of verifying each of the email addresses of that domain. When you verify an entire domain, you are verifying all email addresses from that domain, so you don't need to verify email addresses from that domain individually. For example, if you verify the domain example.com, you can send email from user1@example.com, user2@example.com, or any other user at example.com without explicitly verifying these in the email addresses section.Additionally, when you set up Easy DKIM for a domain, Amazon SES automatically authenticates every email from every address on that domain. However, do note that Easy DKIM settings for a specific email address automatically override the settings for the domain that the address belongs to. For example, if you have verified a domain example.com and enabled DKIM on this domain and then you verify an email address of this domain, such as test@example.com and do not enable DKIM for this email address, then on sending emails from test@example.com, your emails will not be DKIM signed.Please feel free to contact us if you have any other questions.Regards.CommentShareSUPPORT ENGINEERajita-awsanswered 2 years ago0Hi :)Thanks a lot for help and to clarify my question.Kind RegardsTom LøkkaCommentSharetoloekkaanswered 2 years ago"


Question: Not able to connect to instance please help

getting the below error.FollowComment

Answer: "0Hello,Please see the following knowledge center article  on steps to take to resolve issues with EC2 instance connect. There are a number of possible causes for this along with their resolutions in this article:EC2 Instance Connect doesn't support the OS distribution.The EC2 Instance Connect package isn't installed on the instance.There are missing or incorrect AWS Identity and Access Management (IAM) policies or permissions.Security groups associated with the instance don't have EC2 Instance Connect service IPs listed.Please note that there are several other methods of connecting to your EC2 instance per the following documentation  including but not limited to SSH, RDP, Serial Console, and AWS Systems Manager Session Manager. Many of these options will be dependent on things like IAM permissions for your user and the instance itself as well as the type and OS of the instance.CommentShareKameron_Banswered a month ago"


Question: ViewShakeEx FlowGraph node not working?

"After successfully setting up my first person player, I can't seem to figure out why ViewShakeEx nodes don't work at all. I tried different entity references and completely different variable settings, all of which didnt help. I entered Debug mode and it seems that it IS FIRING, but it's not actually doing anything. Any ideas? This flowgraph is taken from my main FG entity that controls the entire player.REMOVEDUPLOADFollow"

Answer: "0Accepted AnswerI looked into this and noticed that the ViewShakeEx node does work with component entities only if you create the flow graph through right clicking on the component entity and selecting FlowGraph->Add. For the node's settings, just set the View to Current and set the Shift to something like 3,3,3 and leave the Entity unassigned.However, there are gotchas with this:Camera:View does not seem to work.Setting the entity on the Camera:ViewShakeEx does not do anything.Important note: In the case of having multiple cameras in the scene, Camera:ViewShakeEx will change the view to the last Camera created.Let me know if that helps.Thanks!ShareEXPERTrePost-User-8100776answered 6 years ago0Hey @REDACTEDUSERwith the team to see if this is a known bug and if there's a possible work around. I'll get back to you as soon as I can!SharerePost-User-5738838answered 6 years ago0Hey @REDACTEDUSERSharerePost-User-8353690answered 6 years ago0I tried assigning the entity as the camera entity i have in my player prefab, and it still doesn't work :(SharerePost-User-1269214answered 6 years ago0Hey @REDACTEDUSERSorry for the delayed response — it is a known issue that ViewShakeEX node does not interact with the Camera components perfectly, at this moment. However, we can simulate the shaking effect with random values through Math:Random and attaching the result to the camera’s position.In this example, I’ve made a simple box mover Flow Graph to get the demo box moving. The demo box is a component entity with the box mesh. For this instance, the demo box is a parent to the camera entity. This was done to get both items to moving in the same direction. I then used math:random for x and y, which makes the camera jitter. Here’s the Flow Graph image and a GIF showing the jittery result:REMOVEDUPLOADREMOVEDUPLOADHope this is helpful — let us know if this works for you :)Cheers!SharerePost-User-5738838answered 6 years ago0Thanks for the info. I'm just gonna wait until the new visual scripting system is up and running as it says in the new popup message in 1.7. I feel the legacy systems just aren't working well for me, but high hopes for the new systems coming (hopefully) soon.SharerePost-User-1269214answered 6 years ago0Right on. It's looking pretty good.SharerePost-User-8353690answered 6 years ago"


Question: Business tarif change!

Hi. I chose a business rate for 100 dollars and I want to return to a rate of 25 dollars per month. thanks**FollowComment

Answer: "1Hi ThereIt sounds like you are referring to your support plan.  Here is the pricing for the different support plans: https://aws.amazon.com/premiumsupport/pricing/Business support starts at $100 but you can change your support plan to either Developer which is $29, or Basic (no technical support) for $0.  You can follow this guide for changing your support plan.CommentShareEXPERTMatt-Banswered 4 months ago"


Question: Postgresql TOAST table size limits

I am running into some issues with Postgresql TOAST table size limits.any suggestions or workaround?FollowComment

Answer: "1Accepted AnswerThe possible workaround in this case is by Partitioning your table, and that will reduce the total number of wide values. That way for those wide columns you have in the table might be much less than the size limit which is 4 billion.please take a look at https://wiki.postgresql.org/wiki/TOAST.CommentShareOthnajidanswered a month agoEXPERTAWS-User-Nitinreviewed a month ago"


Question: Instances failed to join the kubernetes cluster

"I am attempting to setup an EKS cluster, and have followed the documentation as much as possible. The cluster endpoint is both private and public, and my worker nodes will be in a private subnet.I have a public subnet where I have a jumphost to connect to the worker nodes in the private subnet if I have to for debugging.When I attempt to create a node group, the instance boots but fails to connect with the message "Instances failed to join the kubernetes cluster" in the UI. There is no more information anywhere, so I logged into the worker node from the jumphost, and this is what I seeJul 14 10:06:31 ip-10-0-60-142 kubelet: F0714 10:06:31.010038    4491 server.go:273] failed to run Kubelet: could not init cloud provider "aws": error finding instance i-0e50417a226393598: "error listing AWS instances: "RequestError: send request failedncaused by: Post https://ec2.us-west-2.amazonaws.com/: dial tcp 54.240.249.157:443: i/o timeout""Jul 14 10:06:31 ip-10-0-60-142 systemd: kubelet.service: main process exited, code=exited, status=255/n/aJul 14 10:06:31 ip-10-0-60-142 systemd: Unit kubelet.service entered failed state.Jul 14 10:06:31 ip-10-0-60-142 systemd: kubelet.service failed.Jul 14 10:06:36 ip-10-0-60-142 systemd: kubelet.service holdoff time over, scheduling restart.From the message it looks like the kubelet is not able to connect to what seems to be public IP address for the API endpoint. Why should it connect to a public IP at all when I have enabled private access? What else is going wrong here? Can somebody from AWS help?FollowComment"

Answer: 0Changing the global STS to valid in all AWS regions seems to work.Above can be done at https://console.aws.amazon.com/iam/home#/account_settingsCommentSharesanjitanswered 3 years ago


Question: GuardDuty and AWS Security Hub - Timing

"Hi All,Ive a quick question re: the timings of findings being generated and being accessible in AWS Security Hub via GuardDuty.Without giving away the trade secrets, Im guessing there various step that take place from the point there is suspicious activity to it being available via the SecurityHub API.Im guessing the steps would be:Suspicious activity on the account taking placeGuardDuty observes and stores this findingGuardDuty then passes this to Security Hub or does Security Hub have the same access to the GuardDuty repository (therefore does it get I the same time as GuardDuty finds it?)Available to be pulled via the findings APIWhat are the timeframes of these steps?Im trying to understand how quickly I can access the finding from the point the suspious activity happened.Thanks all.FollowComment"

Answer: "0Guardduty is designed to analyze account and network activity in near real time and at scale. The findings are available for retrieval through Guardduty API.When GuardDuty creates a new finding, it is usually sent to Security Hub within five minutes. More details about Guardduty and Security Hub integration can be found here.CommentShareraj_banswered 9 months ago"


Question: Do Amazon SageMaker manifest files enable dataset versioning?

"Some Amazon SageMaker algorithms can train with a manifest JSON file that stores the mapping between images and their Amazon S3 ARNs and metadata, such as labels. This is a great option, because the manifest file is much smaller than the dataset itself. Because the manifest files are small, they can be used easily in versioning tools or saved as part of the model artifact. This appears to be the best construct enabling exact dataset versioning within SageMaker. i.e., if we exclude the creation of a unique training set hard copy per training job that can't be scaled to large datasets. Is my understanding accurate?FollowComment"

Answer: "0Accepted AnswerIf you create the conditions for immutability of the assets the manifest points to, then manifest enables exact dataset versioning with SageMaker. You can have a data store in Amazon S3 with all versions of the data assets and use the manifest files for creating and versioning datasets for specific usage.If you don't guarantee immutability for the assets that the manifest points to, then your manifest becomes invalid.CommentShareAWS-User-5951845answered 2 years ago"


Question: Multi-account Multi-region config aggregation / recording

"I've been trying to setup multi-account config aggregation and recording at org level.I'd been trying to do it with Terraform, but ended up re-doing it via the console, and also while logged in under the root account for the org, to make sure there weren't delegation issues.I've got the config aggregator setup, logging to S3, and I'm seeing events come in and getting written, but only from the org account itself. I see the sub-accounts in the aggregator and the status shows up "Ok" for each of them (this was true even previously, when I'd set it up from an IAM account with admin privs), however, I'm not yet seeing any configurations or events coming through. Resources from the org itself are showing up fine.Config aggregator is using a custom role based on AWSConfigRoleForOrganizations as well as an sts:AssumeRole policy attachmentThe recorder has "Use an existing AWS Config service-linked role" (AWSServiceRoleForConfig) selected currentlyhttps://docs.aws.amazon.com/config/latest/developerguide/aggregate-data-troubleshooting.html mentions "Enable AWS Config in the source account", but based on the other docs, it seems like that should not actually be necessary with this type of setup?Presumably since the recorder and aggregator are in the org account, as well as the target bucket, the other accounts within the org don't need any permissions for the bucket, right?Also, will all the stuff from sub accounts show up under [bucket]/AWSLogs/[org account ID]/Config/us-east-2/2023/2/24/ConfigHistory/ if that's where the aggregator itself is? or would I expect them to show up in the same structure as cloudtrail logs etc. where they're under the org ID and then sub account ID ([bucket]/AWSLogs/o-XXXXXXXX/[sub account id]/Config)?Aggregator menu view in consoleDetail of one sub account's statusAggregator main page only shows the org account.FollowComment"


Question: AWS Sagemaker Project from template Model building testing and deployment failing default pipeline.

"After creating the domain and adding a user for AWS Sagemaker, I opened Sagemaker Studio and created a project using the template "Model building Training and deployment", project got successfully created and I also cloned the files from template to local in studio, till this point it was fine,Now, when I am seeing the pipelines, I see a pipeline already runs by default after project creation, but here this pipeline is failing with the below error from output tab :-"ClientError: Failed to invoke sagemaker:CreateProcessingJob. Error Details: The account-level service limit 'ml.m5.xlarge for processing job usage' is 0 Instances, with current utilization of 0 Instances and a request delta of 1 Instances. Please contact AWS support to request an increase for this limit."Here is the screenshot - Please help me with this, I am new to SageMaker.FollowComment"

Answer: "0Hi, looking at the error details, seems like you hit the account level service limits that are specified for your SageMaker resources. Please check these instructions on how to request for service quota increase through AWS Support:https://repost.aws/knowledge-center/sagemaker-resource-limit-exceeded-errorCommentSharesupriya_awsanswered 2 months ago"