Question: DDR write access problem

"Hello,I am implementing an FPGA IP connected to the AWS shell through AXI interface. The IP performs :loading data from DDRA,calculation on these datastoring the result in DDRBThe IP integrates the following AXI interfaces :- S00 : Full AXI , Write access to DDRA to transfer data from host application- M00 : Full AXI , Read access to DDRA for loading data to be computed- S01 : Lite AXI for configuration and debug- M02 : Full AXI  , Write access to DDRB for storing partial results- S02 : Full AXI , Read access to DDRB to transfer data to host applicationThe computing part initiates accesses to DDR : 2 x 2 beats of 512 data bit, for a basic versionThe FPGA design is based on the IPI CDMA Test Example. Test are performed with C file provided with the HDK on F1 instanceData are transfered from host to DDRA correctly. I have implemented registers in the kernel to check the reading access from DDRAThe problem is on reading results from DDRB.  DDRB data are set to 0. I checked that data are correctly read by replacing DDRB data by constant data. -> OKI have to run simulation to check axi_awvalid, axi_awready, axi_wvalid, axi_wready and  axi_wlast . But when I try it I get the following error message :"ERROR: [VRFC 10-449] cannot open file "/opt/Xilinx/Vivado/2021.2/data/xsim/ip/blk_mem_gen_v8_4_5/blk_mem_gen_v8_4_5_synth_comp.vdb" for writing"Can you tell me how to fix this issue?Best RegardsFollowComment"


Question: Not getting RBT (Ring Back Tone) or voice mail prompt before hearing voice mail beep during outbound call

"Use Case:From Amazon Connect based contact centre agents make outbound calls to their customers to offer servicesIf customer will not reply then call will go to voice mail box of customer (depends if voice mail is enabled by customer or not)Frequency of issue:30% to 40% of callsIssue observed:For majority of the calls agents can't hear Ring Back Tone or Voice Mail Prompt played from customer end, they directly hear 'beep' sound to leave voice messagePoints checked:Verified latency and other points using https://www.connect-tools.net/endpoint-test/ and observed that agent's systems and network are ideal for applicationNot received any errors in Agent CCP logs which indicates connectivity issuesMonitored performance of resources in Agent's systems and those are at optimum levelEnabled Early Media option in Telephony Options in Amazon ConnectFollowComment"

Answer: "0This could be your outbound whisper flow is being played.  The default behavior is to use the "Default Outbound" flow that say "This call is not being recorded." and you might have this modified to say something longer.In the scenario of voicemail, the moment it connected, Connect will play the Outbound Whisper flow while the voicemail greeting is played at the same time.  And when the Outbound Whisper flow done playing, the call is delivered to the agent, and then all they hear is the tail end of the voicemail and the beep.Check this setup and possibly make a new Outbound Whisper flow with nothing, so agent can hear it earlier.  You can change the outbound whisper flow used in the Queue setting, and the Routing Profile's Default Outbound Queue will determine which Queue's setting to use for this.CommentShareClarenceChoianswered 10 days ago"


Question: Unexpected EC2 error while attempting to Create Network Interface UnauthorizedOperation while using boto3

"While trying to start a task of a ECS cluster using the aws API key with boto3 for my own account, the task container was created and immediately killed due to an error:*Unexpected EC2 error while attempting to Create Network Interface in subnet 'subnet-xxxxxxxxxxxxxxxxx': UnauthorizedOperation*However, I was able to start a task in a ECS cluster via web GUI using the same subnet. When the container was created, it is in the subnet I am expecting.The task launch type is FARGATE, platform version is 1.4.0. Task role has been defined and used in either manual or script launch mode. Network mode shows awsvpc. In case of failed script launch, the EIN id is 'unset'.Can someone help understand this issue? It will be nice to know how to enable the log for the launching of a container. At this moment, I only see the container logs after a container is successfully launched via web gui.Thank you!FollowCommentVenkat Penmetsa SUPPORT ENGINEERa year agoIts worth checking the CloudTrail event history to find out the request parameters and the IAM user/role being used for the operation. Search for the EventName "CreateNetworkInterface" in your CloudTrail event history and see if that helps!Share"

Answer: "0It appears to be a security group related. The automation script used a different security group which has much more limitation. The manual process via web ui used a different security group.However, I don't understand how security group blocks CreateNetworkInterface.Thanks.CommentShareJManswered a year ago"


Question: Access denied using cyberduck or s3 Browser to upload object into s3 bucket

"Hi there,No matter what I do I cannot upload any object to an s3 bucket and I have the right permissions. I have tried playing around with the permissions and then ended up giving up and allowing all s3 permissions.I am using Cyberduck or S3 browser to upload documents, for certain reasons I cannot upload files straight to s3 in the browser.Below is the JSON that is used.{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": "s3:","Resource": ""}]}I really don't know why it will give me 'access denied' whenever I try to upload.ThanksFollowComment"

Answer: "0Hi,Below is the sample minimal IAM policy you may use to provide permissions to the bucket:[code]{"Statement": [ {"Effect": "Allow","Action": ["s3:ListBucket", "s3:GetBucketLocation"],"Resource": "arn:aws:s3:::your_bucket_name","Condition": { }}, {"Effect": "Allow","Action": ["s3:PutObject", "s3:GetObject","s3:DeleteObject"],"Resource": "arn:aws:s3:::your_bucket_name/*","Condition": {}} ]}[/code]CommentShareIvan Moiseevanswered 4 years ago"


Question: Appium Java Cucumber test scenarios are not executing in the AWS Device Farm

"Hi Team,I'm currently trying to execute Appium automated test scenarios on AWS device farm. There are no errors in the log, but no test scenario executed. I have included the testng.xml file which refers to the TestRunner class.[DEVICEFARM] Setting up your device. This usually takes 2-3 minutes.[DEVICEFARM] ########### Start executing testspec ###########  [DEVICEFARM] ########### Entering phase install ########### [DeviceFarm] export APPIUM_VERSION=1.14.2[DeviceFarm] avm $APPIUM_VERSION/usr/bin/avm: line 261: appium: command not found      exists : [DeviceFarm] ln -s /usr/local/avm/versions/$APPIUM_VERSION/node_modules/.bin/appium  /usr/local/avm/versions/$APPIUM_VERSION/node_modules/appium/bin/appium.js [DEVICEFARM] ########### Entering phase pre_test ########### [DeviceFarm] export CLASSPATH=$CLASSPATH:$DEVICEFARM_TESTNG_JAR[DeviceFarm] export CLASSPATH=$CLASSPATH:$DEVICEFARM_TEST_PACKAGE_PATH/*[DeviceFarm] export CLASSPATH=$CLASSPATH:$DEVICEFARM_TEST_PACKAGE_PATH/dependency-jars/*[DeviceFarm] echo "Start appium server"Start appium server[DeviceFarm] appium --log-timestamp --default-capabilities "{\"deviceName\": \"$DEVICEFARM_DEVICE_NAME\", \"platformName\":\"$DEVICEFARM_DEVICE_PLATFORM_NAME\", \"app\":\"$DEVICEFARM_APP_PATH\", \"udid\":\"$DEVICEFARM_DEVICE_UDID\", \"platformVersion\":\"$DEVICEFARM_DEVICE_OS_VERSION\", \"chromedriverExecutable\":\"$DEVICEFARM_CHROMEDRIVER_EXECUTABLE\"}" >> $DEVICEFARM_LOG_DIR/appiumlog.txt 2>&1 &[DeviceFarm] start_appium_timeout=0; while [ true ]; do    if [ $start_appium_timeout -gt 60 ];    then        echo "appium server never started in 60 seconds. Exiting";        exit 1;    fi;    grep -i "Appium REST http interface listener started on 0.0.0.0:4723" $DEVICEFARM_LOG_DIR/appiumlog.txt >> /dev/null 2>&1;    if [ $? -eq 0 ];    then        echo "Appium REST http interface listener started on 0.0.0.0:4723";        break;    else        echo "Waiting for appium server to start. Sleeping for 1 second";        sleep 1;        start_appium_timeout=$((start_appium_timeout+1));    fi;done;Waiting for appium server to start. Sleeping for 1 secondWaiting for appium server to start. Sleeping for 1 secondWaiting for appium server to start. Sleeping for 1 secondWaiting for appium server to start. Sleeping for 1 secondAppium REST http interface listener started on 0.0.0.0:4723 [DEVICEFARM] ########### Entering phase test ########### [DeviceFarm] echo "Navigate to test package directory"Navigate to test package directory[DeviceFarm] cd $DEVICEFARM_TEST_PACKAGE_PATH[DeviceFarm] echo "Start Appium JUnit test"Start Appium JUnit test[DeviceFarm] java -Dappium.screenshots.dir=$DEVICEFARM_SCREENSHOT_PATH org.testng.TestNG -junit -testjar *-tests.jar -d $DEVICEFARM_LOG_DIR/test-output[TestNG] Running:  /tmp/scratch5Hh0UX.scratch/test-packagezOobaa/testng.xml===============================================RegressionTotal tests run: 0, Failures: 0, Skips: 0=============================================== [DEVICEFARM] ########### Entering phase post_test ###########  [DEVICEFARM] ########### Finish executing testspec ########### [DEVICEFARM] ########### Setting upload permissions ###########  [DEVICEFARM] Tearing down your device. Your tests report will come shortly.https://us-west-2.console.aws.amazon.com/devicefarm/home?region=us-east-2#/mobile/projects/679dd7ea-c057-48a9-9fa6-cb581cf8133a/runs/716ddf89-b27a-4310-aecf-5eda2f2d7ac2/jobs/00000Appreciate your help on this issue.Regards,Wathsala.FollowComment"


Question: Error when running a glue job to write data to data lake

"I am writing a glue script to take data from s3(PSQL WAL LOGS) to write that data into a hudi data lake.Whenever I am trying to do that I am getting unable to upsert data with commit time error with a trace of org.apache.hudi.exception.HoodieException: ts(Part -ts) field not found in record, Acceptable fields were : [my db columns]I am not sure from where i am getting this ts into the scope.Pasting the below glue script for reference. Note that i am trying to write the CDC logs to data lake, it will be great if some has a glue script to do thatimport sysfrom awsglue.transforms import *from awsglue.utils import getResolvedOptionsfrom pyspark.context import SparkContextfrom awsglue.context import GlueContextfrom awsglue.job import Jobimport boto3from pyspark.sql.types import DataType, StringTypeglue_to_spark_types = {    "boolean": "boolean",    "tinyint": "tinyint",    "smallint": "smallint",    "int": "int",    "bigint": "bigint",    "float": "float",    "double": "double",    "decimal": "decimal",    "string": "string",    "date": "date",    "timestamp": "timestamp",    "array": "array",    "struct": "struct",    "map": "map"}args = getResolvedOptions(sys.argv, ["JOB_NAME"])sc = SparkContext()glueContext = GlueContext(sc)spark = glueContext.spark_sessionglue_client = boto3.client('glue')job = Job(glueContext)job.init(args["JOB_NAME"], args)tables = glue_client.get_tables(DatabaseName="glue catalog db")# for table in tables['TableList']:for table in [{ 'Name': 'tableName' }]:    table_name = table['Name']    print("Table", table)# Script generated for node S3 bucket    S3bucket_node1 = glueContext.create_dynamic_frame.from_catalog(        database="GLUE CATALOG DB",        table_name=table_name,        transformation_ctx="S3bucket_node1",    )    table_schema = S3bucket_node1.schema()        mappings = []    # Iterate over the columns in the schema and generate the mappings    for field in table_schema.fields:        print("field", field)        column_name = field.name        column_glue_type = field.dataType.typeName()        print("col_glue_type", column_glue_type, column_name)        # Get the corresponding Spark SQL data type from the dictionary        column_spark_type = glue_to_spark_types.get(column_glue_type, "string")        mappings.append((column_name, column_glue_type, column_name, column_spark_type))        # Script generated for node ApplyMapping    ApplyMapping_node2 = ApplyMapping.apply(        frame=S3bucket_node1,        mappings=mappings,        transformation_ctx="ApplyMapping_node2",    )        # Script generated for node S3 bucket    additional_options = {        "hoodie.table.name": "asd" + table_name,        "hoodie.datasource.write.table.type": "COPY_ON_WRITE",        "hoodie.datasource.write.operation": "upsert",        "hoodie.datasource.write.recordkey.field": "id",        # "hoodie.datasource.write.precombine.field": "modified_at",        "hoodie.datasource.write.hive_style_partitioning": "true",        "hoodie.parquet.compression.codec": "gzip",        "hoodie.datasource.hive_sync.enable": "true",        "hoodie.datasource.hive_sync.database": "asdasdasdasd",        "hoodie.datasource.hive_sync.table": "cl__" + table_name,        "hoodie.datasource.hive_sync.partition_extractor_class": "org.apache.hudi.hive.MultiPartKeysValueExtractor",        "hoodie.datasource.hive_sync.use_jdbc": "false",        "hoodie.datasource.hive_sync.mode": "hms",    }        print("Apply mapping", additional_options)        S3bucket_node3_df = ApplyMapping_node2.toDF()        S3bucket_node3_df.write.format("hudi").options(**additional_options).mode(        "append"    ).save("s3://asdasdasdasdds/" + table_name + "/")        print("table", table_name)job.commit()FollowComment"

Answer: 0Hudi requires a column that it can use to handle duplicates inside the batch (if you know that can't happen then any column will do).hoodie.datasource.write.precombine.field defaults to "ts" but it will fail if the column doesn't exit.More information in the Hudi docs: https://hudi.apache.org/docs/basic_configurations#hoodiedatasourcewriteprecombinefieldCommentShareGonzalo Herrerosanswered a month ago


Question: Aurora Serverless V2 Postgres Cross Region Replica

Would it be possible to setup an Aurora serverless v2 in us-east-1 and have a read replica in another region (us-west-2)? How could we do this via console?FollowComment

Answer: "0Aurora PostgreSQL DB clusters don't support Aurora Replicas in different AWS Regions, so you can't use Aurora Replicas for cross-Region replication.Taken from: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Replication.htmlHowever, you can add readers in the same region with Aurora Serverless v2 Postgres.Finally, you would be able to create cross-region read replicas with Aurora Serverless v2 in MySQL 8 and MySQL 5.7.CommentShareAWS-User-0986812answered 3 months ago"


Question: Preventing WASM worker errors in console log when *not streaming*

"Whenever a stream has stopped, but you are still accessing the page where the IVS player has been embedded, I get errors in the console. If I try to implement a couple of iframes in another page with IVS players, these error logs are multiplied by the amount of iframes, causing the browser to crash after a while (out of memory).Is there a way to surpress the errors? We tried to find the source, but it appears it is caused by the WASM worker ... which we cannot modify.Access to fetch at 'https://[xxx].eu-west-1.playback.live-video.net/api/video/v1/eu-west-1.[xxx].channel.[xxx].m3u8?player_version=1.8.0' from origin '[xxx]' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.FollowComment"

Answer: "0Hi FB! It looks like you are using an older version of the IVS player (1.8.0). If possible, you might want to upgrade to the latest player version (1.16.0).The message you are seeing is likely caused by trying to call load() or play() on a channel that is not broadcasting. One possible approach would be to use fetch() to first check that the playlist URL does not return a 404 before calling load() or play() on the channel.CommentSharerecursivecodesanswered 3 months ago"


Question: Operating AWS Batch on a public subnet

"We want to move our AWS Batch computing environment from a private subnet to a public subnet to reduce communication costs for the NAT Gateway, but are there any security risks associated with doing so?Even if we assign a public IP, we do not see any problem as long as the inbound rules for the security group are properly configured.FollowComment"

Answer: "0Public subnet means that the instances can be directly accessible from the internet with their public IP address (or EIP). There are a lot of bots constantly crawling IP addresses. If they get a response from a server, they know that it could potentially be breached or brute-forced.I understand the cost consideration of using the NAT Gateway. I would make use of NACL (first) + Security group (second). NACL is setup on the subnet level, protecting all the instances within that subnet. Security group works at the instance level. If you are using Linux you can also look to use IP Tables which is Linux firewall.CommentShareEXPERTTushar_Janswered 6 months ago0So, AWS Batch is the orchestration tool not where batch runs.Are you referring to the compute pools, if so then as with any workload you would not want those to be in public subnets.What data costs are you generating?It may be that VPC Endpoints might be useful in reducing costs.If all your data is in Dynamo DB or S3 then a gateway load balance endpoint is a about a tenth of the cost.Other AWS Services would be an interface endpoint for which data processing is about 25% of the cost.If your data is not in AWS then my preferred method to reduce cost and keep security is an NLB.Put the NLB in the public subnet with targets as your data source and have your batch use the NLB as it's data source.This can be secured and is about half the cost of NAT but operates in a similar way in terms of system protection.CommentShareRobin Fordanswered 5 months ago"


Question: Can't create one-way trust

"Hello,I'm trying to create a one-way forest trust between our AWS managed AD and on-premise domain but when creating the one-way trust in Directory Services Console, it fails. I'm following this blog, https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_setup_trust_create.html. I have thoroughly read, re-ran the tutorial, deleted and re-created the trust but it keeps failing. Is there a fix or work around for this? The error message that I get is "Trust relationship status failed: The remote domain is not reachable. Please ensure your security group settings are correct and your conditional forwarder is configured properly". I've checked and verified the security group and that the ports (from the tutorial) allows incoming traffic from our domain and outgoing is open to all. I've also checked with our security team to make sure our on-prem firewall isn't blocking 172.24.0.0/16 (managed AD CIDRs) traffic to our domain. The conditional forwarder are configured correctly on our on-prem DNS and as well as on the managed AD DNS settings. I can ping to the AWS managed AD from our domain and can ping from the ec2 instance, joined to the managed AD, to our domain.Any help is appreciated!FollowComment"

Answer: "0The part we were missing is adding IP routing (on-premise is in public IP CIDR range) under the Networking&Security tab in Directory Service, you can read it at https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_setup_trust.html at number 10 under "Create, Verify, or Delete a Trust Relationship".CommentSharevue07418answered 3 years ago0In addition if anyone runs into an issue creating a trust. It's good to note that the Managed AD Security Group assigned to your directory only allows outbound communications to itself. If you need to create a trust, you will need to add a rule that allows outbound communications to the domain controllers that you are creating a trust with this. This needs to be done before creating your conditional forwarder as well, or you will get a failure in creating the trust due to communication issues.CommentShareEXPERTRob_Hanswered 10 months ago"


Question: Hasura server shows 502 Bad Gateway errors which is running on EC2

"https://prnt.sc/XIVLCkyDETq8Front side while we trying to fetch data using API but shows cors error. But actually is due to the Hasura server looks not connected wth that EC2 instance.I tried to reboot the instance but it still not working. Instances running properly.Please let me know. How we can figure out this?FollowCommentiwasa EXPERT8 months agoHi.Are Hasura Server and EC2 instances the same thing? Another thing?Is there a load balancer in front of EC2?If you see CORS, what domain?I think everyone can give a little more advice once they know your architecture configuration.Share"


Question: Sending data from EC2 to S3

"Hii everyone,I am running Websocket Server in python in EC2 and i am storing exchanged messages in as a .log file. I want to store the exchanged messages to S3 continuously. can any one  please  tell me how to do this??Thanking you in advanceFollowComment"

Answer: "0How continuously do you mean?  A simple approach would be to use Boto3 in Python to write messages as individual objects in S3 as you process them, but I don't know how small these messages are and how many you get.Another approach is to use the CloudWatch Logs agent on the EC2 instance to push your .log files' messages into CloudWatch, then set a subscription there feeding to Kinesis Firehose which can deliver to S3.CommentShareEXPERTskinsmananswered 5 months agorePost-User-7451843 5 months agoi am sending sensors data to websocket server continuously for a month and  from server i want to store in s3. could you please tell me the best approach that will work?Shareskinsman EXPERT5 months agoIt sounds like you've got a stream of small bits of data so I think Kinesis Firehose delivering to S3 is best, as it can look after buffering etc.Either have your code directly Put to the Kinesis stream, or go via CloudWatch Logs as I mentioned.Share0Configure FluentBit or FluentD and simply send to S3.It is recommended to configure the log agent separately so that it does not affect the application.https://docs.fluentbit.io/manual/pipeline/outputs/s3CommentShareJIHUN KIManswered 5 months ago"


Question: Question about removing elasticbeanstalk

"i removed all elasticbeanstalks on aws consoloe and shut down the server on aws.but one server i made is still running on aws server.For instance, if i send a request to DNS that i got from aws through postman, i still get a response.Because of this issue, the cost that i have to pay keeps increasing.I chekced over and over again if there is a remaining elasticbeanstalks i made, but i cannot find any.can anyone help me for sorting out this issue?thank youFollowCommentAshish_P a year agoOne way is to look at the Billing details and find which Region the Host deployed and then in respective region check ElasticBeanStalk / EC2 Console.Share"

Answer: "0Hi Taehee, our guide here: https://aws.amazon.com/premiumsupport/knowledge-center/terminate-resources-account-closure/ can help in eliminating AWS resources on your account you no longer need.Another resource you may find helpful is this document: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/checklistforunwantedcharges.html on avoiding unexpected charges on your AWS account.Lastly, keep in mind the AWS Pricing Calculator: https://calculator.aws/#/createCalculator/CloudTrail is always available at your convenience.CommentShareEXPERTAWS Support - Zackanswered a year ago"


Question: How to download and use matlab in ubuntu instance?

"Hi, I was trying to download and activate matlab in aws ubuntu instance for my project. However, I couldn't get any guide to install matlab in ubuntu instance.Until now, I made ubuntu instance successfully and downloaded matlab installation file, but I couldn't get matlab exe file.As I thought, I need ubuntu GUI to activate matlab exe file. so I tried to use VNC but I still don't know how to use it.Can you help me to make matlab environment in aws ubuntu instance?FollowComment"

Answer: "0HiMatlab installation instructions are available at https://www.mathworks.com/help/compiler/install-the-matlab-runtime.html. The standard install is administered through the GUI which is where your problem seems to be. There is also the option of a non-interactive install, (see halfway down the page referenced above) using:./install -mode silent -agreeToLicense yeswhich would be worth a try.If you need need the GUI, does it have to be Ubuntu? There is an official guide from AWS on how to install and connect to the GUI on AWS Linux: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-2-install-gui/. Note the alternative options at the top of the guide which might be more effective for you.If Ubuntu is a hard requirement, there is an unofficial, older guide here https://linuxhint.com/configure_gui_ec2_ubuntu/ which still appears relevant. This coupled with the matlab install guide should answer your question.The matlab-on-aws project might also be of interest. It provides a CloudFormation stack which will install matlab for you.Note that I don't have a matlab license so this answer is based on documentation rather than proven on my machine. Hope it helps.CommentShareedeastwoodanswered a year ago0Hello Kwon,I understand that you are trying to download and activate MATLAB in your AWS instance and you cannot seem to get the MATLAB exe file.In order to activate MATLAB on your instance, please follow the steps mentioned below:Login to your instance through a virtualization platform i.e Virtual BoxLocate your Matlab zip file and unzip using the command:sudo unzip -X -K <name of downloaded file> -d matlab_2022_installerPlease note that matlab_2022_installer is the name of the file you are creatingList all the files and locate matlab_2022_installer. Get into that folder using: cd matlab_2022_installerUse the command sudo su (this command will take you to root) and enter your password if required.On root, run the following command:xhost +SI:localuser:rootThe above command should show "localuser:root being added to access control list"List all the files in the folder using ls, locate "install"Install file is the executable fileRun the following command to run the executable file:sudo ./installBy now you should be able to login to your Matlab account using your credentials and complete the installation.Exit root by typing the command: cd and go to user local using the command: cd /usr/local Find the Matlab folder, enter, and list all the files to locate your Matlab version and get into the folder.Enter the bin folder and list all the files to see the activate matlab script and run the script using the command: ./activate_matlab.shAfter activation, open a new terminal and run the command: matlab - This command will run matlabI hope this helps.CommentShareAsenathianswered a year ago"


Question: SES Custom MAIL FROM config

"We have configured SES for a domain, and wish to use the custom mail from feature.The DNS records have been added correctly as provided by AWS, however the "pending verification" remains for many days, and then fails. This has been peer checked by a few of us!Sorry, I cannot post the actual domain names here (as one is a customer and I'd need to seek permission which would be sticky), however are there any logs that I can check to see why it has failed verification for the MAIL FROM checking?  Or additionally what are the reasons that it would fail?Is it as simple as the MX record for bounce.domain.com and associated TXT record for bounce.domain.com?I have just now deleted the config in SES, and re-entered it (within classic portal) - just as a troubleshooting step.Are there any other troubleshooting tips that can be provided for ensuring successful verification?Thanks in Advance,TomyFollowComment"

Answer: "0Accepted AnswerResolved. There was a space at the end of the MX Record value. All the various DNS checking sites didnt spot it. However -https://mxtoolbox.com did not notice the space and it looked OK.https://dnschecker.org/ did not find the MX recordhttps://toolbox.googleapps.com/apps/checkmx/ was the most useful, and outlined "\032" at the end of the value, which is the ASCII value for a space.To double check, i used Powershell which clearly showed a space within the square brackets:$answer = (resolve-dnsname -Name amazon.com -type mx).NameExchangeWrite-output "MX Record value is [$answer]"MX Record value is [amazon-smtp.amazon.com]CommentShareinvtomyanswered a year ago0Usually custom MAIL FROM domain is set to a subdomain so just want to confirm you are using a subdomain. Because you will have 2 set following 2 records:DomainRecord TypeRecord Valuesubdomain.domain.comMX10 feedback-smtp.region.amazonses.comsubdomain.domain.comTXT"v=spf1 include:amazonses.com ~all"Can you please confirm if you have set these 2 records as well for the custom mail from domain that you are setting?CommentSharehameedullahanswered a year ago0Hi, thanks for quick reply.Yes, I can confirm that those records 100% exist in the DNS for the domain.CommentShareinvtomyanswered a year ago"


Question: 403 Access denied error from S3 in Glue

"I have some data that I've uploaded to an S3 bucket in CSV format. I decided to try crawling it with Glue. I added a crawler, pointed it to the bucket, and gave it an IAM role that has the AWSGLueServiceRole managed policy.I ran the crawler and it didn't identify any tables, even though I know I have several CSV files in the bucket. I checked CloudWatch logs and the crawler is getting a 403 access denied error from S3:ERROR : Error Access Denied(Service: Amazon S3; Status Code: 403; Error Code: AccessDenied;Request ID: 4A6CA0B1723E03DC) retrieving file ats3://data-lake-us-east-1-930604210392/rJEzO-5Jb/1493993509425/Unemployment_Insurance_Recipients_and_UI_Benefit_Payments_by_County__Monthly_.csv.Tables created did not infer schemas from this file.It looks to me like the AWSGlueServiceRole managed policy should give it plenty of access to S3. What else can be going on?FollowComment"

Answer: 0Accepted AnswerThe IAM Role will need access to the S3 bucket it cannot access. The AWSGlueServiceRole policy only gives the ability to GetObject from resources names aws-glue-*. You will need to attach another policy or create your own policy to run the glue jobs on that S3 bucket.CommentSharerridgleyanswered 6 years ago


Question: Not able see One of our EC2 instances  on Compute Optmizer

Both our T3 instances are in a single region but still only one is visible in the Compute Optimizer console. How can we see both?FollowComment

Answer: 0Hi - Few criteria for AWS Compute Optimizer areIt needs at least consecutive 30 hours running time before it makes recommendations for standalone EC2 instances.If the instance is in stopped state you will not get any recommendations for that instanceIf the problematic instance belongs to an Autoscalling group then refer to the recommendations for Autoscalling for Compute OptimizerHope this helps narrow down the reason on why one of the instance is not showing up in Compute optimizer recommendation.CommentShareEXPERTGokulanswered 4 months ago


Question: Unable to invoke AWS Lambda function: Authorization error

"I am using storing the document first in my bucket and then calling the lambda function that I created to get the response of the document, I am able to send the document in S3 but getting the below error that's why I am not getting the response of the document in code of react.js.Error:-"AccessDeniedException: User: arn:aws:iam::076465650773:user/username is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:ap-south-1:076465650773:function:testing-lamda-function because no permissions boundary allows the lambda:InvokeFunction action"I have already created the role, user & inline policy as below:-![lambda_role](/media/postImages/original/IMitfRFbfYS5qWO8lJn9BMGw)![aws_user](/media/postImages/original/IMtt5hcq8sQwCZdZfCAPnUzA)![testing-lambda-policy](/media/postImages/original/IMiNOBaFjKQRyHlTUf9EDcrw)My code:-export const DetectText = () => {  const [file, setFile] = useState({});  const bucketName = process.env.REACT_APP_SECRET_BUCKET_NAME;  const onSelectFile = (e) => {    if (!e.target.files || e.target.files.length === 0) return;    const reader = new FileReader();    const file = e.target.files[0];    setFile(file);    reader.readAsDataURL(file);  }  const s3 = new AWS.S3({    accessKeyId: process.env.REACT_APP_ACCESS_KEY_id,    secretAccessKey: process.env.REACT_APP_SECRET_ACCESS_KEY,    region: 'ap-south-1'  });  const detectText = async () => {    const params = {Bucket: bucketName, Key: file.name, Body: file};    s3.putObject(params, (err, data) => {      if (err) console.log(err);      else console.log(data);    });    const lambda = new AWS.Lambda({      accessKeyId: process.env.REACT_APP_ACCESS_KEY_id,      secretAccessKey: process.env.REACT_APP_SECRET_ACCESS_KEY,      region: 'ap-south-1'    });    const params2 = {      FunctionName: 'testing-lamda-function',      Payload: JSON.stringify({        Records: [{           s3:{bucket: { name: bucketName }, object: { key: file.name }}          }]      })    };    lambda.invoke(params2, (err, data) => {      if (err)console.log(err);      else console.log(data);    });  };  return (    <div>      <input type='file' id='file' name='file' onChange={onSelectFile} className='inputfile' />      <button onClick={detectText} style={{ margin: "10px" }}>Run OCR</button>    </div>  )}Please let me know what I am doing wrong. Any help or suggestion will be truly appreciated.FollowComment"

Answer: "1Accepted AnswerFrom the error message, it appears that the IAM user "User: arn:aws:iam::076465650773:user/username" does not have "lambda:InvokeFunction" permission.Try setting "lambda:InvokeFunction" to the appropriate IAM user.Also, please check the following document, as it says "because no permissions boundary".https://repost.aws/knowledge-center/iam-access-denied-permissions-boundaryCommentShareEXPERTRiku_Kobayashianswered 2 months agoRitik 2 months agoThanks now it's working after adding this InvokeFunctionShare"


Question: Verifying Rule destination on AWS IOT for Telegram Bot

"I am trying to set up a simple service where I send messages from an edge device towards AWS IOT. AWS IOT then has a rule functionality (https://docs.aws.amazon.com/iot/latest/developerguide/iot-rules.html) that allows me to route that message towards a web app or service.I have managed to do is to send messages to a topic on AWS IOT Core and save them in a S3 Bucket. Now I am trying to set up a rule to route them to Telegram. I followed a Telegram Bot tutorial and obtained a link https://api.telegram.org/bot<bot token>/sendMessage?chat_id=<chat id>&text=<my message>. I have a bot token and chat id entered in. If I substitute <my message> with my personal message and add to that my browser, my telegram channel will get the message.I am trying to have custom messages to my telegram channel based on received messages on MQTT, AWS IoT Rules Engine requires a confirmation that I can access the data sent to that endpoint. The Rules Engine issues a challenge message to the specified endpoint with a token. If I can get the token and send that back to Rules Engine, then I can prove that I have access to the data on the receiving side, which would complete the confirmation process. The message has a format like this: HTTP POST {confirmationUrl}/?confirmationToken={confirmationToken}I am seriously confused how to verify that with the link from Telegram above. According to AWS, if you control that endpoint, you can simply look in your service logs for POST requests to that resource with the confirmationToken URI query, extract that token value, and paste it back into the AWS IoT console. I guess my main questions based on the telegram link I have above would be:What is the HTTPS Endpoint I should enter for my rule action here?What is the Confirmation Url I should enter for my rule action here?How would I check for the confirmation token? I have no idea how to open the service log.FollowComment"

Answer: "0Thanks for the details regarding the question on the Rules Engine HTTP action. The confirmation process is required to ensure that unauthorized endpoints are not sent traffic from AWS IoT Core., hence the control plane method for sending the confirmation token as a specific query string (and body) key and value. The service logs in question would be with the endpoint, which in this case would be Telegram.I haven't tested with Telegram but in looking at the API, my guess that since the API URI is https://{confirmation url}/?confirmationToken={confirmation token} (where the URL could include the bot token id), it would still fail on only seeing the ?confirmationToken={confirmation token} param/value without matching the API parameters.One alternative is you could move the logic of sending messages to another rules action such as AWS Lambda (lambda action) or AWS Fargate (HTTP listener that then reformats the message and sends to Telegram via the HTTPS action and validation process above). So, store the credentials and logic to read the message from AWS IoT Core and transform to an HTTP POST that is valid for Telegram.Interested in what you come up, please let me know how it works out.CommentShareGavin_Aanswered a year ago0Hi,I've checked with Telegram Bot API and accessing the service logs isn't possible.I've switch to AWS Lambda and it works!CommentSharelohkpanswered a year ago"


Question: Amazonses.com SPF Record missing IP addresses?

"Using Amazon SES service, we have noticed that email is coming from 69.169.238.144 and failing SPF check.https://ipinfo.io/AS16509/69.169.238.0/23 indicates that this is an IP range belonging to Amazon.Using reverse lookup tools or https://ipinfo.io/69.169.238.144 indicates that 69.169.238.144 belongs to b238-144.smtp-out.us-west-2.amazonses.comSo why is this IP range not included in the SPF include:amazonses.com if this is a valid smtp-out for us-west-2?v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 ip4:69.169.224.0/20 ip4:23.249.208.0/20 ip4:23.251.224.0/19 ip4:76.223.176.0/20 ip4:54.240.64.0/19 ip4:54.240.96.0/19 ip4:52.82.172.0/22 ip4:76.223.128.0/19 -allFollowComment"

Answer: "0Hi ThereThere are two ways to achieve DMARC validation: using Sender Policy Framework (SPF), and using DomainKeys Identified Mail (DKIM). The only way to comply with DMARC through SPF is to use a custom MAIL FROM domain, because SPF validation requires the domain in the From address to match the MAIL FROM domain. By using your own MAIL FROM domain, you have the flexibility to use SPF, DKIM, or both to achieve DMARC validation.See https://docs.aws.amazon.com/ses/latest/dg/mail-from.htmlCommentShareEXPERTMatt-Banswered 4 months ago"


Question: step function PutBucketWebsite dose not allow String-argument  ERROR

"HiGetting an error in the step function when trying to use the Put Bucket Website function.when placing a string "IndexDocument": "index.html" it does not allow me  to save the function changes and states the error:software.amazon.awssdk.services.s3.model.IndexDocument$BuilderImpl (although at least one Creator exists): no String-argument constructor/factory method to deserialize from String value ('index.html')]"I tried to place an argument - it allowed me to save - but the execution failed with a similar error:{"error": "States.Runtime","cause": "An error occurred while executing the state 'Put Bucket Website' (entered at the event id #42). The Parameters '{"WebsiteConfiguration":{"IndexDocument":"index.html"},"Bucket":"thetest1"}' could not be used to start the Task: [Cannot construct instance of software.amazon.awssdk.services.s3.model.IndexDocument$BuilderImpl (although at least one Creator exists): no String-argument constructor/factory method to deserialize from String value ('index.html')]"}FollowComment"

Answer: "1Accepted AnswerLooking at the API Documentation, your configuration seems to be missing a Suffix element - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.htmlIf you look at the Javascript example - https://docs.aws.amazon.com/code-library/latest/ug/s3_example_s3_PutBucketWebsite_section.html, your JSON should be something like{"Bucket": "thetest1","WebsiteConfiguration": {"ErrorDocument": {"Key": "SomeErrorDocument.html"},"IndexDocument": {"Suffix": "index.html"}}}CommentShareEXPERTIndranil Banerjee AWSanswered 9 months agobd 9 months agoThank you, Indranil - worked perfectly.Share"


Question: Last logon/auth time

"Hi,It seems that there is currently no way to get the last logon/auth time for a user.It can be implemented with the PostAuthentication trigger. But I would like also to save IP and user agent information, can this be achieved ? Any plans to add more data to the trigger events ?Thank you in advance,JonathanFollowComment"

Answer: "0Yes, that is in the works. We heard this requirement before so I will +1 the feature request.CommentShareAWS-User-0691748answered 6 years ago0Actually, from the client if you call getDevice, it should give you all that information. That won't be available from lambda unless you authenticate the user from lambda and call the getDevice from there using the access token.Or alternatively, you can call adminGetDevice from lambda (it is available in the main AWS SDK for javascript) which only requires a username.Edited by: Ionut@AWS on Feb 21, 2017 9:16 AMCommentShareAWS-User-0691748answered 6 years ago0Hi Ionut,This was my idea in the first place and it works for first time connections but for subsequent connections it only works with remembered devices (because the DEVICE_SRP_AUTH is not happening ?).If a device is tracked but not remembered user agent, source ip and last seen informations are not updated anymore after the first login.JonathanCommentSharejogoldanswered 6 years ago0I can take this as a request to update that, but is there a blocker for you turning on device remembering?Edited by: JeffB@AWS on Mar 3, 2017 1:46 PMCommentShareAWS-User-4365954answered 6 years ago0I'm using MFA and remembered devices to suppress MFA but leave this choice to my users (opt-in). So when users choose to not remember the device, after the first login the device info is not updated anymore.CommentSharejogoldanswered 6 years ago0Understood, that's totally fair. We'll review that logic and see if we should update it.CommentShareAWS-User-4365954answered 6 years ago0Was this ever resolved? Is the "last seen" time updated for tracked only (not remembered) devices? Or it still only set when the device is first seen?On a related note, can you clarify if the "last seen" value is the last time the device accessed Cognito or the last time an access token was granted?CommentShareharry-evansanswered 4 years ago"


Question: RDS Set Up and AZ Issues

"I was told by an AWS Rep that I could limit costs from RDS by restricting the subnets my db had access to.My db worked before I did this, so I know it is the problem, but in a caviler manner, I deleted my subnets besides the one I wanted my new db in.Now I get the following error when attempting to create, despite having since created subnets in all the availability zones listed in the error."You can't create a db.t3.micro database instance because no subnets exist in availability zones with sufficient capacity for VPC and storage type : gp2 for db.t3.micro. Please first create at least one new subnet; choose from these availability zones: us-east-1d, us-east-1b, us-east-1a, us-east-1c, us-east-1f."Any Idea?FollowComment"

Answer: "0Hi, what is the tenancy of your vpc?dedicated or default?CommentShareDidier_AWSanswered a month ago0For RDS you need a minimum of 2 subnets configured. Ensure you have updated your subnet group’s configurationYour error message also reads your CIDR range is too small. I’d check the number of free IP addresses available.Your VPC must have at least two subnets. These subnets must be in two different Availability Zones in the AWS Region where you want to deploy your DB instance. A subnet is a segment of a VPC's IP address range that you can specify and that you can use to group DB instances based on your security and operational needs.CommentShareGary Mcleananswered a month ago0The number of subnets in your db subnet group do not impact the price. More subnets gives RDS more flexibly in placement of your instances.CommentShareMODERATORphilawsanswered a month ago"


Question: Lambda support for Java 17 LTS

I am in the process of upgrading the java version from Java 8 to latest Java LTS version (Java 17) and the architecture from x86_64 to ARM64 for some of my lambda functions. I am interested to know the timeline of the Amazon Corretto 17 support in Lambda.FollowComment

Answer: "0No official timeline. ( there is an Issue opened on the AWS repo )But as you probably already know you can create your own container image in the Amazon ECR container registry and run  your lambda function.Hope it helps.AlexCommentShareaaagiusanswered a year ago0Hello AWS-User-samaram,Has your problem about Lambda support been resolved? Let us know. Also, remember to click on the "Accept" button when an answer provided in the community helped you. This allows other community members to also benefit from it. Thank you for your participation.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago0I had the same need you did, so I created unofficial community AWS Lambda base images for Java 17, 18, and now 19 using the official amazoncorretto/amazoncorretto image. They're available in the ECR Public Gallery and DockerHub, and are totally free to use.Using the community base image is exactly like using the officially-supported base images. For example, the following is the Dockerfile from an example Java 17 lambda function:FROM public.ecr.aws/aleph0io/lambda/java:17.0.4-al2COPY target/hello-lambda.jar "${LAMBDA_TASK_ROOT}/lib/"CMD [ "com.sigpwned.lambda.hello.HelloLambda::handleRequest" ]Of course, these are not "official" AWS images, and as soon as official AWS images are released you should use those instead. In the meantime, these are a good option. I'm using them in production for my own projects, and they work a treat.The source code for the base images is on GitHub at aleph0io/aws-lambda-java-base-images, and there is a writeup of the base image on my blog as well, for the curious.CommentSharesigpwnedanswered 9 months ago0The Java 17 runtime for AWS Lambda was released yesterday, April 27th - official release notes here: https://aws.amazon.com/blogs/compute/java-17-runtime-now-available-on-aws-lambda/Also, a Java migration guide was released on Serverlessland which wasn't in the question but it's useful for anyone that's migrating an existing Java app to Lambda - https://serverlessland.com/content/service/lambda/paved-path/java-replatforming/access-patternsCommentShareTodd Shafferanswered a month ago"


Question: MediaLive: two overlays (GOP-aligned)

"Hello,What I want to achieve is:input: single video stream + two PNG images to overlay, image 'A' and image 'B'.output: two groups of live streams, group 'A' and 'B'.Group 'A' would contain all bitrate renditions of the input video stream with image 'A' overlaid on top of each; similarily group 'B' would contain the same but with image 'B' overlaid.Now, important requirement is that everything should be GOP-aligned so that we are later on in the chain able to on-the-fly follow a segment of 1080 rendition from group 'A' with a segment of 576 rendition from group 'B'.Now, what I understand is that I can use two separate AWS MediaLive instances. The first would produce group 'A' and the second group 'B'. As I understand, MediaLive guarantees that individual renditions coming out of a single MediaLive instance are GOP aligned. However it seems to me that there is no such guarantee that outputs of two separate MediaLive instances are aligned? Is that correct?If yes, then maybe I could somehow have only one MediaLive instance produce both groups 'A' and 'B' ? In that case however I cannot see a way to configure this single MediaLive to produce two groups of outputs with a different overlay on each?Edited by: Koltunski on Jul 28, 2020 7:06 AMEdited by: Koltunski on Jul 28, 2020 7:07 AMFollowComment"

Answer: "0Hi Koltunski,Thank you for asking this question on the MediaLive forums, unfortunately there is not currently a way to implement two images going to different outputs on a single MediaLive channel.  To do this you will need to create two channels for the different image overlays.  To overcome the timecode and GOP issues that you are looking to avoid.  I would suggest that you use MediaConnect to send your source to the two MediaLive channels and use Epoch Locking as your output locking mode in MediaLive which will attempt to synchronize each output to the Unix Epoch.Also, when using Epoch Locking there are 2 things to note, you need to have timecode on your source for this to work and scte-35 messaging is not supported when using Epoch Locking.ZachEdited by: Zacharyb-AWS on Jul 28, 2020 1:12 PMCommentShareZacharyb-AWSanswered 3 years ago0Thank you Zachary for your in-depth answer.One more question: you say that for 'Epoch Locking' to work the input video must have a 'timecode'.What kind of 'timecode' are you referring to?CommentShareKoltunskianswered 3 years ago0Hi Koltunski,Thank you for the follow up question, Video Timecode is time metadata that is assigned to a specific frame or a specific point in a video which is used for reference points and editing.ZachCommentShareZacharyb-AWSanswered 3 years ago0KoltunskiPlease see the reference to embedded timecode in https://docs.aws.amazon.com/medialive/latest/ug/timecode.htmlCommentShareAWS-User-5437070answered 3 years ago0Hello,I came back and I am trying to implement the pipeline described by Zachary in the second message of this thread.So, again: what I am trying to acheive is: a single video input, two transcoding pipelines, each on overlaying an image on top of the video, and then weave the two resulting HLS streams together by taking every other segment from each one. For this to work, the two pipelines must obviously be GOP-aligned.So far I've got two MediaLive pipelines and two inputs. Each input pulls the same HLS video source. Each MediaLive pipeline overlays a different image on top of the video; both send their output to a single MediaStore container. I stream like that for a while, stop, go to the container and edit the M3U manifests:(...)#EXTINF:10,overlay_a_720p30_00326.ts#EXTINF:10,overlay_b_720p30_00327.ts#EXTINF:10,overlay_a_720p30_00328.ts#EXTINF:10,overlay_b_720p30_00329.ts(...)so that the two streams, 'overlay_a' and 'overlay_b' are weaved together. I use Epoch Locking, and I inject embedded timecodes during the transcode.When I then watch such 'weaved' stream, it is clear that the two pipelines are many seconds apart. Thinking about it, it's not surprising - they are probaby apart already at the input and all of that timecode and locking later on cannot rectify the initial desynchronization.Zachary says that one has to 'use MediaConnect to send your source to the two MediaLive channels'.The problem is, I cannot see any way how I could create one MediaLive input of type 'MediaConnect' and then connect this one input to two MediaLive channels? The UI only lets me to use each input once?CommentShareLKoltunskianswered 2 years ago0Hi LKoltunski,Your description indicates that Epoch locking is not presently working. There are two additional requirements for Epoch locking to work successfully:The input timecode must be in UTC format.There cannot be any "complex" frame rate conversions happening in the channel. In other words, you can't take a 29.97 input and output 30.00 fps. Even multiples are OK.When Epoch locking is working properly you will see segment numbers that are based on Epoch time. In other words, the segment number will be the Epoch timestamp divided by the exact segment duration.With respect to the MediaConnect question, you need to create additional inputs with the same MediaConnect flow ARNs.Please advise if you have any other questions,Regards,SteveEdited by: AWSsteve on Feb 11, 2021 11:04 AMCommentShareSteve_Wanswered 2 years ago0Thanks Steve!So you're saying that even without MediaConnect, the following pipeline    ---> MLive input -> MLive transcode (insert timecodes & Epoch) -> MStore container   HLS  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||  --> weave into one HLS---> MLive input -> MLive transcode (insert timecodes & Epoch) -> MStore containeris supposed to stay synchronized, if Epoch locking works?Edited by: LKoltunski on Feb 11, 2021 12:01 PMEdited by: LKoltunski on Feb 11, 2021 12:02 PMEdited by: LKoltunski on Feb 11, 2021 12:03 PMCommentShareLKoltunskianswered 2 years ago0If you can supply the required number of streams to feed both MediaLive channels, yes you can do it that way. But if you only have a single source, MediaConnect can distribute the single source to the two MediaLive channels by creating two MediaLive inputs referencing the same MediaConnect flow(s).The key for Epoch locking to work is that every MediaLive pipeline is receiving the same source with the same embedded timecode (in UTC).Note another way to confirm what timecode is being received, is that MediaLive will emit a log entry in the as-run log stream for each channel showing the initial timecode.Edited by: AWSsteve on Feb 11, 2021 12:05 PMCommentShareSteve_Wanswered 2 years ago0I came back to report mixed results.About two weeks ago, I followed what Steve suggested and I managed to create this:https://4n42nbhrddyctj.data.mediastore.eu-west-1.amazonaws.com/tears_abab.m3u8(the above is a manually rewritten manifest, basically 'tears_a.m3u8' and 'tears_b.m3u8' weaved together in order to see if they are time-synchronized).If you watch this with VLC, you'll see 10-second long segments, the odd ones with a visible, large 'A' overlaid, the even ones - with a large 'B'. Transition between the 'A' and the 'B' is seamless. Epoch Locking works; I can also tell this by the way the segments are named ( 'tears_a_720p30_161339652.ts' - the '161339652' is the Epoch divided by the segment duration just like Steve was saying ).So success!However, today I was trying to re-create this pipeline, to no avail. Whatever I try, the segments which land in MediaStore are named like this: 'tears_a_720p30_00012.ts' - '00012' instead of the Epoch - and by this alone, I can tell that the synchronization is not going to work. Indeed, when I manually rewrite the manifest into an 'abab' one just like above, I can see that the 'a_000N' and 'b_000N' segments are a few seconds apart. So Epoch Locking is not working at all.I am at a loss trying to figure out why.Here's what I do:create an input of type 'HLS' , pull https://ntv1.akamaized.net/hls/live/2014075/NASA-NTV1-HLS/master_2000.m3u8  (NASA TV)Notice that the above source is at 29.97 fps = 30000/1001. It also (as far as I can tell) does not include timecode info.create a MediaLive channel, set the above as an input, configure it to add timecode from SYSTEMCLOCK ( channel->General Settings-> Timecode Configuration->  SYSTEMCLOCK ) The only point of this MediaLive is to add the timecode.configure this to output to rtp://IP:PORT, where IP and PORT is taken from the MediaConnect instance from point 5)Create a MediaConnect flow, taken note of its input IP and PORT, configure its Whitelist CIDR block so that the RTP from the previous MediaLive gets through.create two more Inputs from the MediaConnect flow.create two more MediaLive channels. Configure each one to take its input from the just created two inputs of type MediaConnect.configure the 2 channels to send their output to appropriate mediastoressl:// ... locationconfigure their template to be 'Live Event (HLS)' which creates the HSL output with 4 renditions.Set their class to be ‘SINGLE_PIPELINE'Channel → General Settings → Global Configuration → Output Locking Mode -> set this to 'Epoch Locking'.In each output rendition's settings pages, make sure that the ‘Frame Rate’ is set to ‘SPECIFIED’ and Num/Denom is 30000/1001in each of the two Channels 'General Settings' -> 'Timecode Configuration' set the timecode to 'EMBEDDED' (meaning: take the timecode from the stream, because it's supposed to be there -> it's supposed to be added by the first MediaLive instance)again for each of the two MediaLive channels, create a Schedule of type 'Static image activate' and overlay 'A.png' (first) and 'B.png' (second)create a MediaStore container (in point 8 we gave this as a location of the output)The above is, AFAIK, ecactly how I was creating this before. Only now it doesn't work.Any advice?CommentShareLKoltunskianswered 2 years ago0LKoltunskiGiven that the workflow doesn't seem to work the issue is most likely that the source does not contain timecode. In your procedure step 3 doesn't state that you enabled timecode insertion in the output. In the UDP output group, Video Settings - Codec Settings - Timecode - Timecode Insertion - Set to PIC_TIMING_SEI.If with this change you still have issues then please either open a ticket in Support Center, providing the Channel ARNs for all three channels, (fastest response), or private mail the info to me, and we will investigate the issue further.RegardsCommentShareAWS-User-5437070answered 2 years ago0Is there any more update on this topic?I am having the same issue. Only the first time try, the segment sequence number was EPOCH/segment_duration. After I edited the medialive channel (added another resolution to the output group), the sequence number was then named from 00001.ts.CommentSharejasonliuanswered a year ago"


Question: Connecting Programmatically to Amazon DocumentDB

"Hi,I'm trying to connect to the DocumentDB cluster from code (C # /. Net).I connect with Cloud9 and MongoDB Compass without any problems (In MongoDB Compass I added a .pem file in the connection options).Unfortunately, I have a problem with connecting from the code level, when I try to write data to the database, I get a timeout (I received the same message in MongoDB Compass before adding the .pem file).I did the instruction: https://docs.aws.amazon.com/documentdb/latest/developerguide/connect_programmatically.html (TLS Disabled). There is nothing in it about an SSH connection (with a .pem file).Can you tell me how to do it or what am I doing wrong?Thanks: DFollowComment"

Answer: "0There is a few troubleshooting steps I suggest to follow.Make sure that you can connect to the DocumentDB instance (establishing a TCP connection). See Testing a Connection to an Amazon DocumentDB InstanceIt's most likely that the TCP connection fails as you are getting a timeout error. If the Cloud9 instance is in the same VPC as the DocumentDB, make sure that the security group attached to the DocumentDB is not blocking inbound connection at the DocumentDB port (default port: 27017). See Security Group Blocks Inbound Connections.If you are connecting from another VPC or region, see the following: Cross Region Connections, Connecting from Different Amazon VPCsAgain, make sure that you can make a TCP connection against the DocumentDB endpoint first. If not, check the security group of the DocumentDB cluster and VPC settings (NACL, network firewall if any). If the client is in a different network, make sure there is a peering between two VPCs to be able to connect.CommentShareTaka_Manswered 10 months agoAWS-Arthur 10 months agoI answered below :DShare0ok, following your suggestions:I did a connection test, result:Ncat: TIMEOUT.I checked my Security Group and in inbound rules is added port 27017 on all tarfficaws docdb describe-db-clusters  --db-cluster-identifier test-270722 --query 'DBClusters[*].[DBClusterIdentifier,Port]'[    [        "test-270722",        27017    ]]--db-cluster-identifier test-270722 --query 'DBClusters[].[VpcSecurityGroups[],VpcSecurityGroupId]'[    [        [            {                "VpcSecurityGroupId": "sg-03b6d4320986c0f67",                "Status": "active"            }        ],        null    ]]Maybe I don't understand something, because why is testing done to the endpoint via port 27017?I read that to connect from outside the VPC you have to do it via proxy / SSH.My configuration looks like this:1.I have a DocumentDB cluster + Security Group "A" (Inbound rules: custom 27017 allowing traffic from Security Group "B")EC2 Instance + Security Group "B" (Inbound rules: TCP from anywhere + SSH port 22)And this is how I connect to DocumentDB cluster, e.g. via MongoDB Compass, I provide both, data to connect to the cluster: host, username, password and data for SSH: SSH host, SSH port, SSH username, SSH Identity File (.pem file)So, my questions are:how to properly connect programmatically from the local workstation and save the data in DocumentDB.1.what should the configuration look like in AWS (is mine correct?), Maybe I just misunderstood something in the documentation2.Do I have to configure something on the workstation, but since I can connect via MongoDB Compass, I think everything is ok in this matter3. In the programming manual it looks simple, connect to the cluster endpoint on port 27017, so why all the fuss with SSH, on the other hand, without SSH, I can't connect via MongoDB Compass. Somehow I don't understand it ...I'm missing something hereCommentShareAWS-Arthuranswered 10 months agoTaka_M 10 months agoSorry for the late reply. Thanks for the additional info. Now it's clear that you are connecting from a local workstation instead of an EC2 instance in one of the VPCs. So, if you are connecting from your local workstation, that's a different network from the VPC the DocumentDB cluster is running. Basically, you need a network connection to the VPC to make it work. In your case, you are using a bastion host to connect to the cluster (local workstation -> bastion host -> DynamoDB cluster). So, you will need to do the same from your code if you wanna follow the same setup (establish the SSH connection to the bastion host and then run the query from there). I think this article can be of help. Take a look at the Connect from a machine outside AWS using an SSH tunnel section.Additionally, make sure not to expose all your TCP and SSH connection to 0.0.0.0/0. Try to restrict it to specific IP(s) or CIDRs.Share"


Question: how to save a file while running an etl job in a fargate task?

"I have a python code for an etl job , i am planning to run as a fargate job. I am saving a docker container in ecr and pulling that to  run my task, but i need to temporarily save a text file while running that container. i know in lambda, i think we can save a file to temporary folder as such /tmp/somefile.txt, i assume as lambda or a fargate task will run in some ec2, it should be the same?FollowComment"

Answer: "0Yes, you are right. You can store the files temporarily in /tmp folder like you do in any EC2 instance, but it cannot exceed 20GiB with default settings. Please read this doc here.Also, if you want to persist the files, you could use EFS mounting.CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered 10 months ago0To add to the answer, you can definitely indeed store files locally on the filesystem in similar way to lambda / EC2. Your image + local content can go up to 20GB "for free" with every task. You can go up to 200GB of that NVMe goodness, but you have to pay for the storage above 20GB (also you have to define that at the task definition level, it doesn't magically add storage for you).But instead of EFS I'd much more recommend something a little more modern and use S3, as if you needed to do any form of automation (i.e. trigger a lambda when that temporary file is created/updated) then that's easy to do, whereas EFS won't give you that. But that very much depends on your IO pattern.EFS requires also a little more involvement in the infrastructure. Not too much but substantially more than S3.CommentShareJohnPrestonanswered 10 months ago"


Question: Accessing SageMaker Notebooks without accessing the console

"Is it possible to access SageMaker Notebooks without accessing the console?Do we have a best practice for that?In the create-presigned-notebook-instance-url command, what is the --session-expiration-duration-in-seconds: is it the validity duration of the URL or the max session duration once the URL has been clicked?FollowComment"

Answer: "0Accepted AnswerI have experimented with CreatePresignedNotebookInstanceUrl a number of times. It returns an "AuthorizedUrl" string in the form:https://<notebook_instance_name>.notebook.<region>.sagemaker.aws?authToken=<a_very_long_string>I used the URL in another browser with no AWS console's session cookies (not logged in to the console) and it worked (could access my notebooks).The parameter SessionExpirationDurationInSeconds is... well, exactly what it says, The number of seconds the presigned url is valid for. The API accepts a range of  [1800, 43200]  in seconds, which is equivalent to : 30 minutes to 12 hours .I hope this helpsCommentShareAWS-User-7712569answered 4 years ago"


Question: Error! Cannot create the fleet. Reason: Current limit of fleets of 0 have been reached

"Things were working fine last week, now whenever I try to create a fleet it gives this error:Error! Cannot create the fleet. Reason: Current limit of fleets of 0 have been reached..I have 0 fleets, and in the limits section it says I can have up to 20.This seems to be happening to others as well. I only have 2 more days to finish my project so this is very unfortunate for me. 😦FollowComment"

Answer: "0Also tried from within the CLI, no luck. same error.REMOVEDUPLOADCommentSharerePost-User-8653618answered a year ago0Am getting the same error. Popped up 3 days ago after terminating a fleet and creating a new one. Was working absolutely fine until that last fleet creation attempt.I contacted AWS support after upgrading my account to get access to technical support assistance, they've increased my Gamelift service limit for fleets but the error persists.I also tested deploying a build and fleet on another region and even created a brand new account to test and the error persists. I'm guessing this is a general account / gamelift problem?CommentSharerePost-User-8653618answered a year ago0Getting same error. Tried with two accounts and unfortunately no luck. I contacted the support and tried to increase my limits but it didn't solved the error. Is this a general problem?CommentSharerePost-User-1293119answered a year ago0Same Error here. Since ~3 Days. Support just answered: "You are receiving the error message as the default value for EC2 Fleet for your account has not been updated to 20. To resolve the issue I have reached out to the service team, and they are currently working on this.". But it worked for month before, and since other accounts are affected too, this might be a general problem.CommentSharerePost-User-4014759answered a year ago0They say this but increasing the limit doesnt fix the problem. I can now personally confirm this is a general issue with the gamelift services and all accounts connected to it.I've created two seperate, totally new accounts, also one from a different region, and the issue persists. A little trasparency and acknowledgment from AWS would be appreciate to help debug the issue. Right now they are sweeping it under the rug and making me believe my account is the problem.In the meantime I have a game community that is on hold and to which I must explain the current happenstance.CommentSharerePost-User-8653618answered a year ago0Getting the same error. We've started getting this around when we started using Organization accounts to manage multiple development environments for different developers, I wonder if it's related somehow.Creating new fleets has been impossible for many accounts for a few days now, an update from the development team would be nice.CommentSharerePost-User-7390418answered a year ago0Looks like it's about the free-tier eligible accounts and machines. I tried to create a new fleet with c5.large with an organization account that doesn't have free-tier eligibility and it worked.CommentSharerePost-User-1293119answered a year ago0Anyone has updates on this?CommentSharerePost-User-4014759answered a year ago0Glad it was sorted for you. That did not work for me unfortunetly. :/But what did work was a week of pressuring AWS Support. Finally unlocked my restrcition! 🥳CommentSharerePost-User-8653618answered a year ago0@REDACTEDUSERCommentSharerePost-User-9736231answered a year ago0You have to send a message to AWS support. Can take a few days to a week but eventually they'll respond. Really a bummer of an error.CommentSharerePost-User-8653618answered a year ago0Hi folks, if you run into this error, please follow these steps to get your limits increased.Go to https://us-east-1.console.aws.amazon.com/support/home?region=us-east-1#/case/createSelect "Service Limit Increase"In "Limit type", select "GameLift"In "Requests", select your region. If you need multiple regions, select "Add another request" and select more regionsIn "Case description", specify the following informationInstance typeDesired limitSubmitCommentSharerePost-User-7108006answered a year ago0Thank you, finally this works!Regards, John, web-designer, WorkTimeCommentSharerePost-User-0084621answered a year ago"


Question: RDS upgrade from PG 12.7 to 13.3 fails due to missing libraries

"I started from a PG 11.2 database.  I was able to first upgrade PostGis, then the upgrade the database to 12.7I then upgrade postgis extensions (to 3.0.3new).However, The upgrade to Postgres 13.3 failed with this error message:Your installation references loadable libraries that are missing from the new installation. You can add these libraries to the new installation,or remove the functions using them from the old installation.  A list of problem libraries is in the file:loadable_libraries.txtHow can I workaround this?  There is only schema with Postgis enabled, and I did upgrade postgis before trying to upgrade the server.I really don't want to have 8 hours of downtime to restore this 350 GB database into PG13.StanFollowComment"

Answer: 0I talked with someone at AWS.  The postgis upgrade from 12.5 to 13.3 requires TWO steps.  Summary is below:-- Sequence on PG 12.x-- primary upgrade of postgisSELECT postgis_extensions_upgrade();-- Reboot instance!-- now Some parts of postgis are not yet upgraded!-- confirm by checking this result still has "2.5"select probin from pg_proc where proname = 'postgis_raster_lib_version';-- Do the upgrade againSELECT postgis_extensions_upgrade();-- result of this query should be "raster-3"select probin from pg_proc where proname = 'postgis_raster_lib_version';-- Now the to upgrade to postgres 13 workedCommentSharesknutsonanswered 2 years ago


Question: Plesk Lets Encrypt Certificate Auto Renewal

"Hi,I am just getting started with Plesk on Lightsail. I have successfully issued an SSL to my domains. However, I keep getting errors when the system tries to auto renew the certificate. I cannot seem to find an answer. Can anyone one help or point me to some documentation?Here is the email I keep getting...Could not secure domains of admin (login admin) with Let`s Encrypt certificates. Please log in to Plesk and secure the domains listed below manually.Securing of the following domains has failed:'example.ca'Missed domain names failed to pass validation: webmail.example.caThe following domains have been secured without some of their Subject Alternative Names:<none>  Could not renew Lets Encrypt certificates for admin (login admin). Please log in to Plesk and renew the certificates listed below manually.   Renewal of the following Lets Encrypt certificates has failed:FollowComment"

Answer: 0Had to change TXT record in domain zones in lightsail to have the proper subdomain which was "_acme-challenge.example.ca"CommentShareBrooksyanswered 3 years ago


Question: Proper way to interact with resources/services outside of GG v2

"Hi,We have a MQTT events flow generated outside of Greengrass Core on IoT device and we want to forward those events to AWS IoT Core using custom forwarder deployed as Greengrass component. It seems a few options are available.Use 3rd-party MQTT broker running outside GG core environment. It aggregates all events and provides some topics to subscribe to. GG component subscribes to these topics and once a new event appears, it pulls it, transforms it if needed and publishes to IoT core topic through IPC. GG component is a generic or lambda-based component written in Python so it is possible to use 'paho-mqtt' package to connect to external MQTT broker and 'awsiotsdk' to communicate to Iot Core via IPC. Looks fine in general. Custom authentication and authorization mechanizms can be implemented in MQTT broker and it's independend from GG.The same custom MQTT broker as in #1 but deployed as GG component. External datasources publish their events the same way but lifecycle of this broker is managed by GG because it is its component. Not bad, but it looks a bit redundant because GG v2 has it's own internal topics to be used to connect different components to each other.Use IPC and internal GG topics directly. External datasources publish events directly to these topics. This idea appeared base on this discussion - https://github.com/aws/aws-iot-device-sdk-python-v2/issues/145. Looks promising because in this case we use native GG mechanisms without any additional resources. The problem is authentication and authorization. In order to connect to internal topic we need to have AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT and SVCUID. AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT is static but I guess SVCUID is generated for each component individually and updated periodically. It raises some security concerns how to get this info from external processes, where to store it and how to change. But at least this approach exists and can be potentially used.So the question is which approach could be considered as the most proper, well-architectured and secured? I think GG developers team thought about this scenario and maybe they have some recommendations. Is #3 just a dirty hack or is it one of the 'official' ways to pass events to GG/IoT from outside? Maybe other options which I missed?Thanks in advance.Edited by: lacteolus on Feb 18, 2021 1:58 AMFollowComment"

Answer: "0Hi,3 should not be used as your are basically breaking the Greengrass authentication and authorization system's intent. It certainly can be done that way, but I would really caution against it. Either #1 or #2 makes the most sense to me; so much sense in fact that we've already implemented an example of this solution https://github.com/aws-greengrass/aws-greengrass-component-examples/tree/main/mqtt-bridge.This example code must be treated exactly as that, an example. It does not implement any security above username+password and has very minimal error handling. You can have a look at it to give you a head start, but I would tell you to not deploy it as-is into a production environment as it has not been tested to those standards.Hope that helps,Michael DombrowskiCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0@lacteolus I've done #1 using the exact method you described, and it works reliably. Two things to consider:Spooling from GG to IOT Core is only memory-backed at the moment, there's no persistent message storage if your device goes offline. May/may not be a deal breakerI think there's a tiny leak in the python IPC code : https://github.com/aws/aws-iot-device-sdk-python-v2/issues/149There's a another way which i'm starting to consider, and that's using StreamManager ( https://forums.aws.amazon.com/thread.jspa?threadID=335746&tstart=0  )- which does persistent message storage, but you'd need to run a lambda in AWS to push data from a kinesis data stream to IoT Core.CommentShareiamalsohereanswered 2 years ago0As I know AWS has plans to add "world-facing" broker as part of greengrass core. I think it would help to communicate components and other services running on device.CommentSharelacteolusanswered 2 years ago"


Question: IoT Events custom JSON payload not working

"I'm trying to use IoT Events custom payload with Lambda action. When I pass a JSON list format data from input and use it in the Lambda Action with JSON payload the following error occurs: We couldn't parse your content expression for the payload of LambdaAction. Enter a content expression with the correct syntax.Code example: {                       lambda: {                         functionArn: consumer.functionArn,                         payload: {                            contentExpression: "{\"deviceId\": \"test\", \"applianceId\": \"another test\"}",                           type: 'JSON'                         }                       }                     }The answer from https://repost.aws/questions/QUJ23sjtbVTMSmG4JzITEK1g/io-t-events-custom-payload-error not working.Did something change?FollowComment"

Answer: "0I used the kind of content expression you have provided in the question and I could get the desired response with Lambda action."{    \"deviceId\": \"test\",     \"applianceId\": \"another test\"}"Event received by Lambda isReceived Event is: {'deviceId': 'test', 'applianceId': 'another test'}For the custom payload expression, you can specify the payload in following format for JSON payloads."{    \"variable1\": \"${$input.my_input.stringVariable}\",     \"variable2\": ${$input.my_input.numberVariable}}"#input.my_input.stringVariable is returning a string, and#input.my_input.numberVariable is returning a numberThis translates into the following when the DM is exported or described via API."\"{    \\\"variable1\\\": \\\"${$input.my_input.stringVariable}\\\",     \\\"variable2\\\": ${$input.my_input.numberVariable}}\""May be you could try double-escaping the string values for creating the detector model from CLI.CommentShareHarshil_Sanswered a year ago"


Question: RDS Proxy on MySQL Lambda Function (C# .Net Core 3.1 Runtime)

I have a Lambda function written in c# .net core 3.1 runtime. In which I am using MySQL for some DB-related stuff. I want to use RDS Proxy on this function (will apply to other functions later) as my application is making too many connections. I've searched on the internet about how to apply RDS Proxy in code level with MySQL connector in c# (.NEt core 3.1 runtime) but couldn't find anything helpful. I  want to integrate proxy settings on MySQL connector object but as my finds on the internet MySQL doesn't support settings for proxy. I'll really appreciate it if you can provide any code sample for connecting MySQL with rds proxy in c#.FollowComment

Answer: "1Check this article out :)You don't need to add proxy, you just need to change the connection string in your Lambda, everything else is handled by AWS.Of course, you need to set up RDS Proxy, but in the code, there is almost nothing to be done and it doesn't matter if you are using .net.CommentShareMGanswered a year agoJahangeer Ahmed a year agoI have this line here, When I pass the rdsProxyEndpoint it gives an error (mentioned below). It is failing because the connection string isn't good or in a standard format. I have tried to hard code the RDS Proxy Endpoint but it still gives the same error. Any solution for this?DbConnection connection = new MySqlConnection(rdsProxyEndpoint); //error appears hereError: Format of the initialization string does not conform to specification starting at index 0ShareMG a year agoI think there must be something wrong in the connection string hmmmCould you verify your connection string using this article?You can also check this thread about how connection string should be formatted.Share"


Question: Domain registration failed

"I have status: Domain registration failed: [Parameters in request are not valid].All that I see in route 53 it is this notification about registration failed, other tabs like a 'Registered domains', 'Pending requests' are empty. And I don’t know what to do now to resolve this problem, I can’t find where I should change this parameters to register done, or return my money that I spent on this.FollowComment"

Answer: "0HiCan you provide some more details?  Are you transferring a domain or registering a new one? What is the TLD?Also can you take a look at this article and see if it applies to your case?https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/troubleshooting-domain-transfer-failed.html#troubleshooting-domain-transfer-failed-parameters-in-request-are-not-validCommentShareEXPERTMatt-Banswered 9 months agosinica15 9 months agoit is new domain registered using route 53, TLD is .comShare"


Question: "Need to load column having comas (,) in csv file"

"Hi ,I need to load the data address colum in redshiftAddress"{""Source"":""MITS_SMTP"", ""Machine"":""ATL1S""}"I have given the below propertiesROW FORMAT SERDE'org.apache.hadoop.hive.serde2.OpenCSVSerde'WITH SERDEPROPERTIES ('separatorChar'=',')STORED AS INPUTFORMAT'org.apache.hadoop.mapred.TextInputFormat'OUTPUTFORMAT'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'LOCATION'S3 path 'TABLE PROPERTIES('skip.header.line.count'='1','data_cleansing_enabled'='true','invalid_char_handling'='REPLACE','replacement_char'=',')The data is loading as "{""Source"":""MITS_LOG"" in the address colums .Can you please guide what needs to be done to get this sorted ..FollowComment"

Answer: "0Hello,Thank you for reaching out to us. Please find the details below :The following example shows the contents of a text file with the field values separated by commas.12,Shows,Musicals,Musical theatre13,Shows,Plays,All "non-musical" theatre14,Shows,Opera,All opera, light, and "rock" opera15,Concerts,Classical,All symphony, concerto, and choir concertsIf you load the file using the DELIMITER parameter to specify comma-delimited input, the COPY command fails because some input fields contain commas. You can avoid that problem by using the CSV parameter and enclosing the fields that contain commas in quotation mark characters. If the quotation mark character appears within a quoted string, you need to escape it by doubling the quotation mark character. The default quotation mark character is a double quotation mark, so you need to escape each double quotation mark with an additional double quotation mark. Your new input file looks something like this.12,Shows,Musicals,Musical theatre13,Shows,Plays,"All ""non-musical"" theatre"14,Shows,Opera,"All opera, light, and ""rock"" opera"15,Concerts,Classical,"All symphony, concerto, and choir concerts"Assuming the file name is category_csv.txt, you can load the file by using the following COPY command:copy categoryfrom 's3://mybucket/data/category_csv.txt'iam_role 'arn:aws:iam::0123456789012:role/MyRedshiftRole'csv;Alternatively, to avoid the need to escape the double quotation marks in your input, you can specify a different quotation mark character by using the QUOTE AS parameter. For example, the following version of category_csv.txt uses '%' as the quotation mark character.12,Shows,Musicals,Musical theatre13,Shows,Plays,%All "non-musical" theatre%14,Shows,Opera,%All opera, light, and "rock" opera%15,Concerts,Classical,%All symphony, concerto, and choir concerts%The following COPY command uses QUOTE AS to load category_csv.txt:copy categoryfrom 's3://mybucket/data/category_csv.txt'iam_role 'arn:aws:iam::0123456789012:role/MyRedshiftRole'csv quote as '%';Reference :-https://docs.aws.amazon.com/redshift/latest/dg/r_COPY_command_examples.htmlThank you !CommentSharePriyaAWS2020answered 10 months ago0I am not using command .I am loading using redshift external table .Would be helpful if you could detail the serde propertiesCommentShareAWS-User-4439582answered 10 months ago"


Question: AWS Cognito for iOS (AWS Amplify related)

"I'm using AWS Cognito in my backend (NestJS) and want to integrate it with my iOS app. In that case, is there any library that I should use? Because most examples I see are with Amplify, I'm only going to use Cognito, for auth, and EC2 to store the backend. So, trying to summarize my question: Should I use the Amplify lib when I'm only using Cognito? And if I use Amplify and Amplify Cognito plugins to handle authentication, should I also consider Amplify pricing too?FollowComment"

Answer: "0Yes, it makes sense to use Amplify for Swift, even if you use only the Authentication (Cognito) plugin.Amplify Swift libraries provide high level abstraction that keep you free from low level AWS API details.If you want full control and code it yourself, the alternative is to use the AWS SDK for Swift (in preview)To answer your last question about pricing: Amplify libraries and command lines are free to use.  You only pay for the AWS resource it creates for you (like a cognito user pool)CommentShareSebastien Stormacqanswered 4 months ago-1You can use the following: amazon-cognito-identity-js. As noted here, the package will be hosted as part of the Amplify repo.CommentShareRajarshi_Danswered 8 months agorePost-User-6097675 8 months agoSo on my backend service, I only receive the JWT that Cognito should return. All the authentication flow should be on the device, so I would use a Swift package to deal with sign-in, in that case, should I should AWS Amplify (https://github.com/aws-amplify/amplify-ios)? Or, is there any other library that uses only Cognito?Share"


Question: Debugging Cloudfront with multiple origins (S3 + API Gateway) : path pattern not working.

"I have set up a cloudfront instance with 2 origins (frontend and backend) for a relatively simple SPA app with a KOA backend.When either origin is set as the default (*) behavior, it works exactly as expected.  Whenever I add a second origin (i.e. path pattern /v1/* ), it fails to recognize the pattern and instead tries to load the resource from the default (*) origin.  I can flip back and forth by just changing which the default is pointing at, and that origin works fine, but the second path is never accessed.The precedence is0: /v1/*  , APIGateway (origin path = "/Prod"1: default(*) , S3calling xxx.cloudfront.net/v1/test gives me a blank page from the react frontend (i.e. I see all the metadata, and the same as xxx.cloudfront.net/nonsense).calling xxx.cloudfront.net/ launches the frontend, as expected.calling xxx.execute-api.us-west-2.amazonaws.com/Prod/test gives me "Hello World"Currently in the process of putting a bullet in it and running two cloudfronts (and all the CORS headaches that entails)FollowCommentrePost-User-0948785 4 months agoI have the same issue. Did you manage to resolve this?Share"

Answer: 0I recommend you get in touch with AWS Support for help with this.The only other suggestions I have for you are to ensure you have read the documentation: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html and/or to try out this CloudFront workshop: https://catalog.us-east-1.prod.workshops.aws/v2/workshops/9331108e-464e-4699-8a9c-486090105878/en-US/ to see if you can identify what might be wrong with your own distribution.CommentSharePaul_Lanswered a year ago


Question: Count concurrent users

"Is there any way to count concurrent WATCHING (streaming) users by MediaPackage, MediaLive or CloudFront? Yes, Lambda@Edge+Cloudfront would be a solution for a self created measurement tool ... but is there no way to count concurrent users?FollowComment"

Answer: "0VideoTaxi wrote:Is there any way to count concurrent WATCHING (streaming) users by MediaPackage, MediaLive or CloudFront? Yes, Lambda@Edge+Cloudfront would be a solution for a self created measurement tool ... but is there no way to count concurrent users?Hi VideoTaxi,The dimensions you mention measure different things.An end user on your stream (ie: someone who is playing back a URL that ends at CloudFront) can only be measured from CloudFront data. CloudFront is the only place where you would be able to get data around how many people are WATCHING your stream.Only some of the hits you get on CloudFront will pass through to MediaPackage. Others will be served content from CloudFront cache and therefor will not register with MediaPackage. MediaPackage exposes the hits it receives to CloudWatch. You can read more about which metrics are published here: https://docs.aws.amazon.com/mediapackage/latest/ug/metrics.html. The metric you are looking for is called "EgressRequestCount". Note that those are only the requests that aren't being served by CloudFront directly.MediaLive has no concept of "players connected to your stream". Since MediaLive only encodes and "pushes" content out.I hope this helps. Please let us know if you have any further questions!Kind Regards,ThijsCommentShareThijsBanswered 4 years ago0Hi Thijs,thanks for your helpful answer. So you are suggesting tracking infos directly in CloudFront and do that over the logs (not really real-time) or the Lambda@Edge functions (real-time), correct?Thanks so much, AndreasCommentShareVideoTaxianswered 4 years ago0Hi Andreas,Yes, you should either parse the logs that cloudfront can provide you. Like you said, this would not be real-time. The alternative is to run a lambda@edge every time a request comes by to log whichever details you are most interested in.I hope this helps! Please reach out if there are any followup questions you might have!Kind regards,ThijsCommentShareThijsBanswered 4 years ago0Thanks for helping out!CommentShareVideoTaxianswered 4 years ago"


Question: How to delete CloudFormation

"Lambda function you created, the function fetches RDS_HOSTNAME and RDS_PORT environment variables but unable to delete the stack.  The Lambda function was manually deleted but still unable to delete the stack.aws lambda invoke --function-name YOUR_FUNCTION_NAME --region YOUR_REGION output.jsonFollowComment"

Answer: "0Hi,Is there a specific error stating why deletion failed?Can you try going through this and see if something is missing? https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html#troubleshooting-errors-delete-stack-failsCommentShareEXPERTalatechanswered 2 months ago"


Question: CloudFront with EIP as origin

"Hello,I'm looking for some confirmation that traffic flowing through an EIP as an origin for CloudFront will not result in charges between Cloudfront and the EIP.If you are using an AWS origin, effective December 1, 2014, data transferred from origin to edge locations (Amazon CloudFront "origin fetches") will be free of charge. This applies to data transfer from all AWS regions to all global CloudFront edge locations.This is my understanding, but looking for some confirmation in case I'm missing something special with EIPs.ThanksFollowComment"

Answer: "0Accepted AnswerYes, that is correct. There will be no data transfer out charge from EC2 (EIP) to CloudFront. The customer will only be charged for data transfer out to the Internet from CloudFront.CommentSharetirthatawsanswered 3 years ago"


Question: AWS Connect Voicemail Template Fails to Deploy

"I am trying to install voicemail template (https://docs.aws.amazon.com/pdfs/solutions/latest/voicemail-for-amazon-connect/voicemail-for-amazon-connect.pdf) on my aws account although I am getting the following error while deployment which causes the whole deployment to fail:CREATE_FAILED: Embedded stack arn:aws:cloudformation:eu-central-1:######:stack/AWSVoiceMailStack-VoicemailStack-#######/###### was not successfully created: The following resource(s) failed to create: [CognitoUserPoolUserPool, ApiGatewayRestApi, ApiGwAccountConfig].I've tried to set a totally unique name on the userPool prefix, as this was a common issue with this template but still didn't work. Unfortunately I don't know what other info could be helpful about it but I can provide it later.FollowComment"

Answer: "0I tested deployment in eu-central-1 and didn't run into any issues with the latest template.  Does the IAM user/role you are launching the template with have appropriate permissions?  If you drill down in the events for the failing stack, are there any further details under those specific resource creation failures?  If you try to create the resources manually, do you run into any issues?CommentShareAWS-TimGanswered 8 months ago"


Question: Elastic Disaster recovery agent

"Hello, I am having an issue with Elastic Disaster recovery agent.Everything was working fine and the machine was fully replicated to AWS, However all of a sudden I got the error that AWS Agent is not seen.And a Lag of 3days with no other logs.  Can anyone help with this ?FollowComment"


Question: Error fetching list of subscribers

Error fetching list of subscribersFollowComment

Answer: "0Hello Customer,Thanks for your patience. I would like to inform you that, the error message you are observing when scheduling an email report is an unexpected behavior.Kindly try the following options to see if any method mitigates the issue :As suggested in the error message, delete and re-create the report.Clear the browser cache and attempt to re-create the report.Attempt to create the report in an incognito or a private browser window.To isolate and test the issue, also try to create the report from a different browser.After following the above, if the issue still persists, please open a support case with the AWS QuickSight support team using this LINK in order to investigate further into the root cause of the issue.CommentShareSai_Canswered 7 months ago"


Question: EC2 migration to VPC error systems-manager/automation verifySecurityGroup

"Hi,I tried to migrate my EC2-classic to VPCBefore using wizard "systems-manager/automation", i have only create an new Security Group in my standalone VPC.My VPC and my EC2 server are all in Ireland, why this error ?I just use "Test" and get security group id created just beforeHow could i resolve it ?RegardsStep fails when it is Poll action status for completion. Traceback (most recent call last): File "/tmp/6c97ba4a-da4f-4e64-9657-1340b5e9d1e1-2022-05-02-16-03-47/customer_script.py", line 186, in verifysecurityGroup raise Exception('[ERROR] Security Group and Subnet are not in same VPC') Exception: [ERROR] Security Group and Subnet are not in same VPC Exception - [ERROR] Security Group and Subnet are not in same VPC. Please refer to Automation Service Troubleshooting Guide for more diagnosis details.FollowComment"

Answer: "0Hi thereAccording to the error you receive, go to the VPC console, check which VPC is your SubnetID that you are using. Your Security Group must be from the same VPC.The following  command describe-subnets example uses a filter to retrieve details for the subnets of the specified VPC.aws ec2 describe-subnets --filters "Name=vpc-id,Values=vpc-06e4ab6c6cEXAMPLE"The following coomand will displays information about the security group with the ID sg-88888.aws ec2 describe-security-groups --group-ids sg-88888 --region us-west-2Reference :https://docs.aws.amazon.com/quicksight/latest/user/vpc-finding-setup-information.html#vpc-subnet-idCommentShareNosiphiwoanswered a year ago"


Question: ACM Renew issue with Correct DNS

I have problem to verify (renew) ACM Certificate for domain. Verification is by DNS and DNS are correctly set. Renewal eligibility is "Eligible". Certificate is associated with Load Balancer. This is the 3th renew. Renewal status is still "Pending validation" 15 days before expiration. Can anyone help?FollowComment

Answer: "2Hi,Please, check the troubleshooting guide here: https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-renewal.html, but usually the problem is related with the CNAME configuration in your DNS. I assume that you did this several days ago so it should not be a propagation problem. Check the DNS configuration using some web query tools to be sure that the register is resolved correctly. Again, i think you have a problem with the DNS.As explained on the documentation if the certificate is active in an AWS Service, and the DNS is ok, it should automatically autorenew starting 60 days before the expiration. The system check for it every hour.If none of this works, please contact support team to check the reason.Best,CommentShareJuanEn_Ganswered 9 months agoEXPERTToni_Sreviewed 9 months agorePost-User-0767091 9 months agoThanks for the reply, I will have to contact AWS support, DNS are correct.Share0Adding CAA records into my DNS records solved my problem.Info about CAA records:https://aws.amazon.com/premiumsupport/knowledge-center/acm-troubleshoot-caa-errors/More info:https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-caa.htmlhttps://docs.aws.amazon.com/acm/latest/userguide/setup-caa.htmlCommentSharerePost-User-0767091answered 8 months ago"