Question: It there a way to add Exponential Backoff to AWS:ExecuteAutomation in an SSM Automation Document?

"Put simply, I have written an SSM Automation. It creates a snapshot of each of the attached volumes of a targeted instance, by getting a list of Volume Ids from a DescribeInstance call. It then utilizes Rate Execution of a second runbook, in an AWS:executeAutomation action, which creates each snapshot, fanning out on those volume ids. As you can see, I have already limited MaxConcurrency of this step to 1.{ "name":"SnapshotAllVolumes", "action":"aws:executeAutomation", "maxAttempts": 3, "onFailure":"Abort", "inputs":{    "DocumentName": "MyCustomCreateSnapshotRunbook",    "Targets": [       {         "Key": "ParameterValues",         "Values": [           "{{ DescribeInstance.CurrentVolumes }}"         ]       }     ],    "TargetParameterName": "VolumeId",    "RuntimeParameters": {       "InstanceId": "{{ InstanceId }}",       "InstanceName": "{{ GetInstanceName.Name }}"    },    "MaxConcurrency": "1" }Where I have gotten into trouble is I am attempting to execute this runbook via Maintenance Window on ~60 instances, each averaging about 3 EBS volumes. I keep crashing into a rate limit on the above step.Step fails when it is Executing. Fail to start automation, errorMessage: Rate exceeded. Please refer to Automation Service Troubleshooting Guide for more diagnosis details.Unfortunately, it doesn't tell me exactly which rate limit I'm hitting, but I think I can assume it is one of two: either the limit on api calls, or the limit on simultaneous SSM rate executions. Because the latter is much more restrictive(25 is the max), I think it's my most likely suspect. I've been dialing down the concurrency limit on my Maintenance Window. If my assumption about rate limit is correct, I need to stay under 25 concurrent Rate Executions.With the max concurrency of 1 on the child runbook, no individual execution of the parent runbook should lead to more than 2 simultaneous rate executions(the parent, and x*(number of volumes) consecutive executions). This means my concurrency rate for my maintenance window needs to keep below 25/2, so I've reckoned my max safe concurrency is a mere 12.Talking all this over with support, the solution recommended was to implement some sort of exponential backoff on the retries here. That way the calls that are rate limited on the first attempt are retried at different times, et al. This could be done through code if resorted to invoking a lambda that executed the child Automation, instead of executing directly in the Parent Runbook.I'd much rather not need to introduce a dependency on a Lambda here. I was wondering if anyone has a way to implement incremental backoff purely in SSM automation? Perhaps it isn't even possible?FollowComment"

Answer: "0Hello, thank you for your post. Regarding implementing incremental backoff purely in SSM automation, this cannot be directly enabled. The closest option is setting an error threshold on the Run Command page in the SSM console. Reviewing the information you provided, I suspect your document named MyCustomCreateSnapshotRunbook makes use of the CreateSnapshot API or CreateSnapshots. I suspect this is the API for which you are hitting a rate limit. I do recommend you use the CreateSnapshots API, as it takes an instance ID as input and creates snapshots for all volumes attached to the instance[1] - this would make it less likely to reach a rate limit which could occur if the CreateSnapshot API were repeatedly called for individual volume IDs.As the issue you are facing involves details that are specific to your use case and the resources in your account, I encourage you to open a support case so that our support team can review the API calls that were made and the specific errors that were encountered. This will allow us to provide your better guidance to resolve the issue.References:[1] https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSnapshots.htmlCommentShareSUPPORT ENGINEERAWS_SamManswered a year ago"


Question: Can't remove wildcard certificate

"I have a wildcard certificate, which is associated with 3 load balancers. The use case was to add it to custom domains for API Gateway, but I decided to delete them and the certificate. And although I tried to remove all custom domains, the certificate is still shown as in use. These load balancers' ARNs do not match any of the custom domains that I have. What could be done to delete this certificate?FollowComment"

Answer: "0Hi,It may take some time once you've removed all the associations to reflect. Try it again as its been 2 days since you've posted the question.Here are some useful documentations:https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-delete.html - Delete using console and CLIhttps://docs.aws.amazon.com/acm/latest/userguide/gs-acm-describe.html- Find the association using ACM describe.Also verify the region is correct.CommentShareAWS-CSinghanswered 5 months ago"


Question: SQS Step Function Poller without Lamda

"Typical Pattern to execute Step function for an SQS Event is to create Lambda with SQS Event Source Mapping and run an express step function synchronously within Lambda. If step function fails, error can be thrown out of lambda, which keeps the message in SQS and will be retried by poller, after visibility timeout.This process has one key disadvantage. During the step function process, Lambda also stays active and hence we will be paying for execution of both.Alternatives:If we execute step function asynchronously,We can't use SQS + Lambda Retry, since we mark Lambda process as success and message is deleted from SQS.We also can't use FIFO SQS, since message will be removed before the event is fully processed by step function and next one is queue with group id might be picked up right away.Question:Are there any alternate designs without writing our own SQS poller?If we need to write a poller, how can we effortlessly scale , like AWS Event Source Poller does?FollowComment"

Answer: "0I don't think this is going to be easy either way: Either you write some custom code for the poller/waiter/asynchronous process (so there's complexity there as well as cost, maintenance, etc.) or you continue to do what you're doing (having the Lambda function wait - which is cost but far less complexity).Yes, there are ways to do this: For example, you could have the Lambda function store the status of the SQS message in a database (DynamoDB for example) so that you can track the in-progress items; but now you're recreating the queue logic in a separate place.You hint at something but don't directly say it: It sounds like you (a) need to process the messages in order and (b) only want to process a certain number at a time. Why is that? Is there a threshold load on a back-end system that can't be exceeded?It might be possible to provide another solution if you could give more context to what you're trying to achieve.CommentShareEXPERTBrettski-AWSanswered 7 months ago"


Question: uploading a file to aws s3 is failed

when i uploaded a file to aws s3 through aws cli it is showingCould not connect to the endpoint URL: "https://demoo0.s3.ap-south-1.amazonaws.com/AWS.docx"not only aws s3 for every aws services it is showing same errorif anyone came across same error please solve it?FollowComment

Answer: "0Should the endpoint be  "https://demoo0.s3.ap-south-1.amazonaws.com"?CommentShareronald_lanswered 9 months agorePost-User-7451843 9 months agohow to check the end point?Share0how to check the end point?CommentSharerePost-User-7451843answered 9 months ago0Hi ThereAre you using an ec2 instance to run the CLI?  Have you verified that the EC2 instance has internet access?  If its in a private subnet, verify that the instance can reach the internet via a NAT gateway.  If in a public subnet, verify that it has an elastic IP attached.To troubleshoot this error, check the following:    Confirm that you're using the correct AWS Region and Amazon S3 endpoint.    Verify that your network can connect to those Amazon S3 endpoints.    Verify that your DNS can resolve to those Amazon S3 endpoints.    If you're seeing this error on an Amazon Elastic Compute Cloud (Amazon EC2) instance, then check the Amazon Virtual Private Cloud (Amazon VPC) configuration.Please take a look at this KB article detailing the troubleshooting steps for this errorhttps://aws.amazon.com/premiumsupport/knowledge-center/s3-could-not-connect-endpoint-url/CommentShareEXPERTMatt-Banswered 9 months ago"


Question: What AWS services I can use to buid a web application that our government uses to distribute fuel

"Hello,I am from Sri Lanka and some of you might know the country is going through a major economic and political crisis. As a result we have no fuel. To distrubite this scarce resource, the government has intrroduced a web application where you can register with your details and it gives you a QR code which you can show to gas station to pump fuel. This has brought in so that people can't pump fuel multiple times. This has to serve millions of people. Highlevel operation of the webapplication is,Input Name, Phone No, Driver License No, Vehicle No, Vehicle Chassy No.You receive an OTP and register for an account.Generate QR code.Login with OTP.https://fuelpass.gov.lk/Can anyone help me to understand what AWS services I can use to build this web application including the frontend. Thanks in advance.FollowComment"

Answer: "0There are multiple ways you can build web applications on AWSYou can use Honeycode to build the front-end - https://docs.aws.amazon.com/honeycode/latest/UserGuide/what-is.htmlhttps://www.honeycode.aws/You can build static websites on Amazon S3 - https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteHosting.htmlYou can use Cloudfront as a CDN for your website - https://docs.aws.amazon.com/AmazonS3/latest/userguide/website-hosting-cloudfront-walkthrough.htmlYou can also use AWS Amplify as a framework for building web applications - https://aws.amazon.com/amplify/For exposing REST APIs that your web application may call, you can use Amazon API Gateway - https://aws.amazon.com/api-gateway/For the backend microservices, you can useAWS Lambda if you want a completely serverless event-driven framework - https://aws.amazon.com/lambda/If you want to build your microservices to run on containers, you can use Amazon Elastic Containers Service - https://aws.amazon.com/ecs/, or Amazon Elastic Kubernetes Service if you prefer a managed Kubernetes - https://aws.amazon.com/eks/If you are using a third-party framework like Wordpress or the LAMP stack, you can also host your web application on Amazon EC2 machines, just like you would in your own data center -https://aws.amazon.com/getting-started/hands-on/build-wordpress-website/https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-lamp-amazon-linux-2.htmlFor security of your application, AWS offers a number of services that have been summarized here - https://aws.amazon.com/products/security/CommentShareEXPERTIndranil Banerjee AWSanswered 10 months ago"


Question: Allow restoring tables from RDS snapshot directly into an RDS instance

Please create a feature which allows to easily load a list of [database].[schema].[table] from an RDS snapshot directly into a target instance->database->schemaAlso add an option for a custom prefix to be added to the original imported tables name.(Return an error if tables already exist in target schema)FollowComment

Answer: "0Thanks for your feedback. We will pass this feature request to the relevant team. Is this something for specific engine or in general?CommentShareEXPERTAWS-User-Nitinanswered 6 months agoYoni Sade 6 months agoI think it should be available for all RDS engines since snapshots are a general feature, but if I needed to choose a priority then:MySQL->MariaDB->PostgreSQL->SQL Server->OracleShareAWS-User-Nitin EXPERT6 months agoThanks, I will take a noteShare"


Question: S3 copy from one folder to another

"I have requirements to copy small small huge number of files from one folder recursively under S3 bucket to another folder path periodically or once it arrives in source location.Source location: bucket_name_1/folder1/folder2/name123.csvbucket_name_1/folder1/folder3/name127.csvbucket_name_1/folder1/folder4/name128.csvtarget copy location:bucket_name_1/folder_bkp/folder2/name123.csvbucket_name_1/folder_bkp/folder3/name125.csvbucket_name_1/folder_bkp/folder4/name126.csvcan you please help to get this done using less cost, easy to setup and efficient to do this?FollowComment"

Answer: "2Hi,If your use case requires copying the file once it is created at source location, a common solution is to configure an S3 Event Notification and invoque a Lambda function to execute your logic (in this case, copy the file to another path).However, if the number of files is huge, it is better to configure the notification from S3 to SQS, and then process the events in batch through the lambda function.Note: As described in the official documentation, event notifications are delivered in seconds but can sometimes take a minute or longer.CommentShareMikel Del Tioanswered a month agorePost-User-8752939 a month agoYes this can be used but as I mentioned earlier, source file will be huge and huge in number which can throttle the Lambda, it may find concurrency limit to execute like problems.ShareMikel Del Tio a month agoTotally agree! I just edited the answer but you had answered before.SharerePost-User-6187323 a month agoHI Mikel, thanks for this approach,where will be that batch option available? SQS or Lambda? So that Lambda will not be triggered for every small files with instance rather, Lambda should be triggered batch like may be 100 files.ShareMikel Del Tio 25 days agoHi, The batch options are configured at the lambda trigger, using Batch size, and Batch window properties. The next page shows how to do it step by step. The Batch size defines the number of records to send to the function in each batch, and the Batch window the maximum amount of time to gather records before invoking the function, so you should adjust them based on your use case. Your Lambda function will be executed when one of these two values is reached. That is, when the configured maximum batch size is reached or when the batch window expires.Share1Have you looked at S3 replication - https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html? It removes the need for any customised code, and objects can be replicated within 15 minutes of being created in the source bucket.CommentShareSimon Hanmeranswered a month ago0Please take a look in this article: https://repost.aws/knowledge-center/s3-large-transfer-between-bucketsAnother option mentioned there is S3DistCp tool. It is suitable for periodic transfers. For the "large number of small files" use case, the --srcPrefixesFile option could be useful since it allows to provide a list of prefixes (folders) to copy, so the tool won't have to ls everything in the source bucket.S3DistCp tool runs on EMR service so you have to consider its cost, but it may be quite efficient (i.e. quick) compared to alternative solutions.CommentSharenikos64answered a month ago"


Question: logging options in boto3 set_stream_logger

"I'm trying to find out what the various logging levels are and what they mean.  I can't find that anywhere.  Can someone please help me on this?  I know I can do the following, but that will log everything.  boto3.set_stream_logger('').  Also, why don't you have a boto3 or AWS SDK or AWS SDK for python tag?FollowComment"

Answer: "0Accepted AnswerThe AWS SDK for Python (Boto3) uses the standard Python logging module, so you're most likely to find helpful insights by referencing the official Python docs as well as articles that cover logging generally.Here's a direct link to the  detail on pre-defined logging levels described in the Python docs.The Python docs don't really provide guidance on when the various log levels should be used. One resource I've found personally useful in understanding logging best practices—including what log levels mean—is the article, "The 10 commandments of logging".CommentShareKrisanswered a year ago"


Question: Overwrite in glue script

"Hi all,I can able to append my data to curated. But I can't able to overwrite. During overwrite curated existing file was deleted but not write a new file.My script:df. write.mode('overwrite'). Parquet (s3_file_path)FollowComment"

Answer: "0You should not use the same path as source and destination, even when appending, it can result in racing issues and jobs that are not idempotent.When you select overwrite, first deletes the files on the destination.CommentShareGonzalo Herrerosanswered 7 days ago"


Question: Yahoo blocking SES ranges

"How do I get in contact with AWS to let them know that yahoo IP ranges are blocking Amazon SES? I am unable to open a technical support case unless I pay more money. :-/SMTP; 554 5.7.9 Message not accepted for policy reasons. See https://postmaster.yahooinc.com/error-codes"}],"timestamp":"2022-02-03T14:50:50.000Z","reportingMTA":"dns; alph770.prodigy.net"},FollowComment"


Question: ResourceInitializationError: failed to invoke EFS utils commands to set up EFS volumes: stderr: Failed to resolve "fs-file-system-id.efs.us-west-1.amazonaws.com" - check that your file system ID is

"We are mounting EFS volume to our task and we are running the task on fargate but it giving above mentioned error.we made sure everything running the Fargate task and EFS is in the same VPC, using the same sub net and availability zone.We also opened port  2049 for NFS. We also tried opening all traffic for all ports and attached to the task but still we are facing the same issue.FollowComment"

Answer: "0Can you please verify the debugging methods mentioned by AWS support, i think this will help youCommentShareGKanswered a year agoAWS-User-1423467 a year agoWe referred and checked the debugging methods provided by AWS for the error. All the configurations looks okay and we are still facing the same error.We tried creating the entire pipeline in different VPC and it worked. But when we try in the VPC we tried earlier, it is still giving an error.Share"


Question: EMR notebook with no AWS console

"HiOne point I don't understand about EMR notebook :this tool is mainly made for developers for which we don't want to allow to connect to the AWS console...How to provide EMR notebook without a AWS console ? ... this is easy with a jupyter managed inside EMR but with less possibilities.or How to configure a very restricted AWS console, with only the possibility to start a EMR notebook and open jupyterlab that is provided ?FollowComment"

Answer: 0You can use AWS Identity and Access Management policy statements together with notebook tags to limit access.https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-fine-grained-cluster-access.html#emr-managed-notebooks-tags-examplesCommentSharerePost-User-4869158answered 4 months ago


Question: "AWS Outposts pricing - Foot note on EBS Pricing for 33, 55 & larger Tiers"

"Hi All,There is a footnote in the pricing page - https://aws.amazon.com/outposts/pricing/ - as seen below†Outpost configuration pricing listed above includes 11 TB of EBS gp2 storage capacity. You can calculate prices for 33 TB and 55 TB or larger storage capacity using the EBS price tiers listed below.EBS storage tiers. Customers can purchase the below EBS (gp2) storage tiers:2.7 TB EBS tier is priced at $0.6270/GB-mo11 TB EBS tier is priced at $0.3420/GB-mo33 TB EBS tier is priced at $0.2280/GB-mo55 TB EBS tier is priced at $0.1710/GB-mo*EBS (gp2) storage TB =10244 bytes and GB =10243 bytes.Which payment option  - All Upfront  / Partial Upfront / No Upfront -  is the above pricing for each Storage tier - referring to ?  This is not clearly mentioned in this page anywhere.FollowComment"

Answer: "0Accepted AnswerEBS pricing is the same, regardless of the payment option.CommentShareAWS-User-1169509answered 3 years ago"


Question: HIVE_WRITER_CLOSE_ERROR: Error committing write parquet to Hive. Transient Error.

"I'm getting an error with a CTAS iceberg parquet table, with the error message as "HIVE_WRITER_CLOSE_ERROR: Error committing write parquet to Hive."However, once I delete the orphaned files in S3 and then re-run the CTAS query it works successfully. I'm trying to understand the reason why the query is failing transiently?Example:create tableexample_schema.example_tablewith (table_type='iceberg',is_external=false,location='s3://example_path',partitioning=ARRAY['ingest_timestamp'],format='parquet')asSELECT*FROM example_schema.example_source_tableFollowComment"

Answer: "0Short description:The above error usually occurs when your query is failing with "AmazonS3Exception: Slow Down (Service: Amazon S3; Status Code: 503; Error Code: 503 Slow Down; Request ID: xxxxxxxxxxx) " error.The error code 503 Slow Down typically indicates that the number of requests to your S3 bucket is very high. For example, you can send 3,500 PUT/COPY/POST/DELETE or 5,500 GET/HEAD requests per second per prefix in an S3 bucket. However, in some cases, Amazon S3 can return a 503 Slow Down response if your requests exceed the amount of bandwidth available.This explains the transient nature of this query failing at times and succeeding at other times. Please note that this error comes not only from calls made by Athena to the buckets being read/written to, but other AWS services requesting/writing to these buckets.By default, S3 will scale automatically to support very high request rates. When your request rate is scaling, S3 automatically partitions your S3 bucket as needed to support higher request rates. This may be the reason why your query succeeds after some attempts.However, if S3 is being overwhelmed by a high request volume you would start to see 5XX errors, requesting you to slow down / try later. Considering the distributed nature of the S3 service these errors are sometimes expected but rarely generated.Workarounds:[1] You can retry the query after some time with an exponential back-off to give S3 enough time to partition your bucket further based on your key space design. During this time, errors can still occur but it is best to retry while S3 auto-partitions your bucket based on the request rate it is receiving.[2] Configure your application to gradually increase request rates[3] Distribute objects across multiple prefixes[4] Monitor the number of 5xx status error responsesYou can refer the detailed workarounds outlined here- https://repost.aws/knowledge-center/http-5xx-errors-s3Additional troubleshooting:If you continue to see same error message while querying after following the workarounds, you can contact AWS Support https://support.console.aws.amazon.com/support/home#/case/create?issueType=technical Include the query id with the error message.CommentShareSUPPORT ENGINEERrePost-User-0020223answered a month ago"


Question: user pool client userPoolClientSecret attribute missing

"Hi team,I added a user pool client to my user pool : const client  = myUserPool.addClient(      "pool",      {        userPoolClientName: "appClient",        generateSecret: true,      }    );but I can't access the client's Secret   const id = client.userPoolClientId;   const secret = client.????? (userPoolClientSecret this properties is on the CDK doc but cannot find it on the client object how can I get userPoolClientSecret  from the client?this what I found on the CDK docUser Pool clients can generate a client ID as well as a client secret, to support more advanced authentication workflows.To create a client with an autogenerated client secret, pass the generateSecret: true prop:const userPoolClient = new cognito.UserPoolClient(this, 'UserPoolClient', {  userPool: importedPool,  generateSecret: true,});// Allows you to pass the generated secret to other pieces of infrastructureconst secret = userPoolClient.userPoolClientSecret; //CAN'T find the userPoolClientSecret attributealso can't find the attribute to specify the client type via the CDK (public client, confidential client, other) like on the IHMThank you.FollowComment"

Answer: 0Accepted AnswerI upgraded the CDK version to the current version: 2.39.0 I can see the userPoolClientSecret property nowit was added since the version: V2.37.0CommentShareJessanswered 9 months ago


Question: How do I disconnect from OneDrive in AppStream

"When I connect to OneDrive the connection persists through logout/login.It even persists through remove/re-add the domain in stack settings.I'm guessing there is a simple way for a user to disconnect from OneDrive, but searching around have not found it.Anybody know how to do this?FollowComment"

Answer: "0Accepted AnswerThanks, @Mayank_J -- followed document you referenced and got me to where needed to be.My user experience was slightly different, however.Document:Sign in to Office 365 or OneDrive for Business.In the right pane, under My accounts, choose My account.On the account dashboard page, in App permissions, choose Change apppermissions.On the App permissions page, under Amazon AppStream 2.0, choose Revoke.My experience:In web browser sign in to onedrive.comClick on user icon in upper right and select View accountIn left menu select Office appsIn left menu select App permissionsIn resulting screen under Amazon AppStream2.0 click "Revoke" and then OK to confirmLogout of streamLogin to streamCommentSharePaulv45answered 6 months agoMayank_J 6 months agoThanks for the update. We will validate it and update the documentation as needed.Share0There is no option to log out. If you no longer want to use One drive then follow the steps in this documentation to remove access.CommentShareMayank_Janswered 6 months ago"


Question: Issues in managing datasets by additional users in Quicksight

"Hi,A customer has recently started using QuickSight for MVP they have deployed on AWS involving Aurora Serverless RDS. They are using PowerBI and getting acquainted with QuickSight service. A week back they started using collaboration feature and facing couple issues.Background: User1, who has admin access, have created 2 data sets from Aurora Serverless, utilizing SPICE for couple of tables respectively. He has also created Analysis and Dashboards. He needed additional help in QuickSight so added User2 through IAM (same level of permissions as User1) and also “Manage Users with Admin access”. User2 has accepted invitation and is able to access Data sets, analysis and dashboards.Issue 1: User2 need to edit Dataset1 and apply join and filters, however in “Edit Data set” console, “Datasource” panel is not visible at all (top Panel, where you can see Data set and add new data set for join). He is able to see left panel with “fields, filters” and data rows.Issue 2: User1 refreshed one of the dataset and able to see additional rows of last month in analysis graphs and edit data set console. However, User2 is not able to view same data. User2 has done full refresh multiple times and even though additional data is not visible in analysis graphs or edit data set consoleFollowComment"

Answer: "0Accepted Answer#1 – Most likely cause is that User2 doesn’t have permissions on the data source created by User1.There are two components in play.Data source that contains your connection definition and Data set that contains the schema meta data.Have User1 check permissions on the Data Source ( Manage Data -> New Data Set ->Scroll down to ‘From Existing Data Sources’ to find it)#2 – User2 might have accidentally added another filter.Have User2 create a new analysis on the refreshed Data set, pull in just the date field to a table visual and sort to see the latest value available.CommentShareAWS-User-9130822answered 3 years ago"


Question: DB Connections Upper Limit

"I've successfully increased the max_connections value for one of my replicas (db.m4.large) from the default provided by AWS using a parameter group.  I am trying to figure out the maximum number of connections the DB can support.I've ran some tests where I cause X number of connections to occur and then look at the change in freeable memory and get a rough calculation of freeable memory used per connection.  I've ran many tests with different numbers of connections and load on the DB and it seems the freeable memory decrease is independent of the load on the DB and related to the number of connections.I can use these data points to calculate a value for amount of freeable memory decrease per DB connection (~0.4-0.9 MB / connection), but I'm wondering how accurate or useful of a calculation this is in determining how many connections I can support.  Some questions:What else besides number of connections can cause freeable memory to decrease?What is the limitation to how many DB connections you can have?  Is it limited by freeable memory, CPU Utilization, something else?Edited by: taylor10 on Feb 19, 2020 12:02 PMFollowComment"

Answer: "0Hello,The below information is with respect to RDS MySQL:-- The default value of 'max_connections' in RDS MySQL is specific to a particular DB instance type. This is because, this parameter depends on the RAM available for a DB instance.Max_connections (default value) = ‘DBInstanceClassMemory (in bytes)/12582880’.-- However, the allowed values for this parameter is 1-100000-- Hence, you can consider modifying the parameter 'max_connections' in the parameter group associated with your DB instance. But, it is recommended to increase this value if the DB instance has sufficient resources (CPU , Memory) to serve increased connections. This is because, each connection requires resources, if the connections are increased to a value higher than what could be handled by the DB instance type, the connections may not get required resources resulting in performance issues.Best regards,AshikaCommentShareAshikaAWSanswered 3 years ago"


Question: Workspace Locks Up

"I have been using Workspace for at least 5 years without an issue.  I last used the my Workspace in Dec.  Today I tried to access it, I get a login box, and sometimes it pops up an error about "Unknown Error" and other times I can even get the desktop but am unable to click on things or if I try to start a program it just hangs. It does this from the Windows Client (up-to-date running on an up-to-date Windows 10 Pro machine) and also on the Web Browser client too. (I allowed web browser client and same issues).  I have rebooted several times and tried from both clients multiple times.  Says the workspace is healthy and I show no issues in AWS status.  I have even waited several hours this afternoon and tried again and same issues.What can I do?  This service is useless if I can't login to it.  Very frustrated.FollowComment"

Answer: "1Please create a support case so AWS can resolve this for you. A support engineer will be able to comb through the logs and pinpoint the exact issue.CommentShareEXPERTStevieStetsanswered 5 months agoCBaker007 5 months agoI only have Basic support for my non-profit organization using Workspaces.  We can't afford the support fees.That is why I posted in re:Post instead of just opening a trouble ticket.ShareFrancisco_L SUPPORT ENGINEER5 months ago@CBaker007 due to the nature of the issue it will be hard to solve it without seeing the logs from the WorkSpaces side. An alternative would be to rebuild the workspace https://docs.aws.amazon.com/workspaces/latest/adminguide/rebuild-workspace.html however if you have installed or made modifications to the C: drive of the WorkSpace, rebuilding will remove them, as it will use the C: drive that is part of the bundle. You can also create a brand new workspace, install your applications on it, create a new image and bundle, and then use the migration feature https://docs.aws.amazon.com/workspaces/latest/adminguide/migrate-workspaces.html which would migrate the user data (D: volume) to the new bundle (C: volume).The final alternative would be if you are currently using a pcoip based workspace. In this case, you can switch the protocol to the new WSP protocol https://docs.aws.amazon.com/workspaces/latest/adminguide/modify-workspaces.html and see if you are able to connect to it that way. This operation is reversibleShare"


Question: AWS connect Phone number creation

"Hi,Just want to know how can we create a Phone number in Amazon connect via Terraform scripts. I am not able to see any resource in Terraform who create the Phone number. Please suggestRegardsJoFollowComment"

Answer: 1Accepted AnswerAt the moment there is no programmatic way to book & manage phone numbers. You have the option to list phone numbers assigned already to your Amazon Connect Instance.CommentSharefaddianswered a year ago


Question: Trust relationship between a role in global AWS and users/roles in China AWS region

"Hi,Consider the following trust relationship for a role in AWS global:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": "arn:aws:iam::ACCOUNT_ID:root"      },      "Action": "sts:AssumeRole",      "Condition": {        "StringEquals": {          "sts:ExternalId": "SOME-EXTERNAL-ID"        }      }    }  ]}Will it be possible to add an account ID located in one of the AWS China regions?Will it be trusted by the role assigned with the above-mentioned trust policy?Thanks in advance.FollowComment"

Answer: "2IAM roles and resource-based policies delegate access across accounts within a single partition. AWS Global and AWS China use different partitions. A partition is a group of AWS Regions. Each AWS account is scoped to one partition.The following are the supported partitions:aws - AWS Regionsaws-cn - China Regionsaws-us-gov - AWS GovCloud (US) RegionsReferences:https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.htmlCommentShareRoBanswered a year ago0It doesn't work as AWS Global and AWS China are two separate clouds.   You can get more details from below blog.https://aws.amazon.com/blogs/enterprise-strategy/getting-started-with-aws-services-in-aws-china-beijing-region-and-aws-china-ningxia-region/You should take note of the following when using AWS services in the Beijing and Ningxia Regions.To use services in the Beijing and Ningxia Regions, you need an account and credentials specific to the Beijing and Ningxia Regions.In Ningxia or Beijing Region, there is no concept of “root” or “account” user or credentials. All users are IAM users, including the user who created the account.The domain for AWS China Regions is www.amazonaws.cn.Beijing Region and Ningxia Region are not connected by AWS backbone to the AWS Global Regions.AWS China Regions names are as follows. Beijing: cn-north-1; Ningxia: cn-northwest-1.The endpoints for services in the Beijing Region and the Ningxia Region are different from other AWS global endpoints. The endpoint domain for both the Beijing and Ningxia Regions is amazonaws.com.cn. Endpoint syntax varies from service to service. For more information, see China (Beijing), China (Ningxia), and the service-specific documentation.In AWS China Regions, the Amazon Resource Name (ARN) syntax includes a cn. For example: arn:aws-cn:iam::123456789012:user/division_abc/subdivision_xyz/Bob.The EC2-Classic platform is not supported.AWS Free Tier is not available in AWS China Regions as now.CommentSharecharliezhanganswered 4 months ago"


Question: Local Secondary Index Lambda Node.js gets none query results

"Hi, i am using node.js as my request handler. I have a table with a local secondary index, but after I add "IndexName" into query params, it returns nothing.FollowCommentNirmal a month agoAre you referring DynamoDB Local secondary index?Shareskinsman EXPERTa month agoHi, I think you'll need to provide a lot more information for someone to be able to help.  For example what do your table and LSI definitions look like?Share"


Question: Manage AWS KMS Access

Being an AWS Administrator I want to avoid giving AWS KMS Access to developers. Is there a work around or some automated process that we can follow incase we don't want to give AWS KMS access to developers even if they are using KMS keys in there code.Any suggestions or ideas are highly appreciated !!FollowComment

Answer: "0Hi,have a read at this: https://repost.aws/knowledge-center/share-kms-account.The basic idea would be to get to order KMS keys from a central account managed by - let’s say - operations team and not accessible to developers.This account will store keys and will contain KMS policies that would allow the team to use the key in their account, which can be changed by developers only by approval of ops team.KMS keys will be shared across accounts so you can get their ARN and use it.Hope it helps ;)CommentShareEXPERTalatechanswered 12 days ago"


Question: Lightsail instance can't access to RDS

"A Lightsail instance trying to connect to an RDS Postgres database using "psql --hostname=[RDS endpoint URL]"Receiving the error message:"""Is the server running on host "XXXX.rds.amazonaws.com" (XXX) and acceptingTCP/IP connections on port 5432?"""The database is accessible from local desktop, but not from the lightsail instance.Public IP of the lightsail instance is open on the RDS relevant security group similar to the local desktop security group.VPC peering is also enabled on Lightsail, and a security group with the instance's private IP also addedAre there special configuration the LightSail instance/ console needs to open?Any other configurations on RDS ?ThanksFollowComment"

Answer: "0Based on the information provided, it seems like you have already taken the necessary steps to enable access between the Lightsail instance and the RDS instance. However, there might be some additional configuration required to ensure proper connectivity. Please follow these steps:Check the RDS instance's inbound rules:In the AWS Management Console, navigate to the RDS dashboard.Click on your RDS instance, and in the "Connectivity & security" tab, click on the security group under "VPC security groups."In the "Inbound rules" tab, make sure that there's a rule allowing access from your Lightsail instance's public IP (if connecting over the public internet) or private IP (if connecting over VPC peering).Verify the RDS instance is publicly accessible:In the RDS dashboard, click on your RDS instance, and in the "Connectivity & security" tab, check if "Publicly accessible" is set to "Yes."If not, modify the RDS instance to make it publicly accessible, or ensure that you're using VPC peering to access it from the Lightsail instance.Check the Lightsail instance's firewall settings:In the Lightsail console, click on your instance.Go to the "Networking" tab and check the firewall settings.Make sure that there's a rule allowing outbound traffic on port 5432.Verify the PostgreSQL service is running and accepting connections:Connect to your RDS instance through the AWS Management Console.Run the following command to check the PostgreSQL configuration file: SHOW config_file;Open the configuration file and ensure the following settings are configured correctly:listen_addresses = '*'port = 5432If you have made any changes, restart the PostgreSQL service.Test connectivity using telnet:From your Lightsail instance, run the following command to check if there's basic network connectivity to your RDS instance: telnet [RDS endpoint URL] 5432If the connection is successful, it should display a message similar to "Connected to [RDS endpoint URL]."CommentShareEXPERTsdtslmnanswered 2 months agorePost-User-2354337 2 months agoThanks for the response.RDS is publicly accessible, Lightsail's IP in an inbound rule and VPC peering is turned on on LightsailHow to run these commands on the RDS Instance? Is there access to that instance from RDS console?On Lightsail Firewall I opened 5432 completely. Is there option to open only outbound?Share"


Question: Need help setting up VPN between Sophos UTM firewall and AWS VPC

"Hello all,I'm trying to set up a VPN connection between our Sophos UTM firewall and an AWS VPC, but I'm running into some issues. Our on-premises network has two subnets (1.1.1.1/24 and 2.2.2.2/24) that need to be connected to the AWS VPC, but I'm not sure how to configure the VPN connection properly.I've followed this document https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html to setup VPN Connection on AWS side.Also, I've followed the steps in the Sophos UTM documentation to create the VPN connection, but when I try to establish the connection, it fails and I can only reach the AWS VPC from one of our subnets (either 1.1.1.1/24 or 2.2.2.2/24). I've checked the firewall rules and routing configuration on our Sophos UTM firewall, but I'm not sure what I'm missing.The following VPN tunnel configurations have been tested on UTM Sophos side:Tunnel1: Source: 1.1.1.1/24 – GW 3.3.3.3 (on AWS side) – Destination Subnet  5.5.5.5/16 – WORKINGTunnel1: Source: 2.2.2.2/24 – GW 3.3.3.3 (on AWS side)– Destination Subnet 5.5.5.5/16 – WORKINGTunnel1: Source: 1.1.1.1/24 and 2.2.2.2/24 – GW 3.3.3.3 (on AWS side) – Destination Subnet 5.5.5.5/16   - Connection failed, only reachable from one source subnet, sometimes 1.1.1.1/24, sometimes 2.2.2.2/24 - NOT WORKINGTunnel1: Source: 1.1.1.1/24 – GW 3.3.3.3 (on AWS side) – Destination Subnet 5.5.5.5/16Tunnel2: Source: 2.2.2.2/24 – GW 4.4.4.4 (on AWS side) – Destination Subnet  5.5.5.5/16After enabling second tunnel, connection lost - NOT WORKINGCan anyone provide some guidance on how to set up the VPN connection between Sophos UTM and AWS VPC with multiple subnets? Do I need to create multiple VPN connections, one for each subnet? What configuration changes do I need to make on the Sophos and AWS side?Any help would be greatly appreciated. Thanks in advance!FollowComment"

Answer: "1Accepted Answerwhen I try to establish the connection, it fails and I can only reach the AWS VPC from one of our subnets (either 1.1.1.1/24 or 2.2.2.2/24).This is likely because you are using Policy based VPN.  See below note from the VPN FAQQ: How many IPsec security associations can be established concurrently per tunnel?A: The AWS VPN service is a route-based solution, so when using a route-based configuration you will not run into SA limitations. If, however, you are using a policy-based solution you will need to limit to a single SA, as the service is a route-based solution.See this Knowledge Center article on this topic (see the resolution section): https://repost.aws/knowledge-center/vpn-connection-instabilityCommentShareEXPERTTushar_Janswered 21 days agonmos 20 days agoThanks for reply.We tested this scenario today, but it was not successful.As you suggested, on UTM Sophos firewall the following tunnel has been created.Tunnel1: Source: 0.0.0.0/0 – GW 3.3.3.3 (on AWS side) – Destination Subnet 5.5.5.5/16 - Connection failed - NOT WORKINGThe tunnel is not up.Second scenario that we tested was adding one more Customer Gateway and creating second VPN connection.  Multiple Site-to-Site VPN connections -> https://docs.aws.amazon.com/vpn/latest/s2svpn/Examples.htmlThis testing was not successful as well, because we used just the different interface of the Sophos firewall as the second Customer Gateway.Do you have any suggestion how to solve this issue and establish the VPN connection between AWS and on-premise?Thanks in advance.Share"


Question: AWS Elastic Beanstalk Service in UAE me-central-1 Region

"Dear Team,Is there any estimated date when AWS Elastic Beanstalk Service will be available in UAE / me-central-1 Region?I see many relevant services but could not see it's working.Best RegardsFollowComment"

Answer: 0Any response or info on this please?CommentSharerePost-User-4532817answered 2 months ago0Any progress on response on this please?CommentSharerePost-User-4532817answered a day ago


Question: How to base64encode in AppSync javascript resolver ?

"I am trying to base64encode a string in a AppSync javascript resolver but as far as I checked, it is not possible nor with btoa() function nor with js util library. Is there any workaround to manage it ?FollowComment"


Question: Sudden Bounce Rate Spike

My SES account's sending privileges got paused for going above 15% bounce rateI have a lambda function that runs every month and sends emails to close to 10k emailsPrevious bounce rates have been around 3% at most.I haven't had a significant increase in emails yet the bounce rate went from 3% to 15% in a day.I have checked my email list and it doesn't seem to be an issue with my emails.The lambda function that sends the email also hasn't changed since the last run.How can a bounce rate just jump like that? Is my email address getting blocked by email providers out of nowhere? Is SES having a hiccup?FollowComment

Answer: "0I've gone through a few sending pauses myself in the past and the support team is really good about listening to your case and providing feedback on how to address it.A sudden bounce spike makes me think something's up with your list. Are you handling the bounce reports and cleaning your list? Is there any pattern to the bouncing email addresses? (same domain or MX service?)I wouldn't think it's your email address being blocked. Usually, if you're being blocked or blacklisted, your email will still be delivered, but go into the recipient's Spam folder.CommentSharePurdyanswered a year ago"


Question: "cam't receiving email, Gmail bounce"

"I wan to receiving email, and follow the documentafter Verify email & Verify DomainI create 'receive rule' and choose S3and I use Gmail to send an email to 'test@mydomain.com'I also get AMAZON_SES_SETUP_NOTIFICATION file in my s3 bucket, but Gmail bounce (550 5.1.1 The email account that you tried to reach does not exist. Please try double-checking the recipient's email address for typos or unnecessary spaces)I don't kFollowComment"

Answer: "0Accepted AnswerHello,Did you create an MX record for your domain? This record allows SES to handle the incoming mail for your domain. For more information, see https://docs.aws.amazon.com/ses/latest/DeveloperGuide/receiving-email-mx-record.html.Thanks for using Amazon SES!Brent @ AWSCommentShareAWS-User-4207280answered 3 years ago"


Question: How to get metadata of a File From FSx to S3

I have created an FSx. The FSx data repository is S3. Mounted the FSx on the EC2 machine. So whenever I create/modify/delete the file it gets sync with S3.Now how can I get who has created/modified the file in EC2?One way could be by doing ssh on EC2. But can S3 know this metadata?FollowComment

Answer: "0When FSx for Lustre exports files from the file system to a linked S3 bucket, it exports the POSIX metadata to S3 as described in this documentation section.https://docs.aws.amazon.com/fsx/latest/LustreGuide/overview-dra-data-repo.html#posix-metadata-supportCommentSharefilesteranswered 6 months ago"


Question: Any workarounds to run AWS Client VPN on Ubuntu 22.10?

"I am forced to use AWS Client VPN. My organisation uses SAML-based authentication. Therefore OpenVPN client cannot be used.I successfully used AWS Client VPN version 3.3.0 with Ubuntu 22.04, using workarounds described in https://repost.aws/questions/QUNJeF_ja_Suykous7EvfX5Q/aws-client-vpn-on-ubuntu-22-04. After I updated my system to Ubuntu 22.10, a different problem appeared and I am unable to connect.I found a solution to:Process terminated. Couldn't find a valid ICU package installed on the system. Set the configuration flag System.Globalization.Invariant to true if you want to run with no globalization support.   at System.Environment.FailFast(System.String)   at System.Globalization.GlobalizationMode.GetGlobalizationInvariantMode()   at System.Globalization.GlobalizationMode..cctor()Ubuntu 22.10 comes with libicu71. I don't have older versions available. I solved the problem based on a StackOverflow question, so with export DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1.Setting the env var makes the app start successfully. But I am block by the final problem: clicking 'Connect' button ends with a window sayingUnknown error ocurred. Try again.Browsing logs from ~/.config/AWSVPNClient/logs shows:2023-05-10 19:02:04.024 +02:00 [DBG] Starting OpenVpn process2023-05-10 19:02:04.048 +02:00 [DBG] Received exception for connection state Disconnected. Show error message to user2023-05-10 19:02:04.048 +02:00 [ERR] Exception received by connect window view modelTmds.DBus.ConnectException: Connection refused awsvpnclient ---> System.Net.Internals.SocketExceptionFactory+ExtendedSocketException (111): Connection refused awsvpnclientThis looks like a new problem to me. The question for Ubuntu 22.04 mentioned libssl, but there the problem manifested itself with a hard crash with core dump.I tried different versions of libssl1.1:libssl1.1_1.1.0g-2ubuntu4_amd64.deblibssl1.1_1.1.1f-1ubuntu2.16_amd64.deb (this worked for me when using Ubuntu 22.04)libssl1.1_1.1.1f-1ubuntu2.18_amd64.debBut nothing changes.FollowCommentPiotrKubowiczSup 13 days agoMore on 'connection refused'. When everything worked, logs were:[DBG] OvpnGtkServiceClient connected. Calling StartVpnAsync[DBG] OvpnGtkServiceClient received OpenVPN process PID: 62858[INF] Connecting to management interface... host 127.0.0.1, port 8096[DBG] Socket connectedNow the exception is:   at Tmds.DBus.Connection.DoConnectAsync()   at Tmds.DBus.Connection.ConnectAsync()   at ACVC.Core.OpenVpn.OvpnGtkServiceClient.StartVpnAsync(String[] ovpnConfigFileContents, String[] managementPortPasswordFileContents) in /home/ubuntu/Jenkins/workspace/GtkBuild/SecureConnectClient/ACVC.Core/OpenVpn/OvpnGtkServiceClient.cs:line 24   at ACVC.Core.OpenVpn.OvpnGtkProcessManager.Start(String openVpnConfigPath, String managementPortPasswordFile, Int32 timeoutMilliseconds) in /home/ubuntu/Jenkins/workspace/GtkBuild/SecureConnectClient/ACVC.Core/OpenVpn/OvpnProcessManager.cs:line 695   at ACVC.Core.OpenVpn.OvpnConnectionManager.Connect(OvpnConnectionProfile ckonfigProfile, GetCredentialsCallback getCredentialsCallback, Int32 timeout) in /home/ubuntu/Jenkins/workspace/GtkBuild/SecureConnectClient/ACVC.Core/OpenVpn/OvpnConnectionManager.cs:line 862Share"


Question: Api gateway auth failing because cognito passes id_token param with # instead of ?

"I have an http api integration with cognito authorizer and I'm using implicit grant, the id_token is passed in the url as: https://abc.eu-central-1.amazonaws.com/abc#id_token=xyzMy api gateway has Identity Source config as: $request.querystring.id_tokenThe api gateway is failing to parse the id_token and ends up returning {"message":"Unauthorized"}.If I change the request manually to use ? instead of # infront of id_token everything works fine because hash fragments are not sent to the server:https://abc.eu-central-1.amazonaws.com/abc?id_token=xyzAny ideas how to sort this issue without changing the auth type? I can't believe I'm spending a day on such an issue.FollowComment"

Answer: "0Accepted AnswerUsing the hash fragment of the URL is related to the OpenID Connect Core 1.0 standard section 3.2.2.5.  Successful Authentication ResponseWhen using the Implicit Flow, all response parameters are added to the fragment component of the Redirection URIAdvice under 3.2.2.7.  Redirect URI Fragment Handling is:Since response parameters are returned in the Redirection URI fragment value, the Client needs to have the User Agent parse the fragment encoded values and pass them to on to the Client's processing logic for consumption.Are you redirecting from Cognito directly to API Gateway?However, per Amazon Cognito - Authorize endpoint "An implicit grant is less secure because it exposes tokens and potential identifying information to users" and it is more secure to use an  authorization code grant.  The code is returned in the query string parameters and not in the fragment.CommentSharehakansonanswered 3 months agofouad 3 months agoYes I wanted to redirect from Congito to ApiGateway directly, but couldn't get hold of the token on the Http ApiGateway side not via QueryString nor via the Authorization header even as it wasn't getting populated also. What I ended up doing is build a small client that I redirect from Cognito, the parses the token and then do request to ApiGateway with token as QueryString value. It doesn't sound smart but that's all what I'm left with!Sharehakanson 3 months agoBeware that tokens are credentials, and show up in access logs when on Query String, and could be used to make additional requests.   See https://aws.amazon.com/blogs/mobile/understanding-amazon-cognito-user-pool-oauth-2-0-grants/ about the authorization code grant which can be exchanged for the desired tokens based on a code_challenge.  Can you do this code for token exchange in your API Gateway logic?Sharefouad 3 months agoYes, I'm aware of that, the whole solution was simple about a lambda displaying some html response, there is not much security concern about it. At the end to get a token needs a valid credentials and if someone is able to get access to access logs to get the token that means they are authorized otherwise it's a different problem.Share0HIwe are trying to redirecting from Cognito directly to API Gateway, which show us {"message":"Unauthorized"}not sure what we are doing wrongThanksSiddharthCommentShareupon cloudanswered 3 months agofouad 3 months agoThis is not possible to do it directly, you need something between cognito and api gateway to parse the toke or token from code and pass it again to the api gateway via Authorization headerShare"


Question: Cloud Quest: Solution Architect Role

I am having difficulty with a lab in cloud quest for the Solution Architect role. I can't figure out this python code change. Its under serverless foundations for a lambda function. Would anyone be able to help or has done this before?FollowComment

Answer: "0Hi Guys,has this solution worked for anyone? i'm still getting syntax error as soon as I add that code, I'm now stuck on 96% because this code... can you assist?CommentSharerePost-User-1379039answered 5 months agoCrawford 4 months agogood afternoon all,I have been working on this for several hours now and glad that someone else as commented. Unfortunately this exercise is not very intuitive for people who don't have much or any Python knowledge. Trying the above advice now to see if that works...ShareCrawford 4 months agodeloyed and test with the suggested code from Julian and it worked. I think this exercise could have been worded better for those of us non-programmers.Share0Hi Julian,There's two different sections of the code you'll need to look at - the first is the if-else section. As an example, I'd start with updating the first statement to something like this:    if emoji_type == 0:        # Only execute if id is equal to 1        # The variable custom_message combines "Message for code 0:" string with the variable message        feeling = "positive"        custom_message = "Message for code 0: " + messageThis adds the feeling variable. Do this for the neutral and negative feelings in the else and elif sections as well.Secondly, we need to modify the response the Lambda is returning which is this section here:    response = {        # In this name-value pair, the literal value "message" will store the value of the variable custom_message.        "message": message,        # In this name-value pair, the literal value "id" will store the value of the variable id.        "custom_message": custom_message,    }Rather than "custom_message": custom_message try replacing it with:"feeling": feeling,Hope this helps!JasonCommentShareAWSJasonanswered 6 months ago"


Question: Cognito - User Asked to Login to App Constantly

I am using AWSMobileClient on an Android App with a Cognito User Pool. I have set the Refresh Token Expiry to 3650 days and the Access Token Expiration to 1 day and the ID Token expiration to 60 minutes. I do not want my users to have to login to my app after the first login is successful. My users are randomly experiencing an issue where they are asked to login to the app again.Please assist to advise what other settings need to be changed or what else I can investigate to find the problem.FollowComment

Answer: "0Hello AWS-User-3095156,Thank you for your question.The issue you are having is your app users are experiencing a problem where after a successful login, they are prompted to log in again. You are asking which Amazon Cognito settings or configurations can be modified to prevent this.Have your users received any errors when refreshing the token? If they have, check to see if the tokens have been revoked.Check for the implicit grant type which results in a refresh token not returning per RFC standards. Per the enclosed documentation, “In an implicit grant, user pool tokens are exposed directly to the user. As a result, ID and access tokens have more potential to become compromised before they expire.”I am listing recommendations for settings to check.Check the InitiateAuth endpoint to ensure the token value listed is correct.Check the value set for the UnusedAccountValidityDays.Have users check to ensure they have confirmed their accounts as unconfirmed accounts will need to be authenticated again.AWS CloudTrail will displays errors found in Amazon Cognito APIs and provides a log of requests made.Documentation:https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-refresh-token.htmlhttps://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.htmlhttp://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.htmlhttps://docs.aws.amazon.com/cognito/latest/developerguide/logging-using-cloudtrail.htmlhttps://docs.aws.amazon.com/cognito/latest/developerguide/token-revocation.html#revoke-tokens-apihttps://aws.amazon.com/blogs/mobile/understanding-amazon-cognito-user-pool-oauth-2-0-grants/CommentSharelatrunda_sanswered 9 months ago"


Question: How do I create a lifecycle rule to move to glacier?

"Hi everyone, first time user of AWS... Thank you in advance for your help and your time.I created a lifecycle rule to move everything to Glacier Flexible but it hasn't done anything yet... Have I misconfigured something? Does versioning need to be enabled for this type of transition to work?Bonus Question: Can I just select all objects and change the storage class? It said it would make a copy if I did that... I am assuming it means it will make a copy to Glacier and not maintain another copy in S3 standard.Thanks again!FollowComment"

Answer: "0Accepted AnswerHello,Here's a relevant FAQ on how this process works: Why isn't my Amazon S3 lifecycle configuration rule transitioning objects into the GLACIER storage class?.If the objects are in the STANDARD_IA storage class, the objects must be stored in STANDARD_IA for at least 30 days before transitioning to GLACIER. Before you check that the rule transitioned the storage class, confirm that the objects have been stored in STANDARD_IA for at least 30 days.Amazon S3 Lifecycle configuration rules run once a day. Check and confirm whether the rule has transitioned the storage class.The total number of objects in the bucket affects the time it takes for you to see the change in storage class. If the bucket contains a large number of objects, then it might take longer to see the change in storage class.CommentShareEXPERTChris_Ganswered 10 months agorePost-User-2311498 10 months agoThanks Chris! The objects are not yet 30 days old. I will check back in a few weeks. Thanks again!Share"


Question: How to properly create a custom entity recognizer in Amazon Comprehend

"Hi all! I'm currently learning how to create custom entity recognizers in Amazon Comprehend, and some questions came up.In the documentation I saw this example:It mentions giving "context" to the labels. How do I do this? For example, let's assume I'm working on PDF data that contains information about Engineers and Analysts involved in some project, something like this:What exactly do I have to pass to SageMaker Ground Truth so it generates the objects to be labeled? Just the lines that have the Engineer and Analyst names? All of the lines in the file? Because in this example I gave, I have only 8 lines of text in the file, but if I had something like 50 lines, I'd only have 2 lines to be labeled, and the others 48 would have to be skipped entirely.FollowComment"

Answer: "0The "context" mentioned here refers to the document in which the mention occurs (which is not necessarily a specific key-value labelling) - not something you annotate.To illustrate:A simple RegEx e.g. \d{4}-\d{2}-\d{2} could extract all date mentions e.g. "2022-08-25" from textA text entity recognition model could be trained to distinguish different entity types by the context in which their mentioned. For example, 'Agreement_Start_Date' and 'Agreement_End_Date' if you were training a model on contract documents that might contain a sentence like "This agreement shall be effective from 2022-08-25, and will end on 2022-08-26".A layout-aware entity recognition model could be trained to distinguish different entity types by the combination of text content and overall page layout. For example, trying to distinguish the sender address vs recipient address in traditional letters.As mentioned on the other question, if your documents really do contain explicit Label: Value pairs then you probably don't need to go to the trouble of training a model in Comprehend: Textract Form Extraction should pick them out for you (you can try it out in the AWS Console for Amazon Textract).If you have more complex documents where the pre-trained key: value detection in Amazon Textract doesn't meet the need, then yes you could train an Amazon Comprehend model by example, to extract different entity types ('Engineer_Name', 'Analyst_Name' for example). I'd suggest to refer to this two-part blog:Annotating the documents via Amazon SageMaker Ground TruthTraining and using the model in ComprehendIf you were training the model to extract 'Engineer_Name' and 'Analyst_Name' entity types, you would highlight "John Doe" for one and "Jane Doe" for the other. The model would (ideally!) learn to pick out other analyst names vs engineer names when seeing similar-looking documents in future. Hope this helps to clarify!CommentShareEXPERTAlex_Tanswered 9 months ago"


Question: AWS ECS issue with cloudMap service

"i have created an ECS service and during creation i have enabled service discovery, which in its turn create a namespace in cloudmap service, then cloudmap have created a hosted zone in Rout53 for the ecs service, then i have used that cloud map provided dns name as a CNAME to my domain sub.example.com which is located in different hosted zone,**Issue:**the above solution was working since about 1 week but i noticed that this solution was not work any more yesterday.To solve the issue temporary, i have mapped the EC2 instance ip (which created by ECS to hold the ecs service) to the domian instead of mapping the domain to the cloudmap DNS service, and everything is working properly,so i don't know why this issue happened suddenly, all things was ok till yesterday, but something unexpected got happened with the cloudmap dns which was working before with no issues.FollowComment"


Question: Widgets do not appear in public dashboard (cloudwatch)

"Error:  Could not load data. The current role cannot perform cloudwatch:GetMetricData.My iam policie:            "Effect": "Allow",             "Action": [                 "cloudwatch:GetDashboard",                 "cloudwatch:GetMetricData",                 "cloudwatch:DescribeAlarms",                 "ec2:*"             ],FollowComment"


Question: Time Series data from Redshift to SiteWise?

"Hi,I have a customer who wants to store time series data (industrial IoT) in Redshift. Then query/push that data to IoT SiteWise for equipment monitoring.My initial thought is - IoT SiteWise is already a time series data store with Hot & Cold Tiers, so it does not make sense to use Redshift as a data store. Instead they should use Redshift downstream of SiteWise. What do you folks think? Also, would appreciate some reasons for why Redshift is a good or bad candidate in this case.Thanks!FollowComment"

Answer: "1Hi,Redshift is a data warehouse and SiteWise has a time series data store built for the service. Both data stores are built for different purposes. You can query Redshift with SQL and SiteWise with it's own API..Why does your customer wants to store data in Redshift? Copying the data also to SiteWise would increase your storage costs. One need to know more details about the use-case to provide a recommendation.Cheers,PhilippCommentSharePhilipp Sanswered 3 months ago0At AWS we love "working backwards". I encourage you to do the same here.Start with your end product needs, is it fast querying access for analytical purpose, is it just to store lots of data in most cost effective way, is it real-time access to latest IoT data?IoT SiteWise anyways stores data on Amazon S3, so focus on your query needs now. There are various compute options available like Athena, Redshift, EMR to name a few. With Redshift Spectrum you can query the S3 data directly also so you do not need to duplicate this S3 data in Redshift. But if you are unable to meet the query performance expectations then local Redshift tables is the next option to try.Hope this helps, and best of luck!CommentShareMilindOkeanswered 3 months ago"


Question: mutual TLS authentication for Amazon API Gateway - With my existing public key infrastructure (PKI) standard.

"Hello Team,I am trying to enable mTLS for Amazon API Gateway for my endpoint, and I have my existing public key (PKI) for my domain (.crt & .key)..While using to upload my existing root CA public key in S3 bucket, I am getting some error like "API Gateway couldn’t build a unique path from the given certificate to a root certificate". I am following the setup using this link,Ref : https://aws.amazon.com/blogs/compute/introducing-mutual-tls-authentication-for-amazon-api-gateway/Note : I am not using the openssl to generate the RootCA.pem & RootCA.key.Step 1: (SKIP)Create the private certificate authority (CA) private and public keys:openssl genrsa -out RootCA.key 4096openssl req -new -x509 -days 3650 -key RootCA.key -out RootCA.pemStep 2:Create client certificate private key and certificate signing request (CSR):openssl genrsa -out my_client.key 2048openssl req -new -key my_client.key -out my_client.csrStep 3:Sign the newly created client cert by using your certificate authority you previously created:openssl x509 -req -in my_client.csr -CA RootCA.pem -CAkey RootCA.key -set_serial 01 -out my_client.pem -days 3650 -sha256Step 4:I have a minimum of five files in my directoryRootCA.key (root CA private key)RootCA.pem (root CA public key)my_client.csr (client certificate signing request)my_client.key (client certificate private key)my_client.pem (client certificate public key)Step 5:Prepare a PEM-encoded trust store file for all certificate authority public keys you want to use with mutual TLS:cp RootCA.pem truststore.pemStep 6:Upload the trust store file to an Amazon S3 bucket in the same AWS account as our API Gateway API.aws s3 mb s3://your-name-ca-truststore --region us-east-1 #creates a new S3 bucket – skip if using existing bucketaws s3api put-bucket-versioning --bucket your-name-ca-truststore --versioning-configuration Status=Enabled #enables versioning on S3 bucketaws s3 cp truststore.pem s3://your-name-ca-truststore/truststore.pem #uploads object to S3 bucketStep 7:Enabling mutual TLS on a custom domain name I have in AWS API gateway console,While I upload my existing root CA public key in S3 bucket, I am getting some error likeError :  "API Gateway couldn’t build a unique path from the given certificate to a root certificate".Error : "There is an invalid certificate in your truststore bundleMutual TLS is still enabled, but some clients might not be able to access your API. Upload a new truststore bundle version to S3, and then update your domain name to use the new version."FollowComment"

Answer: "0Hi,Can you tried to create a RootCA with openSSL, this could be an issue with your RootCA generated without openSSL.CommentShareRicardo_Manswered 6 months ago0Hello Team,We are about to go live for the client with the mTLS setup on the AWS API gateway. The example what AWS is fine upto sandbox testing. They have created a Root CA private and public keys on their own and also created a client certificate and keys for the sandbox testing. But they are recommented to use domain SSL or secured intermediate certificate not a self created certificates. Whether we need to use our domain SSL certificates as a Root CA certificate or as the client certificate?. I’ve tried to set as a Root CA, but when I try to upload it on the API gateway, it failed says not a valid certificate. Can you please help us on what I’m doing wrong here?..CommentSharerePost-User-1942230answered 6 months ago"


Question: Expanding an xen instance partition fails due to missing "growpart"?!

"Hello, I would like to expand a partitation on an instance, but for some reason the command growpart does not exist on this instance?I am proceeding as usual according to https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/recognize-expanded-volume-linux.html, and this has also worked for the other instances in the past, only with the current one I fail at point 2c, as the command "growpart" obviously does not exist on my instance?!?This is the current situation at this instance:sudo lsblkNAME    MAJ:MIN RM SIZE RO TYPE MOUNTPOINTxvda    202:0    0   8G  0 disk-xvda1 202:1    0   5G  0 part / xvdb    202:16   0  15G  0 disk  -xvdb1 202:17   0  15G  0 part /IOLSo the xvda drive has already been increased from 5 to 8 GB.But when I try to enlarge it using growpart, the result looks like this:sudo growpart /dev/xvda 1sudo: growpart: command not foundAnd indeed, there is obviously none:which growpart/usr/bin/which: no growpart in (/usr/lib64/qt-3.3/bin:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/ec2-user/bin)Maybe you can imagine the look on my face when I saw this message? 8:oWhere did that go?! Are there alternative ways to increase the partitation to the full drive size without growpart?FollowComment"

Answer: "1Hellogrowpart command come with package cloud-utils-growpart . Ensure you have package installed on installed.$sudo yum list cloud-utils-growpart===> If missing rpm$ sudo yum install cloud-utils-growpart==> if installed, just reinstall will help to reinstate file  /usr/bin/growpart$sudo  yum reinstall cloud-utils-growpartCommentShareHiteshanswered 2 months agoKiezkickerde 2 months agoThanks for naming the appropriate installation package, that was a very helpful hint.Filesystem     Type   Size  Used Avail Use% Mounted on/dev/xvda1     ext4   8.9G  3.0G  5.5G  36% / (yes, 9 GB, added another GB since my initial post)tmpfs          tmpfs  1.8G     0  1.8G   0% /dev/shm/dev/xvdb1     ext4    15G  5.5G  9.3G  38% /IOL:-)Share"


Question: Issue with Twitter and LinkedIn meta tags with Cloudfront & Lambda@Edge

"I'm using a Lambda@Edge function (triggered on origin request) to change the meta tags for a react site, hosted on S3 with Cloudfront, for rich social sharing. It works perfectly for Facebook, but doesn't for Twitter or LinkedIn.LinkedIn errors (from their post inspector):We encountered a server error while trying to inspect the URL.(URL Redirect Trail) 500 Failureand Twitter card validator error:INFO: Page fetched successfullyINFO: 11 metatags were foundERROR: No card found (Card error)I believe my tags are actually ok e.g. Facebook's sharing debugger shows what it sees:<meta name="twitter:card" content="summary_large_image"/><meta name="twitter:site" content="@myTwitter"><meta name="twitter:creator" content="@myTwitter"><meta name="description" content="My amazing content"><meta property="og:image" content="https://mys3bucket.s3.amazonaws.com/static/media/myImage.19c87b8d.jpg"><meta property="og:title" content="My amazing title"><meta property="og:description" content="My amazing content"><meta property="og:url" content="https://example.com/whatever/mypage"><meta property="og:type" content="website"><meta property="og:locale" content="en_US"><meta name="author" content="me">My question is - is Cloudfront the issue i.e. could it be stopping the Twitterbot / however LinkedIn does it? I have ran:curl -A TwitterBot https://www.example.comand it does return html with the correct tags, so I'm not sure.Also - if I turn off the Lambda@Edge and just hardcode the tags in my index.html, Twitter and LinkedIn sharing work fine.I can't see anything in the AWS docs of anything I should be doing to allow Twitter/LinkedIn bots.Any help appreciated!FollowComment"

Answer: "1Accepted AnswerIt's possible that CloudFront is causing the issue with the social sharing on Twitter and LinkedIn.When a request is made to CloudFront, it checks the cache for a response before forwarding the request to the origin. If a cached response is found, CloudFront returns it to the viewer without forwarding the request to the origin. In your case, since the Lambda@Edge function is modifying the meta tags for rich social sharing, it's possible that the cached response does not contain the updated meta tags.One way to test this is to invalidate the cache for the specific pages that contain the meta tags for rich social sharing. This will force CloudFront to forward the request to the origin, which will then trigger the Lambda@Edge function to update the meta tags.Another thing you can do is to check the headers sent by the Twitterbot or LinkedIn bot and make sure the headers match the headers sent by other clients.You can also check the CloudFront access logs to see if there are any errors related to the requests made by the Twitterbot or LinkedIn bot.If none of the above solutions work, it's possible that the issue is with the Lambda@Edge function and the way it's modifying the meta tags. You can try to check the logs of the Lambda function to see if there are any errors that could cause the problem.Finally, you can also try using another caching option instead of CloudFront, like using a CDN (Content Delivery Network) such as Cloudflare or Akamai, that might work better with your use case.CommentSharejayamaheizenberganswered 4 months agorePost-User-9814767 4 months agoThanks for the detailed answer - it helped me narrow down the cause: I needed to add a header to the response - Content-Type of text/html. Facebook could obviously parse the response without the header, but LinkedIn and Twitter couldn't.Share"


Question: AWS IoT custom domain ECDSA support

"We configured a custom domain using this guide: https://docs.aws.amazon.com/iot/latest/developerguide/iot-custom-endpoints-configurable-custom.htmlThe domain is enabled and active.The TLS handshake works with no cipher constraints, however when the cipher suites are constrained to ECDSA, the connection is dropped after client hello.$ openssl s_client -cipher ECDSA -connect custom-domain-name:8883 -showcerts -servername custom-domain-nameCONNECTED(00000003)write:errno=0---no peer certificate available---No client certificate CA names sent---SSL handshake has read 0 bytes and written 284 bytesVerification: OK---New, (NONE), Cipher is (NONE)Secure Renegotiation IS NOT supportedCompression: NONEExpansion: NONENo ALPN negotiatedEarly data was not sentVerify return code: 0 (ok)---Is ECDSA not supported? This is odd since it is one of the recommended cipher suites here: https://docs.aws.amazon.com/iot/latest/developerguide/transport-security.htmlFollowComment"

Answer: "1Accepted AnswerWhen setting up a custom domain you need to attach a server certificate to the endpoint which has either an ECDSA signature or an RSA signature.In practice this mean that you can either use an RSA cipher or an ECDSA cipher but not both for the same custom domain endpoint.The standard endpoint, on the other hand, supports both ciphers.CommentShareEXPERTMassimilianoAWSanswered a year ago1This should be noted in the docs at https://docs.aws.amazon.com/iot/latest/developerguide/iot-custom-endpoints-configurable-custom.html under "ACM-generated public certificates"When using an ACM issued certificate this limits you to RSA, since ACM does not issue ECDSA certificatesCommentSharefriedrichmaeckleanswered a year ago"


Question: Operator '||' cannot be applied to 'com.amplifyframework.core.model.query.predicate.QueryPredicateOperation<java.lang.String>

"How to add and/or/not operator in query predicate in android?I saw there is nothing mentioned in andorid but in JavaScript it is mentioned as below:let filter = {      or: [{ priority: {eq:1} },           { priority: {eq:2} }]  };await API.graphql({ query: listProducts, variables: { filter: filter}}));How to achieve the same in android java?FollowComment"


Question: Anomaly detection model based on math expression could not exclude datetime range

"I created math expression based on FILL(LOG(RATE(METRIC)),0) math expression, and excluded time range which was wrong, but AI model could not learn and after that wrong period predicting wrong values. Please help me with this - why it is happening and how can I fix it ? For excluding datetime I'm using boto3 library and put_anomaly_detection endpoint. I'm getting already created models and putting that models by excluding datetime.FollowComment"

Answer: "0Anomaly Detection models are not supported for math expressions containing 'METRICS' expression. I have assumed you use it; based on the METRIC present in your expression FILL(LOG(RATE(METRIC)),0). Please correct me if this is not the case.Along with this, there's a bunch of other math expressions currently not supported for AD models. Click here for the full list.On a side note, you can consider allowing some time for the model to retrain, based on sudden spikes or changes. Models are retrained continually. If this wait does not bring any improvements, I would suggest to delete & recreate the model from scratch with appropriate expression & time ranges.CommentShareSUPPORT ENGINEERShreyas_Manswered 3 months ago"


Question: "During the installation of joomla, the What is the path to MariaDB?"

I am using Bitnami Joomla in lightsail.I want to use the MariaDB configured in Bitnami.How should I fill in the path of MariaDB during the installation of Joomla?Application user name: user Database user name: rootIs this correct?Thank you.FollowComment


Question: Getting {"message":"Missing Authentication Token"}"for Simple API Gateway Response

Hi TeamI created a simple API gateway named Trial with Post Method to get the simple response from Lambda.Clicking in Test button via the API Gateway is fetching the correct response from Lambda but after deploying the API and clicking on the Post URL I am getting the error as {"message":"Missing Authentication Token"}.The CORS is enabled and the API was deployed and URL is also complete.Please let me know in case you require more information.FollowComment

Answer: "0Have you created resources? The URL gotten when you deploy your API does not include your resource, for instance if you have a resource called /books, your URL doesnt not include it, so you have to add /#yourresourcename/ after the URL gotten when you deploy your API.CommentShareVicky Gracianoanswered 5 months agorePost-User-4140128 5 months agoHi Vicky- Thanks for your response, but as mentioned in the problem the URL is complete i.e. the resource is included in URL after deployment.Share0If you have an api token required you need to specify x-api-key header with the API key as the value. You may also need a need to setup a usage plan.https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-setup-api-key-with-console.htmlCommentShareEvananswered 5 months ago"


Question: Unknown error when accessing the database details view through the AWS LakeFormation console

"When trying to access a specific database (e.g default,  the default HIVE database) through the console (e.g, using the URL https://us-east-1.console.aws.amazon.com/lakeformation/home?region=us-east-1#database-details/default?catalogId=$AWS::AccountID), an Unknown Error is being thrown and shown in the console (screenshot sadly not attached because it's unsupported on this platform).Since there is no additional information with the error, it's impossible (for us) to know how to remediate the issue.As for IAM permissions, the user trying to access the view has this following policy attached:{    "Version": "2012-10-17",    "Statement": [        {            "Action": "lakeformation:*",            "Resource": [                "*"            ],            "Effect": "Allow"        }    ]}FollowComment"

Answer: 0Accepted AnswerSo apparently the Unknown Error was due to the user not being able to do Get/List operations for the RAM (Resource Access Manager). Attaching the AWSResourceAccessManagerReadOnlyAccess managed policy to the user solved the issue.CommentShareOryJonay-HelloHeartanswered a year ago


Question: Intermittent name resolution error when accessing RDS db

"At varying intervals (every couple days, weeks, or even months), the web application hosted on our AWS EC2 instance cannot connect to our RDS database due to a name resolution error:  "SQLSTATE[HY000] [2002] php_network_getaddresses: getaddrinfo failed: Temporary failure in name resolution"Upon reboot of the EC2 instance, the problem goes away for awhile but then returns days, weeks or months later. Would love to know how to prevent the problem from recurring.FollowComment"

Answer: "1How many connections per second are being made from the EC2 instance to the RDS instance?  You may be running into a DNS quota issue where the single EC2 instance is sending too many packets too quickly to resolve the RDS DNS entry.Info about this: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-limitsCommentShareEXPERTChris_Ganswered a year ago0Interesting - I am also seeing very occasional (but transitory) rejections from a RDS instance that is only contacted once per minute!  The Airflow log looks like ...[2022-03-12 03:05:03,760] {{bash.py:173}} INFO - psql: could not connect to server: Connection refused[2022-03-12 03:05:03,952] {{bash.py:173}} INFO - Is the server running on host "edmdbc01.crqgpecn5ugy.ap-southeast-2.redshift.amazonaws.com" (10.160.224.71) and accepting[2022-03-12 03:05:04,071] {{bash.py:173}} INFO - TCP/IP connections on port 5432?[2022-03-12 03:05:04,148] {{bash.py:173}} INFO - AWS Redshift connection is broken ![2022-03-12 03:05:04,184] {{bash.py:173}} INFO - PGHOST=edmdbc01.crqgpecn5ugy.ap-southeast-2.redshift.amazonaws.com[2022-03-12 03:05:04,217] {{bash.py:173}} INFO - PGPORT=5432[2022-03-12 03:05:04,249] {{bash.py:173}} INFO - PGDATABASE=staging[2022-03-12 03:05:04,286] {{bash.py:173}} INFO - PGUSER=airflow_user[2022-03-12 03:05:04,320] {{bash.py:173}} INFO - PGPASS=/tmp/airflowtmp868/dev/.pgpass[2022-03-12 03:05:04,356] {{bash.py:173}} INFO - PGOPTIONS=--search_path=modelWhilst Route 53 can burst limit - I would (naively?) assume if the webapp was hitting the same endpoint (RDS) and the DNS TTL wasn't 0 (disabled) that the EC2 name cache would prevent reissue of the name resolutions until it reached expiry.  Perhaps the webapp is requesting lots of other novel names and the RDS request is just the unlucky 1001 th ?CommentShareFrank Hamersleyanswered a year ago0For something completely different ... I have just noticed a pattern emerging in our own Redshift connection failures!These have all occurred between 03:01 UTC and 03:20 UTC - with the majority of cases seeing service restored after one minute - however on two occasions as long as 4 minutes later!!This suggests (weekly?) routine maintenance is in progress and the instance is being killed/restarted - or at least going into a single user mode and hence refusing connections!In that case restarting the EC2 probably induces enough delay during the reboot so that by the time it is back on-line the Redshift maintenance is complete - which in turn means the reboot is not actually fixing anything.  What happens if you leave it online? Does it ever reconnect without intervention ?CommentShareFrank Hamersleyanswered a year ago0As Chris_G mentioned:You may be running into a DNS quota issue where the single EC2 instance is sending too many packets too quickly to resolve the RDS DNS entryI think it's worth adding to this, that the metric used for the hard limit and maximum number of DNS query packets is packets per second, per ENI. So while your webapp may not be querying the DB's DNS that much, it may be just as you said:as  Perhaps the webapp is requesting lots of other novel names and the RDS request is just the unlucky 1001 th ?However, I don't believe the names would have to be novel. Unless you have configured local DNS caching on your EC2 instance, DNS queries from your instance will still head to your AWS DNS Server.I ran into the same issue, but it was with Lambda functions instead of an EC2 instance. We solved the issue but increasing the number of ENIs assigned to the Lambda functions. You could also increase the number of ENIs on your EC2 instance, depending on which instance type you're using.If you want to dive deeper into finding out where exactly the problem is, check out:How can I determine whether my DNS queries to the Amazon-provided DNS server are failing due to VPC DNS throttling? and then How can I avoid DNS resolution failures with an Amazon EC2 Linux instance? The following links might also be of use:Amazon DNS ServerPacket per second (PPS) per elastic network interface limitActually, the whole whitepaper is good: Hybrid Cloud DNS Options for Amazon VPCAWS Hybrid DNS with Active DirectoryAlso here's some answers I posted regarding the same issue, but with lambda functionsOccasional 'temporary failure in name resolution' while connecting to AWS Aurora clusterERROR AWS Lambda SDK: Temporary failure in name resolutionCommentSharemikeyanswered 4 months ago"


Question: CloudWatch Agent - metrics are not reporting

"Troubleshooting a Windows Server, On Premise, Managed Node that is not reporting Metrics to CloudWatch.  CloudWatch Agent has been installed and configured.  There is an IAM profile that allows for communications.  The setup is proven as there are numerous other like Managed Nodes using this configuration without issue.  Just having issues with this one particular instance.In the Amazon CloudWatch Agent logs, I see the following from within the configuration-validation.log:<timestamp> E! The service process could not connect to the service controller.The amazon-cloudwatch-agent.log appears clear of errors.  I tested access to the endpoint and do not see that as an issue.  I have tried uninstalling/re-installing CloudWatch Agent via the Run Command.  I've searched for the listed error provided above and do not find anything relevant to help me remediate the communications issues.  Any ideas or suggestions would be really appreciated.Thank you!FollowComment"


Question: "How to build monitoring dashboard that will monitor the status of AWS Health Dashboard, where we want to monitor the status of the Transcribe service in the Ohio region."

"Dear AWS experts,I am trying to build a monitoring dashboard that will monitor the status of AWS Health Dashboard, where we want to monitor the status of the Transcribe service in the Ohio region.I am using the lambda function to monitor the AWS Health Dashboard. When I run the lambda function, I get the following response:"errorMessage": "An error occurred (SubscriptionRequiredException) when calling the DescribeEvents operation: "Lambda Function:import boto3def lambda_handler(event, context):    health = boto3.client('health')    response = health.describe_events()    status = response['events'][0]['statusCode']        s3 = boto3.client('s3')    s3.put_object(Bucket='status_m', Key='health-dashboard-status.txt', Body=status)The region is set to us-east-2 Ohio.Function log:START RequestId: d359f1e0-a14f-49c9-ba53-5234917f6e2f Version: $LATEST[WARNING]2023-05-08T11:27:48.662Zd359f1e0-a14f-49c9-ba53-5234917f6e2fClient is configured with the deprecated endpoint: us-east-2[ERROR] ClientError: An error occurred (SubscriptionRequiredException) when calling the DescribeEvents operation: Note: The role associated with the lambda function has a custom policy called AWSHealthReadOnlyAccess that looks like the below:{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": "health:DescribeEvents",            "Resource": "*"        }    ]}I am not sure what I am missing here. I appreciate your help in advance.Kind RegardsFollowComment"

Answer: "0Programmatic access to AWS Health API requires the calling account to have a Business, Enterprise On-Ramp, or Enterprise Support plan. Accessing AWS Health is free through the AWS Health Dashboard and through Amazon EventBridge. You can use the latter  to monitor events for Transcribe by  configuring an EventBridge rule that catches events for Amazon Transcribe and then triggering your lambda. If you want to go down the programmatic access route, I'd recommending looking into AWS Health Aware, which also requires Business or Enterprise support, but will have some good examples for for you to follow (see github project), which supports pushing events to a number of channels that you can configure.CommentShareiddvanswered 22 days agoAndrew_R EXPERT22 days agoJust a note, AWS Health Aware also uses the Health API (and the related Business or Enterprise Support plan enabled on each account)Shareiddv 21 days agoThat is correct, I just mentioned it because it might serve as a good example. I've updated my answer to clarify.Share-1Hi,The event bridge rule is created like the one in the doc you shared.Event Source: AWS events or EventBridge partner eventsEvent pattern: Event source -> AWS service >> Health >>> Specific health eventSelect Target: I believe I should select the Lambda function that I shared in the question.Can you please explain with a bit more clarity when you say-configuring an EventBridge rule that catches events for Amazon Transcribe andthen trigger your lambda.Thanks in advanceFor your reference:Screenshot for the CloudWatch metrics when the event bridge rule is set for the Transcribe service with a lambda function.CommentSharerePost-User-7621104answered 22 days agoiddv 22 days agoYou added an answer to your own question, if you want to follow up on a question I will probably be better to add a comment to my question :) (1) When you configure the rule you can select the service you are interested from a drop down list. You can follow the guide I linked, the provided example is for catching EC2 events, but it will work exactly the same for Transcribe. (2) After you have configured the rule, any AWS Health event posted for Amazon Transcribe that reaches your account invoke the target that you have configured in the rule. It looks like you want to write the output to S3, so you can do that by invoking your Lambda function when an event is received. The guide I linked also has an example of the payload.SharerePost-User-7621104 21 days agoHi iddv, based on the suggestion(1) when I configure the even bridge rule, I can select the service I am interested in from a drop-down list. The service in my case is Transcribe - Done(2) After I have configured the rule, any AWS Health event posted for Amazon Transcribe that reaches my account invokes the target that I have configured in the rule - Done(3) I want to write the output to S3, so I can do that by invoking my Lambda function when an event is received - Done.Lambda function looks like this:import jsonimport boto3def lambda_handler(event, context):    s3 = boto3.client('s3')    bucket_name = 's3bucket'    key = 'aws-health-events/{}.json'.format(context.aws_request_id)        event_data = json.loads(event['detail'])    # Extract relevant information from the AWS Health event    event_description = event_data['eventDescription'][0]['latestDescription']    event_status_code = event_data['statusCode']    event_start_time = event_data['startTime']    event_end_time = event_data['endTime']        # Upload the event information to S3    s3.put_object(Body=event_description, Bucket=bucket_name, Key=key)        return {        'statusCode': 200,        'body': json.dumps('AWS Health event successfully processed')    }Observations:I can see some runtime metrics that lambda sends. But I'm unsure how to read it. Please refer the screenshot I've attached for your reference in the post above.I Can't see any file in the S3 bucketShareiddv 21 days agoThe metrics that you've posted seems to indicate that your function was invoked successfully once. There are a couple of things that you can do to debug this, such as (1) verify that you've deployed the latest version of your function, (2) make sure to test your function with a valid sample event, (3) add some debug logging to your code to verify that your code is doing what you expect it to do and (4) verify that your function has the correct permissions. Once you have it working with a sample event, you can log a request with AWS Support through the console to send a test event to your account, that will test your function end to end with a real AWS Health Event!Share-1Thanks for the quick reply :)I am not looking to fix this programmatically. I will try your recommendation to go with EventBridge now.CommentSharerePost-User-7621104answered 22 days ago"


Question: TGW BGP VPN Route Advertisements

"Hello, when building a Dynamic VPN attached to a Transit Gateway, will the VPN only advertise propagated routes from the Transit Gateway Route Table to my Customer Gateway or also static routes located from my Transit Gateway Route Table?thanks,FollowComment"

Answer: "2The VPN will advertise everything in the VPN associated TGW route table back to on-prem, so it will advertise both static and propagated.CommentShareMatt_Eanswered 20 days agoEXPERTTushar_Jreviewed 20 days ago"


Question: bad entry in /etc/pam.d/system-auth file

We recently installed AL2 and found a bad entry in the /etc/pam.d/system-auth file.  The offending line looked as follows (contains leading dash):-session     optional      pam_systemd.soNot sure how to proceed to get this fixed?  It does cause the following error during certain sudo commands:sudo: PAM (sudo) illegal module type: -sessionFollowComment

Answer: "0Accepted AnswerThe entry which is specified is not a bad entry, it is used"If a line in the configuration file starts with a dash, the error isn't logged. This can be useful for modules that may not be present, for example, a module for fingerprint authentication may not be present, but if it is, it should be used."Take a look at these:https://www.redhat.com/archives/pam-list/2009-October/msg00028.htmlhttp://wpollock.com/AUnix2/PAM-Help.htmWhat commands are you running which cause these errors?CommentSharessuryadanswered 3 years ago0Hi,Thanks for the explanation.  That makes sense now.FWIW. the command was running in a script and looked something like the following:sudo -u $run_as_user $actual_env_path/setup_handler_cacheCommentSharekerrydanswered 3 years ago"


Question: Windows 2008 EC2

Are there any limitations operating Windows 2008 (not R2) on EC2?Specifically interested in issues changing instance type/family within the current generation.Egm4.4xlarge -> m4.2xlargeorm4.4xlarge -> r4.xlargeCheers!FollowComment

Answer: 0Accepted AnswerMost M4 and R4 would be fine but 2008 Sp2 lacks driver support for newer platforms that leverage ENA and NVMe.  This may also limit your ability to operate in new regions that lack previous generation instance types.CommentShareAWS-User-4316850answered 3 years ago


Question: cant run an smtp docker container on linux AMI

"Hi,i'm trying to run postfix/dovcot containers using docker-compose on a new Linux AMI based vm i just created.docker daemon issues an error: "Error response from daemon: driver failed programming external connectivity on endpoint <XXXXXX Container name XXXXX> (582c7551d1c87e6131cb153b1dee9f9c1d0bd5ea1eaedfe070d7952276547569): Error starting userland proxy: listen tcp4 0.0.0.0:25: bind: address already in use"indeed ,runningsudo lsof -i:25 |grep LISTENshows that the port is used. this is the output :master  3038 root   13u  IPv4  17945      0t0  TCP localhost:smtp (LISTEN)What am i missing here ? why is that port taken ? i read some comments on the net saying that Amazon prevent using port 25 by default - is that the case here ?Thanks in advanceSivanFollowComment"

Answer: "0Accepted AnswerSo i found out that this AMI comes with postfix installed and enabled , i did not know postfix is installed by default.i simply had to disable and stop the service.I found this by mistake while running some ps aux commands ,grepping for pids.what i  did was:sudo systemctl stop postfixsudo systemctl disable postfix # so that postfix wont reload when my vm restartsCommentShareAWS-User-6427338answered a year ago"


Question: Connect Contact Flow playing a DTMF tone

"I have a use case where an end to a Contact Flow needs to play a DTMF tone. I have this setup by the Contact Flow playing a .wav file in a prompt.I have confirmed the .wav file plays, as I have added an audio clip to the beginning of the file preceding the DTMF tone and this preceding audio can be heard, but still not the DTMF tone.Is there a way to have a DTMF tone originate from Connect and send outbound?  If this is not possible through Connect alone, would it be possible by integrating a Lambda function to play the file from S3? I was going to build this, but it seems more likely the issue is with DMTF going outbound from Connect in general.Thank you for your input.Edited by: JDIO on Feb 16, 2019 11:22 PMFollowComment"

Answer: "0Updating for anyone else with future need:The DTMF tone does flow through, it was/is simply not audible through my test receiver. I am unsure if this is unique to my setup or will be experienced across all use cases, however the functionality is still there.CommentShareJDIOanswered 4 years ago0I experience similar issue with 2 way hands free devices which rely on dtmf tones to switch between talk and listen modes. Were you able to find a solution to your issue?P.CommentSharePhilGregoryanswered 4 years ago"