Question: "Verified domain, SES authentication refuses emails."

"Hi, I found myself in a weird situation were I have a verified domain, let's say xyz.com but SES refuses emails despite the domain being verified.The account is out of the sandbox.I have successfully verified the domain.I have successfully sent myself an email from the SES testing, the email came as follows:from:mktg@xyz.comto:(my personal email)date:Mar 23, 2022, 4:44 PMsubject:fdfdfdfmailed-by:custom.xyz.comsigned-by:xyz.comsecurity: Standard encryption (TLS)However, when I send an email from my aplication on behalf of (from) mktg@xyz.com, I get this error msg:"Expected response code 250 but got code "554", with message "554 Message rejected: Email address is not verified. The following identities failed the check in region EU-CENTRAL-1: mktg , mktg@xyz.com "Note: mktg@xyz.com is not the real mailbox and xyz.com is not the real domain.FollowComment"

Answer: "-1Have you done "Create an MX record in the Route 53"? Reference hereHow about AWS Workmail? It is much friendly, but might not meet your needsI have a note here when I tried SES with save emails into S3CommentSharehaianswered a year ago"


Question: "EC2 error This account is not authorized to use the EC2 serial console error, Instance reachability check failed"

AWS EC2 is not connection.EC2 error This account is not authorized to use the EC2 serial console errorThe issue is coming frequently after registering a case 11665142811 also for the same with screenshots.Development is on hold due to this. Kindly do the needful soon.FollowComment

Answer: 0Check this resource: Configure access to the EC2 Serial Console. Could be blocked at a number of levels.CommentShareEXPERTkentradanswered 5 months ago


Question: How to connect Glue to MSK with IAM  authentication?

"When setting up a Glue Connection for our MSK cluster configured woth IAM authentication, the broker disconnects the connection from Glue jobs using the connection with a message that says SASL failed. We have given ghe role used on the Glue job full permission. Is it currently possible to connect using IAM authentication?FollowComment"

Answer: "0Currently, AWS Glue does not integrate with Amazon MSK clusters configured to use AWS IAM access control.You can connect to MSK clusters using IAM Access Control from other AWS services, such as Amazon EMR and Amazon Kinesis Data Analytics. In these cases, you configure the Kafka client to use MSK IAM authentication.Also, AWS Lambda has its own integration with MSK clusters using IAM Access Control, through an Event Source Mapping. By taking this approach, the Kafka client is configured for you.CommentShareJayanswered a year ago"


Question: S2S VPN tunnels up but no communication.

"Hi,I'm trying to get a VPN running between my on premises site, and a VPC. I think I've followed all the instructions on the AWS guide, and created VPG, CGW, and attached them to a VPN on my VPC. I have used the generic config file to setup the IPSec VPN settings on the router here, Draytek 3900 on Static Routing. Added Network ACL and security group rules to allow traffic between the private IP range on prem, and the VPC subnet range.Both tunnels show as up in the console, but I can't ping between the on prem machines and an Instance I created in the subnet. From the router I can ping the inside IP of both tunnels, but not from the Instance.I must be missing something, but I can't see what it is. I have setup route tables to point traffic from my subnets to my internal IP range to go to the VPG. I'm also getting confused by the tunnel IP ranges which don't match anything at either end.Information from config file:Outside IP Addresses:Customer Gateway         : xx.xx.xx.xx Public IP of my router set in CGWVirtual Private Gateway        : yy.yy.yy.yy Public IP of AWS tunnelInside IP AddressesCustomer Gateway         : 169.254.x/30 (This doesn't match my internal IP range)Virtual Private Gateway             : 169.254.y/30 (This doesn't match VPC internal range)Next Hop              : 169.54.y (Pingable from my end)My Router configLocal IP/Subnet Mask:      192.168.a/24 (My internal range).Local next hop:                   0.0.0.0 (also tried next hop from config file, but that didnt work either).Remote Host:                      yy.yy.yy.yy Public IP of AWS tunnel from config file).Remote IP/Subnet Mask:  169.254.x/30 (169.254.y/30 VPG from config file).I've also added the IP range of my VPC into the 'More Remote Subnet' but that doesn't make any differencePing to keep alive is enabled and set to the VGW public IP.CGW is attached to my VPC.VPN settingsVPC:   My VPC.Local IP CIDR:        my internal IP range (192.168.a).State:   Available.Customer gateway:   xx.xx.xx.xx Public IP of my router.Routing:   Static.Remote IP CIDR:     0.0.0.0/0 (also tried subnets and entire VPC range).VPG: My VPG.Type: ipsec1.Acceleration: False.CGW: My CGW.Can anyone point me in the right direction for the correct settings I need?FollowComment"

Answer: 0192.168.a/24 (My internal range).Make sure you have the static route of your on-prem LAN above in the AWS VPN Connection "Static Route" tabCommentShareEXPERTMatt-Banswered a year ago0Please share me configCommentSharerePost-User-0650257answered 6 months ago


Question: Receiving SMS to Pinpoint phone number from a short code number

I am able to receive sms from normal phone numbers but not from short code numbers. I need to be able to receive sms body sent from a shortcode number. Is there a settings for Pinpoint number or in the Lambda function to enable such feature?FollowComment

Answer: "0Hi.Did you see why you couldn't receive the SMS when you used the shortcode?You can get the cause of failure from record_status for details by receiving the SMS event.https://docs.aws.amazon.com/pinpoint/latest/developerguide/event-streams-data-sms.htmlSending SMS is subject to various restrictions depending on the country and regulations.After understanding the cause of the failure, it is necessary to consider whether countermeasures are possible or impossible.CommentShareEXPERTiwasaanswered a year ago"


Question: circular dependency between resources in CloudFormation template

"I am facing circular dependency between resources in CloudFormation templatewhen i try to deploy following template -Resources:  ExternalTablesRolesStack:    Type: AWS::CloudFormation::Stack    Properties:      TemplateURL: !Sub "${LibStackPath}/roles/template.yaml"  ExternalTablesBucket:    # http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html    Type: AWS::S3::Bucket    DependsOn: WriteWorkingBucketPolicy    Properties:      LifecycleConfiguration:        Rules:          - Id: LifeCycleRule            ExpirationInDays: 7            Status: Enabled  ParameterExternalTablesBucket:    # http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-parameter.html    Type: AWS::SSM::Parameter    DependsOn: ExternalTablesBucket    Properties:      Type: String      Value: !Ref ExternalTablesBucket      Name: !Sub '/${Stage}/AWS_EXTERNAL_TABLES_BUCKET'  ExternalTableColumnsParser:      # http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html      Type: AWS::Serverless::Function      DependsOn: [ExternalTablesBucket, WriteWorkingBucketPolicy]      Properties:        Environment:          Variables:            Stage: !Ref Stage        Events:          OnPlaceFileEvent:            Type: S3            Properties:              Bucket: !Ref ExternalTablesBucket  # must be defined in same template              Events: s3:ObjectCreated:Put              Filter:                S3Key:                  Rules:                    - Name: suffix                      Value: .csv        Handler: schema_parser.app.lambda_handler        Role: !GetAtt ExternalTablesParserRole.Arn  WriteWorkingBucketPolicy:    Type: AWS::IAM::Policy    Properties:      PolicyName: AllowWriteInternalBucket      PolicyDocument:        Version: "2012-10-17"        Statement:          - Effect: Allow            Action:              - s3:PutObject              - s3:DeleteObject            Resource:              - !Sub ["arn:aws:s3:::${Name}/*", Name: !Ref ExternalTablesBucket]      Roles:        - !GetAtt ExternalTablesRolesStack.Outputs.ServerlessFunctionRoleNamethen giving error asCircular dependency betweenresources: [ExternalTablesBucket,ExternalTableColumnsParserOnPlaceFileEventPermission,ExternalTableColumnsParser,WriteWorkingBucketPolicy,ParameterExternalTablesBucket]Is there any correct way to fix it?FollowComment"

Answer: "1After try some trial for fix template I had found correct way to prevent circular dependency -`stack operations go through the following order:create ExternalTablesRolesStackcreate ExternalTableColumnsParsercreate ExternalTableColumnsParserOnPlaceFileEventPermissioncreate ExternalTablesBucketcreate WriteWorkingBucketPolicyExternalTablesBucket comes later than ExternalTableColumnsParser. But old template let ExternalTableColumnsParser to depend on ExternalTablesBucket `Here is the correct template -Resources:  ExternalTablesRolesStack:    Type: AWS::CloudFormation::Stack    Properties:      TemplateURL: !Sub "${LibStackPath}/roles/template.yaml"  ExternalTablesBucket:    # http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html    Type: AWS::S3::Bucket    Properties:      LifecycleConfiguration:        Rules:          - Id: LifeCycleRule            ExpirationInDays: 7            Status: Enabled  ExternalTableColumnsParser:      # http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html      Type: AWS::Serverless::Function      Properties:        Environment:          Variables:            Stage: !Ref Stage        Events:          OnPlaceFileEvent:            Type: S3            Properties:              Bucket: !Ref ExternalTablesBucket  # must be defined in same template              Events: s3:ObjectCreated:Put              Filter:                S3Key:                  Rules:                    - Name: suffix                      Value: .csv        Handler: schema_parser.app.lambda_handler        Role: !GetAtt ExternalTablesRolesStack.Outputs.ServerlessFunctionRole  WriteWorkingBucketPolicy:    Type: AWS::IAM::Policy    Properties:      PolicyName: AllowWriteInternalBucket      PolicyDocument:        Version: "2012-10-17"        Statement:          - Effect: Allow            Action:              - s3:PutObject              - s3:DeleteObject            Resource:              - !Sub ["arn:aws:s3:::${Name}/*", Name: !Ref ExternalTablesBucket]      Roles:        - !GetAtt ExternalTablesRolesStack.Outputs.ServerlessFunctionRoleNameCommentSharedeepakanswered a month agoskinsman EXPERTa month agoGood news!  So you removed all the DependsOn as I suggested - please Accept my answer if you have a moment, to help other people find it.Share0Have a good look at your "DependsOn" statements.  They should be used sparingly, only in situations where CloudFormation needs to be told that resource A must be created before resource B or else creation of resource B will fail.Looking at for example:  ParameterExternalTablesBucket:    # http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-parameter.html    Type: AWS::SSM::Parameter    DependsOn: ExternalTablesBucketYou shouldn't have a DependsOn here because there is no need for the bucket to exist when you're creating the SSM parameter.  You're just setting a string value in the parameter that has no meaning to CloudFormation.Basically, remove all your DependsOn statements and you'll be able to tell by the CloudFormation errors if it turns out you really need any.CommentShareEXPERTskinsmananswered a month ago0Your ExternalTablesBucket has a DependsOn for WriteWorkingBucketPolicyYour WriteWorkingBucketPolicy has a Ref to ExternalTablesBucketRemove the DependsOn under ExternalTablesBucketCommentShareEXPERTkentradanswered a month ago"


Question: Can we trigger AWS Cloudwatch event bridge from AWS config aggregator?

"We are trying to trigger a lambda when certain AWS Config rules are breached. Currently, we have linked AWS Config with AWS Cloudwatch event bridge and this triggers the lambda on any rule breach.This works great for a single region, but for multiple regions, we will have to set up AWS config rules in that region and an event bridge integration, and a lambda handler in that region as well. This is a lot of additional setups to extend this trigger to multiple regions.So, we set up an AWS Config aggregator which collects AWS config rule breaches from all regions and accounts and consolidates them in one place. If we can set up an AWS Cloudwatch event bridge trigger on the AWS Config Aggregator, it will solve our problem. I could not find anything regarding this.Also, if there is any other way to solve this problem, please let us know. Any input is greatly appreciated. Thanks.FollowComment"

Answer: "0Hello,Unfortunately, the there is no integration in place yet between AWS Config Aggregator feature and AWS CloudWatch event rules. The reason for this is the AWS Config Aggregator feature is supporting Multi-account & Multi-region. However, AWS CloudWatch service (event rules) is a regional service. Therefore, at the moment we can't build Cloudwatch event rule based on the aggregated data received from multi-account & multi-region. Hence, as of now there is no out of the box solution.However that there is an existing feature request in place for this functionality of including CloudWatch Event Delivery along with the Config Aggregation,  As is the case with all feature requests, the internal team takes them seriously and evaluates every request, but we are unable to share any rough ETA for delivering this feature as inclusion of any new feature needs rigorous testing and shall be prioritized along with the team's additional workload. However, any new announcements will be made in our What's New page What's New page [https://aws.amazon.com/new/] and our Official Blog [https://aws.amazon.com/blogs/aws/].CommentShareSUPPORT ENGINEERAWS-User-6158549answered a year agovictoria b a year agoHello AWS-User-6158549.Could it worked if the eventbridge rule is created in every region but only in one account with the config aggregator?Share0any update about this topic?CommentShareaortegaanswered a month ago"


Question: Setup DynamoDB Accelerator (DAX) - Documentation is WRONG

"Hello,Im trying to setup DAX to handle caching for our DynamoDB logic for our existing kubernetes cluster.However, when I follow the guides, they are incomplete.From official doc here:https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.create-cluster.console.create-subnet-group.htmlOpen the **DynamoDB **console at https://console.aws.amazon.com/dynamodb/.In the navigation pane, under DAX, choose Subnet groups.However there are NO such thing as "DAX" under DynamoDB. There is simply create table etc. When I search DAX in the console, I get no hits.How exactly am I to understand how this is to be done when the official guide itself isnt correct?Same with guides I've found, they simply do not align with how it looks in real life.Help much appreciated since our Prod enviroment is in dire need of this ASAP.Kind regardsOlleFollowComment"

Answer: "1You do not see DAX as Stockholm is not a region which DAX is currently available. Use a compatible region like Dublin and you will be able to follow the example correctly.DAX is now available in the US East (N. Virginia), US East (Ohio), US West (Oregon), US West (N. California), South America (São Paulo), EU (Ireland), Asia Pacific (Singapore), Asia Pacific (Tokyo), Asia Pacific (Sydney), and Asia Pacific (Mumbai) Regions.CommentShareEXPERTLeeroy Hannigananswered 2 months ago"


Question: AWS IoT Core parser time with time zone

"Hi everyone.Someone can help me?I try to convert using the parse time function (parse_time(String, Long[, String])) in AWS Iot Core Rule, but it always results as UTC GMT (00:00), even though my AWS Region is Sao Paulo (sa-east-1).How can I get local time using parse_time function as UTC-0300?my Sql command used in Iot core rule is:...parse_time("yyyy-MM-dd'T'HH:mm:ssZZ", timestamp()) as timeStamp,...FollowComment"

Answer: "1Accepted AnswerHi argollo. You need to pass the timezone as a third argument. That argument should be Joda-time: https://joda-time.sourceforge.net/timezones.html. Otherwise it defaults to UTC.So parse_time("yyyy-MM-dd'T'HH:mm:ssZZ", timestamp(), 'America/Sao_Paulo').CommentShareEXPERTGreg_Banswered 2 months agoargollo 2 months agoHi Greg, thanks a lot!worked perfectly!BRAlexShare"


Question: AWS Glue partitions for data catalog table

I am trying to create a glue ETL of a very large legacy table that has been added by a crawler to the Glue Data Catalog.  The Glue documentation states I should be able to see/edit "partitions" for the table in the catalog.  I see no options anywhere in the DC to edit/create partitions or specify a column or expression to use for partitioning.  Is this functionality available?https://docs.aws.amazon.com/glue/latest/dg/partition-indexes.htmlFollowComment

Answer: "1Hello John,Unfortunately, it is currently not possible to add/create partitions to Glue table via the Glue console. However, it is possible to edit table schema which means you can add or remove partition columns in the console.If you want to edit the partition columns, you may follow the below steps, however, partitions would still need to be added to the table:Under Data catalog, select Tables, then select the table in which you want to create a partition.Select Edit schema option.Click on Add column and enter the preferred name, select the partition key checkbox, then Click Add.Click Save on the top right corner.5 Go back to the table details and you can click on View partitions option to check the partitions.I see that your Glue table had been created via a crawler. Ideally, a Glue crawler also adds partitions to the table if the data in S3 is stored in a partitioned format. I suspect that the data in S3 might not be in a partitioned format which is why crawler might not have created the partitions.You can manually add partitions to your table using the following approaches:Add Glue Table Partition using Boto 3 SDKYou can use AWS Boto 3 SDK to create glue partitions using the batch_create_partition() or create_partition() APIs.Using Alter Table Add Partition commandYou can run the Alter Table Add Partition SQL command via Athena to add the partitions manually into the table.https://docs.aws.amazon.com/athena/latest/ug/alter-table-add-partition.htmlhttps://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/glue.html#Glue.Client.create_partitionCommentShareSUPPORT ENGINEERrePost-User-1053431answered 10 months agojohnclarity 10 months agoThanks for your comments.  Sadly it isn't germane to the issue we are facing as we are using a MySQL database, NOT Athena or any cloud DB.   I was able from your tip to delete the datetime column and re-add it to the DC Table schema whilst checking the "partition" checkbox.  This caused the "Partitions and Indexes" option to show up under the table but sadly it says "Unsupported partition keys" for the column I specified as a partition column :(Share"


Question: Types of command to start an application using CodeDeploy

"Hello,I'm using CodeDeploy and CodePipeline to deploy my back-end Python Flask application on an EC2 instance with Github connection.Usually, to start the app locally I will use this command in the terminal:uwsgi --ini myapp:app_var_nameMy problem is that when I do this, the step "Application start" in the CodeDeploy "deployment" stage runs infinitely, until a timeout error happens that stops the pipeline.I confirmed the fact that the application was launched by sending a request to the public address.What kind of command line should I write to avoid any CodeDeploy stage to timeout?Does adding & to the command line enough?FollowComment"

Answer: "0Your task for "Application Start" hook requires to be finished after it start the application service.https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html#appspec-hooks-serverFor the uWSGI server that you use, it can be run through service manager like systemd. You should make the service to be stopped before the installation and start the service again after the deployment.Please check following uWSGI document for more information.https://uwsgi-docs.readthedocs.io/en/latest/Management.htmlCommentShareJunseong_Janswered a year ago"


Question: Amazon MSK updating is incredibly long

"I've just started Amazon MSK and created the cluster.Since I had to change the cluster configurations, I did the cluster configuration updating. Now more than 4 hours passed, but the updating is still in progress. Why Amazon MSK updating is spending too long? Does anyone know the reason why? I'm getting feel I might have to use self-hosted Kafka cluster rather than managed Kafka cluster.FollowComment"


Question: ECS microservices scaling with ALB target group limitation

"Hello,As stated in the alb docs the "Target Groups per Application Load Balancer" is set to 100 hard limit.I have a customer who is using ALB with ECS to implement their microservices and are up to 75 target groups and will at some point hit the 100 target group limit. Just wondering what or if their is a recommend way to over come this limit ?Best I can come up with is to have a small chain of ALBs. So have an entry ALB will route traffic based on some rules to say 3 other ALBs downstream that in turn point to the target groups that have the ECS services but not convince this is the best solution.Is there are alternative solutions then please let me knowthanksalexisFollowComment"

Answer:
"0Hi Alexis! Warm greetings.
You have mentioned that you are looking for an alternative solution to creating a chain of ALB’s.With regards to the target group limit, unfortunately there is no way to increase the limit even if you were to reach out to AWS to increase the limit for you .With that being said you could potentially increase the size capacity of your target groups instances so they can take up more requets.

You could also try switching from ECS to ESK. The idea behind it is that EKS can be part of a large federated cluster architecture. all applications managed by Amazon EKS are fully compatible with applications managed by any standard Kubernetes environment. In that sense, it can be argued that Amazon EKS is more extensible than Amazon ECS.Further more, AWS ECS at the moment offers more in-depth AWS integration than Amazon EKS, it may be considered the go to choice for straightforward container workloads if you’re looking to work only in the AWS cloud. It is also much easier for developers to learn, and has quicker prototyping mechanisms such as AWS Copilot. However, if you’re looking to run large microservices architectures, span deployments across multiple infrastructure providers, or need additional automation or flexibility provided by Kubernetes’ diverse toolsets, Amazon EKS offers more versatility with a much richer ecosystem of tools and resources.References:[1] https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html[2] https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html[3] https://aws.amazon.com/blogs/containers/amazon-ecs-vs-amazon-eks-making-sense-of-aws-container-services/CommentShareAntonioanswered a year agoalexis a year agoThanks for the suggestion and EKS is an option in the long term. The customer already has 75+ microservices running in production so a move to EKS would be a big undertaking and at the moment just looking to see if there is any short term solutions to the problem.Share"


Question: "Sagemaker local deployment: "RuntimeError: Giving up, endpoint: didn't launch correctly""

"Hi,I am trying to launch an endpoint locally, to do couple inferences from my dev notebook (without having to wait for instanciation time of actual endpoint or batch training). I am running the following code:# get trained model from s3trained_S2S = SM.model.Model(    image=seq2seq,    model_data=('s3://XXXXXXXXXXXXX/'        + 'output/seq2seq-2018-07-30-16-55-12-521/output/model.tar.gz'),    role=role) S2S = trained_S2S.deploy(1, instance_type='local')    I get the following error (several hundreds of lines repeated):WARNING:urllib3.connectionpool:Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7fa5c61eaac8>: Failed to establish a new connection: [Errno 111] Connection refused',)': /ping RuntimeError: Giving up, endpoint: seq2seq-2018-08-01-14-18-06-555 didn't launch correctlyFollowComment"

Answer: "0Accepted AnswerCurrently, SageMaker local is supported only for SageMaker framework containers (MXNet, TensorFlow, PyTorch, Chainer and Spark) and not for the Builtin algorithmsCommentShareAWS-User-7953554answered 5 years ago"


Question: AWS SDK for Go V2 - Get Elastic IP consumed quota

"Hello,I'm trying to use the SDK to figure out what is the available quota for Elastic IP (excluding used Elastic IPs).I can get the Elastic IP limit using the github.com/aws/aws-sdk-go/service/servicequotas client,And the current number of used Elastic IPs using the github.com/aws/aws-sdk-go-v2/service/ec2 client.Then calculate the available quota using subtraction.The challenge I'm facing is that in case the account contains a large number of IP addresses,fetching all of them can be time-consuming. While I'm interested only in the number of available Elastic IP addresses.I was hoping there is another function or endpoint I can query to get the number of available Elastic IPs insteadof going through this calculation.Thank you,Ori AdlerFollowComment"

Answer: "0Hi Ori,I understand that you are looking for way to find number of available (unused) EIPs in your account for a given region. In general for Elastic IPs that are not used in a VPC do not have the following properties (fields) or the value of these fields is set to Null :"AssociationId" , "NetworkInterfaceId", "NetworkInterfaceOwnerId", "PrivateIpAddress"You can run this API "describe-addresses" to get list of EIP in your account for the given region. example command to do so using AWS CLI is "aws ec2 describe-addresses --region us-west-2"Here are the AWS documents on topic :Describe address API : https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAddresses.htmlAWS CLI for Describe API : https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-addresses.htmlUsing the above information you can run a CLI command to query AWS EC2 endpoint to just provide list of Elastic IPs that are not associated to any resources (which also mean not used). Save the output in a .txt file and run grep to count the unused EIPs for that region.You will have to customize this using SDK but here is how I accomplish this using AWS CLI in my test environment:Run this command on CLI to get list of unused EIPs : "aws ec2 describe-addresses --region us-west-2 --query 'Addresses[?AssociationId==null]' >> test.txt".Instead of AssocationID you can other fields  "NetworkInterfaceId", "NetworkInterfaceOwnerId", "PrivateIpAddress" as well. In this command I am saving my result in test.txt file.Now use grep to count number of time Allocation-ID is repeated in my output (as this field is present in output once for every IP). Here is the command : "grep -o -i AllocationId test.txt | wc -l" , "grep -i -c AllocationId test.txt" both the commands will give same output. If you also want list of Allocation-ID as well you can run this command : "grep -i AllocationId test.txt"With the steps mentioned above you will get number of Unused EIPs in your account for that region.If you are looking for a way to get number of EIPs that are not yet allocated to your account (or get the number of EIP you can allocated to your account before you hit the service quota limit) then as of now we do not have any direct API call which can perform this action. All API calls related to EIP are made to AWS EC2 endpoint and EC2 endpoint do not provide information on number of "utilized" or "not utilized" value for this service quota as of now. To get this information you can either write a script which will get both "service quota" and "current EIP count" do the calculation on your behalf and provide the information. Which will be similar approach as you are currently taking.I hope this information helps.CommentShareSUPPORT ENGINEERWilsina_Ranswered a year ago0Thank you for this great answer.I have two follow-up questions:Because I'm interested only in the total number of addresses, is there a way to fetch the total number of addresses without their content? I'm just interested in the length of the array returned from this API call []types.addresses of describeAddressesOutput.What is the maximal number of results for this operation?CommentShareAWS-User-6944452answered a year ago"


Question: "www.example.com doesn't work, but www.example.com/index.html does"

"Hello,I am setting up a static website with s3 and cloudfront, and my site https://www.example.com/index.html loads just fine, but https://www.example.com doesn't - it throws a 403 error.I have a hosted zone in route 53 for example.com with 6 records:example.com type A routing to my cloudfront distribution, similar to abcd123456789.cloudfront.netwww.example.com type A again routing to my cloudfront distribution abcd123456789.cloudfront.netexample.com type NS routing to my 4 nameservers, similar to ns-1234.awsdns-01.comexample.com type SOA routing to the first nameserver of the NS record, so ns-1234.awsdns-01.comrandomcharacters1.example.com type CNAME routing to randomcharacters2.tftwdmzmwn.acm-validation.awsrandomcharacters3.www.example.com type CNAME routing to randomcharacters4.tftwdmzmwn.acm-validation.awsThe two CNAME records are pulled from aws CM > certificates > name of certificate > Domains, where it lists one of the records for example.com and the other for www.example.com.Also, here is the complete list of what happens when I type these urls into the browser:example.com - redirects to https://example.com - 403 errorwww.example.com - redirects to https://example.com - 403 errorhttps://example.com - 403 errorhttps://www.example.com - 403 errorhttp://example.com - redirects to https://example.com - 403 errorhttp://www.example.com - redirects to https://example.com - 403 errorexample.com/index.html - redirects to https://example.com/index.html - displays correctlywww.example.com/index.html - redirects to https://www.example.com/index.html - displays correctlyhttps://example.com/index.html - displays correctlyhttps://www.example.com/index.html - displays correctlyhttp://example.com/index.html - redirects to https://example.com/index.html - displays correctlyhttp://www.example.com/index.html - redirects to https://www.example.com/index.html - displays correctlySo it's the case that whenever I add /index.html the site works, but when I don't, it doesn't.Default root object under Cloudfront > Distributions > distribution name > General > Settings is example-com.s3.us-east-1.amazonaws.com/index.html.A link to an earlier related question I asked is hereFollowComment"

Answer: "2Accepted AnswerThe default root object is configured incorrectly. According to the docs it should only be the object name relative to the bucket without any prefix /. In your case it should be index.html.https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DefaultRootObject.htmlCommentShareEXPERTMassimilianoAWSanswered a month agoJeff F a month agoIt worked. I am eternally grateful.Share0You could use a CloudFront Function to append index.html to requests that don't specify a filename: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/example-function-add-index.htmlCommentShareEXPERTBrettski-AWSanswered a month ago-1I had a similar problem with the s3/cloud front configuration for my blog site. I had to use a custom origin in the cloudfront distribution.If you look at https://headforthe.cloud/article/hosting-a-static-blog-in-aws/, it shares the terraform I used to deploy my site, specifically at https://headforthe.cloud/article/hosting-a-static-blog-in-aws/#cloudfront.CommentShareSimon Hanmeranswered a month ago-1Make sure that you have set up the S3 bucket to act as a static websiteCheck if the "Origin Domain Name" is set to the S3 website endpoint (e.g., example-com.s3-website-us-east-1.amazonaws.com) instead of the bucket's REST endpoint (e.g., example-com.s3.us-east-1.amazonaws.com). If not, update the "Origin Domain Name" to the S3 website endpoint.In the CloudFront Management Console, select your distribution and click on the "Distribution Settings" tab. Under "Default Root Object," set the value to "index.html" (without the bucket URL). This setting ensures that when users request the root URL of your website, CloudFront serves the "index.html" file.and Please Checkhttps://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/GettingStarted.SimpleDistribution.htmlCommentShareEXPERTsdtslmnanswered a month ago"


Question: Is SNS HTTPS authentication via (golang) sdk broken?

"I am able to set up an unauthenticated subscription to a topic without issues, both using the web console and via the golang sdk.I have tried to add basic authentication to the endpoint, however I'm seeing some strange behaviour. When I set the endpoint https://username:password@x.example.com/path via the golang sdk, the credentials I get sent are username:****! The console list of subscriptions displays the endpoint as https://username:****@x.example.com/path, so it looks like it's using the display password as the actual one?I attempted to do the same via the console. This displays the same endpoint (with redacted password), but the subscription confirmation request sends the correct credentials through. Once the subscription is confirmed though I am able to click through it in the console and it's displayed as https://username:password@x.example.com/**** - it's redacting the path and not the password! I have not yet sent any messages via the topic as I'm not set up for it easily to know if it works ok for notification messages, and I cannot click through an unconfirmed request to see how the sdk created subscription shows.So, I think there are 2 issues - setting basic auth credentials from the (at least golang) sdk results in invalid passwords being set, and creating it via the console redacts the wrong information, leaking the endpoint password. Has anyone else seen similar behaviour? I'm going to include the security tag as it seems to me there is an attempt being made to redact the password from the console but it's failing.FollowComment"


Question: "aws-sdk-php, IamClient - How to update policy json, the 'PolicyDocument'?"

"https://docs.aws.amazon.com/aws-sdk-php/v3/api/class-Aws.Iam.IamClient.htmlThe "role" section makes sense to me.There is createRole, getRole, deleteRole, and updateRole.  Also, the getRole function returns the 'AssumeRolePolicyDocument', so I could compare it to what I want it to be and update it if necessary with the updateRole function.The "policy" section seems to be missing functionalityThere is createPolicy, getPolicy, and deletePolicy - but there is no updatePolicy?When you run 'createPolicy', you pass in the 'PolicyDocument' as json.  But the 'getPolicy' function does not return the 'PolicyDocument' so I can confirm it's correct.  I don't see how to query this information.  There also isn't a getPolicyDocument function.And if I was able to get the PolicyDocument json, how would I update the Policy?  Is there a function that I'm overlooking?Or am I logically approaching this problem incorrectly?FollowComment"

Answer: "0Accepted AnswerI see, I need to manage through Policy Versions.There is CreatePolicyVersion, DeletePolicyVersion, GetPolicyVersion, ListPolicyVersions, and SetDefaultPolicyVersionThis obviously covers it.CommentShareAWS-User-3699386answered a year ago"


Question: How to sync big SAP datasources using Appflow

"Hello everyone,I'm currently working on loading heavy SAP datasources, such as 0FI_ACDOCA_10, using Appflow to S3.Initially, I set up a flow run in incremental loading mode without any filters. However, this approach frequently encountered errors due to network connection issues, timeouts, ...So, I decided to split the loads into multiple parts, such as one load per week. After that, I set up a schedule using incremental loading mode to run daily and capture new data changes. However, this schedule requires an initial load, which means I need to set a filter to retrieve data equal to or greater than the current month using a date field. Unfortunately, this approach filters out any data changes from previous months, even if they were captured using delta mode.Ideally, the flow for running incremental loading should be able to capture data changes without the need for an initial load?If you have any solutions or suggestions for this situation, I would greatly appreciate it.Thank you.FollowComment"

Answer: "3Due to the characteristics of the SAP datasource, the AppFlow integration can be complex when handling large data loads.To optimize the SAP extractor or use a different extractor if possible. Some extractors allow more granular filtering, which can help improve the efficiency of data extraction and reduce the size of each data pull.Or you can use AWS Glue to extract dataI offer you o follow the following articleshttps://aws.amazon.com/blogs/awsforsap/architecture-options-for-extracting-sap-data-with-aws-services/https://aws.amazon.com/blogs/awsforsap/extracting-data-from-sap-hana-using-aws-glue-and-jdbc/https://aws.amazon.com/blogs/awsforsap/run-federated-queries-to-an-aws-data-lake-with-sap-hana/CommentShareEXPERTsdtslmnanswered 18 days ago"


Question: Should I use Cognito Identity Pool OIDC JWT Connect Tokens in the AWS API Gateway?

"I noticed this question from 4 years ago: https://repost.aws/questions/QUjjIB-M4VT4WfOnqwik0l0w/verify-open-id-connect-token-generated-by-cognito-identity-poolSo I was curious and I looked at the JWT token being returned from the Cognito Identity Pool. Its aud field was my identity pool id and its iss field was "https://cognito-identity.amazonaws.com", and it turns out that you can see the oidc config at "https://cognito-identity.amazonaws.com/.well-known/openid-configuration" and grab the public keys at "https://cognito-identity.amazonaws.com/.well-known/jwks_uri".Since I have access to the keys, that means I can freely validate OIDC tokens produced by the Cognito Identity Pool. Moreso, I should be also able to pass them into an API Gateway with a JWT authorizer. This would allow me to effectively gate my API Gateway behind a Cognito Identity Pool without any extra lambda authorizers or needing IAM Authentication.Use Case: I want to create a serverless lambda app that's blocked behind some SAML authentication using Okta. Okta does not allow you to use their JWT authorizer without purchasing extra add-ons for some reason. I could use IAM Authentication onto the gateway instead but I'm afraid of losing formation such as the user's id, group, name, email, etc. Using the JWT directly preserves this information and passes it to the lambda.Is this a valid approach? Is there something I'm missing? Or is there a better way? Does the IAM method preserve user attributes...?FollowComment"


Question: How to restore S3 bucket files if I did not have versioning turned on

"hi,I accidentally deleted all my (*.mp4) files on my S3 bucket and went to restore and saw that I needed to turn versioning on in order to restore the files, unfortunately I did not have versioning on, so is there anyway I can store my files from any backup that Amazon might be taking?ThanksAmirFollowComment"

Answer: "0Sorry, but your files are gone :-(For future you could enable versioning and/or AWS Backup for S3.https://docs.aws.amazon.com/aws-backup/latest/devguide/s3-backups.htmlCommentShareKalluanswered 3 months agoEXPERTkentradreviewed 3 months ago"


Question: AWS Managed Blockchain - Consortium networks

"My question is about whether it is possible to build a permissioned network with Proof of Authority on Ethereum, making use of the AWS Managed Blockchain service. If possible, I would like to know the limits of gas per block that can be handled.FollowComment"

Answer: "0AMB launched Goerli support yesterday (5/03/2022), which provides POA on a test network. This is your best option to use Proof of Authority on Amazon Managed Blockchain.CommentShareJCanswered a year agoarodriguez a year agoThanks for your answer. I'm interested in building my own network using consensus algorithm like IBFT, QBFT, etc, not in using a testnet. The main goal is to build a consortium.Share"


Question: Issue on RDS SQL Server native backup over S3

"Hello,we have migrated to RDS SQL Server 2019. We have configured some tasks to make daily backups to S3 as explained on https://docs.aws.amazon.com/es_es/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.html.In our tests everything was perfect. However, after the real migration backups are working fine for all databases except one of them (it only worked in the first and second execution). We receive this error on RDS:Error de escritura en '90ED53E1-C302-4079-B1D4-FB342E653B48': 995(The I/O operation has been aborted because of either a thread exit or an application request.)  Encountered an error while uploading an S3 chunk: Part number must be an integer between 1 and 10000, inclusive  S3 write stream upload failed.I found that this error occurs in other cases 3 years ago: https://repost.aws/questions/QU_qO619dVT7-qiwtK8WgGhAIs there any way to solve this issue?Best regards.FollowComment"

Answer: "0Hello,Can you try to increase the size of the ‘part’ with the advanced configuration setting and see if it makes a difference, since this could be due to the size being too small.The part size can be up to 5 GB.Note: If you use the Amazon S3 console, the maximum file size for uploads is 160 GB. To upload a file that is larger than 160 GB, use the AWS CLI, AWS SDK, or Amazon S3 REST API.Also, optimize the performance by going through the below mentioned link:https://aws.amazon.com/premiumsupport/knowledge-center/s3-upload-large-files/ -- [1]CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 8 months ago0Hello,thank you but we can't change the size of the part because it's an RDS procedure that we can't modify. We have got better results increasing the number of files in  the parameter "XXX" of procedure msdb.dbo.rds_backup_database.We'll see if it works always but anyway this is a problem from RDS backup system.Best regards.CommentSharemontystranswered 8 months ago"


Question: How to configure a custom domain name for api gateway in a multi region scenario?

"I am following a tutorial to create an aws route 53 hosted zone for my domain via a cloudformation stack , as suchZone:  Type: AWS::Route53::HostedZone  Properties:    Name: example.comnow , i understand, i have to create a ssl certificate and a custom domain name for my api gateway  in each regions . in each region , i plan to create following resources, but i'm not sure what value ( ??? , see below)  i should use , in the template below. in each region , for the certificate , what is the domain name i should use , should i create aus-east-1.example.com and us-west-1.example.com separately ? i'm not sure how to link the api gateway in both regions to my domain name (example.com)cert:  Type: AWS::CertificateManager::Certificate   Properties:      DomainName:  ????       DomainValidationOptions:          - DomainName:  ????             ValidationDomain: example.com       ValidationMethod: DNS  ApiGWCustomDomain:    Type: AWS::ApiGateway::DomainName    Properties:       DomainName: ???      CertificateArn: !Ref cert      EndpointConfiguration:        Types:          - Regional      SecurityPolicy: TLS_1_2FollowComment"

Answer: "0In API Gateway, you can create the same regional custom domain (e.g., test.example.com) in multiple regions. Each custom domain name in API Gateway comes with a target domain name. You can use the target domain name value for the route53 or you can use an alias record. I recommend reviewing this blog post.References:Setting up custom domain names for REST APIsSetting up a regional custom domain name in API GatewayCommentShareTaka_Manswered 8 months agoclouduser 8 months ago@Taka_M - thanks. I did review the blog post you linked. it is helpful. if possible, could you clarify few things for me , so i need a domain name, and a hosted zone , which will be global resources . in each region, I will need to set up a regional custom domain (which can be same, based on your comment) . do i need to create ssl cert in both regions? also , i see in the configuration for custom domain name , there is a hosted zone id field , i assume it must be same for both custom domain names? in other words, in my example , i've created a hosted zone for my domain name. but in second region , will it be a different hosted zone id?ShareTaka_M 8 months agoYour understanding is correct. You do need a certificate for each region.For an API Gateway Regional custom domain name, you must request or import the certificate in the same Region as your API. The certificate must be signed by a publicly trusted Certificate Authority and cover the custom domain name.Getting certificates ready in AWS Certificate ManagerFor Route53, you do not need another hosted zone. You can take a look at this CloudFomration template for the blog post that shows how to create multiple record sets for the same hosted zone.Share"


Question: "EC2 Instance with recurrent I/O errors, but fsck reports filesystems as clean"

"I have a Linux (Ubuntu) instance running as m3.xlarge - this server is getting IO errors across multiple EBS volumes. I have unmounted the volumes and run fsck on them. One found some problems that were fixed, the others reported as clean. On restart, after a while (hour) I received more IO errors. As multiple volumes are involved, I wondered if there was an underlying hardware problem (I have multiple other very similar instances which are functioning as normal). I have stopped/started the instance to see if that would move it to a new host, but there is no way of telling.Suggestions on finding the issue? Is there a way to confirm if an instance has moved to a new host?FollowComment"

Answer: "0Hi, thank you for your question. In most cases, starting and stopping your instance will migrate the instance to another physical host computer [1]. If you have stopped/started the instance multiple times and the I/O errors persist, it is likely that the problem lies within the instance itself, rather than the underlying host/hardware. Please refer to this guide for help troubleshooting common I/O errors within your EC2 instance [2].Additionally, please ensure that your read/write IOPS are not exceeding the capacity of your EBS volumes. You can view your read/write IOPS by monitoring the VolumeReadOps and VolumeWriteOps volume metrics in CloudWatch [3].[1] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html[2] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstances.html[3] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.htmlCommentShareArthur_Vanswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 9 months ago"


Question: VPC end point was not connecting

"Hi,An internet-facing VPC endpoint has been created for the AWS Transfer family.However, I was unable to telnet that vpc endpoint.Using a cloud formation YAML template, I created this.Note: I am not sure where I made a mistake from my end. Can anyone help me?Thanks,FollowComment"

Answer: "1Accepted AnswerCheck if communication is allowed by the security group configured for the VPC endpoint.CommentShareEXPERTRiku_Kobayashianswered 22 days agoMahendra Kumar V 21 days ago@Riku kobayashi, Thanks for suggesting an answer to my concern.I have modified Sg, But Still, the issue was not fixed.Can you please give me some other alternate solution's?ShareMahendra Kumar V 21 days ago@Riku kobayashi, Possible can you please take my yaml template, do you have a chance to run this into your testing account and share me corrected file?This will be a huge support for me,Thanks,ShareRiku_Kobayashi EXPERT20 days agoI think you need to specify the security group for the VPC endpoints of the TRANSFER family as I answered in this question.https://repost.aws/ja/questions/QUqXCFQ7SSRUeBQEDxwt_YUw/aws-transfer-family-vpc-end-point-not-workingShareRiku_Kobayashi EXPERT19 days agoIf the issue has been resolved, can you please approve the answer for the betterment of the community?Share"


Question: Glue Mongo connection not working

"I am trying to create a connection from AWS Glue to MongoDB, but when I test the connection it fails with error: "Check that your connection definition references your Mongo database with correct URL syntax, username, and password. Exiting with error code 30". I know that my connection parameters are correct because I can connect with the same host, port, database, user name, and password from another client application (Mongo Compass). And I know that my VPC configuration should be correct too because I have another connection in the Glue, to connect to the PostgreSQL database on-premise with public IP, that works just fine. I need to use this connection in my ETL job.Can anyone help me to connect MongoDB from Glue.FollowComment"

Answer: 0I am using MongoDB Atlas cluster and AWS Glue and I am unable to connect from AWS Glue to MongoDB atlasThis StackOverflow discussion "https://stackoverflow.com/questions/64300562/connecting-to-mongodb-from-aws-glue" says AWS have problems on their side with SSL certificates with ETA to fix in January 2022.Is this problem been solved?CommentShareruslan-8137137answered 10 months ago


Question: How to get task status in Amazon connect

HiHow can you get task status programatically in amazon connect.Essentially i want to query the status of a task before sending another one to amazon connect . To see if it's expired or handled etc.. is this possible?I had look in api docs I couldn't find what I am afterI would like to be able track the status of task so I can query themPlease adviseCheersCodebugFollowComment

Answer: "1we have an example please update accordinglyand before Please refer to the following documentation about GetContactAttributeshttps://docs.aws.amazon.com/connect/latest/APIReference/API_GetContactAttributes.htmlimport boto3connect_client = boto3.client('connect')# Replace contact_id with the ID of your contactresponse = connect_client.get_contact_attributes(    InitialContactId='contact_id')# Extract the status attribute from the responsestatus = response['Attributes']['status']# Do something based on the statusif status == 'handled':    # Handle the taskelif status == 'expired':    # The task has expiredCommentShareEXPERTsdtslmnanswered a month agoCodeBug a month agoThanks for the info . Essentially I have an external app wants to query the status of a a task that has been submitted in the past.  The attribute status you have provided is not available for tasks . I can only see it available for cases? From where I cant get the proper status for tasks.  then i can add it as an attributeSharesdtslmn EXPERTa month agoSorry i have added another answer for this oneShare1as a workaroundhttps://docs.aws.amazon.com/connect/latest/APIReference/API_StartTaskContact.html#API_StartTaskContact_RequestSyntaxWhen creating a task, you can set custom attributes for the task. Add an attribute (e.g., "status") to the task with an initial value (e.g., "pending"). This way, you will be able to track the status of the task.response = connect_client.start_task_contact(    InstanceId='your_instance_id',    ContactFlowId='your_contact_flow_id',    Name='your_task_name',    Attributes={        'status': 'pending'    })Inside the contact flow associated with the task, use a Lambda function or an Amazon Connect API to update the "status" attribute based on the task's progress (e.g., "in_progress", "completed", "failed", etc.).To query the status of a task from your external application, you can use the get_contact_attributes API call as mentioned in my previous response. You can then use the "status" attribute value to determine the current status of the task.CommentShareEXPERTsdtslmnanswered a month ago"


Question: DescribeEndpoint from inside a lambda

"I am setting up a CF stack using the CDK.  I am planning on having API gateway host a Lambda function to return the IoT Core mqtt endpoint for my remote IoT clients.Is there a way within the SDK to call DescribeEndpoint from inside the lambda, or do I have to fetch() it from the URL?  I'm not quite sure how I would go about calling that, since it needs account permissions.Inside my Lambda, I'm trying this:export async function getMqttEndpoint(request: APIGatewayProxyEventV2): Promise<APIGatewayProxyResultV2> {    const client = new IoTClient({});    const command = new DescribeEndpointCommand({        endpointType: "iot:Data"    });    return client.send(command)        .then((response) => {            return {                body: response.endpointAddress            }        });}FollowComment"

Answer: "0Accepted Answerok I figured it out.  I just didn't have the right permissions granted to the lambda.In case anybody ever needs this in the future, here's how I did this in CDK:        const extraPolicyStatements = new iam.Policy(this, 'describe-endpoint-policy', {            statements: [                new iam.PolicyStatement({                    actions: ["iot:DescribeEndpoint"],                    resources: ["*"]                }),                new iam.PolicyStatement({                    actions: ["logs:CreateLogGroup"],                    resources: [`arn:aws:logs:${this.env.region}:${this.env.account}:*`]                }),                new iam.PolicyStatement({                    actions: [                        "logs:CreateLogStream",                        "logs:PutLogEvents"                    ],                    resources: [`arn:aws:logs:${this.env.region}:${this.env.account}:log-group:/aws/lambda/*:*`]                })            ]        });        const role = new iam.Role(this,            "abcdEndpointExecRole", {                roleName: "abcdEndpointExecRole",                assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),                inlinePolicies: {                    "describe": extraPolicyStatements.document                }            });then gave that to the Lambda as its role.  Not sure that's the best way or not but it is readable and it wroks.CommentSharewz2banswered 7 months agoOzy smile 7 months agoAre you making sure that CF will not do any caching?Share"


Question: "Microsoft support for Windows Server 2012 R2 ends October 10, 2023"

"We currently are using Amazon Elastic Compute Cloud t2.large with Windows Server 2012 R2. Microsoft support for Windows Server 2012 R2 ends October 10, 2023. Does that mean we’ll need to upgrade our current AWS setup? If so, what is the cutoff date for when this needs to get done.FollowComment"

Answer: "0Short answer is YES.As for the cut off date, it's not clear for now.The below contents might be helpfulhttps://aws.amazon.com/emp-windows-server/?nc1=h_lsCommentSharerePost-User-5208427answered 2 months ago"


Question: How to avoid SMS template rejection without mentioning brand name in sms content?

We are like a shopify for hotels. We would like to send SMSes. But on behalf of our hotel customers. We do not expose our brand to hotel guests. How do we send SMSes. Templates are getting rejected because they do not have our company name in them.FollowComment


Question: How to checkpoint SageMaker model artifact during a training job?

"Hi,Is there a way to regularly checkpoint model artifact in a SageMaker training job for BYO training container?FollowComment"

Answer: "0Accepted AnswerIf you specify a checkpoint configuration (regardless of managed spot training) when starting a training job, checkpointing will work. You can provide a local path and S3 path as follows (API reference):"CheckpointConfig": {   "LocalPath": "string",  "S3Uri": "string"}The local path defaults to /opt/ml/checkpoints/, and then you specify the target path in S3 with S3Uri.Given this configuration, SageMaker will configure an output channel with Continuous upload mode to Amazon S3. At the time being, this results in running an agent on the hosts that watches the file system and continuously uploads data to Amazon S3. Similar behavior is applied when debugging is enabled, for delivering tensor data to Amazon S3.As commented, sagemaker-containers implements its own code to save intermediate outputs and watching files on the file system, but I would rather rely on the functionality offered by the service to avoid dependencies on specific libraries where possible.Note: when using SageMaker Processing, which in my view can be considered an abstraction over training or, from another perspective, the foundation for training, you can configure an output channel to use continuous upload mode; further info here.CommentShareEXPERTGiuseppe_Panswered 3 years ago"


Question: "Unable to import module 'lambda_function': No module named 'google'"

"I am trying to import google modules to my lambda function, but keep getting the error where I am Unable to import module 'lambda_function because there no module named google. I've tried adding a layer  with the zipped up file of all of the google library packages that I need into the Lambda function. The function just doesn't detect the library.This is my lambda_function.py code in Lambda. The import statements are listed above.import osimport jsonimport google.authimport google.oauth2.credentialsfrom google.oauth2 import service_accountimport googleapiclient.discoveryimport datetimeimport requestsdef lambda_handler(event, context):    name = event['name']    email = event['email']    phone = event['phone']    date = event['date']    time = event['time']    permit_type = event['permit-type']    create_event(name, email, phone, date, time, permit_type)    return {        'statusCode': 200,        'headers': {            'Content-Type': 'application/json'        },        'body': json.dumps({'message': 'Event created successfully!'})    }This is the command I used to import the google libraries.pip install google-auth google-auth-oauthlib google-auth-httplib2 google-api-python-clientThe directory in the lambda function looks like this currently:My hander is lambda_function.lambda_handlerIf anyone has some sort of insight or a solution to this, it would honestly be awesome. Thank you in advance!FollowComment"

Answer: "0Are you able to create layers this way?https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.htmlIn your case, I think you need to zip the module and set it to layers with the following command.pip install google-auth google-auth-oauthlib google-auth-httplib2 google-api-python-client -t .zip -r  ../python .CommentShareEXPERTRiku_Kobayashianswered a month agorePost-User-0521233 a month agoI'll give it a try. Would I need to adjust the command you gave me, or can I just run it as it is?ShareRiku_Kobayashi EXPERTa month agoIt is recommended to run the command in an empty directory, since the modules are all placed in the directory where the command is executed.SharerePost-User-0521233 a month agoI gave it a try and unfortunately it did not work. Im not sure if I did it correctly but after running the commands, I downloaded the zip locally and then created a layer in my function and uploaded the zip to it.Share"


Question: Partial Indexes not implemented.

"partial indicies" are part of MongoDB since version 3.2. Is this feature on the roadmap for DocumentDB? Any workaround till this is implemented?Source: https://docs.mongodb.com/manual/core/index-partial/FollowComment

Answer: "0Correct. Partial indexes are not supported at this time: https://docs.aws.amazon.com/documentdb/latest/developerguide/mongo-apis-index.htmlAbsent of partial indexes, any workaround would require additional work in the application to create an additional field that is indexed and filtered.We do not have an ETA to share at this time.CommentShareAWS-User-2073714answered 4 years agoDaltro_Gama a month agoFour years passed and this feature is important for better design and resource usage. No ETA yet?Share0Thank you for the answer.CommentSharemiscanswered 4 years ago"


Question: domain transfer pleas add TLD .love to Route 53

"Hello, I would like to transfer a domain with TLD .love to you but this domain is not listed. Can you add it there please?FollowComment"

Answer: 0I join this request to add the .love TLD to the Route 53 domain list. Thank you.CommentSharerePost-User-3148413answered 8 months ago


Question: FSx SSD IOPS performance

"Customer would like to know the IOPS performance when the volume is <1TiB. From doc ( https://docs.aws.amazon.com/fsx/latest/WindowsGuide/performance.html ), it stated 3,000 Disk IOPS per TiB of storage, what if customer provisioned 500GiB volumes, will it be 3,000/1,500 IOPS? (Shall we consider 3 IOPS per GiB?)FollowComment"

Answer: "0Accepted AnswerYes, that's right. Amazon FSx for Windows File Server provides 3 IOPS per GB of storage capacity for SSD storage.CommentShareAWS-User-9252611answered 3 years ago"


Question: Does eb deploy change the instance's public IP or not?

"Why this question?If eb deploy does change the IP address of ec2 instance then it is okay to use eb ssh and then select the instance number or id, depending upon how many instances are there in a single environment.If not, why not just directly ssh -i <key.pem> ec2-user@<instance-ip>Am I missing something here?FollowComment"

Answer: "0depending on the Elastic Beanstalk deployment policy you have selected for your environment, this can cause the replacement of the instances. and it will cause the IP address to change.My recommendation is to not use public subnets for your instances to prevent risks and use the SSM session manager to connect to the instances if needed.CommentShareEXPERTDamian Olguinanswered 14 days ago"


Question: I can't get certificate in Certificate Manager Service

I can't get a certificate even though I create cname type record.Status "pending validation".Can anyone help?FollowComment

Answer: "1Accepted AnswerHi ThereYou have an issue with your Name Servers it seems.  Notice there is no response to my dig command below.  You need to make sure the Name Severs in the domain registration are the same as the Route53 hosted zone, there is probably a mismatch.Get the name servers that Route 53 assigned to the hosted zone when you created it. See "Getting the Name Servers for a Public Hosted Zone" in the Route 53 Developer Guide:   https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlUpdate the domain registration to use the name servers that you got in step 1. See https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.html#domain-name-servers-glue-records-adding-changingCommentShareEXPERTMatt-Banswered 3 months agomesutal 3 months agothanks for everything. yes my domain name is not active. I don't know what to do any more. I deleted the hosted zone and created it again. I guess I have no choice but to wait.ShareMatt-B EXPERT3 months agoHi, what do you mean by "my domain name is not active"?  If you delete the hosted zone and create it again, you MUST update the name servers in the Domain Registration.  When you create a new hosted zone, they will change.  See https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.html#domain-name-servers-glue-records-adding-changingSharemesutal 3 months agoMy problem is solved. Thank you for everything. Thank you so much!!!!!ShareMatt-B EXPERT3 months agoNo Problem!  If you wouldn't mind, please post the solution and mark the answer as "Accepted" so that others in the community having the same issue can benefit from your findingsShare1Need to dig in on how is the cname type record that you createdSome potential issue like :additional characters or is missing characters during record creationDNS provider automatically adds the bare domain to the end of its DNS recordshttps://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-pending-validation/CommentSharewkkamaruanswered 3 months agomesutal 3 months agoI clicked on the "create records in route 53" button that appeared when I entered the certificate I created. I don't think there is an error in the registry name Does aws have a service like solving the problem directly through my account? because that's not how it will be solved.Share0If I send an AWS email. Can AWS authorities solve my problem through my account?CommentSharemesutalanswered 3 months agoMatt-B EXPERT3 months agowhat is the domain name?Sharemesutal 3 months agomy domain name is ahmetmesutal.clickShare0Hi ThereIs your domain name registered with AWS and if not, are the Name Servers pointing to Route53?CommentShareEXPERTMatt-Banswered 3 months agomesutal 3 months agoi registered domain name with AWSShare"


Question: Returning remaining CPU burst capacity after retirement

"According to AWS's instance retirement plan about the Amazon Lightsail Instances, they can be stopped and started again after the retirement.But, after their restart, these remaining CPU burst capacity is reset even though it was full before their retirement. I think it is reasonable that AWS returns these last capacity because instances are stopped for retirement by AWS, not user. resulted metric graphBut, AWS instance maintenance does not reset it. I just want like this.FollowCommentRodney Lester a year agoI cannot address the request for burst capacity, but a stop/start of an instance is required to move the instance to new hardware and that is likely why it was reset.ShareLipi a year ago@Rodney Lester, Thanks for your comment. My point is that the instance having full capacity is stopped by AWS's retirement, not me(or user). So I think AWS should return the instance with full capacity or last capacity amount if not full when it is started.Share"


Question: SES IP Blacklisted by spamcop.net

"Hi Support Team,we just faced the following issue,Mar 23 14:18:33 mail postfix/smtpd[59466]: NOQUEUE: reject: RCPT from a9-30.smtp-out.amazonses.com[54.240.9.30]: 554 5.7.1 Service unavailable; Client host [54.240.9.30] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?54.240.9.30;Could you please take care of this, or please advise how to fix this issue ASAP?Thanks in advanced.FollowComment"

Answer: "0For immediate support, you should create a support case.The FAQs in the developer guide have a few recommendations. You could try contacting the postmaster of the domain that rejected your message.If that is not feasible, you should consider using a dedicated IP address. The address is dedicated to you and allows you to control the reputation of that address.CommentShareJeremy_Sanswered a year ago"


Question: Send Wait Condition Signal from Lambda

"I'm trying to send a Cloudformation Wait Condition Signal from a js lambda function once the infrastructure is done provisioning. I'm using Axios to PUT FormData trying to emulate the curl request shown in the docs (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-waitcondition.html). Cloudformation shows an 'unparsable WaitCondition data' error.Has anybody had success doing this?FollowCommentrePost-User-7619589 a year agoI didn't find the solution. But, there was a better way of handling my situation. Having the lambda wait until the infrastructure was finished by polling its status before returning prevents the rest of the stack from provisioning which is what I wanted.Share"

Answer: 0What are you creating in CloudFormation vs. what is running post-provisioning?Lambda could be a way to signal but personally I'd prefer signaling from within the resource you're creating (especially when talking about EC2).CommentShareEXPERTRaphaelanswered 10 months ago


Question: Combinatorial Loop

"Hello,I am using Vitis flow to create an RTL kernel.I have an intentional 'combinatorial loop':In the design, multiplexers are used to connect some number of LUTS in different ways based on a register value.Register value will never be such, that LUTS are connected in an actual loop, but the synthesis tool still sees it as one.Is there a way to write a constraint to break the loop during Timing analysis, like when working with the Vivado on a local board.If there is none, and loops are generally prohibited, do you know if it is noted in any documentation, so I can deliver that as a formal confirmation?Thanks in advance,DjordjeFollowComment"

Answer: "0Dear customerThank you for reaching out to AWS. Yes, F1 does not allow combinatorial loops and is documented in Erratahttps://github.com/aws/aws-fpga/blob/master/ERRATA.mdIs combinatorial loops strictly required for your design and can not be addressed with other microarchitecture updates/design techniques?ThanksKishoreCommentShareAWS-User-7905434answered 2 years ago0Hi DjordjeM,To add on kishoreataws's comment, Vivado has no knowledge of the design, so it simply scans for any existing combo path in the netlist. In addition, for example a SEU event on the register, might cause a misbehavior on the multiplexer select signal and therefore enable the combo path by accident. That's why it's not allowed to mitigate this error at the constraint level.One thing you could try is that if you're sure the combo path will NEVER be selected, or in other words,  enabled/utilized by the design, you could consider inserting a register to break the loop. Hope that helps.Thanks,ChenCommentShareAWS-zhczanswered 2 years ago0Thank you both for clarification,I know that the synthesis tool can't know the states of register, and that the register can access unwanted state in many ways.I just wanted to confirm, and get somewhat of a more 'formal' way, to notify lead designer that it's not supported.The ERRATA file will do the trick.I'll have to find the best place to break the loop and synchronize the rest of the design.Thanks for quick answers!Best,DjordjeCommentShareDjordjeManswered 2 years ago"


Question: Route 53 Registration of domain name cannot be completed

"I received an auto-email shortly after attempting to register a domain name via Route 53. stating that AWS can't finish registering my domain. I Verified via Route 53 that the desired domain name was available, added it to my cart and proceeded with the order. I had started with a free-tier account over a year ago, but also linked that account to a valid credit card, which was accepted when I initially signed-up. I double checked that my personal and credit card details were still captured, up-to-date and correct, but still no luck. I read FAQs and other posts about the issue, but none of them have seemed to have been resolved or are not related in the same way to this issue I have. An only alternative is to register with the registrar and point the domain to AWS services for hosting but, I would prefer to do the complete end-to-end registration and hosting through Route 53 if possible.FollowComment"

Answer: 0What are the contents of the mail? Is it a payment issue or something different?It could be possible that it it is against any of the ICANN rules or the AWS agreement.Ref.: https://aws.amazon.com/route53/domain-registration-agreement/CommentSharePatrick Schaumburganswered a month ago


Question: On-Premises to S3 DataSync task sometimes fails with "Deferred error: pwrite ... Input/output error"

"We run a daily on-premises data upload to s3 over a DirectConnect network. While the daily task has been running for several months now, in the last week we have seen the daily upload task fail twice with the following Execution Status:Transfer and verification completed. Selected files transferred except for files skipped due to errors. If no skipped files are listed in Cloud Watch Logs, please contact AWS Support for further assistanceThe cloudwatch log had the following error:[ERROR] Deferred error: pwrite(name="<snipped_path>", size=262144, offset=60030976): Input/output errorI can't find any mention of this error (and how to fix it) in the documentation, aws re:post OR in a web search. How can I debug the underlying issue?FollowComment"

Answer: "0This error can occur if there was a file that was not able to be written to the destination on the first attempt. This can occur if there is a network disconnect or disruption during the transfer or the destination is overloaded. If these errors continue, you can start by inspecting your network at the time the Input/output error occurred.CommentShareDarryl_Dioanswered 5 months ago"


Question: Corretto 17 for Elastic Beanstalk

"Hello,When will Corretto 17 be available for Elastic Beanstalk?The list currently contains Corretto 8 and 11, but Java LTS version 17 is unavailable for now.Will this change shortly?greetings EricFollowComment"

Answer: 0You can install and use Corretto 17 on your own using an ebextensions file. Inside your application bundle add a .ebextensions folder with a file name ending in .config" with this content:packages:  rpm:    java17: https://corretto.aws/downloads/latest/amazon-corretto-17-x64-linux-jdk.rpm  container_commands:  01_alternatives_set:    command: sudo alternatives --set java /usr/lib/jvm/java-17-amazon-corretto.x86_64/bin/java    CommentSharejohnthussanswered a year ago


Question: athena query issue with apache hudi

"recently i got this error in athenaPermission denied on S3 path: s3://{S3_BUCKET}/{S3_PREFIX}/.hoodiewhere the location path that set in glue s3://{S3_BUCKET}/{S3_PREFIX}/{DB_NAME}/{TABLE_NAME}/what i want to ask is why athena searching ".hoodie" directory under {S3_PREFIX}, where it should be inside the {TABLE_NAME} directory?checked in the {S3_PREFIX} directory there no file/directory name ".hoodie" after the {S3_PREFIX}and also check in emr-spark, with emr-spark i able to retrieve the data without getting permission denied issue.FollowComment"

Answer: "0Athena Uses Presto for DML queries and to query Hudi tables metadata for the hudi table is required which is store under ".hoodie/" folder inside the table location. So suppose if the hudi table is built upon S3 location "s3://mubucket/hudi/" then after creating a hudi table in this location a ".hoodie/" folder will be created.Here in you case if the permission denied error is coming up for a different location other than table location if I understood it correct then, This can be due miss-configurations of the table. Hence can you try recreating another small sample hudi table and then run Athena queries over the same. Also check whether you have proper permissions over the bucket or not when running Athena queries.CommentShareSUPPORT ENGINEERShubhanswered 7 months ago"


Question: DynamoDB - Fine grain control scoped to Cognito User

"I have a table that will contain rows of data for all users of the app. But I only want User A to access rows added by User A, User B to access User B's rows, etc. So its essentially a user-scoped database.IAM Policy{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "dynamodb:PutItem",                "dynamodb:GetItem",                "dynamodb:DeleteItem",                "dynamodb:Query",                "dynamodb:Scan"            ],            "Resource": "arn:aws:dynamodb:us-east-1:0000000:table/my-table",            "Condition": {                "ForAllValues:StringEquals": {                    "dynamodb:LeadingKeys": [                        "${cognito-identity.amazonaws.com:sub}"                    ]                }            }        }    ]}I believe the "cognito-identity.amazonaws.com:sub" for my user is: us-east-1:XXXXXMy id for rows is us-east-1:XXXXX#uuid1 but us-east-1:XXXXX cant access it. I get: AccessDeniedExceptionHowever, the following condition worked:"Condition": {  "ForAllValues:StringEquals": {    "cognito-identity.amazonaws.com:sub": [      "us-east-1:XXXXX"    ]  }}FollowCommentstewartcampbell a year agoCan you pull the error out of CloudTrail? That should hopefully give more info.ShareJash Sayani a year agoCloudTrail just shows DescribeTable but not PutItem calls.Share"

Answer: "0Hi.  From a quick glance, the policy looks to be correct.Have you done the following as well:Use the Cognito ID as the hash key for DynamoDBValidated proper access to the KMS Key (If used) for the User.How are you connecting the users to access the DynamoDB Table?  Are you using a role that grants access to a Cognito Identity Provider and do you have a user pool group set up for your Cognito users in Cognito?CommentSharejsoncanswered a year agoJash Sayani a year agoUse the Cognito ID as the hash key for DynamoDBhash key? The id field (Partition key) has CognitoID#ItemUUIDHow are you connecting the users to access the DynamoDB Table?IdentityPool group has IAM policy mentioned in question.Share"


Question: Psexec is blocked by organization.  Alternatives to installing greengrass?

"Hi,It looks like PSexec is banned in my org so I am having difficulty in installing greengrass user on the local system account.   Does anyone know of any work arounds?ThanksFollowComment"

Answer: "0I was able to find the answer.  If PSTools is banned by your org.  You can do this:Using task scheduler, schedule a run of CMDKEY running under SYSTEM with the appropriate arguments of /add: /user: and /pass:No need to install anything.CommentShareAWS-User-6540243answered 3 months ago"


Question: Elastic IP address not attached to a running instance per hour (prorated):Still It is Charging amount

"Hi Team,I found similar questions related to "Elastic IP address not attached to a running instance", But still it is charging some amount. I have tried Free tier account for few days. And Released all the resources that I have created. But still I am getting invoices for services.May I know which service charges it is taking?Below I am attaching some details of my invoice:Amazon Web Services India Private Limited$0.08$0.05Elastic Compute Cloud$0.05US East (N. Virginia)Elastic IP Addresses$0.05$0.00 per Elastic IP address not attached to a running instance for the first hour1.000 Hrs$0.00$0.005 per Elastic IP address not attached to a running instance per hour (prorated)10.800 Hrs$0.05$0.02Relational Database Service$0.02US East (N. Virginia)Amazon Relational Database Service Backup Storage$0.02$0.095 per additional GB-month of backup storage exceeding free allocation0.106 GB-Mo$0.01$0.095 per additional GB-month of backup storage exceeding free allocation running PostgreSQLFollowComment"

Answer: "0Hello there,Elastic IP Addresses are free whilst attached to an instance. You'll need to check which regions you've got  Elastic IP Addresses running in, it might be that you've got multiple Elastic IP Addresses in other regions as well. Once you've found out which regions your Elastic IP Addresses are in, you can then release all your Elastic IP Addresses, and stop all further charges. Here's a step-by-step guide on how to release your Elastic IP Addresses: https://aws.amazon.com/premiumsupport/knowledge-center/elastic-ip-charges/.Kind Regards,- Ash R.CommentShareEXPERTAWS Support - Ashanswered 5 months ago"


Question: Lightsail Postgres "no pg_hba.conf entry"

"Hi,I have created a managed database in my Lightsail dashboard (PostgreSQL database (15.2) / 240 GB SSD).On the networking tab I have enabled the "Public mode".I can connect using a desktop client (DBeaver), but when connecting programmatically (from the same machine/IP address) I am receiving:original: error: no pg_hba.conf entry for host "xxx.xxx.xxx.xxx", user "yyyyyyyy", database "zzzzzzzzz", no encryptionThis confuses me greatly because there is no other setting I can make apart from the toggle.Also, I have an older instance I created a few months ago (PostgreSQL database (12.13) / 40 GB SSD) to which I can connect programmatically, without errors.When I do aselect * from pg_hba_file_rules;Against both instances I get very different output. Old instance:|line_number|type |database     |user_name |address |netmask|auth_method|options|error||-----------|-----|-------------|----------|--------|-------|-----------|-------|-----||4          |local|{all}        |{all}     |        |       |md5        |       |     ||10         |host |{all}        |{rdsadmin}|samehost|       |md5        |       |     ||11         |host |{all}        |{rdsadmin}|all     |       |reject     |       |     ||12         |host |{rdsadmin}   |{all}     |all     |       |reject     |       |     ||13         |host |{all}        |{all}     |all     |       |md5        |       |     ||14         |host |{replication}|{all}     |samehost|       |md5        |       |     |New instance:|line_number|type   |database     |user_name |address |netmask|auth_method  |options  |error||-----------|-------|-------------|----------|--------|-------|-------------|---------|-----||2          |local  |{all}        |{rdsadmin}|        |       |peer         |{map=rds}|     ||6          |local  |{all}        |{all}     |        |       |scram-sha-256|         |     ||12         |host   |{all}        |{rdsadmin}|samehost|       |scram-sha-256|         |     ||13         |host   |{all}        |{rdsadmin}|all     |       |reject       |         |     ||14         |host   |{rdsadmin}   |{all}     |all     |       |reject       |         |     ||15         |hostssl|{all}        |{all}     |all     |       |md5          |         |     ||16         |host   |{replication}|{all}     |samehost|       |md5          |         |     |Any ideas what I should do to be able to connect?EDIT1:I have now completed a completely new instance with1 GB RAM, 2 vCPUs, 40 GB SSDPostgreSQL database (12.14)And I can connect programmatically.Please advise what changed in DB setups with higher Postgres versions and how I can connect.It seems to me at this point that the "Public mode" toggle button is broken for the biggest instance with the highest Postgres version. It does not make the instance fully available with just username/password. Something else is needed, something that the DBeaver client apparently does in the background, but I am not aware of.EDIT2:I have created an instance withPostgreSQL database (14.7)240 GB SSDAnd can connect to that. So only the latest Postgres version seems to fail.FollowComment"


Question: Cloudformation "AWS::EC2::Volume" as root device for EC2 instance

"When using the BlockDeviceMappings it is possible to set the volume size during stack creation but changing the size (or any other EBS property) results in EC2 instance replacement.The recommendation here is to to use AWS::EC2::Volume to avoid replacement.https://repost.aws/knowledge-center/cloudformation-update-volume-instanceIs it possible to make Cloudformation create a AWS::EC2::Instance based on a public AMI (e.g. Windows_Server-2019 ami-010c18a20eec1a70a) where the root device (/dev/sda1) is defined by AWS::EC2::Volume?I have tried many variants, "Volumes", "VolumeAttachment", in combination with "NoDevice". Also it seems like the snapshot used as root device for public AMIs are not publicly accessible (fails with "Snapshot does not exist").FollowComment"


Question: Generate specific parameters to appear in SNS email notification in CloudWatch Alarm for a Log Group

"I am able to create a CloudWatch alarm that gets triggered from a Metric Filter of "ERROR" in a log group, however, I need to add specific parameters to the email notification that the CW alarm generates.  I have created a SNS Topic and SNS Subscription to generate the notification but I cannot figure out how to add the below parameters to the email.  I attempted to use Powershell command to do this but received an error of "Delivery protocol [email] does not support raw message delivery."  From doing research, it appears that I need to create a Lambda function to do this.  I am looking for guidance on how to structure the Lambda function to grab the raw data from the metric filter in the log group and sends that information in an email when the ERROR Cloudwatch Alarm is triggered."@@t" - time"SourceContext" - the context of the occurred error"MachineName" - server name"@log" - the log group nameThank you,FollowComment"

Answer: "0Accepted AnswerCurrently you can't directly embed the data you are looking for in a CloudWatch alarm notification.  However, as you discovered you can enrich the notification by using your own code in the form of a Lambda.  CloudWatch alarms supports SNS as a destination, which is straight forward to connect to a Lambda function.You can see https://github.com/awslabs/cloudwatch-logs-customize-alarms for an example of how to enrich an Alarm with the log event details.  Because each metric filter is unique to a log group, you can take advantage of the "Description" field on the alarm to convey the log group.  The description comes across on the notification email.Here is a blog post that explains the end-to-end process: https://aws.amazon.com/blogs/mt/customize-amazon-cloudwatch-alarm-notifications-to-your-local-time-zone-part-1/CommentSharetichenmanswered 3 months ago"


Question: Stuck instance will not stop

"I have an instance  i-0e15606540d19ff6c that seems to have quit in the middle of the night last night.  I can't stop it, tried force stopping it and waited about 10 min and it still won't restart. I received an e-mail last night saying the hardware had a problem and the instance aws going to be stopped, but it seems to be stuck in stopping instead.FollowComment"

Answer: 0OK it eventually stopped.  Not sure if someone did something or it stopped on its own.  That was weird.  The e-mail suggested it would stop on its own at 4:00 AM so when I woke up and it was stuck in stopping I was worried!CommentSharewz2banswered a year ago


Question: Control Tower Organizational Trail with delegated account

"Hi,is it possible to use Organizational Trail with Control Tower but defining a delegated account?since Nov 2022 (https://aws.amazon.com/about-aws/whats-new/2022/11/aws-cloudtrail-delegated-account-support-aws-organizations/?nc1=h_ls) AWS Cloudtrail supports delegated account for organizational Trail. Control Tower v3 adopts organizational trail in July 2022 (https://aws.amazon.com/about-aws/whats-new/2022/07/aws-control-tower-adopts-aws-cloudtrail-organization-logging/). When you configure Control Tower you define if you opt-in to use organizational trail. But I guess it's managed from management account, which seems not to be aligned with Control Tower philosophy (only use management account for CT management purposes; Cloudtrail logs review looks more related to Audit/Security instead of management).Is it possible to use a delegated account for this purpose (like you can do for GuardDuty and Security Hub)?TIA.FollowComment"

Answer: "0Accepted AnswerHi THereThis is one of the purposes of the [Audit account](From https://docs.aws.amazon.com/controltower/latest/userguide/how-control-tower-works.html#what-shared).  The audit account is a restricted account that's designed to give your security and compliance teams read and write access to all accounts in your landing zone. From the audit account, you have programmatic access to review accounts, by means of a role that is granted to Lambda functions only. The audit account does not allow you to log in to other accounts manually.You can query the CloudTrail logs in the Log Archive from the Audit account using the role aws-controltower-AuditReadOnlyRole with Lambda  to gain access to the logs in the Log Archive. The role assumes aws-controltower-ReadOnlyExecutionRole in the Log Archive account granting read only access.CommentShareEXPERTMatt-Banswered 2 months ago0Thanks a lot Matt-B for your answer.Let me explain a little bit better my question. I agree with you that this would be the purpose of Audit account. And being the delegated account is something possible with Security Hub and GuardDuty when using Control Tower: each new account can have these services enabled in an organizational way, so all events  are sent to Audit account, and then from there they are archived in S3 bucket in log archiving account. From Security Hub and GuardDuty in the Audit account it's possible to review recent events, and in case an old event is required Audit account can read it from log Archiving.My question is about organizational CloudTrail trail; delegated account for this service is a new feature (since Nov22). Previous to that, Control Tower v3 allows to deploy an organizational trail so every new account has cloudtrail enabled and an organizational trail defined. But this organizational trail is managed from Management account, and all logs are sent to management account (and from there, they can be sent to an S3 bucket in archiving account). As management account is only intended to be used for management, it would be great if you can define Audit account as delegated account for this organizational trail; but as this is a recent feature, I'm not sure if Control Tower, at the moment that you decide to use organizational trail, allows you to select a delegated account, or if it sets management account as the main account for the organizational trail. I've not seen any reference in control tower documentation, only that it allows you to enable the organizational trail (https://docs.aws.amazon.com/controltower/latest/userguide/configure-org-trails.html).CommentShareaortegaanswered 2 months agoMatt-B EXPERT2 months agoRight now no, you cant delegate CloudTrail to another account because its fully integrated and managed by Control Tower which runs in the management account.   but you can analyze the cloudtrail logs from the audit account.Shareaortega 2 months agoThanks Matt-B!Share"


Question: Rekognition Reporting Moderation labels mis-classifications

"This image is being identified as explicit nudity via the Rekognition detectModerationLabels API Is there a better place to report issues like this?https://ic-cdn.flipboard.com/meredithcorp.io/ea9f9f3bcd15ae62bfcbdfe0a12879b8b8ee3287/_large.jpeg  "moderationLabels": [    {      "name": "Explicit Nudity",      "parentName": "",      "confidence": 92.17741    },    {      "name": "Illustrated Explicit Nudity",      "parentName": "Explicit Nudity",      "confidence": 92.17741    }  ]FollowComment"

Answer: "0Hello,Amazon Rekognition’s Content Moderation models have been and tuned and tested extensively, but we recommend that you measure the accuracy on your own data sets to gauge performance.You can use the ‘MinConfidence’ parameter in your API requests to balance detection of content (recall) vs the accuracy of detection (precision). If you reduce ‘MinConfidence’, you are likely to detect most of the inappropriate content, but are also likely to pick up content that is not actually inappropriate. If you increase ‘MinConfidence’ you are likely to ensure that all your detected content is truly inappropriate but some content may not be tagged.Use this link to provide feedback on the support case to exactly mention your use-case !!CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months ago"


Question: awsebcli has vulnerable requirements

"Hi,The packages required by awsebcli contain 2 vulnerabilities:requests: CVE-2018-18074urllib3: CVE-2018-20060Both vulnerabilities have been fixed in their respective packages, but can't be upgraded in an environment with awsebcli due to outdated requirements in awsebcli. Is there any timeframe or policy on when/if these things are monitored and fixed?Many thanks!FollowComment"

Answer: "0Accepted AnswerThanks for your patience. 3.14.9 is out and contains the upgrade.Yes, "safety" is quite nice. Thanks for the recommendation.Rahul.CommentShareAWS-User-2500988answered 4 years ago0Hi  krovski,Thanks for reporting the problem to us. I'll schedule a release for sometime next week with updated dependencies.Thanks,Rahul.CommentShareAWS-User-2500988answered 4 years ago0Great, thanks!btw: I strongly suggest to use https://github.com/pyupio/safety to do these checks on a regular basis.CommentSharekrovskianswered 4 years ago0Thanks!!!CommentSharekrovskianswered 4 years ago"


Question: RDS DB migrations using ECS and Fargate

"I run my app with Docker and ECS. How can I handle database migrations? With fargate there doesn’t seem to be a way to SSH into the container to run any commands so I can’t run my RDS MySQL migrations by going into the container. I have some migrations to run at times, not for all deploys. Any advice?I used to run my docker container in a EC2 box so I had the option to run a command inside the container once the container is up. I have migrated to ECS and Fargate now and I don't know how to handle it now.FollowComment"

Answer: "0Hi,Were you able to solve this issue? I am also facing the same sort of issue. I have an application deployed on ECS (fargate) and I want to run migrations.CommentSharejunaid421answered 3 years ago0While it is technically possible to install sshd in your image so you can SSH into your task, that's not  a terribly practical approach. It would be helpful to understand your scenario in a little bit more detail. What's driving doing the DB migrations? Are you deploying updated code? If that's the case, consider automating the DB migration as part of your deployment (e.g. validate the state of the DB when you're task starts up and if not what you expect, do the migration)./MatsCommentShareMatsanswered 3 years ago0You have 2 options1 - do them as part of CICD pipeline in CodeBuild https://aws.amazon.com/blogs/database/building-a-cross-account-continuous-delivery-pipeline-for-database-migrations/2 - set up fargate task and execute the migration there. The task can be invoked after the CloudWatch eventhttps://docs.aws.amazon.com/AmazonECS/latest/developerguide/scheduled_tasks.htmlhttps://aws.amazon.com/about-aws/whats-new/2018/08/aws-fargate-now-supports-time-and-event-based-task-scheduling/CommentShareIvanMartosCrowdhouseanswered 3 years ago0You have 2 options1 - do them as part of CICD pipeline in CodeBuild https://aws.amazon.com/blogs/database/building-a-cross-account-continuous-delivery-pipeline-for-database-migrations/2 - set up fargate task and execute the migration there. The task can be invoked after the CloudWatch eventhttps://docs.aws.amazon.com/AmazonECS/latest/developerguide/scheduled_tasks.htmlhttps://aws.amazon.com/about-aws/whats-new/2018/08/aws-fargate-now-supports-time-and-event-based-task-scheduling/CommentShareIvanMartosCrowdhouseanswered 3 years ago0You can do it in your Dockerfile as part of your ENTRYPOINT or CMD. In Rails app you would normally run the migrations before you start the server by runningbundle exec rails db:migratebundle exec rails server -p 3000CommentSharejedrekanswered 3 months ago0@Mats ideally that would be good, but the deployment process of an ECS task doesn't seem to provide a mechanism to execute one-off commands as part of the process (in the same way that you can use initContainers in Kubernetes deployments or lifecycle hooks in Helm charts).@jedrek that's a non-ideal workaround as 1) you'd be running migrations (eg: start db connections and execute queries at least to check the migration version) every time a container starts (not just a deployment). If I have a service running 100 copies, migrations would be execute at least 100 times during the deploy process with potential race conditions if multiple containers can start around the same time. 2) migrations would also run whenever containers get moved around container instances, when instances get removed/readded and so on.would be great if the ECS service would allow for something like init containers so that a check (in the form of a command running inside a container) could be performed before a deployment starts.CommentShareausterusanswered 15 days ago"


Question: Lookout for Vision robustness against variation in training data "good" images

"When training a Lookout for Vision model, how feasible is it to include variations in the "good" product training data? As in can I have the product viewed in different orientations (rotated so that a top down view of the product doesn't have to be aligned any certain way), have the product uncentered to the camera, vary lighting?I am designing a system to identify product anomalies but want to know how much I need to take into account controlling the environment in which the product image is taken when carrying out my design. Ideally I would like the LofV model to be intelligent enough to understand that a product is still a good product even if the top down view of it has been rotated and nudged off centre slightly.Any help would be much appreciated.Thanks.FollowComment"

Answer: "0The Amazon Lookout for Vision documentation recommends consistent image capture conditions, such as camera positioning, lighting, and object pose. In an ideal scenario you can control the environment and ensure consistent conditions.If that's not possible, then providing more data that reflects the variations (object position and rotation, lightning conditions) can increase your models' performance. To what extent depends a lot on the situation (variability in conditions, types and sizes of anomalies, etc.) so it's difficult to give a general answer. I would recommend to run a PoC, evaluate your performance metrics (such as F1 score), and then try to improve your model.In addition you can try to preprocess your raw images to reduce variations. For example, you could use an object detection model to locate the object (and its orientation) in the larger image and then crop/rotate the image so it only contains your object (ideally rotated to a consistent orientation).In your camera setup you could also evaluate bandpass filters as a way to improve lightning conditions. An experienced partner would be a great asset in such a discussion.CommentShareJohann Fuechslanswered 10 months ago"