Question: AWS::EC2::AvailabilityZone::Name parameter validation...

"I have an AWS::EC2::AvailabilityZone::Name as a parameter for my CloudFormation template like this:AvailabilityZone:Type: AWS::EC2::AvailabilityZone::NameDescription: New subnets will be created for this zone.ConstraintDescription: "A valid availability zone must be selected."It populates nicely with the list of Availability Zones for the region where the CloudFormation template is coming up. However, CloudFormation does not validate that an Availability Zone was selected (i.e. it can be left blank). After the "Create Stack" button is pushed the stack creation process will fail.I would like to be able to validate the parameter and make sure that it is not empty before the stack fails. I tried specifying a "MinLength" property of 9. I uploaded the template and it would not let me enter an empty Availability Zone (i.e. it seemed to work). However, in our build process we call cfn-lint to validate the template and it gives the following error:E2001 Parameter AvailabilityZone has property MinLength which is only valid for \['String']Can anyone tell me what is the correct way to validate an AWS::EC2::AvailabilityZone::Name field to be non empty at least, and preferably an item in the list provided by the GUI?Thanks in advance,FollowComment"

Answer: "0AWS tech support sent me an answer. Although MinLength is not supported on AvailabilityZone::Name, AllowedPattern is. Here is a pattern that ensures the AvailabilityZone::Name is at least 1 character long. Since this is a popup field it ensures that the popup is populated and not left blank.===================================================AvailabilityZone:Type: AWS::EC2::AvailabilityZone::NameDescription: EC2 AvailabilityZoneAllowedPattern: ".+"                # -> to have a non blank valueFYI: Using a DefaultValue is not really an option since I don't know what Region the script is being run in.CommentSharehdsiiianswered 3 years ago"


Question: SMTP messages are failing intermittently

"I inherited a Drupal 7 site running Open Atrium and the sending of email messages is failing intermittently. 1 out of every 10 emails fails the with unable-to-authenticate error message. How are most emails working then? I've updated the email config to Signature Version 4.Site is running on Pantheon and hasn't been updated in over a year. Using TLS and SMTP port is 587.Drupal 7.78PHP 7.3SMTP module - 7.x-1.7Edited by: jtjones23 on May 24, 2021 12:28 PMEdited by: jtjones23 on May 24, 2021 12:31 PMFollowComment"

Answer: "0Started working after I changed the From: email to a verified AWS email address.Edited by: jtjones23 on May 24, 2021 1:10 PMCommentSharejtjones23answered 2 years ago"


Question: How to deploy frontend and backend in one CICD  (CodePipeline)?

"I have set up a CICD for the frontend of my App which is using Codepipeline, Code Build, and it deploys frontend of my app to ECS Fargate container. Similarly, I have setup a CICD for backend of my App which is also using Codepipeline, Code Build and it deploys backend of my app to ECS Fargate Container.The problem is that both frontend and backend of my application are in two different Bitbucket repositories. Is there any good practice to manage this in one CICD. Basically, I want to deploy my app's frontend and backend to one ECS Fargate cluster. Right now two ECS Fargate clusters are being used. I just want to deploy my application as one solution which eventually contains two containers but in a single cluster.I am following this tutorial if someone wants to get more details.Is there any best practice that I should follow for my solution? Any suggestion for the improvement will be appreciated greatly.FollowComment"

Answer: "1Accepted AnswerHi,Zainub here. It will be my pleasure assisting you on this query.From the correspondence, I understand that:There currently are 2 separate pipelines for the front-end and backend of the application.The front-end and backend of the application are in different BitBucket repositories.Guidance is required on best practices for managing the front-end and backend in one CICD pipeline.The front-end and backend must be deployed to 1 ECS cluster with 2 containers - currently being deployed to 2 clusters.Kindly confirm if the summary and understanding of the issue is correct.Best PracticeAs per the CICD best practices on AWS, it is recommended to:"Use multiple distinct pipelines for each branch and team"In this case, the best practice would be to use distinct pipelines for each repository.That said, it may still be possible to deploy to 1 cluster with each container running in it's own service. See Step 2: Creating Your Continuous Deployment Pipeline point 6 to add a deployment stage, specifying an existing ECS cluster and service. The difference between the front-end and backend pipelines will be that they specify the same ECS cluster but different services.However, I see that the 3rd party tutorial uses a CloudFormation (CFN) provider in the deploy stage which creates the Fargate ECS Cluster with a VPC, 2 Subnets and a Load balancer. This solution creates the infrastructure, therefore, when used on 2 different pipelines, 2 clusters are created. A suggestion would be to deploy the CFN template separately, so that the infrastructure is created only one time and include the ECS cluster in the pipeline as an existing cluster.Kindly note that assistance on custom solutions falls beyond the level of support generally provided. As such, I have not personally implemented this custom solution and guidance, regarding this, is provided on a best effort basis.Update The Custom SolutionThat said, if you would still like to implement 1 pipeline to deploy the front-end and backend containers to a single cluster, this is possible. However, kindly note that implementing such a solution means that if there is a change deployed from 1 repository, the pipeline deployment will execute for both repositories.Update The Source StageIt is possible to configure the pipeline to pull from multiple sources.If multiple source input artifacts are configured, such as for the front-end and backend BitBucket repositories, ensure that multiple source output artifacts are also configured.Update The Build StageUpdate the build stage input artifacts to include the multiple source output artifacts. According to the custom solution, the source output artifact is manipulated in the build and a file, imageDetail.json, is included as the build output artifact. The build must be updated to include output artifacts for the front-end application and the backend application.Update The Deploy StageUpdate the deploy stage input artifacts to include the multiple build output artifacts. Additionally, update the ParameterOverrides to include an image URI for the front-end and backend application.Update Fargate-Cluster.ymlUpdate the Fargate-Cluster.yml to either include a TaskDefinition for the front-end and backend application (2 tasks running in one cluster) or update the TaskDefinition's ContainerDefinitions to include a container for the frontend and backend application (1 task running in the cluster which contains 2 containers).A summary of the steps required to update the custom solution is as follows:Note: If there is a change deployed from 1 repository, the pipeline deployment will execute for both repositories.Update the source stage to include multiple source input and output artifacts (for front-end and backend).Update the build stage:Include multiple input artifacts.Update the build itself to create and include multiple output artifacts.Update the deploy stage:Include multiple input artifacts.Update the ParameterOverrides to include an image uri for the front-end and backend application.Update the TaskDefinition to either:Include a task definition for each application.ORUpdate the TaskDefinition to include a container for each application.Kindly note that as assistance on custom solutions falls beyond the level of support generally provided, I have provided a high level overview of the changes required to the custom solution on a best effort basis.Additional InformationThe following documentation, regarding CICD best practices, may also be of interest:CodePipeline best practices and use cases. Security best practices.I hope you find the above informative and don't hesitate to reach out with further questions!Have a great day ahead.Resources:Summary of best practicesTutorial: Amazon ECS Standard Deployment with CodePipeline: Step 2: Creating Your Continuous Deployment PipelineMultiple input sources and output artifacts sampleCodePipeline best practices and use casesSecurity best practicesCommentShareSUPPORT ENGINEERZainub_Aanswered 6 months agoAWS-User-8471608 6 months agoHi Zainab, thank you for the detailed explanation. I just want to clear one more thing. As you have mentioned above, "A suggestion would be to deploy the CFN template separately, so that the infrastructure is created only one time and include the ECS cluster in the pipeline as an existing cluster". I just want to know that when when CFN template runs again it doesn't only update the existing resources or recreate them?I think it should only update the infrastructure only. Kindly share your feedback on this. I will be waiting for you. You have assisted me remarkably.Share0Hi,From the comment, I understand that guidance is required on whether deploying the CFN template again would update the existing resources or recreate them. Kindly confirm if the summary and understanding of the issue is correct.If the solution had not yet been implemented, then you would need to deploy the Fargate-Cluster.yml stack template directly on CFN to create the ECS resources. That is to say, it is not necessary to deploy the Fargate-Cluster.yml stack, you would just need to update the deploy stage provider to specify ECS. Kindly note that this is a high level overview of changes that would need to be made and as you work to change the custom solution, more detailed changes may be needed.As the solution has been implemented:A template deployment to the existing stack is only necessary when you want to update the infrastructure.Depending on the resource property changes, the resources will either be updated or replaced.Example, updating the DeploymentController property of the AWS::ECS::Service stack resource requires the service to be replaced, whereas updating the CapacityProviderStrategy property requires no interruption, i.e. service is updated.See Update behaviors of stack resources for more information.If you do not deploy the template to the existing stack and choose to create a new stack, new resources will be created.As always, I hope you find the above informative and don't hesitate to reach out with further questions.Have a great day further.Resources:AWS::ECS::Service Properties: DeploymentControllerAWS::ECS::Service Properties: CapacityProviderStrategyUpdate behaviors of stack resourcesCommentShareSUPPORT ENGINEERZainub_Aanswered 6 months ago"


Question: Amazon SES Emails Bounce for Specific Recipient in Verified Domain

"Have an AWS Lambda function sending email by using SES.Emails sent by SES are currently bouncing for only one recipient email address. Checked my SES Dashboard, and the domain for this email address is a fully verified domain.Bounces only occur for the one email recipient, and this recipient is in the UK, not in United States.However all other UK email recipients are receiving SES emails fine, and no bounces occur for any other email addresses in the verified domain.Any ideas what might cause this problem to occur?FollowComment"

Answer: "0Hi,You can get the message ID and details of this bounce by configuring SNS notifications for Amazon SES. You can set this up so that anytime there is a bounce you get a notification and can view all the information.Here is a link that provides more information on SNS: https://docs.aws.amazon.com/ses/latest/dg/configure-sns-notifications.htmlCommentShareDumkele_Oanswered 10 months agoSUPPORT ENGINEERAjinkya B-AWSreviewed 10 months ago"


Question: Can't connect to SQL Server 2014 Express AMI

"Hello,When I use the RDP session I only see one Command Prompt window.  I don't see a Windows UI.  Is this AMI bad?Additionally, I'm trying to remotely connect to the SQL Server that is provided by this AMI.  I have all ports inbound ports open but I can't figure out how to remotely connect and configure it.  I can connect to it locally in the RDP session.Is there a default port for this SQL instance?https://aws.amazon.com/marketplace/pp/B00KQP3H7W?qid=1550514839796&sr=0-8&ref_=srh_res_product_title#pdp-supportThanks!ZachFollowComment"

Answer: "0Accepted AnswerThe AMI contains Windows Server Core Install : https://msdn.microsoft.com/en-us/library/hh846323(v=vs.85).aspx, so seeing only Command Prompt is expected.By default the network services are disabled on SQL Server. Need to restart network services to be able to reach SQL Server (port 1443) from outside server.Following is the way to enable the networking service:Use netstat -a -b to verify port 1433 is not LISTENINGRun C:\Windows\SysWOW64\SQLServerManager12.msc from cmd.exe to open SQL Server 2014 Configuration ManagerFollow Steps in Microsoft Article   https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/enable-or-disable-a-server-network-protocol?view=sql-server-2017  to check the network status, enable, and restart SQL ServerAfter SQL Server restart, check for port status using netstat -a -bShould be able to connect from other servers after that, off course assuming the port is allowed.Hope this helps.CommentSharevinjakanswered 4 years ago0Perfect response!  Thank you so much.  That's very helpful.CommentShareLexiPhoneDoctoranswered 4 years ago0Is there a set of default credentials for remote server management?I can telnet to the port 1433 and that responds so I know the server is running.  I'm not able to figure out the default credentials using the remote management server tool so I can't log in to begin adding databases, etc.CommentShareLexiPhoneDoctoranswered 4 years ago"


Question: How to get paginated response using ListBuckets api using Go lang sdk

"I am using go sdk to fetch the list of buckets. I am not able to find the option fetch the buckets using paginated option using api ListBuckets(&s3.ListBucketsInput{}). It seems options like continuation token, marker or isTruncated is not available to list the bucket. Any idea , which other options or api is available?FollowComment"


Question: Error running a module on boto3

"Note: New on AWS | Post_1 | Edit the question if necessaryStarted practicing building a Py-based app on AWS (region = 'ap-south-1') with a publicly available tutorial by AWS. While exploring the SDK, I made a client, a resource, and this (app.py) file.  When I ran app.py to fetch and list the Dragon data hosted for the demo purpose, it bounced back with some errors. The parameter bucket could be making the error but could the region be making any problems as well? if the API call is right, then what could make this problem? Inserted both code and the error:import boto3s3 = boto3.resource('s3', 'us-east-1').meta.clientssm = boto3.client('ssm', 'us-east-1')bucket_name = ssm.get_parameter(Name= 'dragon_data_bucket_name',WithDecryption=False)['Parameter']['value'] #Systems Managerfile_name = ssm.get_parameter(Name= 'dragon_data_file_name',WithDecryption=False)['Parameter']['value'] #Systems Managerdef listDragons():        expression = "select * from s3object s" #SQL        result = s3.select_object_content(            Bucket= bucket_name,            key= file_name,            ExpressiopnType= 'SQL',            Expression=expression,            InputSerialization= {'JSON': {'Type':'Document'}}, #document type            OutpuSerialization= {'JSON': {}}    )        for event in result ['Payload']: #Looping the events        if 'Records' in event:            print(event['Records']['Payload'].decode('utf-8'))listDragons()   Error:Traceback (most recent call last):  File "app.py", line 7, in <module>    bucket_name= ssm.get_parameter(Name= 'dragon_data_bucket_name',WithDecryption='False')['Parmaeter']['value'] #Systems Manager  File "/home/ec2-user/.local/lib/python3.7/site-packages/botocore/client.py", line 514, in _api_call    return self._make_api_call(operation_name, kwargs)  File "/home/ec2-user/.local/lib/python3.7/site-packages/botocore/client.py", line 902, in _make_api_call    api_params, operation_model, context=request_context  File "/home/ec2-user/.local/lib/python3.7/site-packages/botocore/client.py", line 963, in _convert_to_request_dict    api_params, operation_model  File "/home/ec2-user/.local/lib/python3.7/site-packages/botocore/validate.py", line 381, in serialize_to_request    raise ParamValidationError(report=report.generate_report())botocore.exceptions.ParamValidationError: Parameter validation failed:Invalid type for parameter WithDecryption, value: False, type: <class 'str'>, valid types: <class 'bool'>FollowComment"

Answer: "0Your logs and code are not the same. In the logs, the code is giving an error due to this block:bucket_name= ssm.get_parameter(Name= 'dragon_data_bucket_name',WithDecryption='False')['Parmaeter']['value']While in the code section, the syntax is correct:bucket_name = ssm.get_parameter(Name= 'dragon_data_bucket_name',WithDecryption=False)['Parameter']['value']The error is due to a syntax error in your API call. The WithDecryption parameter for ssm.get_parameter API takes a bool value while you provided a string by enclosing it in quotes. Remove the quotes on your API call and it will work fine. Below is the updated API call syntax:bucket_name = ssm.get_parameter(Name= 'dragon_data_bucket_name',WithDecryption=False)['Parameter']['value']Please validate that you have submitted the correct syntax for the API call and resubmit the logs if you still have errors.CommentShareAjitanswered 7 months agoAB_AWS 7 months agoIt was my fault that I pasted the old err-log. I already removed the quotes and it still refused to compile. Here is the actual one (I also edited the question and changed the log):Traceback (most recent call last):File "app.py", line 7, in <module>bucket_name= ssm.get_parameter(Name= 'dragon_data_bucket_name',WithDecryption='False')['Parmaeter']['value'] #Systems ManagerFile "/home/ec2-user/.local/lib/python3.7/site-packages/botocore/client.py", line 514, in _api_callreturn self._make_api_call(operation_name, kwargs)File "/home/ec2-user/.local/lib/python3.7/site-packages/botocore/client.py", line 902, in _make_api_callapi_params, operation_model, context=request_contextFile "/home/ec2-user/.local/lib/python3.7/site-packages/botocore/client.py", line 963, in _convert_to_request_dictapi_params, operation_modelFile "/home/ec2-user/.local/lib/python3.7/site-packages/botocore/validate.py", line 381, in serialize_to_requestraise ParamValidationError(report=report.generate_report())botocore.exceptions.ParamValidationError: Parameter validation failed:Invalid type for parameter WithDecryption, value: False, type: <class 'str'>, valid types: <class 'bool'>Share0Your error log still doesn't match your code, it looks like you're not running the version you think you are?  The log mentions 'Parmaeter' whereas your code has 'Parameter'.  I'd suggest then that although your code now has the quotes removed from 'False' that you're actually running another version.CommentShareEXPERTskinsmananswered 7 months ago"


Question: Instance Status Checks always failed.

"Hi,I'm imported vmdk into AWS snapshot and then prepared an image.when I'm trying to lunch I got an Instance Status Checks error without any error message, I don't have access via ssh or via session manager to console.I think that I have a network issue but I don't know where to start.Please assistFollowComment"

Answer: "0Hi dandanaws,Thank you for posting your question here :)As the first method of solving your problem I would retrack the steps you took in order to import the Virtual Machine Disk (vmdk) onto AWS though as a suggestion I would begin by restarting the import by following the steps in the AWS document that I have linked below.https://docs.aws.amazon.com/vm-import/latest/userguide/vmimport-import-snapshot.htmlhttps://docs.aws.amazon.com/vm-import/latest/userguide/vmimport-image-import.htmlIf you are still facing the same issue I have listed links below that will help you understand how status checks work as well as troubleshoot and solve the “Status Check Failed” error which you are faced with when the snapshot has been launched.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-system-instance-status-check.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/system-reachability-check/https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstances.htmlI trust the information provided above will assist in resolving your query, however if you face issues please feel free to contact me.CommentShareArtemisFanswered 3 years ago0Hi, thank you very much for your answer.It's working with t2 or c4 instances type, but the problem still exists with t3.Do you have any idea ?I run Nitro scripts and the result is that all drivers installed and readyroot@telco-systems-ucpe-manager:~# ./nitro.shOK     NVMe Module is installed and available on your instanceOK     ENA Module with version  is installed and available on your instanceOK     fstab file looks fine and does not contain any device names.Edited by: dandanaws on Nov 17, 2020 4:55 AMCommentSharedandanawsanswered 3 years ago0Hi dandanaws,Thank you for responding It seems that everything is fine it terms of the OS compatibility (NVMe, ENA modules and fstab)I suspect that the ENA attibute has not yet been set on the Instance, or AMI itself. As a method of diagnosing the problem can you please follow the steps below:Can you test the ENA attibute using CLI commands I have listed below:Instance:aws ec2 describe-instances --instance-ids instance_id --query "Reservations[].Instances[].EnaSupport"AMI:aws ec2 describe-images --image-id ami_id --query "Images[].EnaSupport"If the attribute is set, the response on the CLI commands will be "True". If it's blank, or anything other that "True", please set it using the following CLI commands:Instance:aws ec2 modify-instance-attribute --instance-id instance_id --ena-supportAMI:aws ec2 register-image --ena-support ...As guidance I have provided you with a link to an AWS document that will guide you with the process.https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/enhanced-networking-ena.html#test-enhanced-networking-enaIf you're not familiar with the CLI, here's how you can set it up:https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2-linux.htmlPlease check if the troubleshooting steps suggested in the above link help resolve the issue. However, if the issue persists, please feel free to refer with the steps you took in order to solve it and we can take it from there. I trust the information provided above will assist in resolving your query.CommentShareArtemisFanswered 3 years ago0Thank you very very much for help and supportthis is the resulttion :sudo sed -i '/^GRUB_CMDLINE_LINUX/s/"$/\ net.ifnames=0"/' /etc/default/grubCommentSharedandanawsanswered 3 years ago"


Question: Why do the AWS Pinpoint endpoints become INACTIVE without making them so?

"Hello,I am using the AWS JavaScript SDK to create endpoints. I have an AWS Lambda which has logic that creates an endpoints. I call the Lambda via GraphQL when a user is created so that the user gets an endpoint on creation.I setup the all users to have an active endpoint but literaly after a few minutes of creation every user's endpoint becomes INACTIVE. Why is that the case?Here is the code I use to create the endpoint:const { Pinpoint } = require("aws-sdk");const AWS = require("aws-sdk")const pinpoint = new AWS.Pinpoint(); exports.handler = async (event) => {        const marketing = event.arguments.marketing;    const typeAction = event.arguments.typeAction;    const endpointAddress = event.arguments.address;    const projectId = projectID;    const valueAction = event.arguments.valueAction;    const endpointID = generateEndpointID(20);    const params = {        ApplicationId: projectId, /* required */        EndpointId: endpointID, /* required */        EndpointRequest: { /* required */          Address: endpointAddress,          Attributes: {            typeAction : [typeAction],            valueAction : [valueAction],            marketing : [marketing],          },          ChannelType: "EMAIL",          EndpointStatus: 'ACTIVE',          OptOut: 'NONE',          User: {            UserAttributes: {              //            },            UserId: endpointAddress          }        }      };    const pinpointRes = await pinpoint.updateEndpoint(params).promise().catch(er=> {console.log(er)});    return endpointID;};FollowComment"

Answer: "0Amazon Pinpoint automatically sets this value to INACTIVE if you update another endpoint that has the same address specified by the Address property.Reference: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Pinpoint.html#updateEndpoint-propertyPlease see for every email address once endpoint is created, after few mins somewhere in the flow creates/updates endpoint for the same email address.CommentShareprabuanswered a year ago0after adding an endpoint with an address that already exists in your segment it will overwrite it and make the existing one INACTIVE.its to counter the duplication of addresses.CommentShareAbdul Qayyumanswered 9 months ago"


Question: State Machine times-out on Choice

"I updated my state machine to use a task token and now it's timing out when it gets to the choice. This was previously working, and the cloudwatch logs for the first supportticketparse lambda function aren't indicating that anything is wrong. My guess is that I have and error in the payload definition, but I'm not sure. Is anything obviously wrong with the definition? If not, where else can I look for a potential problems?{  "Comment": "A description of my state machine",  "StartAt": "zen sort",  "TimeoutSeconds": 60,  "States": {    "zen sort": {      "Type": "Task",      "Resource": "arn:aws:states:::lambda:invoke.waitForTaskToken",      "OutputPath": "$.Payload",      "Parameters": {        "FunctionName": "arn:aws:lambda:us-east-1:363540650061:function:support-ticket-parse:$LATEST",        "Payload": {          "ExecutionContext.$": "$$",          "APIGatewayEndpoint": "https://9084s1lza7.execute-api.us-east-1.amazonaws.com/test/",          "Payload.$": "$"        }      },      "Next": "Choice"    },    "Choice": {      "Type": "Choice",      "Choices": [        {          "Variable": "$.name",          "StringMatches": "New User Account ",          "Next": "send email"        },        {          "Not": {            "Variable": "$.name",            "StringMatches": "New User Account "          },          "Next": "Fail"        }      ],      "Default": "Fail"    },    "send email": {      "Type": "Task",      "Resource": "arn:aws:states:::lambda:invoke.waitForTaskToken",      "OutputPath": "$.Payload",      "Parameters": {        "FunctionName": "arn:aws:lambda:us-east-1:363540650061:function:send_email:$LATEST",        "Payload": {          "ExecutionContext.$": "$$",          "APIGatewayEndpoint": "https://9084s1lza7.execute-api.us-east-1.amazonaws.com/test/",          "Payload.$": "$"        }      },      "Retry": [        {          "ErrorEquals": [            "Lambda.ServiceException",            "Lambda.AWSLambdaException",            "Lambda.SdkClientException"          ],          "IntervalSeconds": 2,          "MaxAttempts": 6,          "BackoffRate": 2        }      ],      "End": true    },    "Fail": {      "Type": "Fail"    }  }}FollowComment"

Answer: "0Accepted AnswerWhen you added .waitForTaskToken to your Lambda task, did you also add logic elsewhere to receive the task token (in the Lambda function or in something downstream that you passed the token to) and to call back to Step Functions to close the loop? If not, then I believe you are just seeing the expected behavior here. With the callback pattern / .waitForTaskToken, step functions will call the target specified in your task then pause that part of the workflow until you call back or there's a timeout.https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-tokenThis seems the most likely case, however you stated that it "times-out on Choice" which would not align. I wonder if it just seems to look that way because you can see that the Lambda function was called but don't see the Choice state having executed.As a side, it seems that you are calling Lambda functions that are then calling API-Gateway. It's possible you need to have these proxy Lambda functions, but if not, note that you can invoke API-Gateway directly from Step Functions.https://docs.aws.amazon.com/step-functions/latest/dg/connect-api-gateway.htmlCommentShareJustin Callisonanswered 10 months agoluketk 10 months agothanks for the response!  I think the main problem was that I was calling the waitForTaskToken in both my first lambda function and did not recieve it. In this case I simply deleted the waitForTaskToken on line 7 and that seemed to fix it, I don't think I need the task token until the send email function is called.Share0Have you configured logging on your step function? Refer to this if you haven't - https://docs.aws.amazon.com/step-functions/latest/dg/cw-logs.htmlLogs should provide you a better idea of why the Step Function is getting timed-out?Also I looked at your step function. I don't see a token in the callback to the lambda getting passedTake a look at the example on this https://docs.aws.amazon.com/step-functions/latest/dg/connect-lambda.html{"StartAt":"GetManualReview","States":{"GetManualReview":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke.waitForTaskToken","Parameters":{"FunctionName":"get-model-review-decision","Payload":{"model.$":"$.new_model","token.$":"$$.Task.Token" --> This is missing in your step function},"Qualifier":"prod-v1"},"End":true}}}This has more information on the role of the token for callback functionsCommentShareEXPERTIndranil Banerjee AWSanswered 10 months agoluketk 10 months agoI did configure logging and it simply said that the function timed-out. I think the issue is related to the taskToken. Thank you for reaching out and helping!Share"


Question: App Sync Security For IAM_AUTH

"Suppose I have the given graphql schema using AWS_IAM authentication:type User{   userId: ID   name: String   myConversationIds: [ID]}type Conversation {    conversationId: ID    messages: [Message]}type Message{    content: String    senderId: ID    conversationId: ID}type Mutation{    sendMessage(userId: ID, conversationId: ID, content: String) : Message}Would it be possible for a malicious user, to use curl or some other external program to call sendMessage, with another user's userId, or a conversation they are not invited to?Would it be necessary to authenticate the user by checking their ID, and checking if they are invited to the given conversation before invoking sendMessage?Or is it impossible for a malicious user to construct their own mutations, and can only query appsync through the authenticated application?How does the appsync console queries page send requests to the api when authenticated with IAM?FollowComment"

Answer: "0Would it be possible for a malicious user, to use curl or some other external program to call sendMessage, with another user's userId, or a conversation they are not invited to?No, you would have an Auth type set on the API. So only the requests with proper Authorization headers are allowed to execute this query. AppSync provides you $context.identity inside the resolver mapping templates, so you can always use that to limit the "userId" in the query parameter.Would it be necessary to authenticate the user by checking their ID, and checking if they are invited to the given conversation before invoking sendMessage?This seems to be your business logic, so you can always add Auth rules inside your mapping templates to return $util.unauthorized() for any particular field in the query graph. You can check multiple utility functions from here: https://docs.aws.amazon.com/appsync/latest/devguide/resolver-util-reference.htmlOr is it impossible for a malicious user to construct their own mutations, and can only query appsync through the authenticated application?Again, your API is protected with the Auth type you decide, so no malicious user can get access to your API without proper authorization headers.How does the appsync console queries page send requests to the api when authenticated with IAM?AWS AppSync uses the IAM permissions of the logged in user to run your query on the console.Edited by: Shankar-AWS on Feb 21, 2019 11:49 AMCommentShareAWS-User-5675963answered 4 years ago0No, you would have an Auth type set on the API. So only the requests with proper Authorization headers are allowed to execute this query. AppSync provides you $context.identity inside the resolver mapping templates, so you can always use that to limit the "userId" in the query parameter.Are these headers, encrypted so that someone using wireshark or another network analyzer can't determine what the authorized header should be and use curl to execute malicious commands?Maybe this example will better articulate what I am wondering.// guaranteed to be my UserIdString myUserId = getMyUserId();// guaranteed to return conversations I am autorized to talk in. String[] conversationIds = getAllMyConversationIds(myUserId);for(String convId : conversationIds){    // Preconditon: myUserId is the callers userId, and the caller is invited to convId    // Does the precondition hold against malicious users?    // Is it nessasary to include Auth Checks inside sendMessage given the precondition?    sendMessage(myUserId, convId, "Hello World");}To add auth checks to send message, I would need to transform it to a pipeline resolver, where I would first need to check the users table (hash: cognitoIdentityId) if the source has the given userId, and then add another function to check the conversations table to see if the user has been invited to the conversation. This would triple the calls needed to dynamodb in order to send a single message. Is this necessary?Thank you for the help!CommentShareOGDevanswered 4 years ago0I think you are talking about 2 different things here:API level Auth - AWS AppSync supports Cognito User Pools, IAM, API_KEY and OIDC. Each request to the service has a valid Authorization header, otherwise AppSync will not process these requests. This is vended over an HTTPS connection, so your requests are encrypted. This is similar to any public APIs (like API Gateway).You can use Cognito group level auth to secure your GraphQL fields. This is purely your business logic, and you should set these rules in your Request and Response mapping templates of your field resolvers. AppSync exposes $context.identity object so you can have these conditions set on the resolver.You don't necessarily need to have a pipeline resolver to plugin Cognito auth validations for your GraphQL fields.CommentShareAWS-User-5675963answered 4 years ago0I see that makes more sense.Is it safe to expose cognitoIdentityId?Currently, I have a dynamodb users table with cognitoIdentityId hash key and a userId GSI. To authenticate users, I query the GSI with the provided userId, and then check if the source.cognitoIdentityId equals the cognitoIdentityId stored in dynamodb.This is not ideal because I have a GSI and have to frequently use pipeline resolvers for auth checks. It would be much better if I could expose cognitoIdentityIds and not need userIds at all.I don't see any way out of making an additional dynamodb call to the conversations table to check if the user is associated with the given conversationId.Therefore to send a message I would need to use the pipeline:AuthUserbyIdAuthUserConversationSendMessageIs there any way to cut down the amount of dynamodb calls for sending a single message? Possibly  Cognito groups, although I must use IAM auth.I noticed that the "Chat App" sample project has none of these checks, is it vulnerable to attacks? I may be overthinking things, I just want to make sure my application has no security vulnerabilities.I really appreciate the help, thank you!CommentShareOGDevanswered 4 years ago0If you're asking about directly keying and querying on the cognitoIdentityId that's pretty much what Cognito recommends. Do you mean exposing the cognitoIdentityId in your client app?The cognitoIdentityId in your app can for example correspond to an unauthenticated identity in which case you just need to make sure that the unauthenticated identity only has access to the relevant information in your app. You can restrict access by specifying the policy in the unauthenticated role to only allow access to the appropriate resources.If it corresponds to a user that federated into the Cognito Identity Pool, when obtaining credentials, Cognito verifies the token the user federated with, issues credentials against the token and identity id and when using those credentials against AppSync, AppSync rehydrates the identity id based on the supplied credentials and you can use the identity id in your templates.Which part of the process are you unsure of?CommentShareAWS-User-0691748answered 4 years ago0That pretty much clears it up. I was concerned with exposing cognitoIdentityIds to the client app, so that users can query information directly by using:getUserByCognitoId(cognitoIdentityId: String): UserOpposed to creating a separate userId field, and a GSI in the users table to create the query:getUserById(userId: String): UserBut it seems like as long as my unauth role is highly restrictive. (Analytics/Cognito Identity) it should be okay.Thanks!Edited by: OGDev on Mar 1, 2019 11:49 AMCommentShareOGDevanswered 4 years ago"


Question: EventBridge failing to invoke API Destination with SDK_CLIENT_ERROR suddenly

"Hello,We're using EventBridge to trigger an application API on a periodic basis. It is public facing and hosted on our EC2 instances, which is behind a Load Balancer.It had been working fine up until the day the domain name's SSL certificate expired. However, after SSL cert had been renewed and re-imported via Certificate Manager, the error still persists (from the deadletterqueue):NameValueERROR_CODESDK_CLIENT_ERRORERROR_MESSAGEUnable to invoke ApiDestination endpoint: API destination endpoint cannot be reached.RULE_ARN...TARGET_ARN...Connection is Authorized, API Destination has been checked and works when called in the browser. Everything seems to be in order. Have tried re-creating  new connection/APIDestination/new rule but hitting same error.What might cause such an error "SDK_CLIENT_ERROR" ?Thanks in advance.FollowComment"


Question: ECS update stuck in "in progress" after machine change

"Hello,After the change of machine type on bigger some tasks on ECS were redeployed as before they had too little memory to start. After that, they were stuck in "in progress" status with both tasks working and receiving traffic.The fix was to force redeploy service. After that, the tasks were back to normal.Expected behaviorFrom ECS I would expect to properly scale and deploy a new version of the service without operator intervention.FollowComment"


Question: How to concatenate thing name with string in mqtt policy?

"Hi guys,I am asking help to configure a particular case in mqtt policy that seems not to work.In my scenario I have a thing in IoT Core with a generic name (let's say TesThing ) and I want this thing to be able to connect to IoT Core with two possible client ids: the thing name as it is ( TesThing ) or the thing name plus the string "Shell" (that is TesThingShell ). I wrote this policy to achieve this behaviour:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": "iot:Connect",      "Resource": [        "arn:aws:iot:**-**-*:123***789:client/${iot:Connection.Thing.ThingName}",        "arn:aws:iot:**-**-*:123***789:client/${iot:Connection.Thing.ThingName}Shell"      ]    }  ]}However it does not behave as expected. The device connects normally with id "TesThing" but does not connect with id "TesThingShell", unless I explicitly hardcode "TesThingShell" in the policy. This made me think that it is not actually possible to concatenate ${iot:Connection.Thing.ThingName} with a generic string in the policy document. Do you know any way to do this?FollowComment"

Answer: "0Thanks for using AWS IoT. As our docs(https://docs.aws.amazon.com/iot/latest/developerguide/thing-policy-variables.html) say, to use thing-policy variables these two things must be true.ClientId must match with ThingName.Certificate must be associated with the Thing (specified in the clientId).A certificate can be associated with more than one thing so we depend on device giving the exact thing name while connecting to IoT core in clientId field. This is needed even if certificate is attached to a single thing because if the certificate is attached to another thing in its lifetime (maybe accidentally), we don't want existing devices to break as policy variables cannot be resolved if we cannot identify the thing uniquely.We have a feature request in our backlog to support multiple client ids. We cannot give exact dates but we are working hard to get the features out based on the priorities.CommentShareAWS-User-3247576answered 3 years agoShainert Israel a year agoWhat is the status of this feature request?Share0Thank you for the answer.I managed to obtain the same behaviour I had in mind using thing attributes instead of different client ids, cited in the link you provided.CommentShareFiorixF1answered 3 years ago"


Question: How to secure static IP address of instance from bot attacks?

"I have several instances with virtual hosts set up, and the default host document root is /opt/bitnami/wordpress. All of my virtual host records point to their respective domain name/website directory. When someone visits the static IP address of the instance directly, it loads a forbidden error page, which is fine but when bots are attacking the static IP address, I don't know how to limit or prevent the attack. I have fail2ban running, but doesn't seem to be stopping them.Is there something I can do with the default first virtual host record to stop direct access or at least send them away or limit them somehow?One other consideration is that I'd still like to be able to test websites the way I usually do by accessing the static IP address with the directrory name. e.g. 11.22.333.444/domain.com.FollowComment"

Answer: "1Hi, @BJSawsFrom your tag, I'm guessing you're using Lightsail.It is easy to introduce AWS WAF for BOT countermeasures.However, Lightsail does not provide the ability to use AWS WAF directly.You can use snapshots to migrate from Lightsail to EC2.Alternatively, you can use the following link method to host the ALB + WAF in your default VPC and use VPC peering to forward traffic to Ligthsail.https://blog.ddm.tri-stage.jp/2022/06/13/wordpress%E3%82%92%E6%A7%8B%E7%AF%89%E3%81%97%E3%81%A6%E3%81%84%E3%82%8Blightsail%E3%81%ABaws-waf%E3%82%92%E5%B0%8E%E5%85%A5%E3%81%97%E3%81%A6%E3%81%BF%E3%81%9F/CommentShareEXPERTiwasaanswered a year ago0Have you considered using AWS Web Application Firewall bot control?CommentShareRodney Lesteranswered a year agoBJSaws a year agoThanks. I ended up figuring out that I can restrict my lightsail instances to a range of IP addresses using the lightsail firewall...so I just restrict all traffic to be from Cloudflare IP address ranges.Share"


Question: Storage Classes

"The storage types offered by AWS are instance stores, EBS, EFS, and S3.S3 has storage classes - Standard, Standard 1A, etc.Are there storage classes for the other storage types (EBS, EFS, instancestores) as well?FollowComment"

Answer: "0Hi ThereAmazon EBS provides the following volume types: General Purpose SSD (gp2 and gp3), Provisioned IOPS SSD (io1 and io2), Throughput Optimized HDD (st1), Cold HDD (sc1), and Magnetic (standard). They differ in performance characteristics and price, allowing you to tailor your storage performance and cost to the needs of your applications. For more information, see (Amazon EBS volume types)[https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html].EFS Standard and Standard-IA storage classes are regional storage classes that are designed to provide continuous availability to data, even when one or more Availability Zones in an AWS Region are unavailable. They offer the highest levels of availability and durability by storing file system data and metadata redundantly across multiple geographically separated Availability Zones within a Region.  See https://docs.aws.amazon.com/efs/latest/ug/storage-classes.htmlCommentShareEXPERTMatt-Banswered 5 months agoTrevor_C 5 months agoHello Matt-B, thanks for responding to my query with that wonderful information.  If I'm understanding your reply correctly, you are stating that there are storage classes for EFS (Standard and Standard-IA_.  Regarding EBS, I noticed that you referred to the different offerings as "volume types", and not "storage classes".  That prompts this question, are volume types and storage classes synonymous terms?ShareMatt-B EXPERT5 months agoI think there are similarities and differences in the 2 terms, which is why its best not to get too caught up in different terminologies.  This gets even more confusing as you look at other providers as well, because they tend to use their own terminologies that mean different things.  Its much more important to select a service based on your use case and requirements.With that said, think of Storage Classes more like "tiers" (ex. Hot, warm, cold).  With storage classes, you get to choose different classes based on your access patterns and balance availability with cost.  Here is a really good chart that shows the differences across all of the classes.  https://aws.amazon.com/s3/storage-classes/#Performance_across_the_S3_Storage_ClassesWith EBS, you are really just choosing different volume types based on the i/o performance you need (magnetic vs SSD)Share"


Question: API Gateway deploy in Jenkins warnings on Open API 3.0 spec import

"Hello all! I am investigating an issue happening with recent API Gateway deployments that have resulting warnings in the Jenkins console output resembling the following:"warnings": [        "More than one server provided. Ignoring all but the first for defining endpoint configuration",        "More than one server provided. Ignoring all but the first for defining endpoint configuration",        "Ignoring response model for 200 response on method 'GET /providers/{id}/identity/children' because a model with the same name already exists. Please reference the defined model/schema, rather than redefine it on this method.",        "Ignoring request model for 'PUT /providers/{id}/admin_settings' because a model with the same name already exists. Please reference the defined model/schema, rather than redefine it on this method.",        "Ignoring response model for 200 response on method 'GET /providers/{id}/profile/addresses/{address_id}' because a model with the same name already exists. Please reference the defined model/schema, rather than redefine it on this method.",        "Ignoring response model for 200 response on method 'GET /providers/{id}/profile/anecdotes/{anecdote_id}' because a model with the same name already exists. Please reference the defined model/schema, rather than redefine it on this method.",        "Ignoring request model for 'POST /providers/{id}/routes' because a model with the same name already exists. Please reference the defined model/schema, rather than redefine it on this method.",        "Ignoring response model for 200 response on method 'GET /providers/{id}/routes/{route_id}' because a model with the same name already exists. Please reference the defined model/schema, rather than redefine it on this method.",        "Ignoring response model for 200 response on method 'GET /service_type_groups/{id}' because a model with the same name already exists. Please reference the defined model/schema, rather than redefine it on this method.",        "Ignoring response model for 200 response on method 'GET /service_types/{id}' because a model with the same name already exists. Please reference the defined model/schema, rather than redefine it on this method."    ]Here is an example of the 200 response for an effected method in the OAS doc:responses:        '200':          description: Array of Provider Identities that are children of this Provider          content:            'application/json':              schema:                description: Array of children provider identities                type: array                items:                  $ref: '#/components/schemas/providerIdentityExpansion'        '404':          $ref: '#/components/responses/not_found'        '500':          $ref: '#/components/responses/server_error'Based on the language in the warnings text, my understanding is that there is some kind of default request/200 response model defined, and it is somehow being overwritten in the API methods themselves. But when comparing some other (seemingly) non-warning methods they look identical in how they are implemented. I have tried a few potential fixes with removing adding attributes, but none have worked so far.Would anyone be able to help me in finding what exactly is going wrong here in the OAS doc?FollowComment"


Question: Games digital distribution platform

"I want to enter into digital game distribution services, similar to STEAM. I am new to all this. Need help and suggestions on how can I develop a steam-like platform whereThere will be 2 interfaces - 1 for gamers, 1 for the game developerGame codes to be stored in the cloudUser authentication will be neededGame license management will be neededThanksFollowComment"

Answer: "1That's a big question - actually, many big questions. I'd suggest that re:Post isn't the place to ask that - mainly because it's a discussion rather than a "here's a single way to do this". Even a single way would (probably) take several pages of notes; and that would lead to lots more Q&A. And there's no single one "good" way of doing what you're proposing - depending on the skills you and your team have; the preferences in design and so on.I'd encourage you to reach out to your local AWS Solutions Architect to talk about this in detail - that way it can be a proper discussion.CommentShareEXPERTBrettski-AWSanswered 8 months ago"


Question: Filter Expression can only contain non-primary key attributes ?

"DynamoDB currently does not allow FilterExpression on your GSI hash or sort keys. Hash or sort key should be specified using KeyCondition only. I understand this is made to protect us from making mistakes, but it also removes the ability of doing some pretty good things.As an example, I am working on a table that has relationships from users to resources. In a simplified example, imagine:PK|user#SoMeId      SK|resourceA#rEsOuRcEiD       NAME|-nice-slug-name-I want to be able to search in "NAME" using "contains", and I would also like to have my list sorted by it, as it is more natural for users than random ids. If I could use a sort key in both KeyExpression and FilterExpression, I could create a GSI using PL/NAME, append prefix to name as well, and have a nice search index.PK|user#SoMeId     SK|resourceA#rEsOuRcEiD     NAME|resourceA#-nice-slug-name-query (PK=user#SoMeId, SK=begins_with(resourceA), INDEX=pk-name-index, FILTER={ name: contains(slug) })That would be very nice. Judging by I understand DynamoDB works, it seems like this should be completely possible from the technical perspective.Why don't you guys force an extra argument to enable functionality? Instead of outright banning it, just offer the ability of setting something like AllowKeyFilter=true on the API calls, just to make it an obvious opt-in feature, so no one can complain if they pay more than expected in case they made something wrong?When I asked this question on the past, I have been told to duplicate fields, but that's just cumbersome. Why not allow it to be used by those that opt-in?(Continued from https://forums.aws.amazon.com/thread.jspa?threadID=172530)FollowComment"

Answer: "0To my knowledge, you have correctly identified how the service is working. Your best course of action is likely to provide feedback to the Amazon DynamoDB service team through the AWS Management Console. Some details on doing that are here: https://repost.aws/knowledge-center/send-feedback-awsCommentShareAWS-Harrisonanswered a month ago"


Question: Amazon RDS Custom SQL-Server: Agent not running

"Hello,I am an absolute beginner to Amazon RDS. I've created an RDS Custom Instance for SQL Server Standard. After connecting; I've tried to activate SQL Jobs: sp_configure 'show advanced options', 1;  GO  RECONFIGURE;  GO  sp_configure 'Agent XPs', 1;  GO  RECONFIGURE  GONow I 'm able to create jobs, but they are not runnable. Error message is:I've found no advanced setting in RDS admin or Management Studio where I am able to activate the agent. According to the documentation, this feature should work:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.SQLServer.CommonDBATasks.Agent.htmlCan anybody point me into the right direction please how to get it running? Thanks in advance.FollowComment"

Answer: "0Accepted AnswerDid a support request, if anyone else stumbles upon this: Use the underlying EC2 instance to start the service. You can open a PowerShell-Session. There you can start services.CommentSharerePost-User-7052216answered 10 months ago"


Question: Certain EBS snapshot can't be restored.

"Hi,I want to access to the EBS snapshot that I have created.To do this,I tried to make the snapshot into volume and attach it to the ec2,and I also tried to create new AMI with the snapshot and run it on new ec2 instance.However, when I use that certain EBS snapshot, both cases are keep giving me 1/2 instance status error, so I can't connect to the ec2 for data extraction.I only have one snapshot and I really need to recover data from that EBS snapshot.Is there any way? Please I need help.Thank you.Volume that is created with EBS snapshot seems like it has no error...FollowComment"

Answer: "0Create a new instance and attach the volume you created with the snapshot to the new instance, not as the root volume. See: Attach an Amazon EBS volume to an instance.CommentShareEXPERTkentradanswered 4 months ago"


Question: Is there really such a thing as a totally seamless and tile free texture?

"I've been mucking around with textures. The texture below is displayed in Photoshop with a 50% offset (i.e. 4 tiles). As you can see, it appears to be totally seamless.REMOVEDUPLOADThis is the same texture rendered in Lumberyard with U and V at 1.0. As you can see, there is obvious tiling. I can turn down the U and V to reduce the tiling at the cost of fidelity and resolution. Has anyone found a way to get perfect seamless textures into Lumberyard or reduce tiling (apart from simply turning down the U and V settings)? If so, I'd love to hear your tips and tricks.REMOVEDUPLOADFollow"

Answer: "0@REDACTEDUSERWhat you are seeing is the variation of light and dark in your texture. You can easily fix this using the High Pass filter in Photoshop. Here is a great article about the topic on Gamasutra:https://www.gamasutra.com/view/feature/131482/the_power_of_the_high_pass_filter.php?print=1Here is your original texture:REMOVEDUPLOADThe same texture after a few minutes in Photoshop adjusting the High Pass filter settings:REMOVEDUPLOADAttached here is the high pass texture: 7293-grass-002.zip|attachment (2.31 MB)grass-002.zipSharerePost-User-2521121answered 5 years ago0Thanks BigMonet, appreciated : )SharerePost-User-3290209answered 5 years ago0@REDACTEDUSERBoth textures will actually work...In the image that I shared in this post, I used a green colored overlay above the high pass texture in Photoshop. But, this actually limits what you can do with the texture because it is already colored / tinted.I would recommend using the high pass texture directly in Lumberyard. Then, use the diffuse color options in the Material Editor to tint the high pass texture any color that you want. This would be the recommended workflow.SharerePost-User-2521121answered 5 years ago0@REDACTEDUSERI'd be whether the previous workflow for painting terrain that is in the docs will be removed at some point and replaced with what you did. Thanks in advance!SharerePost-User-8843326answered 5 years ago0Ah, so you would high pass in photoshop, fade the high pass with luminosity as mode and opacity at 100%, then use that and tint it when needed. Thanks for explaining!SharerePost-User-8843326answered 5 years ago"


Question: streaming data through the DMS

"When streaming data through the DMS, should the destination cluster have the same size and architecture as the source cluster? Example: an Aurora postgresql cluster with three instances for a Postgresql RDS.FollowComment"

Answer: "1Accepted AnswerHiNot necessary or mandatory have the same size and architecture, it depends how will be your requirements for your target database and type of workload of the source database. For example if your source database is focus to process thousands or millions of transactions, this workload needs to be replicated to your target database by DMS using CDC, transactions replicated needs to be received by your target database and process them, so, in this case you needs similar instance sizes. In another hand if your source is processing few transactions you target database could have less resources. You should analyze current transactional workload on your source database and define target size properly. Another thing to consider is the size of your DMS Instance, this instance should be on charge of replicate data from source to target, correct has to be set for replicate your data correctly, you could review link below to define DMS instance size.Choosing the best size for a replication instancehttps://docs.aws.amazon.com/dms/latest/userguide/CHAP_BestPractices.SizingReplicationInstance.htmlRegardsCommentSharesnmatusanswered 4 months agorePost-User-7704228 4 months agoThanks for the clarification.In my case, the database processes a very large amount of requests, including this is one of the reasons for the stream, trying to reduce the consumption of IOPS that is causing a high cost in the aurora. I will then make a cluster in rds based on the current cluster. ThanksShare"


Question: AWS PrivateLink Scaling

Are there any limitations around PrivateLink network throughput. How does PrivateLink scale to handle an uptick in data sent to an endpoint?FollowComment

Answer: "0Accepted AnswerPrivateLink is based on AWS Hyperplane and is highly available and scalable by design.By default, each interface endpoint can support a bandwidth of up to 10 Gbps per Availability Zone. and can automatically scale up-to 40Gbps. If your application needs higher bursts or sustained throughput, contact AWS support.Link: https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.htmlCommentShareEXPERTRizwan_Manswered 3 years ago"


Question: AWS DNS not updating

"I've also put this on StackOverflow which was my first instincthttps://stackoverflow.com/questions/74975099/aws-dns-not-updating/74975409#74975409I am attempting to configure the DNS records in Route53. As an experiment im trying to host a static website from an S3 bucket, use Cloudfront and attach a custom domain. This should not be a problem!!!!!!!Thus far its a fail and i'm considering never going near AWS with a bargepole again, all the same I would like to see this through before I cancel my subscription.CloudFront distribution is working securely at https://dr3uff0ffprrr.cloudfront.net/ although it is slower than expected.I can't attach a custom domain to the CloudFront distribution with DNS routing. I know it can take 72 hours to propagate, I am way beyond that now. I have also tried the enhanced support option but all they do is refer to the literature which I could have read for myself at no extra cost.The custom domain that I want to use is www.androit-solutions.com. Oddly it is hosted by AWS Route53 and I wonder if that has actually made it more complicated to use.Anyway, a bucket has been created for domain and subdomain. My inputted DNS details are:androit-solutions.com A Simple - dr3uff0ffprrr.cloudfront.net.androit-solutions.com AAAA Simple - dr3uff0ffprrr.cloudfront.net.androit-solutions.com NS Simple -ns-1581.awsdns-05.co.uk ns-115.awsdns-14.com ns-755.awsdns-30.net ns-1266.awsdns-30.organdroit-solutions.com SOA Simple - ns-1581.awsdns-05.co.uk. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400www.androit-solutions.com A Simple - dr3uff0ffprrr.cloudfront.net.www.androit-solutions.com AAAA Simple - dr3uff0ffprrr.cloudfront.net.DNS server lookup sites report that there are no DNS records. Zone is definitely public.Please help or feel free to suggest alternatives.ThanksRobertPlease see everything aboveFollowComment"

Answer: "0Right, positive things appear to be happeningTwo notifications have appeared:androit-solutions.comName server update successful2023-01-01 22:41:51androit-solutions.comDomain registration successful2022-12-26 14:03:45dns lookup is also looking goodI will give this some time to propagate but I would still appreciate it if you could check over the other infos that I have inputted. I came within the width of a ballhair away from ditching AWS, I suspect its something to do with the website GUI and it was incredibly annoyingCommentSharenotImpressed1983answered 5 months agoNima-AWS 5 months agoGlad to hear that it started to work. NS records are looking good and the domain is now resolving. Are you facing any other issue that you need help with?SharenotImpressed1983 5 months agoYeah everything is fine apart from the site not being secure if I use the domain. CloudFront distribution is still safe and SSL cert still valid - what on earth went wrong with that?ShareNima-AWS 5 months agoYou site is now loading on both http://androit-solutions.com and https://androit-solutions.com. In order to enforce the site to only load on https, you need to update the setting in your Viewer Protocol Policy under Behaviors as explained in the link below:https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.htmlShare0When you register a domain with Route 53, it automatically creates a hosted zone for that domain. But it seems that no hosted zone is currently associated with your domain androit-solutions.com as it is not possible to find any name server for this domain. Hence, if you created the public hosted zone that you are currently using separately, please consider updating the name servers in the below record for your domain.androit-solutions.com NS Simple - ns-1581.awsdns-05.co.uk ns-115.awsdns-14.com ns-755.awsdns-30.net ns-1266.awsdns-30.orgInstruction on how to update the name servers for a registered domain is provided in the link below:Adding or changing name servers or glue recordsMore details on replacing a hosted zone for a registered domain can be found here:Replacing the hosted zone for a domain that is registered with Route 53Hope this helps!CommentShareNima-AWSanswered 5 months agonotImpressed1983 5 months agoI think I might be getting somewhere here...for some unknown and go awful reason I have only now received an Email saying that my name servers have been updatedSharenotImpressed1983 5 months agoI have been updating from the GUI in pic2 and I never ever got an Email confirming the update until I tried the GUI in pic 1I was told to update SOA records by support, they gave me:ns-1581.awsdns-05.co.uk. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400I don't know if thats right im a bit suspiciousPlease let that be it that was so frustratingShare0I think you might be better served by using a CNAME to point to the cloudfront distribution.Details below . . .https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.htmlAlso checkIf your domain's NS records properly updated in Route53?https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/migrate-dns-domain-in-use.htmlIs your S3 bucket setup  to host static websites?https://docs.aws.amazon.com/AmazonS3/latest/userguide/HostingWebsiteOnS3Setup.htmlCommentSharetedtrentanswered 5 months agonotImpressed1983 5 months agoThanks but i've been through the literature many times and its not up to date, many of the links it refers to are simply not there, something that support doesn't seem to understand. There are no DNS records for the domain they simply won't update. I have already tried the CNAME. S3 buckets are configured and working as is cloudfront.Share"


Question: Where should .config files go?

"I can't get EB to install ImageMagick on deploy. I've had to ssh into the instance to install it. Not how I want it.packages.config:'''''''''packages:yum:ImageMagick: []'''''''''''Tried .platform/, Have tried everywhere. Currently in .platform/nginx/hooks/prebuild/Where should that file be located?THXFollowComment"

Answer: "0Thanks to thesameeric's answer re: Client_max_bodysizeThe packages.config file goes in .platform/nginx/conf_d/Edited by: squirreltown on Jun 11, 2021 1:37 PMCommentSharesquirreltownanswered 2 years ago"


Question: Redis cluster with multiple shards

For a redis cluster with 3 shard and 1 replica of each shard so total 6 nodes.How do I know maximum number of  client connection (parallel) of each node?FollowComment

Answer: "0Hi There,For each node in the cluster, there is a limit of 65000 connections at a time.This value is specified in the Parameter group of the cluster with parameter named "maxclients".This value is fixed and cannot be changedYou can look up maxclients in https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/ParameterGroups.Redis.html#w144aac20c45c51c45b7Hope this is helpful.CommentShareSUPPORT ENGINEERSatyamanswered 4 years ago0Thanks for the answer.CommentSharesagar596answered 4 years ago"


Question: Cannot deploy Flask application with Elastic Beanstalk

"I have a simple use case. I want to deploy my Flask application with Elastic Beanstalk, however after trying for multiple hours I cannot seem to make it happen.My application is pretty standard:-I have "app.py" file with my python code where I only have to import "flask" and "sqlite".-I have "templates" folder with my .HTML files and "static" folder with my .CSS and .PNG files.-I have an "expenses.db" and "users.db" databases with less than 50KB of data in both combined.My application works when I run the "python app.py" command in CMD through my virtual environment.My requirements.txt only includes the basic libraries:blinker==1.6.2click==8.1.3colorama==0.4.6Flask==2.3.2itsdangerous==2.1.2Jinja2==3.1.2MarkupSafe==2.1.2Werkzeug==2.3.4Unfortunately it is my first time using AWS, but after a few hours I managed to successfully set up the environment, however I now cannot deploy my application, and I am guessing it is a pretty standard use case.The EVENTS say:May 26, 2023 15:25:44 (UTC+2)INFOThe environment was reverted to the previous configuration setting.May 26, 2023 15:25:26 (UTC+2)ERRORDuring an aborted deployment, some instances may have deployed the new application version. To ensure all instances are running the same version, re-deploy the appropriate application version.May 26, 2023 15:25:26 (UTC+2)ERRORFailed to deploy application.May 26, 2023 15:25:26 (UTC+2)ERRORUnsuccessful command execution on instance id(s) 'i-0dcd82ee6b813bdf4'. Aborting the operation.May 26, 2023 15:25:26 (UTC+2)INFOCommand execution completed on all instances. Summary: [Successful: 0, Failed: 1].May 26, 2023 15:25:26 (UTC+2)ERROR[Instance: i-0dcd82ee6b813bdf4] Command failed on instance. Return code: 1 Output: Engine execution has encountered an error..May 26, 2023 15:25:23 (UTC+2)ERRORInstance deployment failed. For details, see 'eb-engine.log'.May 26, 2023 15:25:23 (UTC+2)ERRORInstance deployment: Your source bundle has issues that caused the deployment to fail. For details, see 'eb-engine.log'.May 26, 2023 15:25:19 (UTC+2)INFODeploying new version to instance(s).May 26, 2023 15:24:45 (UTC+2)INFOUpdating environment IU-Appl-env-1's configuration settings.May 26, 2023 15:24:36 (UTC+2)INFOEnvironment update is starting.May 26, 2023 15:18:25 (UTC+2)INFODeleted log fragments for this environment.and my "cb-engine.log" sayss2023/05/26 12:17:56.699238 [INFO] Starting...2023/05/26 12:17:56.699296 [INFO] Starting EBPlatform-PlatformEngine2023/05/26 12:17:56.699372 [INFO] reading event message file2023/05/26 12:17:56.699551 [INFO] Engine received EB command userdata-exec2023/05/26 12:17:56.709787 [INFO] Running command /bin/sh -c /opt/aws/bin/cfn-get-metadata -s arn:aws:cloudformation:eu-central-1:159258688165:stack/awseb-e-rr9c3sfmup-stack/2f3744f0-fbbf-11ed-8d54-064cd1f3cb1a -r AWSEBAutoScalingGroup --region eu-central-12023/05/26 12:17:57.441546 [INFO] Running command /bin/sh -c /opt/aws/bin/cfn-get-metadata -s arn:aws:cloudformation:eu-central-1:159258688165:stack/awseb-e-rr9c3sfmup-stack/2f3744f0-fbbf-11ed-8d54-064cd1f3cb1a -r AWSEBBeanstalkMetadata --region eu-central-12023/05/26 12:17:58.300973 [INFO] This is a workflow controlled instance.2023/05/26 12:17:58.301072 [INFO] Engine command: (env-launch)2023/05/26 12:17:58.301211 [INFO] Executing instruction: SyncClock2023/05/26 12:17:58.301215 [INFO] Starting SyncClock2023/05/26 12:17:58.301230 [INFO] Running command /bin/sh -c /usr/bin/chronyc tracking2023/05/26 12:17:58.308629 [INFO] Reference ID    : 00000000 ()Stratum         : 0Ref time (UTC)  : Thu Jan 01 00:00:00 1970System time     : 0.000000000 seconds fast of NTP timeLast offset     : +0.000000000 secondsRMS offset      : 0.000000000 secondsFrequency       : 31.829 ppm fastResidual freq   : +0.000 ppmSkew            : 0.000 ppmRoot delay      : 1.000000000 secondsRoot dispersion : 1.000000000 secondsUpdate interval : 0.0 secondsLeap status     : Not synchronised2023/05/26 12:17:58.308661 [INFO] Running command /bin/sh -c /usr/bin/chronyc -a makestep2023/05/26 12:17:58.315713 [INFO] 200 OK2023/05/26 12:17:58.315794 [INFO] Skipping Configure OS2023/05/26 12:17:58.315802 [INFO] Skipping LockRepo2023/05/26 12:17:58.315808 [INFO] Skipping GenerateEBBanner2023/05/26 12:17:58.315815 [INFO] Skipping Install Process Manager2023/05/26 12:17:58.315821 [INFO] Skipping install syslog2023/05/26 12:17:58.315826 [INFO] Skipping install cron2023/05/26 12:17:58.315831 [INFO] Skipping install proxy2023/05/26 12:17:58.315837 [INFO] Skipping installhealthd2023/05/26 12:17:58.315842 [INFO] Skipping Install Log Streaming Manager2023/05/26 12:17:58.315847 [INFO] Skipping install X-Ray2023/05/26 12:17:58.315852 [INFO] Skipping install Third Party License2023/05/26 12:17:58.315857 [INFO] Skipping install httpd2023/05/26 12:17:58.315865 [INFO] Instance has NOT been bootstrapped2023/05/26 12:17:58.315869 [INFO] Executing instruction: installSqsd2023/05/26 12:17:58.315873 [INFO] This is a web server environment instance, skip install sqsd daemon ...2023/05/26 12:17:58.315878 [INFO] Instance has NOT been bootstrapped2023/05/26 12:17:58.315882 [INFO] Executing instruction: bootstraphealthd2023/05/26 12:17:58.315886 [INFO] this is a basic health env, skip bootstrap healthd instruction...2023/05/26 12:17:58.315890 [INFO] Executing instruction: GetSetupProxyLog2023/05/26 12:17:58.316034 [INFO] Skipping Install yum packages2023/05/26 12:17:58.316041 [INFO] Skipping Configure Python site-packages2023/05/26 12:17:58.316047 [INFO] Skipping Install Python Modules2023/05/26 12:17:58.316052 [INFO] Skipping MarkBaked2023/05/26 12:17:58.316058 [INFO] Instance has NOT been bootstrapped2023/05/26 12:17:58.316062 [INFO] Executing instruction: TuneSystemSettings2023/05/26 12:17:58.316065 [INFO] Starting TuneSystemSettings2023/05/26 12:17:58.316070 [INFO] Instance has NOT been bootstrapped2023/05/26 12:17:58.316998 [INFO] Executing instruction: GetSetupLogRotate2023/05/26 12:17:58.317003 [INFO] Initialize LogRotate files and directories2023/05/26 12:17:58.328678 [INFO] Instance has NOT been bootstrapped2023/05/26 12:17:58.328691 [INFO] Executing instruction: BootstrapCFNHup2023/05/26 12:17:58.328694 [INFO] Bootstrap cfn-hup2023/05/26 12:17:58.329979 [INFO] Copying file /opt/elasticbeanstalk/config/private/aws-eb-command-handler.conf to /etc/cfn/hooks.d/aws-eb-command-handler.conf2023/05/26 12:17:58.331277 [INFO] Executing instruction: StartCFNHup2023/05/26 12:17:58.331290 [INFO] Start cfn-hup2023/05/26 12:17:58.331318 [INFO] Running command /bin/sh -c systemctl show -p PartOf cfn-hup.service2023/05/26 12:17:58.354167 [INFO] cfn-hup is not registered with EB yet, registering it now2023/05/26 12:17:58.354216 [INFO] Running command /bin/sh -c systemctl show -p PartOf cfn-hup.service2023/05/26 12:17:58.385914 [INFO] Running command /bin/sh -c systemctl daemon-reload2023/05/26 12:17:58.918397 [INFO] Running command /bin/sh -c systemctl reset-failed2023/05/26 12:17:58.940875 [INFO] Running command /bin/sh -c systemctl is-enabled aws-eb.target2023/05/26 12:17:58.952586 [INFO] Running command /bin/sh -c systemctl enable aws-eb.target2023/05/26 12:17:59.483576 [INFO] Running command /bin/sh -c systemctl start aws-eb.target2023/05/26 12:17:59.496835 [INFO] Running command /bin/sh -c systemctl enable cfn-hup.service2023/05/26 12:18:00.006690 [INFO] Synchronizing state of cfn-hup.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.Executing: /usr/lib/systemd/systemd-sysv-install enable cfn-hupCreated symlink /etc/systemd/system/multi-user.target.wants/cfn-hup.service → /etc/systemd/system/cfn-hup.service.2023/05/26 12:18:00.006724 [INFO] Running command /bin/sh -c systemctl is-active cfn-hup.service2023/05/26 12:18:00.018338 [INFO] cfn-hup process is not running, starting it now2023/05/26 12:18:00.018367 [INFO] Running command /bin/sh -c systemctl show -p PartOf cfn-hup.service2023/05/26 12:18:00.038791 [INFO] Running command /bin/sh -c systemctl is-active cfn-hup.service2023/05/26 12:18:00.056752 [INFO] Running command /bin/sh -c systemctl start cfn-hup.service2023/05/26 12:18:00.123535 [INFO] Instance has NOT been bootstrapped2023/05/26 12:18:00.123559 [INFO] Executing instruction: SetupPublishLogCronjob2023/05/26 12:18:00.123564 [INFO] Setup publish logs cron job...2023/05/26 12:18:00.123569 [INFO] Copying file /opt/elasticbeanstalk/config/private/logtasks/cron/publishlogs to /etc/cron.d/publishlogs2023/05/26 12:18:00.125438 [INFO] Instance has NOT been bootstrapped2023/05/26 12:18:00.125453 [INFO] Executing instruction: MarkBootstrapped2023/05/26 12:18:00.125458 [INFO] Starting MarkBootstrapped2023/05/26 12:18:00.125463 [INFO] Instance has NOT been bootstrapped2023/05/26 12:18:00.125581 [INFO] Marked instance as Bootstrapped2023/05/26 12:18:00.125588 [INFO] Executing instruction: Save CFN Stack Info2023/05/26 12:18:00.125648 [INFO] Starting SwitchCFNStack2023/05/26 12:18:00.125653 [INFO] Executing cleanup logic2023/05/26 12:18:00.125662 [INFO] Platform Engine finished execution on command: env-launch2023/05/26 12:18:26.492401 [INFO] Starting...2023/05/26 12:18:26.492449 [INFO] Starting EBPlatform-PlatformEngine2023/05/26 12:18:26.492468 [INFO] reading event message file2023/05/26 12:18:26.492707 [INFO] Engine received EB command cfn-hup-exec2023/05/26 12:18:26.636618 [INFO] Running command /bin/sh -c /opt/aws/bin/cfn-get-metadata -s arn:aws:cloudformation:eu-central-1:159258688165:stack/awseb-e-rr9c3sfmup-stack/2f3744f0-fbbf-11ed-8d54-064cd1f3cb1a -r AWSEBAutoScalingGroup --region eu-central-12023/05/26 12:18:27.081083 [INFO] Running command /bin/sh -c /opt/aws/bin/cfn-get-metadata -s arn:aws:cloudformation:eu-central-1:159258688165:stack/awseb-e-rr9c3sfmup-stack/2f3744f0-fbbf-11ed-8d54-064cd1f3cb1a -r AWSEBBeanstalkMetadata --region eu-central-12023/05/26 12:18:27.585979 [INFO] checking whether command app-deploy is applicable to this instance...2023/05/26 12:18:27.585990 [INFO] this command is applicable to the instance, thus instance should execute command2023/05/26 12:18:27.585993 [INFO] Engine command: (app-deploy)2023/05/26 12:18:27.585997 [INFO] Downloading EB Application...2023/05/26 12:18:27.585999 [INFO] Region: eu-central-12023/05/26 12:18:27.586001 [INFO] envID: e-rr9c3sfmup2023/05/26 12:18:27.586004 [INFO] envBucket: elasticbeanstalk-eu-central-1-1592586881652023/05/26 12:18:27.586006 [INFO] Using manifest file name from command request2023/05/26 12:18:27.586012 [INFO] Unable to get version manifest file.2023/05/26 12:18:27.586020 [INFO] Downloading latest manifest available.2023/05/26 12:18:27.586024 [INFO] Download latest app version manifest2023/05/26 12:18:27.586121 [INFO] resources/environments/e-rr9c3sfmup/_runtime/versions/manifest2023/05/26 12:18:27.634805 [INFO] latestManifest key *: resources/environments/e-rr9c3sfmup/_runtime/versions/manifest_16851034062482023/05/26 12:18:27.635009 [INFO] Downloading: bucket: elasticbeanstalk-eu-central-1-159258688165, object: /resources/environments/e-rr9c3sfmup/_runtime/versions/manifest_16851034062482023/05/26 12:18:27.652050 [INFO] Download successful100bytes downloaded2023/05/26 12:18:27.652139 [INFO] Trying to read and parse version manifest...2023/05/26 12:18:27.652476 [INFO] Downloading: bucket: elasticbeanstalk-eu-central-1-159258688165, object: /resources/environments/e-rr9c3sfmup/_runtime/_versions/IU-Appl/4.02023/05/26 12:18:27.727270 [INFO] Download successful1636869bytes downloaded2023/05/26 12:18:27.727384 [INFO] Executing instruction: ElectLeader2023/05/26 12:18:27.727390 [INFO] Running leader election for instance i-0dcd82ee6b813bdf4...2023/05/26 12:18:27.727392 [INFO] Calling the cfn-elect-cmd-leader to elect the command leader.2023/05/26 12:18:27.727405 [INFO] Running command /bin/sh -c /opt/aws/bin/cfn-elect-cmd-leader --stack arn:aws:cloudformation:eu-central-1:159258688165:stack/awseb-e-rr9c3sfmup-stack/2f3744f0-fbbf-11ed-8d54-064cd1f3cb1a --command-name ElasticBeanstalkCommand-AWSEBAutoScalingGroup --invocation-id 81fc8159-b362-4ef0-b1fe-ae448bfa9802 --listener-id i-0dcd82ee6b813bdf4 --region eu-central-12023/05/26 12:18:28.085028 [INFO] Instance is Leader.2023/05/26 12:18:28.085080 [INFO] Executing instruction: stopSqsd2023/05/26 12:18:28.085086 [INFO] This is a web server environment instance, skip stop sqsd daemon ...2023/05/26 12:18:28.085089 [INFO] Executing instruction: PreBuildEbExtension2023/05/26 12:18:28.085093 [INFO] Starting executing the config set Infra-EmbeddedPreBuild.2023/05/26 12:18:28.085114 [INFO] Running command /bin/sh -c /opt/aws/bin/cfn-init -s arn:aws:cloudformation:eu-central-1:159258688165:stack/awseb-e-rr9c3sfmup-stack/2f3744f0-fbbf-11ed-8d54-064cd1f3cb1a -r AWSEBAutoScalingGroup --region eu-central-1 --configsets Infra-EmbeddedPreBuild2023/05/26 12:18:28.577001 [INFO] Finished executing the config set Infra-EmbeddedPreBuild.2023/05/26 12:18:28.577038 [INFO] Executing instruction: StageApplication2023/05/26 12:18:28.577570 [ERROR] An error occurred during execution of command [app-deploy] - [StageApplication]. Stop running the command. Error: staging application failed due to invalid zip file2023/05/26 12:18:28.577576 [INFO] Executing cleanup logic2023/05/26 12:18:28.577664 [INFO] CommandService Response: {"status":"FAILURE","api_version":"1.0","results":[{"status":"FAILURE","msg":"Engine execution has encountered an error.","returncode":1,"events":[{"msg":"Instance deployment: Your source bundle has issues that caused the deployment to fail. For details, see 'eb-engine.log'.","timestamp":1685103508577,"severity":"ERROR"},{"msg":"Instance deployment failed. For details, see 'eb-engine.log'.","timestamp":1685103508577,"severity":"ERROR"}]}]}2023/05/26 12:18:28.577680 [INFO] Platform Engine finished execution on command: app-deploy2023/05/26 12:20:37.766827 [INFO] Starting...2023/05/26 12:20:37.766955 [INFO] Starting EBPlatform-PlatformEngine2023/05/26 12:20:37.766976 [INFO] reading event message file2023/05/26 12:20:37.767162 [INFO] Engine received EB command cfn-hup-exec2023/05/26 12:20:37.873560 [INFO] Running command /bin/sh -c /opt/aws/bin/cfn-get-metadata -s arn:aws:cloudformation:eu-central-1:159258688165:stack/awseb-e-rr9c3sfmup-stack/2f3744f0-fbbf-11ed-8d54-064cd1f3cb1a -r AWSEBAutoScalingGroup --region eu-central-12023/05/26 12:20:38.417209 [INFO] Running command /bin/sh -c /opt/aws/bin/cfn-get-metadata -s arn:aws:cloudformation:eu-central-1:159258688165:stack/awseb-e-rr9c3sfmup-stack/2f3744f0-fbbf-11ed-8d54-064cd1f3cb1a -r AWSEBBeanstalkMetadata --region eu-central-12023/05/26 12:20:38.807697 [INFO] checking whether command bundle-log is applicable to this instance...2023/05/26 12:20:38.807711 [INFO] this command is applicable to the instance, thus instance should execute command2023/05/26 12:20:38.807714 [INFO] Engine commanFollowComment"


Question: Assignee of issue don't get email - CodeCatalyst

when I assign someone for issue that assignee don't get email for it. is it intentional? I guess assignee should receive email in that caseFollowComment

Answer: "0Accepted AnswerThanks for reaching out. Email notifications on issue assignment are not currently supported in Amazon CodeCatalyst.I have raised a feature request with the service team on your behalf. While I am unable to comment on when this feature may get released,  please keep an eye on Whats' New and Blog pages for any new feature announcements.Here is the documentation on the notifications that Amazon CodeCatalyst supports today.CommentShareMODERATORAWS-Christosanswered 3 months ago"


Question: Unable to generate policy with access analyzer

"I tried to generate a policy using access analyzer. The generated policy is always empty and I cannot figure out why. Moreover, the events I can see in the cloudtrail event logs do not include data events even though I've configured data events.I have executed the following actionDynamoDB CreateTable aws dynamodb create-table --tablename  .... DynamoDB PutItem aws dynamodb put-item --table-name xxx --item file://contents.jsonS3 list aws s3 ls s3://mygreatbucketS3 download aws s3 cp s3://mygreatbucket/theevengreater/file .The only relevant event that is being logged in the cloudtrail is the create-table event. The data events are missing. I can't figure out what I'm doing wrong. The cloud trail config says in the "data events" section "Log All Events" for both S3 and DynamoDbB.I followed the instructions in https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation.html. I opened my Administrator user and on the policy page I clicked "Generate Policy" in the bottom.FollowComment"

Answer: "0Please see the Things to know about generating policies in the below doc :https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation.htmlData events not available – IAM Access Analyzer does not identify action-level activity for data events, such as Amazon S3 data events, in generated policies.While generating the policy, Please check the duration and region on which the IAM Access Analyzer should look into the cloudtrail.CommentShareGautam Kumaranswered 6 months agoEXPERTkentradreviewed 6 months agoKai 6 months agoJust to clarify: In the Cloud trail configuration, I did enable data events. If these are not logged, then what is this setting good for? Is there a distinction between "action-level data events" and "other data events"? And I solely operate in zone eu-central-1 and that is what I configured access analyzer to look after.Share"


Question: How can I secure the channel of communication between cross account event bridges?

"Hi,I am setting up cross account event bridges and want the messages to be transmitted securely and not via public network. I understand I can create VPC endpoints on event bridge but those can be used only from the resources within the VPC (same account). I want to create a secure channel between the two event bridges that are hosted on different accounts.  Or does the traffic between two eventbridges (essentially AWS services) ever go over public network?ThanksFollowComment"

Answer: "2EventBridge is managed in the EveentBridge service VPC. No customer has access to that VPC. When you have a rule targeting an event bus, regardless in the same account or a different account, it stays within the EventBridge service. It does not go to the internet, it is not accessible by anyone.CommentShareEXPERTUrianswered 17 days agorePost-User-1191271 16 days agothanks Uri. Is this documented anywhere? I would need an AWS artefact confirming this.Share1To answer the last part of the question: Traffic between AWS services does not go across the public internet as per the VPC FAQ.CommentShareEXPERTBrettski-AWSanswered 17 days agorePost-User-1191271 17 days agoI understand the traffic flows within AWS infrastructure only, but other tenants can still have access to this data, and hence I am looking for a private channel that can be accessed only by the 2 accounts involved in the cross-account integration.ShareBrettski-AWS EXPERT17 days agoCould you explain why you think that other tenants have access to the data? That's not true unless you have explicitly given a foreign account (i.e. one not controlled by you) access to the EventBridge.Share1Hi, use EventBridge ad hoc rules to go cross-account: see https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-cross-account.htmlThen, Event Bridge encrypts its messages; https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-data-protection.htmlCommentShareDidier_AWSanswered 17 days agorePost-User-1191271 17 days agoI understand the messages will be encrypted using TLS, but I prefer something more secure like MASSL or a private vpc channel.Share"


Question: removing contexts on a LevV2 bot from unsiupported locale (or adding support for contexts there)

"First time I’m building out a somewhat smart lex bot, totally self taught. I've built out intents, some picking up contexts from other intents.Through testing I learned that slots for things like city have different available options based on locale, so I’ve copied my EN_US setup to EN_AU and found that the slots got fixed. (Hooray!!)Just tried to update an intent in AU and am getting an error saying contexts are not supported in that locale, I assume they got copied across from EN_US. But the UI doesn't display in that locale contexts so I cant actually see how to clear them out. Any thoughts? Is this a bug?And any idea why they are not supported?FollowComment"

Answer: "0Accepted AnswerHi, yes the inputcontext is only available in en_US https://docs.aws.amazon.com/lexv2/latest/dg/how-languages.html among other things. So it doesn't show on other locales.For now, I think the only way is to edit directly the model locale. Follow this in orderIn Amazon Lex console,  Got to your bots and export that one.Unzip and edit in BotLocales/en_AU/{intentName}/intent.jsonMake sure that    "inputContexts": null, "outputContexts": null,Save it, zip itGo to your bots and import this edited one.Let us know!CommentShareKikeanswered 3 months agoEXPERTAWS-samfredreviewed 2 months ago"


Question: Transfer S3 bucket objects of Intelligent tiering  to another s3 bucket of diff account

"Hi,I am trying to copy all the data from bucket A to bucket B of different account . I have done by using aws cli command "aws s3 sync s3://DOC-EXAMPLE-BUCKET-SOURCE s3://DOC-EXAMPLE-BUCKET-TARGET".Then all the objects has been transferred except objects of intelligent tiering storage class.Please let me the exact process to copy that too.FollowComment"

Answer: "0Hi,You can try to provide the --storage-class option as part of you commandhttps://docs.aws.amazon.com/cli/latest/reference/s3/sync.htmlCommentShareEXPERTalatechanswered 4 months agorePost-User-2782063 4 months agoIs with that,  objects already in Intelligent tiering in source bucket also moved directly to standard in destination bucketSharealatech EXPERT4 months agoNot sure if above is a question or if it helped working as intended, can you clarify?Share0Hi THereAre the objects also in the Archive Access and Deep Archive Access tiers.  If so, you first need to initiate a restore request before you can copy them.See https://docs.aws.amazon.com/AmazonS3/latest/userguide/intelligent-tiering-managing.html#restore-data-from-int-tier-archiveCommentShareEXPERTMatt-Banswered 4 months ago"


Question: Create portable script in Powershell to list EIPs

"Create a script List EC2 Elastic IP addresses for eu-west-1 and us-west-2 regions for a given account and assign a tag 'TBA' to all of them. The output should be a confirmation of Tag update and Public IP.I'm having difficulty in the script:Get-EC2Address -AccountId 123456789$tag = New-Object Amazon.EC2.Model.Tag$tag.Key = "Name"$tag.Value = "TBA"Get-EC2Address -Filter @{Name="tag:Category";Values="Prod"}I was trying different sources, but still cant get proper commandsplease helpFollowComment"

Answer: "1Accepted AnswerThe example you provided is lacking a command New-EC2Tag to add a tag to an elastic IP allocation. Additionally, you are not using the right filter to get IPs with a tag (Name:TBA). Please see the below for a sample script. You can customize it as needed.# set regions$regions = @("eu-west-1", "us-west-2")# AWS PowerShell documentation https://docs.aws.amazon.com/powershell/latest/reference/foreach ($region in $regions) {    # https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2Address.html    # Extracting elastic IP allocation IDs    $allocationIds = Get-EC2Address -Region $region | ForEach-Object { $_.AllocationId }    # Prepare a Tag to Add    $tag = New-Object Amazon.EC2.Model.Tag     $tag.Key = "Name"     $tag.Value = "TBA"        # Tag all the elasticIPs    try {        # https://docs.aws.amazon.com/powershell/latest/reference/items/New-EC2Tag.html        # add a new tag        New-EC2Tag -Resource $allocationIds -Tag $tag    } catch {        # Failed to add a tag        Write-Error $_.ErrorDetails        throw    }    # if tagging is successful, get IPs again    Get-EC2Address -Filter @{Name="tag:Name";Values="TBA"}}CommentShareTaka_Manswered 7 months agorePost-User-1905993 7 months agothank you for your answer, really appreciate itShare"


Question: how do i fix my SMTP error on my WP site?

"My wordpress website was launched on lightsail, with DNS from Route53, i have setup my SES, and have updated my WP SMTP mail with with the right details but yet i still receive error when i try to authenticate. my website cannot send verification emails and password reset emails to subscribers.The error i received below2022-03-17 22:25:11 CLIENT -> SERVER: QUIT 2022-03-17 22:25:11 SERVER -> CLIENT: 221 Bye 2022-03-17 22:25:11 Connection: closedhow do i fix this please??FollowComment"

Answer: "0Any chance you are still in the SES Sandbox?https://docs.aws.amazon.com/ses/latest/dg/request-production-access.htmlCommentShareJohn Voldanswered a year agoAWS-User-2707455 a year agoit still is, i have requested to remove from Sandbox though. regardless i should still be able to authenticate my smtp right?Share0Here is a doc in the Lightsail documentation on how to setup WordPress in Lightsail to use SES for sending emails: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-enabling-email-on-wordpressCommentSharedonleyatawsanswered a year agoAWS-User-2707455 a year agoI have gone through and followed all the steps, but i still get an error.this is the new error  i have after trying to test my smtpSMTP ERROR: Failed to connect to server: Connection timed out (110)SMTP connect() failed. https://github.com/PHPMailer/PHPMailer/wiki/TroubleshootingShare"


Question: How to improve accuracy of speaker diarization?

"What steps can I take to improve AWS Transcribe's Speaker Diarization accuracy?Unfortunately the algorithm is not doing a great job of correctly identifying who is talking, even with a clean audio recording. Its even having trouble distinguishing between a man and a woman's voice.Much appreciated!FollowComment"

Answer: "0Other than a clean audio recording, I'd optimize the following factors:When using custom vocabularies: keep the list small, and provide IPA pronunciations if you can.When using real-time streams: two to five speakers seem best.When using an audio source: set the "Maximum number of speaker" to the actual number of speakers in the file.For sources and more information:https://aws.amazon.com/transcribe/faqs/https://docs.aws.amazon.com/transcribe/latest/dg/diarization.htmlCommentShareriyanchristyanswered a year ago"


Question: How to include a query to the API Gateway?

do I have to incude it here?Thanks in advance!FollowComment

Answer: "0The question is not clear. Can you please provide some details on what you are trying to achieve?If you are trying to test the highlighted GET method then you can click on the TEST button to test your APIIf you want to understand how to add query parameters or validate or transform the request or response payloads, there are some good tutorials I would recommend that you go through - https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-rest-tutorials.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 8 months ago"


Question: Reserve a pool of Public IP address from AWS for an account

"Is it possible to reserve a pool of public IP address from AWS for an account, are there any limits, or any points to be considered, any documentations to refer and what is the minimum block can request and the maximum, any pricing details for reserving blockFollowComment"

Answer: 0Accepted AnswerYou can request a contiguous block of Elastic IP addresses by cutting a ticket to VPC Support Ops.CommentShareAWS-User-4380583answered 3 years ago


Question: How to configure internet access for a lambda function with a properly configured NAT Gateway?

"HelloI am configuring internet access for a lambda that makes an http call to an API.Below are the steps I followed:I created a public subnet with a CIDR range of 10.0.128.0/20 with its route table containing a route to the internet gateway. NAT Gateway has been provisioned in this subnet.I created a private subnet with a CIDR range of 10.0.64.0/20. Created a route table with destination: 0.0.0.0.0/0 and target: nat gateway and attached it to the subnetTo test the NAT gateway is working, I used the reacheability analyzer in AWS Network Manager and it is reacheable (source was a linux ec2 instance created in the private subnet above and target was the internet gateway).I created a security group that allows all inbound and outbound IPv4 traffic.In Lambda function VPC Configuration, only the private subnet and security group were added.Upon adding, lambda was tested to make an API call to https://api.github.com but the lambda fails to reach the API. Logging was added to log the status call.Any assistance is highly appreciatedFunction is a simple lambda function that use HTTP Client to make an http callNAT Setup guide - https://repost.aws/knowledge-center/nat-gateway-vpc-private-subnet#Lambda internet access - https://repost.aws/knowledge-center/internet-access-lambda-functionYouTube video - https://www.youtube.com/watch?v=Z3dMhPxbuG0FollowComment"

Answer: "0Accepted AnswerThe above implementation has been re-reviewed and with logging in place and a test API call to a free API - https://jsonplaceholder.typicode.com/todos/1 I can confirm that the response status is 200 OK (Lambda is able to reach the internet).Another learning was since the NAT has a static public IP, this can be added in security groups whose resources you want the lambda function to access.High level summary of what got the NAT working for me:NAT GW was created in the public subnet.Private subnet was attached to Lambda and has a route table linking to the NAT.A security group allowing all outbound traffic on http and https port was attached to the lambda while adding the private subnet.CommentShareKyandaanswered 2 months ago0Hi, from your description above I couldn't be sure which subnet your NAT GW is in.  It's in the Public subnet, right?Your setup sounds good.  Are your NACLs open?CommentShareEXPERTskinsmananswered 2 months agoskinsman EXPERT2 months agoSomething still doesn't sound right there - your NAT GW needs a route to the Internet GW (if you're using it for internet traffic) so by definition is in a Public subnet if it's working.ShareKyanda 2 months agoKindly note that the NAT Gateway was provisioned in the public subnet which has a route table with access to the internet gateway. Sorry about the earlier comment, I might have been rushing.On a high level summary:NAT GW was created in the public subnet.Private subnet was attached to Lambda and has a route table linking to the NAT.A security group allowing all outbound traffic on http and https port was attached to the lambda while adding the private subnet.This approach got the NAT working as expectedShareKyanda 2 months agoHello SkinsmanThanks for the prompt response.The NAT is residing in the public subnet.But as per tests with a colleague today morning, we tested using this free API - https://jsonplaceholder.typicode.com/todos/1 and the response code logged was OKSeems all checks out.Share"