Question: Please recommend EC2 instance type.

"I'm a cloud student.The number of simultaneous users of the banking apps is 50 million. The average number of users is 10 million and the minimum is 9 million.I wonder how to set the instance type (CPU, Memory) at this time.Also, I wonder if there is a standard for setting this.Thank you.FollowComment"

Answer: "0Hi,There is no specific instance type you must use in this case, but with the provided info, I would look into general purposes and compute optimized instances here. https://aws.amazon.com/ec2/instance-types/, and probably start with T series or C series (2x large as minimum and then probably vertically scaling them)Also is no just about the instance type. You may think that if you buy a huge instance then you are done. Fir that load, you need to probably need to consider autoscaling group of MANY instances behind anELB load balancer ALB/NLB).Once you have this structure, build it and perform stress tests to assess its resilience and scalability.Hope it helps.CommentShareEXPERTalatechanswered 3 months ago"


Question: SES – email receiving + S3 action + encrypted S3 bucket = FAIL

"SES – email receiving + S3 action + encrypted S3 bucket = FAILhi there,Much like https://stackoverflow.com/questions/53666393/how-to-integrate-amazon-ses-with-encrypted-bucket I'm having difficulty attempting to use SES email receiving where the email is put in an S3 bucket with encryption rules and default encryption settings applied.When creating the rule I receive the following message:Unknown errorRequest failed with unknown error, ensure that you have the necessary permissions and that all fields have correct values.Server-side message: Could not write to bucket: BUCKET_NAME_HEREThought / comments appreciated given the details in the documentation are not exactly transparent on the topic.FollowComment"

Answer: "1Hello, a couple of thoughts on this topic:Firstly, check the that S3 has the correct bucket policy to allow SES to put objects, and doesn't have any denies. The stack overflow link and its corresponding amazon documents assume the correct permissions for KMS, but do not specify the proper policy for SES to upload objects (in this case emails) to S3. You can follow this link to see how to give proper permissions to S3 https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-with-s3-actions.htmlOther suggestions:a. Make sure to enforce encryption for any email being uploaded to the S3 bucket as talked about in this blog post: https://aws.amazon.com/blogs/security/how-to-prevent-uploads-of-unencrypted-objects-to-amazon-s3/b. Try following these steps when you configure Amazon SES to receive email and encrypt the email messages before saving them to your S3 bucket:Create a receipt rule for Amazon SES, specifying the S3 action, an S3 bucket for storage, and an AWS KMS key for encryption.Amazon SES receives an email message that matches your receipt rule.Amazon SES requests a unique data key encrypted with the KMS key that you specified in the applicable receipt rule.AWS KMS creates a new data key, encrypts it with the specified KMS key, and then sends the encrypted and plaintext copies of the data key to Amazon SES.Amazon SES uses the plaintext data key to encrypt the email message and then removes the plaintext data key from memory as soon as possible after use.Amazon SES puts the encrypted email message and the encrypted data key in the specified S3 bucket. The encrypted data key is stored as metadata with the encrypted email message.c. Inside your KMS key's policy, make sure you have specified the required aws:ses:rule-name and aws:ses:message-id in the EncryptionContext. More information can be found here: https://docs.aws.amazon.com/kms/latest/developerguide/services-ses.html#services-ses-permissionsCommentShareKyle_Wanswered a year agoSUPPORT ENGINEERAjinkya B-AWSreviewed 10 months ago"


Question: Receiving "An error occurred fetching your data" if the root segment has not finished

"We're using AWS X-Ray to trace our long-running processes, but we're not able to view the traces until the root segment has ended. As soon as the long-running process finishes we're able to see the entire trace with all the sub-segments included, but nothing is displayed before this, even though many sub-segments finish while the process is running. The X-Ray API doesn't return the data either, so it's not just an issue in the X-Ray console.Is this expected behaviour? If not, how would we troubleshoot this issue?FollowComment"

Answer: "0Hi Chris!Thanks for posting this issue. X-Ray the service will aggregate the data that clients (instrumented with the X-Ray SDK or OpenTelemetry) send it. X-Ray does support showing "in-progress" segments, but only if the clients actually send the traces/segments before they are closed out.You are most likely wrapping a segment around your process so that once the process finishes you are using endSegment() to close out the segment. This segment closing "flushes" the segment to the X-Ray service and that's why you would see it there.However, if you want to see it in progress, you need to periodically call sendSegment() so that the X-Ray service can display it. Only after you call that method can you retrieve the data X-Ray receives.You want to do this on the Root segment, as subsegments cannot be sent without a segment to be their parent.Hope this helps!CommentShareaws-nathanielanswered a year ago"


Question: How do I access Greengrass Core environment variables in AWS System Manager Run Command

"I have AWS systems manager managed node setup for a greengrass core device and want to run command to execute shell script. The shell script needs to access greengrass core environment variables $AWS_IOT_THING_NAME to process. However, I do not see any value returned by $AWS_IOT_THING_NAME.Is there a different mechanism to access the greengrass env variables by the AWS SSM run command?I can see that the SourceId of the node is same as the AWS_IOT_THING_NAME. Can I access it inside a shell script as environmental variable?I need to execute a script to run on multiple devices which uploads images to the s3 bucket with folder name {AWS_IOT_THING_NAME}/images. I know this can be done using custom greengrass component, but I want to try it using the AWS SSM fleet manager.FollowComment"

Answer: "0Hi,SSM Agent is not able to access Greengrass variables since it is not executed as a child process of Greengrass, but as an independent process executed by systemd, even when you deploy it via aws.greengrass.SystemManagerAgent component.What you can do is to write a component that export that variable so that it is available to the script run by the SSM Agent. One example would be to write that ThingName in a file inside /var/ or /etc/ folders, and then read it from your script before executing it. Alternatively the custom component could add an export to the .bashrc file of the SSM Agent user and execute your script in bash.Cheers,MassimilianoCommentShareEXPERTMassimilianoAWSanswered 5 months agoraghak 5 months agoHi Massimiliano,Is there a way to get the Managed node "SourceId" using the SSM run command to run a shell script?ShareMassimilianoAWS EXPERT5 months agoCould you please explain what you are trying to do?Share"


Question: Use boto3 to create buckets with ACLs enabled

"Hello.I’m creating a bucket using boto3 with:s3X = boto3.resource('s3')s3X.create_bucket(Bucket=’my_bucket_name’)This creates the bucket but it blocks all public access (and sets ACLs as disabled). I tried modifying the last line as:s3X.create_bucket(Bucket=’my_bucket_name’, ACL=’public-read-write’)However, this generates the error message:botocore.exceptions.ClientError: An error occurred (InvalidBucketAclWithObjectOwnership) when calling the CreateBucket operation: Bucket cannot have ACLs set with ObjectOwnership's BucketOwnerEnforced settingThe instance has the AWS credentials and I was expecting to be able to set up the bucket properties via boto3.FollowComment"

Answer: "1Accepted AnswerSorry, I just checked the documentation and it looks like the default setting is to deny public access.https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.htmlBy default, new buckets, access points, and objects don't allow public access.In other words, after the bucket is created, the public access settings need to be disabled and the ACLs set, so the code should look like the following.s3X.create_bucket(Bucket=’my_bucket_name’,ObjectOwnership='ObjectWriter')s3X.put_public_access_block(Bucket=bucket_name, PublicAccessBlockConfiguration={'BlockPublicAcls': False,'IgnorePublicAcls': False,'BlockPublicPolicy': False,'RestrictPublicBuckets': False})s3X.put_bucket_acl(ACL='public-read-write',Bucket=’my_bucket_name’)CommentShareEXPERTRiku_Kobayashianswered a month agoRiku_Kobayashi EXPERTa month agoYour code is trying to create an S3 bucket with "resource".As per the following documentation, "client" is used to create S3 buckets.https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3.html#clientSo the full code is as follows.import boto3s3X = boto3.client('s3')s3X.create_bucket(Bucket=’my_bucket_name’,ObjectOwnership='ObjectWriter')s3X.put_public_access_block(Bucket=bucket_name, PublicAccessBlockConfiguration={'BlockPublicAcls': False,'IgnorePublicAcls': False,'BlockPublicPolicy': False,'RestrictPublicBuckets': False})s3X.put_bucket_acl(ACL='public-read-write',Bucket=’my_bucket_name’)ShareRiku_Kobayashi EXPERTa month agoSince "resource" does not seem to have "put_public_access_block", I created a code to use "client" as well.import boto3s3X = boto3.resource('s3')s3X.create_bucket(Bucket='my-bucket-name',ObjectOwnership='ObjectWriter',CreateBucketConfiguration={'LocationConstraint': 'ap-northeast-1'})client = boto3.client('s3')client.put_public_access_block(Bucket='my-bucket-name', PublicAccessBlockConfiguration={'BlockPublicAcls': False,'IgnorePublicAcls': False,'BlockPublicPolicy': False,'RestrictPublicBuckets': False})client.put_bucket_acl(ACL='public-read-write',Bucket='my-bucket-name')ShareAWS-User-7310704 a month ago@Riku_Kobayashi: Using 'resource' is preferable when integrated into python projects (which is the case), but if resource doesn't have the put_public_access_method (and probably others), I guess that you can use 'client' or a combination of 'client' and 'resource.' Thanks.Share0Try changing the code as follows.The error occurs when ObjectOwnership is "BucketOwnerEnforced".s3X.create_bucket(Bucket=’my_bucket_name’, ACL=’public-read-write’, ObjectOwnership='ObjectWriter')BucketOwnerEnforced" is changed to "ObjectWriter" because ACLs are disabled and an error occurs when ACL settings are inserted.If this answer leads to a resolution, please approve the answer for the betterment of the community.CommentShareEXPERTRiku_Kobayashianswered a month agoAWS-User-7310704 a month agoStill generating an error message: 'botocore.exceptions.ClientError: An error occurred (InvalidBucketAclWithBlockPublicAccessError) when calling the CreateBucket operation: Bucket cannot have public ACLs set with BlockPublicAccess enabled'ShareRiku_Kobayashi EXPERTa month agoSorry, I just checked the documentation and it looks like the default setting is to deny public access.https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.htmlBy default, new buckets, access points, and objects don't allow public access.In other words, after the bucket is created, the public access settings need to be disabled and the ACLs set, so the code should look like the following.s3X.create_bucket(Bucket=’my_bucket_name’,ObjectOwnership='ObjectWriter')s3X.put_public_access_block(Bucket=bucket_name, PublicAccessBlockConfiguration={'BlockPublicAcls': False,'IgnorePublicAcls': False,'BlockPublicPolicy': False,'RestrictPublicBuckets': False})s3X.put_bucket_acl(ACL='public-read-write',Bucket=’my_bucket_name’)Share"


Question: Lean Ubuntu - can i remove snap package?

I was looking at processes running in my ubuntu. its 150+ process running. There is 20 loop process. I googled they say it connected with snap packagethen i list snapFound this====snap listName              Version     Rev    Tracking         Publisher   Notesamazon-ssm-agent  3.0.1124.0  4046   latest/stable/…  aws✓        classiccore18            20211028    2253   latest/stable    canonical✓  basecore20            20211129    1270   latest/stable    canonical✓  baselxd               4.0.8       21835  4.0/stable/…     canonical✓  -snapd             2.53.4      14295  latest/stable    canonical✓  snapdIt seems amazon process is connected. Is it safe to remove snap?===here is full list of process=== Let me know which can be killed off.  == i am new to ubuntu/lightsail so i need expert help.50% of memory used already. 1gB /2gb.let me know. I want Ubuntu run only essential processthanks much.FollowComment

Answer: "0All process with memory. Need tow eed out non essential process.USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMANDroot        1139  0.0  7.2 274288 147456 ?       Ss   Dec20   0:06 /usr/sbin/apache2 -k startwww-data   44029  0.0  6.4 275192 129780 ?       S    22:32   0:00 /usr/sbin/apache2 -k startwww-data   44026  0.0  6.4 275192 129580 ?       S    22:32   0:00 /usr/sbin/apache2 -k startwww-data   44027  0.0  6.3 275196 129376 ?       S    22:32   0:00 /usr/sbin/apache2 -k startwww-data   44360  0.0  6.3 275192 129376 ?       S    22:32   0:00 /usr/sbin/apache2 -k startwww-data   44030  0.0  6.3 275192 129352 ?       S    22:32   0:00 /usr/sbin/apache2 -k startwww-data   44028  0.0  6.3 275192 129088 ?       S    22:32   0:00 /usr/sbin/apache2 -k startwww-data   44024  0.0  6.0 194128 122872 ?       S    22:32   0:00 /usr/sbin/apache2 -k startwww-data   44025  0.0  6.0 195304 122796 ?       S    22:32   0:00 /usr/sbin/apache2 -k startmysql        731  0.1  5.5 1261168 112764 ?      Ssl  Dec20   2:51 /usr/sbin/mysqldpsaadm     11892  0.1  5.3 323308 108756 ?       S    00:35   2:12 sw-engine-fpm: pool pleskpsaadm      8668  0.1  5.2 323160 106408 ?       S    00:00   2:24 sw-engine-fpm: pool pleskpsaadm      2114  0.1  5.2 323012 105784 ?       S    Dec20   2:52 sw-engine-fpm: pool pleskpsaadm      2132  0.1  5.2 249092 105420 ?       S    Dec20   2:48 sw-engine-fpm: pool pleskroot         165  0.0  4.3 139768 87648 ?        S<s  Dec20   0:05 /lib/systemd/systemd-journaldpsaadm     40984  0.0  2.6 119644 54176 ?        S    21:56   0:00 /usr/bin/sw-engine -c /opt/psa/admin/conf/php.ini /usr/local/psa/bin/extension --exec revisium-antivirus ra_executor.phpgrafana      966  0.1  2.6 1385564 53852 ?       Ssl  Dec20   1:38 /usr/sbin/grafana-server --config=/etc/grafana/grafana.ini --pidfile=/run/grafana/grafana-server.pid --packaging=deb cfg:default.paths.logs=/var/log/grafana cfg:default.paths.data=/var/lib/grafana cfg:default.paths.plugins=/var/lib/grafana/plugins cfg:default.paths.provisioning=/etc/grafana/provisioningpsaadm     40986  0.0  2.4 115472 50176 ?        S    21:56   0:01 /usr/bin/sw-engine -c /opt/psa/admin/conf/php.ini -dauto_prepend_file=sdk.php /opt/psa/admin/plib/modules/revisium-antivirus/scripts/ra_executor.phppsaadm       975  0.0  2.1 115116 43072 ?        Ss   Dec20   0:02 /usr/bin/sw-engine -c /opt/psa/admin/conf/php.ini /opt/psa/admin/plib/WebSocket/bin/ws-server.phpbind         464  0.0  1.9 373536 39868 ?        Ssl  Dec20   0:02 /usr/sbin/named -f -t /var/named/run-root -c /etc/named.conf -u bind -n 2root         492  0.0  1.5 238596 32240 ?        Ss   Dec20   0:04 sw-engine-fpm: GM process (/etc/sw-engine/sw-engine-fpm.conf)root         488  0.0  1.4 725396 30228 ?        Ssl  Dec20   0:04 /usr/lib/snapd/snapdroot         476  0.0  1.2 134416 25728 ?        Ss   Dec20   0:04 php-fpm: GM process (/etc/php/5.6/fpm/php-fpm.conf)root        2054  0.0  1.1 1247780 22980 ?       Sl   Dec20   0:03 /snap/amazon-ssm-agent/4046/ssm-agent-workerroot         507  0.2  1.0 756724 21032 ?        Ssl  Dec20   3:03 /usr/bin/python2 /usr/bin/fail2ban-server -xf startroot         274  0.0  0.8 280220 18008 ?        SLsl Dec20   0:05 /sbin/multipathd -d -sroot         712  0.0  0.8 108356 16212 ?        Ssl  Dec20   0:00 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signalgrafana     1235  0.0  0.7 718796 15668 ?        Sl   Dec20   0:26 /var/lib/grafana/plugins/plesk-json-backend-datasource/dist/gpx_plesk-json-backend-datasource_linux_amd64root         469  0.0  0.6  29296 13532 ?        Ss   Dec20   0:00 /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggerssystemd+     409  0.0  0.6  23920 12808 ?        Ss   Dec20   0:00 /lib/systemd/systemd-resolvedroot           1  0.0  0.6 170844 12628 ?        Ss   Dec20   0:12 /sbin/initroot         495  0.0  0.5 392440 11072 ?        Ssl  Dec20   0:00 /usr/lib/udisks2/udisksdroot       45775  0.0  0.5  18236 10896 ?        Ss   22:43   0:00 sshd: ubuntu [priv]jadmin_+   46270  0.0  0.4  17264  9852 ?        SLs  23:05   0:00 proftpd: jadmin_378 - 184.65.143.85: IDLEubuntu     45778  0.0  0.4  18308  9436 ?        Ss   22:43   0:00 /lib/systemd/systemd --userjadmin_+   46450  0.0  0.4  17124  9356 ?        SLs  23:11   0:00 proftpd: jadmin_378 - 184.65.143.85: IDLEpostfix    41724  0.0  0.4  42148  9076 ?        S    22:23   0:00 tlsmgr -l -t unix -u -croot         489  0.0  0.4 673224  8936 ?        Ssl  Dec20   0:39 /usr/sbin/sw-collectd -fwww-data    4531  0.0  0.4 134752  8772 ?        S    Dec20   0:00 php-fpm: pool wwwwww-data    4532  0.0  0.4 134752  8772 ?        S    Dec20   0:00 php-fpm: pool wwwnginx      16787  0.0  0.4  18480  8608 ?        S    00:53   0:01 nginx: worker processroot         600  0.0  0.4 234376  8272 ?        Ssl  Dec20   0:00 /usr/lib/policykit-1/polkitd --no-debugsw-cp-s+   16753  0.0  0.4  12956  8144 ?        S    00:53   0:09 sw-cp-server: worker processroot         486  0.0  0.3 1235160 8080 ?        Ssl  Dec20   0:04 /snap/amazon-ssm-agent/4046/amazon-ssm-agentroot       41968  0.0  0.3  13776  7980 ?        S    22:26   0:00 dovecot/authroot         493  0.0  0.3  16724  7796 ?        Ss   Dec20   0:01 /lib/systemd/systemd-logindsystemd+     407  0.0  0.3  26752  7664 ?        Ss   Dec20   0:02 /lib/systemd/systemd-networkdroot         444  0.0  0.3 237488  7468 ?        Ssl  Dec20   0:02 /usr/lib/accountsservice/accounts-daemonroot       46449  0.0  0.3  13252  7232 ?        SLs  23:11   0:00 proftpd: connected: 184.65.143.85 (184.65.143.85:57012)root       45957  0.0  0.3  18356  7104 pts/0    S    22:43   0:00 sudo supostfix    41594  0.0  0.3 419844  6912 ?        Ssl  22:12   0:00 /usr/lib/plesk-9.0/psa-pc-remote -p inet:12768@127.0.0.1 -t 7210   -P /run/psa-pc-remote.pid -u postfix -g popuser -nroot       45958  0.0  0.3  17400  6852 pts/0    S    22:43   0:00 suroot       40979  0.0  0.3 1004972 6704 ?        Sl   21:56   0:00 plesk bin extension --exec revisium-antivirus ra_executor.phpubuntu     45856  0.0  0.3  18396  6284 ?        S    22:43   0:00 sshd: ubuntu@pts/0postfix    41640  0.0  0.3  38400  6232 ?        S    22:12   0:00 qmgr -l -t fifo -upostfix    41641  0.0  0.3  38348  6212 ?        S    22:12   0:00 pickup -l -t fifo -u -croot         965  0.0  0.3  12196  6104 ?        Ss   Dec20   0:00 sshd: /usr/sbin/sshd -D -o AuthorizedKeysCommand /usr/share/ec2-instance-connect/eic_run_authorized_keys %u %f -o AuthorizedKeysCommandUser ec2-instance-connect [listener] 0 of 10-100 startupssystemd+     330  0.0  0.2  90252  6016 ?        Ssl  Dec20   0:00 /lib/systemd/systemd-timesyncdubuntu     45933  0.0  0.2  10508  5548 pts/0    Ss   22:43   0:00 -bashubuntu     45779  0.0  0.2 175048  4840 ?        S    22:43   0:00 (sd-pam)dovecot    41967  0.0  0.2   9464  4804 ?        S    22:26   0:00 dovecot/statsroot       41517  0.0  0.2   7724  4736 ?        S    22:11   0:00 dovecot/configmessage+     453  0.0  0.2   7596  4628 ?        Ss   Dec20   0:03 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-onlyroot         196  0.0  0.2   8596  4480 ?        Ss   Dec20   0:00 /lib/systemd/systemd-udevdsyslog       482  0.0  0.2 224328  4460 ?        Ssl  Dec20   0:01 /usr/sbin/rsyslogd -n -iNONEroot       14580  0.0  0.2  38080  4248 ?        Ss   00:45   0:10 /usr/lib/postfix/sbin/GM -wroot       45959  0.0  0.2   9100  4056 pts/0    S    22:43   0:00 bashroot       46553  0.0  0.1  10784  3296 pts/0    R+   23:12   0:00 ps aux --sort -rssnginx      16788  0.0  0.1  17276  3148 ?        S    00:53   0:00 nginx: cache manager processroot       41508  0.0  0.1   4568  3016 ?        Ss   22:11   0:00 /usr/sbin/dovecot -Froot         450  0.0  0.1   8668  2952 ?        Ss   Dec20   0:00 /usr/sbin/cron -froot       41516  0.0  0.1   4532  2560 ?        S    22:11   0:00 dovecot/logroot        1049  0.0  0.1   7944  2220 ?        Ss   Dec20   0:00 /usr/sbin/xinetd -pidfile /run/xinetd.pid -stayalive -inetd_compat -inetd_ipv6daemon       498  0.0  0.1   3812  2212 ?        Ss   Dec20   0:00 /usr/sbin/atd -froot        2077  0.0  0.1   7360  2088 ttyS0    Ss+  Dec20   0:00 /sbin/agetty -o -p -- \u --keep-baud 115200,38400,9600 ttyS0 vt220root        2079  0.0  0.0   5836  1776 tty1     Ss+  Dec20   0:00 /sbin/agetty -o -p -- \u --noclear tty1 linuxroot       16786  0.0  0.0  17032   964 ?        Ss   00:53   0:00 nginx: GM process /usr/sbin/nginxroot       16752  0.0  0.0  11032   940 ?        Ss   00:53   0:00 sw-cp-server: GM process /usr/sbin/sw-cp-serverd -c /etc/sw-cp-server/configroot         445  0.0  0.0   2548   724 ?        Ss   Dec20   0:00 /usr/sbin/acpiddovecot    41515  0.0  0.0   4268   652 ?        S    22:11   0:00 dovecot/anvilpsaadm     40985  0.0  0.0   2616   608 ?        S    21:56   0:00 sh -c '/opt/psa/admin/bin/php' -dauto_prepend_file=sdk.php '/opt/psa/admin/plib/modules/revisium-antivirus/scripts/ra_executor.php' 2>&1root        1174  0.0  0.0   2496   588 ?        S    Dec20   0:00 bpfilter_umhCommentSharealexkanswered a year ago"


Question: How to define IAM::Policy in SAM template

"I am trying to configure a sam template, I can define a role and deploy, then manually go in the console and add policies which allow me to add a restapi and functions to the sam template and deploy, but I can't get the policy setting in the template so that it is all automated in one deploy.If I add a policy to the template, deploy always gives a syntax errorSyntax errors in policy. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: a3bb2efb-3920-4298-99af-a15e67f70683; Proxy: null)  I am creating lambda functions that access RDS, so I manually add AWSLambdaVPCAccessExecutionRole to get the function creation to work.I have tried- AWSLambdaVPCAccessExecutionRole  - 'AWSLambdaVPCAccessExecutionRole'  - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole  as well as individual policies- ec2:CreateNetworkInterface  - ec2:DeleteNetworkInterface  - ec2:DescribeNetworkInterface  - ec2:DetachNetworkInterface  - logs:CreateLogGroup  - logs:CreateLogStream  - logs:PutLogEvents  So far the policy section I have is  STDataAccessPolicies:      Type: AWS::IAM::Policy      Properties:        PolicyName: STDataAccess        PolicyDocument:          Version: 2021-10-17          Statement:          - Effect: Allow            Action:            # what goes here            Resource: '*'        Roles:          - !Ref STDataAccessRole  FollowComment"

Answer: "0While I still haven't found a way to create policies in the template, I did manage to find a way to deploy in one pass.You can add policy rules to the role definitionrole:Type: AWS::IAM::RoleProperties:AssumeRolePolicyDocument:...ManagedPolicyArns:arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRolearn:aws:iam::aws:policy/service-role/AWSLambdaRolearn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRoleI found this in an example setting up  lambda access to rds-mysqlCommentSharesambleranswered 2 years ago"


Question: Datazone - delete domain

"I have tried to set up DataZone and was able to login to the portal once.  Now with subsequent attempts, I get the message "You are not a registered Amazon DataZone userPlease contact an admin to be added as a user".I then tried to delete my domain to start over, and am getting"ValidationException: The following resources need to be cleaned up before deleting the current domain: 'my account number' (Type: ASSOCIATED_ACCOUNT), 'test project' (Type: PROJECT), please try again later."How do I remove a project and delete my domain without access to the portal?FollowComment"

Answer: "1hi bharden,Please try the following these steps to login:Log into your AWS account in which the Amazon DataZone domain is createdNavigate to DataZone consoleClick on the Domain URL from the List-Domains page or from the domain-details page.This should automatically log you into your data portal.Please let us know if this does not work.Additionally, for deleting the domain, please try the following steps (recommended based on the error message you are receiving)Navigate to the DataZone consoleClick on your domain name from the list page, this should navigate you to domain details pageUnder "Associated Accounts", notice the account associated to your domainSelect this account/s, click on Actions and select "Disassociate account"After disassociation has completed successfully, try deleting the domain once againThank you for your interest in DataZone.CommentShareNitya-AWSanswered 2 months agobharden 2 months agoWhen I click on the domain url to login in, I get the following message " You are not a registered Amazon DataZone userPlease contact an admin to be added as a user".When I try to disassociate my account, I get the following error message: "There was an error while disassociating 1 account. There are project(s) present in the target/associated account."I'm not sure how to delete projects if I am not able to log in to the data portal.Share"


Question: VPN Tunnel Established with Azure but cant ping in any direction

"Hello Guys,Created site-to-site connection with Azure and created 2 tunnels, both were up but not able to ping EC2 instance. My VPC id is vpc-0ace56502cd6adc42.I have added static route in VPN connection with Azure Subnet CIDR, but not sure what i missed to configure.I enabled cloudwatch to check about TunnelDataIn and TunnelDataOut, TunnelDataIn shows 24 bytes few times but TunnelDataOut is zero always.Appreciated if any help or suggestion is provided, spent almost two days but no luck.Cheers,PKrishnappanFollowComment"

Answer: 0I have resolved the issue by enabling the ICMPv4 in the firewall (File and Printer sharing(Echo Request -ICMPv4-In) Properties in the instance of AWS instance.CommentSharePKrishnappananswered 4 years ago


Question: Could AWS batch work with EKS anywhere ?

"Could AWS batch work with Amazon ECS Anywhere, Amazon EKS AnywhereIn the documentation I do not sow construction to use it like:"platformCapabilities": ["EXTERNAL"]https://docs.aws.amazon.com/batch/latest/userguide/job_definition_parameters.html#job-definition-parameters-platform-capabilitiesFollowComment"

Answer: "0Hello,I hope you're keeping well.At this current time EKS Anywhere on Batch is not supported. Reason being, the control plane in EKS Anywhere is hosted on-prem. As a result, the Kubernetes API isn't hosted on EKS service side. Given the differences [1] between EKS-A and EKS, integration with AWS Batch would be a separate feature in itself.In terms of ECS Anywhere, it isn't natively supported. However, as a workaround, you should be able to use a combination of unmanaged Batch compute environments [2] and ECS Anywhere instances to implement something similar. Unmanaged compute environments allow you to manage your own compute resources(container instances) and ECS Anywhere would allow you to register on-premise instances to an ECS Cluster. When you create an unmanaged compute environment, Batch creates an empty ECS Cluster. You can then register the on-premise instances as external instances to the ECS Cluster created by Batch. The drawbadk here is that Batch isn't able to manage the compute resources in an unmanaged compute environment, so you would need to ensure that enough compute capacity(vCpus) is made available in the ECS Cluster for the unmanaged compute environment before submitting jobs to the queue or else they will get stuck in the RUNNABLE status.References:[1]https://anywhere.eks.amazonaws.com/docs/concepts/eksafeatures/[2]https://docs.aws.amazon.com/batch/latest/userguide/compute_environments.html#unmanaged_compute_environmentsCommentShareTiarnananswered 3 months ago"


Question: Bug:  incorrect error message using update-user-pool using aws cli

I called aws cognito-idp update-user-pool using the cli with the field TemporaryPasswordValidityDays in the PasswordPolicy and UnusedAccountValidityDays the AdminCreateUserConfig.The error message was:An error occurred (InvalidParameterException) when calling the UpdateUserPool operation: Please use TemporaryPasswordValidityDays in PasswordPolicy instead of UnusedAccountValidityDaysI believe the actual error message should have been that UnusedAccountValidityDays cannot be set in AdminCreateUserConfig if TemporaryPasswordValidityDays is set in the PasswordPolicy as written here:https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminCreateUserConfigType.htmlFollowComment


Question: How to invoke a lambda function from a real time gamelift server

I have created a lambda function and a real time gamelift server. I want to invoke the lambda function using my real time gamelift server script. Is there any way to achieve that? Thank you.FollowComment

Answer: "1Accepted AnswerYou should be able to use the AWS SDK from your script to interact with other AWS services. For this you'd need to additionally set up an IAM role with appropriate permissions to interact with Lambda (or other AWS services) and assign this role to your fleet. Any game server running on this fleet can then assume the role and interact with required services.For more information, please refer: https://docs.aws.amazon.com/gamelift/latest/developerguide/gamelift-sdk-server-resources.htmlThanks!CommentShareShashankJ_AWSanswered 8 months ago"


Question: how to access/set up a model registry ?

"based on aws docs/examples (https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-version.html), one can create/register model that is generated by your training pipeline. first we need to create a model package group ( sample code below). is model registry already set up by default in our account or do we have to create it as well? can you have more than one model registry in an account.  I don't see , in the code below, where we are passing the model registry info. I am assuming , we simply create multiple training jobs and save the models in its own model group. is there a sample code/repo, where there are multiple training steps that calls same model registry with a different group name ( i can use it as a sample). also, once the model is registered, how do i set up such that, a model can be accepted or declined, before promoting. can we set this up via code , please point me to any examples.import timegroup_name = "mygroup"input_dict = { "ModelPackageGroupName" : group_name}response =  client.create_model_package_group(**input_dict)print('result :  {}'.format(response['ModelPackageGroupArn']))FollowComment"

Answer: "0Hello,Model package group and model registry are 2 different things. Model registry is already in your account but you have to create a model package group where you will have model packages (different versions of the model). see this notebook about using model registry. Your code above is basically creating a model group/model package group in model registry, and in that model group you will have the different versions of your model.I don't have an example in mind, but you can easily have a code where you create different models and add them in the model groups accordingly. Following the notebook shared above , you would just add the same code but adapt it to another model group assuming that you have to two trainings happening each with a different purpose.To summarize: model registry = N model groups and each model group = N model versions (model packages). Suppose you are doing a sentiment analysis task where you have different models per customer. You could create a Model Package Group per customer and in each group register Model Package Versions for each model created.You can automate the testing of your model before registering into the model group by for example checking the loss metric. You can use SageMaker projects for an example that includes a pipeline. Check this example. You could basically have a conditional step in your pipeline.Hope this helps and if I answered your question, please accept it.Thank youCommentShareAWS-ML-Useranswered 7 months ago"


Question: Amazon USA-WEST not accepting traffic from my ISP

as the title says:I operate AS328964 for our corporatesince 15:16 GMT+2 2023-05-05 amazon in USA-WEST has stopped accepting traffic from my ipv4 prefixipv6 prefix is being acceptedtraffic is delivered through my upstream providerall other regions and zones are accepting my prefixall my prefixes are RPKI signedWhat I have tried:email sent to amazon peering team to resolve (no feedback)upstream has opened a ticket to resolve (with no success)AWS support twitter account directed me here :/FollowComment


Question: Can I transcode H.265 MP4's to H.264 MP4's using The Amazon Elastic Transcoder?

"Hello,I need to transcode a few hundred H.265 MP4's to H.264 MP4's, and I was wondering if The Amazon Elastic Transcoder can do that. I couldn't find any documentation that specifically states that.Thanks,JonathanFollowComment"

Answer: "1according to the articlehttps://aws.amazon.com/elastictranscoder/faqs/Amazon Elastic Transcoder does not support H.265. This means that if you have media files encoded in H.265, you cannot use Elastic Transcoder to transcode them into H.264.Amazon Elastic Transcoder supports the following input formats: MP4, MOV, and MPEG-2. These formats may contain H.264, MPEG-2, or Apple ProRes codecs.but AWS Elemental MediaConvert support H.265https://docs.aws.amazon.com/mediaconvert/latest/ug/reference-codecs-containers.htmlYou can check this serviceCommentShareEXPERTsedat_salmananswered 19 days agorePost-User-2323318 18 days agoThank you for your response, but you are incorrect. I was able to successfully transcode a H.265 encoded movie into H.264 using Amazon Elastic Encoder in a test. Please spread the word.Thanks,JonathanShare"


Question: Account Sending Status shows as "disabled"

"Dear Forum Members,We received the following message from AWS support for Amazon SES:The Account Sending Status shows as "disabled", which could be the reason you are unable to send emails.You may change the account sending status on your console.Here is the document that is outlined with the information on how to change the sending status:https://docs.aws.amazon.com/ses/latest/DeveloperGuide/monitoring-sender-reputation-pausing-account.html#monitoring-sender-reputation-pausing-account-part-3 .Can anybody please point us in the direction of where we can see this 'sending status' in our console?When reading this link to change the status, it seems to be command line instructions and I don't believe that our Amazon SES account has the facility for command line instructions.Is there another way how we can change the account sending status?We use Amazon SES with Sendy:  https://sendy.co/Within Sendy, we simple set the SES region and at the same time we also set the same region within the Amazon SES console. Thereafter we can send from Sendy our newsletters.We have been able to successfully send a test email from Sendy using the region we set.Hence, we don't understand the message from Amazon support that our Account Sending Status shows as "disabled".When we asked for clarification from Amazon support on this, no further help was forthcoming.Can anybody advise us on this?Your help is very much appreciated.Kind regards,Pairfum Londonhttps://www.pairfum.comFollowComment"

Answer: "0Dear Forum Members,Since our post below, we received the following response from AWS support:I have confirmed that your account is active and able to send email in the US East (N. Virginia) region. The Account Sending Status shows as "Enabled" at this time.We suspect that it is the interaction between Sendy and AWS SES, i.e. Sendy changes the account status when a region is selected.With kind regards,Pairfum Londonhttps://www.pairfum.comCommentSharePairfum-Londonanswered 2 years ago0resolvedCommentSharePairfum-Londonanswered 2 years ago0resolvedCommentSharePairfum-Londonanswered 2 years ago"


Question: EFS - NFS Client Error while creating a directory or file: Remote I/O Error

"Hi All,I setup a DataSync environment and create a task to transfer data from EFS to EFS.I created 2 different EFS. Source EFS in us-west-1 and target EDS in us-east-1. I created 2 locations. When I started the task it gives an error. Then I tried to regenerate the same error which is coming from source site and there was a hint in the datasync document that says run the following commandsudo mount -t nfs -o nfsvers=4.1 ip-10-1-1-57.us-west-1.compute.internal:/ /efsI run the command and mounted my NFS Server. When I tried to create a directory or file it gives the below error:[root@ip-10-1-1-191 efs]# sudo mkdir test1mkdir: cannot create directory ‘test1’: Input/output error[root@ip-10-1-1-191 efs]# ls -alls: cannot access test2: Remote I/O errorls: cannot access test1: Remote I/O errortotal 4drwxrwxrwx  4 root root 6144 Aug 16 21:22 .drwxrwxrwx 19 root root  268 Aug 16 19:31 ..??????????  ? ?    ?       ?            ? test1??????????  ? ?    ?       ?            ? test2EFS - NFS Server and NFS Client are in the same region and availability zone. I do not have any problem with mounting the EFS and NFS Server.NFS SERVER COMMANDS USED on EC2 (10.1.1.57)sudo sucd /sudo yum update -ysudo yum -y install nfs-utilssudo mkdir /efssudo nano etc/exportssudo cat etc/exportsOUTPUT:/efs *(rw,sync,fsid=0)sudo service nfs startsudo mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport fs-a25576bb.efs.us-west-1.amazonaws.com:/ efssudo exportfs -rsudo showmount -eOUTPUT:Export list for ip-10-1-1-57.us-west-1.compute.internal:/efs *df -kOUTPUT:fs-a25576bb.efs.us-west-1.amazonaws.com:/ 9007199254739968       0 9007199254739968   0% /efsNFS CLIENT COMMANDS USED on EC2 (10.1.1.191)sudo sucd /sudo yum update -ysudo yum -y install nfs-utilssudo mkdir /efssudo service nfs startsudo mount -t nfs -o nfsvers=4.1 ip-10-1-1-57.us-west-1.compute.internal:/ /efsdf -kOUTPUTip-10-1-1-57.us-west-1.compute.internal:/ 9007199254739968       0 9007199254739968   0% /efs[root@ip-10-1-1-191 efs]# sudo mkdir testmkdir: cannot create directory ‘test’: Remote I/O error[root@ip-10-1-1-191 efs]# ls -alls: cannot access test: Remote I/O errortotal 4drwxrwxrwx  3 root root 6144 Aug 16 22:58 .drwxrwxrwx 19 root root  268 Aug 16 22:55 ..??????????  ? ?    ?       ?            ? testNeed an urgent helpBest Regards,Hakan KorkmazFollowComment"

Answer: 0I solved the problem. The point here is NFS Server act as a buffer. EFS and NFS Server Should be mounted to the NFS Client and then you should copy the files from EFS to NFS Server by using the NFS Client command line.CommentShareHakanKorkmazanswered 3 years ago


Question: Why creating a RDS in AWS take much longer than EC2 or kubernetes helm?

"My friend and I notice that it often take 5 to 10 minutes to create a DB in AWS RDS, while only about 1 minute for launching a new EC2, or install mysql using Helm in a Kubernetes. Does anyone help to explain this?FollowComment"

Answer: "1RDS is a managed, multi-tenant service. Creating a RDS instance is not the same as creating an EC2 instance and deploying a software package to it. There's lot of other moving parts within the service which are designed to make it easier for AWS to manage at scale (for many customers) and simultaneously make it easier for you to use because you don't have to worry about all of those moving parts.CommentShareEXPERTBrettski-AWSanswered 5 months agohai 5 months agoand those parts are hidden and not disclosed to users, right? I mean how the management part is installed, and how long does it take.ShareBrettski-AWS EXPERT5 months agoCorrect. We generally don't disclose how a service operates because that gives us the flexibility to change components to deliver a better customer experience.Share"


Question: OpenSearch SNS Destination Support for Alerting

"When I use OpenSearch v1.0 (R20211203-P2 - latest as of 1/30/22), I have the SNS Destination available to me (for alerting notifications). In v1.1 (again latest as of 1/30/22), I don't see SNS as Destination - only the usual Elasticsearch ones are available I'm confused because documentation says SNS as Destination is available if I use OpenSearch v1.1 (again to clarify, I'm not using Elasticsearch BUT OpenSearch). Any insights?FollowComment"

Answer: "0Hi there, thank you for providing your valuable feedback about the service. This issue was identified and fixed in OpenSearch v1.1. You should now be able to see SNS in the destination options. As an alternative you can also use APIs to create a SNS destination and add the SNS destination to a trigger which has had no issues. Hope this helps!CommentShareSUPPORT ENGINEERHarshith_Manswered a year agojoshkent a year agoOn managed OpenSearch v1.1 P5, we still do not have an option for SNS as an alert destination. Has this definitely been patched out or is there still some sort of lingering issue?Share"


Question: More clarity on Tags vs Topics

"According to the FAQ, Tags are labels assigned by requesters to questions, whereas Topics are curated knowledge domains.Tags are straightforward (you should follow them if you are a domain expert and want to answer new questions), but it's unclear how Topics should be used. I would appreciate more clarity in the FAQs on when a topic is added to a specific question, to be more clear on what following them means.Two main questions:What is the standard for adding a question to a Topic?Does it have to have a valid answer?If so, are answers to questions added to a Topic "verified" and 100% correct (to the time of posting of course)?Will there also be active un-tagging of questions which aren't relevant anymore?Further to this, there seem to also be some overlapping between "Topics" and "Community Groups". They seem to be the same type of "tag", but applied to users (is it applied when they subscribe to a Topic?) - and following one implies following the other, which doesn't seem to be documented.FollowComment"

Answer: "1Based on the FAQ and my personal experience with the platform, tags and topics are a way to group related questions, which:Improves "related question" search resultsMakes it easier for people to randomly explore a particular area they are interested inMakes it easier for people with domain expertise (both AWS employees and external re:Post users) to find questions that they can help answerAllows AWS to generate internal reports to answer questions like: what are the most common topics/tags? which ones go unanswered the most? On average, how long does it take before they receive an answer?Tags and Topics form a hierarchy, in which tag is the lowest-level and one or more tags map to a higher-level topic. For example, the tags Elastic File System and Elastic Block Storage both map to the topic Storage.A community has a 1:1 relationship with a topic and is simply a list of all of the re:Post users that are following a particular topic. This makes it easier to find and follow individual users that you might want to learn from, or you can follow an entire community to learn from or help contribute.CommentSharemwrbanswered a year agoSUPPORT ENGINEERMonica_Lluisreviewed a year ago1The answer to this post really says a lot between the lines.  AWS's goal here is not provide users with a better experience its to get posters to better self classify the data for supervised machine learning.  I guess they failed at classifying the old forum post using natural language processing.  So, they had to ruin the value of the open forums so they could collect better structured data.  I wish them luck because this new experience is only going to drive users away to more human usable interfaces elsewhere.CommentShareklarsonanswered a year ago"


Question: Using Lambda with python to comunicate with AWS Iot Core

"Hello, i have been reading a lot of documentation, but its taking too much time and still can't find what i need.I need to use several lamda fucntions to do different things with IoT Core.First i need to add and remove lora gateways and devices invoking the lambda function from a php (the invoking part shouldn't be a problem).Second i need to send data to the device through a lambda function.Basically how to implement AWS python SDK in lambda.the motive is that I don't want to have and EC2 instance for this and the php should have the lower load possible.FollowComment"

Answer: "0Depending in your solution, but most gateways run with the GreenGrass software from aws iot.You can run this on rpi or similar instances. And make a bridge between mqtt and device protocol.You van manage this with the api call's, but you load them with certificates and they will automatic connect and register to the iot core and subsrcribe to topics.For data communication from lambda, you can publish messages with python:https://aws.amazon.com/premiumsupport/knowledge-center/iot-core-publish-mqtt-messages-python/If you want to run a php frontend, you have two options. Either communicatie directly from php to mqtt.  Or create an api gateway with lambda's and connect your php with the rest api of the api gateway.CommentShareJacob Verhoeksanswered 5 months ago0You mean AWS python SDK or AWS IoT device sdk python  ?If its AWS Python SDK, you can use iot wireless api operations (boto3)To add/remove the lora gateway and devices, there are api operationscreate_wireless_device(),create_wireless_gateway(),delete_wireless_device(),delete_wireless_gateway()To send the data back to the lora device,send_data_to_wireless_device() - https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iotwireless.html#IoTWireless.Client.create_wireless_deviceIf you are talking about AWS IoT device sdk python, there is no api operations for iotwireless yet.CommentSharesunriseanswered 5 months ago"


Question: CaC Workshop material available ?

"Hello,I did the Compliance as Code workshop at reInforce this year and was told I could go through it again on my own but am not finding the yamls needed. I have no need for the workspace but without the files its not a very useful learning tool.Understand these are done in Immersion Days but if they're touted as educational material they should have the key resources available to the interested user.thanksFollowComment"

Answer: 0Many of our workshops are posted on GitHub and Amazon Workshops. Is this the workshop you're referring to?CommentShareRich_Banswered 10 months agontuple 10 months agoThanks for the reply @Rich_B. I'm looking for this workshop: https://catalog.us-east-1.prod.workshops.aws/workshops/aa1a9797-2f2b-4d37-a079-dbece1ad6065/en-US.Also I heard you had a new easier scripting language DSK but can't find anything on it. Would you happen to know where I can find info on that ?Share


Question: Batch: is it possible to bind-mount mounted filesystem from host into container?

I am trying to understand whether I can make follwing scenario work with aws batch volumes:I would like to use an EC2 instance that mounts a file system in fstab into /data. I would like to then use bind-mount to make this file system available in my batch container.In an interactive session on the ec2 I can do this by using docker run -v /data:/data <container-name>. I could not  find this scenario in the bind-mounts section of the docs: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/bind-mounts.htmlAll attempts I tried lead to an empty folder being exposed inside the docker container at batch runtime. Is it currently possible to use batch volumes to achieve this or do I need to mount directly inside the container?FollowComment

Answer: "0It's not completely clear what you want to do.  If your EC2 is a ECS node you can do this, it's basicly running the docker commands on your ec2 from the ECS console. But you need to connect it to ecs and run the ecs-agent.If you want to share volumes between EC2 and containers i would suggest running EFS. This is easily mapped on the ec2's and containers. And it is a persistent storage.https://aws.amazon.com/premiumsupport/knowledge-center/batch-mount-efs/CommentShareJacob Verhoeksanswered 5 months ago"


Question: Can Amazon look into Mixamo/Fuse support?

"So, I was thinking. Amazon has shown lots of pushes into gaming tech (Lumberyard, EmotionFX etc.). Mixamo and Fuse are amazing free tools for making and animating characters easily, with a lot of control. However, Adobe has neglected this, moving the Fuse team to other products and not doing anything with Mixamo, instead slowly shutting down things that cost them money (like storing characters on mixamo).There are bugs forming that won't be fixed for the foreseeable future, and I feel Amazon could bring new life into it. There are already quite a few posts asking how to use Fuse characters in Lumberyard, showing that the community wants this tool to work.Anyone agree with me? As far as I see it, Mixamo+Fuse is the only good character creation and animating tool for indie devs and small dev teams who cannot make believable animations and characters in Blender.Follow"

Answer: "0[+1] Awesome perspective! I agree that there's a particular interest in getting these tools to work with Amazon's game services — I'd love to hear more on this topic and see how we can help illuminate such areas./All — what are your thoughts on this topic? :oSharerePost-User-5738838answered 5 years ago0Cool, imaging a tutorial enables everyone can use Lumberyard+Mixamo to prototype their idea immediately (they got the animation, model asset, so the only thing left to do is coding/scripting).SharerePost-User-6460635answered 5 years ago0But there is a catch though, I really don't know what gonna happens to Mixamo in the future. Will it still be free (or affordable)? Will it still be available?SharerePost-User-6460635answered 5 years ago0Well, if Amazon buys it off Adobe (who don't seem to care about it, since they are slowly shutting down mixamo services and moved the dev team away from Fuse), it could be. Since they bought things like EmotionFX, I don't see why not (unless it is too expensive, but that way Adobe might wake up and see people want Fuse/Mixamo and start dev on it again, so a win-win)SharerePost-User-8843326answered 5 years ago0All good questions @REDACTEDUSERAnd to both points, it further enabled gamedev to make something cool, quicker.Now...how helpful would it be to have a tool that enables creation and comes with storage options for dev / prod? I can think of a few but wanted to get your perspectives on this as well!SharerePost-User-5738838answered 5 years ago0Hey @REDACTEDUSERSharerePost-User-5263425answered 5 years ago0IMHO, Mixamo has an unlimited potential: enable everyone (especially noob) create a fully motion character in a snap of a finger, it doesn't even require to install anything, just type in the search box & enter.We can use this to:*Quickly prototype idea*Quickly generate common animation*A great market place for motion capture animation - for everyone - Imagine when this become the standard in motion capture (require a lot of effort though)SharerePost-User-6460635answered 5 years ago0@REDACTEDUSERSharerePost-User-8843326answered 5 years ago0Some textures need to be edited sadly in order to get the wanted effect in Lumberyard. A root motion also has to be manually added to the animation in order to work in LumberyardSharerePost-User-8843326answered 5 years ago0+1 — awesome! Is this simply for ease of use and to save time item, or are there other obstacles in DCC tools that could hinder progress?SharerePost-User-5738838answered 5 years ago0Nice! Now I haven't dove too far into this tool—can you create your own animations from scratch within the product or does that still require work from DCC tools?SharerePost-User-5738838answered 5 years ago0Ah, noted! Thank yaz :)SharerePost-User-5738838answered 5 years ago0Interesting–wonder if a MEL or MAXscript would make this process simpler in the interim :oSharerePost-User-5738838answered 5 years ago0@REDACTEDUSERSharerePost-User-6460635answered 5 years ago0(v >.<)> /can-relate — also, since that's a one of the missing pieces for this tool, are there any scripts/plugins available to help automate this for the time being in your DCC tool of choice?SharerePost-User-5738838answered 5 years ago0@REDACTEDUSERA perfect solution (the dream :)) will be the integration of Mixamo/fuse right in Lumberyard editor. And trust me, we (as indies) are a lot to look for this explosive combo :).ThanksSharerePost-User-3140358answered 5 years ago0Thumbs up! I've been poking at our team on behalf of the community members, especially with such a large interest as this — #TheDreamWill keep this thread posted on any updates I can gather :)SharerePost-User-5738838answered 5 years ago0https://forums.awsgametech.com/t/adding-mixamo-assests/1183/5?u=lumbermixalotSharerePost-User-1289025answered 4 years ago"


Question: Can't Configure Route53 for LightSail (Wordpress Site)

"I have followed the prescribed procedure to configure Route53 to make our site live.I created a .json file with the required information:LightsailContainerServiceHostedZoneIDhosted zone IDPathToJsonFileHowever, I am stuck when trying to execute the following commend :aws route53 change-resource-record-sets --hosted-zone-id XXXXXXXXXXXXXX --change-batch file:///{User}/Downloads/Route53/change-resource-record-sets.jsonI get the same errors:Error parsing parameter '--change-batch': Unable to load paramfile file:///{User}/Downloads/Route53/change-resource-record-sets.json: [Errno 2] No such file or directory:  '/{User}/Downloads/Route53/change-resource-record-sets.json'Local Machine is MacOS. Could be just my ignorance to find the correct local path.FollowComment"

Answer: "0File location is correctFile contained HostedZoneID for LightSail Container, NOT Route53 HostedZoneIDRan command with 3 slashes '///'In all cases, exactly the same error. Is appears the CLI is not able to find/read the file.I also created a container in LightSail, but it says it is not deployed.I tried to execute a command in the CLI:aws route53 get-hosted-zone --id ZxxxxxxxxxxxxxxxxAnd got the following error:An error occurred (AccessDenied) when calling the GetHostedZone operation: User: arn:aws:sts::315206734695:assumed-role/AmazonLightsailInstanceRole/i-0a84f72f05a978510 is not authorized to access this resourceCommentShareAWS-User-2701108answered a year agoGabriel - AWS a year agoAre you running the CLI commands from your personal machine or on your Lightsail instance (the output above looks like it's the instance). Run the commands from your personal machine if you haven't already.Share0HelloHere are my assumptions for the issue:Check the file is present in that pathPlease check the path of the file.json from your system, Create file file on the sample location where you are running the command for Example:aws route53 change-resource-record-sets --hosted-zone-id ZXXXXXXXXXX --change-batch file://file.jsonor run in this way see three slashes after the **file:/// **aws route53 change-resource-record-sets --hosted-zone-id Z3L101LY62BTDZ  --change-batch file:///Users/YOURUSER/Documents/XXXX/XXX/file.jsonPlease check the HostesZone ID of the Service "HostedZoneId": "LightsailContainerServiceHostedZoneID THIS IS NOT ROUTE53 is hotedzone IDCheck the json file in more detailed way so that you will be clear: Information link { "Comment": "Creating the alias record for the domain", "Changes": [         {              "Action": "CREATE",             "ResourceRecordSet":                         {                              "Name": "lightsail.example.com.",                              "Type": "A",                             "AliasTarget": {                                 "HostedZoneId": "LightsailContainerServiceHostedZoneID",                                 "DNSName": " LightsailContainerServiceAddress.",                                 "EvaluateTargetHealth": true                                }                      }        }    ]}CommentShareGKanswered a year ago"


Question: Creating Account Alias with Cloudformation

Is there a way to use cloudformation to create or set up an aws account alias?FollowComment

Answer: "0Are you referring to the AWS Organizations account name or an IAM alias?For the AWS Organizations account name, only during creation, not during an update.CommentShareEXPERTRaphaelanswered 2 months agoTony Ennis 2 months agoWhen we create an account, it gives it a name of aws-<solution>-<client>-<env>. Our account alias for that same account is <solution>-<client>-<env>.We are trying to migrate to use cloudformation stack sets, and I am trying to find a good solution to set the IAM account alias.Share0You could create a lambda backed cloudformation custom resource that does it.CommentShareBillyanswered a month ago"


Question: ota esp32 demo code error

"cmake -DVENDOR=espressif -DBOARD=esp32_devkitc -DCOMPILER=xtensa-esp32 -G Ninja -S . -B ..\build-- Configuring done-- Generating done-- Build files have been written to: C:/gau/AWS/ESP32/freertos-1643010662146/buildcmake --build ..\buildC:\gau\AWS\ESP32\freertos-1643010662146\FreeRTOS>cmake --build ..\buildIn file included from C:/gau/AWS/ESP32/freertos-1643010662146/FreeRTOS/vendors/espressif/esp-idf/components/newlib/platform_include/time.h:22,from C:/gau/AWS/ESP32/freertos-1643010662146/FreeRTOS/libraries/3rdparty/mbedtls/include/mbedtls/platform_time.h:77,from C:/gau/AWS/ESP32/freertos-1643010662146/FreeRTOS/libraries/3rdparty/mbedtls/include/mbedtls/platform.h:68,from C:/gau/AWS/ESP32/freertos-1643010662146/FreeRTOS/libraries/abstractions/pkcs11/corePKCS11/source/portable/mbedtls/core_pkcs11_mbedtls.c:46:c:\users\rhonakam.espressif\tools\xtensa-esp32-elf\esp-2021r1-8.4.0\xtensa-esp32-elf\xtensa-esp32-elf\sys-include\time.h:303: note: this is the location of the previous definition#define CLOCK_BOOTTIME  ((clockid_t) 7)[11/1651] Building C object CMakeFiles/afr_tls.dir/vendors/espressif/esp-idf/components/mbedtls/port/esp_bignum.c.objninja: build stopped: subcommand failed.FollowComment"

Answer: 0Thank you for bringing this issue to our attention. To better help you - can you please tell me what steps you took to produce this issue?I will also need to know which demo you are building as there are two OTA demos - MQTT and HTTP based OTA.CommentShareKodyAWSanswered a year ago


Question: strange tables names in stv_tbl_perm

"Hello,I ran this queryselect name from stv_tbl_perm where temp = 1 and db_id=101618And I got the following results :271020298241:9e77a3c0-58a7-4b33-97da-85bf6241bc48@4872747@9932208@271020298241:9e77a3c0-58a7-4b33-97da-85bf6241bc48@4870525@9932568@271020298241:9e77a3c0-58a7-4b33-97da-85bf6241bc48@29321685@9570081@271020298241:9e77a3c0-58a7-4b33-97da-85bf6241bc48@29323365@9570716@271020298241:9e77a3c0-58a7-4b33-97da-85bf6241bc48@29324913@9571277@271020298241:9e77a3c0-58a7-4b33-97da-85bf6241bc48@26377403@8951653@271020298241:9e77a3c0-58a7-4b33-97da-85bf6241bc48@29323903@9571016@271020298241:9e77a3c0-58a7-4b33-97da-85bf6241bc48@25415007@8951653@271020298241:9e77a3c0-58a7-4b33-97da-85bf6241bc48@29326447@9571976@271020298241:9e77a3c0-58a7-4b33-97da-85bf6241bc48@29309803@9877604@These table names are not familiar to me, what do they mean?They are temp table created by users?, they are temp tables created by redshift?this format  number:text@number@number@ means something?FollowComment"

Answer: 0those are user temporary tables and NOT created by Redshift. system created table during query processing should show up in STV_TBL_TRANSCommentShareMilindOkeanswered a year agoEXPERTFabrizio@AWSreviewed a year ago


Question: Security Hub: cross-account access warning for SSO and OIDC

"I followed the article about how to setup OICD for IAM:https://aws.amazon.com/blogs/apn/using-bitbucket-pipelines-and-openid-connect-to-deploy-to-amazon-s3/https://support.atlassian.com/bitbucket-cloud/docs/deploy-on-aws-using-bitbucket-pipelines-openid-connect/Works like a charm, however Security Hub now reports a cross-account access violation.Same happens when I setup a SSO group in our organisation, attach one of the predefined roles and attach it to the account.What am I missing here? Do I need to manually modify these permissions?In the case of the SSO am actually not sure how, as the group is intended to provide access to multiple accounts.FollowComment"

Answer: "1Hi, Thank you for reaching out.Most likely you are getting these SecurityHub findings from IAM Access Analyzer. If that's true than in my view it sounds like the zone of trust of IAM Access Analyzer is within the account not the organization. You may know this but below is short description on how IAM Access Analyzer analyse policies:Access Analyzer does not examine access logs to determine whether an external entity accessed a resource within your zone of trust. It generates a finding when a resource-based policy allows access to a resource, even if the resource was not accessed by the external entity. Access Analyzer also does not consider the state of any external accounts when making its determination. That is, if it indicates that account 11112222333 can access your S3 bucket, it knows nothing about the state of users, roles, service control policies (SCP), and other relevant configurations in that account. This is for customer privacy – Access Analyzer doesn't consider who owns the other account. It is also for security – if the account is not owned by the Access Analyzer customer, it is still important to know that an external entity could gain access to their resources even if there are currently no principals in the account that could access the resources.SourceIf SSO and OIDC roles are shared within the same organization then recreating IAM Access Analyzer zone of trust might help here to expand the trust boundary from an account to an organizational view. Below is a how-to document on the same, effectively remove the account level analyzer and create a organization wide analyzer from the delegated admin account (organization admin account):https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.htmlHTHCommentShareAdeshGanswered a year agoGeorg a year agoThis is awesome! I'll give it a go!ShareGeorg a year agoI also got this recommendation in a different forum:archive AWS SSO roles automatically so things like this aren't flagged:  MyAnalyzer:    Type: AWS::AccessAnalyzer::Analyzer    Properties:      Type: ORGANIZATION      AnalyzerName: my-analyzer      ArchiveRules:        - RuleName: ArchiveSSORoles          Filter:            - Eq:                - 'false'              Property: isPublic            - Contains:                - aws-reserved/sso.amazonaws.com/AWSReservedSSO              Property: resourceShare"


Question: aws iot device certificates expired

"Dear,https://aws.amazon.com/tw/blogs/iot/setting-up-just-in-time-provisioning-with-aws-iot-core/i have some devices using the method above to provision the certificate. but their certificates expired.It is very hard to update the certificates in the device.So, my question is : how can the devices connect to the AWS IOT Core as before?Thanks.FollowComment"

Answer: "1At AWS security is always job zero. Please also take a look at Security best practices in AWS IoT Core which explains also why security is important.Imagine you would allow your devices to connect without authentication/authorization then everyone could use your IoT endpoint.You can use custom authentication in AWS IoT Core to build your own authentication logic.You can also setup your own MQTT broker, for example on EC2 which meets your security requirements.Cheers,PhilippCommentSharePhilipp Sanswered 6 months ago0Yeah, that's a problem.  I don't know of a way to let it connect using an expired certificate.What you have to do is generate the certificate with a very, very long expiration.  I generally have IoT Core generate my device certificates, so I looked to see what it made:        Validity            Not Before: Mar  2 21:24:37 2022 GMT            Not After : Dec 31 23:59:59 2049 GMTso it generated a cert good for 27 years, not quite sure why that number but ok.  This Dec 2049 date was confirmed by someone on stack overflow as well.If your device can't generate a new certificate before it expires, then I think your only choice is to install certs with a very long expiration, whether you generate them with openssl or not.CommentSharewz2banswered 7 months ago0From a security perspective you should never use long lived certificates. A certificate lifetime should not go beyond 2 or 3 years. When you rotate your certificates/keys regularly you can make sure that you are always use the latest and most secure algorithms.You can use AWS IoT Device Defenders device certificate expiring audit to get a notification about certificates that will expire soon. You can then take automated actions to rotate your certificate.You can find an example architecture in the AWS IoT Jumpstart.You can also try to open a support ticket with AWS IoT.Cheers,PhilippCommentSharePhilipp Sanswered 7 months ago0Yes, Thanks all the answers.I realize my situation now. But i think the design of the AWS IOT should consider both security and simplicity.Now, the design is only consider the security. The implementation is so complex. I need lots of codes on it. and i need change a lot of code in order to comply this security rules.But my device is cheap and it is no sense to implement such complicated code.I really don't care if the device is secure or not.Why can't i use AWS IOT in simple way?  Why can't i config it without security?CommentSharerePost-User-4080439answered 7 months ago"


Question: Lambda Upload a .zip File not working

"When clicking "Upload a .zip file" on the lambda page, it seems that it opens up a frozen window where I can't navigate around and I am forced to exit. Is anyone else having issues with that feature right now? I've tried on Safari and Chrome.FollowCommentIyerBala a year agoWhats the size of the zip file?Share"

Answer: "0Hello,Tim here with the Serverless Support Team, just came across your post where you’re uploading a zip via the web console (lambda page) and it’s freezing up.Good call trying on different browsers, that would be what I would recommend first.I’m curious if the upload is just taking a long time due to the deployment package size, that may be the case. Since you’ve tested multiple browsers, it would seem as if the issue isn’t browser specific but perhaps a part of the process of uploading the zip file.I’d recommend creating a HAR capture and inspecting the HTTP traffic during the upload via the steps here: https://aws.amazon.com/premiumsupport/knowledge-center/support-case-browser-har-file/You can then submit the HAR capture to us via opening a support case, but perhaps looking at the HTTP traffic would be enough to see if the upload is the cause and needs additional time.If you’re exiting the browser under 5 minutes, I’d say give it at least 15 minutes and see if the upload finishes (on a high-speed connection it shouldn’t take too long, but hard to say without knowing your internet speed) and the browser unfreezes. If it works, I’d venture to say that it’s just the upload process taking a long while and making your browser slow down. Else if it takes longer then 15 minutes, I think opening a case with us with the HAR capture should be the next step. You can open a case with us: https://docs.aws.amazon.com/awssupport/latest/user/case-management.html#creating-a-support-caseCommentShareSUPPORT ENGINEERTim_Panswered a year ago"


Question: Always-on Fleet Costing

"I have been unable to get any answers in how to model the rough user-cost for my deployment.I want an always-on fleet but am not clear what control I have over this.I want to delivery a peak usage of 500 users - but this will be very infrequent. The actual usage will probably be within a 8-10 hour window each day with the peak between 09:00-17:00 and very few users (less than 50) outside of these hours.Is it possible to use a combination of AWS-CLI and the Fleet scaling to control these and reduce costs?e.g. at 06:00 each day 100 instances spin up to support initial users and the fleet scaling options automatically add additional instances up to a maximum of 500 through the day. The fleet scaling also reduces down the number of 'on instances' based on active users, until 22:00 when all instances are shut-down (but still available to spin-up 'on demand' if requested?).This would mean that the cost-per user would be based on a combination of 'on-time' and 'off-time' throughout the day rather than cost for 500 users 'always on'.Can any one explain if this is possible/reasonable or how the costing works in practice?FollowComment"

Answer: "0You can find pretty much all you should need to know about scaling to your requirements on this web page:https://aws.amazon.com/blogs/compute/scaling-your-desktop-application-streams-with-amazon-appstream-2-0/It includes a tutorial for using the auto scaling as well as writing your Lambda function to scale based on time of day.CommentSharecougarcadanswered 4 years ago0Hi GrahamMacrae,There are two types of fleets in AppStream 2.0, Always-On and On-Demand.With Always-On fleets, all instances that are running are charged the applicable running instance fee, based on the instance type and size, even when users aren't connected.With On-Demand fleets, instances are charged the applicable running instance fee, based on the instance type and size, only when the instances are used for streaming sessions. Instances in On-Demand fleets that are not being used for streaming sessions are charged a small hourly stopped instance fee that is the same for all instance types and sizes.Another cost you will want to consider is User RDS SAL fees. For more information on pricing, please see: https://aws.amazon.com/appstream2/pricing/So controlling the costs by scaling your fleet can be done a few ways. Time based scaling is able to be accomplished via the AWS CLI, Link: https://docs.aws.amazon.com/appstream2/latest/developerguide/autoscaling.html#autoscaling-cliThis can be used with other scaling methods such as Available Capacity or Capacity Utilization to ensure that the number of available instances stays inline with the number of active users you have throughout the day.Regards,NateCommentShareAWS-User-0227918answered 4 years ago"


Question: Unable to delete KMS customer-managed key (CMK) using `AdministratorAccess` Role or root login credentials

"A user in one of our accounts accidentally created a KMS managed key with an incorrect policy. Neither the assumed role AdministratorAccess nor the root account can delete this key, nor update the policy to enable key deletion.Using AWS CLI:➜ aws --region us-east-1 kms schedule-key-deletion --key-id <REDACTED> --pending-window-in-days 7An error occurred (AccessDeniedException) when calling the ScheduleKeyDeletion operation: User: arn:aws:sts::<REDACTED>:assumed-role/AdministratorAccess/<REDACTED> is not authorized to perform: kms:ScheduleKeyDeletion on resource: arn:aws:kms:us-east-1:<REDACTED>:key/<REDACTED> because no resource-based policy allows the kms:ScheduleKeyDeletion action➜ aws --region us-east-1 kms put-key-policy --policy-name default --policy file://key_policy.json --key-id <REDACTED> An error occurred (AccessDeniedException) when calling the PutKeyPolicy operation: User: arn:aws:sts::<REDACTED>:assumed-role/AdministratorAccess/<REDACTED> is not authorized to perform: kms:PutKeyPolicy on resource: arn:aws:kms:us-east-1:<REDACTED>:key/<REDACTED> because no resource-based policy allows the kms:PutKeyPolicy actionAn error occurred (AccessDeniedException) when calling the PutKeyPolicy operation: User: arn:aws:sts::<REDACTED>:assumed-role/AdministratorAccess/<REDACTED> is not authorized to perform: kms:PutKeyPolicy on resource: arn:aws:kms:us-east-1:<REDACTED>:key/<REDACTED> because no resource-based policy allows the kms:PutKeyPolicy actionAs root on the web console, I get root is not authorized to perform: kms:DescribeKey on resource and am unable to view details, or change the deletion schedule (which never succeeds). If I try to issue a new key deletion request using the console, I get Select only keys that aren't already scheduled for deletion.FollowComment"

Answer: "1Hi there! I would recommend to contact AWS Support. From KMS documentation:...suppose you create a key policy that gives only one user access to the KMS key. If you then delete that user, the key becomes unmanageable and you must contact AWS Support to regain access to the KMS key.CommentSharekunztanswered a year agoCiaran a year agoThanks, that's what I expected. I guess we'll have to add paid support to that account.Share0Hi!It sounds like the key policy is locking you out and you will have to contact AWS Support.  A AWS KMS key policy does not automatically give permission to the account or any of its users, unlike other resource policies (S3 Bucket Policy).  Thus, AdministratorAccess on an IAM Entity without a proper KMS Key policy won't work.For KMS Keys, the Key Policy must allow access to administer the KMS Key.  If you are unable to edit the policy, then you will need AWS Support to help you with cleaning up the Key.https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.htmlCheck out this AWS Guide on the "Default Key Policy" and how to reduce the risk of a key becoming unmanageable (which is what you have pointed out above): https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.htmlCommentSharejsoncanswered a year ago0If access to the specific key is completely inaccessible AWS does have a method to recover access if you submit a support ticket. They do make extra steps to make sure this method is not used to circumvent security.Each case may be different but general steps are as follows; however, you will get specific detailed instructions in the ticket.Create an IAM user which a specific name including the KMS Key ID to be recovered and has the IAM policy provided in the ticketThe ticket will provide you with a one time code which AWS will contact by phone at the number on the account owning the keyAWS internal team will verify key is inaccessible and if confirmed will recover access to the provided IAM userAfter AWS has recovered the key you can then use the IAM user to either make necessary changes to the key.CommentShareJeremyanswered a year ago"


Question: SPF record for mail server IP not seeming to work

"We have a double SPF record (it's double now, it was a single entry before). One line is for a commercial service and the other is for an IP that sends to us as well. The entry is set as TXT and is laid out like this:"v=spf1 include:spf.mandrillapp.com ?all""v=spf1 ip4:000.000.00.000 -all"I have obscured the IP but otherwise that is what is there. We started having rejections of email sent to email aliases for our domain two days ago, so we added the second line about 24 hours ago.We do registration through Godaddy and use Route 53 for management.FollowComment"

Answer: 0This is no longer an issue for us.CommentShareimarsman_xmlteamanswered 3 years ago


Question: Issue with linking an instance name with a dot (like aws.com) to s3 error

"Hi everyone,It's my first time posting here.My problem is that I am trying to assign an instance to an S3 bucket in the the Lightsail dashboard and I'm always getting a"Sorry, resource name is invalid" message. I've figured out that it's because the instance name has a dot/period.I tried it again to another instance with a dot, same thing.Lastly, I tried an instance name with only alpha chars in it and it worked.This is the screenshot.https://pasteboard.co/KiSA4rK.pngI can simply create an instance with a different name to make it work, but it shouldn't have allowed me to put invalid charactersin the first place. Is this a known issue? Thanks in advance.FollowComment"

Answer: "0Thanks for reaching out. We have identified a bug in our service. We're working to prioritize the issue and will have a fix out soon. When the fix is out, we will update this thread accordingly.CommentShareAWS-User-2776000answered 2 years ago0Awesome! thanks for letting us know you're going to fix it.CommentSharetheBeginner101answered 2 years ago0Hello,We pushed out a fix for the issue and verified that you can attach instances with a '.' in their name to buckets now.Thank you for informing us of the issue, and please let us know if you encounter further issues.CommentShareAWS-Andyanswered 2 years ago"


Question: RDS restore native backup and lazy loading from S3

"On RDS for SQL Server, I understand that restores from EBS snapshots use lazy loading when downloading data from S3.If I restore a native backup file (.bak) from S3, will this use the same lazy loading as with snapshots or is all the data available on the instance once the restore is completed?Is lazy loading a feature of snapshot restores only?FollowComment"

Answer: "1Hello,If you access data that hasn't been loaded yet, the DB instance immediately downloads the requested data from Amazon S3, and then continues loading the rest of the data in the background.On tables to which you require quick access, you can perform operations that involve full-table scans, such as SELECT * . This will allow Amazon RDS to download all of the backed-up table data from S3.Further more, all data is lazy loaded to the DB instance when you restore from a snapshot, the key difference is when you need quick access to the data that hasn't been loaded to the DB instance yet. In this situation, the DB instance will pull the data needed from S3 and make it available instantly without lazy loading.Additional information about Restoring a DB Snapshot can be found in this AWS Documentation.I'd also advise you to check the Limitations and recommendations for importing backup files from Amazon S3 to Amazon RDS.And one of them states that,Importing from Amazon S3 is not supported on the db.t2.micro DB instance class. However, you can restore to a different DB instance class, and change the DB instance class later.I hope this helps.CommentShareLungaanswered a year ago0Dear Customer,Thanks for reaching out to AWS re:Post.Adding on to the previous answer, I would also like to add that restores of .bak files from s3 for RDS SQL Server do not cause lazy loading as a snapshot restore in RDS.Hope this helps with your project - Thank You!CommentShareEXPERTNIRUPAM_danswered a year ago"


Question: Block Device Mappings

"AMI contains Block Device Mappings information in addition to EBS snapshot and authorization details. Block device mappings, as I understand basically has mapping to block devices (EBS for example) that will be attached to instance upon start up.My question is - EBS volumes cannot be attached to more than one instance. If I use AMI to launch more than one instance, how does block device mappings help?FollowComment"

Answer: "0The advantage of launching an instance from an AMI is that besides mapping to EBS's, the OS and subnet are also mapped.By using AMI, you can easily create the same server on EC2.For more details, please check here.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.htmlYou can also use shared AMIs orhttps://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/sharing-amis.htmlThere are also AMIs available for a fee.https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/paid-amis.htmlCommentShareTTTT1234answered 4 months ago0BlockDeviceMappings, can be a property of the AMI. Examples are definition for the boot volume. You can also specify BlockDeviceMappings in the run-instances api call. Let's say you want to launch a ec2 instance with a multiple EBS volumes. You can specify this BlockDeviceMappings in the run-instances call rather than mapped in the AMI itself.CommentShareMODERATORphilawsanswered 4 months ago"


Question: AWS SES HTTPS custom domain click link-invalid cert

"i wan to use HTTPS custom redirect domain for click link. i follow this aws documentstep 1 and 2, created, verify and setup configuration set for subdomain [link.mydomain.com] in SES-Region Virginia.step 3, create new distribution, other than main distribution that specific for web. origin: [mydomain.com], alternate: [link.mydomain.com]step 4, in NS1 DNS add record [link.mydomain.com] IN ALIAS [r.us-east-1.awstrack.me]step 5, add [link.domain.com] IN CNAME [distribution_name]step 6, request and use certificate in ACM to used in distributionwhen trying click the link in email, browser blocked the access NET::ERR_CERT_COMMON_NAME_INVALIDhttps://link.blessingtransportbromoijen.com/CL0/https:%2F%2Fwww.trustpilot.com%2Freview%2Fblessingtransportbromoijen.com/1/010001874d4ac313-2b8d5d6f-2fc5-417c-8dc0-f12de35c3fd7-000000/5x8QxG3VmqQLXsAJui8PWmlvtDt8jk3S4_zoa2BmlO8=295do i missed some steps or have wrong configurations?need some help to solve this problem.FollowComment"

Answer: "0NET::ERR_CERT_COMMON_NAME_INVALID, suggests there is an issue with the SSL certificate for your custom domainPlease check the followingEnsure that the SSL certificate you have requested in ACM includes the custom subdomain link.mydomain.com. The certificate should be either a wildcard certificate for *.mydomain.com or a certificate that specifically lists link.mydomain.com as one of the domain namesDouble-check that you have selected the correct ACM certificate in the CloudFront distribution settings for the custom domainEnsure that the DNS records are properly set up:Verify that the CNAME record for link.mydomain.com points to the CloudFront distribution domain name (e.g., d12345abcdwq.cloudfront.net).Verify that the ALIAS record for link.mydomain.com points to r.us-east-1.awstrack.me.CommentShareEXPERTsedat_salmananswered 2 months agoAlfan 2 months agoACM already issued SSL cert for *.mydomain.comThe cloudfront distributions already used the SSL cert above.CNAME and ALIAS already properly set up to each names and vales.NET::ERR_CERT_COMMON_NAME_INVALID still existShare0with my current configuration for HTTPS custom link (HSTS subdomain preload enable):Cloudfront, link.mydomain as alias for dxxx.cloudfront.net origin www.mydomainSES, custom domain link e.link.mydomainNS1 Dns,link.mydomain in CNAME r.us-east-1.awstrack.mee.link.mydomain in CNAME dxxx.cloudfront.netnow i got ERR_SSL_VERSION_OR_CIPHER_MISMATCHwhether SSL by ACM not valid to used for custom domain click link tracking?no idea to solved this problem.CommentShareAlfananswered 2 months ago"


Question: Help with Quicksight Calculated Field for Timeseries aggregate Values

"Imagine if we have a time series values like this, lets say the timestamps are in epoch and device is emitting a payload every minute.timestampdevicesensorNamesensorValue1612828800001device1modeRunning1612828800001device1fuelUsed231612828800011device1modeRunning1612828800011device1fuelUsed331612828800021device1modeRunning1612828800021device1fuelUsed501612828800002device1modeNot Running1612823800002device1fuelUsed451612828800002device2modeRunning1612823800002device2fuelUsed77And we would like to know what was the TotalfuelUsed in the last 30 days when the mode was Running (mode Not Running means engine is on but not moving = idle). We tried using calculated field and periodToDateAvg function but somehow it is just not possible to do this complex query in one or multiple calculationsCalculated Field 1: ProductiveProductive time = sum(periodToDateAvg({sensorName} = 'mode' and {sensorValue} = 'Running', Month )) <<<---- Need help hereCalculated Field 1: TotalFuelUsedDuringProductiveTotalFuelUsedDuringProductive = TotalFuelUsed/ProductiveExpected Outputdevice1 TotalFuelUsedDuringProductive = (50-23)/(3-2)Is this even possible to do in Quicksight? or do we have to use Athena SQL Query?FollowComment"


Question: Convert log fields into table columns with aws cloudwatch log insights

"i've a lambda function and i want to have a cloudwatch logs table with errors and warnings columns.Actually I was able with this query to get an error / warnings report per day:parse "[E*]" as @error| parse "[W*]" as @warning| filter ispresent(@warning) or ispresent(@error)| stats count(@error) as error, count(@warning) as warning by bin(15m)Here are two example messages of the lambda:WARNING:Field           Value@ingestionTime  1653987507053@log    XXXXXXX:/aws/lambda/lambda-name@logStream 2022/05/31/[$LATEST]059106a15343448486b43f8b1168ec64@message    2022-05-31T08:58:18.293Z b1266ad9-95aa-4c4e-9416-e86409f6455e WARN error catched and errorHandler configured, handling the error: Error: Error while executing handler: TypeError: Cannot read property 'replace' of undefined@requestId  b1266ad9-95aa-4c4e-9416-e86409f6455e@timestamp  1653987498296ERROR:Field           Value@ingestionTime  1653917638480@log    XXXXXXXX:/aws/lambda/lambda-name@logStream 2022/05/30/[$LATEST]bf8ba722ecd442dbafeaeeb3e7251024@message    2022-05-30T13:33:57.406Z 8b5ec77c-fb30-4eb3-bd38-04a10abae403 ERROR Invoke Error {"errorType":"Error","errorMessage":"Error while executing configured error handler: Error: No body found in handler event","stack":["Error: Error while executing configured error handler: Error: No body found in handler event"," at Runtime.<anonymous> (/var/task/index.js:3180:15)"]}@requestId  8b5ec77c-fb30-4eb3-bd38-04a10abae403@timestamp  1653917637407errorMessage    Error while executing configured error handler: Error: No body found in handler eventerrorType   Errorstack.0 Error: Error while executing configured error handler: Error: No body found in handler eventstack.1 at Runtime.<anonymous> (/var/task/index.js:3180:15)Can you help me understand how to set up the query in order to have a table with the following columns and their values: from @message extract timestamp, requestID, type (WARN or ERROR), errorMessage and if feasible also the name of the lambda from @log and the @logStream.Can you help me understand how such a query is produced?FollowComment"

Answer: "0It seems that not work correctly (does not correctly recognize the type). If i remove the filter for the type, I receive poorly paginated results and I don't understand why:@message2022-06-07T08:01:26.897Z 65985471-edd9-44ba-99f8-8e9f0a5d4fa6 INFO saving evse statuses to database...the type info is in the third place but the query (removing the filter on error and warn) put as type "statuses" and as info "to database..."CommentSharerePost-User-7503870answered a year agoAWS-SA a year agoI may well have the parse wrong since I didn't have your data to work with. Check the pattern for your log events and modify accordingly. (What did the event look like that gave you the info noted above for the type and info fields?)Once you get the right data in the parse field though, I think this should work.Share0If you fields always have these two formats, then you can extract the type (ERROR or WARN) as the third space separated field. I used this and rewrote your first query to show you an alternative way of doing this that keeps the type in a single column, and how you can still use this to create multiple series for a time chart (always useful to know some more tricks! )parse @message "* * * *" as time, request, type, info| filter type in ["ERROR", "WARN"]| stats count(type="ERROR") as error,  count(type="WARN") as warning by bin(15m)You asked to see w table with columns of time, requestID, type, error message, log, logstreamBasing this off the above query we can get all of this (apart from the error message) using the following:parse @message "* * * *" as time, request, type, info| filter type in ["ERROR", "WARN"]| display @timestamp, @requestId, type, @log, @logstreamThe last part is getting the error message. You have two formats of messages here, so we will need two capture patterns. I'm assuming your JSON event is ingested with the JSON fields extracted and you therefore have a field called errorMessage.The trick here is to use coalesce to get a JSON error message if it exists, and if not, take the info field from the first format of your events. You can then add this new field into the display command.parse @message "* * * *" as time, request, type, info| filter type in ["ERROR", "WARN"]| fields coalesce(errorMessage, info) as msg| display @timestamp, @requestId, type, msg @log, @logstreamIf you want to see more on the Logs Insights syntax see https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html.A Quick note on field names. Field names don't have to start with @. In fact it is better not to. The CloudWatch discovered fields do start with @, and it will help you distinguish between them and those you create. The exception to this is discovered fields from JSON do not start with @. You can read more at https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData-discoverable-fields.html.CommentShareAWS-SAanswered a year ago"


Question: TLSv1.3TLS_AES_128_GCM_SHA256 Error

"I created cloudfront for nginx web server. When I access cloudfront, it will show 502 ERRORThe request could not be satisfied. Besides, I found the the log show TLSv1.2 TLS_AES_128_GCM_SHA256 Error. I cannot enable TLS 1.3 in nginx server.  Can I only enable TLS 1.2 but not TLS 1.3 in cloudfront?FollowComment"

Answer: "0Hello,I don't think your nginx is the problem, we have the same error, we have enabled TLSv1.3 support in apache, however it continues with the same problem "502" detail:Debug Server apache SSL:TLS 1.2xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 256 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384xc028 ECDHE-RSA-AES256-SHA384 ECDH 256 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384xc014 ECDHE-RSA-AES256-SHA ECDH 256 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAx9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256x6b DHE-RSA-AES256-SHA256 DH 2048 AES 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256x39 DHE-RSA-AES256-SHA DH 2048 AES 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHAx9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHAxc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 256 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256xc027 ECDHE-RSA-AES128-SHA256 ECDH 256 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256xc013 ECDHE-RSA-AES128-SHA ECDH 256 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAx9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256x67 DHE-RSA-AES128-SHA256 DH 2048 AES 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256x33 DHE-RSA-AES128-SHA DH 2048 AES 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHAx9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHATLS 1.3x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256Debug Services A-LoadBalancer:TLS 1xc014   ECDHE-RSA-AES256-SHA              ECDH 256   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAx35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHAxc013   ECDHE-RSA-AES128-SHA              ECDH 256   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAx2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHATLS 1.1xc014   ECDHE-RSA-AES256-SHA              ECDH 256   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAx35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHAxc013   ECDHE-RSA-AES128-SHA              ECDH 256   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAx2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHATLS 1.2xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 256   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384xc028   ECDHE-RSA-AES256-SHA384           ECDH 256   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384xc014   ECDHE-RSA-AES256-SHA              ECDH 256   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAx9d     AES256-GCM-SHA384                 RSA        AESGCM      256      TLS_RSA_WITH_AES_256_GCM_SHA384x3d     AES256-SHA256                     RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA256x35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHAxc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 256   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256xc027   ECDHE-RSA-AES128-SHA256           ECDH 256   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256xc013   ECDHE-RSA-AES128-SHA              ECDH 256   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAx9c     AES128-GCM-SHA256                 RSA        AESGCM      128      TLS_RSA_WITH_AES_128_GCM_SHA256x3c     AES128-SHA256                     RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA256x2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHATLS 1.3Debug Service CloudFront SSL:TLS 1xc014   ECDHE-RSA-AES256-SHA              ECDH 256   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAx35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHAxc013   ECDHE-RSA-AES128-SHA              ECDH 256   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAx2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHAx0a     DES-CBC3-SHA                      RSA        3DES        168      TLS_RSA_WITH_3DES_EDE_CBC_SHATLS 1.1xc014   ECDHE-RSA-AES256-SHA              ECDH 256   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAx35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHAxc013   ECDHE-RSA-AES128-SHA              ECDH 256   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAx2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHAx0a     DES-CBC3-SHA                      RSA        3DES        168      TLS_RSA_WITH_3DES_EDE_CBC_SHATLS 1.2xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 256   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384xc028   ECDHE-RSA-AES256-SHA384           ECDH 256   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384xc014   ECDHE-RSA-AES256-SHA              ECDH 256   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAxcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256x9d     AES256-GCM-SHA384                 RSA        AESGCM      256      TLS_RSA_WITH_AES_256_GCM_SHA384x35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHAxc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 256   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256xc027   ECDHE-RSA-AES128-SHA256           ECDH 256   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256xc013   ECDHE-RSA-AES128-SHA              ECDH 256   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAx9c     AES128-GCM-SHA256                 RSA        AESGCM      128      TLS_RSA_WITH_AES_128_GCM_SHA256x3c     AES128-SHA256                     RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA256x2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHAx0a     DES-CBC3-SHA                      RSA        3DES        168      TLS_RSA_WITH_3DES_EDE_CBC_SHATLS 1.3x1302   TLS_AES_256_GCM_SHA384            ECDH 253   AESGCM      256      TLS_AES_256_GCM_SHA384x1303   TLS_CHACHA20_POLY1305_SHA256      ECDH 253   ChaCha20    256      TLS_CHACHA20_POLY1305_SHA256x1301   TLS_AES_128_GCM_SHA256            ECDH 253   AESGCM      128      TLS_AES_128_GCM_SHA256We think we should enable TLSv1.3 on the Elastic Load Balancer, but we know how to do it.CommentSharerobertoslanswered 2 years ago"


Question: Enabling CORS policy for public S3 object delivered through CloudFront

"I have an S3 object that should be publicly accessible but only from specified domains. The object is accessed through a CloudFront custom url.I have tried the below steps:Set S3 bucket permission to PublicSet 'Origin request policy name' = 'Managed-CORS-S3Origin behavior' in CloudFront distribution according to this post on aws knowledge center so CloudFront passes originAdded CORS policy to S3 bucket as below. https://www.example.com replaced with domain I want to provide access to.[    {        "AllowedHeaders": [            "*"        ],        "AllowedMethods": [            "GET"        ],        "AllowedOrigins": [            "https://www.example.com"        ],        "ExposeHeaders": [            "Access-Control-Allow-Origin"        ]    }]While I am able to access the object from specified domain, I am also able to access it from domains NOT specified under AllowedOrigins in the CORS policy.Looking for some direction on how best to fix this so access is restricted to specified domains only.Thanks!FollowComment"

Answer: "0You need to BLOCK Public permission on the bucket, otherwise everyone from everywhere can access itCommentShareGerman Rizoanswered a month ago"