Question: AWS connect create a task  from API

"Hi,The requirement is when we invoke CreateTaskContact API call on Amazon connects from Lambda using python boto 3 function "start_task_contact", Is there anyway way to pass a phone number as the value to the "Reference" attribute. So When the task reaches the agent, he can simply click on the phone number to make an outbound call?  Currently, the "reference"  attribute is only accepting URL as the type and valid URL as a value. Anything other than this is throwing an InvalidRequestException error.RegardsjoFollowComment"

Answer: "0Accepted AnswerHi,As per the API Guide, use the 'Attributes' to pass in phone number: https://docs.aws.amazon.com/connect/latest/APIReference/API_StartTaskContact.html#API_StartTaskContact_RequestSyntax"Attributes": {"TripAdvisorScore" : "5 out of 5" ,"PhoneNumber": "+44112233445566"},ThxDanCommentShareDanBloyanswered a year ago0As per the documentation the only valid values for Type are **URL **and **ATTACHMENT **(https://docs.aws.amazon.com/connect/latest/APIReference/API_Reference.html). And attachment doesn't appear to be useful for anything currently.The simplest way to achieve this would be to use the Streams API and create a custom CCP that displays the click to call link along side the CCP. You'd then use Dan's comment about attaching the PhoneNumber as an attribute for the number to use in the click to call.I've thought of some other options, such as calling the StartOutboundVoiceContact API via the url, but they get pretty ugly pretty quickly.CommentShareledgeanswered a year ago"


Question: tls_alert handshake failure

"Hi,I'm calling the api from the load balancer nginx server to the api server (code written in Elixir) and it throws the following error. I'm still not sure whether it has to do with the OS or TLS?OS: Ubuntu 16.04Erlang: Elixir 1.6.5 (Erlang OTP 20)Error:Request: POST /api/bill/payment** (exit) an exception was raised:** (HTTPoison.Error) {:tls_alert, 'handshake failure'}(httpoison) lib/httpoison.ex:66: HTTPoison.request!/5I know Ubuntu version is very old. However the same api endpoint used to work before like year ago. There isn't any change in the code though.May I know is this something to do with AWS certificate?regardsRiazFollowComment"


Question: Can we form AWS Transit Gateway attachments using <1Gbps hosted DX?

I have a 500Mbps hosted Direct Connect. Is there a way to connect this to Transit Gateway?FollowComment

Answer: 0Accepted AnswerThe short answer is not directly.Long answer only on 1Gbps or above Hosted Connections. It does require a new type of VIF called Transit VIF where the limit kicks in.https://aws.amazon.com/directconnect/faqs/Q: What is transit virtual interface?Transit virtual interface is a type of virtual interface you can create on any AWS Direct Connect 1/2/5/10 Gbps connection. Transit virtual interface can only be attached to a Direct Connect gateway. You can use the AWS Direct Connect gateway attached with one or more transit virtual interface to interface with up to three AWS Transit Gateways in any supported AWS Regions.Here  is a blog post about how to connect over a sub-1Gbps hosted connection using AWS Site-to-site VPN.CommentShareEXPERTEvgeny-At-AWSanswered 4 years ago0AWS Direct Connect now supports connections to AWS Transit Gateway at speeds of 500 megabits per second (Mbps) and lower.https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-sub-1-gbps-hosted-connections-with-aws-transit-gateway/EricCommentShareEricanswered 6 months ago


Question: How can I access VPC Endpoints from On-Prem?

"Hey folks,I'd like for our on-prem uses of the AWS APIs to use the internal VPC Endpoints.I kinda of assumed that it would be as simple as establish a tunnel from on-prem >> VPC then point at a Resolver and BAM, it would work. But having some trouble on the side provisioning the endpoints themselves.From there I was working off this, but it is based on "SAM" and not really something I can reproduce myself easilyhttps://aws.amazon.com/blogs/compute/integrating-amazon-api-gateway-private-endpoints-with-on-premises-networks/I setup a S3 endpoint and and it resolves on-prem to the VPC's IP. But even when specifying the internal endpoint in a aws s3 ls --endpoint-url ... the command times out. I am guessing there are some additional permission I need to set or routing that I don't have my head around.I am out of ideas right now, any recipes (terraform preferred) you can point me to? Or reading on the subject?thanks in advance,-DanielFollowCommentSri a year agoHi, You would need two things. you could create them manually without using the SAM template.DNS forwarding from on-premises to AWSA site-to-site VPN and security groups to allow the connectivityS3 endpoints are a bit different compared to VPC endpoints.S3 endpoint is a Gateway endpoint, which serves as a target for a route in your route table for traffic destined for the service where as VPC endpoint is a private Interface endpoint, which is powered by PrivateLink, and uses an elastic network interface (ENI) as an entry point for traffic destined to the service.PS: S3 can also have an interface endpoint.Sharedpwtheitguy a year agoSo just for an update here. I have a tunnel working using Wireguard using a Linux EC2 instance, which is our company standard for such things. Would I be better off using some sort of Amazon service? Should it matter if the traffic terminates here? Not really having connectivity issues, my on-prem machines can resolve DNS.I went to create S3 Interface Endpoint and am stuck in some sort of error loop. Started a second thread on that ( https://repost.aws/questions/QUeJsY_nepTvmJeBc_iZUPdw/how-do-i-create-a-vpc-endpoint-for-s-3-interface ) specific issue.I CAN create an S3 Gateway endpoint but my undertanding is that will only work for services in the VPC and won't support my link from back on-prem.Share"

Answer: "0You're correct (from the comments) that a S3 Gateway Endpoint isn't the right thing to use because it only allows access from IP addresses within the VPC. That said, if you were using Wireguard to "get" to the VPC; then NAT on the instance terminating the Wireguard session so that the traffic appears to originate on that EC2 instance then that would work.So let's assume you're using an Interface Endpoint (powered by PrivateLink). As long as the VPC has a route back to your on-premises machine (via your Wireguard instance) then you should be fine. Ensure that you have the EC2 source/destination check disabled on the instance terminating the Wireguard session otherwise that will get dropped.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: "When I create a dataset using an existed data source and a custom SQL, can I perform JOIN SQL operations there?"

Operate position is as follows.FollowComment


Question: Quicksight - Can't create a copy of Analysis due to read permission from Dataset

"In Quicksight I'm trying to create a copy of an analysis but I get a message that I need reading permission to two additional datasets, but I don't know who owns the dataset. Is there a way to find out who owns a dataset when it's not visible under your own account? Can the account admin see all datasets even though they have not created them and give permission?FollowComment"

Answer: "1Accepted AnswerHi,From the QuickSight UI this is not possible. What you can do is ask the ask account ADMIN to make API calls to retrieve this data .To find out who has permissions on a dataset  : https://awscli.amazonaws.com/v2/documentation/api/latest/reference/quicksight/describe-data-set-permissions.html .Example below :88665a256657:~ xxxx$ aws quicksight describe-data-set-permissions --aws-account-id 123456789012 --data-set-id cdb151b3-14eb-4f98-a4c5-f1af2024213e{    "Status": 200,    "DataSetArn": "arn:aws:quicksight:eu-central-1:123456789012:dataset/cdb151b3-14eb-4f98-a4c5-f1af2024213e",    "DataSetId": "cdb151b3-14eb-4f98-a4c5-f1af2024213e",    "Permissions": [        {            "Principal": "arn:aws:quicksight:eu-central-1:123456789012:user/default/Default-Author1",            "Actions": [                "quicksight:PassDataSet",                "quicksight:DescribeIngestion",                "quicksight:CreateIngestion",                "quicksight:UpdateDataSet",                "quicksight:DeleteDataSet",                "quicksight:DescribeDataSet",                "quicksight:CancelIngestion",                "quicksight:DescribeDataSetPermissions",                "quicksight:ListIngestions",                "quicksight:UpdateDataSetPermissions"            ]        }    ],    "RequestId": "85f704e6-f8fd-461c-a8d2-9fca16aeb97a"}Implementing an administrative dashboard is also going to be very helpful (the link provides details on implementation ) : https://d172fagwhsdxeg.cloudfront.net/index.html?dashboardid=1cc671e3-40e5-4eea-a58e-3ed9d41de6f1&dashboardregion=us-east-1Regards,KoushikCommentShareKoushikanswered 8 months ago"


Question: glue version 3.0 for python shell

Is glue version 3 available for Python Shell also or it will support only version 1.0?FollowComment

Answer: "0---UPDATED AnswerHello,Glue v3 is specific to Spark jobs. Both Glue v2 and version 3 introduced new Spark versions (Glue v2 = Spark 2.4 ; Glue 3 = Spark 3.1.1).Glue Python shell scripts do not follow the same numbering. Currently Python 3.9 and python 3.6 are available when using the Glue Studio Python shell editor.To learn more on the new Glue Python Shell version you can look at this blog post.Hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year agodpevrli a year agoI hope soon we will see an updated version of python shell job image as stated here https://repost.aws/questions/QU7EmDfBcESiWaFTxZQKaAow/glue-py-shell-python-versionShare"


Question: Add AWS Chatbot API

"Is there any plan to expose AWS Chatbot APIs ? Is anyone aware of its planned roadmap?There might be plenty of automation, services and dependencies that can be built around AWS Chatbot and it is a bit sad seeing that its API is still not available.FollowComment"


Question: Is there a way to restrict CloudWatch alarms to only trigger during specified time periods?

"I have a Development account which only needs monitoring during business hours. Currently, notifications are being routed to OpsGenie via an SNS topic. There are options to silence the alerts at the OpsGenie level, but they are still generated, which skews alert metrics. Is there any way to prevent alerts from being sent to the topic outside of 9-5 business hours?Thanks!FollowComment"

Answer: "1Hello,there is no built-in silence feature in CloudWatch alarms. It is however possible to prevent the alarm from sending notifications, using one of the following approaches:Disable the alarm actions during off-business hours using a lambda triggered by an eventbridge cron rule. Your alarm will still change state during off-business hours, but the notification will not be posted. You can call the lambda at 5pm to call https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DisableAlarmActions.html, and trigger the lambda at 9am to call https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_EnableAlarmActions.htmlUse metric math to silence the metric during off-business hours, for example create a metric math expression that would be equal to IF(HOUR(m1) > 9 AND HOUR(m1) < 17, m1) and alarm on that metric math expression. With that option, your alarm will never change state during off-business hours.CommentShareJscanswered a year ago"


Question: Error when trying to parse OpenTelemetry 0.7.0 data from metric streams

"I'm trying to parse open telemetry data from metrics stream and sent to s3 bucket, without any compressions.I downloaded the files from s3 (binary), they look like¹—µ—Ôcloud.provideraws"cloud.account.id935705392901cloud.regionus-west-2xaws.exporter.arnd...........// ARN...êNamespaceAWS/NetworkELBMetricNameHealthyHostCount=hex:00000000: aec2 020a aac2 020a d401 0a17 0a0e 636c  ..............cl00000010: 6f75 642e 7072 6f76 6964 6572 1205 0a03  oud.provider....00000020: 6177 730a 220a 1063 6c6f 7564 2e61 6363  aws."..cloud.acc// skipped00000050: 2e72 6567 696f 6e12 0b0a 0975 732d 7765  .region....us-we00000060: 7374 2d32 0a78 0a10 6177 732e 6578 706f  st-2.x..aws.expo00000070: 7274 6572 2e61 726e 1264 0a62 6172 6e3a  rter.arn.d.barn:// skipped000000e0: c002 12e7 020a 2f61 6d61 7a6f 6e61 7773  ....../amazonaws000000f0: 2e63 6f6d 2f41 5753 2f4e 6574 776f 726b  .com/AWS/Network00000100: 454c 422f 556e 4865 616c 7468 7948 6f73  ELB/UnHealthyHos...and I followed the doc https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-metric-streams-formats-opentelemetry-parse.html trying to parse it using javascript, but I keep getting an errorError: Unknown base64 encoding at char: ¹from this line in the sample code from the docconst reader = new pb.BinaryReader(data)the google-protobuf I used is 3.19.3, and metrics_service_pb is generated from proto that from the doc as well.Does anyone know how to properly parse the binary data with javascript?Thanks,BillFollowComment"

Answer: "0solved by converting the file from s3 to Uint8Array - example codefs.open(filename, 'r', function (err, fd) {    var buffer = Buffer.alloc(1);    var data = new Uint8Array(fileSize);    var n = 0    while (true) {        var num = fs.readSync(fd, buffer, 0, 1, null);        if (num === 0)            break;        data[n] = buffer[0]        n += 1    }    console.log(parseRecord(data));});not optimized, but working for me.where filename is the filename from s3, and fileSize is the num of bytes of the file.HTH for anyone is using open telemetryCommentSharebchunganswered a year ago"


Question: Unable to factory reset AWS Deeplens

"I'm trying to reset my v1 AWS Deeplense using the instructions given in the AWS documentation. But, when I restart my device using BIOS setting I'm getting following error: "can't read CTR while initializing i8042" and then I'm routed to initramfs prompt. I tried multiple things to resolve this error:I tried changing changing my pen driveI tried executing steps via both Ubuntu and windows machinesI also tried formatting my USB stick in multiple waysI tried exiting a couple of times on initramfs promptBut, none of these steps work. I don't understand why this is happening. Can you please help me reset my device to factory setting?FollowComment"

Answer: "1Hi Shree,To make sure the official guide works, I just tried resetting my personal v1 deep lens according to the official guide and it worked. With that context in mind, can you share the following information?Are you following this guide in performing the factory reset?2)Are you able to format the USB according to the guide? (i.e 2GB FAT32 partition and 27.88GB for NTFS partition)3)The error which you encountered is it after you performed **Boot From File **step in the BIOS window?If it's yes to all three. I suspect there might be an issue with the USB drive, you could try attempting the factory reset again with another USB. Do share the information and we can try providing more help from there.CommentShareAWS-Vincentanswered a year agoAWS-User-shree a year agoHi Vincent. Thanks for your response. I was able to resolve this issue. The answer to all the three questions is yes and I did try 4 different USB sticks and faced the same issue with all four. I finally used the memory card to do the factory reset by performing the same steps but with a memory card.ShareAWS-User-shree a year agoBut now I am facing a new issue. After I register my deeplens, it good into an infinite loop for an upgrade. Here's what I did, 1) successfully registered the device - although the device registration was successful, I couldn't see any IP address on the console; 2) after registering I was asked to update my device (because without doing that I can't deploy any project), and after I do that it goes into an endless state of 'deployment in progress'. I tried factoring resetting and doing this step multiple times but ended up with the same outcome. Have you ever seen this issue?ShareAWS-Vincent a year agoHi Shree, glad to know you're able to proceed a step further. Can i confirm if you're updating the device via the ubuntu terminal?sudo apt-get updatesudo apt-get install awscamsudo rebootIn addition, is your device showing online/offline in the console? Given your IP address cannot be seen, I would assume it's not online. If that's the case, you could jump into the ubuntu console and check if it has wifi connectivity. Typically if your device is online and registered, then it's IP address would be collected, regardless whether your device is updated.Share0I did factory reset following this guys tutorial series on youtubeCommentSharematt_the_hatanswered a year ago"


Question: s3 permissions - security hub wants no read only so suggestions

"Starting to utilize the security hub feature and they are saying that "S3.2 S3 buckets should prohibit public read access".So we use S3 for a lot of images, most of already in cloudfront, but when I turn off public, even the cloudfront fails.   The recommendation is really no help, just says to turn it off, so I am trying to figure out the best practice to roll out to all our S3 buckets.As I said, most are images that goto cloudfront, there are some other uses that I can look at, but I want to get those resolved from security hub and still allow the images to work.Thanks.FollowComment"

Answer: "0The S3.2 policy evaluates not only the Block Public Access setting, but the bucket policy and the bucket ACL.You will need to configure Origin Access Identity (OAI) on your S3 Bucket(s) so they only serve content via CloudFront (if not already done so).Take a look at this article + video guide.CommentShareMKanswered 7 months ago"


Question: another DNS migration question - moved DNS but still shows old as primary?

"so I waited until I saw the router 53 servers showing as DNS for one of my least important domains, and then removed dyndns\oracle from DNS at the host level.but - for Primary DNS and responsible email it still shows dydns.  is there another place I need to change that, or did I miss a step somewhere?SOATTL21600Primary NSns1.mydyndns.org.Responsible Emailzone-admin.dyndns.com.FollowComment"

Answer: "0What is the domain name in question?In general, if you have a TLD (top level domain) registered with a Registrar A, have it hosted with a DNS Hosting Provider B, and then create a new hosted zone for the same TLD with a DNS Hosting Provider C, with the intention to use this new hosted zone, you need to:a) Update A, with nameservers for your hosted zone provided by Cb) Wait for upto 48 hours before deleting hosted zone in BOn Linux, you can verify this by running whois <domain name> and it should display the namservers for the TLD provided to the registrar. These should match the ones provided by C.CommentShareEXPERTprabhishanswered 4 days ago"


Question: Name Server propagation takes longer than 96 hours

"I registered a domain (yhhsieh.com) on amazon four days ago and point it to an EC2 instance. The DNS works fine at that time.After that I updated the name server to the blue host name server (ns1.bluehost.com/ns2.bluehost.com) it has been 4 days since then but the name server propagation haven't finished yet.I changed the name server only and did nothing to the host zone.I check the name server propagation using the following link:https://dnschecker.org/#NS/yhhsieh.comfrom the link you can see the name server on some DNS still points to the amazon one.I've read that the name server propagation normally takes up to 72 hours. I wonder why it takes so long in this case?Thank you.Edited by: scrashedward on Mar 11, 2020 7:30 AMFollowComment"

Answer: "0Accepted AnswerHi,To change the DNS service for a domain, you update the name servers that are associated with the domain registration. Currently, those name servers are still the name servers for your Route 53 hosted zone.For information about how to change the name servers for your domain, see "Adding or Changing Name Servers and Glue Records for a Domain" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.htmlScottCommentShareEXPERTAWS-User-6179575answered 3 years ago"


Question: Unable to deny snapshot creation based on tags

"A customer wants to deny creating resources unless it has specific tags. I'm currently working on EC2 snapshots, volumes, and instances with the following SCP:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "GRAPPTAG2",      "Effect": "Deny",      "Action": [        "ec2:RunInstances",        "ec2:CreateVolume",        "ec2:CreateSnapshot"      ],      "Resource": [        "arn:aws:ec2:*:*:instance/*",        "arn:aws:ec2:*:*:volume/*",        "arn:aws:ec2:*::snapshot/*"      ],      "Condition": {        "Null": {          "aws:RequestTag/application": "true"        }      }    }  ]}But this policy doesn't allow me to create EC2 snapshot, regardless if I specify the tag or not, but it works as expected for creating an EBS volume or EC2 instanceNow If I separate the ec2:CreateSnapshot into its own statement then it works as expected like the following:enter code here{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "GRAPPTAG2",      "Effect": "Deny",      "Action": [        "ec2:RunInstances",        "ec2:CreateVolume"      ],      "Resource": [        "arn:aws:ec2:*:*:instance/*",        "arn:aws:ec2:*:*:volume/*"      ],      "Condition": {        "Null": {          "aws:RequestTag/application": "true"        }      }    },    {      "Sid": "GRAPPTAG3",      "Effect": "Deny",      "Action": [        "ec2:CreateSnapshot"      ],      "Resource": [        "arn:aws:ec2:*::snapshot/*"      ],      "Condition": {        "Null": {          "aws:RequestTag/application": "true"        }      }    }  ]}So I'd like to know why this is happening and if there is anyway to combine them into a single statement.Thanks!FollowComment"

Answer: "0Accepted AnswerThe following policy ensures that only EC2 instances, volumes and snapshots will launched if they have an "application" key with any value except null value.{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Deny",            "Action": [                "ec2:CreateSnapshot",                "ec2:CreateVolume",                "ec2:RunInstances"            ],            "Resource": [                "arn:aws:ec2:*::snapshot/*",                "arn:aws:ec2:*:*:instance/*",                "arn:aws:ec2:*:*:volume/*"            ],            "Condition": {                "StringNotLike": {                    "aws:RequestTag/application": "?*"                }            }        }    ]}CommentShareAWS-User-2530299answered 3 years agorePost-User-2123090 8 months agoI tried to implement something almost exactly like this without luck. Are we sure this works?Share"


Question: DAX Using Postman

"Hello All,I am trying to create/delete/describe clusters for DAX(DynamboDB Accelerator) using postman. But unable to. Can anyone let me know the details on how to achieve this?Details required,Host : dax.region.amazonaws.com (Please correct if this is not correct)Service name : daxHTTP request : POST (I used Post as all other dynamodb operations are carried out using post request.)Query Parameters.Request Headers.FollowComment"

Answer: "0Thanks for reaching out. I have shared your question with our DAX team and will follow up with their reply.CommentShareAWS-User-6425534answered 3 years ago0Thank you. I am waiting for your response.CommentSharemanishkotharianswered 3 years ago0Hey manishkothari,Unfortunately you won't be able to use Postman to connect to a DAX cluster because DAX uses its own protocol not base HTTP. Postman only works with HTTP-based protocols.Are you just looking to do some testing/ad hoc querying? What's the use case for DAX + Postman?CommentShareAWS-User-6425534answered 3 years ago0Thank you, I was just looking to do it via HTTP.CommentSharemanishkotharianswered 3 years ago"


Question: How to setup alert for Blocking Locks in mysql RDS instance?

How to setup alert for Blocking Locks in mysql RDS instance?FollowComment

Answer: "0Hi,Please check https://aws.amazon.com/blogs/database/monitor-errors-in-amazon-aurora-mysql-and-amazon-rds-for-mysql-using-amazon-cloudwatch-and-send-notifications-using-amazon-sns/. This provides an overview of how you can configure the deadlock events and alerting on Amazon RDS MySQL engineCommentShareArunanswered 3 months agoKanhaiya Sharma 3 months agoHi Arun,I have already set-up that alert. But that can send you alert only when deadlock happens. I want to setup alerts when there are blocking sessions in database for defined interval of time.SELECTr.trx_id waiting_trx_id,r.trx_mysql_thread_id waiting_thread,r.trx_query waiting_query,b.trx_id blocking_trx_id,b.trx_mysql_thread_id blocking_thread,b.trx_query blocking_queryFROM information_schema.innodb_lock_waits wINNER JOIN information_schema.innodb_trx bON b.trx_id = w.blocking_trx_idINNER JOIN information_schema.innodb_trx rON r.trx_id = w.requesting_trx_id;Share"


Question: Auto scaling group: Terminate burstable instance with lowest CPU credit balance first

"Hi,How can we update our Elastic Beanstalk environment to terminate - during an automatic down-scaling event - the instance with the lowest amount of CPU credit balance?Currently, when scaling down, it terminates the oldest instance, leaving new instances in place that may have only just started to accumulate CPU credits.Thank you for any help in this regard.FollowComment"

Answer: "1ASG's support setting a custom termination policy for changing which instances are selected for termination when a scale in event occurs https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-termination-policies.html#custom-termination-policy - Beanstalk does not provide a way to override this setting to OldestInstance or the most relevant policy. It only allows for a small subset of settings on the ASG to be adjusted https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html#command-options-general-autoscalingasg.CommentSharelp901answered 9 months agoAWS-User-9221314 9 months agoIs there a termination policy that considers the CPU credit balance?ShareShahad_C 9 months agoNot one of the build in ones, you'd need to create a Lambda function and use a custom policy as lp901 mentioned.  You could change to using the built in "NewestInstance" policy instead of making a custom one, but that isn't guaranteed to get rid of instances with the fewest creditsShare"


Question: Efficiently Signing CloudFront Distribution URL for HLS Video Streaming Stored in S3

Hi my team is working on figuring out a solution as to how we can use signed urls to protect the content that is streamed to our users via an Alexa skill on their Alexa devices. We are serving video streaming content using HLS and m3u8 media types. The content is served through a cloudfront distribution. We have seen articles such as this which require signing the m3u8 manifest and each underlying file as well. We are looking for a more efficient alternative. Is it possible to only sign the CloudFront url? Or is the only way to serve signed m3u8 content by signing each underlying file?Thanks!FollowComment

Answer: 0There is a newer solution that is built by AWS for media streaming: https://aws.amazon.com/solutions/implementations/secure-media-delivery-at-the-edge/CommentShareYury Yakubovanswered 7 months ago


Question: No Graviton instances for global datastores

"I have a couple global datastores running Redis 5.0.6 in us-east-2 and us-west-2 and I was planning on switching the instances to the Graviton-based instances (m6g) but for some reason they're not showing up when I attempt to change the Node Type. Has anyone seen this before? I verified that those regions support Graviton instances for Elasticache as long as Redis version is >=5.0.6.The sections show up in the drop-down menu, but the actual instance sizes aren't listed. This is the case for all the datastores. I've tried relogging into the account to see if maybe it was some kind of weird caching issue, but that didn't help.FollowComment"

Answer: "0Turns out since Graviton instances for Elasticache was just recently released (<2 months), there was limited capacity within the AZs that the clusters were running in. The API checks if there is capacity within each subnet/AZ included in the subnet group, and if at least one of the AZs doesn't have capacity it will not apply the modification or even show it as an available option.CommentSharellubricoanswered 2 years ago"


Question: A user can see/use my inbox without permission

"One of my colleagues has since yesterday access to my inbox despite having no permission for.When he opens Outlook my inbox appears listed below his own, and he can do any action (sending, receiving, deleting, ...).This seems to happen only on his PC, not e.g. on his mobile phone.My Inbox has default permissions and the only thing I share (specifically with this colleague) is my calendar.No users has access permission to the inbox of the others.I'm the most privileged user, but not on personal inboxes - I have permissions on group emails.Does anybody has any idea what could be the reason for this strange behaviour?Any help is welcome.ThanksClaudioFollowComment"

Answer: "0Accepted AnswerHi Claudio,The service team investigated your issue and it seems you have misinterpreted the way WorkMail permissions work. You have given multiple groups full mailbox access permissions on your user. This means that all members of these groups have full mailbox access to your user and explains why your colleague can open your mailbox without you giving explicit permissions to do so.If you want to give your user permissions on groups you need to add your user to the group.I will check with the service team to review the documentation and console details for this.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 4 years ago0Hello Claudio,I'm sorry to hear you're experiencing problems with permissions on you mail store. I have escalated this case to the service and will get back to you on this asap.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 4 years ago0Ops. Thanks for the quick investigation and clarification.I'm now fixing the configuration and as soon as my colleague will confirm on his side, I'll make the question as answered.ThanksClaudioCommentSharecspaanswered 4 years ago"


Question: Migrate from Private VIF to Transit VIF

"Hello,I have a customer that is looking at migrating their existing PrivateVIF/DXGW/VGW setup to use TGW. The new setup will preferably be using TransitVIF/DXGW/TGW/VPC. Has anyone executed this change?In this case, for minimal downtime, is it feasible to setup transitVIF/DXGW/TGW/VPC as a passive link to the original connection and failover? If it is possible, how do we handle the moving parts such as:VPC Route tables changes, TGW routingCan we use AS-Path prepend, Local pref to make sure that the redundant link of transitVIF/DXGW/TGW/VPC be the passive link until failover?ThanksFollowComment"

Answer: "0Accepted AnswerIf the customer has a Dedicated Connection (DX) that allows them to provision new Transit VIF or has ordered new connection via DX Partner they will need a new DXGW.This new DXGW would be attached to Transit Gateway and at this point you will define the prefixes you want to advertise over the new Transit VIF connection towards the on-prem. These prefixes can be edited later so you can add and remove them. These prefixes then can be handled by the customers router as they want. For example they can set the preference to be lower than existing connections or use more specific routing on the existing connections.The Transit Gateway attachments to VPCs will need static routes added on the VPC routing tables. None of the routes are dynamically propagated from TGW towards VPC attachments. The VPC CIDR can be propagated into the TGW Routing Table.If they pre-pend AS-Path on their advertisements over this new connection that information will be lost on the DXGW, so the VPCs wouldn't see difference.So to make this move:Setup new Transit VIF with new DXGW (can't use DXGW with VGWsattached)Setup new Transit Gateway and attach it to new DXGW. At this point you can define what prefixes are advertised over the Transit VIF or add them later. But these should be less specific than the existing routes coming over the Private VIF.Attach VPCs to the Transit Gateway (At this point the traffic from VPCs wont start flowing to TGW as there are no route table entries)Add less specific routes to the TGW-DXGW attachment if you didn't do it at step 2Add less specific routes to the VPC route tables towards the on-prem (These two steps will activate routes but they are not prefered as they are less specific)Shift traffic from the Private VIF to TGW by deactivating route advertisement or shutting down the BGP complete so the less prefered routes are taken into useExamples of moving connection from VPN + VGW to VPN + TGW: https://aws.amazon.com/premiumsupport/knowledge-center/transit-gateway-migrate-vpn/CommentShareEXPERTToni_Sanswered 3 years ago"


Question: amazon-linux-extras install epel broken on ARM64 instances

"I am trying to install epel using amazon-linux-extras on a t4g ARM64 instance:sudo amazon-linux-extras install epelThis used to work until recently, but now results in the following error:[ec2-user@ip-... ~]$ sudo amazon-linux-extras install epel -yInstalling epel-releaseLoaded plugins: extras_suggestions, langpacks, priorities, update-motdCleaning repos: amzn2-core amzn2extra-docker amzn2extra-epel epel3 metadata files removed0 sqlite files removed0 metadata files removedLoaded plugins: extras_suggestions, langpacks, priorities, update-motdamzn2-core                                                               | 3.7 kB  00:00:00amzn2extra-docker                                                        | 3.0 kB  00:00:00amzn2extra-epel                                                          | 3.0 kB  00:00:00 One of the configured repositories failed (Unknown), and yum doesn't have enough cached data to continue. At this point the only safe thing yum can do is fail. There are a few ways to work "fix" this:     1. Contact the upstream for the repository and get them to fix the problem.     2. Reconfigure the baseurl/etc. for the repository, to point to a working        upstream. This is most often useful if you are using a newer        distribution release than is supported by the repository (and the        packages for the previous distribution release still work).     3. Run the command with the repository temporarily disabled            yum --disablerepo=<repoid> ...     4. Disable the repository permanently, so yum won't use it by default. Yum        will then just ignore the repository until you permanently enable it        again or use --enablerepo for temporary usage:            yum-config-manager --disable <repoid>        or            subscription-manager repos --disable=<repoid>     5. Configure the failing repository to be skipped, if it is unavailable.        Note that yum will try to contact the repo. when it runs most commands,        so will have to try and fail each time (and thus. yum will be be much        slower). If it is a very temporary problem though, this is often a nice        compromise:            yum-config-manager --save --setopt=<repoid>.skip_if_unavailable=trueCannot retrieve metalink for repository: epel/aarch64. Please verify its path and try againInstallation failed. Check that you have permissions to install.FollowComment"

Answer: "0Greetings sergeiwoven,I found the resolution of the issue you're experiencing.The EPEL repository is already installed on the original version of Amazon Linux, the only thing you need to do is enable it. By observing from the steps you provided in your post, you only installed EPEL but have not enabled it.You can enable EPEL repository by using the yum-config-manager command or by editing the epel.repo file.See command below to enable the EPEL repository:sudo yum-config-manager --enable epelTo install EPEL repository on other Linux distributions please refer to this AWS Blog, which was last updated on 2021-11-17I hope this helps.CommentShareLungaanswered a year ago"


Question: How to have static outbound IP address for API Gateway + Lambda

"Hi,I am using a third party API for payments for which they need to whitelist our IP but we are on aws serverless that is an API of API gateway invoke the lambda function. so it return diff IPs on invocation. How to have static outbound IP address?How to provide a static IP to the third party for whitelisting? I searched but found https://medium.com/financial-engines-techblog/aws-lambdas-with-a-static-outgoing-ip-5174a1e70245 or similar for static IP at lambda. but as per my assumption if a lambda returns static IP to API gateway, will the same IP be returned by API gateway to the calling party?FollowComment"

Answer: "3In short: The blog post you reference is the way to go forward.But in a little more detail: There are two components here (at a networking level).First, there is the connection to API Gateway from the API caller. When called that invokes the Lambda function and the Lambda function can return data to the caller. That traffic is between the caller IP address and the API Gateway IP address.Second, there is the connection that the Lambda function establishes (outbound) to the third-party API. By default, Lambda functions can connect to external (Internet-hosted) services with no other configuration but as you've pointed out there is no static IP there. To have Lambda appear to come from a static IP address you need to have it connected to a VPC and use NAT Gateway as per the blog post.CommentShareEXPERTBrettski-AWSanswered 7 months agoShaista 7 months agoBut Unfortunately after the implementation of said blog and https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/generate-a-static-outbound-ip-address-using-a-lambda-function-amazon-vpc-and-a-serverless-architecture.html there is no success in getting static public IP for lambda. I am checking remote IP in chrome -> Network tab and in Postman. They are different on every invocation response. What I might be missing?ShareBrettski-AWS EXPERT7 months agoA Lambda function will not get a static public IP. The public IP will belong to the NAT Gateway.Share"


Question: pgp decryption and lambda

"I try to use pgp encyption/decryption using lambda and found https://www.youtube.com/watch?v=N3R1SScBS9E&ab_channel=AmazonWebServicesgithub:https://github.com/aws-samples/pgp-decryption-for-transfer-family?sc_channel=EL&sc_campaign=Demo_2022_vid&sc_medium=YouTube&sc_content=N3R1SScBS9E&sc_detail=MIGRATION_TRANSFER&sc_country=USbasically i run setupenviroment.sh that create a lambda layer. I then create a very basic lambda funcitonimport gnupgimport jsondef lambda_handler(event, context):gpg = gnupg.GPG(gnupghome='/tmp', gpgbinary='/opt/python/gpg', options=['--trust-model', 'always'])but i am keep getting errorSTART RequestId: 72c1cffb-12ea-47f6-9d7f-dad91503e8b2 Version: $LATEST[ERROR]2023-01-04T16:13:00.757Z72c1cffb-12ea-47f6-9d7f-dad91503e8b2Unable to run gpg (/opt/python/gpg) - it may not be available.Traceback (most recent call last):File "/opt/python/lib/python3.8/site-packages/gnupg.py", line 941, in initp = self._open_subprocess(['--version'])File "/opt/python/lib/python3.8/site-packages/gnupg.py", line 1007, in _open_subprocessresult = Popen(cmd, shell=False, stdin=PIPE, stdout=PIPE, stderr=PIPE, startupinfo=si, env=self.env)File "/var/lang/lib/python3.8/subprocess.py", line 858, in initself._execute_child(args, executable, preexec_fn, close_fds,File "/var/lang/lib/python3.8/subprocess.py", line 1704, in _execute_childraise child_exception_type(errno_num, err_msg, err_filename)OSError: [Errno 8] Exec format error: '/opt/python/gpg'[ERROR] OSError: Unable to run gpg (/opt/python/gpg) - it may not be available.Traceback (most recent call last):  File "/var/task/lambda_function.py", line 5, in lambda_handler    gpg = gnupg.GPG(gnupghome='/tmp', gpgbinary='/opt/python/gpg', options=['--trust-model', 'always'])  File "/opt/python/lib/python3.8/site-packages/gnupg.py", line 945, in init    raise OSError(msg)END RequestId: 72c1cffb-12ea-47f6-9d7f-dad91503e8b2FollowComment"

Answer: 0My initial thought is that the construction of the Lambda Layer isn't correct. Have a look at the documentation - and the thing there that has tripped me up in the past is that you must create a directory called python and all the libraries must be installed in that directory. When you create the ZIP file you have to include that directory in the path.CommentShareEXPERTBrettski-AWSanswered 5 months ago


Question: Amazon SES email template specs

Can template used in the SES be fullscreen width? Meaning the image in the template is fullscreen no matter of the screen size and will scale accordingly. I'd like to avoid empty sidebars in the email.FollowComment


Question: Lightsail website not working

"Public IP: 18.209.227.83Domain: bbs.exlabnyc.comMy website went down since yesterday morning. I noticed that the CPU utilization rate went up to 100%(I didn't do anything.)  I looked at some answers and check the status of the server which gives me this. I am not sure what is going on. Hope somebody could help me with this.One of my friends told me all my files on my instance were gone. But if that's the problem, the server should at least give some responses when I ping it right?Could I be hacked and the hacker deleted all my files? Is that possible?FollowComment"

Answer: "0It sounds like the BBS software you're using went over your burst capacity. If the utilization graphs indicate that you're frequently going over burst capacity, you might solve the issue by using a larger instance size (take a snapshot of your instance and create a new larger instance from the snapshot).Otherwise, you can look into what's causing your software to use so much CPU to see if you can keep it within your allotted capacity.CommentShareGabriel - AWSanswered a year ago"


Question: Cloudtrail event notifications

"Hello,we have configured configured Control Tower landing zone  and enrolled tens of accounts in our organization.We would like to monitor some of the actions (ConsoleLogin, SwitchRole, CreateUser, CreatePolicy, CreateRole, PutGroupPolicy, ...) across all accounts in organization and be notified when the action occurs via Slack or Pagerduty.Is there any out of box solution or recommended approach?I am considering two approaches:Listen Cloudtrail S3 logs bucketCreate an account which will have read only access to cloudtrail logs S3 bucket in Log Archive account.Lambda function will be triggered on new records in bucket. It will download the files from S3 and parse the events.Huge disadvantage is that it'll have to parse all cloudtrail entries which could be expensive and in inefficient.Aggregate events using EventBridge busesCreate dedicated account "Audit Notifications" where will be EventBridge event bus aggregating matched events from all other accounts. There will be configured event rule with Lambda target forwarding matched events from all accounts to Slack/Pagerduty/... in "Audit Notifications" account.Event rule forwarding matched events to Event Bus target  in "Audit Notifications"  will be deployed into each governed region in each member account.Similar as described in https://aws.amazon.com/premiumsupport/knowledge-center/root-user-account-eventbridge-rule/I favor second approach, but maybe there are some other options.thanksFollowComment"

Answer: "0Accepted AnswerHi, there's a probably a couple ways to achieve this, but here's a common pattern. With Control Tower, it sets up the centralized log bucket, but also configures a Cloudwatch Log Group in each account for local Cloudtrail logs. You can create Metric Filters on that Log Group for specific actions. For instance IAM policy changes or failed logins. Documentation here: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateMetricFilterProcedure.html and https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html.That log filter can send the alerts to the Control Tower created SNS topic aws-controltower-SecurityNotifications. This topic forwards the alerts via a Lambda function to a topic in the Audit account. Which then can have subscriptions to email, PagerDuty, etc. Bear in mind that central SNS topic may get a little noisy so it may be a case of creating new topics. You could also subscribe to the SNS topics in each account differently. That would provide some flexibility on who/what gets alerts from specific accounts.On the deployment side, if you are using cloudformation, and create a template for the metric filters, then the Customizations for Control Tower solution https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/ or Organizations StackSets https://aws.amazon.com/blogs/aws/new-use-aws-cloudformation-stacksets-for-multiple-accounts-in-an-aws-organization/ can help you deploy the same template to many accounts quickly and easily. Managing the deployment and updates from a central location.CommentShareJimmy_Manswered a year agoMartin Halamicek a year agoHi Jimmy,thanks for the suggestions.I was considering to connect it to Cloudwatch Log Group  created it each member account for Cloudtrail, however I am more interested in distinct events over metric alerts at the moment, so I would have to use subscription filter instead of metric filter on log group. But the subscription filter does not support SNS topic or Event Bus in same or different account.That is why I chosen default Event bus filter on Cloudtrail events in member account and forward to Custom Event Bus which is in Audit Notifications account. Similar template https://gist.github.com/Halama/e5db7ab0cc7b2762ff7f9a28fa1eac84#file-cloudtrail-would be deployed into each member account using Organizations StackSets as you suggested (CT customizations are promising but at the moment seems to much complex).Share"


Question: AWS IoT Embedded SDK

"Hello,To make my device development more straightforward, I'd like to use the AWS IoT Device SDK Embedded C release 202108.00. However, I am having trouble cross-compiling it for my platform (based on the BG77, using a Qualcomm version of Clang). I am unable to configure & build the project.Here is my configure command:cmake -G Ninja -B build -S . -DCMAKE_TOOLCHAIN_FILE=path/to/bg77.cmake -DBUILD_DEMOS=OFF -DBUILD_TESTS=OFF -DINSTALL_PLATFORM_ABSTRACTIONS=OFFAnd the error I am seeing is:<trim>Downloading the Amazon Root CA certificate...  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current                                 Dload  Upload   Total   Spent    Left  Speed100  1188  100  1188    0     0  20941      0 --:--:-- --:--:-- --:--:-- 21214Downloading the Baltimore Cybertrust Root CA certificate...  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current                                 Dload  Upload   Total   Spent    Left  Speed100  1262  100  1262    0     0  13008      0 --:--:-- --:--:-- --:--:-- 13010-- Configuring doneCMake Error: The following variables are used in this project, but they are set to NOTFOUND.Please set them or make sure they are set and tested correctly in the CMake files:OPENSSL_CRYPTO_LIBRARY (ADVANCED)    linked by target "openssl_posix" in directory aws-iot-device-sdk-embedded-C/platform/posix/transportOPENSSL_SSL_LIBRARY (ADVANCED)    linked by target "openssl_posix" in directory aws-iot-device-sdk-embedded-C/platform/posix/transport-- Generating doneCMake Generate step failed.  Build files cannot be regenerated correctly.At this point, there is no build.ninja file generated, so I cannot build the project.The README in the repo says the following:The follow table shows libraries that need to be installed in your system to run certain demos. If a dependency is not installed and cannot be built from source, demos that require that dependency will be excluded from the default all target.What is the proper way to build this without these dependencies?Thank you,JonathanFollowCommentAWS-User-2848082 a year agoAs additional information, with this patch, I can complete the CMake configure & generate steps.diff --git a/platform/posix/transport/CMakeLists.txt b/platform/posix/transport/CMakeLists.txtindex 0bf7ce39..fa283801 100644--- a/platform/posix/transport/CMakeLists.txt+++ b/platform/posix/transport/CMakeLists.txt@@ -30,15 +30,9 @@ target_link_libraries( openssl_posix                        PUBLIC                           sockets_posix                        PRIVATE-                          # This variable is set by the built-in FindOpenSSL.cmake-                          # and contains the path to the actual library.-                          ${OPENSSL_LIBRARIES}                           # SSL uses Threads and on some platforms require                           # explicit linking.-                          Threads::Threads-                          # SSL uses Dynamic Loading and on some platforms-                          # requires explicit linking.-                          ${CMAKE_DL_LIBS} )+                          Threads::Threads )  # Set path to corePKCS11 and it's third party libraries. set(COREPKCS11_LOCATION "${CMAKE_SOURCE_DIR}/libraries/standard/corePKCS11")I still can't do a full build (mbedtls fails with an error about only being supported on Windows or Unix), but I can build most of the targets (e.g., aws_iot_json).Share"


Question: "How do I Remove the SSL certificate, which is copied in a new instance from a snapshot of an old instance?"

"I have created a Snapshot of the instance and then created a new instance from the snapshot.The website is working but when I am trying to give/install an SSL certificate it will give me the error "Warning: The domain 'www.xyz.com' does not resolve, please fix its DNS entries or remove it.".and on the browser, it is showing this error "aws lightsail This server could not prove that it is xyz.com; its security certificate is from www.abc.com. This may be caused by a misconfiguration or an attacker intercepting your connection."After that, I have tried "sudo /opt/bitnami/bncert-tool --perform_public_ip_validation 0 --perform_dns_validation 0" and it is give this error"Could not obtain certificates:error: one or more domains had a problem:[www.xyz.com] acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNSproblem: NXDOMAIN looking up A for www.xyz.com - check that a DNS recordexists for this domain; DNS problem: NXDOMAIN looking up AAAA forwww.xyz.com - check that a DNS record exists for this domain"FollowComment"

Answer: "0It appears to be referencing the host zone for certificate issuance.By the way, have you already corrected your DNS records to the new Lightsail IP address?CommentShareEXPERTRiku_Kobayashianswered 10 days agoDCPatel 10 days agohow can I solve this issue?and yes I have corrected DNS record.Share"


Question: Designing VPC to host multiple businesses

"Curious what best practices are in designing a VPC. Is it best to isolate each hosted customer on a separate VPC or do most have a single VPC with multiple subnets for each customer? I know it can get quite expensive having separate VPCs for each customer with security appliances, load balancers, etc configured for each. Please let me know your thoughts.Thank youFollowComment"

Answer: "1Hi,As soon as I hear the words "isolated" and "hosted customer", I immediately turn to the use of multiple VPCs.  There is no  explicit cost for creating separate VPCs and they provide the perfect tooling for customer segmentation.  As for providing services, such as firewalls,  inbound load balancing and so forth, consider using shared services as part of your hosting offer for your customers.   Using tools like Transit Gateway, you can connect all of your VPCs, along with your shared networking services, described above.  Using custom routing tables VPCs can still be isolated (with up to 5000 VPC attached to a single TGW) but benefit from using the shared ingress or even in-line firewall inspection.Here is a link to a number of configurations possible using Transit GW, with one covering your exact situation, isolated VPCs  using shared services -https://docs.aws.amazon.com/vpc/latest/tgw/TGW_Scenarios.htmlThis article covers many AWS Network Firewall design configurations, but pay attention to the section "Centralized deployment model" :https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall/Here is another awesome PDF walking through numerous reference designs using Transit Gateway:https://d1.awsstatic.com/events/reinvent/2019/REPEAT_1_AWS_Transit_Gateway_reference_architectures_for_many_VPCs_NET406-R1.pdfCommentShareMstein-AWSanswered 2 months agoEXPERTkentradreviewed 2 months ago0Hi,Well, answer is it depends :)I suggest a good read to this https://aws.amazon.com/blogs/security/security-practices-in-aws-multi-tenant-saas-environments/ which discusses different deployment models.On top of that, have a look at best practices for tenant isolation with pros and cons:https://d1.awsstatic.com/whitepapers/saas-tenant-isolation-strategies.pdfHope it helps ;)CommentShareEXPERTalatechanswered 2 months agoEXPERTkentradreviewed 2 months ago"


Question: Timestream weird behavior with measure name

"Hello:I'm having a weird behavior in Timestream where my data has a measure name "Latitude" which normally has decimal values like 121.451253 but it was stored as bigint truncating the decimal part. I also tried to send the measure as string in which case it was just ignored (not stored).I noticed that changing the name of the measure or just using lowercase like "latitude", everything is fine... Is there any issue using some specific words? I checked there is no reserved word with that name...ThanksFollowCommentAWS-User-SOS a year agoI also noticed that once it stores a measure with some specific type (String, BigInt, etc), it won't accept same measures in different types...Is this correct?Share"

Answer: "0Hi, the Latitude is not a special keyword. So no issues using Latitude.Measure names in Timestream are case sensitive. So Latitude and latitude will be two different measure names.Timestream offers flexible and incremental schema definition. This means you do not need to define schema upfront while creating a table. However, we do assign the type to a particular column (Latitude in this case) first time system ingests a measure name. if you first ingested Latitude with Big Int, it is not possible to change it to double. The system will treat Latitude as BIG INT.You can check the schema of your table (Types for each column in table) in the query editor mode of the consoleHope this helps.CommentShareAWS-User-1847733answered a year ago"


Question: Hosting many Static Sites with Single Cloudfront Distrubation

"Hello, i’m planing to build a SaaS Plattform like Shopify. part of my business will be that the customer can have their own domain on which their shop runs. I’ve solved everything on aws so far, but I’m now coming up against a limit (number of S3 buckets and the domain assignment). My principle when creating my platform was always that it scales from 1 to 10000 without resorting to servers or manually switching anything later in production.I found a solution here, where u use 1 cloudfront distro with 1 s3 bucket with multiple directorys : https://repost.aws/questions/QUJCmEN5YvTdevcBub9nlW5w/hosting-1000-s-of-static-sitesbut i wonder what the limitation of ssl certificates has to do with it. without increasing the limit I can only use 10 domains with SSL?example.comshop.comtest.com...If so, what can the limit be increased to? Can it be that AWS denies my limit increase?I ask myself the same thing for domains in Route53, there I have a limit of 20, to what can this generally be increased?Edit: i just found out about Amplify. this service seems also nice, i could use amplify for the static site generation and use 1 s3 bucket with all the images.but it also has a limit of 25. does anybody know how much i can increase the limit?I also can not find anyway of explaining my limit increase or contact the support. it would be really nice to know beforehand what limit i can expect before building my plattform and than later to change it again because of the limitFollowComment"

Answer: "0You can request an increase to many service quotas by using the console as documented here. Many quotas are not hard limits and can be increased, but not all.It is possible to request an increase beyond what the service allows - this will be different for each service. Given the scale that you wish to operate at I would strongly recommend two things:Automate your deployment solution. At the scale at which you want to operate it will be crucial.Start separating your workloads across multiple accounts. Each account has separate quotas and this will help you scale. Automation is going to make operating across multiple accounts much easier.There are other reasons to use multiple accounts as per this whitepaper.CommentShareEXPERTBrettski-AWSanswered a year agoEXPERTTasioreviewed a year ago"


Question: Connection Information WordPress needs to access your web server

"hello allmay i ask you all, i found a problem like in the picture.In order to perform the requested action, WordPress needs to access your web server. Please enter your FTP credentials to continue. If you don't remember your credentials, we recommend contacting your web host.can you please help me to fix this all Thank youFollowComment"

Answer: "0Accepted AnswerHi @Taufiq, I see that you've tagged AWS Transfer for SFTP. Are you having an issue with AWS Transfer Family specifically?CommentShareEXPERTAWSTransferFamilyanswered 5 months agoTaufiq 5 months agoright I just had this problem after migrating from my old hosting to my new amazon hosting.Share0right I just had this problem after migrating from my old hosting to my new amazon hosting.CommentShareTaufiqanswered 5 months ago0How was this fixed? Having the same issue.CommentShareChaplainTIGanswered 5 days ago"


Question: Every HTTP requests to APIs created in API Gateway is returning back EOF: Error.Why?

I am sending few HTTP requests GET/POST/DELETE to few APIs created in AWS API Gateway. I am getting EOF:Error and it's not triggering the logs  as well.For example below is some log statements from the Lambda which is triggering these HTTP requests;Get "https://cj41dl5igj.execute-api.ap-southeast-1.amazonaws.com/v1/IntegrationServices/Application/GetMessageThread/150FA9C6-D6F1-4EEC-9B8F-41FE753F8ECE?SystemClient=6d9320a0-da2a-4802-ba15-4f49842ed7a3": EOFGet "https://cj41dl5igj.execute-api.ap-southeast-1.amazonaws.com/v1/IntegrationServices/Application/GetMessageThread/150FA9C6-D6F1-4EEC-9B8F-41FE753F8ECE?SystemClient=6d9320a0-da2a-4802-ba15-4f49842ed7a3": EOF: ErrornullEND RequestId: ec3194b2-e680-441f-9152-5936f309d737REPORT RequestId: ec3194b2-e680-441f-9152-5936f309d737Duration: 19.45 msBilled Duration: 20 msMemory Size: 512 MBMax Memory Used: 29 MBInit Duration: 91.66 msGet "https://cj41dl5igj.execute-api.ap-southeast-1.amazonaws.com/v1/IntegrationServices/Application/GetMessageThread/150FA9C6-D6F1-4EEC-9B8F-41FE753F8ECE?SystemClient=6d9320a0-da2a-4802-ba15-4f49842ed7a3": EOFFollowComment

Answer: "0What is the backend for your APIs? Have you tested the backend directly (without going through API Gateway) and do they work fine? If your backend is a lambda function and it gives you the same error when run directly, then try increasing the memory allocated to the lambda functionIf the backend endpoints all work fine, then I would test locally from the API Gateway AWS console next.CommentShareEXPERTIndranil Banerjee AWSanswered 10 months agorePost-User-4115978 10 months agoWell backend is .NET WebServices and it's working fine. These HTTP calls I am making from Lambda to API Gateway resource endpoints.If I directly test on API Gateway AWS console,that also correctly working.I am getting error only when I am trying to make HTTP calls from Lambda to API Gateway resource endpoints.Another thing I would like to highlight,Lambda is developed in GoLang.ShareIndranil Banerjee AWS EXPERT10 months agoI did some search on the net and found this article - http://bindersfullofcode.com/2019/02/16/golang-lambda-reuse.htmlThis may be the issue you are running into because of the way Go implements HTTP connections.Share"


Question: F1.16X Large Error - 'xrt_xocl::error'

"Hi,I referred to Multiple devices example project and updated my project to work with multiple fpga devices https://github.com/Xilinx/Vitis_Accel_Examples/tree/2020.2/sys_opt/multiple_devices. I am successful with using the f1.4xlarge instance and I am able to get the expected results.However, when I try to run inference on f1.16xlarge, it throws the following error:terminate called after throwing an instance of 'xrt_xocl::error'what():  No devices foundAbortedI tried setting the XCL_EMULATION_MODE=hw, unset XCL_EMULATION_MODE and set up the environment usingsource $AWS_FPGA_REPO_DIR/vitis_runtime_setup.shIt appears that the line in host code which corresponds to this error isauto devices = xcl::get_xil_devices();Note: the xcl2.cpp and xcl2.hpp are in ./libs folder.Kindly suggest on what I can try to resolve this problem.ThanksFollowComment"

Answer: "0Hello,Can you confirm mpd has started in this case? If not, can you run:sudo systemctl restart mpdBesides that, what OS is this running on and what region is the F1.16XL instance running in? We can help debug this further with those details.-DeepCommentShareDeep_Panswered 2 years ago"


Question: Sagemaker onboarding exceptions for IAM user - CreateDomain error and ValidationException

"I am an IAM user. The permission policies I have from the admin are IAMFullAccess, AmazonS3FullAccess, AmazonSageMakerFullAccess, and AmazonEC2FullAccess. When trying to onboard sagemaker, I get the following two exceptionsAccessDeniedExceptionUser: arn:aws:iam::123456789:user/username is not authorized to perform: sagemaker:CreateDomain on resource: arn:aws:sagemaker:region:123456789:domain/domain because no identity-based policy allows the sagemaker:CreateDomain actionandValidationExceptionAccess denied in getting/accepting the portfolio shared by SageMaker. Please call withservicecatalog:AcceptPortfolioShare & servicecatalog:ListAcceptedPortfolioShares permission.The first exception seems to indicate that I have not been given any identity-based policy that allows me to call createdomain on the sagemaker api, but as I listed at the beginning I have been given a full access policy for sagemaker and other services, and I attach the AmazonSageMakerFullAccess policy to the execution role when trying to onboard. Looking at this error online I found a suggestion to add a policy containing kms:CreateGrant and dms:DescribeKey, but it didn't help and looking at the api-permissions-reference (https://docs.aws.amazon.com/sagemaker/latest/dg/api-permissions-reference.html) I only need such things if I specified a customer managed key, which I did not. I found a question on this forum that was related (https://repost.aws/questions/QUyWQfPusnSHG6Ujfzx27o1w/sagemaker-studio-create-domain-error), but the answer seems to have listed permission policies that are needed. These are permissions I should already have in the full access policies.I created a seperate personal account and was able to successfully onboard sagemaker with no issues, so the problem is coming specifically from the IAM account and its permissions.FollowComment"


Question: Ability to stay connected to AWS console during an active session from forced logout using a token

My team has a session token set for AWS Console access that forces a logout after 60 minutes.  This occurs if the user is active or not active.  Does anyone know if there is a way to adjust this time for active sessions only?  I didn't see anything but thought I would take a stab in the dark and see if anyone has any ideas.FollowComment

Answer: "1Sure, you can customize the session timeout duration for active sessions only in AWS Console using IAM or AWS CLI. Just set the "SessionDuration" parameter to a value lower than the maximum session duration for your IAM role to allow longer active sessions.CommentShareAWS_Guyanswered 2 months ago0Hello,Greetings of the day.Thank you for reaching out with your concern in AWS re:Post.I Understand that you would like to know if there is a way to adjust this time for active sessions only.I would like to inform you that regarding AWS Console sessions initiated by IAM users or the root account, unfortunately, there is no way to customise  a session timeout at this moment; a login session will expire in 12 hours when you sign into the AWS Management Console with your AWS or IAM account credentials [1].However, when your IAM users assume IAM roles from AWS Console, it is possible to customise the session timeout for each role [2]; the session duration for IAM roles can be set from 15 minutes to 12 hours [3].I hope the above information is helpful to you.Thank you and have a great day ahead.Reference:-[1] AWS Web Console FAQhttps://aws.amazon.com/console/faqs/#session_expire[2] Modifying a role (console) - Modifying a role maximum session duration (console)https://docs.aws.amazon.com/IAM/latest/UserGuide/roles-managingrole-editing-console.html#roles-modify_max-session-duration[3] Using IAM roleshttps://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.htmlCommentSharePriya_sanswered 2 months ago"


Question: Request for addition of TLD ".nyc" to Route53

"Hi, requesting addition of the ".nyc" TLD to Route53FollowComment"

Answer: "0Hello,Currently ".nyc" TLD is not in the list of Domains that you can register with Amazon Route 53. AWS does keep adding new TLDs to the list so keep an eye on the list of officially supported TLDs.That being said, as the domain is already registered with another registrar, you can just:Create a public hosted zone in Route53: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/CreatingHostedZone.htmlGet the nameservers for this zone: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlSet these nameservers in your registrar console (often found in glue records or nameservers)Use your public hosted zone by creating recordsNote here that you can have a registrar (for example GoDaddy) different than the DNS service (Amazon Route53).See this link that explains the whole procedure: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/migrate-dns-domain-in-use.htmlHope this helps.CommentShareEXPERTTushar_Janswered 8 months ago"


Question: Deploying Lambda functions from GitHub "serverlessly" with our Code* services

"I've looked everywhere but can't find a good solution of a serverless CI/CD of Lambda functions.CodePipeline comes very close to providing that setup, except for the deployment part -- there's really no serverless way to deploy it after it's built.Any help is appreciated.FollowComment"

Answer: 0Accepted AnswerUsing CloudFormation as the deploy step can allow you to build a serverless CD pipeline for Lambda functions. There is a recent blog post and reference implementation that outlines how to put it all together.CommentShareEXPERTAWS-User-0860851answered 6 years ago


Question: how to debug site to site VPN tunnel during initial establishment

"Hey There,Is there a way do debug over a s2s VPN tunnel on AWS via CLI or something like that? I just had a site to site vpn tunnel configured with Cisco device on the other side, but the tunnels is not up. So got two questions here.how to debug a s2s vpn tunnel on AWS?can elastic IP be the local IP to access remote IP via VPN tunnel on AWS？Thank you.FollowComment"

Answer: "0There is no debug VPN option, have you seen the AWS Site-to-Site VPN logs functionality?https://docs.aws.amazon.com/vpn/latest/s2svpn/monitoring-logs.htmlElastic IPs exist outside the VPC boundary. You cannot advertise those through the VPN.As for the Tunnels not coming Up, see below Knowledge Center articles:https://aws.amazon.com/premiumsupport/knowledge-center/vpn-tunnel-phase-1-ike/https://aws.amazon.com/premiumsupport/knowledge-center/vpn-tunnel-phase-2-ipsec/CommentShareEXPERTTushar_Janswered 7 months ago0Hey Tushar,I have read the vpn logs doc, but got stuck on IAM policy change for what is called language grammar issue.Thank you for the clarification on the elastic IP use and also the articles in KB which I think would be much helpful.CommentShareedisonwang66answered 7 months ago"


Question: Unable to run ECS Task using image from ECR

"Hello all,I have an image in ECR which I'm attempting to run an ECS container for in Fargate. However, it doesn't work and always fails with:CannotPullContainerError: containerd: pull command failed: time="2021-08-11T10:51:33Z" level=info msg="apply failure, attempting cleanup" error="failed to extract layer sha256:e5b9632d4...2a9c38caa: link /var/...I cannot see any more to this error so unsure what else it says. Someone suggested CloudTrail but no errors appear in there, only calls to GetAuthorizationToken, BatchGetImage, and GetDownloadUrlForLayer loads of times. Interestingly, the SHA doesn't match any of the SHAs from ECR.I have setup permissions in ECR so that the Role which ECS is using should be able to read the image.I can successfully run the exact same setup against a docker image from the standard docker repository (mariadb:latest for example) and that works fine.Please help! Thanks in advanceEdited by: GoldieLocks on Aug 11, 2021 4:23 AM to add more clarity.Edited by: GoldieLocks on Aug 11, 2021 4:24 AMFollowComment"

Answer: 0Turns out Windows containers are not supported on fargate.CommentShareGoldieLocksanswered 2 years ago0Recently been added for support on Fargate.CommentShareJohnPrestonanswered a year ago


Question: fpga-load-local-image produces "(12) cl-id-mismatch"

"Hi there,Once I try to load my local image, I obtain the following error:$ sudo fpga-load-local-image -S 0 -I agfi-0c5a45f4871941614Error: (12) cl-id-mismatchThe vendor and device ID presented by the CL did not match expectedvalues provided at ingestion time.The clear request runs successfully before loading.$ sudo fpga-clear-local-image -S 0AFI          0       none                    cleared           1        ok               0       0x04261818AFIDEVICE    0       0x1d0f      0x1042      0000:00:1d.0Describe request after failed load attempt is the following:$ sudo fpga-describe-local-image -S 0 -HType  FpgaImageSlot  FpgaImageId             StatusName    StatusCode   ErrorName    ErrorCode   ShVersionAFI          0       none                    load-failed          7        cl-id-mismatch        12       0x04261818Type  FpgaImageSlot  VendorId    DeviceId    DBDFAFIDEVICE    0       0x1d0f      0x1042      0000:00:1d.0What am I missing here? How can I resolve this issue?FollowComment"

Answer: 0This was a duplicate of another question I asked.CommentShareyonselyukselanswered 2 years ago


Question: SNS is not delivering text message to particular mobile carriers since a few days ago

"I have a toll phone number in AWS Pinpoint (registered and in production mode) to send Transactional messages and since a few days ago our clients in Costa Rica are not receiving the messages (however in October the messages arrived successfully). In my SNS dashboard the SMS to Costa Rica are in Sent state (we contact in Costa Rica with a Mobile Phone carrier and no restrictions were detected in our clients phone numbers). Where is the point when the flow is broke? or I have to pay to AWS for a technical support plan to report this issue in the infrastructure, a wrong behavior that is not a bad implementation of the user, is a service that a day starts to work in an unexpected way? Also some other users in this forum are reported similar issues in the last days.FollowComment"


Question: How to delete queue in AWS Connect

"In AWS Connect, is there a way we can find queues that are not used (usage report) and then remove the queues that are not wanted so that we stay in the service limits for Queues allowed for an instance ? These are not the SQS but the generic queues used to route calls in AWS ConnectFollowComment"

Answer: 1There is not currently a way to delete queues in Connect.  You could optionally rename the queue for re-use.  You can also request a service limit increase on the number of queues for your instance by accessing Service Quotas.https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-service-limits.htmlCommentShareAWS-TimGanswered 8 months agoEXPERTAWS-samfredreviewed 2 months agoCloud9 8 months agoI agree. Those two options were already accomplished for the immediate use but was looking forward to a way to clean up to keep the total queue numbers low so that it stay under the initial provided service limit. Thanks for respondingShare0A way to find unused queues is by running an historical report against those queues and identify those which to not have any calls on it.This way you can also ensure that they are not used only very infrequently.CommentSharefaddianswered 8 months ago


Question: Easy way to get SES Sending Stats per Domain

"Hi, anyone know an easy way to get SES email sending stats on a per-domain basis?  E.g. in CloudWatch.  I'm looking to delete a domain but want to check it's not being used first.FollowComment"

Answer: "1Accepted AnswerHelloRegarding this: an easy way to get SES email sending stats on a per-domain basis?Yes, you can follow this blog,https://aws.amazon.com/blogs/messaging-and-targeting/introducing-sending-metrics/and thenhttps://docs.aws.amazon.com/ses/latest/dg/event-publishing-add-event-destination-cloudwatch.htmlRegarding this:I am looking to delete a domain but want to check it's not being used first.If you are not using configuration set in the first place, by default, SES won't able to provide cloudwatch metrics on domain basis.you can use AWS CLI to view available metrics% aws cloudwatch list-metrics --namespace "AWS/SES" --region us-east-1Hope that helps!CommentShareAWS-User-6819265answered a year ago"


Question: when to use ECR in lambda ?

"I want to host a python code based service in Lambda behind API GW. AFAIK, there are 2 approaches to deploy the code to Lambda.simply zip the code and upload to S3 and link with the lambda functioncreate ECR images and deploy it with lambda function.Are there any guidance on when to use ECR ? and when to use simple code zipping ?What are the pros and cons of each approach ? Some leads on this topic will be super helpful.FollowComment"

Answer: "2You usually will use the container option in one of the following two cases:You need a function with a package size larger than 250MB unzipped (containers support 10GB)You are already using containers in other places and would like to use the same tools you are using for containersIn other cases I would just use the zip file approach.CommentShareEXPERTUrianswered a year agoNavin GV a year agoCan we just simply use Container for all lambda as a default pattern ? Assume a case, the team uses containers for all old services. What will the value/advantage in using zip for new service or refactor the container based app to code-zip ?ShareUri EXPERTa year agoYou could use a container for all functions, but note that you don't just take your old code and run it in a container. When running in Lambda you need to include the Lambda handler, which will be invoked when the function is triggered. You will need to move to stateless, etc.Share2It also comes down to how you want to manage language runtimes. In AWS Lambda, container image packaged functions are similar to Zip files, but the customer is responsible for more artifacts, including the runtime, in the container image. If you take advantage of container packaging, the shared responsibility model for Lambda shifts, with the customer now being responsible for managing from the base image up. Since container images contain language runtime libraries, using a container image to package Lambda functions prevents Lambda from automatically updating the language runtime.CommentSharejimmyrayanswered a year agoNavin GV a year agoCan we just simply use Container for all lambda as a default pattern ? Assume a case, the team uses containers for all old services. What will the value/advantage in using zip for new service or refactor the container based app to code-zip ?Share"


Question: AppStream: Your session is taking longer than expected to prepare - fails

"I have an on-demand fleet.When starting as user I get the normal 2-minute start up timer.About 10% of the time this works fine providing a streaming session.  90% of the time I get the message "Your session is taking longer than expected to prepare"  Then 10% of the time after this the session starts as normal.90% of the time when I get the "Your session..." the session appears to hang with no user message.Looking at fleet usage it looks like the system thinks it is running but then eventually times out and user has to start over.This has been working flawlessly for several years.  I'm at a loss as to what is going on and how to proceed.Any words of wisdom from anyone?Thanks.Paul===================== editing question 1/19/22 based additional date gatheringSince initial post have been attempting to construct an example to take to support.Here's where I am at the moment.Summary -- 20% of login attempts result in 20-minute delay.Any thoughts before going to support?Thanks, Paul===========================See below for user view of issue and fleet view of issue.Fleet Info...Always on does not failOn-demand fail rate perhaps 20% resulting in 20 minute login delayOn Demand Fleet Configuration (all defaults taken during fleet configuration)...Instance typestream.standard.largeFleet typeOn-demandStream viewAppMaximum session duration960 MinutesIAM roleNoneDesired Capacity1Disconnect timeout15 MinutesIdle Disconnect Timeout15 MinutesMinimum capacity1Maximum capacity5Scale In Policiesdefault-scale-in:If Capacity Utilization <= 25 % then remove 1 instance(s)default-scale-out:If Capacity Utilization >= 75 % then add 2 instance(s)Scheduled Scaling PoliciesTypical fail experience =================================:User view =======:21:04Attempt to login, session taking longer.Being prepared.Taking longer.Being prepared.Taking longer.Being prepared.No streaming resources available, Retry.Session expired, OK.21:11Attempt to login.No streaming resources available, Retry.Repeated retries.21:23Normal login sequence.Session being prepared, Connecting, Application Available, Loading app settings22:14LogoutFleet view ======:Fleet Usage Log:21:03 Actual 1 Inuse 0 Desired 1 Available 0 Pending 021:04 Actual 1 Inuse 1 Desired 1 Available 0 Pending 021:06 Actual 1 Inuse 1 Desired 3 Available 0 Pending 221:10 Actual 0 Inuse 0 Desired 3 Available 0 Pending 321:23 Actual 2 Inuse 1 Desired 3 Available 2 Pending 121:24 Actual 3 Inuse 1 Desired 3 Available 2 Pending 022:14 Actual 3 Inuse 1 Desired 3 Available 2 Pending 022:15 Actual 2 Inuse 0 Desired 3 Available 2 Pending 122:35 Actual 2 Inuse 0 Desired 1 Available 2 Pending 022:36 Actual 1 Inuse 0 Desired 1 Available 1 Pending 0FollowCommentPaulv45 a year agoUpdated question adding details in preparation for submitting to support.  Your wisdom welcome.  PaulShare"

Answer: "1Do you have app settings persistence enabled for the stack? Try disabling that. If that works, it's the downloading of that VHD that is causing the issue. Do you have a S3 VPC Endpoint Gateway and configured Route Table entries for your AS2 subnets? Did you check the resource policy assigned to the endpoint? What is the bucket policy?CommentShareEXPERTStevieStetsanswered a year agoPaulv45 a year agoThanks for jumping in, Stevie.  Yes app setting persistence enabled.  Will take a shot there next.SharePaulv45 a year agoDisabling app settings persistence seemed to have no impact on situation.Next step is to see what AWS support has to say as noted by Till.Will do that and report back here -- likely after 1/5/22.Thanks.PaulShare0Hi Paul,we had this multiple times as well in different setups. To eliminate possible trouble sources, it would be great to tell us more about the setup.Is it a domain-joined fleet? Any GPOs attached to the OU and/or user?Does it work with always on enabled?Did you apply any workarounds like extending the size of the VHD file?If not - what did the AWS support say? Unfortunately the instance pool is managed by AWS so we've only limited view to the most components...Kind regards,TillCommentShareTillanswered a year agoPaulv45 a year agoThanks for your answer/suggestions, Till.Nice to hear I'm not alone.took the defaults for everything when creating so guessing not domain-joined fleet and no GPOs attached.Good thought on trying always on -- will give that a whirl.While have been at this for multiple years, still would be classified as newbie so don't know what extending VHD file means, but will check in to.Have not yet contacted support -- trying here to see if can get better feel for what's happening before going to support.Thanks.  PaulSharePaulv45 a year agoIndeed always on works flawlessly which is good but not shocking.  Looking as Stevie suggestion next.Share0I have worked on this issue for several weeks with Amazon Support.It is very challenging to duplicate the problem in any consistent way.Amazon Support helped me understand the nature of the issue but we have not yet resolved the issue completely.  There are many different tools available to understand the problem more fully and we have exercised some of these.  Rather the beating our heads against the wall for a complete solution, we have developed a problem avoidance strategy I plan to use for the moment.I am just getting started with supplying my application to my users via AppStream.  I am using On-demand fleets.  Following mostly fleet configuration defaults, I had set minimum capacity to 1.  This is problematic in the situation we are dealing with here.  I set it to 2 instead at a cost of $19/month for the extra capacity.  While there is no guarantee the second instance of the stack will not have the same problem, at least it is an attempt to avoid the issue.There are many other fleet configuration parameters such as Scale Out and Scale In Policies available and tools such as CLI to work further.  I have looked at these a bit under the guidance of Amazon Support, but am not currently planning to use anything other than setting minimum capacity to 2.Along the way I learned...Logging out from a session moves the session from InUse to Pending, not to Available as you my expect.Transition from Pending to Available is about 20 min.These facts were key in identifying the workaround proposed.Using minimum 2 enables my message to users to be:On some occasions when you attempt to login, the startup sequences appears to hang.  When this happens, you will see the amazon AppStream 2.0 normal startup screen with no additional information supplied and no user interaction requested.Workaround 1:Totally quit the browser being used.  Then restart the browser and execute the normal AppStream login process.   Note that opening a new tab/window in current browser session will not resolve the issue.  You must totally quit the browser which will result in killing all current browser sessions.Workaround 2:Start AppStream in a different browser(e.g. if hung in Chrome, access from Firefox instead).Here is more detailed info from Amazon Support...To summarize the suggested work arounds, we mentioned the following:1.Increasing the minimum number of instances based on sage.2.Using a scheduled scaling policy.3.Using the Insufficient Capacity Error policy and launching instances based on alarm.4.Clearing the browser for cache and allowing enough time for instances to move from the pending to a running state before connecting to a session.5.Switching over to the old console and adding the auto-scaling rules again.6.Run commands using he AWS CLI to clear the user session.Hope others find this info helpful.PaulCommentSharePaulv45answered a year ago"


Question: GraphQL API subscribe() call returns Unauthorized exception with JWT token

"Hello,customer is building an app that uses Cognito User Pools federated with on-prem  Central Authentication Service (CAS) via SAML. This provides JWT tokens.With this token they are calling GraphQL API from AppSync implemented via Amplify with DynamoDB. They are using "aws-amplify" library for this.There are no errors when the call is a query or mutations. For example:API.graphql(graphqlOperation(<some query here>, {}, <token>)).then((res) => (....)But there is an exception if the call is of type "subscribe", example:API.graphql(graphqlOperation(<some subscription name here>, {}, <token>)).subscribe({next: (data) => (....)message: "Connection failed: UnauthorizedException"I can provide more details or arrange a customer call if anyone is eager to help out with this issue.FollowCommentMassimilianoAWS EXPERT5 months agoHow is the graphql schema defined and how has authorization been setup?Share"


Question: Passing VAST tag parameter values for MediaTailor Channel Assembly FAST Channel Programs

"Hi,I would like help with setting up the right VAST parameter values for targeting MediaTailor Channel Assembly FAST Channel Programs.Suppose, I've setup a Channel Assembly FAST Channel with 2 Programs (A and B). Program A has 2 mid-roll ad breaks. Program B has 1 mid-roll ad break. Channel is configured to play these 2 programs after each other in a loop. That is,**Program A -> Program B -> Program A -> Program B ... and so on in loop**I see that there are these 3 parameters ("splice_insert.avail_num", "splice_insert.splice_event_id", "splice_insert.unique_program_id") available when setting up an ad break in a Program.Which of these should be used for distinguishing between Program A and B? And, which of these should be used for identifying a specific mid roll ad break (say, 1 or 2) within that program?Also, could these be values be passed as parameters in VAST tag to Ad Server? For example, I want to use these parameters passed in the VAST tag to target the 2nd mid-roll ad break in Program A.Thanks.FollowComment"

Answer: "0Hi,The values that are used for the splice_insert parameters in Channel Assembly are sent through to the server side ad insertion (SSAI) in the form of the session variables. For example, in Channel Assembly, splice_insert.avail_num becomes [scte.avail_num] in SSAI. Based on what you are trying to do, we would recommend one of the following:Channel Assembly's splice_insert.splice_event_id > SSAI's [scte.event_id]orChannel Assembly's splice_insert.unique_program_id > SSAI's [scte.unique_program_id]For more information on the SSAI session variables, please review https://docs.aws.amazon.com/mediatailor/latest/ug/variables-session.htmlPlease let us know if you have further queries or concerns on this. Thank you!CommentShareSUPPORT ENGINEERIsha_Panswered a year agom1rr1ad-user a year agoHi,As per the example in my question, can you please clarify which of these 3 (splice_insert.splice_event_id or splice_insert.unique_program_id or splice_insert.avail_num) should I be using todifferentiate between Program A and B? 2) differentiate between the mid-roll ad breaks (1 or 2) in Program A?And, is it possible to pass the AssetID values for these FAST Channel Programs to VAST tag? Anything similar to the asset.CAID macro?Thanks!Share"


Question: AWS SNS - Unable to send SMS

"Hello, i am unable to send SMS's from AWS console on AWS SNS Service.Details:Reagion: us-east-2SNS Account status: sandboxTrying to send SMS to: Mozambique countryPrefix Number: +258FollowComment"

Answer: "1Have you added the phone number you're trying to send to as a verified destination number?Since your account is in the sandbox, you'll only be able to send to numbers you've previously verified.https://docs.aws.amazon.com/sns/latest/dg/sns-sms-sandbox-verifying-phone-numbers.htmlCommentShareEdanswered a year agorePost-User-4622105 a year agoYes, i did it first.Share"


Question: FlexMatch pricing

"https://aws.amazon.com/gamelift/pricing/GameLift FlexMatch usage is included in the fees for GameLift if you host your games on GameLift servers.Does this mean that FlexMatch is free if I let GameLift / GameLfit Realtime manage my server instances?GameLift FlexMatch usage will be charged separately if you host your games on any other game server solution, including on-premises, peer-to-peer, cloud compute primitives, and GameLift FleetIQ. You are charged based on the number of Player Packages you submit and the number of Matchmaking Hours you consume.Some rough analyticsBreak into two groupsShort session game (mobile PVP):  2 mins game session, 1 min idle interval, 1v1 gameplay.Long session game (PC PvP): 10 mins game session, 2 mins idle interval, 10v10 gameplay.match requests (player packages) / sec = CCU / (game session length + player idle interval)match hours = match requests / player-per-match * match window / 3600Short sessionCCUsession length (mins)idle time (mins)match requests/secmatch requests/momatch requests $players/matchmatch window (secs)match hoursmatch hours/mo $50310.21540,0001025375370600312.506,480,000129254,5004,4952000318.3321,600,0004312515,00014,99550003120.8354,000,0001,0792537,50037,495100003141.67108,000,0002,1592575,00074,995Long sessionCCUsession length (mins)idle time (mins)match requests/secmatch requests/momatch requests $players/matchmatch window (secs)match hoursmatch hours/mo $501020.07180,0003201025206001020.832,160,00042201030029520001022.787,200,00014320101,00099550001026.9418,000,00035920102,5002,4951000010213.8936,000,00071920105,0004,995For the short session game, it doesn't make sense at all - way more expensive.For the long session game, it may be affordable. Because this genre usually gains higher LTV.Well, it's good to have FlexMatch as a free addition to Gamelift services (if it is). But as a standalone service, it's just too expensive.The estimation is rough, it assumes the CCU is a constant for 7x24x30. But you can just half the CCU number to get the point. Please let me know if it's not good, or am I missing something obvious.FollowComment"


Question: Getting User Utterance as Text in Amazon Sumerian

"I have a Sumerian Host that acts basically as a front-end for a Lex chatbot.However, in some cases, I need to to some processing based on the actual user utterance (that is, the text of what the user says). Is there a way I can use "Send Audio to Lex" action (or a different one) to get a text version of the user audio (so, to perform speech-to-text)?FollowComment"

Answer: "0Accepted AnswerHello Maxi,If you are looking for only transcribing a user input, Amazon Transcribe would be a better fit. However, if you are looking for doing some processing of the user input, in context of the bot, you can hook a Lambda function in a bot, and use "inputTranscript" field to get the text  of what the user said.ThanksCommentShareswapandeepatawsanswered a year agoKris a year agoMaxi, do you want to do the additional input text processing on the client side (inside of Sumerian using JavaScript) or on the server side? If you want the processing to happen on the server side, then the answer swapandeepataws provided is good. However, if your goal is to do some processing on the client side directly in Sumerian, that's possible, too. Let me know if that's your objective. I'd be happy to provide some sample code.ShareKris a year agoAlso, a clarification on swapandeepataws's answer. Amazon Sumerian doesn't offer direct integration of Amazon Transcribe as it does for Lex and Polly. If you want to integrate Transcribe with Sumerian you can, but it requires linking the AWS JavaScript SDK into your Sumerian project and writing custom JavaScript code to interact with that SDK.ShareMaxi a year agoThanks Kris, saw your comments too late, but as you can see it is solved.ShareMaxi a year agoHi! I added the lambda and used the "inputTranscript"  as you suggested and it works fine.JFYI, as I want to always have a transcript on Sumerian side, I created a bot with a "fake" intent that has only one utterance that is never matched. I added a AWS.FallbackIntent which calls my lambda function. The Lambda simply retrieves "inputTranscript" and returns in into a properly formatted Lex reply (https://docs.aws.amazon.com/lex/latest/dg/lambda-input-response-format.html).The result is that, whatever the user says, the fall back intent is always activated, which calls the Lambda, which returns user utterance as message. I can then take the message and process it in any way I want.Thanks for the hint.Share"


Question: Secure ALB access only from Amazon CloudFront

"My customer is migrating from on-premises and asked me how to secure ALB access only from Cloudfront. We have a blog post on this subject (based on security group auto updates). But at the beginning of this post it is mentioned:Note from December 3, 2019: The features and services described in this post have changed since the post was published and the procedures described might be out of date and no longer accurate. If we update this post or create a replacement, we’ll add a notification about it here.Do we have a new solution for this ?FollowComment"

Answer: "0Accepted AnswerOne more way to prevent users accessing your ALB directly is make use of Custom Headers on CloudFront and WAF on ALB.Step1: Configure CloudFront to add custom header to the requests going via CloudFront.Step2: Attach AWS WAF to ALBStep3: Create "String Match" rules/conditions on the WAF to allow requests if and only if the request has the custom header added by CloudFront and block the requests if the header is not present.On CloudFront,Edit OriginIn"Origin Settings",  add a Custom header with key(can be anything)  "X-Origin-Header" with some alpha numeric secret as value which the CloudFront will add to the request passing through it.On the ALB,Add AWS WAF on the ALB and create a "String Matching" condition with "Header" key as "X-Origin-Header" and value which you have entered in on the CloudFront distribution.Add this condition to the rule and add the rule to the WebACL on the ALB.Lifecycle of the request:Here, when ever a user tries to access the application via CloudFront, a custom header with a secret string value is added to the request and the WAF which is infront of the ALB will forward the requests to the ALB if and only if the request has the custom header passed by CloudFront.If a user tries to access the ALB directly, the request will not contain the customer header and will be blocked by WAF with a 403.For more information, please refer to this article and let me know if you need any clarifications.The main advantage of this method is that you don't have to deal with frequent change in CloudFront IP address changes.CommentShareSaiJeevan_Danswered 3 years ago"


Question: Best approach for CodeBuild job in Account A that applies migrations to private DB cluster in Account B?

"Hi,I am a little confused on what's required for this setup to work.I have two account Tooling account(Account A) and a Dev account(Account B). Account B has a db cluster(private isolated subnet) and have configured its security group to allow access from IP address associated with target region of CODEBUILD - https://ip-ranges.amazonaws.com/ip-ranges.jsonThis of course is not sufficient alone since db cluster is in a vpc and not just that- different account as well.Error: connect EHOSTUNREACH <addressIp>3306    at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1187:16) {  errno: -113,  code: 'EHOSTUNREACH',  syscall: 'connect',  address: <addressIp>  port: 3306,  fatal: true}Could you please point me to the steps I'd have to take in order to be able to connect to it from CodeBuild ? I cannot seem to have any relevant documentation on what I am trying to achieve, beside just VPC support section on AWS - https://docs.aws.amazon.com/codebuild/latest/userguide/vpc-support.html . I do have a bastion host so the team can connect to it locally.  Do I have to setup another VPC in Tooling account and do VPC peering between VPC in Account A and Account B ?I am using CDK to deploy infrastructure and for the pipelines as well.Any suggestions are greatly appreciated.FollowComment"

Answer: 0Using IAM Roles to manage the cross account access should sort out these issues.  AWS has some documentation here that provides a rough example that you may be able to use as reference.CommentSharedave-learning-awsanswered 8 months ago