Question: DMSStack-DMSRole-xxxx/dms-session-for-replication-engine is not authorized to perform: secretsmanager:GetSecretValue

"I'm trying to test endpoint connection from DMS Replication Instance,DMS (3.4.7) RI instance (running in Acnt A) is attempting to get a secret from SecretsManager (running in Acnt B) using VPC Interface endpoint,  but errors out with the following.Test Endpoint failed: Application-Status: 1020912, Application-Message: Failed to retrieve secret. Unable to find Secrets Manager secret, Application-Detailed-Message: Unable to find AWS Secrets Manager secret Arn 'arn:aws:secretsmanager:us-east-1:acntBbbbbb:secret:/dmsdemo/aaaaa-<erandomStrng>' The secrets_manager get secret value failed: User: arn:aws:sts::acntAaaaa:assumed-role/DMSStack-DMSRole-zzzzzzz/dms-session-for-replication-engine is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:us-east-1:acntBbbbbb:secret:/aaaaa-<randomStrng> because no session policy allows the secretsmanager:GetSecretValue action Not retriable error: <AccessDeniedException> User: arn:aws:sts::acntAaaaa:assumed-role/DMSStack-DMSRole-zzzzzzz/dms-session-for-replication-engine is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:us-east-1:acntBbbbbb:secret:/dmsdemo/aaaaa-<randomStrng>' because no session policy allows the secretsDMSRole{"Version": "2012-10-17","Statement": [{"Action": ["secretsmanager:GetSecretValue","secretsmanager:DescribeSecret"],"Resource": "arn:aws:secretsmanager:us-east-1:acntAaaaa:secret:/dmsdemo/aaaaa-<randomStrng>","Effect": "Allow"},{"Action": "kms:Decrypt","Resource": "arn:aws:kms:us-east-1:acnt:key/ddddddddddd","Effect": "Allow"}]}Resource Policy on Secret{"Version" : "2012-10-17","Statement" : [ {"Effect" : "Allow","Principal" : {"AWS" : [ "arn:aws:iam::acntAaaaaa:root", "arn:aws:iam::acntBbbbbbb:root" ]},"Action" : [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ],"Resource" : "*"} ]}Any thoughts on what was missing in permissions that is restricting the access to secretFollowComment"

Answer: 0it seems you are accessing secrets in account B from account A which is hosting the dms instance.I would suggest having secret/secretIAMrole/dms in one account say A while the credentials/endpoint details as defined in secret could be of acct B.CommentShareAWS-User-8174525-subhashanswered 8 months agorePost-User-0396193 8 months agoSecrets Manager can be in any account. GetSecretValue should not fail. The same scenario was working with Previous DMS engine 3.4.6ShareAWS-User-8174525-subhash 8 months agoIn that case i would suggest opening a case with support to check this.SharerePost-User-0396193 8 months agoSure thingShare


Question: how to create snapshot routine in AWS

"When generating a crontab it tells me that the crontab I typed is not valid. I need it to generate from Monday to Friday from 10 to 22 UTC, every 10 minutes.Can anyone help me?I tried this crontab:0/10 10-22 ** ** MON-FRI *FollowComment"

Answer: "0Accepted AnswerIt is not quite clear your cron is running within your on-premise Linux-dist, or you are generating the cron in AWS native cloudwatch rule for snapshot. I believe the later scenario is more AWS-style. If yes, the correct syntax is 0/10 10-22 ? ** MON-FRI ** (It should be ? if you need any day of Month/Week)CommentShareharshmanvaranswered 4 years ago"


Question: "When the EC2 instance status check is normal, the Linux terminal cannot be connected"

"AWS EC2 instance status check is successful, but the Linux terminal cannot be connected via SSH.And the self-built MySQL database is also down.According to the system log and MySQL error log, there is no abnormality. Similar problems have occurred before, and finally the instance needs to be restarted to solve it.I want to know what caused it so that I can avoid the same problem from happening again in the future.Best regards,Thanks!FollowComment"

Answer: "0What instance type are you running? My guess would be the MySQL workload is gradually consuming more and more resources until it's reached a point that there's nothing left, and as a result the host is basically hanging.Check the Monitoring tab for the instance in AWS Console, is there anything that looks like a cause for concern?Unfortunately the EC2 section of the AWS Console doesn't display metrics for memory use, you'll need to setup CloudWatch agent to collect these https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Install-CloudWatch-Agent.htmlCommentShareRWCanswered 25 days ago0r5.2xlarge,But no problems were found by checking /var/log/message, such as "OOM",,,CommentSharerePost-User-6695411answered 25 days ago"


Question: FHIR works on AWS server not allowing to keep customized id as primary key

"We are working for FHIR(Fast Healthcare Interoperability Resources).We have followed “FHIR works on AWS” and deployed the CloudFormation template given by AWS in our AWS environment.Following is the template that we have deployedhttps://docs.aws.amazon.com/solutions/latest/fhir-works-on-aws/aws-cloudformation-template.htmlRequirement : we want to maintain client specific/customized ids as primary key in the server.Problem : server not allowing us to override or mainain client specific (customized ) ids as primary key .Infact , in the runtime, it is generating its own ids and ignoring the id given by us.FollowComment"

Answer: "0Hello,I suggest posting this directly in the "issues" section of the solution's github repository:https://github.com/awslabs/fhir-works-on-aws-deployment/issuesCommentShareAWS-ADolganovanswered a year ago"


Question: Unable to connect to website after lightsail restart

"Hi, I Successfully created a lightsail LAMP instance connected it to Cloud9 via SSH following all the instructions.  Got  PHPmyadmin going via putty etc. All great, changes in cloud 9 updated via live site on public IP and could update mysql database via PHP ect on Cloud9  - wonderful.I then stopped the lightsail instance, restarted but would not connect to new Public IP.Changed to Static (so if i would re-connect it after another stop/ restart) but still won't connect. Re-did all my putty setting so can access PHPmyadmin just in case (never know)- only thing remaining is for the app to run via  (now static) IP - just get: This site can’t be reached.I've probably missed something fundamental. Any help please:? :)Edited by: LDG23 on Apr 10, 2019 8:15 AMEdited by: LDG23 on Apr 10, 2019 8:25 AMFollowComment"

Answer: "0Reboot button on Lightsail page sorted it. Should have thought really if anything like my router :) More relevant to Lightsail than cloud 9 but hey ho, wasn't sure where the problem was and i followed so many steps to get this set up i feared the worse. (the documentation  well written however). Happy with results at the moment; essentially now have what i had in c9.io! i think :)CommentShareLDG23answered 4 years ago"


Question: Adding Storage Gateway to AD Domain via CLI

"HiWe have a problem with Storage Gateway joining the domain via CLI (version: aws-cli/1.16.93 and aws-cli/1.16.90).When we run the following command "$ aws storagegateway join-domain....", it returns:An error occurred (InvalidGatewayRequestException) when calling the JoinDomain operation: The gateway cannot connect to the specified domain.This is the command we used:aws storagegateway join-domain --gateway-arn arn:aws:storagegateway:<region>:<account-id>:gateway/<gateway-id> --domain-name <our-domainname>  --organizational-unit "OU=<our-ou-name>,DC=<our-domain>,DC=COM --domain-controllers <our-dc-ip> --user-name <username> --password <password>Could someone help us debug why we are unable to join the Domain?We already checked the following:-Specified DC is reachable and necessary ports are opened-All traffic inbound/outbound allowed between Storage Gateway and specified DC-Storage gateway can resolve Domain Name-DHCP Options Sets specify correct DC and domainname in search list-The user and/or OU has right to join the domain-The user and password is correct-Other windows instance which is in same subnet and same security group can join the domainAdded additional reachable DCs to the domain-controllers list, and the problem remainsThank you,FollowComment"

Answer: "0Please check the logs on your Domain Controller/AD for any errors? Most probably the error is being returned by your DC/AD. You can also capture the network packets while you are executing the "join-domain" operation to confirm that the error is returned by the DC/AD.Can you please PM me your Storage Gateway ID & the Region?CommentShareShashi-AWSanswered 4 years ago0Hi shashi-AWS,Thank you for your advise.After discussion with our DC/AD admins, we found error log in event viewer.-> Event Id:16642, Directory-Service-SAM, The account-identifier allocator was unable to assign a new identifier.It was because DC in AWS does not have connectivity with FSMO role holder DC. After we switched site2site VPN to other site which has DC with FSMO role, successfully storage gateway could join the domain with same command I posted initially.Again, thank you for your help.CommentSharettakatsukaanswered 4 years ago"


Question: issue  to create volume from snapshot using in-build step function

"using step functions "create volume" (arn:aws:states:::aws-sdk:ec2:createVolume.waitForTaskToken)  I  want to create a  volume from encrypted snapshot, but step fucntion  It never get resume or not throwing any error.  It keep running for ever!I have  already passed availability zone, kmskeyId,  encrypt=true, snapshot id, size, type , but it keeps running  for ever.  I have also  allowed  full access  of EC2 and also allowed  full access of KMS to  step function. but still it is not  working.FollowComment"

Answer: "0One way to troubleshoot would be to build a test user in IAM with admin rights (Delete this user when done with the test)Try your step function with these enhanced rights. If it now works . . .Use IAM Acccess analyser to build a policy that has all the needed access.https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_generate-policy.htmlCommentSharetedtrentanswered 6 months ago0I'm sorry to hear that this was confusing, but the feature is working as expected. Please see the help link below. The .waitForTaskToken integration pattern allows you to pass a token to a the target of a Task that you then need to call back to Step Functions with (using the SendTaskSuccess, SendTaskFailure, etc API Actions). In the meantime, the workflow execution will wait.https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-tokenI believe what you expected was the behavior of the .sync / Run A Job integration pattern. Unfortunately, this is only available for a select set of API actions via Optimized Service Integrations.https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-synchttps://docs.aws.amazon.com/step-functions/latest/dg/connect-supported-services.htmlGiven we do not have such an optimized integration for ec2:createVolume, I suggest you consider using a job-poller-pattern to check for status and continue the workflow.https://docs.aws.amazon.com/step-functions/latest/dg/sample-project-job-poller.htmlA handy approach is to encapsulate this in a separate state machine that can be called using the .sync service integration for Step Functions so you can reuse it in different workflows. You can see that approach in action in this blog post:https://aws.amazon.com/blogs/compute/orchestrating-aws-glue-crawlers-using-aws-step-functions/CommentShareJustin Callisonanswered 6 months ago"


Question: ECS Service Connect LogConfiguration SecretOptions Usage

"I'm looking to migrate services from AppMesh to Service Connect, and ran into an issue with the log configuration in my template which looks something like this:"ServiceConnectConfiguration": {     "Enabled": true,        ..."LogConfiguration": { "LogDriver": "awsfirelens", "SecretOptions": [  {   "Name": "apiKey",   "ValueFrom": { "Fn::Join": [ "", [ "arn:aws:ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter/my/key" ] ] }  } ]},This results in the following error:Resource handler returned message: "Invalid request provided: CreateService error: TaskDefinition#logConfiguration The Systems Manager parameter ARN has a different account ID than the current account. The current account ID is null and the ARN account ID is #####. Cross-account access for ARNs is not currently supported. (Service: AmazonECS; Status Code: 400; Error Code: InvalidParameterException; Request ID: #####; Proxy: null)" (RequestToken: #####, HandlerErrorCode: InvalidRequest)This logConfiguration is the same as what had been on the envoy container.  Is this null account id something that could be changed in how Service Connect scaffolds this out?**Edit: ** Hardcoding the value:"ServiceConnectConfiguration": { "Enabled": true, "LogConfiguration": {  "LogDriver": "awsfirelens",  "SecretOptions": [   {    "Name": "apiKey",    "ValueFrom": "arn:aws:ssm:us-east-1:####:parameter/my/key"   }  ] }Results in the same error. The parameter in question is a SecureStringFollowComment"

Answer: "0From the issue description I understand you are looking to migrate your service from AppMesh to ServiceConnect and in the template snippet the parameter ARN is specified with environment variable for region and account ID.The shared error indicates that the SSM parameter ARN is different from current account which indicates its null. Furthermore, the account ID's needs to be the same as SSM parameter ARN as cross account support is not currently supported.Based on this data, it seems the template is not pulling the account ID as it set as null, can you confirm how the account ID variable is setup in the cdk template?Based on the environment variable this seems to be pulling a ENV from CDK, can you confirm if the ENV is setup with the correct values?With regards to envoy containers the instance metadata can be used to extract the account ID which does not require it to be set as an ENV. Thus this should work on container without any issue. The service connect is not the error prone component but rather the account ID not being setup in the CDK ENV. Please refer to  https://docs.aws.amazon.com/app-mesh/latest/userguide/proxy-authorization.html for more info about instance metadata.I would also like to take the opportunity to advise I am an engineer from ECS and do not work on CDK. I did however setup a lab with CDK using literal values for the region and account ID and I was able to deploy successfully, when trying to use ENV my code failed to synthesize. I would recommend reaching to CDK team to understand how to pass the account variable correctly to avoid the null results.CommentShareBohlale_Manswered 5 months agoJohn_Y 5 months agoSorry, I should have made the example more concise: I've updated the question to include the actual cloudformation stack values opposed to cdk code.  Like I mentioned the block of code is identical between the original envoy setup and the new service connect setup, so there shouldn't be any issues with the account id.It seems like there's an issue with service connect being able to read secure strings (or maybe any SSM parameters).  From it's perspective it's running in some sort of context that does not have an account id.ShareJohn_Y 5 months ago@Bohlale_M - any thoughts on the updated details in the question?  In your lab example, were you using a securestring parameter in that secretoptions section?Share0For now I've updated the parameter store value to String from SecureString, and added the value as an inline resolveCommentShareJohn_Yanswered 4 months ago"


Question: Does ALB send SNI information in TLS handshake to a back-end server

"I am trying to setup HTTPS end-to-end connection from my browser to a server running on an EC2 instance through ALB. The front-end connection from my browser to ALB goes through fine. But, the ALB to back-end TLS handshake fails as server_name extension (SNI information) is not sent by ALB during TLS Client Hello handshake (as I see in packet-capture).Is there a way to forward SNI information received from front-end https connection by ALB to the back-end https connection too?FollowComment"

Answer: "0Hello,You mention that you are trying to send SNI information to your backend by the means an ALB.As you mentioned the load balancer does not forward the SNI to the respective targets when the connection is between the load balancer and the target over TLS. The Application Load Balancer does not look for a domain name when processing the TLS handshake with the backend. It is merely there to make sure that you have a valid certificate with the accepted ciphers.The solution to workaround it would be:1. Use a NLB with a TCP:443 listener which would pass the SNI extension specified by the client to the targets[1].2. Making use of ALB SNI abilities to check the Domain name and then forward to different target groups [2].References:[1] https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-listeners.html#listener-configuration[2] https://aws.amazon.com/blogs/aws/new-application-load-balancer-sni/CommentShareAntonioanswered a year ago"


Question: EMR Notebook Box API Integration Issue

"Hi Experts, I am trying to use box.api in the EMR Notebook (SparkR Kernel) and using http proxy on the EMR host to route traffic to internet. The connection to box.api.com is established on the EMR server by setting up the http_proxy environment variable, but I am unable to connect to internet from the EMR Notebook as the http_proxy environment variable doesn't seem to be set for the Notebook users.Any hints how to set the global environment variable (http proxy) on the EMR server for all EMR Notebook users?The EMR notebooks seem to be running in a docker image. I also tried setting up global environment variable in /etc/profile.d, but no luck.FollowComment"

Answer: "0Hi, Thanks for writing to re:Post.I Understand that you want help in connecting Notebook to Internet.To enable access to internet via the notebook, you will need to check if there is a security group named 'ElasticMapReduceEditors-Editor' or else create new security group for 'ElasticMapReduceEditors-Editor' with the following ingress and egress : [1]===========================Inbound:NoneOutbound:Allow the notebook to route traffic to the internet via the cluster, as the following example demonstrates:Type                             Protocol    PortRange   DestinationCustom TCP rule        TCP                18888            SG-HTTPS                         TCP                 443                0.0.0.0/0This should help in connection to the Internet through your notebook.I hope you find this information helpful.Thank you and have a good rest of your day![1] https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-security-groups.htmlCommentShareSUPPORT ENGINEERMudasser_Aanswered 4 months agorePost-User-4278710 4 months agoHi Mudasser, Thanks for the tips. I did follow the steps to setup security groups to allow inbound and outbound traffic, but it didn't work. In our environment the Internet Router is not enabled and internet traffic is routed through http proxy server. If I set the http_proxy environment variable on the EMR host then I can connect to internet via proxy without any issues, however the EMR Notebook is not able to connect to internet through http_proxy. There might be some configuration for notebook to use http_proxy environment variable that I am unable to figure it out.Share"


Question: Please publish video tutorials about import sounds & audios in Lumberyard 1.23

"Hi lumberyard team,Please publish video tutorials about import sounds & audios in Lumberyard 1.23.I hope the last puzzle piece of my big project is completed.The last piece of my puzzle is how to import & use sounds and audios.Thank you so much 🙂🌍💡🌹🙏FollowComment"

Answer: "0Accepted AnswerHey @REDACTEDUSERI've added your message to our Tutorial queue, and will work on this soon.CommentSharerePost-User-8914159answered 3 years ago0Am seeing if we have an official tutorial (or plans for one). In the meantime this could be useful if using wwise: https://www.youtube.com/watch?v=VoVgc9Ke1ywHave you got any specific problems / issues in LY 1.23 relating to audio? Or are you looking for more general help?CommentSharerePost-User-5332620answered 3 years ago0Hi Pip,I have a big project in lumberyard until summer 2020, I start with link video that you sent , your link is helped to me, thank you , for first time I test audio system in lumberyard , I think in my new project, I cover 70-90% systems and tools in lumberyard , if I find new bugs in ly 1.23 , I report, thank you my friend 🙏 🙂 🌹CommentSharerePost-User-8224505answered 3 years ago0Hi JKingpin,You are welcome , I'm glad I can make my games with lumberyard in private and public school in my country , thank you so much for you /your team want do my suggestion, great my friend 🙏 🙂 🌹CommentSharerePost-User-8224505answered 3 years ago0Hey @REDACTEDUSERPart 1: https://youtu.be/VoVgc9Ke1ywPart 2: https://youtu.be/4PjwtYspNsYPart 3: https://youtu.be/7ztbDeObeOoLet us know how this works for you.CommentSharerePost-User-8914159answered 3 years ago0thanks a lot @REDACTEDUSERI downloaded three top video , Now , I understand how to work sound in lumberyard  I think wwise audio system is very bad1ne : wwise does not support all sound/audio formats2wo : I have a good idea , of course my idea is old , Why LY team not change wwise ot a new audio system?A system that works in the background , example users  can drag and drop various audio files directly into assets browser.3hree : Occasionally in the audio editor in lumberyard or even the lumberyard editor for some long, short sounds/audios the current sound system does not work.Thank you so much for your support in video tutorials 🙏CommentSharerePost-User-8224505answered 3 years ago0@REDACTEDUSERI'm currently working on my own set of Audio implementation videos and wonder if there is anything additional you were wondering about with regards to audio.I see your  perspective on this.The way Lumberyard now works is that the Wwise integration is a gem that can be enabled or disabled, if you have another audio middleware you'd rather use instead of Wwise. In using Lumberyard you are not tied to Wwise and are free to use others, just need to write your own integration. You also have many audio programs to convert and export  audio into wav to be read into Wwise if that's your only limitation.Hope this helps. I hope to release these audio related tutorials beginning in May.Stay tuned.CommentSharerePost-User-8914159answered 3 years ago"


Question: How can I automatically install from CodeCommit onto a Raspberry Pi

"I want to be able to use CodeCommit as a repo for my scripts, and then have AWS automatically deploy any new commits to a bunch of Raspberry Pi systems (on-premise instances which I've already set up in Systems Manager). Preferably, it would take a commit and install it on a single staging RPi first, test it, and if the tests go well, then install it on the rest of the fleet of RPi systems.(The Raspberry Pi systems are running Ubuntu Server 20.04 LTS, so are all compatible as per the requirements of Systems Manager)I've spent all week reading the documentation and going through the tutorials for CodeCommit, CodeDeploy, CodePipeline, and Systems Manager... and I'm getting nowhere.Is this even possible with AWS? Are there any clear guides on how to do this?The closest I've come to success was following this: https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-simple-codecommit.html, but that tutorial explains how to deploy from CodeCommit to an EC2 instance rather than to an on-premises instance. I tried switching to an on-premise instance instead of EC2 (in step 5), and specified the tags I've already assigned to my on-premises instance (in Systems Manager > Fleet Manager), but when I try to run the deployment, I get an error: "The deployment failed because no instances were found for your deployment group. Check your deployment group settings to make sure the tags for your Amazon EC2 instances or Auto Scaling groups correctly identify the instances you want to deploy to, and then try again." The tags are definitely correct. I have no idea how to fix this.Thanks in advance for any help.DaveFollowComment"

Answer: "-1Essentially, I had skipped a bunch of steps in the user guide without realising it. Going back to the start after a decent night's sleep helped.PEBCAK  is a thing.CommentShareZPMMakeranswered 2 years ago"


Question: Failed to set local disks when trying to setup a new disk for upload buffer

"I have a storage gw with 2TB cache and 1Tb upload buffer (working fine)I turned off vm and increased the size to 3tb cache and 2.7TB upload disks on the VM.Went back to AWS console and saw both disks: cache disk is showing the updated disk (3TB) -- good there, but I won't be able to save the upload buffer disk. I keep getting "Failed to set local disks" when I hit Save.I deleted both disk and re-add them to VM (just to test it out). same issue as above.Any suggestion?ThanksEdited by: risabeast on Feb 25, 2019 11:19 AMFollowComment"

Answer: "0Hi,I have included below a couple of documentation links that can help you.If you are looking to expand your volume size use below:https://docs.aws.amazon.com/storagegateway/latest/userguide/managing-volumes.html#volume-size-increaseIf you are looking to provide more cache and upload buffer to the gateway, we recommend to follow the process at link below:https://docs.aws.amazon.com/storagegateway/latest/userguide/ManagingLocalStorage-common.html#ConfiguringLocalDiskStorageRegards,BhavinCommentShareAWS-User-4940880answered 4 years ago0Thank you for your help.I have decided to delete the gateway and redo the whole thing since there is no way around it.CommentSharerisabeastanswered 4 years ago"


Question: Lightsail SSH not working!

"Hi,I had an instance of lightsail running with ubuntu for 3 months without any issue. Developers and I were able to access via SSH.About a week ago we could no longer connect. Initially not even the lightsail browser version would work (immediately disconnecting).After doing some research online I decided to create a new instance from a snapshot. That made SSH connection via browser work again. But unfortunately Putty still returns "Server refused our key". Tried downloading the keys again, creating new keys, uploading my own key. Nothing worked.Any help will be highly appreciated.FollowComment"

Answer: "0Hello,Thank you for using Lightsail.Here are some ideas to help debug:Navigate to the "Connect" tab of the instance and verify that the key pair name in bold below the "Connect using your own SSH client" section is the same as the one you've downloaded and are attempting to use to connect.Ensure the .pem key has the correct permissions set, otherwise the server will refuse connection. On Linux or Mac you can set the correct permissions with the following command chmod 400 ~/key-name.pem. Details for connecting with Putty as you mentioned can be found here: https://docs.aws.amazon.com/quickstarts/latest/vmlaunch/step-2-connect-to-instance.htmlLet us know if either of those helps, or if you are still stuck connecting.Regards,JonathanCommentShareAWS-User-7183595answered 4 years ago0unfortunally, i have the exactly same issue...  i tried to change the keys, restart the computer - change the computer - always the same error "server refused our key" - the only thing which works is the ssh client via browser - no connection via sftp or navicat/mysql as before (it worked well, till i destroyed the apache conf files...) therefore i terminated the old instance and build a new one - then the ssh putty client stopped connectingany ideas - there is nothing out in the internet - not for this problem - is that a lightsail problem??CommentSharepardiumanswered 4 years ago0Have you attempted to update the permissions as mentioned above by JonathanH-AWS?Are there any additional details you can provide regarding the error message that you are seeing?In order to get a clearer understanding of what may be happening, you can try editing your/etc/ssh/sshd_configfile and change the log level toLogLevel DEBUG3Once you have done so and after you attempt to connect again, more specific errors should be output to/var/log/secureRegards,JordanCommentShareAWSJordanRanswered 4 years ago0I have the same problem on osx. Permissions are correct, and using -v option, I can see it cycling through all the keys, and none of them work. I also tried using the default key, although the lightsail console for the instance shows it as being associated with the custom key. (key was generated during the instance creation; not an uploaded key). I cannot get into the instance except for the "lacking" web shell console, and cannot run many commands without getting some weird 404 response which terminates the session.CommentSharewkhatchanswered 4 years ago0same problem since weeks.still no change. "Server refused our key"I have another LAMP instance, where everything is working wellCommentShareEdgar1004answered 3 years ago0Still stuck connectingNo change at all. Each trial same result. Really need serious help.why is my first instance working smoothly from the beginning (in the same region), the new one absolutely not?The first LAMP is based on UBUNTU, the second one on DEBIAN.So maybe user - name is changed from ubuntu to admin.But has nothing to do with "server refused our key"As you wrote: "...key pair name in bold below the "Connect using your own SSH client" section is the same as the one you've downloaded.."its...-eu-central-1  ... so correct!What can I do?CommentShareEdgar1004answered 3 years ago0This is not really helpful/etc/ssh/sshd_config  results in : Permission deniedThank you very much!Edited by: Edgar1004 on Sep 26, 2020 7:19 AMCommentShareEdgar1004answered 3 years ago0I found the solution and would like to share this message to all of you who had same problem, desperately searching for solving.Lightsail LAMP doen't come now based on UBUNTU, it's based now - without any announcement - on DEBIANHere is the crux.DEBIAN asks for another User-name and this is not "admin" like you see in the discription. It is "bitnami"And voila... it worksCommentShareEdgar1004answered 3 years ago0I think you should check this pattern which is discussed in the documentation here: https://aws.amazon.com/premiumsupport/knowledge-center/lightsail-resolve-ssh-console-errors/ .CommentShareAdeel Khananswered 10 months ago"


Question: Please add .pt domain to TLD

"Hi,Would it be possible to add the domain .pt to TLD?Many thanks!JoaoFollowComment"

Answer: "0Hello, thank you for reaching out.I understand that you are requesting support for the ".pt" TLD registration on Route 53.Route 53 Domains is currently directly accredited with .com, .net, and .org registries. All other TLDs are provided via third party registrar associates. To improve our level of service and support, we are actively working to become directly accredited with all other TLDs. In addition to improving our existing offering, we will become accredited with other registries to expand our TLD catalog. This work is currently in progress. We do not currently have dates to share for adding new TLDs.You can monitor the updates here at AWS Blogs - https://aws.amazon.com/blogs/aws/ and what's new on AWS - https://aws.amazon.com/new/CommentShareAustin_Lanswered 10 months ago"


Question: Messages published over MQTT from an IoT Greengrass device arrive out-of-order

"Hi, when using IoT Greengrass I've found that when MQTT messages are published close together (less than 1-second interval) they may arrive out of order. Is this expected?FollowComment"

Answer: "0Accepted AnswerOut-of-order MQTT messages should be expected and solutions should be designed with this principle in mind. Messages published with QoS1 retries from the client when ACK is not received is a common way that messages get out of order. Many things can cause the ACK to not be received - Internet down, power outage, network congestion.Strategies for handling out-of-order messages include use of sequencing numbers generated by the client and ignoring messages received with a timestamp older than the last processed message. For more guidance, consult the IoT Lens for AWS Well-Architected. https://docs.aws.amazon.com/wellarchitected/latest/iot-lens/welcome.htmlCommentShareAWS-User-7933729answered 3 years ago"


Question: Private API Gateway 403 errors

"I'm toying with API gateway and have run into an issue in which one account gets a 403 Forbidden Error.  VPCE's are setup in two accounts.  The Account where the api gateway and one of the VPCE's resides works just fine, however the second account does not.    The forbidden message is just that "Forbidden" so very unhelpful.  Any ideas on how to resolve the 403's?Calling it like so:curl -v https://vpce-0c868a4b1293a28b5-6gi9t6mm.execute-api.us-east-1.vpce.amazonaws.com/dev -H 'Host: abc123defg.execute-api.us-east-1.amazonaws.com'Resource policy is as follows (I did replace the account id and actual api id with something random):vpce-078ec1da4e3a0deb3 = VPCE in account where API gateway resides.vpce-0c868a4b1293a28b5 = VPCE in secondary account.{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Deny",            "Principal": "*",            "Action": "execute-api:Invoke",            "Resource": "arn:aws:execute-api:us-east-1:123456789123:abc123defg/*",            "Condition": {                "StringNotEquals": {                    "aws:sourceVpce": [                        "vpce-0925a8e90cbab6f12",                        "vpce-078ec1da4e3a0deb3",                        "vpce-0c868a4b1293a28b5"                    ],                    "aws:SourceIP": [                        "10.0.0.0/8",                        "63.237.3.169/32"                    ],                    "aws:sourceVpc": "vpc-06f730a7eb116c752"                }            }        },        {            "Effect": "Allow",            "Principal": "*",            "Action": "execute-api:Invoke",            "Resource": "arn:aws:execute-api:us-east-1:1234567891323:abc123defg/*"        }    ]}FollowComment"

Answer: "0Accepted AnswerHi,Apart that you can troubleshoot further here: https://repost.aws/knowledge-center/api-gateway-private-cross-account-vpce,Can you try to invoke the api gw as https://<api-gw-id>-<vpce-url> As described in “associate/disassociate” section in https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-apis.html?Let me knowCommentShareEXPERTalatechanswered 2 months ago0I've followed those steps and I'm still getting 403 errors.  I actually followed them before I posted.  No matter the calling method, I always get 403 Forbidden error when calling from the secondary account.  Note, I have to use the public DNS in some cases due to non-vpc systems having to call the gateway.UPDATE:  I did just do yet another re-deploy and tried the <apiid>.execute-api.us-east-1.amazonaws.com method and it worked from within the secondary account VPC.  Now I just need to make it work via the public DNS.CommentShareraithedavionanswered 2 months ago0And now the public is working too.  Maybe I forgot to re-deploy or I'm just really bad at copy pasta on Friday.  Thanks alatech.CommentShareraithedavionanswered 2 months ago"


Question: Can't create a DNS zone with for .eu domains

The seems to be a bug in the Lightsail console. I can't create a DNS zone for a .eu domain.See attached image:FollowComment

Answer: "0Accepted AnswerHello,Thank you for using Lightsail. We have fixed this problem and you should be able to create DNS zones with top-level domains that are 2 characters in length.LeslieCommentShareAWS-Leslieanswered 9 months ago0Do you by any chance have a trailing whitespace after eu? Otherwise it's a perfectly valid domain for me in LightsailCommentShareSydanswered 9 months agoandreimatei 9 months agoNo, I do not have. There is a bug that is preventing having a domain with 2 characters.Shareandreimatei 9 months agoCan someone else try to add a DNS zone with whatever.eu or cc or anything? The UI is preventing the add of 2 char domains :(ShareSyd 9 months agoI was able to create the domain mydomain.eu in Lightsail.Share"


Question: How to verify that checkpoints work for SageMaker Spot Training?

"Hi,How can we know that checkpoint works before launching a sagemaker spot training job?Is there a way to force a regular checkpoint to s3 instead of waiting for the SIGTERM?cheersFollowComment"

Answer: "0Accepted AnswerHi olivier,If you enable Sagemaker checkpointing , it periodically saves a copy of the artifacts into S3. I have used this in pytorch and it works by checkpointing periodically and the  blog on Managed Spot Training: Save Up to 90% On Your Amazon SageMaker Training Jobs also mentions the sameTo avoid restarting a training job from scratch should it be interrupted, we strongly recommend that you implement checkpointing, a technique that saves the model in training at periodic intervalsCommentShareEXPERTAparna_Eanswered 3 years ago"


Question: java.nio.channels.UnresolvedAddressException when trying to create a topic in Amazon MSK

I created and deleted topics on my Amazon MSK for weeks. But today when I use the same zookeeper connection string I get the error:java.nio.channels.UnresolvedAddressExceptionThe only difference is I upgraded the java version on my linux instance to Java 17. Can that cause this issue? Nothing else has changedFollowComment

Answer: "0Hi there, even though full support of Java 17 is included in later versions of Kafka https://issues.apache.org/jira/browse/KAFKA-13273, I did not see any issues with some simple data plane commands like creating or deleting topics from Apache Kafka 2.7.0 client. It could also be a transient network issue while connecting to zookeeper. Instead of zookeeper string, can you try using --bootstrap-server <broker string> and see if that works../kafka-topics.sh --bootstrap-server <broker endpoints> --listCommentShareSUPPORT ENGINEERHarshith_Manswered a year ago"


Question: Where to post an Aurora MySQL bug which lead to a segmentation fault?

"Hi, I've been able to cause a segmentation fault and crash Aurora (  5.6.mysql_aurora.1.23.2 )  - two difference instances with an accidental misuse of SUBSTRING() with a zero index, meant to be 1./etc/rds/oscar-start-cmd: line 39: 34079 Segmentation fault (core dumped) /rdsdbbin/oscar/bin/mysqld --core-file --innodb_shared_buffer_pool_uses_huge_pages='1' "$@" Where's the best place to log that with the Aurora team?The query which did it wasn't particularly complex:SELECT     substring(ba.BSB, 0, 2) as bsbBankNum,    count(distinct c.Id) as PortfoliosFROM    Customer C     inner join BankAccount ba on ba.CustomerId = c.IdWHERE    C.DataSetType = 'Subscription'        AND C.SubscriptionStatus NOT IN ('Trial' , 'TrialExpired', 'Cancelled')group by substring(ba.BSB, 0, 2)FollowComment"

Answer: "1The query seems very benign, without looking at logs its hard to tell what exactly is causing the segmentation fault. Your best option is to open a ticket with support, could be something peculiar to your environment or the version  that you are using or a combination of both or some other factors.CommentShareDevinder-theDBGuyanswered a year ago"


Question: AWS Oracle RDS  - Bunch of  *Thread 1 advanced to log sequence xxxxxx (LGWR switch) *

"Hi! I see a whole bunch of  *Thread 1 advanced to log sequence xxxxxxx (LGWR switch) * in the Cloud Watch. May I ask somebody to explain what it means and what I can do within the realm of AWS Oracle RDS, please? I searched for this issue but all recommendations relate to standalone Oracle instances.Many thanks in advance,FollowComment"

Answer: "1Every Oracle database has a set of two or more online redo log files. The set of online redo log files is collectively known as the redo log for the database. The database log writer process (LGWR) writes redo records from the memory buffer to a redo log group until the log files in that group reach their storage size limit, or until you request a log switch operation. The LGWR process then writes to the next log group. The LGWR process performs this action in a circular fashion so that the oldest group is overwritten by the most recent redo records. This process is called a log switch and oracle logs this information in alert log with the above message. You can safely ignore it, unless you are seeing a log switch happening more that 3-4 times an hour. ( a general rule of thumb) If it does, then you need to add larger online redo logs and drop the existing ones.CommentShareDevinder-theDBGuyanswered a year ago"


Question: Is ATECC608 device supported in Greengrass V2 via PKCS11 ?

"I'd like to use ATECC608A/B secure element device to support secure connection to AWS with Greengrass V2.I think that this is possible via use of  aws.greengrass.crypto.Pkcs11Provider but I have not been able to get confirmation of if this actually works, or exactly how to configure.Is this supported ? If so, are there any configuration examples for this ?Thanks.FollowComment"

Answer: "1Accepted AnswerConfirmed working for me with Greengrass 2.9.2 and ATECC608A/B withd4f3b1abe  version of cryptoauthlib. It does not work for me with v3.4.1 of cryptoauthlib. Some discussion hereCommentSharemajhanswered 4 months agoEXPERTGreg_Breviewed 4 months ago0The ATECC608A/B secure element device can be used to support secure connections with AWS Greengrass using the aws.greengrass.crypto.Pkcs11Provider. This provider allows you to use PKCS #11 libraries to access cryptographic operations provided by a Hardware Security Module (HSM), such as the ATECC608A/B.To use the Pkcs11Provider, you will need to configure the Greengrass Core software to use the PKCS #11 library provided by the ATECC608A/B device. This typically involves specifying the path to the library, and providing a configuration file that contains information about the device and the cryptographic operations it supports.I would recommend following the documentation from AWS Greengrass and Microchip (ATECC608A/B's manufacturer) on how to set up the secure element device and configure it to work with the AWS Greengrass.Here is the link for AWS Greengrass documentation (Kindly visit "Install the AWS IoT Greengrass Core software with the private key and certificate in an HSM" from the below link):https://docs.aws.amazon.com/greengrass/v2/developerguide/manual-installation.html#run-greengrass-core-v2-installer-manualHere is the link for Microchip ATECC608A/B documentation:https://www.microchip.com/wwwproducts/en/ATECC608ACommentSharerePost-User-8175358answered 4 months ago"


Question: MediaTailor to Cloudfront to Route 53 using HTTPS / SSL - Any Suggestions? Domain Continues To Fail

"I have a fully functioning MediaTailor instance distributing HLS content in .m3u8 - (public data removed):https://(my cloudfront alphanumeric).cloudfront.net/v1/nevermind/58a2f0c6b3528a8407e12e2dd992bd221d5afc39/RadFAST1-Channel-Beachfront/radfast1.m3u8I am trying to use a Route53 domain name to mask the cloudfront source:I have registered a new domain with Route 53, I have created a SSL certificate, I have added the CNAME records to my Domain, I have added the Domain to the Cloudfront instance. Here are the results (which fail):https://(my dot com)/v1/nevermind/58a2f0c6b3528a8407e12e2dd992bd221d5afc39/RadFAST1-Channel-Beachfront/radfast1.m3u8Does anyone have any suggestions / tips / ideas? I tried using a GoDaddy domain and found that that doesn't work for HTTPS. I purchased a domain from Route53 in hopes that the fact that AWS was hosting the domain would make this work, but no such luck. Is it my URL syntax from Cloudfront / Mediatailor?Any assistance appreciated - I've been working on this for a week now.Thanks.FollowComment"

Answer: "0Accepted AnswerIssue solved.Here's how: when Route53 created the domain record the A name was set to https\072\057(my cloudfront distribution alphanumeric).cloudfront.net - I figured that was correct because Route53 set in that way when I first registered the domain.When I removed the "https\072\057" from the A name record and replaced it with (my cloudfront distribution alphanumeric).cloudfront.net - everything worked including my HTTPS CNAME SSL.CommentShareRadiant RePosteranswered 7 months ago0Hello,You'll probably want to remove your CloudFront link from this thread, or you could potentially incur unexpected costs from people watching your content as this is a public forum.Your domain http://radiantfc.net/ does not DNS resolve for me at all, so I don't think a DNS record has been setup for it, or hasn't propagated yet.-DirkCommentShareDirkjan_Banswered 7 months agoRadiant RePoster 7 months agoDirk -Not so worried about people watching the content - it's a test stream. I've registered the domain in Route53 and added the CNAME records. I have screen shot of domain in Route53 but can't add it in comments. I've been messing with this for days and I feel like I'm missing something really basic - though for the life of me I can't figure out what it is. Trying not to get frustrated - but this is the last step of this build / test and it should be easy...any assistance appreciated.JockShare"


Question: Problem with renewing or validating certificate

"I used to do it with e-mail but the European Union has some law that makes domain information private so the contact e-mail cannot be found for my domain so no renewal e-mail can be sent to me. So I tried to set up e-mail for my domain so that one of the default e-mail addresses would work, but my load balancer has to use a CNAME for the root domain which makes the MX record useless, as far as I can understand. So no e-mail that way. That leaves the DNS option. But my domain provider does not seem to allow underscores in the name field of a CNAME. This leaves me with no way to renew or validate certificates. What are my options besides waiting for my website to become unreachable?FollowComment"

Answer: "0But seriously, do I have any good options? I guess I could shut down access through the root domain long enough to set up an email address to validate the certificates but that seems drastic.CommentShareAWS-User-8238431answered 4 years ago0For some reason I have certificates for the same domain but they are hosted at US East (N. Virginia) instead of US West (Oregon), where my server is hosted and the soon to be expired certificates. Those US East certificates were renewed, I don't know how. Can I use them for the server in US West?CommentShareAWS-User-8238431answered 4 years ago0Figured it out. My domain provider has a bad ui.CommentShareAWS-User-8238431answered 4 years ago"


Question: AWS Saving Plans Calculation Example by Amazon

Could someone show me how did Amazon do those Calculations in this example (link below) ? At least in the 1st example.I made my calculations and there is no way to totalize $47.13 as they said in this article...And why do they say in other articles that there is not a usage commitment on Reserved Instances if we are buying an Instance for one year or three?Thank youLink to article - exampleshttps://docs.aws.amazon.com/savingsplans/latest/userguide/sp-applying.htmlFollowComment

Answer: "0Hi ThereThe $47.18 from scenario 1 is just an example. Its based on the discounted rate that you get when you purchase a savings plan.  It works like this:You have an EC2 instance that costs $1/hour to run on-demandThe discounted rate for this instance is $.90/hour when you purchase a savings plan for 1 year.  This is the discount you get for committing to 1 year of usage.You purchase a savings plan commitment of $.90/hour which will cover the entire cost of running that instance.If you spin up a second instance of the same type, you are billed $1.90/hour.  ($.90/hour for the savings plan + $1/hour the on demand rate for the second instance)If you terminate both instances, you are still billed $.90/hour because you committed to that amount for the year.Check out this youtube video for a good explanation of how savings plans work: https://www.youtube.com/watch?v=xjq-1CdvgQ8CommentShareEXPERTMatt-Banswered 6 months ago"


Question: Matchmaking event of type MatchmakingSucceeded did not contain player session ids of new incoming players

"Recently I believe I may have stumbled across a glitch where an event of type MatchmakingSucceeded did not have the player session ids of the new incoming players. I do want to note that this matchmaking request was a manual backfill request so I am not sure if that had anything to do with it. I just want to make sure that this is a glitch or if something I did caused this to happen. And if need be, for further investigation, I can pm someone information about the match and players involved because I have the event message recorded.FollowComment"

Answer: "0Accepted AnswerWe recently deployed an improvement to the GameLift service that targets missing player session IDs in matchmaker responses. We expect missing player session IDs to no longer occur. Please let us know if you still see this issue over the next 2-3 weeks!CommentSharerePost-User-7171842answered 3 years ago0Can you provide matchmaking ticket ids and I can get the GameLift service team to investigate?CommentSharerePost-User-5332620answered 3 years ago0Yes, here are the tickets associated with the event:b1bb51c1-d0b0-4ed2-b060-7ed3fc362fd9a4a94c8e-7823-4b91-a029-3e8401d968b72f8c501a-c424-428b-a1be-5475e3b54278CommentSharerePost-User-5100160answered 3 years ago0Thanks I've opened an issue with the GameLift team.CommentSharerePost-User-5332620answered 3 years ago0I recently noticed this issue too. Players that leave the session or time out are still reported in backfill messages but don't have a player session.Is this still going to be expected behavior or will this be changing somehow?CommentSharerePost-User-3832429answered 3 years ago0@REDACTEDUSERSeems strange to have player data without a player session id on a game session update. As you mention that this is impacting players who've left / timed out on connect, this may due to the fact that your game server is currently responsible for updating the player data in this circumstance and I wonder if there is stale data being sent with the request.CommentSharerePost-User-5332620answered 3 years ago0I can confirm that what @REDACTEDUSERCommentSharerePost-User-5100160answered 3 years ago0@REDACTEDUSERCommentSharerePost-User-5332620answered 3 years ago0Hey @REDACTEDUSERbc459d6a-08a0-4506-b97d-6001bbe1f0b4I believe what happened exactly was that there was a situation in which a player left the game, and a backfill request was made with the remaining players. Then, one of the remaining players also left but the backfill request in progress was not cancelled. Therefore, players could get matched with this backfill ticket that was not truly representative of the players still in the game.I don't know if this is necessarily good or bad behavior, since I found a way around this by cancelling backfill requests whenever players leave the game. In my case, I terminate the player session when a player leaves, so eventually a new backfill request gets made with the remaining players in the game.CommentSharerePost-User-5100160answered 3 years ago0I looked into what happened to that ticket. It was exactly like what you described. The player session was already completed by the time the match was formed.FlexMatch assumes the players in match making tickets are accurate, so it currently records this abnormal case and returns a ticket with missing player session IDs.Your method of canceling the backfill request when players leave the game is the right approach.CommentSharerePost-User-3854098answered 3 years ago"


Question: Unable to verify grouped email

"Hi,We've created 2 email groupes on gsuit on which we can receive emails.We tried to verify those email but we didn't received any verification email.I was able to verify my own email adress on the same domain but we would like to use those grouped emails.Thanks for your timeEDIT: We managed to add our grouped email by verifying the domainEdited by: afanneau on May 23, 2019 12:56 AMFollowComment"

Answer: 0We managed to verify grouped emails by verifying the domainCommentShareafanneauanswered 4 years ago


Question: why does one s3 folder show in my web browser and another folder in the same parent doesn't

why does one s3 folder show in my web browser and another folder in the same parent doesn't. They're in the same parent folder and same instance on EC2. All the setting/properties are the exact same.FollowComment

Answer: "0I may be how the folder was created. See: Organizing objects in the Amazon S3 console using folders.ImportantWhen you create a folder in Amazon S3, S3 creates a 0-byte object with a key that's set to the folder name that you provided. For example, if you create a folder named photos in your bucket, the Amazon S3 console creates a 0-byte object with the key photos/. The console creates this object to support the idea of folders.The Amazon S3 console treats all objects that have a forward slash (/) character as the last (trailing) character in the key name as a folder (for example, examplekeyname/). You can't upload an object that has a key name with a trailing / character by using the Amazon S3 console. However, you can upload objects that are named with a trailing / with the Amazon S3 API by using the AWS CLI, AWS SDKs, or REST API.An object that is named with a trailing / appears as a folder in the Amazon S3 console. The Amazon S3 console does not display the content and metadata for such an object. When you use the console to copy an object named with a trailing /, a new folder is created in the destination location, but the object's data and metadata are not copied.CommentShareEXPERTkentradanswered 3 months agoTU0721 3 months agoIt's not the naming. AWS automatically adds "/". It matches all the settings of another folder that shows up. The strange thing is if I upload new file to the folder that shows up in my browser, the new file also doesn't show in that folder.Sharekentrad EXPERT3 months agoI have not tried the effects of this, but could it be a non-zero sized object that ends in '/' that is throwing things off?ShareTU0721 3 months agoI noticed updates to the some other folders also not reflecting in the server therefore the Browser.Share"


Question: CloudFormation error: DB cluster isn't available for modification with status modifying

"I am getting the following error in CloudFormation when deploying a stack:DB cluster isn't available for modification with status modifying. (Service: Rds, Status Code: 400, Request ID: 26f5ddfb-f2b2-49bc-94e9-8a1690956718)The condition is that the RDS cluster is Serverless v1 (PostgreSQL) and it is auto-scaling.However, the update is only applying tag changes.IMO, tag changes shall not be prevented by cluster scaling.Can someone escalate this with the right team, please?EDIT: Ok, I think there is something more going on. I have deleted the tags that are volatile (build IDs) and deployed from local to clear out those tags. It worked. Then I pushed it thru the pipeline, at which point there should be no changes (no diff), and yet, it still fails with the same error message.FollowCommentben 8 months agoI have no solution for you unfortunately, but I can commiserate. I'm getting the same thing with Aurora mysql serverless. Initially I thought it was due to my stack having drifted, however after making sure the cluster aligned with my stack I'm still seeing the same error. I'm able to make manual changes via the Cloudformation console but not via CI pipeline which is running a stack update.Share"


Question: Strange "XXX" payload in UDP stream from AWS

"I just observed someting very strange.When I send an UDP packet containing "elof" from an EC2, the receiving service get "XXXelof", not "elof".How to reproduce:On several Debian hosts (physical machines and EC2s all over the world) I run:echo elof | nc -nvv -u -w 1 123.123.123.123 6789This command will simply send a UDP packet with the payload "elof" to 123.123.123.123:6789.On a router in a datacentre for 123.123.123.0/24 I run:tcpdump -s0 -X -nli igb1 'udp and port 6789For all regular machines I see:15:56:42.168579 IP 222.222.222.222.54321 > 123.123.123.123.6789: UDP, length 5        0x0000:  4500 0021 eee8 4000 3511 e0c9 d590 1008  E..!..@.5.......        0x0010:  b07c e004 e647 0eff 000d b5a0 656c 6f66  .|...G......elof        0x0020:  0a00 0000 0000 0000 0000 0000 0000       ..............Looks good....but from two EC2 nodes, one in Ireland and one in Frankfurt, the same tcpdump looks like this:15:56:53.746093 IP 55.55.55.55.44444 > 123.123.123.123.6789: UDP, length 1        0x0000:  4500 001d 40c4 4000 2d11 b240 3648 9402  E...@.@.-..@6H..        0x0010:  b07c e004 9c82 0eff 0009 a18e 5800 0000  .|..........X...        0x0020:  0000 0000 0000 0000 0000 0000 0000       ..............15:56:53.746120 IP 55.55.55.55.44444 > 123.123.123.123.6789: UDP, length 1        0x0000:  4500 001d 40c5 4000 2d11 b23f 3648 9402  E...@.@.-..?6H..        0x0010:  b07c e004 9c82 0eff 0009 a18e 5800 0000  .|..........X...        0x0020:  0000 0000 0000 0000 0000 0000 0000       ..............15:56:54.746945 IP 55.55.55.55.44444 > 123.123.123.123.6789: UDP, length 1        0x0000:  4500 001d 41a2 4000 2d11 b162 3648 9402  E...A.@.-..b6H..        0x0010:  b07c e004 9c82 0eff 0009 a18e 5800 0000  .|..........X...        0x0020:  0000 0000 0000 0000 0000 0000 0000       ..............15:56:54.747136 IP 55.55.55.55.44444 > 123.123.123.123.6789: UDP, length 5        0x0000:  4500 0021 41a3 4000 2d11 b15d 3648 9402  E..!A.@.-..]6H..        0x0010:  b07c e004 9c82 0eff 000d 1ab4 656c 6f66  .|..........elof        0x0020:  0a00 0000 0000 0000 0000 0000 0000       ..............Huh?What are those three 1 byte packets before the final "elof" packet???If I load the above pcap into Wireshark and choose Follow UDP Stream, I get the data stream "XXXelof".I find this very odd. The UDP server should only receive "elof", not "XXXelof".Can anyone explain what is happening?/ElofEdited by: elofu17 on Sep 17, 2020 10:00 AMFollowComment"

Answer: "0Ah, a colleague of mine found the problem.It is a netcat issue with the verbose (-v) flag:https://stackoverflow.com/questions/35485726/netcat-sending-extra-x-udp-packetsOn my AWS EC2 nodes, 'netcat-openbsd' was installed while the regular machines use 'netcat-traditional'.CommentShareelofu17answered 3 years ago"


Question: Upgrade MySQL RDS instance 5.7.36 to 8.0 failing

upgrading MySQL RDS instance 5.7.36 to 8.0 but it didn't get upgraded. We checked the prechecked compatibility log and found error "mysql - schema's default character set: utf8" how to fix this.FollowComment

Answer: "1It is because MySQL 8.0 includes a number of incompatibilities with MySQL 5.7. For improved Unicode support, consider converting objects that use the utf8mb3 charset to use the utf8mb4 charset. The utf8mb3 character set is deprecated. Also, consider using utf8mb4 for character set references instead of utf8, because currently utf8 is an alias for the utf8mb3 charset.For more information, see The utf8mb3 character set (3-byte UTF-8 unicode encoding)in the MySQL documentation.CommentShareVijayKanswered a year ago"


Question: Why Deleted EC2 instance keeps returning

"Points of My Scenario:I deleted an EC2 instance and it returned with a different GUID.I then deleted the AMI image I had built to create the EC2 instance, but AWS again found a way to create and run a new EC2 instanceI then deleted all snapshots and volumes, and yet again, AWS found a way to create and run yet another EC2 instance.REQUEST: Since I am being forced to spend money, please help me stop the return of these unwanted, auto-creating EC2 instances.FollowComment"

Answer: "0Accepted AnswerAre the instances part of an EC2 Autoscaling group?  If so, you would see Tags named "aws:autoscaling:groupName" on the instances.CommentShareEXPERTskinsmananswered 4 months agowaltforbes 4 months agoNo: there is no autoscaling group. Thanks for asking.Shareskinsman EXPERT4 months agoHave a look in CloudTrail at the RunInstances events creating the EC2 instances, it might give the info you need to work out how they're being launched.Sharewaltforbes 4 months ago@skinsman (and everybody). thanks for getting me closer to the issue. See CloudTrail info on the latest-new mystery instance (I deleted all previous 'ghost' instances) below:CloudTrail reveals (and mystifies) with the following info:1. Username = InstanceLaunch2. Source IP = spot.amazonaws.com3. User agent = spot.amazonaws.com, also4. Resource Types: VPC, Ami, NetworkInterface, EC2-instance, KeyPair, SceurityGroup, and subnetHopefully the above data provides a clue that can lead me to the answer. Any further thoughts (anyone)?Sharewaltforbes 4 months agoI found a load balancer that I created as a demo to study. I believe this is the problem. I will delete it and see what happens.Sharewaltforbes 4 months agoAlas! Unfortunately, deleting the Load Balancer (along with its empty Target group) and terminating the 'ghost' EC2 instance did not resolve the issue: a new 'ghost' EC2 instance was launched 1 hour and 40 minutes after terminating the previous 'ghost' EC2 instance! I'm being forced to spend money. Lol!ShareShow 4 more comments"


Question: Cannot SSH to ec2 instances

"I'm posting because I can no long ssh to my ec2 instances. I've tried the steps found here https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-resolve-ssh-connection-errors/ for restarting ssh. I've tried starting a new instance and ssh'ing into that, and that likewise times out. Based on an answer to this stackoverflow post: https://stackoverflow.com/a/55234006/848485, I'm posting here on the chance that my account has been "isolated". If anyone has anything else for me to try I'm happy to give it a go.FollowComment"

Answer: "0So I got a new IP address and can now ssh to the instance. I have no idea what was wrong with my old IP, which I had used to ssh many times.CommentSharePlanetNineanswered 2 years ago"


Question: "Can we install 10g, 11g & 12.2 on RDS Custom"

"HI Team,I see only 12.1 & 19c allowed on RDS custom... is it possible to install other versions of Oracle as well?FollowComment"

Answer: "0Currently only 12.1 and 19c versions are supported. As we work backwards from customer requirements and if enough customers ask for it,  it may be supported in  the future.CommentShareDevinder-theDBGuyanswered a year ago"


Question: Deleted Hosted Zone of newly created domain by mistake

"Hi,Kindly assist me on how to link a new hosted zone with my existing domain. I accidentally deleted the default one which was created automatically when I created the domain. After creating a new hosted zone with same name as my domain, I updated the NS record by replacing the default list of servers with list of servers which are attached to my domain. I didn't change the anything in SOA record. Now after creating a new record under the hosted zone (type A record) say test.mydomain.com when i test it through the dig command, the system doesn't show me the value i.e. a dummy IP that i assigned to this new record in the response. Please let me know how do i fix this issueFollowComment"

Answer: "0Hello AWS Customer,I'd like to recommend that instead of using a name server in an already deleted hosting area, create a new hosting area and try changing the name server in the domain using the newly created name server.Hope you will find this information useful. Please let me know if you have any further questions or concerns. We will be more than glad to assist you.Have a good day!CommentShareSUPPORT ENGINEERJisoo_Kanswered 4 months ago"


Question: HDF5.dll is not compatible in EC2 server running on Windows10

We have EC2 server running on Win10 having issue while running ADF service. We get error message while executing Allotrope code (specifically in a .dll called HDF5.dll).  Request for your urgent help.FollowCommentBrettski-AWS EXPERT9 months agoCould you provide more information? Such as the error message you're getting?Share

Answer: "1Hi,This is Sean with AWS Premium Support. I understand you're having problems with a third party application which appears to be Allotrope Data Framework, and its associated DLL HDF5.dll. Please note that this issue appears to be related to a 3rd part application which is outside the Premium Support scope of support[1], but I may be able to help on a best-effort basis.In order to assist you, we would need more information about the specific error details, including the precise error message if possible.  As a general suggestion, I advise you to ensure that the .DLL is registered with regsvr32[2], and to collect a Process Monitor capture of the application[3] that is generating the error in order to gather more information about what else the application is doing at the time it experiences the error.Please share this information as well as some background on the troubleshooting you've performed thus far. Thanks!References:[1] https://aws.amazon.com/premiumsupport/faqs/#Third-party_software[2] https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5[3] https://docs.microsoft.com/en-us/sysinternals/downloads/procmonCommentShareSUPPORT ENGINEERSean_Sanswered 9 months ago"


Question: Redshift out of memory when running query

"Hello there:We have a development RedShift cluster (Version 1.0.37758) with on node (dc2.large). Recently, we keep getting out of memory errors when running ONE query. This select has UNPIVOT in it... the two errors we keep getting are:1.ERROR: Out Of Memory: Detail: ----------------------------------------------- error: Out Of Memory: code: 1004 context: alloc(169776,MtRowset) query: 3422739 location: alloc.cpp:493 process: padbmaster [pid=15449] -----------------------------------------------[ErrorId: 1-626a8968-5f716e5b710716e62422db2e]ERROR: Out of Memory Detail: ----------------------------------------------- error: Out of Memory code: 1020 context: From OomGuard query: 0 location: oom_guard.cpp:392 process: oom_guard [pid=14039]The first error with code 1004 are more often than the second one..Any suggestions on what the root causes are  and how to fix them?Thanks  alot in advanceLiFollowComment"

Answer: "0Accepted AnswerThanks, yes, we rewrote our query and worked around this... thanks for your information.CommentShareAWS-User-3510348answered a year ago0How is your WLM set up? If it is Manual WLM set up, you need to see how much memory allocation is given for queue in which your query will be runningIf you have set up a higher concurrency per WLM queue each slot gets less memory.You can allocate higher memory for specific query by  Allocating a higher query_slot_count to your query:For example  set wlm_query_slot_count to 3; to allocate 3 query slots   Alternatively you can simplify your query with additional interim processing tables and select columns which are required.            You can also refer Auto WLM- https://docs.aws.amazon.com/redshift/latest/dg/automatic-wlm.html where memory management is dynamicCommentShareNita_Sanswered a year ago"


Question: How can EC2 Instance in Private Subnet communicate with Gmail SMTP without NAT Gateway on firewall applied environment?

How can EC2 Instance in Private Subnet communicate with Gmail SMTP without NAT Gateway on firewall applied environment?I can't allow Gmail SMTP Domain's IP Address because the IP is changed.Also I should construct my environment without NAT Gateway because of NAT Gateway Price.FollowComment

Answer: 0You could use an egress-only IPv6 internet gateway (no cost) and connect to Gmail SMTP via IPv6.  A quick google of "gmail smtp ipv6" indicates that IPv6 is supported but has problems in some situations so I'm not sure if this will suit you.CommentShareEXPERTskinsmananswered 7 months ago


Question: sometime facing internal server when storing the files in S3

"Fails because of some reason,This could be for a few reasons, S3 service itself has an internal error. or it could mean that the rate of data access is too high.So we are planning to implement DLQs mechanism for S3. Is it possible use AWS SQS DLQs mechanism ?. What is the best option to implement DLQ for S3.FollowComment"

Answer: "0A lot depends on the max size of the files and where they would be stored in the interim.  Are they already persisted somewhere and you want to queue just some metadata?CommentShareEXPERTskinsmananswered 5 months agorePost-User-9198234 5 months agoNo It's not persisted somewhere. From our service will generate file and continuously sending those file to store in S3. But some months before we got error 500 internal server error returned from AWS S3. We analysed the logs and found the error happens from S3 server itself. So we are planning to implement some DQL technique to prevent this failure.Shareskinsman EXPERT5 months agoI'm guessing your max file size will be too big to fit in SQS messages (max 256KB).  The usual solution for that is to queue just metadata and put the actual data in S3 ... which doesn't really help you here!If at all possible the best option would be to enhance the generating service to cope with S3 errors, retrying and waiting as needed.  Otherwise you're going to need somewhere else to temporarily persist the files.  EFS, which can be accessed from Lambda, might be a good option.SharerePost-User-9198234 5 months agoSo there is no any DLQ mechanism available to prevent failure of AWS S3?Shareskinsman EXPERT5 months agoNo there's not.Share0Hello. I would recommend implementing retry logic if you get intermittent 500 error responses from Amazon S3. Each AWS SDK uses automatic retry logic and an exponential backoff algorithm. A great source to refer is How do I troubleshoot a HTTP 500 or 503 error from Amazon S3?Refactoring to use Amazon SQS in the architecture might not work for your use-case due to SQS messages allowing a max 256 KiB size. To send messages larger than 256 KB, you can look into  the Amazon SQS Extended Client Library for Java, though this library also sends an Amazon SQS message that contains a reference to a payload in Amazon S3.Hope this helps.CommentShareAWS-User-2870192answered 5 months agorePost-User-9198234 5 months agoOur file size very small it will take only 1.5kb its just used to store the event.Share"


Question: Redshift Metric No Data Available.

"Hi all,I'm currently working with Redshift.Why  the metrics for Query duration, Query throughput, Query duration per WLM queue, Query throughput per WLM queue, Concurrency scaling usage, and Usage limit for concurrency scaling dashboard; are showing "No data available" ?May i know why ? and how to solve this issue.Thank you all.FollowComment"

Answer: "0Amazon Redshift maintain log files and corresponding log views only for 2 to 5 days of history. If your cluster has activity within the recent days then Query metrics should be displayed. Concurrency scaling, if enabled and used, then should be displayed.Refer https://docs.aws.amazon.com/redshift/latest/dg/c_intro_STL_tables.htmlCommentShareMilindOkeanswered a year ago"


Question: Configuring auto-scaling for sagemaker async-inference

"I've configured a model for async-inference, and its working correctly - I can submit a file via invoke_endpoint_async and download the output from s3.I'm now trying to configure auto-scaling. I'm trying experimentation with different options, but basically I want to configure 0-1 instances, have an instance created wheninvoke_endpoint_async is called, and have the instance shutdown shortly afterwards (along the lines of batch inference)I'm struggling to get it to work - I'm experiencing similar issues to https://github.com/boto/boto3/issues/2839First I think there's an issue with the console - if I  aws register-scalable-target ... it works but the console doesn't like the zero for min-capacityI think this is just a UI nit though, I don't understand how the policy works - I have{    "TargetValue": 1.0,    "CustomizedMetricSpecification": {        "MetricName": "ApproximateBacklogSizePerInstance",        "Namespace": "AWS/SageMaker",        "Dimensions": [{"Name": "EndpointName", "Value": "***-test-endpoint-2023-03-24-04-28-06-341"}],        "Statistic": "Average"    },    "ScaleInCooldown": 60,    "ScaleOutCooldown": 60}The first point of confusion was the console shows a built-in and custom policy. I was initially using the name of the built-in policy (SageMakerEndpointInvocationScalingPolicy) but put-scaling-policy doesn't appear to edit it - it creates a new policy with the same name.When I monitor the scaling activity ()aws application-autoscaling describe-scaling-activities \    --service-namespace sagemakerI can initially see "Successfully set desired instance count to 0. Change successfully fulfilled by sagemaker."But when I involve the endpoint withresponse = sm_runtime.invoke_endpoint_async(    EndpointName=endpoint_name,     InputLocation="***/input/data.json",    ContentType='application/jsonlines',    Accept='application/jsonlines')output_location = response['OutputLocation']I would expect to see the instance count increase to 1, then back to zero within a space of a few minutes. I have occasionally got it to do something but not reliably. I think the main issue is I don't understand the metric and how it interacts with the target.I've seen charts but I cannot figure out how to plot the "ApproximateBacklogSizePerInstance"? And how does it interact with "TargetValue"? What is the actual trigger for a scale in/out?FollowComment"

Answer: "1Accepted AnswerA target tracking scaling policy will create 2 CloudWatch alarms (one for high and one for low usage), which you'll be able to see in the CloudWatch alarms console.  The high usage policy needs to have 3 consecutive 60 second breaching datapoints to trigger a scale-out; and the low alarm needs 15 consecutive 60 second breaching datapoints to scale-inYou may instead want to use step scaling policies, where you are able to create and control the alarms as well as the policy settingshttps://docs.aws.amazon.com/autoscaling/application/userguide/application-auto-scaling-step-scaling-policies.htmlCommentShareShahad_Canswered 2 months ago0Thanks, once I learned that the policy is managed by CloudWatch alarms I was able to observe my policy working - in particular, I changed the metric to HasBacklogWithoutCapacity, the target to 0.5, and I used Maximum instead of average and it behaves as I require. I did notice that there's also some delay between when I submit an inference job to the queue, and when the metric increases from 0 to 1 (about 2-3 minutes) and then it waits for the 3 consecutive values so overall it takes about 5 minutes rather than 3 to trigger start add capacity. I'll try step scaling to reduce that but at least I have a working proof-of-concept to compare with batch-inference now.CommentShareDaveanswered 2 months agoShahad_C 2 months agoGlad you were able to get it at least mostly working!  Just as an FYI, the Target Tracking scaling policy is expecting the alarm to be configured exactly as AutoScaling created it, so modifying the alarm can lead to unexpected behavior (most often, the alarm triggering but scaling may not happen).  So any time you need the alarm customized, step scaling is the way to go unless its something which can be done natively in the CustomizedMetricSpecification section of PutScalingPolicy https://docs.aws.amazon.com/cli/latest/reference/application-autoscaling/put-scaling-policy.htmlShare"


Question: RDS Database Option for Customer Data

"I am creating a payment portal for a website.  The website will allow users to create an online account, update their customer info (such as billing address, phone, email), and view and pay their invoices.  After some research, I plan to use S3 to store the invoices in PDF format.  I was considering storing the customer data and invoice data in a relational database among two tables connected by customer ID.   A customer would sign into their account, and a query would be made against the customers and invoices table, for the initial summary page that displays upon sign in.  Some further querying would be done if they view their profile or view their invoices page.  I ran an estimate for a single-az, postgresql, general purpose SSD db.t2.micro instance with 100% utilization and 5GB.  That indicated a monthly cost under $14. I chose 100% utilization because user accounts would be accessible 24/7.  I could have done this in S3 with JSON but, in terms of standards, the data calls for a relational database (outside of the PDF objects).  All queries to the database would be through Lambdas.  Is this the cheapest RDS option?  And would a db.t2.micro instance be performant for these rather-simple queries for an online user account (e.g. retrieval speed upon querying)?FollowComment"

Answer: 0This architecture looks good to me.  If you haven't yet taken advantage of the AWS Free Tier you could leverage that to offset the costs.Given that you're using Lambda I'd also encourage you to consider using DynamoDB with SAM (Serverless Application Model). SAM will provide you with tooling for deploying your app and managing your DynamoDB resources.  You can learn more in this YouTube video.CommentShareHopperanswered 9 months ago


Question: [WorkMail] User cannot login after I reset their password.

"Good day and thank you for your time.I have a user who recently lost access to their WorkMail account.  I subsequently reset their password, assuming the password had been changed to something unknown to the user.  Neither of us can now login to the account from the web portal.The account is enabled and we are using the username instead of the email to login.  It's been about an hour with no luck, just in can some backend sync is being slow.Any ideas?FollowComment"

Answer: "0Hi,I'm sorry to  hear you're experiencing problems with loggin on to WebMail. Do note that the Username for WorkMail directories is case sensitive! Can you double check your username in the console and the one you're using in the Webmail?Kind regards.RobinCommentShareMODERATORrobinkawsanswered 6 months ago0I have the same issue. Any updates?CommentShareBedirhan Celikanswered 2 months ago"


Question: Crontab missing from most recent AWS Linux AMI

"Hello Team,For the AMI ID ami-02f3f602d23f1659d (al2023-ami-2023.0.20230315.0-kernel-6.1-x86_64), I am seeing that crontab is missing[root@ip-172-31-11-172 ~]# contab -l-bash: contab: command not foundAfter that I have installed the crontab manually using  the command yum install cronie cronie-anacronBut could you please let me know, Is the AWS missed to include crontab or hereafter the AMI will come up without crontab. Could you please confirm.FollowComment"

Answer: "0Accepted AnswerThe specific AMI referred in the question seems to be a Community AMI. The image doesn't come with crontab and it has to be installed manually. Although I couldn't find any documentation for the specific reason as to why crontab is not installed, I was able to confirm that the instance is installed without crontab confirming our assumption that community editions may not have crontab.CommentSharerePost-User-venkyanswered 2 months ago"


Question: Problem with ApplicationLoadBalancedEc2Service not registering with the cluster

"I have a CDK script that tries to create an ECS cluster, task, and ApplicationLoadBalancedEc2Service, but when I deploy it the Ec2 instance is created, but it is not registered with the LB target group, or registered with the cluster.  So my task never starts.  It also hangs getting to 65 out of 67 services started and never finishes.  I'm thinking that's because the Ec2 instance doesn't get registered with the cluster, and it nothing starts up and the CDK script is waiting for it to go healthy.   I also see that my task doesn't have a CPU, OS, or memory assigned to it when I compare that against my ECS JSON configured file it does.What I don't really get is which part is creating the Ec2 instance?  Is it the addCapacity call that declares the specs of the Ec2 machine?  If so why isn't it automatically registered with the cluster then?  Or is it the ApplicationLoadBalancedEc2Service construct, and in which case why isn't that registered to the cluster with the .cluster() method?  And how would it know what Ec2 specs to start up if it's creating it?Here is my general script:Vpc vpc = Vpc.Builder.create(this, "MyAppVpc")        .maxAzs(2)  // Default is all AZs in region        .natGateways(1)        .enableDnsHostnames(true)        .enableDnsSupport(true)        .ipAddresses(IpAddresses.cidr("10.0.0.0/16"))        .subnetConfiguration(Arrays.asList(                SubnetConfiguration.builder()                        .name("Web")                        .subnetType(SubnetType.PUBLIC)                        .cidrMask(24)                        .build(),                SubnetConfiguration.builder()                        .name("App")                        .subnetType(SubnetType.PRIVATE_WITH_EGRESS)                        .cidrMask(24)                        .build(),                SubnetConfiguration.builder()                        .name("Storage")                        .subnetType(SubnetType.PRIVATE_WITH_EGRESS)                        .cidrMask(24)                        .build()        ))        .build();vpc.addGatewayEndpoint("s3Endpoint", GatewayVpcEndpointOptions.builder()        .service(GatewayVpcEndpointAwsService.S3)        .build());vpc.addInterfaceEndpoint("ssmEndpoint", InterfaceVpcEndpointOptions.builder()        .service(InterfaceVpcEndpointAwsService.SSM)        .privateDnsEnabled(true)        .build());vpc.addInterfaceEndpoint("cloudWatchEndpoint", InterfaceVpcEndpointOptions.builder()        .service(InterfaceVpcEndpointAwsService.CLOUDWATCH)        .privateDnsEnabled(true)        .build());vpc.addInterfaceEndpoint("ec2MessagesEndpoint", InterfaceVpcEndpointOptions.builder()        .service(InterfaceVpcEndpointAwsService.EC2_MESSAGES)        .privateDnsEnabled(true)        .build());ILogGroup appLogGroup = LogGroup.fromLogGroupName(this, "my." + settings.getEnv() + ".archiver", "my." + settings.getEnv() + ".archiver");if( appLogGroup == null ) {    appLogGroup = new LogGroup(this, "my." + settings.getEnv() + ".archiver", LogGroupProps.builder()            .logGroupName("my." + settings.getEnv() + ".archiver")            .retention(RetentionDays.ONE_YEAR)            .build());}IHostedZone domainZone = HostedZone.fromLookup(this, getStackId(), HostedZoneProviderProps        .builder()        .domainName(settings.get("hostname"))        .build());Cluster cluster = Cluster.Builder.create(this, "MyAppCluster")        .containerInsights(true)        .capacity(AddCapacityOptions.builder()                .vpcSubnets(SubnetSelection.builder().subnets(vpc.getPrivateSubnets()).build())                .desiredCapacity(1)                .minCapacity(1)                .maxCapacity(1)                .instanceType(InstanceType.of(InstanceClass.T3A, InstanceSize.LARGE))                .machineImage(MachineImage.latestAmazonLinux())                .machineImageType(MachineImageType.AMAZON_LINUX_2)                .keyName(settings.get("ssh.key.name"))                .build())        .vpc(vpc)        .build();ICertificate myAppCert = Certificate.fromCertificateArn(this, settings.get("ssl.key.id"), settings.get("ssl.key.arn") );Ec2TaskDefinition appTask = Ec2TaskDefinition.Builder.create(this, "MyAppTask")        .family("MyApp")        .networkMode(NetworkMode.AWS_VPC)        .executionRole(Role.fromRoleArn(this,                settings.get("execution.role.id"),                settings.get("execution.role.arn")))        .build();ContainerDefinition container = appTask.addContainer("MyApp-" + settings.getEnv(), ContainerDefinitionOptions.builder()        .image(ContainerImage.fromRegistry("ecr.repo.url/myApp:1.8.0"))        .essential(true)        .cpu(2048)        .memoryLimitMiB(4096)        .memoryReservationMiB(1024)        .portMappings(Arrays.asList(                portMapping(8443,8443),                portMapping(8080,8080),                portMapping(9013,9013),                portMapping(9012,9012)        ))        .logging(LogDriver.awsLogs(AwsLogDriverProps.builder()                .logGroup(appLogGroup)                .streamPrefix("MyApp-" + settings.getEnv() + "-")                .build()))        .build());ApplicationLoadBalancedEc2Service ec2 = ApplicationLoadBalancedEc2Service.Builder        .create(this, "MyAppService")        .cluster(cluster)   // I thought this point of this was to allow the Ec2 instance to registered with the cluster?!        .taskDefinition(appTask)        .cpu(2048)        .memoryReservationMiB(1024)        .memoryLimitMiB(16000 )        .desiredCount(1)        .domainName(settings.get("hostname"))        .domainZone(domainZone)        .certificate( myAppCert )        .redirectHttp(true)        .protocol(ApplicationProtocol.HTTPS)        .targetProtocol(ApplicationProtocol.HTTPS)        .publicLoadBalancer(true)        .build();ec2.getTargetGroup().configureHealthCheck(HealthCheck.builder()        .path("/health-check.txt")        .interval(Duration.minutes(2))        .enabled(true)        .unhealthyThresholdCount(5)        .port("8443")        .protocol(Protocol.HTTPS)        .build());FollowComment"

Answer: "1Accepted AnswerSo from the code you can see I was using the default amazon linux image.  It is not a custom image or special AMI..machineImage(MachineImage.latestAmazonLinux())But that appears to NOT be compatible with ECS cluster requirements.  The fix was simple:.machineImage(EcsOptimizedImage.amazonLinux2())Switching the EcsOptimizedImage object I can spin up an ECS image that matches the requirements.  Once I deployed that I saw it register with the cluster and my image started up.  There are plenty of other issues I have to fix.  It's still not working, but at least it's registering with the cluster now.CommentSharechubbsondubsanswered 2 months ago0Hello,Warm Greetings from AWS Support.I am Tejas from the AWS Support Team.I have read your query and I understand that you have a CDK script which is trying to create an ECS Cluster , task and an application loadbalancer.You have mentioned that is not registered with load balancer target group and the task never starts.You are also suspecting that the EC2 instance does not gets registered with the cluster and the cdk scripts keeps waiting for it get healthy.You have also asked the following queries as to which part is creating the ec2 instance and if the addCapacity is declaring the specification of the Ec2 instance and further follow up questions related to the instance being launched.I have checked your cdk script and I would request you to check the following things mentioned below:-=============================================I would like to start by answering your query, The instance is being created in the cluster (). I noticed that the AMI used in the code is mentioned as " AMAZON_LINUX_2 ".Answering your next query. Yes, The addcapacity call is the one which declares the specification of the instance.I would request you to Check the AMI of your instanceIf the AMI that you use for the EC2 instance is a copied or custom AMI, then confirm that the instance has the following components:A modern Linux distribution running at least version 3.10 of the Linux kernel.Latest version of the Amazon ECS Linux container agent.A Docker daemon running at least version 1.9.0 and any Docker runtime dependencies (from the Docker website). To view the currentDocker version, run the command sudo docker version. For information about installing the latest Docker version on your particular Linux distribution, see Docker documentation for Install Docker engine on the Docker website.[NOTE] The Amazon ECS optimized AMIs [+] https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-optimized_AMI.htmlare preconfigured with these requirements. It's a best practice to use Amazon ECS optimized AMIs unless your application requires version that's not yet available in that AMI.===============================================I have read your script and compared your script with a script on github. I am pasting the link for the gitbhub script for your reference as well[+]https://github.com/aws-samples/aws-cdk-examples/blob/master/typescript/ecs/ecs-service-with-advanced-alb-config/index.ts[Note] On comparing the script , I have found that the load balancer is missing the listener in your script.I have then followed the documentation for python as well [3] https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ecs/README.html#clustersPlease check the section " Include an application/network load balancer  " the below listener is missing from your code.listener = lb.add_listener("Listener", port=80)Please refer to documentation [3] for more details.I would like to inform you that the Your Amazon EC2 instance can't register with or join an Amazon ECS cluster because of one or more of the following reasons:The ECS endpoint can't access the Domain Name System (DNS) hostname of the instance publicly.Your public subnet configurations are incorrect.Your private subnet configurations are incorrect.Your VPC endpoints are incorrectly configured.Your security groups don't allow network traffic.The EC2 instance doesn't have the required AWS Identity and Access Management (IAM) permissions. Or, the ecs:RegisterContainerInstance API call is denied.The instance user data for your ECS container is incorrectly configured.The ECS agent is stopped or not running on the instance.The launch configuration of the Auto Scaling group isn't correct (if your instance is part of an Auto Scaling group).The Amazon Machine Image (AMI) that you use for your instance doesn't meet the prerequisites.Below is a detailed documentation which will provide details of the all the above points which are mentioned above.IMP [+] https://repost.aws/knowledge-center/ecs-instance-unable-join-clusterYou can also debug more by checking the relevant api calls in cloudtrail where resources are present in your account.I hope the above information helps. In case you feel I missed out to address something more to your concern, or if we can otherwise provide any additional assistance with regard to this matter, please do not hesitate to let me know, I’ll be more than happy to assist you.CommentSharerePost-User-0066583answered 2 months ago"


Question: Do new managed data identifiers automatically get added to jobs?

"If you set up an Amazon Macie job and choose to use all managed data identifiers, and then you set it to run on a schedule, will it start including more and more managed data identifiers if and when more get added by AWS?FollowComment"

Answer: "0Hi, @yann_stonemanyes. Added managed identifiers are automatically covered.If ALL is specified, the job configuration will be set to ALL only as follows:aws macie2 describe-classification-job --job-id 5ef5a109c085a7ad997085f85b0605f4  {    "allowListIds": [],:    "lastRunTime": "2021-09-27T07:37:52.551473+00:00",    "managedDataIdentifierSelector": "ALL",    "name": "all hoge",    "s3JobDefinition": {:    },:}Most recently, in April 2022, managed identifiers such as JWT were added.However, if you have individually selected all instead of ALL, you will need to add them manually.CommentShareEXPERTiwasaanswered 5 months ago"


Question: DynamoDB Global Tables and Counters

"Greetings!I've created a DynamoDB table that manages counters. These counters have to be strongly consistent - the workflow currently is to update the counter and read the new value of the counter that is returned by the update.At some point I would like to go multi-region with my application and the next logical step is to convert my existing tables to global tables, but I have concerns that this particular counter table will not work on a global scale.My question is that if I convert this table to a global table and multiple requests across regions attempt to increment this counter, can I expect that it is possible two update requests may return the same value across regions?Unhappy path example:Counter = 1Request to increment counter by 1 in region A and B at the same timeRequest succeeds and the returned value for Region A and B is 2This would be bad, we need Region A to get 2 and Region B to get 3.FollowComment"

Answer: "1Interesting question. You  should not expect reads  to be strongly consistent across regions, There could be delays replicating data across regions ( even though ms). Can you have region specific counters, or update counters in only one region?You may also need to put your logic in a transaction and transactional operations provide atomicity, consistency, isolation, and durability (ACID) guarantees only within the region where the write is made originally. Transactions are not supported across regions in global tables.CommentShareDevinder-theDBGuyanswered a year agoAWS-User-6695896 a year agoThank you for the quick response! The counters can't be region specific, but I can definitely update counters in one region - it may make sense to provision the table in a central region to help with latency from requests across regions.Share"


Question: Advertise IP Pool to ISP Network

"Hi,Our team has been debugging slow connectivity issues between our Load Balancer in us-east-1 and some end users that are located in India.The IP block we are using for our elastic IP on the EC2 instance is owned by Amazon.A traceroute directly from one of our EC2 instances on that load balancer to one of the IP's that is experiencing slow connectivity, shows that the connection becomes significantly slower once it leaves the TATA router in Newark, NJ USA.traceroute -4 -I -n -w 30<snip>16  216.6.87.250  5.633 ms  0.791 ms  0.789 ms17  *  *  *18  216.6.57.5  9.398 ms  9.276 ms  9.300 ms19  66.198.70.10  198.610 ms  198.504 ms  198.524 ms20  *  *  *21  *  *  *22  *  *  *23  *  *  *24  *  *  *25  *  *  *26  *  *  *27  *  *  *28  *  *  *29  *  *  *30  *  *  *The ISP that our end users are using is TATA and they have reached out to their technical support.The TATA technical support have responded with a request that AWS "advertise website IP pool directly into TATA (AS4755)".Can AWS fulfil this request?Due to legal constraints we are unable to distribute our application globally, so connectivity needs to be resolved within the current architecture.FollowComment"

Answer: "2Accepted AnswerHello,Unfortunately AWS does not advertise and prefer specific IPs to ASNs directly by request.  Typically with BGP when making such changes, you'd advertise a /24 and not a single /32 to have the preferred route out through TATA.  These types of changes would affect multiple customers.I understand that you cannot distribute your application globally, but perhaps you can put additional services in place to support your external customers.  I would take a look at Global Accelerator as it may be a good fit to help optimize traffic paths for your customers.CommentShareEXPERTChris_Ganswered a year agoEXPERTToni_Sreviewed a year ago"


Question: EC2 to VPC Migration.

We have an old AWS account that has support for ec2-classic in several zones. I would like the ec2-classic to be removed to be prepared for the ec2-classic end of live. We don't have any ec2-classic resources being used so it can be safely removed. Can someone tell me what i am missing? Can someone on AWS initiate this process for us if needed?FollowComment

Answer: "1Accepted AnswerHello,If your account has access to EC2-Classic Networking but you are not actively using any EC2-Classic Networking resources, there should be no actions that you need to take on your end.  If you do have some resources that have not been migrated by August 15, 2022, you may be reached out to by the AWS Support Team to see if you need any assistance migrating resources off of EC2-Classic.Please see this blog post for additional information on preparing for the retiring of EC2-Classic Networking: https://aws.amazon.com/blogs/aws/ec2-classic-is-retiring-heres-how-to-prepare/CommentShareEXPERTChris_Ganswered a year agoEXPERTToni_Sreviewed a year agojareal a year agoThank you, Chris. All clear now.Share"