Question: I am unable to paste text or type while using Fleet manager in certain windows.

"When using the RDP session of fleet manager, I get strange errors when trying to type into certain windows. For example, I can type into the search bar and notepad, but when I open a PowerShell window, it doesn't respond to key inputs. The Command window works but the PowerShell window is what I use for a lot of admin tasks. Its making fleet manager almost unusable now. Is there a way to fix this?FollowCommentrePost-User-3290301 4 months agoI'm experiencing the same issue with my bastion host and it makes fleet manager almost useless.Share"

Answer: "-1Hi,Have you tried below which basically applies copy/paste for all operations.`Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.In the navigation pane, choose Fleet Manager.-or-If the AWS Systems Manager home page opens first, choose the menu icon (  ) to open the navigation pane, and then choose Fleet Manager in the navigation pane.Select the link of the managed node with the files you want to copy, or cut and paste.In the Tools menu, choose File system.To copy or cut a file, select the File name of the directory that contains the file you want to copy or cut. To copy or cut a directory, choose the button next to the directory that you want to copy or cut and then proceed to step 8.Choose the button next to the file you want to copy or cut.In the Actions menu, choose Copy or Cut.In the File system view, choose the button next to the directory you want to paste the file in.In the Actions menu, choose Paste.`https://repost.aws/questions/QUWBekwFYvRa6GQki8Pk6LgA/fleet-manager-rdp-session-copy-pasteLet me know if this helps..CommentShareShashank Abhishekanswered 5 months agorePost-User-3290301 4 months agoThe question says "unable to paste TEXT", it's not about file.It's an text input problemShareJM 2 months agoSame issue when trying to remote desktop SSO using fleet manager for the following imagesWindows_Server-2022-English-Core-EKS_Optimized-1.25-2023.02.14Windows_Server-2022-English-Core-ECS_Optimized-2023.02.21I can type "15" to "Exit menu and go to powershell", but then no keyboard inputs are shown on screen.I can however copy paste stuff right clicking on the terminal window.Any idea why this is occuring ?Share"


Question: Fleet IQ - Working

"I was going through the Fleet IQ documentation.It requires us to create a launch template and then it will do the rest like launching autoscaling etc.My queries are as followsHow it is managing the fleet here? Basically, since there are no fleets launched in the gamelift, what feature or functionality is it providing me?How it is distributing the game sessions to the game server? Does it also have details about the game session running on the game server or do I have to provide it to the Fleet IQ once I start the game from my backend logicHow I can configure or control concurrency in Fleet IQ like I have an option in gamelift serviceTo make my understanding simpler can I say thatIt only does capacity management nothing elseIt will be my responsibility to manage how many game servers I want to host on a single instanceConcurrency ( game session ) over a game server on a ec2 instance will be my responsibilityDo the above 3 statements are correct?Can I say that Fleet IQ only does capacity management or autoscaling infrastructure management of Spot instance in an effective way to save my cost for hosting?Thank youFollowComment"

Answer: "0FleetIQ was named after the Spot viability logic from GameLift Queues and Fleets.  This feature is for customers looking for a less managed version of GameLift where customers have more control of the AutoScalingGroup and what happens on the instances.  A GameServerGroup creates an AutoScalingGroup in your account.  At that point, you can directly update the launch template on the ASG, add scaling policies, SSH onto your EC2 instances, whatever you need to run your game.The main benefits a GameServerGroup provides:Spot viability management.  GameLift will continuously monitor the instance types / availability zones for Spot viability and modify your AutoScalingGroup so players are less likely to see Spot interruptions, but still utilizing Spot for cost savings.Game server management.  When server processes are ready to host a game session, they should register with GameLift via RegisterGameServer.  When your matchmaker is ready to place a match, it can call ClaimGameServer in order to get an available game server (including any ConnectionInfo or GameSessionData you want to provide) and connect players to that process.ClaimGameServer also performs AutoScaling instance protection (if enabled) and game session packing to make sure your instances are full rather than spreading game sessions across all instances.  This provides more cost savings since AutoScaling can scale in faster as player traffic comes down.What happens on each instance is up to you.  As you mentioned, with more control comes more responsibility with this feature.  You can use Kubernetes/Agones (https://aws.amazon.com/blogs/gametech/introducing-the-gamelift-fleetiq-adapter-for-agones/), other 3rd party process management, or create your own process manager to run on each instance.  If you want GameLift to manage processes on each instance, that's more in-line with what a GameLift Fleet provides.I would recommend reading EC2 metadata to get the IP address/port your process is using and provide that info in RegisterGameServer as the ConnectionInfo.  When your matchmaker calls ClaimGameServer, it will then have the IP/port needed for players to connect to the process.GameServerData can be used either as a way for your server process to send data to your backend service when it calls ClaimGameServer, or your backend service can pass GameServerData in the ClaimGameServer request to the server process on the instance.Hopefully that clears up this feature for you, let me know if you have any more questions.CommentSharerePost-User-4192873answered 2 years ago0Hey Joe,Thanks for your response but I am still not able to understand how the concurrency of my game session will be managed?For example, Let's assume I have baked my AMI and on Boot, I start 3 Game Servers (Let's assume there is only one EC2 Instance ), I call RegisterGameServer from all the 3 and all of them are healthy state after this Match Maker wants to start a game session on a gameGame session activationserver it will call ClaimGameServer API, Now the question is :Who and How it will be decided that on which game server the session needs to be placed.If a new game session is requested assuming my first session is full with all the players, how that will be started and on which game server, who takes this decision? like on which game server it should be started etcHow and Who manages the concurrent game sessions on a single-game server? Example in the GameLift Hosting Solution , I have the option to  provide Concurrent Process and Game session activation , How can I achieve this in Fleet IQ in my custom game. For Concurrent Process this will fall under my bucket to call RegisterGameServer and control concurrent process, but how and who will take care or control of the concurrent game session in a single process.CommentSharerePost-User-6659457answered 2 years ago0I'll start with this before answering your questions.  One of the benefits to GameLift not having any code on the instance is the flexibility of how you use GameServers.GameServer == Instance.  Customers can register/claim/health check treating a GameServer like an EC2 Instance in order to get instance protection and metrics based on instance utilization.  Customers are then responsible for process and game session management with their backend matchmaker.  You can think of ClaimGameServer as ClaimInstance if implemented this way.GameServer == Process.  Customers can register/claim/health check each process on each instance.  This is great if you run 1 game session per process or if your matchmaker already handles sending multiple game sessions to a single process.  You can think of ClaimGameServer as ClaimProcess with this implementation.GameServer == GameSession.  Customers can register/claim/health check each game session they want to run.  If you have a single process that runs 100 game sessions on an instance, that process can call RegisterGameServer 100x and ClaimGameServer becomes equivalent to ClaimGameSession.Who and How it will be decided that on which game server the session needs to be placed?GameLift decides within ClaimGameServer which game server is chosen.  GameLift prioritizes game servers by age, state, and packing onto instances.  If you've registered 3 game servers on 1 instance, ClaimGameServer will return gameServer-1 the first time you call that API, gameServer-2 the second time, etc.If a new game session is requested assuming my first session is full with all the players, how that will be started and on which game server, who takes this decision? like on which game server it should be started etc?In your example, you've registered 3 game servers with GameLift, with unique GameServerIds, let's say gameServer-1, gameServer-2, gameServer-3.  The first time your matchmaker calls ClaimGameServer, GameLift will return gameServer-1.  gameServer-1 will now have ClaimStatus CLAIMED and will not be chosen by ClaimGameServer again until ClaimStatus is reset 60 seconds later.  This means your matchmaker has 60 seconds to connect players to the host using the ConnectionInfo on the GameServer object and either the matchmaker or the process itself must call UpdateGameServer and set the UtilizationStatus to UTILIZED.  This tells GameLift that the GameServer is busy and the GameServer will not be chosen by ClaimGameServer again.  ClaimGameServer only returns GameServers with UtilizationStatus AVAILABLE and without a ClaimStatus.There's a nice visualization of calling ClaimGameServer / UpdateGameServer here:  https://docs.aws.amazon.com/gamelift/latest/fleetiqguide/gsg-lifecycle.html#gsg-howitworks-lifecycle-gameserverHow and Who manages the concurrent game sessions on a single-game server? Example in the GameLift Hosting Solution , I have the option to provide Concurrent Process and Game session activation , How can I achieve this in Fleet IQ in my custom game. For Concurrent Process this will fall under my bucket to call RegisterGameServer and control concurrent process, but how and who will take care or control of the concurrent game session in a single process.Concurrent process activations and all the general process management is up to you.  GameLift doesn't do anything on the instance, so that's all your responsibility.I think you're referring to a single process running multiple game sessions.  You can manage that or you can have GameLift manage that based on your implementation.  Sticking with the example, you have 1 instance with 3 processes and each of your processes should run 5 game sessions each for a total of 15 game sessions on the instance.If you want to manage game sessions, when your matchmaker picks a GameServer, your matchmaker should send the next 5 matches to that GameServer until your matchmaker needs a new process to place on, then it can call ClaimGameServer again.If you want GameLift to manage game sessions, your process can call RegisterGameServer 5 times.  I would recommend setting ConnectionInfo to "ip:1.2.3.4,port:5555,gameSession:1".  Now every time your matchmaker wants to place a match, it can call ClaimGameServer to retrieve a GameServer object and the ConnectionInfo will have the ip, port, and game session number.CommentSharerePost-User-4192873answered 2 years ago"


Question: Text chat moderation

"I have to moderate a simple text chat, looking for profanity inside messages and/or classifying sentences.I found a nice Microsoft guidelines to easily implement that using Azure's Cognitive Services.I wish to use AWS Comprehend, how can I do that?FollowComment"

Answer: "1Amazon Comprehend doesn't provide you this out of box currently. but you can train a document classifier model in Comprehend to classify sentences profane or notEdited by: KapilAWS on May 17, 2021 9:48 AMCommentShareKapilAtAWSanswered 2 years ago0I have to answer myself: no, Comprehend cannot do that.CommentSharew-francesco-vascoanswered 4 years ago0Which services to use for profanity filter, text moderation, post moderation and blog moderation? Does AWS Marketplace provide any service to integrate? If so, please mention.CommentSharesimranbayasanswered 2 years ago0Yes, that was helpful. Thank you!CommentSharesimranbayasanswered 2 years ago"


Question: Bug in the Sagemaker Studio!!

"I'm trying to open the Projects or Model Registry in AWS Sagemaker Studio from the Components and registries icon in the left sidebar.But when I choose either Projects or Model Registry from the dropdown menu it shows nothing except an error message:Response not successful: Received status code 400The region I'm working in is Frankfurt (eu-central-1).They used to work fine, but it's been a few days that I see this error. Please someone help me with this, I need to approve some models as soon as possible.FollowCommentgeorgios_s a year agoI would suggest you reach out to AWS Support who might be able to assist with your issue more quickly. In the meantime, if you have the appropriate permissions, you can try restarting your SageMaker Studio server. For this you can follow the instructions from here: https://docs.aws.amazon.com/sagemaker/latest/dg/studio-tasks-update-studio.htmlShare"

Answer: 2Please update to latest Studio version (3.21.1 or greater) and then do Application Reset.  Please let us know if you continue to see the issue.CommentShareAWS-User-0823842answered a year agozah-rou a year agoThanks for your response. I already updated the Studio by shutting down the servers from File -> Shut Down. But the error is there yet. Is there any instruction for "Application Reset" that you mentioned?Share


Question: How to Add Filter in DynamoDB Query with Number Set using Java SDK/PartiQL?

"Hi.I have a table that has Number Set attribute, Field1.Sample itemsField1 (Number Set)Field2Field3[1,2,3]DataData[2]DataData[3]DataData[2,4]DataDataHow to Add Filter in DynamoDB Query with Number Set using Java SDK/PartiQL? The search sets only 1 param to get the items.Sample scenario:Include 2 as Field1 filter, the result should have rows #1, #2, #4.Include 3 as Field1 filter. the result should have rows #1, #3.Thank you!FollowComment"

Answer: "1Accepted AnswerIn the PartiQL query editor the queries would look like:SELECT * FROM "tablename" WHERE contains("field1", 2)SELECT * FROM "tablename" WHERE contains("field1", 3)I have never created any JAVA client but reading the docs it would be someting likestatement = new ParameterizedStatement()     .withStatement("SELECT * FROM 'tablename' WHERE contains('field1', ?)")     .withParameters(new AttributeValue(2))CommentShareJaccoPKanswered a year agonoelbensonuy a year agocool! tried the PartiQL in the console and worked! greatly appreciate the answer.Share"


Question: What configuration do I need to use to utilize Transfer Acceleration when connecting to an S3 bucket via SFTP Client (Cyberduck / WinSCP) ?

"I am trying to help some team mates on the other side of the world to have faster upload and download speeds to our bucket located in the US. I have enabled Transfer Acceleration on the bucket, but I do not think the SFTP clients utilize it by default. I was able to connect with one IAM user to the root of the bucket by using the endpoint <bucket_name>.s3-accelerate.amazonaws.com instead of s3.amazonaws.com, but unfortunately my team mates across the globe use IAM users that only have access to specific folders within the bucket, and I have not successfully connected when testing with those users. The way they are doing it now, they connect to the bucket (with the original S3 endpoint) and input a path in the path option to /<bucket_name>/path/to/access where path/to/access is the single folder they have access to in the bucket.I use Cyberduck for my SFTP client and my team mates use WinSCP. I am not sure of the different options the tools have but I imagine the concepts are the same. Any ideas on how I can help them achieve faster speeds?FollowComment"

Answer: "0Hi,Hope you are having a good day!I understand you want to implement transfer acceleration for your users(Globally distributed) to access an S3 bucket located in US. Your approach is correct i.e. using <bucket_name>.s3-accelerate.amazonaws.com instead of s3.amazonaws.com, however, the use-case does not require any SFTP client actually, you can achieve the same using AWS CLI only. The endpoint are HTTP/HTTPS endpoints and the client software will be interacting with them using HTTP protocol only (Not SFTP). Considering AWS CLI is available for most of the operating system and is consistent across multiple platforms, it would be a much better alternative.—AWS CLI: https://aws.amazon.com/cli—Installing AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.htmlIn AWS CLI, you can leverage “--endpoint-url” parameter to specify which endpoint the request should be sent. Also, you can edit your default profile to send all requests to transfer acceleration endpoints by default.You can read more about our supported method of using transfer acceleration in the below document,—Using Transfer Acceleration: https://docs.aws.amazon.com/AmazonS3/latest/userguide/transfer-acceleration-examples.htmlAWS CLI reference example$ aws s3 cp file.txt s3://bucketname/keyname --region region --endpoint-url https://s3-accelerate.amazonaws.comIn addition to the above mentioned benefits, you can further optimize file performance of large uploads by altering parameters like maximum concurrent sessions,  etc. You can find details about these in the below document,—How can I optimize performance when I upload large files to Amazon S3?: https://aws.amazon.com/premiumsupport/knowledge-center/s3-upload-large-files/I will not be able to comment on the workings of WinSCP or Cyberduck in detail as I have very limited exposure of working on these 3rd party softwares. I hope you will understand. Having said that, I learned that these softwares directly access the S3 bucket and communicate using HTTPS endpoints only. I would like to know more about the reasoning of using this client since SFTP client are not required to access S3 buckets. If your intention is to list the bucket as a mountable drive or accessing the S3 bucket using “Transfer for SFTP” service (which accesses the S3 bucket as the back-end storage), kindly let me know. We can discuss a few other alternatives in details but first I would like to know more about the use-case.CommentShareSUPPORT ENGINEERUjjwal_Sanswered 9 months ago"


Question: Salesforce OmniChannel Softphone for Connect

"I have Connect running in Salesforce ok...when I go into OmniChannel and click the softphone it shows a button to login to connect there in the OmniChannel SoftPhone...when I click that I get another browser window pop outside of my browser to login with. I login ok there but the softphone UI stays in that browser window and OmniChannel SoftPhone is blank...it never shows up in the softphone in the OmniChannel Console. Any thoughts?Edited by: DonS on Nov 20, 2019 2:34 PMFollowComment"

Answer: "0Sounds like you haven't whitelisted your instance URL Correctly:https://s3.amazonaws.com/connect-blogs/Amazon_Connect_Salesforce_CTI_Adapter/Amazon_Connect_CTI_Adapter_-_Setup_and_Installation_Guide.pdfPage: 26 (Search for https://amazonconnect.sfdcinstance.visual.force.com/apex/ACSFCCP_Console)ThxDanCommentShareDanBloyanswered 4 years ago0Dan, you were correct, I had whitelisted the Lightning URL but not the Console. Thanks.CommentShareDonSanswered 4 years ago0As Dan pointed out RTFM carefully ;) You have to whitelist the URL for the CONSOLE not the Lighting PageCommentShareDonSanswered 4 years ago0I’ve done it way more times that I care to admit :) you’re brave enough to not suffer in silence mate CommentShareDanBloyanswered 4 years ago"


Question: "[RDS, Aurora MySQL] Frequent "Recovery of the DB instance has started. Recovery time will vary with the amount of data to be recovered.""

"We have a db.t2.small Aurora MySQL instance with less than 2GiB of data that has been entering recovery frequently - 6 times in the last 3 weeks.  From what I can find online, this is due to underlying hardware failures?  Shouldn't the database be migrated to good/working hardware after a failure?How do we prevent and/or reduce the frequency of these occurrences?  Is there something we could be doing differently?Also, our client software on our app server doesn't register a disconnect after this.  Does the original host stay up while/after the new one is spun up?  I've found anecdotal evidence that the IP might change, with people handling the event out-of-band by forcing a dns cache refresh via a triggered client software restart in response to the event.Recovery on: 2022-08-03, 2022-08-02, 2022-07-27, 2022-07-20, 2x 2022-07-19FollowComment"

Answer: "-1Looks like you are running a single instance cluster with no read replicas.If the underlying HW fails, it will try to bring up the instance on a new host and has to to crash recovery and can take up to 10 min.   Your application should be connecting to the cluster endpoint and that will not change.To avoid this downtime  you can add a replica which reduces the downtime to a few seconds instead of minutes, what happens in  the background is that it will failover to the replica and make it a writer instance. The cluster end point will remain the same.** PS : If this answers your question and helps you resolve the issue, please accept the answer **CommentShareDevinder-theDBGuyanswered 10 months agoUser28306523088602983 10 months agoThank you for your response.  Could you elaborate on a few points?The console only lists a reader and a writer endpoint.  What is the "cluster endpoint"?<somename>-cluster.cluster-ro-<some id>.<region>.rds.amazonaws.com<somename>-cluster.cluster-<some id>.<region>.rds.amazonaws.comCan you comment on the frequency of recovery events?  Bad luck?Share"


Question: Import Existing DynamoDB table schema to NoSQL workbench's Data model

"Importing data models that are exported by NoSQL workbench is available but is there a way to create data model json from current existing table?Output of json from awscli ( aws dynamodb describe-table ) seems to be little different from what we have to import to NoSQL workbench... (ex. KeyAttributes, NonKeyAttributes,...)Would be great if it's importable from Operation builder's tab.Edited by: adamist521 on Dec 9, 2019 1:54 AMFollowComment"

Answer: "0Hello,Thanks for the feedback.There isn't a way right now to create a data model from an existing table. You will have to manually create the tables in NoSQL Workbench model. This is one of the features in our backlog which a lot of users have asked for it. "aws dynamodb describe-table" is the same ask as before. You want the existing tables to be importable into a NoSQL Workbench model. As you've identified we already import the existing tables in Operation Builder so we will support importing existing tables in a model soon. Stay tuned for more updates.Thanks.CommentShareAWS-User-4262975answered 3 years agorePost-User-6215308 2 months agoAny updates on this?Share"


Question: Migrate distribution domain name to different CloudFront

"I need to migrate CloudFront and S3 bucket to a different AWS account within AWS Organization.Unfortunately, we use distribution domain name of the CloudFront in various places (not a custom CNAME alias), and we cannot simply change the URL. Is it possible to "transfer" distribution domain name of a CloudFront to a different one?ThanksFollowComment"

Answer: "0You can try contacting AWS Support, but aside from that, there is no way to transfer that domain.CommentShareJason Butzanswered a month agoGary Mclean a month agoAgree with Jason.. Next time be sure to use a CNAME then this will not be a problem againShare"


Question: Gamelift with Apple Gamecenter and Google Play Services

"Good day! I’m studying some solutions for my casual multiplayer game for mobile with Unreal Engine and I’m quite interested in GameLift. I’m studying the ways to authenticate and generate tokens for GameLift and I’m thinking in a way to automatic log in user when connected on Apple Gamecenter or Google Play Services. I’m seeing solutions with Cognito but I don’t have any way to connect with those services. How can I get this authentication cycle working, is it possible? Thanks!FollowComment"

Answer: "0Accepted AnswerHey GeekFox,Authentication is ideally handled on the client side or the game backend service; GameLift focuses on integration of game servers with cloud hosting solutions (e.g. EC2).You could checkout GameSparks, which has out-of-the-box solution for Authentication with Apple [1] or Google Play: [2]Alternativly, you could implement your own Authentication solution with Cognito.Create a Cognito user pool, identity pool and Apple/Google account, see: [3], [4]Call GetCredentialsForIdentity (Follow [5]) to get the auth tokensIf you are using Lambda game backend service, use the auth token to authenticate API gateway calls [6] to LambdaLambda will then make calls to GameLift, such as SearchGameSessions, StartMatchmaking, etc.[1] https://docs.gamesparks.com/api-documentation/request-api/authentication/signinwithappleconnectrequest.html[2] https://docs.gamesparks.com/api-documentation/request-api/authentication/googleplayconnectrequest.html[3] https://docs.aws.amazon.com/cognito/latest/developerguide/apple.html[4] https://docs.aws.amazon.com/cognito/latest/developerguide/google.html[5] https://docs.aws.amazon.com/cognito/latest/developerguide/authentication-flow.html[6] https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.htmlCommentSharerePost-User-7108006answered 2 years ago0Hey GeekFox,Authentication is ideally handled on the client side or the game backend service; GameLift focuses on integration of game servers with cloud hosting solutions (e.g. EC2).You could checkout GameSparks, which has out-of-the-box solution for Authentication with Apple: https://docs.gamesparks.com/api-documentation/request-api/authentication/signinwithappleconnectrequest.html or Google Play: https://docs.gamesparks.com/api-documentation/request-api/authentication/googleplayconnectrequest.htmlCommentSharerePost-User-7108006answered 2 years ago0I’ve managed to solve it. I’m using playfab to store securely user data and from there I handle user creation on cognito and store login data. My game retrieve login data from there and login into cognito to get auth tokens. Everything is secured and handled by lambdas with authorizers so only playfab or my game can access cognito.CommentSharerePost-User-0961017answered 2 years ago"


Question: Trouble in transferring call through quick connection.

"Our agents are unable to transfer a clients call to another agent. When they try to transfer the call using the quick connection feature everything starts normally but, the transfer never gets done, leaving the client on hold.I have tried to check the cloudwatch looking for some error, but it does not record the transfer process, which makes me think that it does not enter the transfer flow at all.The chat and task transfers work normally and the cloudwatch registers them correctly. The call transfer is the only one that is causing us problems.FollowComment"

Answer: "0Take this one part at a time. Sounds like the agent can see the QC to agent. What contact flow is associated with that QC? What does that flow look like, post a picture.CommentSharedmaciasanswered 8 months ago0We have tested with the Transfer to agent (beta) block, and directly with the "Set working queue" and "Transfer to queue" blocks, and saw no results. Directly it does not show any record in CloudWatch. The chat and task transfers work correctly, the only detail we are suffering is in the call transfers, in which, it does not even play the text "Transferring..." to the agent, instead, we hear a short beep, the internal transfer is canceled and the call is put on hold.CommentShareAdriananswered 8 months ago"


Question: Conversion of timestamp to date type mmddyy fails

"I need to convert timestamp into MMDDYY format :2020-01-31 01:14:00.000 must be converted to 01/31/20the timestamp is stored in a table and I need to display it  as MMDDYYHere is what I am trying to use :to_date(cast(timestamp_column as varchar), 'DDMMYY') - returns a completely different datePlease anyone help me out here asapFollowComment"

Answer: "2to_date(cast(timestamp_column as varchar), 'DDMMYY')So breaking this down, start at the inner most function.cast(timestamp_column as varchar)This will convert the timestamp to varchar and be something like this 2022-11-09 15:22:48.594634+00So then you have to_date() with the mask of DDMMYY. This means you are telling the to_date function that the format of the first parameter will be formatted like 091122 when it isn't at all. I'm guessing the output was something like 1990-10-22.How it is stored versus how it is displayed are two different things. It is a timestamp so don't worry about how it is stored. It isn't a string. So to display the timestamp in the format you want, use to_char. It means you are taking the timestamp and formatting with the mask you are providing.to_char(timestamp_column, 'DDMMYY')For example:select to_char(now(), 'DDMMYY'); to_char --------- 091122CommentShareEXPERTjgrcloudanswered 7 months agoEXPERTFabrizio@AWSreviewed 7 months ago0Hi akc_adi,Have you tried the following?select to_char(timestamp_column,'DDMMYY')If the timestamp_column is stored as varchar, then you have to cast to timestamp before:select to_char(cast('2020-01-31 01:14:00.000' as timestamp),'DDMMYY')Thanks,CommentShareZiadanswered 7 months agoFabrizio@AWS EXPERT7 months agothe additional explanation in the other answer make it easier to understand.Share"


Question: Workmail Groups Won't Redirect to Outside Email Account

"The majority of our employees forward their work email to a personal email address. We have one group set up on the console for all the employees so that we can send company wide messages. We just switched over to AWS workmail, and everyone has the forwarding set up where If when the message "has my name is in the to or cc box", then "redirect to personal@gmail.com". I sent an email yesterday, and it ended up in everyone's Workmail box instead of the personal gmail box. I've been testing this all morning with variations on the rules "is sent to" and "is received from", but nothing works. The email won't make it to the personal box if sent to an email group. Any suggestions?FollowComment"

Answer: "0HI,I tested a rule with the condition "Is sent to" and selected the group from the address book. Email sent to this group are correctly redirected in my tests. Do note that redirects will not always succeed if the original sender has a SFP record. When the sender SPF record that does not allow WorkMail to send the message WorkMail will not redirect the message as the recipient will think the redirected message is spam as it comes from a unauthorized source. In that case a forward rule will work.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 4 months ago0Hi Robin,Thank you for your assistance. When I changed the name for the condition "is sent to" from the person's name to the name of the group, this issue was resolved. I wish there was a condition that would just forward everything that arrives in their inbox to their personal email.Thanks!KatieCommentShareWTC9175answered 4 months ago0Hi Katie,You can create a rule without any conditions which will apply to all incoming mail. Currently this is only possible via Windows Outlook.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 4 months ago"


Question: RDS Postgres 14x: Resource disappear after convert to MultiAZ-cluster

"Hi,One of my SingleDB instance which is currently working and connected with application. I convert SingleInstance to MultiAZ-Cluster. After that instance is completly disappear from my RDS Console, like i doesn't  have any instance. But my application is still working, and all crud operation working fine.Could any one please tell, is it usual, should i wait?FollowComment"

Answer: "0Accepted AnswerSorry, It was reigion changed that disappear all resources.CommentSharerePost-User-1870805answered 5 months ago"


Question: Bucket disappeared from my account

"Today a bucket disappeared from my S3 account and another appears with an error. The bucket that disappeared until yesterday existed but today it just isn't showing up. The one that appears with an error was created more than 1 year ago, however the console says that it was created today. What options do I have to recover my information?FollowComment"

Answer: "1To answer your question, we require details that are non-public information. Please open a support case with AWS using the following link.https://support.console.aws.amazon.com/support/home?#/case/createCommentShareSUPPORT ENGINEERZizipho_Janswered 7 months ago"


Question: WAF IP Based Rule Issue

"Hi All,I have WAF ACL configured before API Gateway with simple one rule. As per requirement, rule should allow access from specific list of IPs else block the access.{  "Name": "waf_testing_1",  "Id": "0000000-0000-00000-0000-00000000",  "ARN": "arn:aws:wafv2:region:account_id:regional/webacl/waf_testing_1/000000-0000-0000-0000-0000000",  "DefaultAction": {    "Block": {}  },  "Description": "Match a specific URI pattern",  "Rules": [    {      "Name": "match_allowed_ip",      "Priority": 0,      "Statement": {        "NotStatement": {          "Statement": {            "IPSetReferenceStatement": {              "ARN": "arn:aws:wafv2:region:account_id:regional/ipset/allowed_ip/000000-0000-0000-0000-0000000"            }          }        }      },      "Action": {        "Block": {}      },      "VisibilityConfig": {        "SampledRequestsEnabled": true,        "CloudWatchMetricsEnabled": true,        "MetricName": "match_allowed_ip"      }    }  ],  "VisibilityConfig": {    "SampledRequestsEnabled": true,    "CloudWatchMetricsEnabled": true,    "MetricName": "AWS-waf_testing_1"  },  "Capacity": 1,  "ManagedByFirewallManager": false,  "LabelNamespace": "awswaf:account_id:webacl:waf_testing_1:"}But it is still allowing even if user is trying to access from different IP. I am really confused about IP based rule in WAF because WAF2 behaves differently and Classic version behave differently. I dont know if anyone has seen similar issue? Any suggestion?FollowComment"

Answer: "1In such situations it is good to check the IP address that your user is using over the internet and cross check using the Sampled Requests or WAF logs if that same IP is being logged. Also, sometimes our system might be assigned an IPv6 address along with the IPv4 and the system might be using that for communicating (I have noticed this in a few cases).As per your use case, I can understand that you want to allow a user only if the IP address is present in the IP set.However as per the rule configuration, none of the rules seem to be allowing the requestsThe match_allowed_ip rule will be inspected first, if an IP is not present in the IP set allowed_ip then the request would be blocked.If the IP is present in the rule then the rule will not match and the request will be evaluated by the default action which is again set to BlockI would request you to validate the user's IP, if the resource is associated with the correct Web ACL and go through the logs in order to determine which rule is Allowing the request.CommentShareAWS-User-3413787answered 22 days ago0If you want to restrict IPs on the API Gateway, I found the following resource-based policy to be a good way to do so.https://repost.aws/knowledge-center/api-gateway-resource-policy-accessAlso, looking at the WAF configuration you shared with us, the default rule is block, so if it doesn't match the IP-based rule, it will be blocked.So it is possible that all accessible requests are judged to match the IP set.One way to check this would be to output the WAF logs to S3.CommentShareEXPERTRiku_Kobayashianswered 25 days agosnowcoder_07 23 days agoHi @Riku Thanks for the reply.We have considered other options first like security group inbound rule, API resource policy but our use case is different. We have 500+ IPs in allowed list if IPs and whenever new gateway is deployed, gateway IP should be listed. Security group Inbound and resource policy is not good fit here. WAF has capacity to allow 10K ips and we can automate process to update IPs in IP set.WAF configuration is as expected if doesn't match IP based-rule then all request should be blocked else allow.ThanksShare"


Question: my account get charged again

"I have install EC2 free tier and RDS free tier using SQL Server Express.  I left the server for almost 24 hours but did not login to do anything.  Now I check my billing, it was increased $20.  Why does this happen?  Can anyone explain?  Better yet, can any AWS staff investigate this issue?  Please help.  THank you.FollowComment"

Answer: "1When provisioning free tire resources you have to ensure that you observe the limits to some of the services under the tire!There are limits to the free tire offering for each service.Use the Cost Explorer tool to visualize the usage costs:https://aws.amazon.com/aws-cost-management/aws-cost-explorer/CommentShareKipanswered a year ago1You can monitor your estimated AWS charges by using Amazon CloudWatch. When you enable the monitoring of estimated charges for your AWS account, the estimated charges are calculated and sent several times daily to CloudWatch as metric data.https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/monitor_estimated_charges_with_cloudwatch.htmlCommentSharesharpedgewvanswered a year ago"


Question: xml file not read/writable in aws hosting of .net core project

"I am stuck with aws. I have a .Net core project which read and write data in xml files. This works perfectly in local. But when I am publishing my project in AWS(linux env via elasticbean) then all the pages are working and visible except where read and write of xml files is required. At that point I am getting the below error message:{"StatusCode":500,"Message":"Internal Server Error. Error generated by NLog!"}The zip source of aws also not showing the xml files. Is this is a bug in AWS or I am doing something wrong? Shall I place the xml files inside the wwwroot folder or anywhere else. Please help as I am searching for the solution from hours. And where I can see the complete error details.FollowComment"

Answer: "0[javascript:alert(1);]Edited by: jepatel on Sep 29, 2020 6:39 AMCommentSharejepatelanswered 3 years ago0I got the answer by default aws bundle do not include xml files. So you have to explicitly right on the xml file and set it to Copy.CommentShareanuragrawat123answered 3 years ago"


Question: Key not found in KeySchema.

"A DynamoDB table suddenly shows error "Key not found in KeySchema.".We didn't change settings.It worked before.We can't explore items now.Obviously it's a bug.Please fix it.FollowCommentMLGuy a year agocan't be more vague than that. Try to give a few more details on your issue, such as where do you get the error. Try to login again to the management console, if this is where you get it. Your session might not be valid anymore.Sharejzhunter a year agoSomething else is going on. It's exceedingly unlikely this is a newly introduced bug with the DynamoDB service, because it would be affecting everyone.Share"


Question: Greengrass - Core device still rolls back deployment on failure despite rollback being disabled.

"Hi,I have an existing GG deployment where the 'Failure handling policy' is set to 'Don't rollback', however if I deploy a new revision of this deployment and a component fails (known issue with one of our custom components), the GG core device still rolls back? Is there any explanation for this?From GG Nucleus log on Core device:FollowComment"

Answer: "0Accepted AnswerIf your deployment requires a "bootstrap", meaning that Greengrass needs to restart, then it will always rollback if it fails. This is a safety measure to try and ensure you never have a completely borked system.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered a month agocgddrd a month agoMakes sense, many thanksShare"


Question: Migrating Views from on-prem MySQL to RDS MySQL

"I seem to be missing something, I ran a test run of DMS and all my tables were properly migrated. However none of my views came along for the ride. Is there a way to include the views in the migration. Are there are other things that are not migrated by default? Triggers, stored procedures, functions?Thanks!FollowComment"

Answer: "0DMS will only migrate the bare minimum components to perform the data migration i.e. table structure, primary key etc. It does not migrate foreign keys, views, procedures etc.You are doing a homogeneous migration i.e. MySQL to MySQL. Can't you restore using a backup / restore? Any particular reason you are choosing DMS?Check this link: https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.MySQL.htmlEdited by: VMG on Feb 2, 2021 12:57 PMEdited by: VMG on Feb 2, 2021 12:58 PMCommentShareVMGanswered 2 years ago0Ok, I wasn't sure if DMS was something equivalent to mysqldump. I guess it's more for migrating between database engines.Thanks!CommentSharebenanswered 2 years ago"


Question: Quicksight: Conditional Formatting only allows "COUNT" as aggregate

"Hello! I'm trying to create conditional formatting in a quicksight visual by creating a calculated column that sets the threshold for another column.Below I have an example of the data (left) and the threshold column I've created (right).I want the data in the left column to be conditionally formatted to have the background color stated in the right column.For example, the 75 at the top would have a green background color, -107 would be red, etc.When I go to Conditional Formatting >> Add background color, it only allows me to aggregate based on "COUNT" or "COUNT DISTINCT".  I don't want to aggregate anything here - I just want it to set the background to green if the column says "GREEN", or red if the column says "RED".You can see below that the "No aggregation" option isn't there, and I don't understand why.How do I get it to allow me to format the left column using the unaggregated right column?Thank you for your help!FollowComment"

Answer: "0Hello,Thank you for reaching out to us.In order to replicate the use-case, I created a dataset(in excel) as below :-valuescolour75GREEN67GREEN-79GREEN-107RED53RED-79GREENThen i created an analysis (type : pivot table) from the above dataset.Go to Conditional formatting ->Column -> valuesFormat field based on -> coloursAggregation -> No AggregationCondition#1 -> EqualsValue - > GREEN (in the right check box 'color', I choose green colour)Add ConditionCondition#2 -> EqualsValue - > RED (in the right check box 'color', I choose red colour)Attaching screenshots for your reference.Thank you !CommentSharePriyaAWS2020answered 10 months agojros14 10 months agoHi, thanks for your response, but it didn't answer my question.How do I get the "No Aggregation" option to appear?  This is the question I'm asking.You say to select "No Aggregation."  This is what I want to do.  The problem I'm running into is that it doesn't give me the option to select "No Aggregation."  It only allows me to select "COUNT" or "COUNT DISTINCT" as I've shown in the image in the original post.How do I get the "No Aggregation" option to appear?Thank you for your help.Share"


Question: aws token problem

"Hello, I had to get successful response a few hour before but now I could get the "message": "Access to requested resource is denied.","code": "MissingAuthenticationToken",is my account ban or something else? Can you help me please?FollowComment"

Answer: "0Hey @rePost-User-9431081 I would need more information about the context of your need. That said I would open up a support ticket if applicable so that AWS support can assist you.https://docs.aws.amazon.com/awssupport/latest/user/case-management.htmlLet me know if you have any issues with this, or if it helps you then please accept my answer after you've tried it out - it would be much appreciated! Good luck :)CommentShareD Ganswered 20 hours ago"


Question: PSI Secure browser didn't launch while exam

"I had scheduled AWS Cloud practitioner exam on 31st dec 6 PM IST. Verified the system check as mentioned before and logged in on correct timing. But when I launch the exam, it asked yo install PSI Secure browser to start the exam, but unfortunately it didn't work.Contacted support team to resolve, although tried in 2 different laptops with different network, nothing worked. Took almost 2 hours but no luck.Contacted PSI team multiple times after that, but no support from anyone. It's irritating without any reply or any help about next step.Please guide on next step whether it will be rescheduled or refunded? I have used 50% voucher as well. So what will be the status of my exam.FollowComment"

Answer: "0Please submit a ticket to the AWS Training & Certification customer support team, and they will provide assistance. If you already submitted a case, please allow at least 48 hrs to get a response.CommentShareNelliT-AWSanswered 5 months ago"


Question: Please add TLD ".site" to Route 53

Hi! I would like to transfer a domain from another registrar. The TLD is ".site" but that TLD seems to be missing on the available TLD list. Please consider adding ".site" to TLD list.Thanks a lot in advance.FollowComment

Answer: "0Hello, thank you for reaching out.I understand that you are requesting for addition of ".site" to TLD list.Route 53 Domains is currently directly accredited with .com, .net, and .org registries. All other TLDs are provided via third party registrar associates. To improve our level of service and support, we are actively working to become directly accredited with all other TLDs.In addition to improving our existing offering, we will become accredited with other registries to expand our TLD catalog. This work is currently in progress, and rest assured I have added your TLD request in there as well. Please note that we do not currently have dates to share for adding new TLDs.You can monitor the updates here at AWS Blogs - https://aws.amazon.com/blogs/aws/ and what's new on AWS - https://aws.amazon.com/new/CommentShareSUPPORT ENGINEERYash_Canswered a year ago0Thank you for your work !CommentShareAWS-User-5574137answered a year ago"


Question: Greengrass V2 have component call appsync endpoint

"For an upcoming project we want to use greengrass v2 with a custom component(lambda) that requests data using an appsync api call.Using the TokenExchangeService component we are able to make requests to S3 and other service but we are unable to use the AwsAppsyncClient library to connect to Appsync.is there a way to have the appsync client use the token exchange service or to get the credentials by calling the service directly?FollowCommentvidishataws a year agoHello ywk,Can you please share the error message that you get when you try to use the AwsAppsyncClient library to connect to Appsync?Also, please check if your core device has permissions to call AppSync. For more details, check this page https://docs.aws.amazon.com/greengrass/v2/developerguide/device-service-role.html#device-service-role-permissionsThanks,VidishShareywk a year agohello vidishataws,I get a  "ApolloError: Network error: Response not successful: Received status code 403."I have added the appsync permission to the token exchange role that is attached to the core device.I am able to use the S3 client from the normal aws-sdk to list all buckets in my account so I know that the token exchange role is correctly attached to the core device.I seems however that the appSyncClient does not use the AWS_CONTAINER_CREDENTIALS_FULL_URI environment variable to request credentials from the token exchange service. Instead I have to provide it with an acces key id and secret acces key upon creating an instance of the client.Is there a way to get those using the token exchange service? Since calling a get request to the AWS_CONTAINER_CREDENTIALS_FULL_URI gives me a invalid session token error, this seems not possible at the momentSharevidishataws a year agoHello ywk,Can you share more details related to your custom component. The language that you are using? How you create the client? And how you are trying to access AppSync?Thanks,VidishShareywk a year agoMy custom component is a nodejs lambda that uses the appSyncClient to query an AppSync API in the same account and region as the greengrass deployment.This is the code that I use.const graphqlClient = new AWSAppSyncClient({url: "https://XXXXXXXXXXXXXXXXXXX.appsync-api.eu-west-1.amazonaws.com/graphql",region: process.env.AWS_REGION ?? "",auth: {type: "AWS_IAM",credentials: {accessKeyId: process.env.AWS_ACCESS_KEY_ID ?? "",secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY ?? "",sessionToken: process.env.AWS_SESSION_TOKEN,},},disableOffline: true,});and than query using:const result = await graphqlClient.query({query: query,});Share"

Answer: "0Hi,I hope that you are doing well. I would just like to check in and confirm if you are still experiencing the issue? I just want to confirm if you may have made some progress so that I can reach out to our service team with the latest information.CommentShareSUPPORT ENGINEERRyan_Aanswered a year ago0Hi,It seems this should be as expected. The Greengrass Token exchange service provides an environment variable AWS_CONTAINER_CREDENTIALS_FULL_URI. However, this is only compatible with the SDK's found here in this page of our documentation -> https://docs.aws.amazon.com/sdkref/latest/guide/feature-container-credentials.html#feature-container-credentials-sdk-compatI assume that you are making requests to S3 using one of these SDK's which is why it is successful. Please correct me if I'm wrong.In the above instance, I believe you are using a separate library in connecting to appsync -> https://github.com/awslabs/aws-mobile-appsync-sdk-js. Unfortunately, I do not see any method to make AWS_CONTAINER_CREDENTIALS_FULL_URI work with this library. Therefore, you would need to generate credentials which you will be providing to this library outside of AWS_CONTAINER_CREDENTIALS_FULL_URI.CommentShareSUPPORT ENGINEERRyan_Aanswered a year ago"


Question: Is it possible to move a manual snapshot from one instance to another

"Is it possible to move a manual snapshot from one instance to another? I see that you can create a new instance from a manual snapshot, but can't see if one can take a manual snapshot from instance 2 and use it on instance 1 (to function similarly like a staging and live site)FollowComment"

Answer: "0If your goal is to minimize downtime, you might consider creating a new instance from your snapshot, then pointing your static IP to the new instance once you've verified the new instance is working as expected. When you're satisfied the new code hasn't caused a regression you can delete the old instance and will only be charged for the time you were using both instances.This assumes that you've configured a domain to point to a static IP, and that static IP points to an instance. This is a good practice because the public IP of an instance can change when you stop/start the instance.CommentShareGabriel - AWSanswered 5 months ago"


Question: Is it possible to use ALB/NLB infront of an API Gateway.

"Hi AWS, is it possible to use ALB or NLB infront of an API Gateway. Workflow is Client --> ALB/NLB ---> API Gateway ---> ***Please respond.ThanksFollowCommentromerogt 9 months agoWhat would be the use case or objective for doing that configuration?Share"

Answer: "2Hi Arjun, Why would you want this kind of architecture? What are you trying to achieve?ALB is possible behind API Gateway, not the other way around.CommentShareapradanaanswered 9 months ago0You can put both an NLB or an ALB in from of a REST API, as long as the API is a private API which can be accessed only from the VPC where you place the load balancer. You configure the load balancer to use IP address for the target group and you specify the IP addresses of the API Gateway VPC Endpoints. The following extrenal blog shows how to do it for creating custom domain names for private APIs.CommentShareEXPERTUrianswered 9 months ago"


Question: Configuring P-State AMD: m5a.4xlarge

"All,I am playing around AMD's P-States on m5a.4xlarge, to understand how to efficiently tune the ec2 instance to get the price advantage of m5a.4xlarge which is nearly 10% better than Intel. Have you encountered a PoC/experiment where you found a way around it?Thanks!FollowComment"

Answer: "0Hello, thank you for your post.EC2 instance types that use the Nitro system do not support the ability for an operating system to control the CPU P-state settings. Therefore, the "amd-pstate" driver that is discussed in the documentation you linked cannot be used.Having said that, I can confirm the default CPU P-state settings for these instances types already provide maximum performance.Please feel free to let me know if you have any questions.CommentShareSUPPORT ENGINEERAWS_SamManswered 4 months agorePost-User-5414011 4 months agoWe ran a fairly simple workload and bought up a burst of "sleep" pods on m5a.4xlarge and m5.4xlarge. To our surprise, we were performing 5.23 worse on m5a.4xlarge. That does not align right with 10% price benefit.Further digging allowed me to understand we were spending a lot of cycles on CPU, allowing me to suspect the P-States of the instances. Can you tell me if there are any best practice guidelines to run an m5a.4xlarge?Also, do share any docs to give me more info on the CPU Frequency of m5a.4xlarge instances running on Nitro?Share"


Question: Can I delete one VPN tunnel from site-to-site VPN connection ?

"We use Cisco Meraki firewall on our on-premises corpnet to create a site to site VPN connection to AWS. By default, AWS creates two VPN tunnels for HA, but Meraki firewall doesn't support this HA VPN tunnels, it can only create one VPN tunnel toward AWS if VPC subnet (remote subnet) is same. I am wondering if I can delete one of two VPN tunnels to make my AWS site to site VPN connection configuration clean and not tunnel showing in down state?ThanksJerryFollowComment"

Answer: "0Hello Jerry,Unfortunately this is not supported, if you are getting bothered with the notifications you are receiving due to having only a single VPN tunnel, you may reach out to AWS Support to get this disabled for your account in the region where you have the VPN connection with. Let me know if you have further queries.TimCommentShareTimothy_Manswered a year ago0Hello There,I understand that the CGW device does not support multiple tunnels and that should be completely fine. You can still operate in a single tunnel mode. there is no specific requirement to delete the second tunnel. You may just choose to ignore the same and not configure it.It would work completely fine.Also, as mentioned above, you can reach out to AWS Premium support to disable the notifications, if that is something you desire.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered a year ago"


Question: Can the customer check the average cost per query in Timestream?

The customer would like to check the average cost per query in Timestream to be able to analyze and optimize their queries. Is there a way to do that?FollowComment

Answer: "0Hi Ra,I believe you want know the cost per query in Timestream to analyze and optimize queries.  Queries are charged based on the amount of time-series data scanned by Amazon Timestream’s serverless distributed query engine while computing data for queries sent from your applications or from your configured scheduled queries, with a 10 MB minimum per query. A query costs $0.01 per GB scanned [1]. You can also you use AWS Cost Explorer to visualize, understand, and manage your AWS costs and usage over time [2].[1] https://aws.amazon.com/timestream/pricing/[2] https://aws.amazon.com/aws-cost-management/aws-cost-explorer/CommentShareLwazianswered a year ago0Query cost is calculated based on the data scanned by the query.  There is no simple formula to calculate the average cost/query 'coz it all depends on how efficient the query is written, right data model and using right query predicates.   WE have some sample query cost calculation listed on pricing section for your reference: https://aws.amazon.com/timestream/pricing/?nc=sn&loc=3CommentShareSreenath_Ganswered a year ago"


Question: CloudWatch Log Insights results  @LogStream not always clickable.

"Hi,I notice a strange behavior with Log Insights results.If the display command ends with @LogStream the stream is not clickable.But if I add another field after the @LogStream, it become clickable.fields @timestamp, @message, @logStream| filter @message like /Error/# Sadly the below display show the logStream as text.# | display  @timestamp, @message,  @logStream# with the below display logStream is clickable.| display  @timestamp, @message,  @logStream, @log| limit 80| sort @timestamp ascFollowComment"

Answer: "1I tried querying a single log group and it likely inferred it to be that log group. That means even if display ends with @logStream it will show it as a link.  However if I query against multiple log groups, I will have to also return the log group name so that the log stream link can be generated.CommentShareEXPERTAWS-User-Nitinanswered 8 months ago0Hello,The difference could be generated because of the query being executed against multiple log groups.When the following query is executed by selecting a single log group, it is understood that the log event in the query result belongs to the selected log group and the log stream link is provided.fields @timestamp, @message, @logStream| filter @message like /Error/| display @timestamp, @message, @logStream| limit 80| sort @timestamp ascWhen the same query is executed by selecting multiple log groups, the corresponding log group of the log event cannot be identified and hence the log stream link is not obtained.@log is a log group identifier in the form of account-id:log-group-name. When querying multiple log groups, this can be useful to identify which log group a particular event belongs to. Refer to the document https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData-discoverable-fields.htmlHence, the log stream link can be obtained by executing the following query upon selecting multiple log groupsfields @timestamp, @message, @logStream| filter @message like /Error/| display @timestamp, @message, @logStream, @log| limit 80| sort @timestamp ascHence, while querying for multiple log groups you will have to use @log in the query to get the log stream link in the query result.If you have any questions specific to a particular log group, also feel free to raise a case with AWS Support and we can assist you in troubleshooting specifically for a resource.I trust that you find above information helpful.CommentShareSUPPORT ENGINEERshreyasAWSanswered 8 months ago"


Question: Error when running vsock_sample AWS nitro tutorial

"I have configured and build the enclave instance as per https://docs.aws.amazon.com/enclaves/latest/user/enclaves-user.pdf . But when I tried to run in it throws the following error$ nitro-cli run-enclave --eif-path vsock_sample.eif --cpu-count 2 --enclave-cid 6 --memory 512 --debug-modeStart allocating memory...Started enclave with enclave-cid: 6, memory: 512 MiB, cpu-ids: [1, 5][ E36 ] Enclave boot failure. Such error appears when attempting to receive the `ready` signal from a freshly booted enclave. It arises in several contexts, for instance, when the enclave is booted from an invalid EIF file and the enclave process immediately exits, failing to submit the `ready` signal. In this case, the error backtrace provides detailed information on what specifically failed during the enclave boot process.For more details, please visit https://docs.aws.amazon.com/enclaves/latest/user/cli-errors.html#E36If you open a support ticket, please provide the error log found at "/var/log/nitro_enclaves/err2022-04-27T03:41:39.495653281+00:00.log"Failed connections: 1[ E39 ] Enclave process connection failure. Such error appears when the enclave manager fails to connect to at least one enclave process for retrieving the description information.For more details, please visit https://docs.aws.amazon.com/enclaves/latest/user/cli-errors.html#E39If you open a support ticket, please provide the error log found at "/var/log/nitro_enclaves/err2022-04-27T03:41:39.495889864+00:00.log"Action: Run EnclaveSubactions:Failed to handle all enclave process repliesFailed to connect to 1 enclave processesRoot error file: src/enclave_proc_comm.rsRoot error line: 349Build commit: not availableHow to fix this error ?FollowComment"


Question: Is it possible to connect CodeBuild to CodeCommit over PrivateLink ?

"I am able to connect CodeBuild with CodeCommit via NAT gateway in public subnet -> Internet Gateway. As both CodeCommit & CodeBuild are on AWS, I am trying to avoid using Internet Gateway.Here's what I have done so farCreated endpoint for CodeCommitAttached it to private subnetConfigured CodeBuild to use the same subnetI am curious on what can be done here to avoid using Internet Gateway.FollowComment"

Answer: "0Accepted AnswerSo long as CodeBuild has network connectivity to your CodeCommit endpoint, and the DNS resolution that CodeBuild sees for the CodeCommit service is overridden to point to that endpoint, then CodeCommit will be accessed without using the IGW.  DNS resolution is overridden via a Private Hosted Zone (PHZ).  The way it works within a single VPC is that you set PrivateDnsEnabled=true for the VPC Endpoint when you create it, which sets up an AWS-managed PHZ associated with the VPC.See https://www.linkedin.com/pulse/how-share-interface-vpc-endpoints-across-aws-accounts-steve-kinsman/ for more info.CommentShareEXPERTskinsmananswered a year agorePost-User-2082718 a year agoCreated PHZ for git-codecommit.us-east-1.amazonaws.comAdded DNS "A" record for *.git-codecommit.us-east-1.amazonaws.com and pointed it to the endpoint - 10.10.10.229 in my caseOn CodeBuild now I get "CLIENT_ERROR: Get "https:// git-codecommit.us-east-1.amazonaws.com/v1/xxxxxk": dial tcp: lookup git-codecommit.us-east-1.amazonaws.com on 10.10.10.2:53: no such host for primary source and source version refs/heads/master"I must have misconfigured something here.Shareskinsman EXPERTa year agoIf you're not sharing across VPCs, it's easiest to set PrivateDnsEnabled=true and let AWS manage the PHZ for you.  Though of course you can set "false" instead and do your own as it sounds like you're doing.  The PHZ would normally contain an Alias record mapping the service DNS name to the VPC Endpoint name rather than a regular A record mapping to an IP address.  For example an SMS PHZ of ours has:Record name = sms.ap-southeast-2.amazonaws.comValue = vpce-xxxxxxxxxxxxxxxxx-xxxxxxxx.sms.ap-southeast-2.vpce.amazonaws.com.Alias = YesYou don't need "*." on the front of the record name.SharerePost-User-2082718 a year agoVPC has "DNS hostnames" & "DNS resolution" enabled. Can I set "PrivateDnsEnabled=true" using console?So far I have tried following:Created Private Hosted Zone in Route 53 for git-codecommit.us-east-1.amazonaws.comAdded A record using alias to point to the endpointGetting "CLIENT_ERROR: Get "https:// git-codecommit.us-east-1.amazonaws.com/v1/repos/Test/info/refs?service=git-upload-pack":x509: certificate is valid for codecommit.us-east-1.amazonaws.com, *.codecommit.us-east-1.vpce.amazonaws.com, not git-codecommit.us-east-1.amazonaws.com for primary source and source version refs/heads/master"Deleted old private hosted ZoneCreated new private hosted Zone for codecommit.us-east-1.amazonaws.comAdded A record using alias to point to the endpointGetting "CLIENT_ERROR: Get "https:// git-codecommit.us-east-1.amazonaws.com/v1/repos/Test/info/refs?service=git-upload-pack":dial tcp 52.94.226.180:443: i/o timeout for primary source and source version refs/heads/master"Share0I chose wrong endpoint CodeCommit. After choosing "git-codecommit" in Endpoint.CommentSharerePost-User-2082718answered a year ago"


Question: Where can I find "Amazon ECS GPU-optimized AMI" in the EC2 console?

"According to this document, Amazon recommends an AMI called "Amazon ECS GPU-optimized AMI" for workloads targeting GPU on ECS. I have a docker image built that requires GPU, so I want to use this AMI as the base for ECS. But I can't find that AMI anywhere in the console. There's a Amazon official AMI called "Deep Learning AMI GPU PyTorch 1.13.1 (Amazon Linux 2) 20230201", but it can't possibly be that one, because in the docs, Amazon(without a link) is calling it "Amazon ECS GPU-optimized AMI", nothing about "Deep Learning" or "PyTorch" in noted in the docs, and nothing about "ECS" is mentioned in the AMI title. In the Marketplace AMIs, there's one called "ECS-Optimized Amazon Linux 2 GPU with Support by Supported Images" which is the closest name to what the AWS docs have referenced, but that's by a 3rd party company called "Supported Images", which is not mentioned in the AWS docs, and has just about the shadiest website i've seen since 1998 https://supportedimages.com/ (was surprised to find NO comic sans on their website). The name alone seems like exactly what you'd call a scammy company trying to get credibility.Can anyone help me find what Amazon is referrring to in this document, when they say "Amazon ECS GPU-optimized AMI"? Thank you.FollowCommentGabriel Olaleye 4 months agoIt's possible that the "Amazon ECS GPU-optimized AMI" mentioned in the document has been deprecated or changed. It's also possible that there was a mistake or error in the document. To be certain, it would be best to reach out to Amazon Web Services support for clarification on which Amazon Machine Image (AMI) they currently recommend for workloads targeting GPU on Amazon Elastic Container Service (ECS).Share"

Answer: "0Hello Peter,Amazon ECS team publishes the ECS Optimized AMI IDs as a parameter on Systems Manager Parameter Store. For more info, please check here.To find the latest ECS Optimized AMI ID for your desired AWS region, you can run the below AWS CLI command.aws ssm get-parameters --names /aws/service/ecs/optimized-ami/amazon-linux-2/gpu/recommended --region <enter-region-here>Hope this helps!CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered 4 months ago"


Question: The email that has been send from SES is not recieved by the end user

I have Production access in my Aws SES Service and I have send Test email from a verified identity ( That was my personal Gmail ). when I verified my company email address and send a test mail it shows that the email had been send successfully but not recieved by the end user . I contacted my Company IT team to ensure that there is no blocker or restriction in sending email from company mail id . So what is the actual reason behind thisFollowComment

Answer: "0Do you have the corresponding e-mail address on your suppression list?If you are on this list, you will not receive emails.You can check it by following the methods in the following document.https://docs.aws.amazon.com/ses/latest/dg/sending-email-suppression-list.html#sending-email-suppression-list-view-entriesCommentShareEXPERTRiku_Kobayashianswered 22 days agorePost-User-8406405 22 days agoNo there is no emails in the suppression listShare"


Question: Creating groups in WorkDocs

"Hi all, I'm just wondering how to create groups of members in WorkDocs? I am working as part of a project where we will need to assign groups of people to folders with different permissions.FollowComment"

Answer: "0Hi ClogaghFrom the note,I understand you wondering how to create groups of members in WorkDocs? You working as part of a project where we will need to assign groups of people to folders with different permissions. Please correct me if my understanding is wrong.On your Active Directory create groups and add users you want to have an access on that file or folder and give permissions. Go to your workdocs site, select your folder, click “share” then “invite people” and there you can search users and groups within your organisation, then an email will be send to people notifying them a file is shared with them.I hope the above information is helpful.References:https://docs.aws.amazon.com/workdocs/latest/adminguide/cloud_quick_start.html2 https://aws.amazon.com/about-aws/whats-new/2015/04/share-with-groups-and-co-own-documents-with-amazon-workdocs/CommentShareNonkululekoanswered a year ago"


Question: RDS Postgres - Is lower provisioned IOPS better than higher baseline IOPS?

"We have a Postgres running with a 5TB storage.And we have provisioned 5K IOPS.But, after reading the AWS documentation we found that storage with 5TB has more than 15K baseline IOPS. And also cheaper.Now I'm confused.Is lower provisioned IOPS better than higher baseline IOPS?(5K P-IOPS vs 5TB gp2 storage)FollowComment"

Answer: "0Accepted AnswerYes, 5T will have a baseline of 15k IOPS.The docs explain the difference https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html"AWS designs gp2 volumes to deliver 90% of the provisioned performance 99% of the time.... whereas io1 delivers within 10 percent of the provisioned IOPS performance 99.9 percent of the time over a given year."Also io1 has higher throughput capacity (gp2 is pretty good however 250mb/s).So gp2 might be a much better option. I did not find your instance, so I could not comment on your capacity usage.-PhilCommentShareMODERATORphilawsanswered 4 years ago0I think that is answered in the other thread you found, and I did add the link to a video where Grant discuss bursting (he talks about both T2 and GP2 as they were newish capabilities at the time). Thanks for giving me an excuse to talk about this some more...The main thing I'll re-emphasize is that IO1 has a better SLA (both explicit and implicit) than GP2, which largely explains IO1's high cost. By way of (not necessarily accurate) explanation, the bursting concept, such as used in GP2, is one of over-provisioning resources based on statistical and historical usage patterns. So you mix different volumes on a set of resources (SSDs, servers, network adapters, etc.) that can support them going at baseline but not all going at burst. You do this based on both the volumes' historical activity and statistical assumptions about how likely actual IO will approach the resources' capacity. If the usage across multiple volumes changes from historical patterns, and you approach or exceed resource capacity, you consider migrating volumes to re-balance the load. During the hot periods, and any re-balancing, your volume can see increased latency, and potentially less than its targeted IOPS. This is all designed to keep the latency and IOPS within a range that most apps would never notice it, though if the app is super-sensitive to latency it can.With IO1 (again, not claiming 100% accuracy in my explanation) volumes are placed on resources that can deliver all the provisioned IOPS of all the volumes they host. So one volume's performance doesn't suffer as the usage patterns from other volumes assigned to the same resources change. That doesn't mean there isn't some variability in performance, but it is within a much tighter SLA that takes into account all manor of occasional wonkiness found in any complex system.CommentShareHalTempanswered 4 years ago0ok. thank you!CommentShare0dbdbdbanswered 4 years ago"


Question: Not able to make payment

"I have outstanding payment which is less than Rs 1. And the bank is rejecting it because it is less than Rs 1. I am unable to change the amount, can’t find out how to make advance also. I am getting reminders to make the payment. How do I make this payment ?FollowComment"

Answer: "1If it's less than 1 rupee and not able to make payment. then : (1) for the first time creation payment then its possible bcz its either 2 $ or 2 ₹ or (2) just raise a ticket to AWS for account payment they will help regarding payment issues if you using free tier (3) for not free tier wait for more charge so you can make payment. (4) try to use another payment method such as credit, debit, or net banking which maybe work.CommentShareVISIanswered 10 months ago"


Question: VMware Cloud on AWS and AWS External IP range for firewall access

"A customer is configuring firewall rules between their test on-premises environment and the VMware Cloud on AWS (VMC) on Software Defined Data Center (SDDC).  Since, they won’t know the allocated Public IP Addresses for the SDDC HCX and vCenter Instances until the SDDC is deployed, their security team would like to add the AWS Public IP Address Pools to the required FW rules.I know we have the AWS IP Ranges JSON. From my research it appears that Elastic IPs can be from the AMAZON or the EC2 service pools.Do the SDDC and appliances (for example: HCX and vCenter) receive a public IP Address from the EC2 & AMAZON Service Pools from this list?FollowComment"

Answer: "0Accepted AnswerCorrect, we allocate from "EC2". If you check the following blog, IP was allocated from the block found in IP ranges JSON file:{  "ip_prefix": "52.58.0.0/15",  "region": "eu-central-1",  "service": "EC2",  "network_border_group": "eu-central-1"},You can further scope down the filter by using AWS Region to match where SDDC is going to be deployed.CommentShareEXPERTEvgeny-At-AWSanswered 3 years ago"


Question: AWS Solutions- AI-Driven Social Media Dashboard Solutions Implementation

"Hi,I am trying to deploy the AWS solutions - AI-Driven Social Media Dashboard Solutions Implementation for customer's use cases. I could deploy the Cloudformation template without any errors but the user-data script had some issues ( I guess) and it never executed in the EC2 instance. I could see the deployment of Kinesis firehouse and S3 buckets but the instance was not able to get the active tweets and dump them into S3 buckets.https://aws.amazon.com/solutions/implementations/ai-driven-social-media-dashboard/FollowCommentYudho Ahmad Diponegoro a year agoI think it happened to me before and it seems the issue was that I deployed it on a region other than us-east-1. May I know which region are you deploying into?Shareaaronmarkham-AWS a year agoJust thought I'd try it out, but given a new app on Twitter, it is setup with v2 of their API. Does this solution work with v2?Sharehawkoli1987 a year agoHi 6678862,I tried deploying the AI Social Media Dashboard template twice. Both times with stack successfully created.In the first time, I was able to find some csv and metadata objects inside the S3 bucket. The files can be downloaded, but they contain nothing other than the column headers. I kept the EC2 instance running for a month and I was charged $15 for that, but still there was no content inside.The second time I tried with a random keyword. After the whole stack is created successfully, I can't find the objects this time.Hope you have resolved the issue and can shed some light.Share"


Question: Question lightsail + cloudfront + subdomains

"Hello everybody!First of all I apologize for my bad English.I currently have a project in Hostinger, it is a website in php, mysql, html, css, etc.I am looking to migrate to a VPS to be able to create the number of subdomains I need without having a limit like the one I currently have with Hostinger. For that, create an instance in AWS Lightsail and install a hosting panel "HestiaCP", I was able to create a public IP and point my domain to the AWS DNS to access my site.The problem is that I want to enable Cloudfront, and when creating the certificate it does not allow me to enter wildcards so that all my subdomains can enter through cloudfront.Is there a way for all requests to my main domain or any of my subdomains to go through Cloudfront and then go to  Lightsail instance?Thank you very much for your time.EDIT: All subdomains must point to different folders, they behave like different websites.Edited by: gabriel292 on May 27, 2021 5:10 PMFollowComment"

Answer: "0Hello Gabriel,Thanks for choosing Lightsail!Sorry for not supporting wildcard in Lightsail Distribution Certificate. Currently, Lightsail Distribution Certificate supports up to 9 alternative domain names https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-create-a-distribution-certificate. (Alternative domain not supporting wildcard). Will take this feedback (Wildcard Supporting) to our PM.Thanks,YiranCommentShareYiran-AT-AWSanswered 2 years ago0Hello yiranaws!! That would be amazing! Thank you very much and hopefully they can enable wildcards for subdomains.GreetingsCommentSharegabriel292answered 2 years ago"


Question: Not getting messages in SQS after polling ?

"Hi Team,In my FIFO SQS queue messages are available but not able to listing received messages after polling in from console?Note: sometimes getting messages and sometimes not ? issue is intermittent.Can somebody help me on the same ,how to debug or anything i have missed,polling setting -->duration -20 sec,count -- 5FollowComment"

Answer: "0FIFO queues provide exactly-once processing by consuming messages in sequence from a message group. Thus, although the consumer can continue to retrieve ordered messages from another message group, the first message group remains unavailable until the message blocking the queue is processed successfully or moved to a DLQ.So are you sure you're not allowing messages to block the queue because you're not deleting them after processing?CommentShareEXPERTskinsmananswered 3 months agoaj-1993 3 months agoYes, here not deleting messages after processing so those are going to in flight after processing? and also no DLQ  configured for this queue., so in this case, polling should happen and should show the list of messages in received section for every time right but the same not happening .,please correct me if am wrong !!Shareskinsman EXPERT3 months agoIf you read a message it becomes in-flight, so "invisible" to subsequent polls until you delete the message or it reached the visibility timeout.  With a FIFO queue, while the message is invisible so are all messages after it in the same message group.  This is the only way FIFO ordering can be preserved.Shareaj-1993 3 months agoYes, but why i am not able to list messages in queue with polling ,sometimes its works as expected and not for sometime?is there any specific reason with FIFO? i have increased the visibility to 5 minutes and polling timeout to 100 with max rec.messages to 10 .Share"


Question: Renew SSL Lets Encrypt txt not verifying

"Step 5: Confirm that the TXT records have propagatedI added the txt DNS record in GoDaddyexample:_acme-challenge.mydomain.comwith a TTL of 1/2 hrUse https://mxtoolbox.com/TXTLookup.aspx to validate.After several hours, the record still isn't validating.Can't renew Let's Encrypt certificate because the record isn't validating.What can I do? My site will break with an invalid SSL.FollowComment"

Answer: "0You add this txt record _acme-challenge.mydomain.com with your domain dns panel. And its not validating after several hours, that case you can remove this TXT records and add it to your hosting dns zone. If you use clouflare then add into DNS zone.Sometime domains DNS zone record not properly matching but Hosting DNS records matches.I am successfully added all DNS reocrd of my https://nearmeads.com  website and Let's Encrypt certificate installed correctly and renew also. You can check my website DNS record for reference, it will help you.CommentShareAWS-User-8640645answered a year ago"


Question: Debug AWS_IO_FILE_VALIDATION_FAILURE while trying to connect to aws IoT with custom client certificate

"I failed to run the sample code for basic_connect.While running it with the following argument:basic_connect.exe --client_id "ME" --endpoint "*-ats.iot.eu-west-1.amazonaws.com" --cert "<>/MyCertificate.crt" --key "<>/MyPrivate.key" --verbosity "Debug"i receive the following output:[DEBUG] [2022-09-29T13:02:54Z] [00001648] [mqtt-client] - client=*: Initalizing MQTT client[DEBUG] [2022-09-29T13:02:56Z] [00001648] [tls-handler] - static: This library was built with Windows 8.1 or later, probing OS to see what we're actually running on.[DEBUG] [2022-09-29T13:02:56Z] [00001648] [tls-handler] - static: We're running on Windows 8.1 or later. ALPN is available.[DEBUG] [2022-09-29T13:02:56Z] [00001648] [tls-handler] - static: This library was built with Windows 8.1 or later, probing OS to see what we're actually running on.[DEBUG] [2022-09-29T13:02:56Z] [00001648] [tls-handler] - static: We're running on Windows 8.1 or later. ALPN is available.[DEBUG] [2022-09-29T13:02:56Z] [00001648] [tls-handler] - static: certificate and key have been set, setting them up now.[INFO] [2022-09-29T13:02:56Z] [00001648] [pki-utils] - static: loading certificate chain with 1 certificates.[ERROR] [2022-09-29T13:03:04Z] [00001648] [pki-utils] - static: no acceptable private key found, error AWS_IO_FILE_VALIDATION_FAILURE[ERROR] [2022-09-29T13:03:04Z] [00001648] [tls-handler] - static: failed to import certificate and private key with error 1038.Client Configuration initialization failed with error aws-c-io: AWS_IO_FILE_VALIDATION_FAILURE, A file was read and the input did not match the expected valueI have been trying to follow this AWS_IO_FILE_VALIDATION_FAILURE, and i endup with the following callstack:basic-connect.exe!aws_import_key_pair_to_cert_context(aws_allocator * alloc, const aws_byte_cursor * public_cert_chain, const aws_byte_cursor * private_key, bool is_client_mode, void * * store, const _CERT_CONTEXT * * certs, unsigned __int64 * crypto_provider, unsigned __int64 * private_key_handle) Line 691C basic-connect.exe!s_ctx_new(aws_allocator * alloc, const aws_tls_ctx_options * options, bool is_client_mode) Line 2010C basic-connect.exe!aws_tls_client_ctx_new(aws_allocator * alloc, const aws_tls_ctx_options * options) Line 2044C basic-connect.exe!Aws::Crt::Io::TlsContext::TlsContext(Aws::Crt::Io::TlsContextOptions & options, Aws::Crt::Io::TlsMode mode, aws_allocator * allocator) Line 423C++ basic-connect.exe!Aws::Iot::MqttClientConnectionConfigBuilder::Build() Line 493C++ basic-connect.exe!Utils::CommandLineUtils::GetClientConnectionForMQTTConnection(Aws::Iot::MqttClient * client, Aws::Iot::MqttClientConnectionConfigBuilder * clientConfigBuilder) Line 542C++ basic-connect.exe!Utils::CommandLineUtils::BuildDirectMQTTConnection(Aws::Iot::MqttClient * client) Line 459C++ basic-connect.exe!main(int argc, char * * argv) Line 41C++ [External Code]None of the call to CryptDecodeObjectEx will succeed in the function aws_import_key_pair_to_cert_context.It sounds like there is a problem with my private key which i generated as follow:openssl req -newkey rsa:4096 -sha256  -nodes -keyout MyPrivate.key -out MyRequest.csr -config MyConfig.cnfI am not sure to understand what this function is meant to do and what is wrong with my key.I am using win10 with msbuild (tryied in python as well).FollowComment"

Answer: "1Accepted AnswerHi. Your openssl command is generating a PEM key file in PKCS#8 format instead of the PKCS#1 format returned when AWS IoT Core generates the key. So your key file has a "BEGIN PRIVATE KEY" header instead of "BEGIN RSA PRIVATE KEY". I'm not familiar with CryptDecodeObjectEx(), but I think the PKCS_RSA_PRIVATE_KEY parameter might be demanding PKCS#1.So you may find more success by generating your own key and certificate as documented here: https://docs.aws.amazon.com/iot/latest/developerguide/create-device-cert.htmlCommentShareEXPERTGreg_Banswered 8 months agorePost-User-9327290 8 months agoThanks. =)Share0Hi,are you using really <> in your path? I assume you don't have a directory named <>?Perhaps you should modify your command to look similar to (assuming you are in the same directory where your key/cert is stored):basic_connect.exe --client_id "ME" --endpoint "*-ats.iot.eu-west-1.amazonaws.com" --cert "MyCertificate.crt" --key "MyPrivate.key" --verbosity "Debug"You  need also to use a valid iot endpoint. In your case you need to replace * with the unique id of your endpoint.Cheers,PhilippCommentSharePhilipp Sanswered 8 months agorePost-User-9327290 8 months ago"<>" is not a valid path in windows. "<>" and "*" are just a replacement for the real values. I just don't want to share anything personal on the internet.The key is well loaded and as in my file "private.key" in aws_import_key_pair_to_cert_context arguments.  It is CryptDecodeObjectEx which is failing on it. I want to understand why.The documentation specify well that aws support rsa + sh256, that should be provided in a PEM format.SharePhilipp S 8 months agoYou can find some information about troubleshooting connectivity at https://docs.aws.amazon.com/iot/latest/developerguide/diagnosing-connectivity-issues.html. You can use openssl to validate if your certificate is working correctly.Share"


Question: Does making an AppSync request from another backend AWS service leave the network for DNS lookup?

If I have a lambda acting as an AppSync client does it leave the network to do a DNS lookup of the AppSync url provided? I am guessing that if I use an ApolloClient it would need to but what about if you use the aws-sdk AppSyncClient? Trying to speed up calls that pass through a BFF and would love any input!FollowComment

Answer: "1Hi, @James_LundinDo you care if Lambda's communication to your AppSync endpoint goes outside the AWS Global Network?Since Lambda itself runs in a managed VPC, I think it will implicitly resolve the name in the internal DNS.And since the AppSync endpoint is always public, the result of name resolution is a public IP address.However, the following documents state that if the source and destination are AWS networks, they will stay on the AWS Global network.https://aws.amazon.com/vpc/faqs/?nc1=h_lsPackets that originate from the AWS network with a destination on the AWS network stay on the AWS global network, except traffic to or from AWS China Regions.So, in this case, it's a communication from Lambda's managed VPC to AppSync's managed edge, so I think it stays inside.This behavior is the same for both the Apollo Client and the AWS SDK, as it's about how Lambda resolves names and how the AWS network sends packets.CommentShareEXPERTiwasaanswered a year ago"


Question: Amazon Linux 2 amazon-linux-extras PHP 8.2 support

Is there a public timeline for adding PHP 8.2 support to AL2's amazon-linux-extras?PHP 8.1 active support ends in 9 months.FollowComment

Answer: "0Hello there,I see that you want to know the public timeline for adding PHP 8.2 support to AL2's amazon-linux-extras repos.I have checked your concern and unfortunately currently PHP 8.2 support to AL2's amazon-linux-extras is not available yet. However, I can confirm that our internal service team is actively working on enabling PHP 8.2. I have also added your requirement there in the hopes of prioritizing this feature in the near future.However, I will not be able to provide an ETA of when this feature will be included in future updates.  I would suggest you to keep an eye on our What’s New page [1] and our AWS News Blog [2] for latest updates on new releases of AWS services and features.Hope this helps. Please do let me know if you have any further queries or concerns. Have a great day ahead!!References[1] What’s New page:  https://aws.amazon.com/new/[2] AWS News Blog: https://aws.amazon.com/blogs/aws/CommentShareAbijith_Sanswered 3 months ago"


Question: CDK forward-deploying resource from another stack

"We have our own library (.NET) of L3 constructs for quickly deploying a playbook of resources. One of them a composite arrangement of ASG, ALB, with options for CloudFront, WAF, public HTTP API Gateway, etc. A CodePipeline process feeds application binaries to the ASG instances. This construct type is meant to be deployed as part of an application layer stack, which has dependency on a base stack that covers the fundamental infrastructure resources like VPC, security groups, S3 buckets, etc.Yesterday on running cdk diff and deploy of the base stack of a new system environment, I noticed the VPC link of the API Gateway AWS::ApiGatewayV2::VpcLink of the above-mentioned construct has somehow found its way into the template of the base stack instead of the yet-to-be-deployed application stack.[+] AWS::EC2::Subnet SYSTEM-vpc-ENVIRONMENT/vpc/cacheSubnet3/Subnet SYSTEMvpcENVIRONMENTvpccacheSubnet3SubnetC364FB30[+] AWS::EC2::RouteTable SYSTEM-vpc-ENVIRONMENT/vpc/cacheSubnet3/RouteTable SYSTEMvpcENVIRONMENTvpccacheSubnet3RouteTableFB233B7C[+] AWS::EC2::SubnetRouteTableAssociation SYSTEM-vpc-ENVIRONMENT/vpc/cacheSubnet3/RouteTableAssociation SYSTEMvpcENVIRONMENTvpccacheSubnet3RouteTableAssociationCCCE2449[+] AWS::EC2::InternetGateway SYSTEM-vpc-ENVIRONMENT/vpc/IGW SYSTEMvpcENVIRONMENTvpcIGW9869729D[+] AWS::EC2::VPCGatewayAttachment SYSTEM-vpc-ENVIRONMENT/vpc/VPCGW SYSTEMvpcENVIRONMENTvpcVPCGWECCB19DC[+] AWS::ApiGatewayV2::VpcLink SYSTEM-vpc-ENVIRONMENT/vpc/SYSTEM-App-vpc-link-ENVIRONMENT/SYSTEM-App-vpc-link-ENVIRONMENT SYSTEMvpcENVIRONMENTvpcSYSTEMAppvpclinkENVIRONMENT55F63713[+] AWS::EC2::SecurityGroup SYSTEM-vpc-ENVIRONMENT/vpc/SYSTEM-App-vpc-link-sg-ENVIRONMENT SYSTEMvpcENVIRONMENTvpcSYSTEMAppvpclinksgENVIRONMENT6BCED9EA[+] AWS::EC2::SecurityGroup SYSTEM-bastion-host-SG-ENVIRONMENT SYSTEMbastionhostSGENVIRONMENT7DE50118[+] AWS::SNS::Topic SYSTEM-operator-topic-ENVIRONMENT SYSTEMoperatortopicENVIRONMENTDDD12BF6[+] AWS::SNS::Subscription SYSTEM-operator-topic-ENVIRONMENT/email@address.com SYSTEMoperatortopicENVIRONMENT6BB1089F[+] AWS::SNS::Subscription SYSTEM-operator-topic-ENVIRONMENT/email@address.com SYSTEMoperatortopicENVIRONMENTF6CC5213[+] AWS::SNS::TopicPolicy SYSTEM-operator-topic-ENVIRONMENT/Policy SYSTEMoperatortopicENVIRONMENTPolicyFB7F9EC7What can cause CDK to shift a resource from a dependent stack into a dependency stack? This is not desired behaviour.FollowComment"


Question: How to download intermediate certificates for AWS IoT?

"Hello,I generated an MQTT client certificate using create-keys-and-certificate. The issuer of this certificate is:issuer= /OU=Amazon Web Services O=Amazon.com Inc. L=Seattle ST=Washington C=USis there any way to access that intermediate certificate and any other intermediate ones in the chain? I've checked all the certificates here: https://www.amazontrust.com/repository/ but unfortunately none of them is that one.thank you!FollowComment"

Answer: "1Hi,you cannot retrieve the CA from IoT Core that is used to sign AWS IoT Core issued device certificates. AWS IoT Core is not a PKI solution.In case you need a PKI you can use for example AWS Certificate Manager Private Certificate Authority (CA).You can also register your private CA with AWS IoT Core and issue device certificates.KR,PhilippCommentSharePhilipp Sanswered a year ago0You can download the RootCA which used to connect to IoT Core: https://docs.aws.amazon.com/iot/latest/developerguide/server-authentication.html#server-authentication-certsAlso you can request a certificate from IoT Core console, and there will be a link to download those Root CAs.CommentShareguanglananswered a year ago"


Question: Are security groups enforced when using ssm start-session with port forwarding

Can you tell me if security groups are still enforced when we connect to an instance via the ssm start-session CLI command using the port forwarding optionOr are security groups bypassed when connecting to instances using the ssm CLI ?FollowComment

Answer: "1The security groups are not bypassed, however, the SSM agent on the instance initiates the the connection to the SSM service so the outbound rules of the security group on the instance are the ones in play. Most likely, the outbound is wide open. Minimally, the outbound rule needs to allow outbound 443 to the SSM endpoints. See: Systems Manager prerequisites.(Recommended) Create a VPC endpoint in Amazon Virtual Private Cloud (Amazon VPC) to use with Systems Manager.If you don't use a VPC endpoint, configure your managed instances to allow HTTPS (port 443) outbound traffic to the Systems Manager endpoints. For information, see (Optional) Create a VPC endpoint.CommentShareEXPERTkentradanswered a year ago"


Question: "Rotating the Old AWS Access Key, for a New AWS Access Key in WorkMail"

"Hi,Apparently I need to rotate my old AWS Access Key, with a new one that I just created...  In workmail and for mail apps...  How do you replace the old AWS Access Key, with a new one??FollowComment"

Answer: "0Accepted AnswerHi!  To switch out access keys, check out AWS's documentation on managing access keys: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_CreateAccessKey.Keep in mind that Access Keys have 2 parts: an access key ID and a secret access key.  The only time you can view the secret access key is when it is initially created.  Outside of that, you cannot view it again.For more help troubleshooting with WorkMail: https://docs.aws.amazon.com/workmail/latest/adminguide/security_iam_troubleshoot.htmlCommentSharejsoncanswered a year ago"


Question: Exporting result sets is disabled for this account Error when trying to export to csv using Query Editor v2 Redshift

"Hi,I created a redshift database and ran some queries in the query editor v2. I can see the option to Export to csv or json, but when I click on it, I get the error "Exporting result sets is disabled for this account.".Searching google for this specific error message doesn't return much. I have tried adding the policy AmazonRedshiftQueryEditorV2FullAccess to both my own user and the IAM used for the created redshift database, but the error still persists. (taken from article https://docs.aws.amazon.com/redshift/latest/mgmt/query-editor-v2-getting-started.html)Which account specifically is it talking about?What do I need to do in order to be able to export theses query results to csv from the query editor v2 directly?Thanks,BeckyFollowComment"

Answer: "1I just got stuck on this as well.Assuming you have the sqlworkbench:UpdateAcountExportSettings permission, you can enable exporting result sets:Click Account settings in the gear menu in the bottom-left corner of the Query Editor v2 interface.Check the Allow export result set checkbox in the Export settings section, and click Save.CommentSharelucascantoranswered 4 months agorePost-User-0693984 4 months agoThank you very much for your detailed description. Found it! :)Share"


Question: Support for CloudFront compressing WASM (WebAssembly) Files?

Is it possible for the application/wasm Content-Type to be added to the list of file types that CloudFront will automatically compress?Relevant references:Current list of supported filetypes: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html#compressed-content-cloudfront-file-typesRegistration of application/wasm Content Type: https://www.iana.org/assignments/media-types/application/wasmFollowComment

Answer: "1Hi, @gstvIf you have a request for a function, please refer to the following and give us feedback!https://aws.amazon.com/premiumsupport/knowledge-center/send-feedback-aws/?nc1=h_lsIf you want to know if the current feature supports it rather than a feature request, unfortunately the answer is "impossible". CloudFront compression types are not user customizable.If you're looking for a workaround, you may be able to have CloudFront interpret it as a fake file type and compress it by changing the origin response with Lambda @ Edge. This experiment looks interesting so I would like to try it.CommentShareEXPERTiwasaanswered a year ago"


Question: DocumentDB 4.0 mongodump error checking for AtlasProxy: Unknown admin command atlasVersion

Starting from 2023-03-01 the mongodump command fails to exec on documentDB 4.0 instances. Before this date the mongodump command was working just fine.Error trace:Failed: error checking for AtlasProxy: Unknown admin command atlasVersionI've used mongodb-org-tools=4.4.15 and mongodb-org-tools=5.0.15 to run the mongodump with the same result.Command:mongodump --ssl \        --host="$DB_HOST:$DB_PORT" \        --db="$DB_DATABASE" \        --username="$DB_USERNAME" \        --password="$DB_PASSWORD" \        --archive=./production-mongodump.gz \        --numParallelCollections=4 \        --authenticationDatabase="$DB_AUTHENTICATION_DATABASE" \        --authenticationMechanism=SCRAM-SHA-1 \        --sslCAFile=./rds-combined-ca-bundle.pem \        --gzipAny ideas of what this can be?FollowComment

Answer: "3Accepted AnswerWe were having same issue (with mongodump) since 2023-03-01; and it seems to be an issue with the latess update of mongodb-database-tools. In the latest version (100.7.0-1) we were facing this issue, so we have to downgrade to previous version and everything is working again:yum downgrade mongodb-database-tools-100.6.1-1I don't know if this issue is docDB related, or mongo tools related; but for now I think the only option we have is to downgrade this mongo tools.CommentSharejmsanchezanswered 3 months agopuchito 3 months agoThanks for your answer, I would assume is a change in DocumentDB rather than mongo tools because I've been using the same mongo tools version for a long time. Anyways, I downgraded from mongodb-org-tools=4.4.15 to mongodb-org-tools=4.0.28 following your suggestion and works again.For reference, this is how I install the tools in my runners:wget -qO - https://www.mongodb.org/static/pgp/server-4.0.asc | apt-key add -echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu bionic/mongodb-org/4.0 multiverse" | tee /etc/apt/sources.list.d/mongodb-org-4.0.listapt-get update && apt-get install -y mongodb-org-tools=4.0.28SharerePost-User-9296229 2 months agoGreat, this helped, mongodump is working again!Sharekevinc 23 days agoThis saved me as well, though I'm using Database Tools and not "org tools".  I took my package info from MongoDB Database tools. The main page doesn't give you an option to download old versions, but you can just sub out the version number, e.g.:wget https://fastdl.mongodb.org/tools/db/mongodb-database-tools-ubuntu1604-x86_64-100.6.1.debsudo apt uninstall mongodb-database-toolssudo apt install ./mongodb-database-tools-ubuntu1604-x86_64-100.6.1.debShare0I'm actually having the same issue.I'm migrating from Atlas to DocumentDB and I'm getting the same error "Unknown admin command atlasVersion" when I use mongorestore command.CommentShareMarc-Jananswered 3 months agopuchito 3 months agoSome versions of mongodb-database-tools/mongodb-org-tools stopped working (I would assume by an DocumentDB update). Simply downgrade the version of mongodb-database-tools/mongodb-org-tools you are using. Check the accepted answer for the working versions.Share"