Question: AWS::S3::Bucket LifecycleConfiguration - DEEP_ARCHIVE returns error

"Hi all,I am trying to update an existing CloudFormation stack for an AWS::S3::Bucket to modify the LifecycleConfiguration to add a rule for transition to DEEP_ARCHIVE. Unfortunately when deploying the updated template I get the following error:Value of StorageClass property must be in [STANDARD_IA, GLACIER, Glacier]The snippet of the template I am using is:      LifecycleConfiguration:        Rules:          -             Id: RULE-Lifecycle-MultiPartUpload            AbortIncompleteMultipartUpload:               DaysAfterInitiation: 7            Status: Enabled          -            Id: RULE-Lifecycle-StorageClass            Transitions:              -                StorageClass: DEEP_ARCHIVE                TransitionInDays: 14            NoncurrentVersionTransitions:              -                StorageClass: DEEP_ARCHIVE                TransitionInDays: 14                           Status: Enabled          -             Id: RULE-Lifecycle-Expire-Everything-Eventually            ExpirationInDays: 3650            Status: Enabled Has CloudFormation not been updated to support DEEP_ARCHIVE yet? I thought it was generally available everywhere already.ThanksNickEdited by: N Miller on Apr 4, 2019 2:07 PMFollowComment"

Answer: "0Hello there,The property value LifecycleConfiguration - DEEP_ARCHIVE under the resource AWS::S3::Bucket is currently a feature request. I have added your interest to it. Our Cloudformation team is working on adding the feature.Thanks,NitheeshaCommentShareNitheesha_Manswered 4 years ago0Thank you :)I look forward to it being available in the future.ThanksNickCommentShareN Milleranswered 4 years ago"


Question: how to map single Route53 domain to multiple CloudFront domain names?

I have multiple cloudfront endpoints configured for origin in residing in different regions. Is it possible to route the traffic to multiple cloudfront distribution using single domain name?FollowComment

Answer: "0Can you elaborate your use case? Amazon CloudFront uses a global network of edge locations and regional edge caches, when you create a CF distribution you don't choose a Region, so how could you have them per Region?Assuming what you would like to achieve is routing traffic to different origins that are in different Regions, you can set your CF distribution using a single domain name, then you can have multiple origins attached to your CF distribution and configure the behaviour to route to the appropriate resource, and in the Route 53 you will add just one record with a single domain name, here an example:https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-distribution-serve-content/Another option without CF but for routing to different Regions can be: configure Route 53 with Geoproximity and specify the AWS Region where the resources are hosted: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy-geoproximity.htmlFor a more accurate answer please share more details of what you are trying to achieve, if this answer helps you please accept the answer.CommentShareVicky Gracianoanswered 5 months agoGautam Kumar 5 months agoHello,I mean to say a separate cloudfront distribution has been created for each origin which are residing in different regions. Is it possible to redirect the traffic to these origins using a single Route 53 domain?Share0Which is your routing decision, and do you want to use customised domain name in CloudFront or not?For instance, if your routing decision for route to a specific distribution is based on user location, so you can have in r53 something like: example.com = my distribution1.cloudfront.net, And a geolocation routing policy, if my user is from this "country" route to this record example.com = mydistribution2.cloudfront.net, same example.com = mydistribution3.cloudfront.net, sameOtherwise the answer is no. You must create a record in Route 53 to route dns queries to cloudfront. When Route 53 receives a DNS query that matches the name and type of a record, Route 53 responds with the domain name that is associated with your distribution. So, if you use a customised domain name in CF all the distributions will have the same domain name and then how to know which one is the correct?Also, depends on your routing decision, r53 supports certain routing policies, if it is not based on user location or AWS Resources, then also it is not possible to use the same domain name.But also you will have 3 distributions, you can optimise the design. For example for this case the routing can be done in CloudFront and not in R53. You do not need different distributions with the same domain name for multiple origins. You can use just one cloud front distribution with multiple origins, and these origins can be in different Regions, this is the most straightforward approach. Then, in the cloud front distribution you configure the behaviour (this is like the "routing" mechanism) and route your request to the specific origin. Here some references:https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-distribution-serve-content/https://catalog.us-east-1.prod.workshops.aws/workshops/4557215e-2a5c-4522-a69b-8d058aba088c/en-US/basic-configuration/create-multiple-originshttps://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesPathPatternCommentShareVicky Gracianoanswered 5 months ago"


Question: Pearson examination - exam procedure and being revoked

"Just tried to do my Solution Architect Professional exam through Pearson OnVue. After 2 hours (and 45 min check-in) and about 50/70 questions through I was kicked out by Pearson. After chatting with Pearson support I was told the exam was revoked because I leaned in too much and got out of view from the webcam.Checking my phone afterwards I can see that they did attempt to contact me via my phone. As directed by the check-in proctor, both my phone and smartwatch notification were off, silent, and far away from my test area - as you would in any exam situation. There were no other form of contact before being booted. I feel like this is some kind of catch-22 situation where:Pearson will fail and revoke if I use an electronic device (phone) during the examPearson will fail and revoke if I am not reachable through the banned electronic deviceI am all for stringent exam environments but I feel that all this could have been avoided if the exam app did a pop alert saying "We are trying to contact you via chat or your phone" and pause the exam.Anyone know what's the usual resolution for cases like this? Do I get a reschedule exam or is my money gone for good?FollowComment"

Answer: "0Normally they contact you through chat which is embedded into Pearson test application.CommentShareA-Shevchenkoanswered a year ago0I redid my exam 2 weeks later. This time the main point of contact was through the app's voice and text chat. I got warned mid way for mumbling. This was by far the better user experience than trying to contact me via the phone method which was explicitly disallowed according to exam conditions.It annoyed me that I got 711 in the first exam with about 2/3 of the questions answered, and passed comfortably on my 2nd attempt. It just felt like I wasted 3+ hours on my first attempt due to bad UX.CommentSharehernitanswered a year ago0I hate for this to be my first post here... but the same thing happened to me! I got a message saying that an unapproved item was found on my desk, about 90min into the exam so it was revked.Less than 30 minutes before the message appeared I'd been contacted by a proctor to show my desk using the laptop. It was deemed fine (I had an external keyboard and mouse attached to the laptop, both wireless). It wasn't the first time they checked my desk either so if something was wrong they could've told me from the start - but again, they said it was fine, so I don't understand what was this "item" that revoked my exam!And their chat assistant afterwards was completely useless! 30 min on the chat and they're asking the same questions: name, e-mail, contact, etc... and don't come back with any answer!And they did not try to reach me on the phone.Does anyone know how to raise a complaint?Thanks!CommentSharePackitoanswered 4 months ago0It's now been nearly 4 weeks and my review is still underway! In fact, judging by the last communication I received from the Training and Certification team, it seems that they only started reviewing my case this week - that's way beyond the 3 weeks they told me initially that it would take.This review process, done by the Services Team, is almost as bad as the service provided by the proctors. Everything's been on hold and I truly regret trying the exam online!Does anyone know how to escalate this issue to make sure that the review is truly underway? Thanks!CommentSharePackitoanswered 3 months ago"


Question: Why does S3 Select have SQL length limit to 256 KB?

"According to https://docs.aws.amazon.com/AmazonS3/latest/userguide/selecting-content-from-objects.html , the maximum length of a SQL expression is 256 KB. Why do we have such a limit? Is it possible to surpass the limit with some configuration?FollowCommentZJon 3 months agodid I answer your question? please let me knowShare"

Answer: "1Accepted AnswerGreetings,The maximum length of a SQL expression in Amazon S3 Select is 256 KB. This limit is in place to ensure that the service can handle queries efficiently and without experiencing performance degradation. When a query is submitted to S3 Select, the query expression is processed on a distributed infrastructure and it's important to limit the size of the query in order to avoid any processing issues.It is not possible to configure S3 Select to allow SQL expressions larger than 256 KB. If you require a larger query expression, you may need to break it up into smaller expressions and execute them separately. Alternatively, you may want to consider using other AWS services, such as Amazon Athena or Amazon Redshift, which have higher query limits and can handle larger datasets.It's also worth noting that while the maximum length of a SQL expression is limited to 256 KB, the size of the input data can be much larger. S3 Select can process objects up to 400 MB in size and can handle compressed files in a variety of formats, including GZIP and BZIP2. If you're working with larger datasets, S3 Select can still be a very powerful tool for extracting the data you need.Please let me know if that answered your questionCommentShareZJonanswered 3 months ago"


Question: Root user: Lambda console "Create Function" AccessDeniedException

"When I open Lambda console as a root user, I immediately get a 403 error in web console and a red empty bar appears on top. After that when I click "Create Function", web console shows AccessDeniedException: null message for both Root user and Administrative Access user. If I try to create function anyways, nothing happens.SCPs are disabled.FollowComment"

Answer: "0Without asking any questions, it sounds straight away you may have an SCP defined at an Org level preventing either the creation of Lambda and/or denying creating of anything in the region you are using.https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.htmlCommentShareGary Mcleananswered 3 months agorePost-User-7226365 3 months agoThank you for the response but my account is new and I did not add any SCPs. I checked and SCPs are disabled.Share-1There are a lot of other questions about this issue including this one - the short version: Please contact the support team.CommentShareEXPERTBrettski-AWSanswered 3 months agorePost-User-7226365 3 months agoI have subscribed for tech support, since this is my individual account.Share"


Question: Accessing other user resources with management account

"I am the owner of the management account for my organization. However, I am unable to view or access the resources (EC2, S3, Lambda, etc) created by a user within my same organization.Both accounts are in the same organization.The resources are in us-east-1. I have made sure to select this region when browsing AWS services.Both accounts have the FullAWSAccess SCP attached.I tried enabling Tag Policies, tagging all resources with a shared tag, and creating a tag-based resource group. However, only my EC2 instance shows up when I try to create the resource group.I tried using Resource Access Manager to create a new resource share. However, the wizard results in an error: "Organization o-XXXXXXXXXX could not be found."I am up to date with my billing.How do I access resources created by other accounts in my organization?FollowComment"

Answer: "4As the management account owner, you won't be able to directly access resources created by other accounts within the organization by default. Each account in an AWS Organization is a separate entity, and resources created within those accounts are isolated for security reasons.To access resources created by other accounts in your organization, you can do the following:Cross-account access: You can create a cross-account IAM role in the member account that allows access to specific resources. Then, you can assume that role from your management account to access the resources in the member account. This is the recommended approach for accessing resources across accounts within an organization.Here is a brief outline of the process:a. In the member account, create an IAM role that allows cross-account access, with the management account ID as a trusted entity.b. Attach policies to the role that grant permissions to the resources you want to access.c. In the management account, create an IAM user or role with the permission to assume the cross-account role.d. Use the AWS CLI or SDK to assume the cross-account role and obtain temporary security credentials.e. Use those temporary security credentials to access the resources in the member account.For a detailed guide on setting up cross-account access, please refer to the AWS documentation: Tutorial: Delegate Access Across AWS Accounts Using IAM RolesResource sharing: In some cases, you can share resources across accounts using AWS Resource Access Manager (RAM) or specific service sharing features. For example, you can share Amazon RDS, Amazon S3, and VPC subnets across accounts. Note that this method is limited to specific services and resources, and it doesn't provide the same level of flexibility as cross-account access with IAM roles.for more informationhttps://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_share.htmlCommentShareEXPERTsedat_salmananswered 2 months agorePost-User-6840919 18 days agoI'm sure this is probably the "correct" answer, but I'm beginning to believe that this is impossible. Create IAM. Create policy. Attach policy to group. Delegate group to Elastic Beanstalk. Weave Elastic Beanstalk into AWS Wickr basket.There is no reason for this to be so difficult.I don't have any IAM user groups. If I create one, I don't see how to add my own user account to the group so I can attach the cross-account policy.I simply have two AWS accounts under a root AWS organization, and I want to share resources.I appreciate your help, but I think this is where I give up.Share"


Question: (Fargate) ExecuteCommandAgent transitions from RUNNING to STOPPED

"Hi, I recently followed all the guidance to enable ECS ExecuteCommand access for my containers (excellent feature).I followed https://aws.amazon.com/blogs/containers/new-using-amazon-ecs-exec-access-your-containers-fargate-ec2/, deployed the new infrastructure, and I was able to connect to my ECS Fargate task. Success! Very exciting.I go back today to try to troubleshoot a problem in our beta environment, and I keep getting..."An error occurred (InvalidParameterException) when calling the ExecuteCommand operation: The execute command failed because execute command was not enabled when the task was run or the execute command agent isn’t running. Wait and try again or run a new task with execute command enabled and try again."My IAM permissions haven't changed and the cluster/service/task configuration hasn't changed. I double-checked by re-running Terraform to ensure the plans were the same (they are - no diff between what's in the account and what's in the templates).I spun up a new task and described the state of the task:$ aws --region us-west-2 --profile <redacted> ecs describe-tasks --cluster <redacted> --tasks 1fe5bd64db4d428794fa0b956c1efda6 | jq '.tasks[0] | {"managedAgents": .containers[0].managedAgents, "enableExecuteCommand": .enableExecuteCommand}'{"managedAgents": [{"lastStartedAt": "2021-04-07T09:10:01.885000-04:00","name": "ExecuteCommandAgent","lastStatus": "RUNNING"}],"enableExecuteCommand": true}I then tried to connect:aws --region us-west-2 --profile <redacted> ecs execute-command --cluster <redacted> \--task 1fe5bd64db4d428794fa0b956c1efda6 \--container <redacted> \--interactive \--command "/bin/bash"Got the error I pasted above. Then I checked the status again.$ aws --region us-west-2 --profile <redacted> ecs describe-tasks --cluster <redacted> --tasks 1fe5bd64db4d428794fa0b956c1efda6 | jq '.tasks[0] | {"managedAgents": .containers[0].managedAgents, "enableExecuteCommand": .enableExecuteCommand}'{"managedAgents": [{"name": "ExecuteCommandAgent","lastStatus": "STOPPED"}],"enableExecuteCommand": true}There's ample RAM available. I'm not sure why it isn't working after nothing has changed. I don't have any additional tools to troubleshoot this. Worse, it's also happening in our production environment too.Any suggestions?FollowComment"

Answer: "1Hi,One of the AWS Containers Developer Advocates put together this handy tool to check if your environment is fully setup for ECS Exec:https://github.com/aws-containers/amazon-ecs-exec-checkerWould you mind trying that and see if it reveals anything interesting?Thanks!/MatsCommentShareMatsanswered 2 years ago0+1 for ecs-exec-checker tool mentioned by Mats, it would be helpful for most cases.Looking at the logs we have in ECS & Fargate, the backend and agent are looking good. The issue instead is that the ExecuteCommand agent is not able to start up inside the containers and this usually happens for the following scenarios (please note ECS Exec is built on top of leveraging SSM agent):The task uses private links and does not have required SSM endpoints, see https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-privatelink.htmlThe containers/tasks reuses some port mappings across multiple containers or tasks especially when the tasks are configured to use the same appmeshYour container filesystem is readonly and the SSM agent is not able to create the required files and foldersIt only allows one SSM agent running inside the container. If you already have an SSM agent built into your image and started up as part of container launching, the SSM agent started up for ECS Exec will always failThere might be more corner cases we don't know that could cause this issue. If you can provide the logs inside your container under /var/log/amazon/ssm/amazon-ssm-agent.log as part of your container logs, we can take a deep look into it.Edited by: xue-aws on Apr 7, 2021 9:22 PMCommentShareAWS-User-4961254answered 2 years agoJuju 3 months agoI have a similar problem, but I'm using read-only filesystems. What are the directories that should be writable so I can map them to tempfs.Share0That's a great tool! I may have missed it in the official docs; it should definitely be added if it isn't in there.Anyway, here's my output:~ ⌚ 9:47:49$ bash <( curl -Ls https://raw.githubusercontent.com/aws-containers/amazon-ecs-exec-checker/main/check-ecs-exec.sh ) <redacted> f0cd742fafca4430bdc1fc1fc2939d18Prerequisites for check-ecs-exec.shjq      | OK (/usr/local/bin/jq)AWS CLI | OK (/usr/local/bin/aws)Prerequisites for the AWS CLI to use ECS ExecAWS CLI Version        | OK (aws-cli/2.1.32 Python/3.9.2 Darwin/19.6.0 source/x86_64 prompt/off)Session Manager Plugin | OK (1.2.54.0)Configurations for ECS task and other resourcesRegion : us-west-2Cluster: <redacted>Task   : f0cd742fafca4430bdc1fc1fc2939d18Cluster Configuration  | Audit Logging Not ConfiguredCan I ExecuteCommand?  | arn:aws:iam::<redacted>ecs:ExecuteCommand: allowedssm:StartSession denied?: allowedLaunch Type            | FargatePlatform Version       | 1.4.0Exec Enabled for Task  | OKManaged Agent Status   |1. STOPPED (Reason: null) for "<redacted>" containerTask Role Permissions  | arn:aws:iam::<redacted>ssmmessages:CreateControlChannel: allowedssmmessages:CreateDataChannel: allowedssmmessages:OpenControlChannel: allowedssmmessages:OpenDataChannel: allowedVPC Endpoints          | SKIPPED (vpc-<redacted> - No additional VPC endpoints required)Unfortunately it looks like everything is okay but the agent is stopped.CommentSharenscottanswered 2 years ago0xue-aws wrote:The task uses private links and does not have required SSM endpoints, see https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-privatelink.htmlThe containers/tasks reuses some port mappings across multiple containers or tasks especially when the tasks are configured to use the same appmeshYour container filesystem is readonly and the SSM agent is not able to create the required files and foldersIt only allows one SSM agent running inside the container. If you already have an SSM agent built into your image and started up as part of container launching, the SSM agent started up for ECS Exec will always failWe aren't using PrivateLink yet. The tool confirmed this as well.Interesting. We're only running a single container in the task; I don't think there should be any overlapping ports.I didn't set the container file system to readonly; I would be surprised if our server worked in that case since we write logs to disk as well to stdout.Hmmm we're using an image that shouldn't have the SSM agent in it, but this is an interesting lead.I'll try to get some logs!CommentSharenscottanswered 2 years ago0I didn't spend time pulling the logs (yet) but instead took a different approach. I'm not 100% clear on exactly what initProcessEnabled does (not a Docker expert) other than reaping child processes that a user runs when they call execute-command. Maybe that's the whole point?Anyway, I modified our task definition and set initProcessEnabled to true. Our environments can now run execute-command again. Hooray!Maybe there's something to do with the non-initProcessEnabled code path that causes the initial bug. I'm not convinced this change should have done anything meaningful to allow the agent to work. I still think it's very strange that it was reported as "RUNNING" (e.g. started successfully) and then only when I try to connect does it transition to "STOPPED".I was unable to pull logs since I didn't have access to the containers. I figured I would have to add a script to tail/dump the logs when the container starts, but wanted to try the simpler infrastructure change first.Thanks for all your help.CommentSharenscottanswered 2 years ago0The problem started happening againCommentSharenscottanswered 2 years ago0xue-aws wrote:+1 for ecs-exec-checker tool mentioned by Mats, it would be helpful for most cases.Looking at the logs we have in ECS & Fargate, the backend and agent are looking good. The issue instead is that the ExecuteCommand agent is not able to start up inside the containers and this usually happens for the following scenarios (please note ECS Exec is built on top of leveraging SSM agent):The task uses private links and does not have required SSM endpoints, see https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-privatelink.htmlThe containers/tasks reuses some port mappings across multiple containers or tasks especially when the tasks are configured to use the same appmeshYour container filesystem is readonly and the SSM agent is not able to create the required files and foldersIt only allows one SSM agent running inside the container. If you already have an SSM agent built into your image and started up as part of container launching, the SSM agent started up for ECS Exec will always failThere might be more corner cases we don't know that could cause this issue. If you can provide the logs inside your container under /var/log/amazon/ssm/amazon-ssm-agent.log as part of your container logs, we can take a deep look into it.Edited by: xue-aws on Apr 7, 2021 9:22 PMxue-aws wrote:+1 for ecs-exec-checker tool mentioned by Mats, it would be helpful for most cases.Looking at the logs we have in ECS & Fargate, the backend and agent are looking good. The issue instead is that the ExecuteCommand agent is not able to start up inside the containers and this usually happens for the following scenarios (please note ECS Exec is built on top of leveraging SSM agent):The task uses private links and does not have required SSM endpoints, see https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-privatelink.htmlThe containers/tasks reuses some port mappings across multiple containers or tasks especially when the tasks are configured to use the same appmeshYour container filesystem is readonly and the SSM agent is not able to create the required files and foldersIt only allows one SSM agent running inside the container. If you already have an SSM agent built into your image and started up as part of container launching, the SSM agent started up for ECS Exec will always failThere might be more corner cases we don't know that could cause this issue. If you can provide the logs inside your container under /var/log/amazon/ssm/amazon-ssm-agent.log as part of your container logs, we can take a deep look into it.Edited by: xue-aws on Apr 7, 2021 9:22 PMUnfortunately it started happening again. It seems random. I'll try to get some logs this time around.Edit: Woohoo, success. Here are the logs.2021-04-16 00:13:59 INFO [ssm-agent-worker] [MessageGatewayService] [EngineProcessor] Starting2021-04-16 00:13:59 INFO [ssm-agent-worker] [MessageGatewayService] SSM Agent is trying to setup control channel for Session Manager module.2021-04-16 00:13:59 INFO [ssm-agent-worker] [MessageGatewayService] listening reply.2021-04-16 00:13:59 INFO [ssm-agent-worker] [MessageGatewayService] agent telemetry cloudwatch metrics disabled2021-04-16 00:13:59 INFO [ssm-agent-worker] [MessageGatewayService] Setting up websocket for controlchannel for instance: ecs:<redacted_c864dbc6e9404505ae8a07a0f79b3992_c864dbc6e9404505ae8a07a0f79b3992-2907402, requestId: 424ec1d7-16c9-45a2-ac61-ada12d5640b42021-04-16 00:14:00 INFO [ssm-agent-worker] [MessageGatewayService] Opening websocket connection to: wss://ssmmessages.us-west-2.amazonaws.com/v1/control-channel/ecs:<redacted>_c864dbc6e9404505ae8a07a0f79b3992_c864dbc6e9404505ae8a07a0f79b3992-2907402?role=subscribe&stream=input2021-04-16 00:14:00 INFO [ssm-agent-worker] [MessageGatewayService] Successfully opened websocket connection to: wss://ssmmessages.us-west-2.amazonaws.com/v1/control-channel/ecs:<redacted>_c864dbc6e9404505ae8a07a0f79b3992_c864dbc6e9404505ae8a07a0f79b3992-2907402?role=subscribe&stream=input2021-04-16 00:14:00 INFO [ssm-agent-worker] [MessageGatewayService] Setting up agent telemetry scheduler2021-04-16 00:14:00 INFO [ssm-agent-worker] [MessageGatewayService] Starting receiving message from control channel2021-04-16 00:14:00 INFO [ssm-agent-worker] [MessageGatewayService] [EngineProcessor] Initial processing2021-04-16 00:14:15 ERROR error occurred when starting amazon-ssm-agent: failed to start message bus, failed to start health channel: failed to listen on the channel: ipc:///var/lib/amazon/ssm/ipc/health, address in usehttps://stackoverflow.com/questions/65218749/unable-to-start-the-amazon-ssm-agent-failed-to-start-message-bus is my only lead.I'm unsure how it could possibly be in use, given it's a brand new container. Looks like this is an existing GitHub issue: https://github.com/aws/amazon-ssm-agent/issues/361Edited by: nscott on Apr 15, 2021 5:15 PMEdited by: nscott on Apr 15, 2021 5:19 PMEdited by: nscott on Apr 15, 2021 5:24 PMCommentSharenscottanswered 2 years ago0This is happening to me as well. Did everything suggested by ecs task checker and still have this behavior.CommentShareAaron Podolnyanswered 2 years ago0I Fixed this in my case by removing the ReadOnlyFileSystem in the Task DefinitionCommentShareallamandanswered 6 months ago"


Question: Does the new feature of CloudFormation events to EventBridge include events from StackSets?

"AWS released a new feature today that allows CloudFormation stack events to be published o EventBridge.I was wondering does this new feature cover also events from CloudFormation StackSets? That is, can we see with this new feature also events that happen in CloudFormation StackSets?Thank you!FollowComment"

Answer: "0Accepted AnswerAccording to the following documentation, the message structure of events did not include Stack Sets.This means that it is not possible to check Stack Sets Events.https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/eventbridge-events.htmlCommentSharehayao-kanswered 10 months agoPier 10 months agoThank you for your reply! I suspected so but wanted to make sure in case there was something that wasn't published in the documentation.Share0This is now possible with CloudFormation StackSets now sending events notifications in Amazon EventBridge. EventBridge Rules can be created to get triggered based on StackSet creation/updation/deletion and based upon StackSet state/Stack Instance state/StackSet operation state which can trigger desired target(s) accordingly.Ref.: https://aws.amazon.com/about-aws/whats-new/2022/11/event-driven-applications-cloudformation-stacksets-event-notifications-eventbridge/CommentShareSUPPORT ENGINEERSurya Sakalaanswered 5 months ago"


Question: Preflight Issue with AWS API Gateway and Lambda Function

"Hello, I have been experiencing a persistent issue with CORS preflight requests when trying to use AWS API Gateway and Lambda function for sending emails from my website's contact form. Despite following best practices for configuring CORS settings in API Gateway and Lambda, I continue to receive "CORS preflight did not succeed" and "CORS header ‘Access-Control-Allow-Origin’ missing" errors.Here is a summary of the issue and the steps I have taken so far:I have an API Gateway with a POST method that triggers a Lambda function for processing contact form submissions.I have enabled CORS in API Gateway, setting the 'Access-Control-Allow-Origin' header to '*' and including all necessary headers and methods.I have added OPTIONS method to the API Gateway with a Mock integration, and configured the Integration and Method responses with appropriate CORS headers.I have also modified my Lambda function to handle the OPTIONS request and return appropriate CORS headers.Despite these configurations, I continue to receive CORS errors when attempting to send requests from my website to the API Gateway URL.The error messages I receive are as follows:"CORS Preflight Did Not Succeed""Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://example-api.execute-api.eu-central-1.amazonaws.com/EmailResource. (Reason: CORS preflight response did not succeed). Status code: 403.""Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://example-api.execute-api.eu-central-1.amazonaws.com/EmailResource. (Reason: CORS request did not succeed). Status code: (null)."I have tried several troubleshooting steps with the help of an AI language model, but the issue persists. I am now seeking your assistance to identify the root cause of this problem and help me resolve it.Any suggestions or guidance would be greatly appreciated. Please let me know if you require any additional information or clarification regarding my setup.Thank you in advance for your help!FollowComment"

Answer: "0This is obviously a Server authorization issue with the application logic.  Like insufficient rights.  Therefore your URL cannot be access by your API-Gateway.  Clear your browser cache.  Add plugin to web browser to overrride cors settings of browser. just for test on browser.  Modify the application logical permissions ( IAM) so it can use Lambda.   If you add headers to your response, you don't need to apply the second item. "Access-Control-Allow-Origin": "*", "Access-Control-Allow-Credentials"CommentShareWyCliffeanswered a month ago"


Question: Install Older SQL Version On EC2 AMI With SQL Server Standard 2022

"Hello,We are looking at using one of the AWS supplied AMI's with SQL Server 2022 Standard included. We also have a need to install older versions of SQL Server to extract data and possibly install multiple instances of a given version.First does anyone know if the included AWS license comes with Software Assurance, the question is asked when installing a new instance? Second does anyone know if the AWS included SQL license includes the right to install prior versions of SQL on the same EC2 instance?FollowComment"

Answer:
"0Hello there,Regarding your queries related to SQL license on EC2:

Does anyone know if the included AWS license comes with Software Assurance, the question is asked when installing a new instance?-> As you might know that Microsoft Software Assurance is a software maintenance program that helps organizations gain access to the latest software versions and releases, without incurring additional licensing costs, and with AWS License. So, when you bring your own license with the help of software assurance you can use that license with AWS.Therefore, when you install a new instance it will ask for software assurance if you are selecting BYOL option.For more details, please refer the below FAQ page:
[+] https://aws.amazon.com/windows/faq/#licensingDoes anyone know if the AWS included SQL license includes the right to install prior versions of SQL on the same EC2 instance?
-> As per the below article:

“For SQL Server license-included instance on EC2SQL Server licensed through a license-included instance from AWS offers all supported versions of SQL Server as license included. Customers can use any number of running instances of SQL Server on an EC2 instance for the same or earlier version of SQL Server with same SQL Server Edition.”[+] https://aws.amazon.com/blogs/mt/run-multiple-instances-sql-server-on-one-amazon-ec2-instance/I sincerely hope the above Information is helpful. In case of more clarifications regarding the licensing of the SQL Server on EC2 Windows instance, please open a Support ticket with the AWS EC2 Support team, and they can help you with all your queries related to it.Be Safe and have a great day ahead!CommentShareSUPPORT ENGINEERKrishna_Banswered a month agoChris a month agoThank you for the response. For clarification, these questions are directly related to the SQL license that is provided from AWS and not under the BYOL category. Are you saying the SQL license provided by AWS includes software assurance?Share"


Question: AWS Certificate 22 days delay!

"I took my AWS Developer associate exam on December 20 , 2021. Almost 22 days over and I haven't received my certificate. There were 3 cases opened with PSI and AWS support but no luck yet.  I am helpless and looking to get an update.FollowComment"

Answer: "1Have you tried to access your certificate via the aws.training portal. Within Achieved Certifications you will be able to download your certificate. The certificate is usually made available via your AWS Certification Account within five days of you passing your exam.CommentShareRoBanswered a year ago0I think a lot of work is being delayed due to the year-end vacation. If you wait a little longer, you will get good results.CommentShareEXPERTposquit0answered a year agogayani a year agoIts almost 22 days over....None of customer service is able to provide response. Very unsatisfied customer service on this.Share"


Question: Adding custom header to S3

"Hi there,I'm using an S3 bucket to server static resources through CloudFront and I'm struggling figuring out how to add custom headers with canonical tags for specific objects inside this bucket. What I'm trying to implement is this rule that I previously applied to our Apache webservers via .htaccess file:<Files "some-example-file.pdf">Header add Link "<https://example.com/friendly-URL/>; rel=\"canonical\""</Files>Any way to achieve that using Lambda@Edge?Thanks!FollowComment"

Answer: "1Yes, this could be done via Lambda@Edge. There are a few different ways that you could approach this, but I think the most straightforward would be as follows:Add user-defined metadata to the S3 Objects for which you want to return the rel=canonical header. eg. x-amz-meta-canonical: https://example.com/friendly-URLCreate a Lambda@Edge function on the Origin Response trigger. This means your function will only be invoked in the event of a cache miss, and the modified version of the object will be stored in cache for future requests.The function should look for the x-amz-meta-canonical header, read the value, then write a new rel="canonical" header in the correct format. You could choose to remove the x-amz-meta-canonical header if you wishDocumentation:Working with metadata in s3: https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingMetadata.htmlUpdating HTTP responses with Lambda@Edge: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-updating-http-responses.htmlLambda@Edge Response event structure: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-event-structure.html#lambda-event-structure-responseLambda@Edge example of manipulating response headers: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-examples.html#lambda-examples-overriding-response-headerAn alternative approach would be to keep a mapping of the source object and the value of the rel=canonical header (if any) separate to the objects themselves, and simply look this up in your Lambda@Edge function. There are various methods for doing this, as outlined in this blog post: https://aws.amazon.com/blogs/networking-and-content-delivery/leveraging-external-data-in-lambdaedge/However, I think this adds unnecessary complexity, and it is probably easier to store the mapping in the object metadata.CommentSharePaul_Lanswered a year ago"


Question: How to use categorical data without converting?

"I am trying to develop a model in SageMaker, but my data is contained categorical type of data, and I would not want to convert it. In the old Machine Learning, I can use back the same data and train the model without any issue. However, when I tried the built-in algorithm, I got the error message that wanted me to convert the data. Is there anyway to do the same as the old Machine Learning without converting? Thank you.FollowComment"

Answer: "0Have you tried SageMaker Autopilot? https://aws.amazon.com/sagemaker/autopilot/CommentShareEXPERTMahesh_Vanswered a year ago0What kind of ML problem are you working with? If it's regression or classification, you could try SageMaker Autopilot to avoid performing feature engineering steps yourself.If you're using Jupyter notebooks on Sagemaker Studio to do your model training, adding a preprocessing step to perform categorical encoding isn't too difficult. We have plenty of examples on Github.Let us know in more detail what kind of algorithm are you dealing with and how you're doing ML on AWS today and I can give you some pointers.CommentShareVictor Dantasanswered a year ago0In addition to SageMaker Autopilot other folks mentioned, I'd suggest you to try SageMaker Canvas:https://aws.amazon.com/sagemaker/canvas/https://aws.amazon.com/blogs/aws/announcing-amazon-sagemaker-canvas-a-visual-no-code-machine-learning-capability-for-business-analysts/SageMaker Canvas offers a similar yet more powerful experience when compared to the previous-generation Amazon Machine Learning service.CommentShareTulio Albertoanswered a year ago0There are a couple of approaches that might be suitable, feel free to pick the one that fits your use case best.SageMaker Canvas supports the ability to do machine learning on datasets in a no-code fashion, and performs this pre-processing for you. As described in that page, Canvas is suited for business analysts who may not have any coding experience.SageMaker AutoPilot allows for AutoML where AutoPilot takes care of feature engineering and hyperparameter optimization. Autopilot is suited for developers who want to perform AutoML without doing the pre-processing themselves.*You can preprocess the input prior to using prebuilt SageMaker algorithms, a basic example of that is shown here in the section "Data_Transformation". This approach is suited for data scientists who want fined-grained control over the transformation steps.In your context, it seems to me that Canvas or AutoPilot might be most appropriate.CommentShareEXPERTJoshua_Banswered a year ago"


Question: blurred text while using Remote desktop

"When I connect to my windows EC2 instance from linux or windows (RDP) - the text looks very blurred. I tried almost all the tricks that I could find from google. The text is still not clear.FollowCommentTushar A a year agoHi Shantanu, can you share more details about your configuration?  What's the resolution of the source machine, and the machine you're viewing the remote desktop on? What's your internet/network bandwidth?ShareShantanu Oak a year agoHi Tushar, The problem got partially resolved (90% better display) when I changed the server type from t2.small to m5.large. I guess that the problem is with t2 and t3 series because even 8 GB / 16 GB servers from that type show blurred text. I had used t2.small for several months last year without any problem. Was there any hardware upgrade recently? Or do you use different display hardware for t2/ t3?Share"

Answer: "0Hello,Since I am not sure which specific solutions you have tried, I will provide all possible solutions as you can skip or attempt as needed.If your graphics card is onboard (Intel CPU's typically have on-board graphics cards), turn off anti-aliasing through your graphics control panel. Right click on your desktop, click "Graphics Properties". Select 3D from the options menu and check "Turn off" in the "Conservative Morphological Anti-Aliasing' section and click apply.Set the font scale on the RDP to match your host's default settings.Open the remote desktop through normal windows RDP, right click the top window bar, then uncheck 'smart sizing'Navigate to Display settings and uncheck "Inherit from parent" in the properties of the .rdg file. Click "Okay" then go back to the properties and re-check the same checkbox. Then also check "scale docked remote desktop to fit window".Try updating all the drivers on the computer you are connected to.CommentShareAlWasee_Manswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: Amazon Connect is Prompting Digit 0 as "Oh" /"O"

"Hi Team,As we have built one contact flow where we are capturing some digit number from end user like FA1203040 but when we are using the Play prompt Block to playback (SSML type) the user input for confirmation. AWS is prompting the Digit 0 as "oh" or "O"Can anyone help how we can resolve this issue.FollowComment"

Answer: 0You're going to have to add another SSML tag in there.<speak>FA<say-as interpret-as="digits">1203040</say-as></speak>davidCommentSharedmaciasanswered a year ago


Question: Cannot create a DNS Zone in LightSail

"I have been trying to set my WordPress blog this morning with Lightsail. I have created an instance, static IP and distribution. When I come to create a DNS zone I get the following error:Some names are already in use: mycustomdomain.co.uk  NameExistsI registered the domain with Google.I updated the domain settings to fulfil a requirement for a custom domain email address with Proton Mail as outlined here:https://proton.me/support/custom-domainThat is working correctly.I also followed the recommendation here:https://lightsail.aws.amazon.com/ls/docs/en_us/articles/lightsail-how-to-create-dns-entryLightsail DNS zones are created in the Virginia (us-east-1) AWS Region. You will get a resource name conflict error ("some names are already in use") if you named a resource in that region the same as the Lightsail DNS zone (e.g., example.com) you want to create.To resolve the error, create a snapshot of the resource. Create a new resource from the snapshot and give it a new, unique name. Then, delete the original resource that is named the same as the domain for which you want to create a Lightsail DNS zone.This has not resolved the issue.Everything is hosted in the UK location: London, all zones (eu-west-2) as I and my audience will be in the UK.Can anyone help me resolve this error? Would it be easier to transfer the domain from Google to Amazon Route 53 Management?Note:I was playing around with my Synology and installed Wordpress on that to look at self hosting but never got as far as updating the domain records to point to it so seems irrelevant but thought I would mention it.FollowCommentLordPayso 6 days agoMy instance name is WordPress-1, my distribution is Distribution-1 and the static ip is StaticIp-1 and they are attached correctly.  I am wondering if it is an issue registering the .co.uk in the CreateDomain[us-east-1] region but think that is unlikely.Share"


Question: Using DocumentDB with Lambda: connection pooling

"I would like to implement a modern web app with serverless compute using AWS Lambda and Amazon DocumentDB. How can I manage efficiently connections to the DB? Is there a connection pool mechanism, like the one you have when using Amazon RDS Proxy, to avoid opening and closing connections from every Lambda execution?Thanks a lot!FollowComment"

Answer: 1Accepted AnswerBest practices are similar to what you would do when connecting to another data store: declare the variable holding the connection to the database outside your handler so it can be re-utilized by subsequent invocations of your function.You can find a good example here: https://docs.atlas.mongodb.com/best-practices-connecting-to-aws-lambda.CommentShareJesus Bernalanswered 2 years ago


Question: Add single table load progress column to table statistics tab

"It would be useful while full load is running to see in "Table Statistics" tab each table estimated progress in percentage ([target loaded rows]/[source_table_row_count]*100) based on the source table row count returning from this query on the source DB:SQL Server:SELECT  SUM(row_count) AS source_table_row_count FROM sys.dm_db_partition_stats WHERE  OBJECT_NAME(object_id)='table name' and index_id < 2 GROUP BY OBJECT_NAME(object_id);Oracle:SELECT num_rows AS source_table_row_count from all_tables where owner='schema name' and table_name='table name'MySQL:select table_rows AS source_table_row_count from information_schema.tables where table_schema='schema name' and table_name='table name'PostgreSQL:SELECT c.reltuples::bigint AS  AS source_table_row_count FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace where n.nspname='schema name' and c.relname='table name' order by 1,2 ;FollowComment"

Answer: "0Adding a single table load progress column to the table statistics tab in AWS Database Migration Service (DMS) would be a helpful feature. The estimated progress in percentage would allow users to track the progress of individual tables during the full load process.As you mentioned, the source table row count can be obtained using different queries depending on the database platform. AWS DMS supports PostgreSQL, Oracle, Microsoft SQL Server, MySQL, and other database platforms, so it would need to handle the different query formats appropriately.CommentSharehashanswered a month ago"


Question: Can A drive be mounted on a Workspace

"Can I mount a drive on a workspace? I want a set of software to install whenever a workspace is created. I want a drive to contain all those software to mount it to install and then unmount when installation is done, Is this Possible?FollowComment"

Answer: "2To achieve what you would like to do, you'd create a custom WorkSpace image and bundle from a customized Windows/Linux WorkSpace.A custom image contains the OS, software and settings for your WorkSpace.A custom bundle is a combination of a custom image and the hardware from which a workspace can be launched.When launching a new WorkSpaces you can then choose your own custom bundle to have a consistent configuration of hardware and software.To get started, follow the "Create a custom WorkSpaces image and Bundle" of the Administration Guide of Amazon WorkSpaces.CommentSharebemeyeranswered 8 months agorePost-User-3337950 8 months agoThanks, it's all good but I went through AWS Documentation and found that encryption is not supported yet so I won't be able to move forward with this. Thanks for the help, If you have any other solution, Please post.Share1Since you specified "Windows Provisioning", I highly recommend a Windows File Server and a Group Policy Preference to specify the share. On the Windows File Share side, you can do this with EC2 or if you're looking a file share as a service, try Amazon FSx for Windows File Server. Group Policy Preferences simplify what would otherwise need to be accomplished through a logon script. In this specific case, you would create the Group Policy Object in the OU where the WorkSpaces are being provisioned to, make sure Loopback Processing is enabled, and edit. The path is User Configuration --> Preferences --> Windows Settings --> Drive Maps.CommentShareEXPERTStevieStetsanswered 8 months agorePost-User-3337950 8 months agoThanks for the help, I will try this .Share"


Question: AWS Lambda email function does not always work

"I have setup a custom flow with cognito to send MFA codes via email using lambda triggers. I have just noticed though that the function does not appear to always work and the emails are not always sent when requesting to login.My account is still in the sandbox mode since i want to stay in free tier but i havent went over my daily limit so i should still be able to send emailsI have setup the lambda function with a promise but this hasnt fixed the issue.I checked the lambda and cloudwatch SES logs for the trigger and there isnt any failures according to it so i am quite confusedAny ideas what is happening?here is my lambda trigger below for sending emailsconst crypto = require("crypto");var aws = require("aws-sdk");var ses = new aws.SES({ region: "eu-west-2" });exports.handler = async(event, context, callback) => {    var verificationCode = 0;   //Only called after SRP_A and PASSWORD_VERIFIER challenges.  if (event.request.session.length == 2) {      const n = crypto.randomInt(0, 100000);      verificationCode = n.toString().padStart(6, "0");            const minimumNumber = 0;      const maximumNumber = 100000;             verificationCode = Math.floor(Math.random() * maximumNumber) + minimumNumber;         await sendMail(event.request.userAttributes.email, verificationCode);  }  else {      //if the user makes a mistake, we pick code from the previous session instead of sending new code      const previousChallenge = event.request.session.slice(-1)[0];      verificationCode = previousChallenge.challengeMetadata;  }        //add to privateChallengeParameters, so verify auth lambda can read this. this is not sent to client.  event.response.privateChallengeParameters = { "verificationCode": verificationCode };  //add it to session, so its available during the next invocation.  event.response.challengeMetadata = verificationCode;    return event;  };    async function sendMail(emailAddress, secretLoginCode) {  const params = {      Destination: { ToAddresses: [emailAddress] },      Message: {          Body: {              Html: {                  Charset: 'UTF-8',                  Data: `<html><body><p>This is your secret login code:</p>                         <h3>${secretLoginCode}</h3></body></html>`              },              Text: {                  Charset: 'UTF-8',                  Data: `Your secret login code: ${secretLoginCode}`              }          },          Subject: {              Charset: 'UTF-8',              Data: 'Your secret login code'          }      },      Source: 'my verified email'  };  await ses.sendEmail(params).promise();}FollowComment"

Answer: 0Are you catching bounce and delivery feedback notifications via SNS callback subscription?CommentSharemdibellaanswered a year agoSAGE a year agonope i haven’t set it up to work with SNS so it won’t be able to do that surely?Share0In case event.request.session.length != 2 no email will be sent. I would add some logging statement to the function code to better trace what is happening.CommentShareEXPERTMassimilianoAWSanswered a year ago


Question: "NewSQL" AWS database service for OLAP and OLTP combined?

"Does AWS currently, or does it have planned for the future, an equivalent service to "NewSQL" services such as TiDB, Vitess, Yugabyte, and Oracle Heatwave? My understanding is that these services allow OLAP and OLTP within the same database by combining transactional and columnar technologies, eliminating much ETL between a data warehouse and consumer facing db and providing real time analytics. I understand some of these services offer hosting on AWS, but I am wondering if there is an AWS native solution currently or planned.FollowComment"

Answer: "0AWS constantly listens to customers to deliver what they need, and roughly 90-95% of the AWS roadmap is driven by customer input. There is no public information currently on whether a NewSQL or HTAP offering is on the roadmap. If you have a specific requirement, please contact your AWS account manager or solutions architect so that they can take note of your input.NewSQL offerings may offer OLTP scale-out, HTAP, or both. Some of these offerings provide OLTP scale-out (but not OLAP); for example,  YugabyteDB and Vitess. While TiDB and Heatwave do provide HTAP.To address HTAP use cases, you can consider using Amazon Aurora as the OLTP data store, and continuously replicate that data to S3 for querying with Amazon Athena or Redshift Spectrum. Please refer to this blog post - https://aws.amazon.com/blogs/big-data/combine-transactional-and-analytical-data-using-amazon-aurora-and-amazon-redshift/You could also use AWS Database Migration Service to stream data from Amazon Aurora to Amazon Redshift - https://d1.awsstatic.com/events/reinvent/2019/REPEAT_1_Analytical_use_cases_with_AWS_Database_Migration_Service_(AWS_DMS)_DAT360-R1.pdfNote that the above approach (replicate from an OLTP data store to OLAP) is basically what Heatwave does. This pattern is also used by Azure Synapse Connector for CosmosDB and SQL Server.If your requirement is for OLTP scale-out, Aurora Multi-Master (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-multi-master.html) provides some degree of this; however, the amount of scaling is not comparable to what Vitess, YugabyteDB, or Citus PostgreSQL are capable of (Aurora MM is 4 nodes maximum, versus hundreds with NewSQL offerings).It is important to note, however, that Amazon Aurora on a single writer node is capable of high throughput (for example see this excellent comparison of Amazon Aurora, YugabyteDB, and CockroachDB - https://blog.yugabyte.com/comparing-distributed-sql-performance-yugabyte-db-vs-amazon-aurora-postgresql-vs-cockroachdb/ - see the conclusion at the bottom "This means that Aurora PostgreSQL is a great choice if your database instance would never need to handle more than 120K transactions/sec"). Hence for most use cases that do not require >>100K transactions/second, Amazon Aurora is an excellent choice..One or more of the NewSQL offerings mentioned in the question (e.g. Yugabyte) are available as a fully-managed service on AWS, and are available on the AWS Marketplace, e.g. https://aws.amazon.com/marketplace/pp/prodview-d6flojaonhhzgCommentShareorlyandicoanswered a year ago"


Question: Lambda function is no longer writing records to AWS Timestream

"I'm not sure if something changed on AWS, but I didn't change anything on my side on the lambda function or the db/tables in AWS Timestream.I'm testing my lambda and it works, but it doesn't write to AWS Timestream. I'm very confused.I can see in logs that everything goes through and I'm not seeing any errors... and when I query my Timestream DB it doesn't return anything - unless I go way back when it was working properly.FollowCommentalatech EXPERT4 months agoCan you check if region is expected?ShareAmazing Ash 4 months agoCan't say much about the root cause this early but not seeing any error in logs can be to due to other multiple reasons like eaten up exception or insufficient logging. So, in such case, Tracing shall give you some hints. Given you are using Lambda, have you turned-on XRay tracing for the lambda and have you tried looking at that?Please try that, if not already and it may given you some hints.Share"


Question: TLS1.0/1.1 - how to find the requests

"Afternoon all, I received an email saying I had connections with a few S3 buckets so I know the 3 however I can't understand how to get more data.    The 3 buckets all have logging on so I have an s3 bucket with the logs, but the 2 ways they say are;Log Insights. - For this it appears I need to have the actual logs goto cloudwatch logs as I don't see a way of selecting the S3 admin that has the logs.CloudTrail / Lake.   This looks even easier, the doc here - https://aws.amazon.com/blogs/mt/using-aws-cloudtrail-lake-to-identify-older-tls-connections-to-aws-service-endpoints/ I thought was the answer, but I am stuck and it maybe just the data store part.    There is just that 1 line, create a data store, but I did create one, I believe the 'events' should be cloudtrail and not configuration items.   Then for data events I have tried S3, s3 access points (as I am sure its one of those) and when I copy the sample query for TLS calls I get an invalid query.   I even tried other sample ones and all do the same thing, immediate red x.The sample query is here;SELECT eventSource, COUNT(*) AS numOutdatedTlsCalls FROM $EDS_ID WHERE tlsDetails.tlsVersion IN ('TLSv1', 'TLSv1.1') AND eventTime > '2023-01-17 00:00:00' GROUP BY eventSource ORDER BY numOutdatedTlsCalls DESCSo any help on the best way to get that info is appreciated.FollowComment"

Answer: "2Accepted AnswerHey, lraymond@ can you confirm you're updating the $EDS_ID placeholder in your query with your event data store ID?  i.e.SELECT eventSource, COUNT(*) AS numOutdatedTlsCalls FROM '84d60cfd-1b4f-4e75-a235-example' WHERE tlsDetails.tlsVersion IN ('TLSv1', 'TLSv1.1') AND eventTime > '2023-01-17 00:00:00' GROUP BY eventSource ORDER BY numOutdatedTlsCalls DESCCommentShareMatt_Hanswered 4 months agolraymond 4 months ago:facepalm: - I was clearly overlooking that one! I thought that was more an environment variable as the left side has the event data store drop down, but now realize what/why!I appreciate the read and such a quick reply, saved me a lot of time on this one!ShareMatt_H 4 months agoYou're welcome!Share"


Question: Workmail redirect issues

"Moving some companies mail management using Workmail , but also to other functions in AWS. Though , Workmail is a headache due to poor performance in redirecting incoming emails to external accounts, typically temporary project members.We use one mail account to manage all redirects, creating a group for each external user and adding redirect account to the group. Then in Workmail email rules settings we define all rules. Most are working , especially thoose with one external receiver. But in some distributionlist ( a group) we have some 20 external receivers. The result is that the mail is stored in redirect account mailbox and is stack there.With some 4-5 members in a distribution list the redirection works but creates a lot, some 50, records in "deleted box" where the rules is set to "remove" the mail when sent.Of course there are no problems to redirect mails internally in Workmail.We find it strange that there is no simple and straight-forward redirect function that can be maintained without any IT skills.FollowCommentAWS-User-0432774 a year agoFurther testing finds that the rule setup external accounts where all of a sudden only 6 "redirects to.." settings. Regrouped to 7 "redirect to..." where the 7th holds 7 external adressers. The tests indicates that the redirects are working.There is a limitation of 10 "redirect to..." settings. Are there any limitation to number of adresses in a redirect setting?Share"


Question: Cannot upgrade nor restore PostgreSQL 9.4 RDS snapshot

"My attempts to restore an old RDS snapshot (a little over 2 years old, running Postgres 9.4.20) from the Amazon RDS Snapshots page as well as using the aws cli have all failed.  The GUI returns the following error (and yes, we tried many different instance types and realized that wasn't the problem):RDS does not support creating a DB instance with the following combination:DBInstanceClass=db.m6g.large, Engine=postgres, EngineVersion=9.4.20, LicenseModel=postgresql-license. For supported combinations....When we selected the "Upgrade snapshot" option, the "New engine version" drop-down was empty and we were greeted with the error message "No upgrades are available for the snapshot at this time."Using the aws cli, we ran the following command and tried upgrading to versions 9.6.9, 10, 11, 12, 13, and 14, all to no avail.aws rds modify-db-snapshot --db-snapshot-identifier my_snapshot_name --engine-version 11This returned an error like the following error each time for all versions greater than 9; 9.6.9 was deemed not a valid upgrade target:An error occurred (InvalidParameterCombination) when calling the ModifyDBSnapshot operation: You can't upgrade the DB snapshot from the engine version 9.4.20 to 11.13.My suspicion is that this version of Postgres is just too far out of date and that the snapshot would have needed to have been upgraded back when Amazon first alerted us that Postgres 9.4 would be deprecated.Is there any way to recover data from an RDS snapshot of this age/version, or are we out of luck?FollowCommentrePost-User-9836790 10 months agoUgh.  I find myself in the same situation.  I have a snapshot on 9.5.22 which a) can't be upgraded AND b) isn't supported on any of the instance types available (I need a t2 or similar).  So...AWS just deleted my data?  Crazy!!Share"

Answer: "1Linking to a newer question which now has the answer, in case anyone reads this - https://repost.aws/questions/QUiOFEQNgaQQSNevhh31vd9A/how-can-i-restore-a-failed-rds-db-from-a-snapshot-if-it-uses-a-deprecated-engine-version-of-postgre-sqlCommentShareEXPERTskinsmananswered 3 months ago"


Question: Starting with Amazon GameLift

"Hi guys! I'm starting to use Amazon GameLift with Unreal Engine, learning about dedicated servers, so I was reading documentation but I don't understand when billing starts or if I can do this practice using some free tier. So if someone with experience in Amazon GameLift billing can provide me with any information, I'll appreciate it. Thanks!FollowComment"

Answer: "0Accepted AnswerIn terms of hosting costs, each fleet in GameLift has a configurable amount of ec2 instances aka virtual machines that run one or more of your unreal engine dedicated server executable. You are charged for the cumulative amount of time that your instances are running for. The price of instance running time per hour is based off the instance type, Linux vs Windows, and whether it's part of an On-Demand or Spot fleet. The exact prices can be found here, https://aws.amazon.com/gamelift/pricing/The free tier covers up to 125 hours of c5.large On-Demand instance (Linux or Windows) usage per month for the first year of your AWS account.CommentSharerePost-User-5100160answered 2 years ago"


Question: Looking for example using Vitis with RTL CL and DDR ram

"Previously I used the HDK environment to make a AFI with RTL and interfaced over PCIe with some basic c++ code.I would like to try using the Vitis environment this time, but my project needs to use the on-board DDR memory. Is there a Vitus RTL example I can use to show how to access the DDR from my RTL? I could only see examples that use the DDR in cpp or ocl folders, and couldn't find one in the rtl_kernels folder. I would like both the host c++ and my RTL logic to be able to fetch from and write to DDR.Edited by: bdevlin on Mar 29, 2020 6:56 PMFollowComment"

Answer: "0Hello,You can find example of RTL kernels in the Vitis flow here:https://github.com/Xilinx/Vitis_Accel_Examples/tree/master/rtl_kernelsI suggest starting with the simple rtl_vadd design.A few high-level things to understand:RTL kernels need to comply with specific interface rulesRTL kernels are Vivado IP blocks, packaged as .xo files for VitisIn the Vitis flow, the user doesn't need to explicitly manage DDRs, instead you simply specify which DDR you want to connect your kernel ports to and the v++ linker takes care of the rest.More details in the Vitis docs:https://www.xilinx.com/html_docs/xilinx2019_2/vitis_doc/Chunk2020182740.html#qnk1504034323350https://www.xilinx.com/html_docs/xilinx2019_2/vitis_doc/Chunk2086915788.html#ariaid-title6CommentShareThomasXilinxanswered 3 years ago0Thanks - that makes sense. I was able to create a .xo file in Vivado 2019.2 locally from a RTL project using the example design, is it possible for me to copy one of the aws example folders and modify the Makefile to include my .xo? (e.g. modify BINARY_CONTAINER_vadd_OBJS in  Vitis_Accel_Examples/hello_world/Makefile) and it will link OK?I also tried to make a Vitus project locally but had issues getting the platform to load from https://github.com/aws/aws-fpga/tree/master/Vitis/aws_platform/xilinx_aws-vu9p-f1_shell-v04261818_201920_1 , do I need to first build this using vitis_setup.sh and then I can copy the platform files locally?CommentSharebdevlinanswered 3 years ago0You can indeed copy one of the examples and reuse the Makefile, but I think it is a little overkill. These Makefiles are built to support many different plaforms and have a lot embedded intelligence which is not needed if you only target F1.  You can do a "make <your options> -n" to see what commands would really be executed and only reuse those. For instance, the hello_world example Makefile will compile the C kernel (v++ -c). You probably don't want to do this since you already have your .xo. Unless you are combining multiple .xos, then the only thing you need to do at this point is run the v++ linker (v++ -l). Keeping things simple will help you better understand the flow and gradually take advantage of Vitis features.If you want to work locally, then you need to clone the aws-fpga repo and then source vitis_setup.sh. This will download the platform .xsa file which is not hosted on the repo.CommentShareThomasXilinxanswered 3 years ago0Ok makes sense, thanks for your help.CommentSharebdevlinanswered 3 years ago"


Question: 48 hours stuck : "Your request for accessing resources in this region is being validated"

"HelloI am trying to start an ec2 gpu instance in us-east-1. I have tried both Amazon Linux g4ad.xlarge, and g5g.2xlarge instances and receive the following message.Instance launch failedYour request for accessing resources in this region is being validated, and you will not be able to launch additional resources in this region until the validation is complete. We will notify you by email once your request has been validated. While normally resolved within minutes, please allow up to 4 hours for this process to complete. If the issue still persists, please let us know by writing to aws-verification@amazon.com for further assistance.I have emailed aws-verficiation@amazon.com, twice, with no reply. I have been waiting for over 48 hours and am totally blocked. What can I do?FollowComment"

Answer: "0Hello ,Thank you for posting your question on the AWS Repost, my name is Rochak and it will be a pleasure assisting you with this today.I understand you are trying to launch ec2 gpu instance in us-east-1 as well as you have tried launching g4ad.xlarge, and g5g.2xlarge instances and received the error provided.As the error mentioned, it usually happens when your AWS account may be in the process of verified for launching GPU instance in us-east-1. Please kindly note that this is a security measure put in place to prevent the abuse of GPU instances. You can also try launching GPU instances in a different region where your account is already verified.I also understand you have emailed aws-verfication@amazon.com which is the next step. If you haven’t still received a response, I recommend you to open a support case with our AWS Support team. AWS support includes various tier that you can select from depending on your business needs. The support team should be able to provide you with more information about the status of your account verification and help you resolve the issue. [1]I hope this helps. If you need further info, let me know in the comments; otherwise I'd appreciate if you mark my answer as "accepted".Kind regards,Rochak from AWSReferences:[1] AWS Premium Supporthttps://aws.amazon.com/premiumsupport/CommentShareAWS-Rochakanswered 3 months ago"


Question: Elastic beanstalk deployment failing few success and then failed it will happen on workers

Elastic beanstalk deployment failing few success and then failed it will happen on workers error is.032769 [ERROR] An error occurred during execution of command [app-deploy] - [FlipApplication]. Stop running the command. Error: remove current dir failed: unlinkat /var/app/current: directory not emptyFollowComment


Question: Target-based auto-scaling policy in gamelift not working properly based on configured buffer of available game session

"Hello all,We have configured 80 percent buffer of available game session in Fleet Target based auto scaling.But somehow new instance are created when available game session on one instance still not reached its 80 percent capacity.For example we currently have 50 active server process per instance means we can host 50 game session on one instance and based on target based auto scaling new instance creation should trigger when active game session limit reached to 40 but its not working currently, new instance event are triggering when only 5 game session active.Any guides how should we handle this ????FollowComment"

Answer: "1If your target-based auto scaling is not triggering new instance creation when the active game session limit reaches the desired threshold, there could be a few possible reasons for this behavior. Here are some guidelines to help you troubleshoot and handle this issue:Check Auto Scaling Policies: Verify that the auto scaling policies are correctly configured. Ensure that you have set the scaling policy to trigger when the average number of active game sessions exceeds the desired threshold (e.g., 40 in your case). Review the scaling policies' settings and make sure they align with your requirements.Evaluate Scaling Metrics: Assess the metrics used for scaling decisions. Determine whether the metrics being monitored accurately reflect the number of active game sessions. It's possible that the metric being used is not capturing the correct information, resulting in incorrect scaling actions. For example, if the scaling metric is based on CPU utilization, it may not correlate directly with the number of active game sessions.Monitor Scaling Activities: Keep track of the scaling activities and check the CloudWatch metrics for the fleet. This will help you identify whether the scaling activities are being triggered and if they correspond to the expected behavior. Review the scaling events, timestamps, and associated metric values to gain insights into the scaling decisions.Consider Scaling Cooldown Period: Verify that a scaling cooldown period is not impeding the scaling actions. The cooldown period is a configurable interval during which Auto Scaling waits before triggering additional scaling activities. If the cooldown period is set too long, it could delay the creation of new instances, even if the conditions are met.Review Scaling Alarms: If you are using CloudWatch Alarms to trigger the scaling actions, verify that the alarm thresholds and settings are correctly configured. Ensure that the alarms are triggering at the desired thresholds based on the appropriate metrics.Evaluate Scaling Policies: Assess the scaling policies and their configuration. Ensure that the scaling policies are properly adjusted to achieve the desired behavior. For example, if the scaling policy has a scaling adjustment value that is too small, it might not trigger new instance creation until a significant increase in load occurs.Validate Fleet Target Configuration: Double-check the fleet target configuration to ensure it accurately reflects your desired scaling behavior. Ensure that the buffer values and target capacities are set correctly for your game session instances. If necessary, make adjustments to align the configuration with your requirements.CommentShareStefanoBanswered 21 days agorePost-User-6767636 21 days agoEvaluate Scaling Metrics: Assess the metrics used for scaling decisions. Determine whether the metrics being monitored accurately reflect the number of active game sessions. It's possible that the metric being used is not capturing the correct information, resulting in incorrect scaling actions. For example, if the scaling metric is based on CPU utilization, it may not correlate directly with the number of active game sessions.So you are saying that new instance can be triggered based on CPU Utilization ??I have added screenshot of auto scaling policy we are using in fleet.Do I need to do any other configuration to check why auto scaling creating new instances and also how to check reason of new instance creation ?Thanks.Share"


Question: enable communication between multiple VPCs from a single VPN connection attached to my transit gateway

We have DEV and Production servers in different AWS accounts and these account's VPC are connected via Transit Gateway. I want to connect the VPN to the same Transit gateway so that we don't need to create separate VPNs for DEV And Production account.As AWS doesn't support multiple Remote IPv4 network CIDR in to Site to Site VPN.The CIDR range for which both the accounts can be accessible is of size /16. Since it is a very big CIDR and this can cause overlapping of IP addresses for the client's Network they are not allowing it.Also they are not accepting CIDR greater than size /30.AWS support has recommended that we can consider using a dynamic VPN routing.Does anyone has any idea how we can achieve this configuration without setting up Two VPNs.FollowComment

Answer: "1Have  you seen this? https://aws.amazon.com/premiumsupport/knowledge-center/transit-gateway-connect-vpcs-from-vpn/ This looks like the scenario you are describing. Hope this helpsCommentShareValkyrieanswered a year agoLudovicG a year agoThank you Valkyrie, I will go through itShare1Adding something for one part of your question:You can absolutely route more than a single CIDR range through Site-to-Site VPN. That's not a restriction at all. Where the misunderstanding normally is: You can only specify a single encryption domain on the VPN.You might choose to set up the encryption domain to match your CIDR range (say, 172.24.0.0/16) that will restrict you to only routing that CIDR range on the VPN.Instead, you should set up the encryption domain on the VPN to be 0.0.0.0/0 which means "encrypt all traffic on this VPN tunnel". The routers on either end of the tunnel (in this case, Transit Gateway and your on premises device) will only be sending traffic to the tunnel which needs to go to the remote end; and because the tunnel is set up to encrypt all traffic it will encrypt whatever traffic is sent to it even if it "belongs" to multiple CIDR ranges.CommentShareEXPERTBrettski-AWSanswered a year agoLudovicG a year agoThis will definitely help, Thank you for such a wonderful contribution BrettskiShare"


Question: periodOverPeriodPercentDifference /  periodOverPeriodDifference cannot work with year

"Using the same example from: https://aws.amazon.com/blogs/big-data/add-comparative-and-cumulative-date-time-calculations-in-amazon-quicksight/I am able to replicate both Quarter and Month Partial QoQ QTD Sales and MoM MT Sales:PartialQoQQTDSales=periodOverPeriodPercentDifference(sumif(Sales, {Order Date} <= addDateTime(dateDiff(truncDate("Q", ${DateParameter}), ${DateParameter}, "DD"), "DD", truncDate("Q", {Order Date}))), {Order Date}, QUARTER, 1)PartialMoMMTDSales=periodOverPeriodPercentDifference(sumif(Sales, {Order Date} <= addDateTime(dateDiff(truncDate("MM", ${DateParameter}), ${DateParameter}, "DD"), "DD", truncDate("Q", {Order Date}))), {Order Date}, QUARTER, 1)However, Year to Date Partial YoY YTD Sales would not produce the desired result with:PartialYoYYTDSales=periodOverPeriodPercentDifference(sumif(Sales, {Order Date} <= addDateTime(dateDiff(truncDate("YYYY", ${DateParameter}), ${DateParameter}, "DD"), "DD", truncDate("YYYY", {Order Date}))), {Order Date}, YEAR, 1)any ideas what did I do wrong?FollowComment"

Answer: "0Hi there,Thank you for posting the question and the detailed explanation. In context regarding periodOverPeriodPercentDifference, YEAR is also one of the valid granularity.In order to assist you better a screen-share session would be needed. Can you please open a support case with AWS using the following linkCommentShareSUPPORT ENGINEERSanket_Kanswered 3 months ago"


Question: "Not able to delete VPCs, Subnets, SGs, and Network Interfaces"

"Hi,I attempted to do the ECS Fargate DevOps Workshop to deploy a cluster.Basically, it uses Cloudformation to create and delete the stack. Cloudformation stack kept failing in deleting some resources.One example: "DELETE_FAILED" error with status reason as "...Status Code: 400; Error Code: DependencyViolation.."I ended up deleting the stack while skipping the deletion of some resources. Now the stack is deleted, and I have some resources that are not deleting due to dependencies. I have been trying to figure this out all day. Can anyone help?These are the items that are not deleting:2 VPCs - vpc-06b826b3ab1da2e58 // vpc-02de9af25da6ced012 subnets - subnet-0b672b0e8a1874a87 // subnet-0e4181e7a7537f2512 network interfaces - "eni-00c5483e08913c88f" & "eni-061e8154b1bc16528"2 security groups - "ecs-inf-test-servicesgE18B74B7-U32ANMY3D4J5" & "ecs-inf-test-servicesgE18B74B7-7U01IMREA0KK"THANKS!FollowComment"

Answer: "0Hi adub,From my understanding you have deleted your stack but there are still some resources left behind because of dependencies.An Amazon ECS cluster can fail to delete due to an issue with underlying resource dependencies. When an Amazon ECS cluster is created, AWS CloudFormation creates resources such as Auto Scaling groups, virtual private clouds (VPC), or load balancers. These resources are associated with the cluster, and their presence can prevent the deletion of the cluster. Other issues with AWS CloudFormation can also prevent the deletion of an Amazon ECS cluster.You would need to navigate to your resources and go about removing dependencies and then deleting them.In the case of your security groups, it could be that the inbound or outbound rules of the security group refers to another security group/groups or associated with a network interface. You would need to clear the dependencies for the security group that you want to delete and then attempt to delete the security group - https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-delete-vpc-sg/.For deleting your subnets, you can try:•Delete all ENI's associated with subnets within your VPC•Disassociate all the respective subnets from all your route tables in your VPC•Delete all route tables other than the "Main" table•Disassociate all Network ACL's from all the respective subnets in your VPC•Delete all Network ACL's other than the Default oneYou can check out a previous forum with regards to deleting a subnet that had dependencies, which details some more things to consider: https://forums.aws.amazon.com/thread.jspa?threadID=95189For deleting your ENIs, you can find these using the Network Interfaces tab of the EC2 Management Console. Once you find the ENI's attached to that VPC, you can find the individual resources. Specifically, take a look at whatever is connected to ‘eni-00c5483e08913c88f’ and ‘eni-061e8154b1bc16528’.It could be any number of things, including Instances, NAT Gateways, VPC Endpoints, Load Balancers or other resources.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#delete_eniWith regards to the VPC, Common VPC dependencies include InternetGateways, Subnets, or Instances. You would need to clear the dependencies and then delete the VPC - https://docs.aws.amazon.com/vpc/latest/userguide/working-with-vpcs.html#VPC_Deleting.You can view this AWS document for more information: https://aws.amazon.com/premiumsupport/knowledge-center/ecs-cluster-delete-failure-stack/I hope this helps. Please let me know if you have any questions.CommentShareamz99answered 2 years ago0Hello,Thank you for your suggestions, however I am still stuck. I did check all these issues.The security groups do not have any inbound rules. However, when I try to delete it, it gives error "1 network interface associated. Delete the network interface, or associate with a different security group"There are no Instances, NAT Gateways, VPC Endpoints, Load Balancers or other resources so I am not sure what the network interface is attached to. I have checked all these resources. When I try to delete the NI, it gives error "Network interface is currently in use."Subnets: Message I get when trying to delete "The following subnets contain one or more network interfaces, and cannot be deleted until those network interfaces have been deleted." The routing tables are all main. They have been disassociated from the routing tables. I'm not able to disassociate all Network ACL's from all the respective subnets in the vpc.The VPC will not delete because "The following 1 network interfaces must be deleted before this VPC can be deleted"I have gone through to see if there are any Load Balancers, Auto Scaling Groups, NAT Gateways, Endpoints, and various other resources however there was nothing.I will check out some of the documentation.Any other ideas?Thank you.CommentShareadubanswered 2 years ago0I was able to delete the interfaces using the aws cli command. Once I deleted the ENIs, I was able to delete everything else. So basically, I couldn't delete from the console, but I could delete it using the aws-cli command. Thanks!"aws ec2 delete-network-interface --network-interface-id eni-061e8154b1bc16528"CommentShareadubanswered 2 years ago"


Question: why AWS-bucket size shows different result with different methods ?  | AWS-cloud-watch vs AWS Bucket metric dashboard

"I used Aws-cloudwatch to get the size of bucket but the result is different from aws metric dashboard of bucket.Ex.    I uploaded  some amount of data manually in bucket and check the size of bucket after some days but it showing different in api call and showing different on metric dashboard. I'm getting 99GB bucket size on metric dashboard but from api call it showing 120GB so it's weird, I'm not getting how this happend. And also how aws will charges us,  is it based on the data size showing on metric dashboard or on based on the result fetched by cloudwatch api call.cloudwatch cli command :$  aws cloudwatch get-metric-statistics --namespace "AWS/S3" --start-time 2023-01-14 --end-time 2023-01-15 --metric-name BucketSizeBytes --period 3600 --statistics Average --unit Bytes --dimensions Name=BucketName,Value=MyBucketName  Name=StorageType,Value=StandardStorageFollowComment"

Answer: "0One possibility is that you have failed multipart uploads in your bucket and you are being charged for them.  Here are two articles about multipart uploads that are stored in a bucket.  Storage Lens will help you see if this is the case.  Also, if you are being charged for this, open a support ticket with AWS to get those charges refunded to you.  Be prepared to tell AWS how long you need them to look for these charges.https://aws.amazon.com/blogs/aws-cloud-financial-management/discovering-and-deleting-incomplete-multipart-uploads-to-lower-amazon-s3-costs/https://aws.amazon.com/blogs/aws/s3-lifecycle-management-update-support-for-multipart-uploads-and-delete-markers/CommentSharejschwar313answered 4 months ago"


Question: AWS cloud Practitioner exam results delayed

"I appeared for AWS cloud practitioner exam on 31st December 2022 through PSI registrations.I still can’t see exam scores and certification details on my dashboard. In the exam history section it never shows the details of the exam taken.It’s been 10 days now.I have also raised my concern to AWS support. Case number XXXXXXXXXXXX. Candidate Id XXXXXXXX.The response is very slow. Can someone help me resolve this issue? Has anyone encountered similar issue?Regards,Mitesh Jain*Edit: Removed case ID & candidate ID — Aimee K.FollowComment"

Answer: "0Hi Mitesh,Sorry to hear about this trouble. This isn't the experience we aim for.I can imagine your urgency for getting this matter resolved, which is why I've internally raised your concerns to our team that's handling your case.After locating your support case, I can confirm it's queued with the best suited team and your request is actively being reviewed.To reach secure guidance, please continue to communicate your concerns directly through your email correspondence.Thank you for your patience as we continue to investigate.— Aimee K.CommentShareEXPERTAWS Support - Aimeeanswered 5 months ago"


Question: Is there a way by which we can allow https calls from only aws servers from across another region without VPC peering?

"Hello,Is there a way by which we can allow https calls from only aws servers from across another region without VPC peering?I tried using security group. But that will not work.RegardsFollowComment"

Answer: "0I am a newbie to AWS. I created two instances in two different regions. One was Windows  and the other was Linux. Both had public ips. I logged onto windows via Remote Desktop protocol and successfully tested the html page on linux instance. So I was able to make successful html calls.CommentShareSandeepVudataanswered a year ago0As per the other answer, instances can communicate using public/elastic IP addresses which means that VPC or Transit Gateway peering isn't required.Security groups are definitely the best way to limit communications between the instances. When you say "that will not work" - what isn't working?CommentShareEXPERTBrettski-AWSanswered a year ago0See Amazon VPC-to-Amazon VPC connectivity options.CommentShareEXPERTkentradanswered a year ago"


Question: Lambda function updating cannot be made atomic with RevisionId

"A number of Lambda API calls allow for a RevisionId argument to ensure that the operation only continues if the current revision of the Lambda function matches, very similar to an atomic Compare-And-Swap operation. However, this RevisionId appears to be useless for performing some atomic operations, for the following reason:Suppose I want to update a function's code and then publish it, in 2 separate steps (I know it can be done in 1 step, but this does not interest me, because I cannot set the description of a published version in 1 update/publish step...it must be done in 2 steps). The update_function_code call returns a RevisionId that corresponds to the "in progress" update of the function. This RevisionId cannot be used because it will change once the function becomes active/updated. This new RevisionId can only be obtained by get_function.Update code -> RevisionId A (in progress) -> RevisionId B (updated/active) -> Get Function -> RevisionId B -> Publish FunctionThere exists a race condition due to the fact that I must call get_function in order to get the current RevisionId before I continue with publishing my function. This race condition makes it impossible create an atomic sequence of operations that includes a update_function_code operation, because the RevisionId that it returns cannot be relied on, and has to be refreshed with a get_function call. Concurrently, another operation could change the RevisionId, and you wouldn't know, because you're depending on get_function to return an unknown RevisionId.FollowComment"

Answer: "0Accepted AnswerThe solution that I came up with is to sometimes use RevisionId and to sometimes use CodeSha256. Up until the call to update_function_code, you can use RevisionId, then when you call update_function_code, it returns a response containing both a RevisionId and a CodeSha256. The CodeSha256 is static and can be fed into publish_function as a constraint, in the same way as you would use RevisionId.CommentShareamoffatanswered a year ago"


Question: how to connect to private RDS from localhost

"I have a private VPC with private subnets a private jumpbox in 1 private subnet and my private RDS aurora MySql serverless instance in another private subnet.I did those commands on my local laptop to try to connect to my RDS via port forwarding:aws ssm start-session --target i-0d5470040e7541ab9 --document-name AWS-StartPortForwardingSession --parameters "portNumber"=["5901"],"localPortNumber"=["9000"] --profile myProfileaws ssm start-session --target  i-0d5470040e7541ab9 --document-name AWS-StartPortForwardingSession --parameters "portNumber"=["22"],"localPortNumber"=["9999"] --profile myProfile aws ssm start-session --target  i-0d5470040e7541ab9 --document-name AWS-StartPortForwardingSession --parameters "portNumber"=["3306"],"localPortNumber"=["3306"] --profile myProfile The connection to the server hangs.I had this error on my local laptop:Starting session with SessionId: myuser-09e5cd0206cc89542Port 3306 opened for sessionId myuser-09e5cd0206cc89542.Waiting for connections...Connection accepted for session [myuser-09e5cd0206cc89542]Connection to destination port failed, check SSM Agent logs.and those errors in /var/log/amazon/ssm/errors.log:2021-11-29 00:50:35 ERROR [handleServerConnections @ port_mux.go.278] [ssm-session-worker] [myuser-017cfa9edxxxx] [DataBackend] [pluginName=Port] Unable to dial connection to server: dial tcp :3306: connect: connection refused2021-11-29 14:13:07 ERROR [transferDataToMgs @ port_mux.go.230] [ssm-session-worker] [myuser-09e5cdxxxxxx] [DataBackend] [pluginName=Port] Unable to read from connection: read unix @->/var/lib/amazon/ssm/session/3366606757_mux.sock: use of closed network connectionand I try to connect to RDS like this :I even tried to put the RDS Endpoint using ssh Tunnel, but it doesn't work:Are there any additional steps to do on the remote server ec2-instance?It seems the connection is accepted but the connection to the destination port doesn't work.or is there any best other way to connect to private rds in private vpc  when de don't have site-to site-vpn or Direct connect ?FollowComment"

Answer: "1Have you tried Query Editor or  Data API? They are easy ways to access Aurora Serverless.Query Editorhttps://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/query-editor.htmlData APIhttps://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/data-api.htmlCommentShareYManswered 2 years agoAWS-User-1737129 a year agoThank you for your reply, with DATA API I can connect my NodeJs/NestJs application to my private RDS DB  at the moment of application launch?Share1connection refused usually means that there is some network connectivity issue. Can you check your Security Groups on RDS?Following link shows the steps that you would need:https://aws.amazon.com/premiumsupport/knowledge-center/rds-connect-ec2-bastion-host/CommentShareMuhammad Mansooranswered 2 years agoAWS-User-1737129 2 years agoThank you for your answer, yes I opened all traffic in my RDS.I tried to follow those 2 articles which seem to have the same requirement as mine but the same result in the end :https://www.linkedin.com/pulse/remote-port-forwarding-using-aws-ssm-session-manager-jaros%C5%82aw-grz%C4%85bel/?articleId=6704645407001120768&fbclid=IwAR1qruJvAdWX7QvMch8ZNwtU4r-A5O907coQGNoZ5_yLZo4kUoDuapae7xshttps://devobs.co/blog/using-aws-systems-manager-and-ssh-to-access-an-rds-instanceShare1Assuming that you want to connect to private RDS end-point from the InternetSet up bastion host in public subnet in your VPC along with Internet Gateway. Make sure you are able to log into bastion host with SSH keys.Set up SSH tunnel using RDS end-point as host followed by : and port number. Open the SSH session on bastion host along with tunnel setting.You should be able to connect to RDS end-point from tool running on your machine over the internet.Hope this helps.CommentShareSVanswered a year agoJess a year agoThank you @Sahin_v, but as mentioned My VPC is private only VPC with private SNs, and I don't have to change that requirement.i am able to connect to my private bastion host in private SN via SSM port forwarding, but from there to RDS port it hangsShare1You indicated this is a private VPC. Is there a route to the internet via an on-prem connection or have you added an endpoint for SSM? If not, then the SSMAgent in the instance has no route to connect to the SSM Service. The SSMAgent originates the connectivity outbound.  If this sounds like your situation take a look at Step 6: (Optional) Create a Virtual Private Cloud endpoint  (https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-create-vpc.html)CommentShareScott_Kanswered a year agoJess a year agoit's a private VPC linked with another Public VPC with a TGW, but mine is a private VPC and should stay private VPCShare1You should make a tunnel using the bastion host that can be connected with session manager.Please check the following link:https://aws.amazon.com/premiumsupport/knowledge-center/systems-manager-ssh-vpc-resources/CommentShareJunseong_Janswered a year ago1These are external links and I haven't verified their steps, but I think this could help you. https://www.element7.io/2021/01/aws-ssm-session-manager-port-forwarding-to-rds-without-ssh/ https://www.linkedin.com/pulse/remote-port-forwarding-using-aws-ssm-session-manager-jaros%C5%82aw-grz%C4%85bel/?articleId=6704645407001120768 https://www.reddit.com/r/aws/comments/gh8cde/ssm_session_manager_portforwarding_to_rds_wout_ssh/You need a few extra configuration steps on the bastion host to be able to port forward to a destination outside of the instance.CommentSharemikeanswered a year ago"


Question: AWS SNS Delivery retry policy Total policy retry time cannot be greater than 3600 seconds

"I am trying the AWS SNS Delivery retry policy to have it retry every 1 hour for 10 hours.My setup is:Minimum Delay: 3599 seconds,Maximum Delay: 3600 secondsBut I am having an error that it says:Couldn't set topic delivery retry policy. Error code: InvalidParameter - Error message: An error occurred while setting the attribute delivery retry policy (http/s). Invalid parameter: DeliveryPolicy: http.defaultHealthyRetryPolicy: Total policy retry time cannot be greater than 3600 secondsI have tried making the values around 1500-3599 and making sure that the Minimum delay is lesser than the Maximum delay.It only works when the values are within 20-120 (or a few hundreds but definitely not 999)Anyone here who has been successful setting it up at every hour retry? ThanksFollowComment"


Question: Restoring RDS snapshot from an unsupported DB engine version

"Suppose a MySQL RDS instance was created with engine version 5.7.33 and a backup of it was taken today, with plans to retain the backup for seven years. After seven years, if AWS no longer supports version 5.7.33 and the user wants to restore the snapshot, can they do so? Additionally, will the data be recoverable even if the database engine version is no longer supported? Furthermore, if restoring from the snapshot is not possible, what are some alternative methods for storing backups of an RDS instance for long-term retention?FollowComment"

Answer: 0You might try Exporting DB snapshot data to Amazon S3.Or Using Amazon S3 as a target for AWS Database Migration ServiceOr mysqldumpCommentShareEXPERTkentradanswered 3 months ago


Question: AWS Opensearch 1.2.4 with Filebeats OSS

"Hi,Im trying to connect filebeat to AWS Opensearch, but keep hitting template issues. Filebeats errors with the following:Connection marked as failed because the onConnect callback failed: error loading template: could not load template. Elasticsearch returned: couldn't load template: 400 Bad Request: {"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters:  [_default_]If I manually export the template and load it into Opensearch I get the following:{"error":{"root_cause":[{"type":"x_content_parse_exception","reason":"[1:51] [index_template] unknown field [mappings]"}],"type":"x_content_parse_exception","reason":"[1:51] [index_template] unknown field [mappings]"},"status":400I would have assumed there is an out the box version of filebeat-oss that is compatible with Opensearch 1.2.4Any suggestions?ThanksFollowComment"

Answer: 1Resolved using the compatibility mode settingPUT /_cluster/settings{  "persistent" : {    "compatibility.override_main_response_version" : true  }}CommentSharerePost-User-4642679answered a year ago


Question: Preview not working

Always getting the same error message on top saying "You aren't authorized to access this service."Any document i upload says We can't find any textFollowComment

Answer: "0Can you verify that you are accessing this from either N. Virginia, Dublin or potentially Ohio and Oregon.  If you try to access Textract from a region outside of the one where you have been provided access, you will get that message. Currently you can only access Textract within one region and its different for each user.  Can you try each of these to determine which one will work for you?Also, what day did you receive the Welcome message? If you received it on 3/4 or 3/5 you may have received it in error.  If this is the case, then your real access will begin next Wednesday instead.  Please let us know.CommentSharehumphreyAWSanswered 4 years ago0It worked from ireland, thanksCommentShareawsfanaticanswered 4 years ago"