Question: How can I remove Free Tier Cloud Watch service?

"How can I remove Free Tier Cloud Watch service? I got email about it, but I am not able to terminate. Please help.FollowComment"

Answer: "0Which CloudWatch service do you use?In the case of alarms and logs, deleting them will no longer incur charges.If you are using metrics, you will not be charged if you do not send data.For details, please see the fee schedule below.https://aws.amazon.com/cloudwatch/pricing/?nc1=h_lsIf there are any charges, you can use the following documentation methods to figure out which service is causing the problem.https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_billing.htmlIf this answer leads to a resolution, please approve the answer for the betterment of the community.CommentShareEXPERTRiku_Kobayashianswered a month agoEXPERTskinsmanreviewed a month ago0I understand that it is not incurring any charges as of yet. But I do not want to have CloudWatch at all under my billing console. How can I remove the metric altogether as I do not use it at all?Thanks,ReetCommentSharerePost-User-1038053answered a month ago"


Question: Amplify ElasticSearch Domain stuck in "Upgrading" state

"Hi, my group has an ElasticSearch domain (created via Amplify) that has been stuck in the "Upgrading" state for about 3 days. I ran the "Pre-Upgrade Check from 6.2 to 6.8" tool and it has never completed. It just says "In progress (33.33%)" It seems like all of the options are disabled until the upgrade is complete so I guess we're stuck for now?Anyone know how to resolve this?Version: Elasticsearch 6.2Service software version: R20211203-P2t2.medium.elasticsearchFollowComment"

Answer: "0Hi , hope this situation has been resolved by now.for the next time , or otherwise if you still have the issue. This is a case in which AWS Support should be able to help you, because no general answer may apply and something contextual to your account might be causing the issue.Your best next steps would be to open a Support case, in case you have not yet a Support subscription, consider to upgrade to Developer Support or Business support depending on the urgency of your case.Without looking at the internal logs or having more detailed information on the situation it is not possible to provide guidance, sorry.Alternatively, Please make sure you follow the best practices recommended by the Amazon open search to protect your cluster from getting in stuck state in future.Best Practices: https://docs.aws.amazon.com/opensearch-service/latest/developerguide/bp.htmlHope this helpsCommentShareSUPPORT ENGINEERVarun_Sanswered a year ago"


Question: "For AWS Marketplace publication, can an SaaS products collect user's email"

"For AWS Marketplace publication, can an SaaS product collect user's email for the purpose of verifying their account?In our service, users provide a username and email to sign up. They then receive an email with a link to change their password. In future sign-in, they use only their username and password. Their password and email are securely stored in an AWS Cognito user pool.FollowComment"

Answer: "0Yes, you as a SaaS seller can collect email information when the buyer is redirected to your SaaS application.More info on SaaS policy here: https://docs.aws.amazon.com/marketplace/latest/userguide/saas-guidelines.html#saas-customer-informationCommentShareAWS-User-5890248answered 2 years ago0Yes, it depend of your request. If you want user emails for sent some information regarding used service then collect it.CommentShareMunsiradoanswered 2 years ago0Yes. When creating your SaaS product listing, you provide a URL to your registration landing page. We use that URL to redirect customers to your registration landing page after they subscribe. On your software's registration landing page, you collect whatever information is required to create an account for the customer. We recommend collecting your customer’s email addresses if you plan to contact them through email for usage notifications.https://docs.aws.amazon.com/marketplace/latest/userguide/saas-product-customer-setup.htmlCommentShareAiwen_Wanswered 3 months ago"


Question: Cannot create API Gateway v2 in multiple regions with Route 53 latency-based routing

"I want to create a global service comprised of API Gateway v2 (a.k.a. HTTP APIs) in multiple AWS regions with Route 53 latency-based routing handling traffic distribution for clients around the world. This will require each of the HTTP APIs to have the same custom domain configured. The HTTP APIs are configured as regional APIs.However, when I attempt to configure the custom domain in a second region, I'm presented with this error:Error: error creating API Gateway v2 domain name (redacted-my-domain-name.com): BadRequestException: The domain name you provided already exists.This architecture works as expected if I use API Gateway v1 (a.k.a. REST APIs). Thus, I think this is a regression in v2.Is this supposed to work?FollowCommentrcrowley 9 months agoFurther experimentation shows that I can produce this same error by attempting to create the same custom domain in a second AWS account in the same region.Share"


Question: My costs with Cloudwatch increases 10x

In April my Cloudwatch costs catapultated 10x and I don't know why. There some alart messages for 4xx and 5xx erros but I can't find nothing like that on my websiteFollowComment

Answer: "0Hello, I recommend reviewing this article here on re:Post.https://repost.aws/knowledge-center/cloudwatch-understand-and-reduce-chargesCommentShareDavidanswered 14 days ago0Check you bill, there will be detailed info about CloudWatch costs.CommentSharemyronix88answered 13 days ago"


Question: force auto scaling group to scale in by terminating k8s pods ungracefully

"When I perform a scale in task, it's very common that some k8s pods got stuck at terminating stage forever. As a result, the instance would also got stuck at terminating:wait state. Is there a way to force auto-scaling-group to scale down the instances by ungracefully shutting down all pods on the instance after a given period?FollowComment"

Answer: 0close this as a duplicate to the other oneCommentSharezinananswered 2 years ago


Question: Transferred to phone numbers call recording in Amazon Connect

How to record the calls transferred to the external phone numbers from Amazon Connect contact flow?FollowComment

Answer: 0Amazon Connect only records calls when connected to an Agent.You can find more information about the recording behaviour in the Admin GuideCommentSharefaddianswered a year ago


Question: Is there an API for the Amazon Linux Security Center (alas.aws.amazon.com)?

"I would like to pull CVSS scoring info for particular CVEs from alas.aws.amazon.com. I see endpoints like https://alas.aws.amazon.com/cve/html/CVE-2023-25751.html, and am wondering if a /json or /xml or similar endpoint exists. I've searched documentation, tried calling those directly, and looked through network traffic but don't see any requests that indicate those exist. Is there an API for this site (or another resource I'm not aware of), or do I need to parse the HTML to get that CVSS data?FollowComment"

Answer: "1alas.aws.amazon.com does not provide an official API for accessing CVSS scoring information for CVEs in JSON, XML, or other structured formats. However, there are alternative sources you can use to obtain CVSS scores for specific CVEs.One option is to use the National Vulnerability Database (NVD) API, which is maintained by the U.S. government. The NVD API provides CVSS scores and other vulnerability information in JSON format. You can query the NVD API for a specific CVE like this:https://services.nvd.nist.gov/rest/json/cve/1.0/CVE-2023-25751CommentShareEXPERTsdtslmnanswered 2 months ago1Hello,Greetings of the day!! Thank you for contacting AWS.I understand that you wish to know if there are any APIs you can use to retrieve CVSS scoring info for particular CVEs from alas.aws.amazon.com. in the form of JSON, XML.To answer your query, unfortunately there are no APIs that you can use to gather data from the ALAS website. The APIs that AWS provides are specific to services which are used for management and data plane operations specific to your AWS Account. You would have to use conventional tools such as scrapers to gather information from publicly hosted websites.For more information regarding deploying a Server-less Architecture for a Web Scraping Solution on AWS, kindly refer the [document](https://aws.amazon.com/blogs/architecture/serverless-architecture-for-a-web-scraping-solution/)Hope the above information has been helpful.Thank you and Wish you a good day ahead!CommentShareSUPPORT ENGINEERAditi_Banswered 2 months ago"


Question: Get input from agent before placing an outbound call

"I need some way to prompt the agent through the Contact Control Panel before they place an outbound call. Is there anyway that I could extend the CCP or provide an UI for the agent to input information prior to making an outbound call? I have looked into creating tasks in the call flow but I did not find anyway that we could provide a UI using tasks in the call flow. I also looked into the amazon connect stream api, while this does allow us to create an UI for the agent. I did not find a way to use it to inside the CCP itself.FollowComment"

Answer: "0I'm not sure I follow what you're asking. Do you need the agent to enter some DTMF or are you asking them to fill out some form? Assuming it's the form, you could create a form with then launches the CCP to place the outbound calll, but this isn't really a Connect issue, but more of something which should be done in your CRM or similar software.CommentSharedmaciasanswered a year ago0The CCP is not customizable in anyway. You need to use the Streams API to do any customisation of an agent softphone.With the Streams API you embed the CCP. You can then either hide the CCP to make a fully custom softphone or show it and use that for the normal softphone functions. If you show the CCP it is still not possible to alter anything within its frame.CommentShareledgeanswered a year ago"


Question: Is running Fargate and API Gateway without a load balancer in the production environment a bad idea?

"I'm looking at a few articles where the author describes how to route traffic from an AWS API Gateway to Fargate tasks without any load balancing.https://medium.com/@chetlo/ecs-fargate-docker-container-securely-hosted-behind-api-gateway-using-terraform-10d4963b65a3https://medium.com/@toddrosner/ecs-service-discovery-1366b8a75ad6The solution appear to rely on AWS Service Discovery which, from what I can tell, creates private DNS records.If my ECS services starts 3 Fargate tasks, is API Gateway smart enough to spread the traffic across all the 3 tasks or not?FollowCommentvitaly_il 12 days agoHi,I'm thinking about the same choice - leave ALB between API Gateway and ECS Fargate tasks, or try AWS Service Discovery. I'm curious if you have some insights here.Share"

Answer: "0No, AWS API Gateway does not automatically spread traffic across multiple Fargate tasks. It only routes traffic to one target. To distribute traffic across multiple tasks, you need to use a load balancer, such as an Application Load Balancer or a Network Load Balancer, in front of the tasks.CommentShareDivyam Chauhananswered 4 months ago0Running Fargate and API Gateway without a load balancer in a production environment can have potential drawbacks and risks. Without a load balancer, your service may not have automatic failover, scaling, or management of incoming traffic. It can also increase the risk of downtime and decreased performance during traffic spikes. It is recommended to use a load balancer in a production environment to ensure high availability, scalability, and to offload the management of incoming traffic.CommentShareMuhammad Imrananswered 4 months ago"


Question: How long does it takes to get answer from AWS to my support case?

"Hi, i need to exit from sandbox in AWS SES, i wrote in support case additional information and then several times clicked on "resolve case" and "reopen case". and i think aws can answer for my cases longer. What should i do, i clicked "reopen case" one more time, but message is still hangs and I don't know what to do, when to wait for an answer.Message:More information needed for your production access requestIn order for Amazon SES to continue with this request, some additional information on your email sending is required. We have created a support case for a member of our team to work directly with you."FollowComment"

Answer: "0Hi there,Our Support team provides an initial response to your request within 24 hours. Per our Documentation:In order to prevent our systems from being used to send unsolicited or malicious content, we have to consider each request carefully. If we're able to do so, we'll grant your request within this 24-hour period. However, if we need to obtain additional information from you, it might take longer to resolve your request. We might not be able to grant your request if your use case doesn't align with our policies.You can read more information about moving out of our SES sandbox here:https://docs.aws.amazon.com/ses/latest/dg/request-production-access.htmlOur Support team will respond to your request in the order received. To prevent delays, please refrain from changing the status of your case, which should stay as "reopened" if you're seeking additional assistance and a response from our Support team.The following page has further details on updating, resolving, and reopening your case:https://docs.aws.amazon.com/awssupport/latest/user/monitoring-your-case.htmlThank you for your patience as we work to assist you. Continue to monitor our Support Center for an update:http://go.aws/support-centerBest regards,- Kita B.CommentShareEXPERTAWS Support - Kitaanswered 6 months ago"


Question: Are AWS certifications actually useful to a younger student?

"Currently, studying for the SAA-CO2 (soon to be SAA-CO3) Certified Solutions Architect - Associate exam. I am going into my final year of secondary school. I am wondering how beneficial it will be for me to achieve the certification. I would be pretty much unable to apply for a job in the Tech industry yet due to my very limited experience, lack of a degree (university), and age. By the time I finish university and "enter the world of work", the certification will have expired and it will need resitting to obtain the certification again. Is it worth continuing to work towards the certification? If so, how would it be useful to me...FollowComment"

Answer: "1Even though there may not appear to be any tangible benefit in getting certified at secondary schooling level, at times one things leads to another and having smaller incremental wins over time can lead to something big down the road. At the very least, it gives you confidence that your required knowledge is sufficient for you to be able to pass the SAA. I did my SAA about 4 or so years ago and back then I was a Software developer (relatively new to Cloud), fast forward to present time I started at AWS two weeks back. As a rule of thumb, I have always kept an open mind towards any form of learning opportunity and at times the learning opportunity leads to tangible benefits while on other occasions it helps me broaden my learning horizonCommentSharePiyushMattooanswered 10 months ago1Where do you see yourself after graduating ? I believe the answer lies in the same. Why are you doing the certification ? Is it to get the benefits of the knowledge of services or to have a certificate tag on your resume.If its the latter, I would say, do it once you graduate, however if you want to know the services and how they work to get a different perspective towards the cloud, it is quiet helpful as a level 1 certification.Hope this helps !!CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months ago0I think it's true to say that for the most part, it may not be immediately beneficial to you, at least directly. However, in the future, it will show potential employers that you were willing to go the extra mile over and above the academic qualifications that school prepares you for, and over your contemporaries.It also shows that you have the initiative to learn more than "just" the school curriculum, and a mindset that is geared towards industry from an early age. You're also laying the first foundational blocks of what will be many qualifications you'll attain over your career, and incrementally, each of those will add to your capabilities and therefore net worth.I'm not criticising academic qualifications, but they are often less well orientated towards the practicalities of a job, as by their nature they focus on the fundamentals and foundations needed to be successful, rather than being focussed on specific technology stacks, and the specialisation that inevitably ensues when you take your career down a path narrower and more specialised than that which school prepares you for. As an aside, 30+ years ago, I nearly gave up on my degree in Computer Science after working for a big global employer for a year in my third year, as I enjoyed it way more than the theory. But the theoretical work was important and has paid me back over the years, even though much of my curriculum is no longer useful in the workplace (COBOL, Fortran, 1970's AI), as has the qualification I attained, even though I couldn't see the practical use for much of it at the time. And all of my qualifications since then have opened doors for me too.Personally, I also think it will hold you in good stead as your career grows. In 10,20, 30 years even, you will also be able to look back and know that you achieved an industry qualification that would usually be taken by someone 5 or 10 years+ older when you were still in your teens. Not many people do that, it's unusual, in a really good, positive way. That alone will not only give you a head start when you enter the workplace, as it demonstrates a capability and a willingness to learn. It will stand out on your CV, even though the qualification will have expired by then.It will also give you the personal confidence to tackle things that others may find intimidating. It will help you to foster a mindset of life long learning. Few people actively like exams, but lowering the anxiety around them by taking an industry qualification at a young age may lower your reticence to take exams as you get older, something which many adults find daunting, even in their 20s. Desensitising yourself now to that future anxiety, by your own choice, is effectively removing what for some is a huge barrier to their career as you get older.  It encourages an "I can achieve anything I set my mind to" mentality.It's a phrase that sounds a bit of a cliche, but learning doesn't stop with school college or university - they are merely the spring boards to the rest of your career, where you can learn more, specialise and see the bigger picture as a result of continuous learning. I've worked in various areas over the years - development, databases (development and operations), business intelligence, machine learning - and I learn new things every single day, 30+ years on from the start of my career. Not everyone takes that path, as having to learn new things is sometimes viewed as uncomfortable, or taking oneself out of one's comfort zone. Fear of failure is another "adult" trait, which is perhaps reinforced by not trying new things, not having a go at qualifications which might be easily attained.I know numerous, perfectly capable adults of my own age, who don't try new things because they assume they'll fail. That's not something that suddenly happens, it's a mentality that incrementally grows over years of being afraid of taking an exam for fear of failure. The sooner you bop down that fear with a big rubber mallet, the better for yourself !Trying something new, learning new skills, taking exams to test your skills, is the way you grow, learn, get to do new exciting things that might have otherwise have proved impossible. It keeps life and your career interesting and fresh, which in turn keeps your motivation levels high. That's important when you're working for 40+ years, every day needs to be interesting !The only caveat I'd give is if taking the certification is either going to get in the way of your other studies, or cause you financial hardship or unwelcome stress.But if neither of those are issues, I'd encourage anyone with the interest you have at your age to have a go at it, and get the certification as soon as you feel you're ready to take the exam, as my own experiences inform me that it's a positive thing to do and will  give you a foundation for learning that you'll not regret in later life. Start now, and never stop learning.From me, it's a definite "Go for it" - what do you have to lose?  :-)CommentShareJon Ranswered 9 months ago"


Question: Certificate Renewal

"Hi AWS Community,I got the below shown message from AWS and I would like to use Emailvalidation as I have no clue how the DNS stuff works.The problem is, that I do not have access to the emailsaddresses that the validation emails are sent to (admin@goalplay.com, administrator@goalplay.com, hostmaster@goalplay.com, postmaster@goalplay.com, webmaster@goalplay.com).Does anyone know how I could solve this?It would be of great help.Best regards,MoritzGreetings from Amazon Web Services,You have an AWS Certificate Manager (ACM) SSL/TLS certificate in your AWS account that expires on Sep 02, 2022 at 23:59:59 UTC. That certificate includes the primary domain media.goalplay.com and a total of 1 domains.Certificate identifier: arn:aws:acm:us-east-1:405738972658:certificate/7de2bece-a0d8-4e00-b387-e5e4e781fafeACM was unable to automatically renew your certificate. The domain validation method for this certificate is email validation. This method requires the domain owner or someone authorized by the domain owner to take one of the following actions before Sep 02, 2022 at 23:59:59 UTC. If no action is taken, the certificate will expire, which might cause your website or application to become unreachable.If you can write records into your DNS configuration, you can replace all of your existing email-validated certificates with DNS-validated certificates. After you add a CNAME record to your DNS configuration, ACM can automatically renew your certificate as long as the record remains in place. You can learn more about DNS validation in the ACM User Guide.[1]If you want to continue using email validation to renew this certificate, the domain owners must use the approval link that was sent in a separate validation request email. The validation email is valid for 3 days. ACM customers can resend the validation email after receiving the first notification or any time up until 3 days after the certificate expires. For more information on how to resend a validation email, refer to the ACM User Guide.[2]FollowComment"

Answer: "1In case you don't have access to listed emails, you can try option #1 - Adding CNAME entry in DNS (goalplay.com) - if you are using Route53 for your DNS hosting then you will need Route53 access, else your respective DNS hosting provider login.CommentShareAshish_Panswered 9 months ago"


Question: Cloud9 || PHP version

"Hello there,How can I update PHP to 7.4 version or upper?FollowComment"

Answer: "1sudo yum -y remove php*sudo amazon-linux-extras | grep phpsudo amazon-linux-extras disable php7.2sudo amazon-linux-extras disable lamp-mariadb10.2-php7.2sudo amazon-linux-extras install -y php8.0[Courtesy: I got these commands from https://greggborodaty.com/amazon-linux-2-upgrading-from-php-7-2-to-php-7-4/]CommentShareEXPERTIndranil Banerjee AWSanswered a year agoIndranil Banerjee AWS EXPERTa year ago@rePost-User-9011840 - If this solved your issue, can you please accept my answer? ThanksShare"


Question: Is there a documentation where I can see consolidated list of all metrics of all services that can be fetched from cloudwatch?

"Something like what's there for Azure - https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/metrics-supportedI have searched & closest documents I got were again having links to bunch of other pages! This at best are making referring to these simple details more convoluted & obviously time consuming... Also, referring them offline is a challenge!All I need is list of services, metric names, unit, aggregation methods supported & description of metric in a standard format.FollowComment"

Answer: "2There is no single page on AWS that contains all the possible metrics from every AWS service. The closest thing is probably AWS services that publish CloudWatch metrics which contains a list of all the services that integrate with CloudWatch metrics and a list to their documentation. I noticed that some of those links are actually broken too, which is not a good look.I'm speculating here, but there is probably no such list because of how AWS is organized internally. The CloudWatch team probably hasn't made available a way for all the other service teams to publish their metrics centrally. Conway's Law sums it up nicely:"Any organization that designs a system (defined broadly) will produce a design whose structure is a copy of the organization's communication structure."Until such a page exists, you'll be stuck reviewing each service's metrics in isolation I'm afraid.CommentShareEXPERTbwhaleyanswered 7 months agoEXPERTChris_Greviewed 7 months agoVinay B K 7 months agoThanks for your reply. Much appreciated!I tried to download PDF from the link that you have shared hoping that it might have some consolidated list. It has that, but spread across so much that it's hardly usable.Keeping this thread alive for some more time, just in case... Thanks!ShareChris_G EXPERT7 months agoUnfortunately there is no consolidated list because each service team maintains their own lists of CloudWatch metrics.   On the link that was posted here, you can go to each of the service's specific metrics pages to build a consolidated list.Share"


Question: AWS EC2 Issue Image selection when Launching an Instance from Template

"In AWS EC2 when Launching an Instance from Template the search of the images does not find the image I want as well as the search in the Images page, I have to delete a chunk of the image name for it to find it, which takes up more time than it should and triggers me deeply.Have the AWS naughty devs caused this pain to somebody else?Any leads on how to fix it, who else we can ask or who else's communication platforms we can slap?Thanks!FollowComment"

Answer: "1One thing you can try is to search for the image using a different keyword or phrase. Alternatively, you could try using filters to narrow down your search results. For example, you could filter by the operating system, architecture, or storage type.If these options don't work, I would recommend reaching out to AWS support to report the issue and ask for assistance. You can do this through the AWS Management Console by clicking on the "Support" link in the top right corner of the screen. Alternatively, you can submit a support request through the AWS Support Centre.CommentShareAWS_Guyanswered 2 months ago"


Question: Deploy artifact from AzureDevops to AWS ECS or ECR

"Hi team,Please kindly read carefully the question before answering Thank you :)I previously asked this question, but the responses I received were not relevant.I followed this blog,to use IAM role anywhere to consume AWS services, I was able to do AWS API calls from my machine via CLI and credential helper.But my concrete use case is to deploy from an Azure DevOps instance to ASEA AWS account: for example, deploy from an Azure DevOps to AWS ECS.I'm unsure how to use this concept of an IAM role anywhere to deploy from Azure DevOps to AWS ECS.can anyone help me with links or blogs on how can I implement this use case and integrate Azure With AWS IAM role anywhere or if there is any other way to do it?==> Deploy an artifact from Azure DevOps instance to Amazon ECS fargate. Or at least push from Azure to AWS ECRis this the only way to do (IAM role anywhere) to deploy an artifact from Azure DevOps to ECS or ECR or I can use classic IAM role?if I use the concept of IAM role anywhere, where can I install the certificate and the private key inside Azure?azure Pipeline => produce artifact => deploy it to ECS or ECR without using long-term credentialswhat are the steps to do in Azure side so that the Pipeline Azure can push to AWS?Please I know how the IAM role anywhere  works and I already configured it in my AWS account, my question here is not about IAM role anywhere,it's about how can Azure DevOps Pipeline push an artifact to ECS or ECR and what are the steps to do on Azure side?once I have the certificate and the private key where i should install them at Azure level ...?thank you so much!appreciate your HelpThank you!FollowComment"

Answer: "1Hello Jess,I am assuming that you have already looked at the following ways described in this documentation using which you can connect to AWS services from your Azure environment. I am also assuming, none of the above methods suits your objective and hence you are looking at using IAM Roles Anywhere.Disclaimer: I haven't used Azure DevOps pipelines much, and I haven't yet executed all the steps below in my Azure account. Please treat the below steps for your PoC purposes only.Setup the IAM Roles anywhere in your AWS environment based on your requirement and have the certificate and private key ready to be used.Store the certificate and private key from previous step in your Azure Key Vault.In your pipeline step, have the necessary cli's available like aws and aws_signing_helper.In your pipeline step, download the certificate and private key from Azure Key Vault, you might have to write one line code to separate the certificate and private key as per this link.Execute aws_signing_helper cli to get the temporary credentials.Parse the output from the last command using which you can access AWS services as per your role definition.Cleanup the certificate and private key.Please let me know how this works for you. Please also consider any additional security measure so that you are handling the keys in the most secure manner.CommentShareManish Joshianswered 4 days agoJess 4 days agoThank you for the clarification!!Please if I want to use the classic IAM role rolewhat should the IAM role trust policy looks like (Principal section) (I don't have the right to create an IAM user in my AWS account)how can I get credentials form this assumed role in my Azure DevOps Pipeline => using the command line PowerShell?Thank youShare1Hello there,thank you for reaching out.I understand guidance is required to deploy artifacts from Azure DevOps to ECR or all the way to ECS fargate. You had previously explored the use of IAM roles anywhere as a method to have temporary credentials when accessing AWS services from your tasks in Azure.I just want to specify that I do not have much expertise on Azure DevOps as all of the services I work on are AWS services. I did however take the time to dive deeper into this to see if I can be able to share documents that can help in this endeavor.What is necessary to be able to connect with some AWS service from Aure DevOps is the AWS Toolkit for Azure DevOps, it is an addon that can be added for use in Azure DevOps : https://marketplace.visualstudio.com/items?itemName=AmazonWebServices.aws-vsts-toolsThe following are some resources that can help with what you are trying to achieve:1.This AWS workshop gives steps guided by short videos on how to achieve this. I hope this is helpful.https://catalog.us-east-1.prod.workshops.aws/workshops/8a64fbe8-3bbe-4ed9-9868-290c9bb560fe/en-US/700integrate-aws-fargate-with-azure-devopsHere you can see how to create a CI/CD pipeline to deploy containers to a container cluster.You can see how to integrate AWS Fargate with Azure DevOps here.2.This is a slightly more concise article that can be considered but covers only up to pushing to ECR.https://cj-hewett.medium.com/azure-devops-pipelines-build-and-push-a-docker-image-to-aws-ecr-bc0d35f8f126Both solutions involve the use of a AWS service connection in you AzureDevOps environmment. this mostly relies on having an IAM user with the necessary permissions, in this case for ECR or ECS. The use of role can be explored as an alternative to using an IAM role, whether as a classic IAM role, or IAM role anywhere.I hope this this information, especially the workshop is helpful and can provide the much needed guidance on how this can be done.Thanks :)CommentShareBohlale_Manswered 4 days ago"


Question: How would one install Peertube here?

"Anyone ever tried? (Oh, and, I had no idea what tags to use...)FollowComment"


Question: Retrieving current state of device shadow on first subscribe

"Hi, in experimenting with the classic device shadow I have found I can publish to topics like $aws/things/DEVICE_NAME/shadow/update and correctly see the updates as expected if I first subscribed to topics like .../shadow/update/delta or ../shadow/update/documents topics, but I have not been able to figure out how to see the already existing document at the moment I call subscribe. I tried subscribing to a number of different topics but in app code and simply in the MQTT test client but none of the subscriptions return any data until a subsequent publish is done.Is there something obvious I am missing? Or is there maybe a different method to get the already existing data of the device shadow at the time of subscription? Thanks.FollowComment"

Answer: "1Hi,Thanks for reaching out. I understand that you would like to retrieve the existing shadow document of  a thing. This is certainly possible but I would like to confirm that a subsequent publish is required to get the existing shadow document. This is discussed here in our documentationFirst, there would be a need to subscribe to the topics ShadowTopicPrefix/get/accepted and ShadowTopicPrefix/get/rejected as this is where the shadow document will be sent(or if the shadow cannot be retrieved).Once subscribed to the above topics, there would be a need to publish an empty message to the ShadowTopicPrefix/get topic. The current shadow will then be returned to the ShadowTopicPrefix/get/accepted topic.I've just tried this out and it does work as expected. I recommend trying it out in the MQTT test client in the AWS IoT console first. There is currently no topic which will return the existing shadow after subscribing without any subsequent publish.An alternative to the above method would be using GetThingShadow API -> https://docs.aws.amazon.com/iot/latest/apireference/API_iotdata_GetThingShadow.html. You can see the SDK equivalent of this API at the bottom of the documentation, for example, here is the link for the python boto3 SDKI would recommend the first method since you are already using MQTT to communicate with IoT but just letting you know that the second method exists as well.Please let us know if you may have any other questions.CommentShareSUPPORT ENGINEERRyan_Aanswered a year agosamvimes a year agoThanks a lot! I figured I might need to publish an empty one when just doing a subscribe but hoped maybe a missed something. Is there an equivalent react-native javascript library that calls GetThingShadow or do you recommend possibly making the API call directly when the app starts?Also just curious what the difference between publishing to and subscribing to the /get and /get/accepted topics vs /update and /updated/acceptedShareRyan_A SUPPORT ENGINEERa year agoHi,Thanks for your response. I checked our docs and we have documentation on how you can use the Javascript SDK in React Native -> https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/getting-started-react-native.html.A publish to the /update topic means that you are trying to update the shadow document. If there is a corresponding message to the /updated/accepted this means that the update has been accepted -> https://docs.aws.amazon.com/iot/latest/developerguide/device-shadow-mqtt.html#update-pub-sub-topicOn the other hand, publishing an empty message to /get only retrieves the current shadow without any updates. As mentioned earlier, the current shadow state will be published to the /get/accepted topic.Hope this helps! Let us know if anything is unclear.Share"


Question: prepare() server internal error when using TTL

"** <b>AWS Update:</b> Keyspaces now supports TTL: https://aws.amazon.com/blogs/database/announcing-amazon-keyspaces-time-to-live-ttl-general-availability/ **I am seeing an internal error returrned from key space when I try to prepare the following statement.createAccessToken = getSession().prepare(  "INSERT INTO access_tokens" + "(atokenid, atoken, useruuid, auth, clientid, expiration, time, code, version)"  + "VALUES (?,?,?,?,?, ?,?,?,?) IF NOT EXISTS USING TTL ?;");  The issue appears to be with the USING TTL ? since the following prepare doesn't exhibit the issue.createAccessToken = getSession().prepare("INSERT INTO access_tokens" + "(atokenid, useruuid, atoken, auth, clientid, code, expiration, time, version)"+ "VALUES (?,?,?,?,?, ?,?,?,?) USING TTL 200;");Anybody know of a work around that doesn't have me hard code the ttl?Edited by: ArturoAtAWS on Oct 18, 2021 3:03 PMFollowComment"

Answer: 0Seems the issue is moot since Keyspaces doesn't support ttl.CommentSharePaulCurtisanswered 3 years ago0Thanks for the question and info! Our roadmap is driven by customer feedback so it's super helpful to get more info on how you are using prepared statements with TTL.CommentShareAWS-User-6425534answered 3 years ago0Launched: https://aws.amazon.com/blogs/database/announcing-amazon-keyspaces-time-to-live-ttl-general-availability/CommentShareAWS-User-6425534answered 2 years ago


Question: Glue job failing with Null Pointer Exception when writing df

"Running a job to fetch data from S3 and write to GCP BQ using Glue BQ connector by AWS.Everything else is fine, but for one table the second runs seems to fail always with below error.First time it runs fine, I have bookmarks enabled to fetch new data added in S3 and write to BQ.It fails with below error on write function.Unable to understand the null pointer exception thrown.Caused by: java.lang.NullPointerExceptionat com.google.cloud.bigquery.connector.common.BigQueryClient.loadDataIntoTable(BigQueryClient.java:532)at com.google.cloud.spark.bigquery.BigQueryWriteHelper.loadDataToBigQuery(BigQueryWriteHelper.scala:87)at com.google.cloud.spark.bigquery.BigQueryWriteHelper.writeDataFrameToBigQuery(BigQueryWriteHelper.scala:66)... 42 moreFollowComment"

Answer: "0Hi,if you have bookmark enabled, are you sure you have new data in S3 for the second run?If not the read step will create an empty dataframe that might cause the write to BigQuery to fail.Currently you might want to implement a try/catch or conditional logic to test if the dataframe you read has data and writes to bigquery only if true otherwise only log a message that there is no available input at the moment.Hope this helps,CommentShareEXPERTFabrizio@AWSanswered a year agoAWS-User-2896664 a year agoYes, more data is present in S3, I have printed the data and checked just before writing, but still it is throwing this error. I thought maybe something around nullability of the columns, but have fixed that too, by setting the nullable property of source to True same as target , but still the same error.I am clueless now!Share"


Question: Question about tech specs for Graviton 2

"Hello,I have been able to find most of the technical specifications for Graviton 2, but I'm missing one piece of data. Does anyone know how many double-precision operations per second per cycle are they capable of performing?Thanks.Edited by: afernandezody on Mar 29, 2020 6:35 PMFollowComment"

Answer: "0Each core can theoretically do 20GFLOPs of double precision math when using fused-multiply-adds.CommentShareAli_Sanswered 3 years ago0Hello,I am not really sure how you came up with that specific figure. If I assume a frequency of 2.9 GHz, it yields a bit less than 7 (double-precision) FLOPs per cycle. A value of 8 could be expected so my guess is that other limitations decrease the theoretical maximum value per core.Thanks.Edited by: afernandezody on May 13, 2020 6:38 PMCommentShareafodyanswered 3 years ago0The cores each run at 2.5GHz. and can do 4 dual precision multiply accumulates/cycle.CommentShareAli_Sanswered 3 years ago0Not sure why (maybe I read it somewhere) I thought that they run at 2.9 GHz even though the console lists them at 2.5 GHz. Thanks.CommentShareafodyanswered 3 years ago"


Question: Update Records with AWS Glue

"I have two S3 buckets with data tables, namely A and B, and a Glue job, that transforms data from A to B. Both tables contain a column called x. The Glue job performs a GroupBy operation on this column x, which results in transforming all other columns from table A into list type columns for table B. I activate the bookmarking mechanism for the Glue job, so that it processes only new data. That requires, that I also read in inputs from table B (which are outputs of the previous run of the Glue job) in this job and append new items to the list type columns in case a record with a specific value for column x already exists. It is unclear for me how I could update the table B when saving outputs of the Glue job and avoid duplicated values of column x. Does anybody have a hint here? Thanks!FollowComment"

Answer: 0Seems like you are reading Source A table and combining that with processed table B. In that case I would say simple overwrite the result in B and combine Table A and B all the time in glue job.CommentShareZahidanswered a year agoThomas Mueller a year agoIn that case I would have to process the entire table B all the time in order not to loose any records (e.g. that are not in the currently processed batch due to bookmarking). For large tables B that does not sound very efficient to me.Share


Question: "The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access (Query Id: b2c74c7e-21ed-4375-8712-cd1579eab9a7)"

"I tried to set up an cross-account Athena access. I could see the database in Lake formation, Glue and Athena under target account. At the beginning I don't see any tables in the target Athena console. After I did something in Lake formation console (target account) I could see a table in target Athena console and query it successfully. But I could not see other tables from the same database even I tried many ways. I always got below error even I  the gave the KMS access everywhere (both KMS and IAM role) or turn off the kms encryption in Glue. I don't know what is the actual reason.Below is an example of the error message:The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access. (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException; Request ID: cb9a754f-fc1c-414d-b526-c43fa96d3c13; Proxy: null) (Service: AWSGlue; Status Code: 400; Error Code: GlueEncryptionException; Request ID: 0c785fdf-e3f7-45b2-9857-e6deddecd6f9; Proxy: null)This query ran against the "xxx_lakehouse" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: b2c74c7e-21ed-4375-8712-cd1579eab9a7.I have already added the permissions pointed out in https://repost.aws/knowledge-center/cross-account-access-denied-error-s3?Does anyone know how to fix the error and see the cross-account tables in Athena? Thank you very much.FollowComment"

Answer: "0Accepted AnswerHii,Have you created the relevant resource links in your Lakeformation console of your target account? If not  yet done then, please follow the given documentation and set up the shared tables in your target account.In case, both the source s3 bucket and the source table in Glue are encrypted with different KMS keys then permissions must be given to both of the keys. If both belong to different account then you will have to provide both the resource based and Identity based permissions.In my experience, the error you are seeing arises when the Key policy of the KMS key is not properly defined such that it allows cross account access of the key. Thus, please verify it once.It might be better if you reach out to a Premium Support engineer of Security team as they will be able to have a look at your policies and find out the exact root cause of the error.CommentShareSUPPORT ENGINEERChaituanswered 2 months agorePost-User-2681778 2 months agoHi Chaitu, sorry for the late response. I did create the resource links and the key policy was also correctly defined. But it was caused by the KMS key issue because originally my s3 buckets were encrypted with S3-SSE (which does not support cross-account access) and I switched to KMS encryption after I grant the cross account access through lake formation. I finally destroyed the infrastructure and redeployed everything worked. I felt that I should change S3 encryption from S3-SSE to KMS encryption before I implemented the cross-account access.  Thank you very much.Share"


Question: Synchronized data and backup

I'm need to backup and synchronized customer data and controlWhich AWS backup can do itFollowComment


Question: Should I keep all of my business logic in layers in AWS lamda functions service?

"I am designing an application and I really haven't worked with lamda earlier. Currently I have service repository pattern implemented and I am running my application in an express http server.Current design pattern -Model - Sequelize models to call the db methods onRepository layer - Communication with the Database through modelsService layer - calls to repository layer and implementation of business logicController layer - Call service layer functions and send json responseNow I want to migrate to AWS lambda functions. I came accross usage of layers in lambda to share the code accross all the functions.Is it good design to put all my repositories, services and models in layers and only instantiate related classes and then invoke the functions from the lambdas ?( So lambdas will work like controllers in my current design)Or should I move my entire business logic to lambda functions? The question is due to a blog that I read where I got to know that with every new deployment of layers I'll have to redeploy all the lambdas.Please help!FollowComment"

Answer: "2Accepted AnswerAlthough both can work, my recommendation would be to place all your code into the Lambda function. One of the factors that affects cold start time is package size. The package size incudes all the layers. By having all the code in a layer and including it in all functions, you pay extra cold start times for all functions. You should create smaller functions that each includes only what they need. Also, if you make a change to the business logic in one component, you will need to update all functions, which just adds to complexity.You should use layers for things like common 3rd party libraries that you need to use across all functions. Things like monitoring.CommentShareEXPERTUrianswered 7 months agotejas 7 months agoThank you for the help. I am seeing how over using the layers can cause problems in the production in the future. I am going to have repositories and 3rd party utility functions in layers and business logic in lambda functions.Share1Also would like to add that by default you're limited to five layers per lambda. So if you have a sizeable app (i.e. more than a couple models) you likely won't be able to attach everything you would need to the lambdas that need to do the processing.https://docs.aws.amazon.com/lambda/latest/dg/invocation-layers.htmlCommentSharetherealdakotalanswered 7 months ago"


Question: amazon connect restoring phone number

"i accedently deleted mu amazon connect instance, and i need to restore the did phone number or claim a new one?!FollowComment"

Answer: "1Accepted AnswerHello ,Thank you for posting your question on the AWS repost, my name is Rochak and it will be a pleasure assisting you with this today.I understand you accidentally deleted your Amazon connect instance and you would like to restore the phone number associated with it. Please, let me know if my understanding is incorrect.Please kindly note when you delete an instance, we release its claimed phone number back to inventory. When you call the phone number that is released, you'll get a message that it's not a working phone number. So, you can’t restore a deleted instance or access its settings, data, metrics, and reports. [1]Please kindly note that once your phone number is released from your Amazon Connect instance:•You will no longer be charged for it.•You cannot reclaim the phone number.•Amazon Connect reserves the right to allow it to be claimed by another customer. [2]I hope this helps. If you need further info, let me know in the comments; otherwise I'd appreciate if you mark my answer as "accepted".Kind regards,Rochak from AWSReferences:[1] What happens once the Amazon connect instance is deleted?https://docs.aws.amazon.com/connect/latest/adminguide/delete-connect-instance.html[2] What happens once the phone number is released?https://docs.aws.amazon.com/connect/latest/adminguide/release-phone-number.htmlCommentShareAWS-Rochakanswered 3 months agorePost-User-6014145 3 months agohello and thanks Rochak,that was so helpful, now i understand that I cannot restore the same DID phone number...but how can I claim another phone number so i can receive and make calls?every time I try to claim a phone number i get this message "You've reached the limit of Phone Numbers. To increase limit, contact support."I'll be thankful if you can help.Share0Hello ,Thank you again for the question. I understand you are getting the message "You've reached the limit of Phone Numbers. To increase limit, contact support."As you may already know there are various service quotas for Amazon Connect.[1]The phone number per instance is 5 but also please note that it is possible to get an error message that "You've reached the limit of Phone Numbers," even if it's the first time you've claimed a phone number and all the issues that cause this error message require help from AWS Support to resolve.If you have a support plan with AWS, please open a case with AWS Support and choose the service as “AWS Connect” and one of the engineer from “AWS Connect” will be able to assist you with that.  [2]You can also request a quota increase by filling out this form. [3]Please kindly note that I do not have capacity to make adjustment to your quotas at my end.I hope this helps. If you need further info, let me know in the comments; otherwise I'd appreciate if you mark my answer as "accepted".Kind regards,Rochak from AWSReferences:[1] Amazon Connect service quotashttps://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-service-limits.html#connect-quotas[2] AWS Premium Supporthttps://aws.amazon.com/premiumsupport/[3] Requesting a quota increasehttps://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-service-limits.htmlCommentShareAWS-Rochakanswered 3 months ago0Hi,Can you confirm what did you delete. is it instance or number ?Best Regards,Ramy HusseinCommentShareRamyHanswered 2 months ago"


Question: aws-appsync package breaks create-react-app

"I'm trying to implement Cognito User Pools in my Amplify app via this example (https://docs.amplify.aws/lib/graphqlapi/authz/q/platform/js/#cognito-user-pools). Importing the 'aws-appsync' package yields several errors like:ERROR in ./node_modules/graphql/index.mjs 25:0-49Module not found: Error: Can't resolve './version' in 'C:\Users\...\node_modules\graphql'Did you mean 'version.mjs'?BREAKING CHANGE: The request './version' failed to resolve only because it was resolved as fully specified(probably because the origin is strict EcmaScript Module, e. g. a module with javascript mimetype, a '*.mjs' file, or a '*.js' file where the package.json contains '"type": "module"').The extension in the request is mandatory for it to be fully specified.Add the extension to the request.I can address this with webpack config, but I'd have to eject my entire app from Create React App OR go the craco/react-app-rewired route. Surely there's an easier way?FollowComment"


Question: Fix DatabaseConnectionsCurrentlySessionPinned metric on RDS Proxy dashboard

"Currently on the default dashboard for RDS proxy the DatabaseConnectionsCurrentlySessionPinned metric is always empty despite the fact that hundreds of connections are being pinned.After consulting AWS support we were informed that this metric is actually a snapshot which is quite confusing and not useful for users.The DatabaseConnectionsCurrentlySessionPinned metric in RDS proxy dashboard should be fixed so it actually matches the number of occurrences of connection pinning. We can see the correct metric if we access that via Cloudwatch metrics, the same metric query should be used to populate the default RDS proxy dashboard.FollowComment"

Answer: "0Hi Andre de CamargoI understand that on the default dashboard for RDS proxy the DatabaseConnectionsCurrentlySessionPinned metric is always empty despite the fact that hundreds of connections are being pinned. After consulting AWS support we were informed that this metric is actually a snapshot which is quite confusing and not useful for users. Please correct me if my understanding is wrong.The above  metrics is a direct result of Dimension set. You can use the following commands to verify that all components of the connection mechanism can communicate with the other components.Examine the proxy itself using the describe-db-proxies command. Also examine the associated target group using the describe-db-proxy-target-groups Check that the details of the targets match the RDS DB instance or Aurora DB cluster that you intend to associate with the proxy[1].Use the following commands.aws rds describe-db-proxies --db-proxy-name $DB_PROXY_NAMEaws rds describe-db-proxy-target-groups --db-proxy-name $DB_PROXY_NAMEYou can change certain settings associated with a proxy after you create the proxy. You do so by modifying the proxy itself, its associated target group, or both. Each proxy has an associated target group[2].I hope the above information is helpful.References:1.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy.troubleshooting.html#rds-proxy-verifying2.https://docs.amazonaws.cn/en_us/AmazonRDS/latest/UserGuide/rds-proxy-managing.html#rds-proxy-modifying-proxyCommentShareNonkululekoanswered a year ago0HiSeems like CloudWatch console you can see the metrics but not from the RDS console. I would suggest raise a feature request or bug report request from the RDS console lower left corner Feedback button.Seems like you also have support plan available, you may raise the same concern through support case as well.As this metrics is a periodic snapshots, using the RDS proxy log to search "The client session was pinned to the database connection" can be another method of seeing the actual pined sessions.CommentShareSUPPORT ENGINEERKevin_Zanswered a year ago"


Question: Cloudfront not respecting Origin Path

"I have a cloudfront distribution with two origins. The first is an S3 static-website bucket and the second is an ALB. I also configured an extra behavior (apart from the default) to forward all api requests to the ALB.CNAME - service.example.com**Behavior: **Path Pattern - api/*Cache Policy - CachingDisabledOrigin Request Policy - AllViewerOriginOrigin Path - /api/v1The objective is to fetch https://service.example.com/api/v1/something when I try to access https://service.example.com/api/something.This doesn't work. If I access service.example.com/api/anything the URL does not even get rewritten to service.example.com/api/v1/anythingIs there a CloudFront behavior I'm not aware of that's making me misconfigure this?Edit to add:I enabled ALB access logging and this is how all requests look:https 2022-04-21T08:35:38.496934Z app/example-service/48c3493fa5414f88 65.49.20.66:45416 10.0.2.91:8000 0.001 0.002 0.000 404 404 39 178 "GET https://44.198.88.248:443/ HTTP/1.1" "-" ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 arn:aws:elasticloadbalancing:us-east-1:ACCOUNTID:targetgroup/example-service/1d723b6babea76f0 "Root=1-6261175a-69c4fa13012685" "-" "arn:aws:acm:us-east-1:ACCOUNTID:certificate/1d74321b-[snip]-539" 0 2022-04-21T08:35:38.493000Z "forward" "-" "-" "10.0.2.91:8000" "404" "-" "-"Referring to the syntax of this log line, it seems like "GET https://44.198.88.248:443/ HTTP/1.1" is the requested path. There is no path here even though I requested /api/v1/something/else.FollowComment"

Answer: "0Are you specifying your api origin as an ALB or as an HTTP/S server?  If the former (which I think is correct) then wouldn't the constructed origin URL be based on the default ALB domain not your CNAME?CommentShareEXPERTskinsmananswered a year agoyg-2073661 a year agoI specify the API origin as an HTTPS server. If I use the ALB from the drop-down list, Cloudfront tries to connect to the ALB FQDN over HTTPS and fails because the TLS cert is only valid for the CNAME (service.example.com) and not *.elb.aws.amazon.com.So, I have a domain name, say, api-alb.example.com pointing to the ALB (ALIAS-A rec on Route53) and the origin is set to api-alb.example.com over HTTPS. This ensures that the certificate configured at the ALB is valid for the FQDN to which Cloudfront is trying to connect.Share0I have the exact same behaviour but wasn't able to get it to work. Did you have any luck?CommentShareFelipe Pletsanswered a year ago"


Question: Redshift data warehouse and Glue ETL design recommendations

"An AWS Partner is designing a data late/warehouse system for a security-conscious customer. The partner has the following questions related to designing a Redshift data warehouse and related ETL pipelines. I wanted to seek your help to validate my understanding on the following:1. In general, what is the recommended approach to do incremental loads/CDC from source systems to Amazon Redshift? 2. Is it recommended to use AWS Glue to also export data from Amazon Redshift (hot data) to Amazon S3 (cold data)?3. When do we need to run updates to the AWS Glue data catalogs? Is it only when the source table definition is changed? Any other scenarios?4. Is there a scheduling / workflow mechanism to define loading dependencies into Amazon Redshift?5. Is there a mechanism in Amazon Redshift to allow for retries if the data load fails?  E.g. dimension data needs to be loaded completely before fact data table loads starts? Is AWS Glue workflow the suggested tool here as well?6. Can Tableau be used to query data from both Amazon Redshift and Amazon Redshift Spectrum at the same time?7. Would there be any recommended sharable resource, such as a presentation with best practices and approach for designing a data warehouse in AWS?Any insights on any the above would be highly appreciated.Thank you.FollowComment"

Answer: "0Accepted Answer1.In general, what is the recommended approach to do incremental loads/CDC from source systems to AWS Redshift?It depends on the type of source system. For relational databases DMS can continuously replicate changed data. For files on S3, Glue jobs have a Bookmark feature that stores a marker of the most recently loaded data e.g. a timestamp or primary key value.2.Is it recommended to use AWS Glue to also export data from Redshift (hot data) to S3 (cold data)?There are two main methods to export data from Redshift to S3. Use the UNLOAD command, or INSERT data into S3 using a Spectrum external table.3.When do we need to run updates to the Glue data catalogs? Is it only when the source table definition is changed? Any other scenarios?Glue Crawlers can be run to update metadata in the Glue Data Catalog when the structure of a table has changed e.g. a column is added/dropped, and also when partitions have been added to the table. The Glue API can also be used for this purpose, and doesn’t incur the Crawler cost.4.Is there a scheduling / workflow mechanism to define loading dependencies into Redshift?This can be done in a number of ways. Step Functions and Glue Workflows can be used. Also, Redshift now has a built in scheduler.5.Is there a mechanism in Redshift to allow for retries if the data load fails?  E.g. dimension data needs to be loaded completely before fact data table loads starts? Is AWS Glue workflow the suggested tool here as well?An orchestration tool can be used for this purpose e.g. Step Functions or Glue Workflows. An alternate, if the transformations are built with stored procedures, is to orchestrate individual loading procedures (for dimensions or facts) with a central loading procedure.6.Can Tableau be used to query data from both Redshift and Redshift spectrum at the same time?Yes. S3 objects are exposed in Spectrum via external tables in Redshift. Redshift external tables appear and behave just like normal internal tables. Views can be created that join internal tables with external tables and return hot (internal) and cold (external) data in a single view.7.Would there be any recommended sharable resource, such as a presentation with best practices and approach for designing a data warehouse in AWS?The Redshift Database Developer Guide documentation has a section  that is useful for low level Redshift best practices.CommentShareAdam_Ganswered 3 years ago"


Question: App Oauth2 Login in Private Subnet without NAT Gateway

"I run My App in Private Subnet and add Oauth2 Login without NAT Gateway.To do Oauth login, I consider setting proxy server like nginx or squid in Public Subnet.Here, I would like to ask a question because I am confused about the concept of Proxy.Is Oauth2 Login possible with Forward Proxy? Or should I use Reverse Proxy?Can nginx and squid be run as Forward Proxy and Reverse Proxy at the same time?Is there a way to do Oauth2 Login without NAT Gateway instead of Proxy?FollowComment"


Question: AWS SES Deliverability Dashboard

"Hello,We want to use the AWS SES service, in the price description we saw that a fee of $1250 per month is charged for the deliverability panel. We do not need this panel.Can I opt out? How can we do it?If we request production access, will we be charged for the deliverability panel?FollowComment"

Answer: "1Hello,Short answer: yes and no.Deliverability dashboard for AWS SES is an "Additional service" and not enabled by default. These are the additional services provide by SES:Dedicated IP addressesBring Your Own IP Addresses (BYOIP)Deliverability DashboardYou can opt-in or opt-out for these additional services when ever you want.Basic charge for SES only includes (pricing may vary by regions):Email messages: You pay $0.10 for every 1,000 emails you send or receive.Outgoing data charges: You pay $0.12 per gigabyte (GB) of data in the messages you send. This data includes headers, message content (including text and images), and attachments.Incoming mail chunks: An incoming mail chunk is 256 kilobytes (KB) of incoming data, including headers, message content (text and images), and attachments. When you use Amazon SES to receive email, you pay $0.09 for every 1,000 incoming mail chunks.You can find more information about SES pricing here: https://aws.amazon.com/ses/pricing/Regards,FrankyCommentShareFranky Chenanswered a year agoAlessio Dal Bianco 7 months agoHello Franky, but by enable the "Virtual deliverability manager" will "Deliverability Dashboard" getting activated automatically? (I hope not)The problem is that there is no clear way to know if this dashboard will be activated or not.Share"


Question: Enabling GuardDuty via Organisations

"I would like to enable GuardDuty via Organisations, and would like to know whether the existing member accounts on the main administrative account (by invitation) switch to 'enabled via Organisations' automatically.Also, can I designate a GuardDuty administrator account from outside the organisation (being from a separate organisation).FollowComment"

Answer: "2Accepted AnswerIf you have already set up a GuardDuty administrator with associated member accounts by invitation, and the member accounts are part of the same organization, their Type changes from by Invitation to via Organizations when you set a GuardDuty delegated administrator for your organization.If the new delegated administrator previously added members by invitation that are not part of the same organization, their Type is by Invitation. In both cases, these previously added accounts are member accounts to the organization's GuardDuty delegated administrator.You cannot designate an account outside of your organization as a GuardDuty administrator account.CommentShareAlex_AWSanswered a year agoEXPERTLuca_Ireviewed a year agoAyse Vlok a year agoThank you!Share0You cannot delegate Admin to an account outside of your organization as it uses Org based roles for access across the accounts.You can find more information about enabling org wide integration in the AWS docs: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.htmlCommentShareEXPERTRob_Hanswered a year agoAyse Vlok a year agoThank you!Share"


Question: Docker: Elastic Beanstalk  with EFS filesystem

"Hello everybody,I am trying to start a docker service on aws beanstalk by mounting an EFS filesystem.I keep getting the error:Failed to resolve "fs-XXXXXX.efs.eu-west-1.amazonaws.com" - check that your file system ID is correct, and ensure that the VPC has an EFS mount target for this file system ID.Attempting to lookup mount target ip address using botocore. Failed to import necessary dependency botocore, please install botocore first.ERROR: Mount command failed!I made the release with a zip file containingdockerfileDockerrun.aws.jsonapplication.jar.ebextensionscontaining: storage-efs-mountfilesystem.configI set the EFS subnet by opening port 2049 in inbound.and I also tried with the default vpc which has everything openThanks for your supportFollowComment"


Question: [MediaConvert] Job has stuck at 90%

"Hey,I've been playing around the public Video On Demand stack available at https://github.com/aws-solutions/video-on-demand-on-aws. Successfully tested a few .mp4 video files, however ran into a really strange issue for a larger .mp4 video file (14GB). The MediaConvert Job is stuck in TRANSCODING status at 90% of progress and don't fully understand why. What I noticed is that the retry count increases. I don't know how to find attached logs for the job, is it even possible to review them?Any idea or suggestion how to discover the issue?FollowComment"

Answer: "0Hi there,The primary means to monitor MediaConvert jobs is through the job status, CloudWatch Events, and/or CloudWatch Metrics. Unfortunately MediaConvert does not send log information to your CloudWatch Logs. If the job stays in the PROGRESSING state for more than 48 hours, the job will progress to the ERROR state, and you can use the provided error code along with this table to determine more information on the cause of the issue: https://docs.aws.amazon.com/mediaconvert/latest/ug/mediaconvert_error_codes.htmlIf the job results in an error or continues to remain stuck, I would also recommend capturing the job ID and opening a support case so that an engineer can investigate the job details.CommentShareSUPPORT ENGINEERMichael_Lanswered a year ago"


Question: AWS Workspaces disconnects when using screenshot / snipping tool

We are using the Windows AWS Workspaces client to connect to a Linux Workspaces VM. We are finding that whenever we use the "Snipping Tool" app on the local machine (which has the Workspaces client installed) then after a few seconds the Workspaces client will say that its lost connectivity and then disconnect. It is consistently when using the tool and we are having no issues with connectivity / network reliability when we don't use the snipping tool. We are using the latest version of the Workspaces client.Does anyone know why this might be and how to fix it?FollowComment

Answer: "0Hi Andrew,Have you enableb advanced logging on the WorkSpaces client windows machine and look for the error message at the time of the crash? This would give some additional details/insight as to what caused the crash.The Windows client logs are stored in the following location:%LOCALAPPDATA%\Amazon Web Services\Amazon WorkSpaces\logsIf you launch a new Amazon Linux WorkSpaces from the Amazon Public/Default Bundle, can you reproduce the issue? If not, it could be related to an out of date package/binary.Do you know what version of Amazon Linux WorkSpace you are running and if the OS has been updated to the latest?You can try to reboot the Linux WorkSpaces and wait for 10-15 minutes (to allow any boot up process to run and execute).Then connect to it using the WorkSpaces client, then run update (e.g. sudo yum update) to ensure it has the latest.Once the latest updates are installed, attempt to re-produce the issue.Last, if you cannot progress, then I would suggest opening an AWS Premium Support Case to allow a Premium Support engineer to review the log bundle and assist with further troubleshooting.CommentShareEXPERTDzung_Nanswered a year ago0Thanks for the tip. I checked the log and found this during the time of the error:2022-04-06T14:46:22.548Z 00000000-0000-0000-0000-000000000000 LVL:3 RC:-500    VCHAN_PLUGIN :tera_clpbd ==> Client window lost focus. Requesting clipboard contents from host.2022-04-06T14:46:38.231Z 00000000-0000-0000-0000-000000000000 LVL:2 RC:-505        MGMT_KMP :Dropping a mouse event (overflow) - flushing queue!It repeats this quite a few times.I think I'm taking from this that perhaps the size of the clipboard copy (from the snipping tool) causes the workspace to overload and then disconnect. I'm going to experiment with turning the auto copy off on the snipping tool to see if this fixes it (at least then I know what the problem is!).Any other thoughts / ideas welcomed :DCommentShareAndrewanswered a year ago0I think it is clear this is due to the clipboard overflowing, causing a failure and eventually disconnection.When I turn off the "copy to clipboard" option in the snipping tool, the issue goes away.Is there any fix to this? i.e. preventing Workspaces essentially crashing when dealing with a large clipboard?CommentShareAndrewanswered a year ago"


Question: What is main difference between DDoS testing and Stress/load test?

"In many case, ddos test is one kind of the stress/load test.In the article "Network Stress Test" ((https://aws.amazon.com/tw/ec2/testing/))it's not allow to do simulate ddos test to try the limitation to the service while dstress/load test is OK.What is the difference between ddos test and stress/load test in AWS definition?Are there any clarify explains can provide to me ?FollowComment"

Answer: "0Accepted AnswerHello rePost-User-2012324,AWS's definition of a stress test as stated in the document you provided is "when a test sends a large volume of legitimate or test traffic to a specific intended target application" while DDOS tests are defined in the same document as "Tests that purposefully attempt to overwhelm the target and/or infrastructure with packet or connection flooding attacks, reflection and complexity attacks, or other large volumes of traffic are not considered network stress tests but are considered distributed denial of service (DDoS) tests."The main difference between them is that one is purposely attempting to overload the target/infrastructure with attacks. Not legitimate traffic but traffic that is intended to maliciously deny the service of legitimate traffic. Stress/load testing is testing your infrastructure with legitimate traffic that you are expecting and monitoring your environment for how it handles that traffic. There can be some confusion since both can cause denial-of-service but one is done maliciously via attacking methods (syn flooding / amplification / reflection / ICMP flood etc) and the other is testing your target/infrastructure with legitimate and expected traffic to see how your environment can handle it.I hope this provides some clarity!-NickCommentShareNickanswered 10 months ago"


Question: SageMaker AutoPilot Regions

"Is there official documentation showing the regions in which SageMaker AutoPilot is supported? From my understanding, it should work with the SDK wherever SageMaker is supported, while in the no-code mode only where SageMaker Studio is available. Is this true?Thanks!FollowComment"

Answer: "0Accepted AnswerSageMaker Autopilot works in all the regions where Amazon SageMaker is available today as noted in this blog post "Amazon SageMaker Autopilot – Automatically Create High-Quality Machine Learning Models With Full Control And Visibility".  In addition, Autopilot is also integrated with Amazon SageMaker Studio, which is available in us-east-1, us-east-2, us-west-2 and eu-west-1. For a current list of available regions, please check the AWS Regional Services List.CommentShareAWS-User-4866184answered 3 years ago"


Question: ConfirmIntent does not change intent slots with additional user input

"I have an app that gets a roadway and direction of travel from a user. I then send a ConfirmIntent response asking to confirm that this is the information they want. If a user says 'I want I-235 soutbound' it prompts them to confirm. The Lex documentation states:For example, Amazon Lex wants user confirmation before fulfilling an intent. Instead of a simple "yes" or "no" response, a user might respond with additional information. For example, "yes, but make it a thick crust pizza" or "no, I want to order a drink." Amazon Lex can process such additional information (in these examples, update the crust type slot or change the intent from OrderPizza to OrderDrink).However if I try providing different information like 'yes, but northbound', or 'I-235 northbound' it does not switch the slot values to the newly provided ones. Is the documentation just wrong, or has someone gotten this to work?Here is an example of the ConfirmIntent I send back."dialogAction": {        "type": "ConfirmIntent",        "message": {            "contentType": "SSML",            "content": "<speak>Please confirm you want reports on <say-as interpret-as='address'>I-235</say-as>, going south</speak>"        },        "intentName": "RouteIdAndDirectionIntent",        "slots": {            "routeId": "235",            "cityName": null,            "disambiguatedRouteName": null,            "routeDirection": "SB",            "routeType": null,            "countyName": null        }    }FollowComment"


Question: Ground Truth in VPC

"Hi all,So I've been developing POCs with Ground Truth and A2I, both do not have a VPCConfig in their related boto3 method. If I would like to associate them with a VPC, how should I approach it?Thank you!FollowComment"

Answer: "0Accepted AnswerCurrently VPC is not supported, but you can restrict which source IP's are allowed to connect to the Ground Truth job.CommentShareKevinanswered a year agorePost-User-0813700 a year agoThank you for your response, restricting source IP is a great idea!Share"


Question: IAM role that have permission to unload only one schema in redshift

"I want to create an IAM role that have permission to unload only one schema in redshift, is it achievable?FollowComment"

Answer: "0It is not possible to create an IAM role with permissions specific to a single schema in Amazon Redshift because IAM roles are used to manage permissions for AWS services, and Redshift uses its own internal permission management system for granting access to its objects (databases, schemas, tables, etc.).To achieve what you're looking for, you should create a new Redshift user with limited permissions and then create a temporary IAM role or credentials that the user can assume to access the necessary S3 bucket for the UNLOAD operation.CommentShareEXPERTsdtslmnanswered 2 months ago"


Question: Django Daphne Websocket Access Denied

"We need to establish a "Web socket connection" to our AWS servers using Django, Django channels, Redis, and Daphne Nginx Config.Currently local and on-premises config is configured properly and needs help in configuring the same communication with the staging server.We tried adding the above config to our servers but got an error of access denied with response code 403 from the server for web socket request.below is the Nginx config for stagingserver {    listen 80;    server_name domain_name.com domain_name_2.com;    root /var/www/services/project_name_frontend/;    index index.html;    location ~ ^/api/ {        rewrite ^/api/(.*) /$1 break;         proxy_pass http://unix:/var/www/services/enerlly_backend/backend/backend.sock;        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;         proxy_set_header Host $host;         proxy_read_timeout 30;        proxy_connect_timeout 30;        proxy_send_timeout 30;        send_timeout 30;        proxy_redirect ~^/(.*) $scheme://$host/api/$1;     }    location /ws {        try_files $uri @proxy_to_ws;    }    location @proxy_to_ws {        proxy_pass  http://127.0.0.1:8001;        proxy_http_version 1.1;        proxy_set_header Upgrade $http_upgrade;        proxy_set_header Connection "upgrade";        proxy_redirect off;    }    location ~ ^/admin/ {        proxy_pass http://unix:/var/www/services/project_name_backend/backend/backend.sock;        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;         proxy_set_header Host $host;          proxy_read_timeout 30;        proxy_connect_timeout 30;        proxy_send_timeout 30;        send_timeout 30;        proxy_redirect off;    }    location /staticfiles/ {        alias /var/www/services/project_name_backend/backend/staticfiles/;    }    location /mediafiles/ {        alias /var/www/services/project_name_backend/backend/mediafiles/;    }    location / {        try_files $uri /index.html;      }}and Systemctl service to execute Django Daphne service[Unit]Description=Backend Project Django WebSocket daemonAfter=network.target[Service]User=rootGroup=www-dataWorkingDirectory=/var/www/services/project_name_backendExecStart=/home/ubuntu/project_python_venv/bin/python /home/ubuntu/project_python_venv/bin/daphne -b 0.0.0.0 -p 8001 project_name_backend.prod_asgi:application[Install]WantedBy=multi-user.targetBelow is the Load Balancer security group config inbound rulesListner Config for Load BalancerFollowComment"


Question: EC2 Reserved Instances how to merge

"Hi,I have 2 X t4g.nano reserved instances, which I like to merge them to create a t4g.micro RI.documentation in https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ri-modifying.html is catered only for splitting the larger RIs to smaller RIs.what I want is to merge smaller RIs to create a bigger one.ThanksFollowComment"

Answer: "1Accepted AnswerIf you have Standard RIs, you can only merge them using modification feature if start & expiry dates on both RIs are the same. If, for example, you bought one .nano RI in April, and another .nano RI in July, they will have different start & end dates, so you would not be able to merge them.If you are using Linux/UNIX RIs with Regional scope and Shared tenancy, you don't need to merge them, because they are size flexible and will be applied to your larger running instance with other matching attributes automatically.However, if both your RIs are Convertible, you can select both of them, and then use the "Exchange" feature to convert them into one bigger instance.CommentShareEXPERTNataliya_Ganswered 9 months agosravan 9 months agoIf you have Standard RIs, you can only merge them using modification feature if start & expiry dates on both RIs are the same. If, for example, you bought one .nano RI in April, and another .nano RI in July, they will have different start & end dates, so you would not be able to merge them.this clears why I'm unable to merge. my 2 nano RIs have different start and end dates.thanks for the helpShare0Hi ThereIf you are running Linux then you don't have to do anything, the two t4g.nano RI's will apply to your t4g.micro instance.  Please see "Instance Size Flexibility" in the documentation herehttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/apply_ri.html#ri-instance-size-flexibilityYou can also merge two or more Reserved Instances into a single Reserved Instance. For example, if you have four t2.small Reserved Instances of one instance each, you can merge them to create one t2.large Reserved Instance. For more information, see Support for modifying instance sizes.CommentShareEXPERTMatt-Banswered 9 months agosravan 9 months agoThanks Matt-B, for the response.You can also merge two or more Reserved Instances into a single Reserved Instance.I don't find any related option in "Modify Reserved Instances" screen. I only see option to splitShare"


Question: Client VPN access to VPC

"We have a single VPC that up until now we controlled access to an EC2 instance via firewall rules permitting a static IP from specific company offices.  We now have a need to have a freelance developer get access to the EC2 instance, but we do not want to give access to our corporate remote access nor do they have a static IP.I'm attempting to setup client VPN into the VPC.  We have gotten as far as connecting, but can't seem to get access to the EC2 instance via SSH (or even ping it).Example IPs:EC2 VPC IP 10.0.0.2EC2 default gateway 10.0.0.1Client VPN IP 10.0.1.2I'm able to ping 10.0.0.1 (the VPC default gateway) from both the EC2 instance and the client VPN, so this gives me the impression that the routing is setup correctly.  I cannot ping the EC2 instance 10.0.0.2 from the client VPN.  The default route on the EC2 instance is 10.0.0.1, so it shouldn't require any routing back to the client VPN network.We setup ingress rules on the security group associated with the VPC to allow ICMP and SSH from 10.0.1.0/24, but no joy.Any suggestions on where to look next?FollowComment"

Answer: 0Disregard.  Turns out I had to add the VPC subnet to the ingress rules because the client VPN is NATed.CommentSharemorleyzanswered 2 years ago


Question: Pointing domain to a sub directory - Wordpress on LAMP

"Guys, how do I point my domain to the subdirectory which is my Wordpress on my LAMP stack and not the LAMP directory...FollowComment"

Answer: 0Virtual Host was configured. thank you allCommentShareanavrinanswered 4 years ago


Question: Does AWS DMS only support migration to brand new tables in the target DB?

"We have a use case of migrating data from AWS DocumentDB to MySQL DB. In the target DB, we have an existing table where we want this ongoing migration to happen. Is this possible or does DMS only support migration to a brand new table in the target DB?FollowComment"

Answer: "1Per the documentation, there is no limitation on the target table in a MySQL database destination.Some of the limitations that are present are:The data definition language (DDL) statements TRUNCATE PARTITION, DROP TABLE, and RENAME TABLE.Using an ALTER TABLE table_name ADD COLUMN column_name statement to add columns to the beginning or the middle of a table.Aurora Serverless is available as a target for Amazon Aurora version 1.Using an Aurora Reader endpoint.Since it sounds like you are doing continuous replication, also take a look at the Ongoing replication task documentation.CommentShareCarlo Mencarellianswered 5 months ago"


Question: How to remove network interfaces?

"I created 3 EC2 instances within 3 subnets. Meanwhile, I created 3 network interfaces in the subnets for the 3 EC2 instances. I terminated the 3 EC2 instances. However, the 3 subnets and network interfaces can not be deleted because their status is in use.How to remove them?FollowComment"

Answer: "1Does this help? https://repost.aws/questions/QUsua3vTNJTEC2bE5JoqS8xg/cannot-delete-network-interfaceCommentShareEXPERTskinsmananswered 5 months agorePost-User-2672104 5 months agoIt does not work. When I attempted to detach the network interface, there is an error--The network interface can't be detached, Network interface is in use by another service.Share0Which was the use case for these ENIs? Did you use them to connect to any other service? Can you review in the Network interface ID Under Description you can see which is the service is attached. It seems you have any other service attached to it, first you need to find that service before being able to delete the ENI.CommentShareVicky Gracianoanswered 5 months ago"


Question: ec2 instance not connecting to mysql workbench

"i made an ec2 instance, put an inbound rule for 3306, made a remote user with peivilages,when i try to connect the user in another computer it works but only on the teminal,when i try to connect fron the workbench it gives me the "could not connect to ssh tunnel : authuntecation failed"popup screen.i assured that the keypair is right, the username and pass are right.could really use some assestance.FollowComment"

Answer: 0Both of these articles walk you through how to set this up using Sessions Manager port forwarding.How can I use an SSH tunnel through AWS Systems Manager to access my private VPC resources?Securely connect to an Amazon RDS or Amazon EC2 database instance remotely with your preferred GUICommentShareEXPERTkentradanswered 3 months ago


Question: Slice asset not loading - source control not fixing problem

"I'm having some trouble with a slice not loading after manipulating it in windows.I'm getting the following error when the level is opened: [Error] Slice asset {2A23859A-D8C3-564C-BB43-ECAF41F74D80}:1 not ready or not found! Slice data based on the asset will likely be lost.The level I was working on initially had 1 entity. I created a slice from it in order to create a new entity based on it in the editor. I also performed some operations on the slice file in windows, such as duplicating/renaming it and maybe deleting some copies. When I reloaded the level today, the initial entity and the second entity were missing and I was getting the error.I tried restoring an earlier version from source control. Our source control currently tracks just the project directory, and it hasn't caused problems until now.My questions:What is trying to open the slice asset? Where is it looking?When I created the first entity, I didn't create a slice. Where is that slice stored?Is there a small amount of files that can be added to source control to prevent this? The source control outlined here is not feasible: http://docs.aws.amazon.com/lumberyard/latest/userguide/lumberyard-upgrading.htmlFollow"

Answer: "0Accepted AnswerHello @REDACTEDUSERSlice assets are self-contained meaning that all the information it needs is in the .slice asset however they could have dependencies on other assets like lua scripts, other slices...etc. Slice assets are just xml files so you should be able to inspect the files using any text editor.As far as source control goes, committing everything in your assets directory should be fine and is recommended. However, there could be other dependencies outside of that directory like Gems. If your slice depends on an asset in a Gem and you haven't committed that Gem then you would run into cases where the slices wouldn't properly load.Hope that helps!SharerePost-User-5162062answered 6 years ago0Hey @REDACTEDUSERSharerePost-User-5738838answered 6 years ago0Good morning!I am one of the technical artists here on Lumberyard Support, and I am currently looking in to your inquiry. First I wanted to know if I could get a little additional information from you:What version of Lumberyard are you on?Which Visual Studio are you currently using?Which version control software are you using?Thank you so much for taking the time to reach out to us and I hope I can be a help!-MajorBlissSharerePost-User-4093265answered 6 years ago0Thanks for your help. I'm using:LY 1.9.0.1VS 2015 CEgit version 2.13.0 (I am aware that git is not ideal for LY projects... there are too many files and it takes up too much storage. We are hoping to find a solution but we have pushed it off for now.)SharerePost-User-6682533answered 6 years ago"


Question: The new Sustainability Pillar (6th pillar) is not seen in AWS WAR

The newly introduced 6th pillar i.e. Sustainability Pillar is NOT seen in the review. I created a workload in Well-Architected Review tool of AWS today.  I used default AWS Well-Architected Framework Lens.  While reviewing I could see only the old 5 pillars.   Appreciate if someone can provide any insight or solution for getting the 6th pillar as well while reviewing the workload.FollowComment

Answer: 9Support for the sustainability pillar within the  AWS  WA Tool will be available in 2022.Please refer https://aws.amazon.com/well-architected-tool/faqs/ for more details.CommentShareSanjay Aggarwalanswered a year agoAWS-User-2798603 a year agoThank you for your quick answer.  Also I could see only 3 Lenses.  I am interested in other Lenses like SAP lens and Hybrid Network also.  Any idea on when these other lenses will be available and supported?ShareSwwapnil a year ago@AWS-User-2798603 -Please check SAP Lens for the AWS Well-Architected Framework - https://aws.amazon.com/blogs/awsforsap/introducing-the-sap-lens-for-the-aws-well-architected-framework/Hybrid Networking Lens:https://docs.aws.amazon.com/wellarchitected/latest/hybrid-networking-lens/hybrid-networking-lens.htmlShare0Here is the AWS Well-Architected Framework of Sustainability Pillar.AWS Blog Link:https://aws.amazon.com/blogs/aws/sustainability-pillar-well-architected-framework/CommentShareSwwapnilanswered a year ago0The Pillar is now available in the AWS Well-Architected Tool.CommentShareSamiranswered a year ago


Question: [Athena Engine V3] INVALID_VIEW: line 5:8: Failed analyzing stored view 'cadatasource.cadb.caview': line 16:6: Table 'AWSDataCatalog.mydb.mytable' does not exist

We've set up cross account access as described here. All our cross account queries have been working up to now.But now we've set up a workgroup that uses Athena engine V3. Our queries have generally worked fine in this workgroup except for some cross account queries. We get errors similar toINVALID_VIEW: line 5:8: Failed analyzing stored view 'cadatasource.cadb.caview': line 16:6: Table 'AWSDataCatalog.mydb.mytable' does not existWe see no errors from these queries when we run them in our primary (engine V2) workgroup. It appears that Athena engine V3 swaps the default data source (AWSDataCatalog in this case) from our account into the cross account view (cadatasource.cadb.caview). It assumes the tables that the cross account view references are in the default data source in the account from which we are issuing the query instead of the actual data source of the view in the other account.FollowComment


Question: Unable to read data from the transport connection: An established connection was aborted by the software in your host machine.

"after setting up the ses , we OCCASSIONALLY get  the error 'Unable to read data from the transport connection: An established connection was aborted by the software in your host machine. '  occasionally, kindly adviceFollowComment"


Question: Quota increase for "VPCs per Region" Exceeded Resource Limit -- How to Lower my Quota?

"I recently requested a quota increase for my VPCs per Region, but it seems that my request exceeded the resource limits. As a result, I wasn't able to create the cluster I needed to. Here is the error message:Cluster creation failed due to a client error: Cluster creation was cancelled because it will fail from exceeding resources limits. These are the minimum limits for resources required to successfully create your cluster:132.0 TiB EBS gp2, service code: ebs, quota code: L-D18FCD1DHow can I lower my quota, so that I can successfully create a cluster? Thank you!FollowComment"

Answer: "1As I'm reading it, the error isn't saying the quota is too high. It sounds like the EBS volume being requested is above what you amazon account is allowed. Make sure your values and units are correct.Did the quota increase go through completely, meaning it was applied fully? I'll also mention that many service quota increases are regionally based. So an increase for VPCs allowed in us-west-2 will not increase the number of VPCs allowed in eu-west-1. I would also double check the quota increase was in the correct region and has been successfully processed.CommentShareCarlo Mencarellianswered 4 months ago"