Question: [RDS/Aurora] Use TLS with Route53-provided CNAME

"We use a Route53-provided CNAME record to point to our database cluster in order to have easily-recognizable urls for our DBs and be able to perform migrations seamlessly (from the point of view of the app that relies on the database).When using such a CNAME, is it possible to use TLS to connect to the database?FollowComment"

Answer: "0If you want TLS to be verified without warnings the name you are connecting to must match the name in the Cert.  As such, using a CNAME will not work.CommentShareEXPERTiBehranswered a month ago"


Question: aws-cli Unable to locate credentials at launch

"Hi Folks,I'm trying to run a userdata script to mount an EBS volume on my Batch instances during it's launch however no matter what I do the aws cli can't find the IAM Profile credentials. Running aws cli always returns "Unable to locate credentials. You can configure credentials by running "aws configure".If I ssh into the instance I can curl the local metadata endpoint and confirm that the the profile were properly assigned.I saw some old posts and blogs about this error but none of the solutions proposed seems to work. Some posts mentions that if the role is attached after the instance launch than aws cli won't see the credentials but I can't say if thats the case or not if instances managed by AWS Batch, nor do I found who should I setup my cloudformation template in order to make the credentials available for the userdata script.Can someone advise me? Has anyone already faced this problem?FollowComment"

Answer: "0Ok, figure out the error finally. Given that AWS Batch seems to rely on a set of other APIS (namely ECS and EC2) I got a little confused withe multiples roles (and specifically the trust relationships required by each).Also troubleshooting the issues were a little painful until I found the AWS Faq "My Job got stuck in runnable state". Only after reading this troubleshooting guide I could make sense about the role of each service.Regards.CommentShareepchavesanswered 4 years ago"


Question: Why level up to AWS Organizations and Why not stick to AWS Account

"What is the advantage of AWS organization management over the account management ?  Why take the leap****Every Company has users and resources they interact with. End of the day -  management of these users and resources (allowing the intended and blocking the un-intended usage) is the purpose of our job. Answer is to use an account level strategy or organizational level strategy.In AWS , few years back , focus was on securing an account and VPCs did the separation for production, development and testing stages. [Please understand Separate VPC is as good as a separate datacenter ]. Now idea is promoted that practically each developer or team will have an account and  the department will work as an OU and Enterprise will run as a AWS organization - handling this multi account strategy. So along comes SCPs(at the end of the day they are DENY rules). Control Tower and Landing Zone. But the same things can be run on account level.*Are we Securing the blast radius by limiting to an account ? incase of an account compromise ?  *I do not agree as firstly when your running a multi-account system similar cross account access are also in place which needs to be secure along with the basic level account security management. Also top-managing account in organization can be compromised . In fact the attack surface largely increasing onto an other level. Causes difficulties to visibility and monitoring - ( Guard Duty can be enabled for multi accounts and Cloud Trails Aggregator can be used )- but it is getting complicated.Secondly, anyways one has to keep the account secure also. Clear demarcation is  possible and good environment can be provided with VPC , Conditional statements , tagging. In case of merger there can be cross account access enabled with external ID.**I am not here to challenge but I want to gain an understanding in why the shift was undertaken. Also any resources in this regard will be great help. Even a comment might help. ******  **FollowComment"

Answer: "2As you mentioned, limiting the security scope (blast radius as you call it) is a driving factor for many customers to use multiple accounts. Customers commonly separate production, sandbox, staging etc. into separate accounts. Large organizations often separate business units into separate accounts too for billing and security. Access management is simplified in a multi-account scenario as you only allow access by need instead of having to be extremely diligent about policy rights to various resources in a single account. Also, some regulatory requirements mandate separate accounts for production and development. There are also account quotas that larger customers would bump up against if using a single account.CommentShareAWS-Everettanswered 6 months agoEXPERTBrettski-AWSreviewed 6 months agorePost-User-6753560 6 months ago"Also, some regulatory requirements mandate separate accounts for production and development." what ??? "  There are also account quotas that larger customers would bump up against if using a single account" ??Like What - may be more specifiedShare1AWS Organization allows customers to consolidate billing for multiple AWS accounts and optionally manage those accounts centrally. There are many tasks that customers has to perform to ensure the baseline e.g. security guardrail, is implemented correctly. Many customers are asking for AWS guidance to help them ensure their AWS environments meet those requirements. The AWS Well-Architected Management and Governance Cloud Environment Guide (M&G Guide) provides clear guidance for customer to follow. Beyond AWS Organization, M&G Guide it introduce AWS Control Tower to provision a landing zone embedded with controls.You may want to look at the guide at: https://docs.aws.amazon.com/wellarchitected/latest/management-and-governance-guide/management-and-governance-cloud-environment-guide.htmlCommentShareronald_lanswered 6 months agoEXPERTTasioreviewed 6 months agorePost-User-6753560 6 months agoQuestion is not why or How to  use AWS Organization ?  But why at all to have multi-accounts in first place, if required functions can be achieved in a single account itselfShareBrettski-AWS EXPERT6 months agoFor example, if a large company was using a single account and they had many Lambda functions they could easily run into the maximum number of concurrent Lambda executions. Splitting that across multiple accounts allows for a higher aggregate limit.Share"


Question: Upgrading on Cloud9 from Ruby on Rails 6 - 7 and getting error "No region was provided. Configure the `:region` option or export the region name to ENV['AWS_REGION']" when trying to migrate database

"This seems like a zeitwerks load issue ... I have manually set the value in ENV same error -Here is code block of message with trace:`program:~/environment/timpdaley_2 (upgradeRails61to70) $ bin/rails db:migrate RAILS_ENV=development --trace** Invoke db:migrate (first_time)** Invoke db:load_config (first_time)** Invoke environment (first_time)** Execute environment** Execute db:load_config** Execute db:migrate== 20230307163758 AddServiceNameToActiveStorageBlobs: migrating ===============-- table_exists?(:active_storage_blobs)   -> 0.0017s-- column_exists?(:active_storage_blobs, :service_name)   -> 0.0020s-- add_column(:active_storage_blobs, :service_name, :string)   -> 0.0014srails aborted!StandardError: An error has occurred, this and all later migrations canceled:No region was provided. Configure the `:region` option or export the region name to ENV['AWS_REGION']/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-core-3.170.0/lib/aws-sdk-core/plugins/regional_endpoint.rb:92:in `after_initialize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-core-3.170.0/lib/seahorse/client/base.rb:81:in `block in after_initialize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-core-3.170.0/lib/seahorse/client/base.rb:80:in `each'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-core-3.170.0/lib/seahorse/client/base.rb:80:in `after_initialize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-core-3.170.0/lib/seahorse/client/base.rb:24:in `initialize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-s3-1.119.1/lib/aws-sdk-s3/client.rb:452:in `initialize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-core-3.170.0/lib/seahorse/client/base.rb:102:in `new'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-s3-1.119.1/lib/aws-sdk-s3/resource.rb:28:in `initialize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service/s3_service.rb:16:in `new'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service/s3_service.rb:16:in `initialize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service.rb:61:in `new'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service.rb:61:in `build'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service/configurator.rb:17:in `build'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service/registry.rb:13:in `block in fetch'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service/registry.rb:11:in `fetch'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service/registry.rb:11:in `fetch'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/engine.rb:155:in `block (2 levels) in <class:Engine>'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/lazy_load_hooks.rb:95:in `class_eval'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/lazy_load_hooks.rb:95:in `block in execute_hook'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/lazy_load_hooks.rb:85:in `with_execution_control'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/lazy_load_hooks.rb:90:in `execute_hook'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/lazy_load_hooks.rb:76:in `block in run_load_hooks'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/lazy_load_hooks.rb:75:in `each'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/lazy_load_hooks.rb:75:in `run_load_hooks'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/app/models/active_storage/blob.rb:410:in `<top (required)>'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/zeitwerk-2.6.7/lib/zeitwerk/kernel.rb:30:in `require'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/zeitwerk-2.6.7/lib/zeitwerk/kernel.rb:30:in `require'/home/ubuntu/environment/timpdaley_2/db/migrate/20230307163758_add_service_name_to_active_storage_blobs.active_storage.rb:9:in `up'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:873:in `public_send'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:873:in `exec_migration'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:854:in `block (2 levels) in migrate'/home/ubuntu/.rvm/rubies/ruby-3.0.0/lib/ruby/3.0.0/benchmark.rb:293:in `measure'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:853:in `block in migrate'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/connection_adapters/abstract/connection_pool.rb:215:in `with_connection'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:852:in `migrate'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:1046:in `migrate'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:1360:in `block in execute_migration_in_transaction'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/connection_adapters/abstract/transaction.rb:319:in `block in within_new_transaction'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/concurrency/load_interlock_aware_monitor.rb:25:in `handle_interrupt'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/concurrency/load_interlock_aware_monitor.rb:25:in `block in synchronize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/concurrency/load_interlock_aware_monitor.rb:21:in `handle_interrupt'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/concurrency/load_interlock_aware_monitor.rb:21:in `synchronize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/connection_adapters/abstract/transaction.rb:317:in `within_new_transaction'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/connection_adapters/abstract/database_statements.rb:316:in `transaction'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/transactions.rb:209:in `transaction'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:1411:in `ddl_transaction'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:1359:in `execute_migration_in_transaction'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:1333:in `each'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:1333:in `migrate_without_lock'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:1282:in `block in migrate'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:1432:in `block in with_advisory_lock'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/connection_adapters/abstract/connection_pool.rb:215:in `with_connection'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:1447:in `with_advisory_lock_connection'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:1428:in `with_advisory_lock'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:1282:in `migrate'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:1117:in `up'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:1092:in `migrate'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/tasks/database_tasks.rb:262:in `migrate'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/railties/databases.rake:92:in `block (2 levels) in <top (required)>'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/rake-13.0.6/lib/rake/task.rb:281:in `block in execute'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/rake-13.0.6/lib/rake/task.rb:281:in `each'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/rake-13.0.6/lib/rake/task.rb:281:in `execute'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/rake-13.0.6/lib/rake/task.rb:219:in `block in invoke_with_call_chain'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/rake-13.0.6/lib/rake/task.rb:199:in `synchronize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/rake-13.0.6/lib/rake/task.rb:199:in `invoke_with_call_chain'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/rake-13.0.6/lib/rake/task.rb:188:in `invoke'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/rake-13.0.6/lib/rake/application.rb:160:in `invoke_task'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/rake-13.0.6/lib/rake/application.rb:116:in `block (2 levels) in top_level'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/rake-13.0.6/lib/rake/application.rb:116:in `each'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/rake-13.0.6/lib/rake/application.rb:116:in `block in top_level'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/rake-13.0.6/lib/rake/application.rb:125:in `run_with_threads'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/rake-13.0.6/lib/rake/application.rb:110:in `top_level'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/railties-7.0.4.2/lib/rails/commands/rake/rake_command.rb:24:in `block (2 levels) in perform'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/rake-13.0.6/lib/rake/application.rb:186:in `standard_exception_handling'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/railties-7.0.4.2/lib/rails/commands/rake/rake_command.rb:24:in `block in perform'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/rake-13.0.6/lib/rake/rake_module.rb:59:in `with_application'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/railties-7.0.4.2/lib/rails/commands/rake/rake_command.rb:18:in `perform'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/railties-7.0.4.2/lib/rails/command.rb:51:in `invoke'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/railties-7.0.4.2/lib/rails/commands.rb:18:in `<top (required)>'bin/rails:4:in `require'bin/rails:4:in `<main>'Caused by:Aws::Errors::MissingRegionError: No region was provided. Configure the `:region` option or export the region name to ENV['AWS_REGION']/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-core-3.170.0/lib/aws-sdk-core/plugins/regional_endpoint.rb:92:in `after_initialize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-core-3.170.0/lib/seahorse/client/base.rb:81:in `block in after_initialize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-core-3.170.0/lib/seahorse/client/base.rb:80:in `each'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-core-3.170.0/lib/seahorse/client/base.rb:80:in `after_initialize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-core-3.170.0/lib/seahorse/client/base.rb:24:in `initialize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-s3-1.119.1/lib/aws-sdk-s3/client.rb:452:in `initialize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-core-3.170.0/lib/seahorse/client/base.rb:102:in `new'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/aws-sdk-s3-1.119.1/lib/aws-sdk-s3/resource.rb:28:in `initialize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service/s3_service.rb:16:in `new'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service/s3_service.rb:16:in `initialize'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service.rb:61:in `new'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service.rb:61:in `build'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service/configurator.rb:17:in `build'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service/registry.rb:13:in `block in fetch'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service/registry.rb:11:in `fetch'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/service/registry.rb:11:in `fetch'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/lib/active_storage/engine.rb:155:in `block (2 levels) in <class:Engine>'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/lazy_load_hooks.rb:95:in `class_eval'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/lazy_load_hooks.rb:95:in `block in execute_hook'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/lazy_load_hooks.rb:85:in `with_execution_control'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/lazy_load_hooks.rb:90:in `execute_hook'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/lazy_load_hooks.rb:76:in `block in run_load_hooks'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/lazy_load_hooks.rb:75:in `each'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activesupport-7.0.4.2/lib/active_support/lazy_load_hooks.rb:75:in `run_load_hooks'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activestorage-7.0.4.2/app/models/active_storage/blob.rb:410:in `<top (required)>'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/zeitwerk-2.6.7/lib/zeitwerk/kernel.rb:30:in `require'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/zeitwerk-2.6.7/lib/zeitwerk/kernel.rb:30:in `require'/home/ubuntu/environment/timpdaley_2/db/migrate/20230307163758_add_service_name_to_active_storage_blobs.active_storage.rb:9:in `up'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:873:in `public_send'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/active_record/migration.rb:873:in `exec_migration'/home/ubuntu/.rvm/gems/ruby-3.0.0@timdaley_2/gems/activerecord-7.0.4.2/lib/FollowComment"


Question: ELB ‘Create*' API: Filter out policies and change

We have received an email from AWS regarding AWS IAM policy on Elastic Load Balancing and We use AWS Load balancer controller with EKS which is configured with the help of below document:https://docs.aws.amazon.com/eks/latest/userguide/aws-load-balancer-controller.htmlNow we are unable to detect the specific policies affected by the change and need help to identify and fix themFollowComment


Question: Error creating fleets. "Current limit of fleets of 0 have been reached.."

"I have checked with support and confirmed this is not a payment issue. Yesterday, I was able to create new fleets in AWS Gamelift without a problem. In the past, I have gotten a similar error once I have 5 fleets, "Current limit of fleets of 5 have been reached.." Currently I have 2 active fleets, and am unable to make a third.FollowCommentznnxzz a year agoHello!We are facing the same problem. AWS Support Team keeps sending the boilerplate answer, and it is not helpful at all...Did you manage to solve this issue?Share"

Answer: "3Hello, I am also getting the same error. It came up 3 days ago after terminating a fleet and creating a new one. Was working absolutely fine until that last fleet creation attempt.I contacted AWS support after upgrading my account to get access to technical support assistance, they’ve increased my Gamelift service limit for fleets but the error persists.I also tested deploying a build and fleet on another region and even created a brand new account to test and the error persists. I’m guessing this is a general account / gamelift problem?Doesnt work from CLI eitherCommentShareCyrusanswered a year agoKubberz a year agoThe problem was solved? I've had the same problem for two days. As my game is still in the backend deployment phase, I would like to evaluate other options. Due to the amount of complaints without a clear answer from Amazon regarding this issue, perhaps using Gamelift is not a viable option.Share1After a week of trying to debug, AWS Supprot finally unlocked my restriction. Though I am still unsure of what caused the issue and how to prevent it from happening again. Definitely was a general issue with non-organization accounts it seems.CommentShareCyrusanswered a year ago"


Question: Amazon mTurk - Problem to pay "You have exceeded your monthly credit limit"

"Hello,I can't confirm and publish batch on Amazon mTurk.  I get this error: "You have exceeded your monthly credit limit".My AWS account and Amazon mTurk are associated and I just added a valid bank card on my AWS account.So I don't understand the problem.Could you help me?Thank youFollowCommentChristo 3 months agoI reached out to AWS support as many have suggested. The response I received was:After review, we regret to inform you that we are unable to approve your limit increase request at this time.This decision can be influenced due to one or several factors stated in the participation agreement, which can be found here:https://www.mturk.com/participation-agreementIt is unclear to me which part of the participation agreement I'm not fulfilling. I've had an AWS account for a long time for S3 storage, but since merging AWS with mturk account I can't create HITs of any dollar amount.Any ideas on how to resolve?SharerePost-User-8596188 5 days agoHi, Did you solve this issue? May I ask how did you solve it and how long did you wait?Share"

Answer: "1I tried contacting the staff and knew that I was limited to spending $100 a month. Have you lifted the restriction now? Is there any way to speed this up?CommentShareAWS-User-7045847answered a year agorudra0713 a year agoHi, did you find any solution? How did you contact the staff?Share0To resolve this issue, send a message to the support link below and ask MTurk to increase your monthly spending limit:https://support.aws.amazon.com/#/contacts/aws-mechanical-turkI am told by Amazon MTurk support that when an account is set up, there is a review and a monthly spending limit is applied to your account. According to the support email I received, the way this review is done is "proprietary."It is worth noting that if the projected cost of your HITS assessed by MTurk exceeds the monthly spending limit to your account, this may affect how your HITS run (ie you may be prevented from approving workers, bonusing, or launching compensation HITs, if this limit is projected to be “overspent” within the month).  In other words, even if you haven’t spent up to the maximum of the “spending limit,” if the projection is that you exceed this amount, these issues still arise.A temporary fix might be to change (decrease) the sample size of your HITS in the hopes that the projection now meets the monthly spending limit, but I think it is best to work with MTurk to establish the limit you need. It may necessitate proof you are capable of paying the amount; I don't know.IN SUM:  To rectify this, contact their support and request the increase and hopefully an increase is approved.CommentShareAWS-User-9223853answered a year agorePost-User-9687991 4 months agoThis unfortunately doesn't work. I'm new and my limit says it's 2,500 already yet I couldn't publish something for 1,008. I dropped it to 2 and that exceeded the limit too. So I'm pretty sure when you're new the limit is 0. We are forced into AWS billing and can't use pre-paid HITS or pay upfront in any way and then they don't give you a workable account. I've been waiting for 5 days and this is after being told 3 times my case is being expedited.ShareLayne Harris 23 days agoThis is helpful, thank you. Amazon should probably mention this step in their documentation though.Share0I'm having the same issue hopefully we can get an answer.CommentShareHoppersanswered a year ago0Hi! Has anyone found a solution to this? Or can anyone provide an estimate of how long this takes? It has been over a week for me now since contacting them for an increase.CommentSharerePost-User-5881811answered 4 months ago0I am having the same issue. I can't publish my HIT even though I have a credit card linked to my account. I tried to use Advance Pay and was told that MTurk doesn't accept Advance Pay. How am I supposed to use the service if I can't publish a HIT. It's been over a week since I requested a credit limit increase and still no resolution. This is unacceptable when you already linked your payment methods. Amazon needs to do better!!!CommentSharerePost-User-7087241answered 2 months ago0Still a problem to this day...CommentSharerePost-User-1442627answered 2 months ago0Any updates on this? How long does it usually take?I have the same problem.CommentSharefabiangroegeranswered a month ago0It took almost 2 weeks for my limit to be increased after I contacted customer service.CommentSharerePost-User-7087241answered a month ago0I have the same problem last week and asked CS for help, but the experience was horrible.He can neither tell me which agreement I had violated nor refer to any reviewers of my process.I am more disappointed when he said " I will be resolving this case. Future communication about this issue will not be responded to." after two emails.Clearly, he knows that no solutions are provided but he just leaves the problem here anyway.Unacceptable system and customer service.CommentShare410311403answered 19 days ago"


Question: Amazon WorkMail Not Allowed to send Outgoing Email

"Hi, I am having the same issue with my WorkMail account, Can you please share the solution or help me fix this issue?Error:" You are currently not allowed to send this e-mail. Please try again later.2022-08-15 09:15:30 : An error occurred while trying to deliver the mail to the following recipients: name@domain.comTechnical report:Final-Recipient: rfc822; name@domain.com "I am using WorkMail Europe (Ireland) - eu-west-1I am using a custom domain with all verified DNS records and Route53 is also configured. I am not over the sending limit as I am not able to send a single email even to my own verified domain user.FollowComment"

Answer: "0Hi,I'm sorry to hear you're unable to send mails. This error message comes when you have reached the limits or a violation in terms of service was made and the account was blocked. If that happened you should have received a reach out case in your public health dashboard. This notice has instructions on how to remedy this situation.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 10 months agoDanishKnows 10 months agoHI Robins, I have checked the Health Dashboard there are no open or recent issues.Sharerobinkaws MODERATOR10 months agoHi,In that case I would recommend that you create a support case to see what is wrong.Kind regards,RobinShareDanishKnows 10 months agoI have the Support plan: Basic so I am unable to receive technical support.Sharerobinkaws MODERATOR10 months agoHi,Can you share the alias of your organization? I will ask the service team to take a look at your organization.Kind regards,RobinShareDanishKnows 10 months agoAccount Alias is orderlaoShareShow 1 more comment"


Question: Can you guys tell me how to Spawn dynamic Slices from C++?

"I have my own SystemComponent and I want to teach it to spawning something, how to do it?Earlier I saw Spawner Component, can we use it with system? Or maybe we can do Spawning without any other component and directly ?Follow"

Answer: "0Accepted AnswerYou can spawn slices fairly simply through C++ by doing the following:#include <AzCore/Asset/AssetManagerBus.h>#include <AzFramework/Entity/GameEntityContextBus.h>// Firstly, find the slice asset ID using the file name of the sliceAZ::Data::AssetId sliceAssetID;EBUS_EVENT_RESULT(sliceAssetID, AZ::Data::AssetCatalogRequestBus, GetAssetIdByPath, "Slices/TestSlice.dynamicslice", AZ::AzTypeInfo<AZ::DynamicPrefabAsset>::Uuid(), true);if (sliceAssetID.IsValid()){// Using the valid ID, find the actual slice assetAZ::Data::Asset<AZ::DynamicSliceAsset> sliceAsset;sliceAsset.Create(sliceAssetID, true);if (sliceAsset.GetId().IsValid()){// Actually spawn the sliceAZ::Transform transform(AZ::Transform::CreateTranslation(AZ::Vector3(0, 0, 0)));AzFramework::SliceInstantiationTicket ticket;EBUS_EVENT_RESULT(ticket, AzFramework::GameEntityContextRequestBus, InstantiateDynamicSlice, sliceAsset, transform, nullptr);}}If you're looking to get a little more complex, you can create your own version of a spawner. Have a look at 'LmbrCentral\Code\Source\Scripting\SpawnerComponent.h', especially the 'SliceInstantiationResultBus::MultiHandler' functions and the 'SpawnSliceInternalRelative' function.Inherit your spawner class from AzFramework::SliceInstantiationResultBus::MultiHandler and make sure to implement:void OnSlicePreInstantiate(const AZ::Data::AssetId& sliceAssetId, const AZ::SliceComponent::SliceInstanceAddress& sliceAddress) override;void OnSliceInstantiated(const AZ::Data::AssetId& sliceAssetId, const AZ::SliceComponent::SliceInstanceAddress& sliceAddress) override;void OnSliceInstantiationFailed(const AZ::Data::AssetId& sliceAssetId) override;Hopefully that helps.SharerePost-User-8652571answered 5 years ago0Thx! your code works!gyazo gifBut before I readed your reply(and see your code) I was working on another menthod I was trying to create SpawnerComponent for mySystemComponent (I guess it's wrong decision, because system components and regular components various)#include <LmbrCentral/Scripting/SpawnerComponentBus.h>void MyCustomSystemComponent::Activate(){m_entity->CreateComponent(LmbrCentral::SpawnerComponentTypeId);//m_entity->Init();//m_entity->Activate();MyCustomSystemRequestBus::Handler::BusConnect();}and I was in seeking code snippet how to convers path to slice(string) into typeAZ::Data::AssetId sliceAssetIdI wanted to doing Spawning of Slice with internal SpawnerComponent with helps sending to it event like this:LmbrCentral::SpawnerComponentRequestBus::Event(GetEntityId(), &LmbrCentral::SpawnerComponentRequestBus::Events::SpawnSliceAbsolute, sliceAsset, transform);codeAnyways your code works now, thank you!SharerePost-User-2514050answered 5 years ago0Yep, my method works too!) But I do not create SpawnerComponent for systemEntity with are using for SystemComponents like my system. I just create dynamic entity within my system and create for this entity - SpawnerComponent.void MyCustomSystemComponent::Activate(){//AZ::Entity* newEntity = aznew AZ::Entity("testEntity");newEntity = aznew AZ::Entity("testEntity");newEntity->CreateComponent(LmbrCentral::SpawnerComponentTypeId);newEntity->Init();newEntity->Activate();AZ::Vector3 pos(512.0f, 512.0f, 50.0f); // positionAZ::TransformBus::Event(newEntity->GetId(), &AZ::TransformInterface::SetWorldTM, AZ::Transform::CreateTranslation(pos));MyCustomSystemRequestBus::Handler::BusConnect();}so now this event works too,void MyCustomSystemComponent::AddSpawnSliceRequest(const AZStd::string & sliceName, const AZ::Vector3 & pos){AZ::SimpleLcgRandom m_randomGenerator;//m_randIndex = m_randomGenerator.GetRandom();m_spawnPos = AZ::Vector3(1024.0f * 0.5f + m_randomGenerator.GetRandomFloat() * (16.0f),1024.0f * 0.5f + m_randomGenerator.GetRandomFloat() * (16.0f),45.f);AZ::Data::AssetId sliceAssetId;EBUS_EVENT_RESULT(sliceAssetId, AZ::Data::AssetCatalogRequestBus, GetAssetIdByPath, "Slices/DynamicSlice.dynamicslice", AZ::AzTypeInfo<AZ::DynamicPrefabAsset>::Uuid(), true);if (sliceAssetId.IsValid()){// Using the valid ID, find the actual slice assetAZ::Data::Asset<AZ::DynamicSliceAsset> sliceAsset;sliceAsset.Create(sliceAssetId, true);if (sliceAsset.GetId().IsValid()){AZ::Transform transform(AZ::Transform::CreateTranslation(m_spawnPos));AzFramework::SliceInstantiationTicket ticket;EBUS_EVENT_RESULT(ticket, AzFramework::GameEntityContextRequestBus, InstantiateDynamicSlice, sliceAsset, transform, nullptr);if (ticket) {//AzFramework::SliceInstantiationResultBus::MultiHandler::BusConnect(ticket);}if (newEntity){LmbrCentral::SpawnerComponentRequestBus::Event(newEntity->GetId(), &LmbrCentral::SpawnerComponentRequestBus::Events::SpawnSliceAbsolute, sliceAsset, transform);}}}}SharerePost-User-2514050answered 5 years ago"


Question: AWS CLI ECS WAIT Command in Jenkinsfile

"Hi guys,I've pipeline for creating ecs services. As you know, when you use 'aws ecs run-task' the command does not wait until running process it gives output immedeately. You could use sleep 300 command etc to wait updating ecs status to running state.I found this command on cli aws ecs wait tasks-running --cluster ${clusterName} --tasks ${TASK_ID}But it givesWaiter TasksRunning failed: Waiter encountered a terminal failure stateORWaiter TasksRunning failed: Waiter encountered a terminal failure state: For expression "tasks[].lastStatus" we matched expected path: "STOPPED" at least onceAny idea?FollowComment"

Answer: "0Hello there,The error message is self-explanatory. It implies that one of the tasks in the task lists you are trying to wait on is in a STOPPED state.You should run the describe command below to confirm all the task status and see the one in stopped state while that error message is still being reported for the aws ecs wait tasks-running command:% aws ecs describe-tasks \    --cluster ${clusterName} \    --tasks ${TASK_IDS} \    --query 'tasks[*].containers[*].[lastStatus,taskArn]' --output textFor more info on this command, refer to the documentation here.CommentShareOlawale-AWSanswered 8 months ago0STOPPED one is okay I can understand the output. But the first one has not more output just  Waiter TasksRunning failed: Waiter encountered a terminal failure stateCommentShareKKDevopsanswered 8 months ago"


Question: RDS - Restore Oracle Database backup with another name / service name in the same instance

"Hello friends.I have created a new RDS instance for my Oracle database.It is an instance of homologation.I backed up my production database by exporting datapump.DBMS_DATAPUMP.open( operation => 'EXPORT', job_mode => 'SCHEMA'I uploaded my backup file to S3.Then, I downloaded the backup (exported file) from S3, to the Datapump of the homologation instance.Now, I'm trying to restore this backup, however, as it is an approval instance, I need to have more than one database, from the same application, that is, in the production environment, my database is called DBSYSTEM, and in my homologation environment, I need to restore this same database with other names in the same instance, like DBSYSTEM1, DBSYSTEM2, DBSYSTEM3...But here I can't move forward.DECLAREhdnl NUMBER;BEGINhdnl := DBMS_DATAPUMP.OPEN(operation=>'IMPORT', job_mode => 'SCHEMA', job_name => null);DBMS_DATAPUMP.ADD_FILE( handle => hdnl, filename => 'exp_dbsystem.dmp', directory => 'DATA_PUMP_DIR', filetype => dbms_datapump.ku$_file_type_dump_file);DBMS_DATAPUMP.ADD_FILE( handle => hdnl, filename => 'imp_dbsystem.log', directory => 'DATA_PUMP_DIR', filetype => dbms_datapump.ku$_file_type_log_file);DBMS_DATAPUMP.METADATA_FILTER( handle => hdnl, name => 'SCHEMA_EXPR', value=> 'IN (''DBSYSTEM'')');DBMS_DATAPUMP.METADATA_REMAP( handle=> hdnl, name => 'REMAP_SCHEMA', old_value => 'DBSYSTEM', value => 'DBSYSTEM2');DBMS_DATAPUMP.METADATA_REMAP( handle=> hdnl, name => 'REMAP_TABLESPACE', old_value => 'DBSYSTEM_DATA', value => 'DBSYSTEM_DATA2);DBMS_DATAPUMP.METADATA_REMAP( handle=> hdnl, name => 'REMAP_TABLESPACE', old_value => 'DBSYSTEM_INDEX ', value => 'DBSYSTEM_INDEX2');DBMS_DATAPUMP.START_JOB(hdnl);END;When executing the above statement, the following is returned:Bug report -ORA-39001: invalid argument valueORA-06512: in "SYS.DBMS_SYS_ERROR", line 79ORA-06512: at "SYS.DBMS_DATAPUMP", line 4929ORA-06512: at "SYS.DBMS_DATAPUMP", line 5180ORA-06512: in line 5Does anyone have any tips on how to resolve this issue?I thank!FollowComment"

Answer: "0Hello,From your query, I can understand that you are trying to restore a database in your instance using DATAPUMP and need to create multiple databases in the same instance using that backup. However you are getting some errors in performing the same.As you have mentioned that you are facing the following errors:ORA-39001: invalid argument valueORA-06512: in "SYS.DBMS_SYS_ERROR", line 79ORA-06512: at "SYS.DBMS_DATAPUMP", line 4929ORA-06512: at "SYS.DBMS_DATAPUMP", line 5180ORA-06512: in line 5I would like to mention that these errors are quite generic errors and can happen due to even a minor syntax error. This error does not give much information about what actually is going wrong, hence, I would suggest raising a support case with AWS Premium Support so that the issue can be troubleshooted further. You can refer the following article to raise a case with the AWS Technical Support team:[+] Contact AWS:https://aws.amazon.com/contact-us/Furthermore, you can refer the following documentation which mentions how you can use the DATAPUMP Utility for RDS Oracle while importing your backups:[+] Importing using Oracle Data Pump:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Oracle.Procedural.Importing.DataPump.htmlCommentShareSUPPORT ENGINEERVidit Singhanswered 6 months ago0Hi,  An ORA-39001 error indicates that a parameter in the calls to DBMS_DATAPUMP is invalid.In your case, The error stack indicates that the error occurs on line 5 of the PL/SQL block, indicating that one of the parameters in below line is incorrectDBMS_DATAPUMP.ADD_FILE( handle => hdnl, filename => 'exp_dbsystem.dmp', directory => 'DATA_PUMP_DIR', filetype => dbms_datapump.ku$_file_type_dump_file);Please check the dump file referenced in the DBMS_DATAPUMP.ADD_FILE  is correct and accessible, no permission issues etc.CommentShareRamSaM-RePostanswered 5 months ago"


Question: Unable to load .NET config sections into System.Configuration classes within an aws lambda function

"I would like to deploy an AWS lambda function using .NET Core. Much of the code is shared with other applications that are not lambdas. We use System.Configuration extensively throughout our code. However, we are unable to get lambda code to find and load configuration files.These are snippets from our application config file.<configSections>    <sectionGroup name="countryConfig">      <section name="countryConfiguration"               type="TTDomain.Configuration.Countries.CountryConfiguration, TTDomain_NETStandard"/>    </sectionGroup><configSections>......  <countryConfig>    <countryConfiguration configSource="Web.countryConfiguration.config"/>  </countryConfig>And then in C# code we do things likepublic static CountryConfiguration GetConfig()        {            return ConfigurationManager.GetSection("countryConfig/countryConfiguration") as CountryConfiguration;        }This all works just fine, except when deployed as a lambda function. We have many many such usages of various configurations throughout a large code base of assemblies shared to many contexts. Not being able to use this very basic .NET feature is creating a lot of re-work. Any ideas how to make it work without needing to touch all our C# code?ThanksFollowComment"

Answer: "1Hi Kevin,I suspect the issue is that you are using the Windows Compatibility Pack to leverage ConfigurationManager from your .NET Core application. Whilst the Windows Compatibility Pack makes it easy to port .NET Framework apps to .NET, it restricts those applications to only run on Windows. AWS Lambda is underpinned by Linux which means .NET Core applications that have Windows dependencies won't work.CommentShareBradanswered a year ago"


Question: Deployment stuck "In process."

"I am working on AWS Greengrass for deploying my code to a 32bit Raspberry Pi4 remotely. I have successfully downloaded the latest version of Greengrass nucleus. The aws version is 1.27.84. After uploading the code and granting permissions, my deployment status remains at "In Progress". Could anyone tell me why this is happening?Thank YouFollowComment"

Answer: "0Hi Nik. Please check the Greengrass nucleus and component logs for clues: https://docs.aws.amazon.com/greengrass/v2/developerguide/monitor-logs.htmlBased on what you find there, please consult the troubleshooting here: https://docs.aws.amazon.com/greengrass/v2/developerguide/troubleshooting.htmlAnd if you still can't solve it, please share what you want found out.CommentShareEXPERTGreg_Banswered 3 months ago"


Question: Exam with PSI could not verify ID

"I have an exam booked for 13:00 WAT today 17th-09-22 with PSI. during the check in, the proctor said the name on my ID (Popoola Olayinka Israel) is not the same as appeared on the portal (Popoola Israel).i presented 4 means of Identification, but unfortunately, all are with the middlename.I was unable to sit for the exam.On the demographic page of AWS training, there is no slot for middlename, hence the confusion.What do I do next. I hope I wont have to pay another exam fee for this.Kindly advise and helpFollowComment"

Answer: "0Hello,Please reach out to the AWS Certification Support Team here: https://support.aws.amazon.com/#/contacts/aws-trainingUnfortunately there is no assistance that can be provided through re:Post.CommentShareEXPERTChris_Ganswered 9 months ago"


Question: Expected response code "250" but got an empty response

We're experiencing Symfony\Component\Mailer\Exception\TransportException - Expected response code "250" but got an empty response from queued jobs when sending email using Amazon SES. This happens randomly appears to cause some of the emails to stop sending once the initial error occurs. Restarting the queue worker fixes it but inevitably the problem re-occurs again.FollowComment


Question: MWAA - Sentry Integration

"Hey,We had our Airflow system setup with Sentry monitoring before migrating to MWAA, we would like to keep using Sentry for critical errors along with Cloudwatch for usual logs.We added the Sentry requirement to requirements.txt and also added the configurations as in the airflow documentation:sentry.sentry_on=Truesentry.sentry_dsn=<OUR_SENTRY_DSN>When we update our system with these configurations ( we were able to get some alerts from MWAA in Sentry ), but after a while we stop getting them and we get a update failed message ' Update failed' (INCORRECT_CONFIGURATION).Does anyone have a hint on what's happening? Why we get alerts for a while and then stop getting them and update fails?This should be a quick and simple integration.Best RegardsFollowComment"

Answer: "1MWAA does not currently install requirements on the web server which may be causing the creation failure when the web server tries to communicate with Sentry.CommentShareJohn_Janswered a year agoAWS-User-6269177 a year agoThe referenced docs claim that MWAA v2.2.2+ will install requirements such as Sentry on the web server. Unfortunately we have observed that this issue persists on v2.2.2. When can we expect Sentry configuration to be functional in MWAA?ShareJohn_J 8 months agoNote the above was true as of Airflow 2.0.2 support.  As of Airflow 2.2.2, requirements are installed on the web server.  Note that if the libraries are required on a private web server you will need to package them as WHL filesShare0Accepted AnswerWe confirm Sentry works in MWAA v2.2.2, these are the steps to get it working:First add Sentry to your requirements.txt file:apache-airflow[sentry]==2.2.2Then set in your MWAA Configuration options:sentry.sentry_on  Truesentry.sentry_dsn  <YOUR_SENTRY_DSN>CommentShareAWS-User-8775889answered a year ago"


Question: Restore EC2 Instance

"Hi, I got a virus attack on my server. I didn't set up any backup. Its attacked on 18th August.Now I would like to restore my server on 17th august, so I can get back my files.Is there any way to achive this?FollowComment"

Answer: "2Hello, If you weren't leveraging EBS snapshots via Data Lifecycle Manager or AWS Backup to make backups of the EC2 instance, there's unfortunately no way to restore the prior state of an EC2 instance.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.htmlhttps://aws.amazon.com/getting-started/hands-on/amazon-ec2-backup-and-restore-using-aws-backup/I'd highly recommend implementing one of those two options so you can restore to a previous state in the future.CommentShareEXPERTRob_Hanswered 9 months agoEXPERTChris_Greviewed 9 months ago0Please raise a support ticket for this issue. In this forum we don't have access to your account information, identity or any AWS resources that you're running but the support team does and can help you determine what has happened.Did you take backup or had snapshots/Read-Replicas etc in any other region to take the backup from ?CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months ago"


Question: How to configure Redis Client (Lettuce) to handle primary/replica failover ?

"We have ElastiCache Cluster (5 shards, primary+replica in every shard), auto-failover enabled.Yesterday we encountered failover situation, one replica was promoted to primary, however our redis client (lettuce) was not able to discover new topology, and a lot of (all for that one particular shard?) PUT and DEL operations were failing with:Caused by: io.lettuce.core.RedisCommandTimeoutException: Command timed out after 2 second(s)How to configure client to handle such situation? Is enablingClusterTopologyRefreshOptions.builder()            .enablePeriodicRefresh(Duration.ofSeconds(30))            .enableAllAdaptiveRefreshTriggers()enough ?To connect, we use name configured in DNS CNAME record in route53 that points to cluster url (Configuration endpoint from redis configuration)FollowComment"

Answer: "0Hello,A successful failover flags the malfunctioning node as failing and promotes the replica to primary.Clients are supposed to refresh cluster topology in periodic intervals (enablePeriodicRefresh) and in response to specific events (enableAllAdaptiveRefreshTriggers). Your configurations look good in these aspects.The Elasticache cluster endpoint returns all nodes in the cluster (10 nodes in your case), and any healthy node can be used to refresh the client topology. I am not an authority on Lettuce, but based on your description, it looks like the client persisted trying to contact the failing node instead of refreshing the topology and route requests to the healthy nodes.You may want to set lower timeouts in your socket options and make sure that dynamicRefreshSources is true.Additionally, make sure that you have an up-to-date Lettuce version. I've found bug reports addressing issues while refreshing cluster topology in versions not that old.Maybe not directly related to your question, but I would advise against using custom DNS names in front of the Elasticache DNS endpoint. Improper caching may keep the records for longer than ideal and cause trouble in case of scaling or even failover. Although not common, nodes IPs may change in exception conditions during failovers.Same is valid for client-side DNS caching, on Operating System or JVM level.The following blog post provides additional best practices for Redis clients, and provides examples for Lettuce:https://aws.amazon.com/blogs/database/best-practices-redis-clients-and-amazon-elasticache-for-redis/I hope my response has been helpful to you.CommentShareSUPPORT ENGINEERTulio_Manswered 3 months ago"


Question: Next js on Amplify 500 Internal Server Error.

"When I use getServersideprops in my next js app which I deployed on AWS Amplify, I often get 500 Internal Server Error when I use page with fetching data. How to solve this problem?FollowComment"


Question: API Gateway 524 Response

"I have an endpoint in API Gateway that I POST to, and most of the time it is successful. However, sometimes I'll receive status 524 in response with no message.  Does anyone have any insight about this? I haven't been able to find any documentation related. Thanks!FollowCommentManikandan a year agoMay I know what is the target for your API Gateway?Sharecalvin-summer a year ago@Manikandan yes, the target is a lambda function. if it helps, I'm using HTTP API.Share"

Answer: "0Looking for error 524, it seems it is a CloudFlare timeout error. Do you have CloudFlare in front of your API? The default timeout is defined as 100 seconds.CommentShareEXPERTUrianswered a year agocalvin-summer a year agohey! sorry for the delayed response. I was on PTO. I looked into it and yes we do have CloudFlare in front. Per the docs for that error, it is due to no response from AWS APIGateway within 100 seconds. Is there any reason our call to API Gateway would hang for 100+ seconds without any response? I can't find anything about that with my searching.Share"


Question: Account Blocked. Cannot start new instances

"I've been using AWS for a good half a year without any issues, but after spinning up several new instances I received this automated email from AWS yesterday:"Subject: Action Required: Irregular activity in your AWS accountSeverity: UrgentCorrespondence: Dear AWS customer,Your AWS Account may be compromised. Please review the following notice and take immediate action to secure your account."And now when I try to start my instance I am shown with this notification:"This account is currently blocked and not recognized as a valid account. Please contact aws-verification@amazon.com if you have questions."And of course, both AWS Support and aws-verification@amazon.com have not replied after one full day. Does AWS even have support staff these days?FollowComment"

Answer: "0great job AWS, no responses at all after ~48 hours for a case with Severity "Urgent business impacting question"CommentSharest6445answered 2 years ago072 hours and counting..CommentSharest6445answered 2 years ago0Hi there,I have sent you a private message, please look into the same.thanks!CommentShareSanjnaAWSanswered 2 years ago0I got the same issueCommentShareHAYYASanswered 2 years ago0been close to 6 days, still no resolution. well done AWS!!!CommentSharest6445answered 2 years ago0My grandkids are already starting to have their own grandkids.. come on AWS keep me waitingCommentSharest6445answered 2 years ago0accidental double-postEdited by: st6445 on Nov 22, 2021 4:07 AMCommentSharest6445answered 2 years ago0One full week later, still no correspondence from AWS support or any resolution.CommentSharest6445answered 2 years ago0resolved after 9 days or so; disappointing slowCommentSharest6445answered 2 years ago"


Question: Does S3 Cross Account replication happens over Public Internet or Private Network of AWS backbone

"Hi,I would like like to know when we do S3 cross account replication (irrespective if the objects are encrypted or not) then may I know if the replication happens over public Internet or it uses Amazon backbone private network? Any documentation reference links which confirms this?ThanksFollowComment"

Answer: 0I think S3 Cross-region replication works on the private aws backend. So this is usually used for replication of buckets across and within regions.CommentSharerePost-User-3162014answered 8 months ago


Question: "Elasticache NetworkBandwidthOutAllowanceExceeded m5.xlarge, m5.2xlarge, m5.4xlarge"

"Hi,We were running Elasticache m5.xlarge till last week. We found some latency with Redis requests, when we checked the metrics, there seems to be no issues with CPU and Memory. And we found that, there were some values for NetworkBandwidthOutAllowanceExceeded. So we increased changed Elasticache instance type from m5.xlarge to m5.2xlarge. Even after that we were still seeing some values for NetworkBandwidthOutAllowanceExceeded.So,We upgraded Elasticache to m5.4xlarge, we still see the metric NetworkBandwidthOutAllowanceExceeded is showing some values.In last 12 hours, the peak NetworkBytesOut is 2970304512, when I converted this into Gigabits per second, I get, 0.368841553.Baseline Bandwidth for m5.4xlarge is 5Gbps. So, 0.368841553 is less than 5. But still we are seeing NetworkBandwidthOutAllowanceExceeded.Can someone help me in understanding if the metric shows correct values?NetworkBandwidthOutAllowanceExceededFollowCommentKarthikeyan Sundararajan a year agoOkay, AWS Support confirmed that there is a bug with this metric.Share"

Answer: "0Hello Karthikeyan,Are you still having issues with the NetworkBandwidthOutAllowanceExceeded metric? Please let us know.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago"


Question: Barge-in Live conversation Failed || Amazon Connect

Barge-in Live conversation Failed with error code 429.Attached screenshot.I have reviewed my all configuration & rights which looks fine still issue persist.FollowComment

Answer: "0429 is a throttle error. Are you doing this via a custom app? Can you double check that this happens on other browsers? Any chance multiple people are monitor at the same time?DavidCommentSharedmaciasanswered 2 months agorePost-User-2551109 2 months agoHi David,No, i'm not using any custom app. I also tried multiple browsers but it's still same.No only one person try to barge in a conversation but still issue persists.Share0Please make sure CCP of supervisor is opened as to Barge-In supervisor will be receiving contact on CCP. If Eye button is pressed twice it can result POST 429 -- Too many requests errorCommentSharerePost-User-007answered a month ago"


Question: Lorawan support for IN865 region

"Hi, when would AWS lorawan network server support IN865 region? Its been over year since the initial release and would be great so see this implemented.FollowComment"

Answer: "0I am so sorry for the delay. As per my understanding there is already a feature request in place to allow connecting to gateway using IN865 frequency and our internal IoT service team is actively working on it. Unfortunately, I am unable to provide you with an ETA on if and when such functionality will be available for you to use. I would suggest to follow AWS IoT news blog for latest news and feature releases within Amazon.https://aws.amazon.com/blogs/aws/category/internet-of-things/With that said, for a workaround you could consider using a possible option if it fits your use case would be to use a Lora gateway for the devices to connect to and then use the gateway to send the data over MQTT to AWS, however this approach would require TCP/IP connectivity solution on the gateway. We don't have any documentation or step by step guide on this approach as implementation of this scenario might differ depending on the use case specifics.CommentShareSUPPORT ENGINEERNirmal_Kariaanswered a year ago0Hi,Is there any update on the feature request for IN865 frequency support in AWS IoT for Lorawan?CommentSharebinayakanswered a year ago"


Question: aws.iot.SiteWiseEdgeCollectorOpcua: Failed to start OPC-UA Connection for Source (OPC-UA): Failed to obtain Secret from Greengrass IPC

"Hello,I have deployed Greengrass as a Docker container from the official Docker Hub page: amazon/aws-iot-greengrass:2.5.3-0I run it and deployed on it basics Greengrass components, it runs fine, and deployed also IoT SiteWise most recent components.But the component SiteWiseEdgeCollectorOpcua is logging this error when it starts:OpcUaManagedConnection - {"message":"Failed to start OPC-UA Connection for Source (OPC-UA): Failed to obtain Secret from Greengrass IPC"}I am pretty sure the rest of the IoT SiteWise deployment is correct, since it's quite basic, and I already deployed the same things previously on a Linux deployed Greengrass and it worked fine.I tried to understand what this could be related.For sure it is not related with the permissions given to the IAM Role used by Greengrass, since it currently has all permissions to operate on my AWS account just for debugging this.To avoid networking issue i also run the container with the option --network host so that it can open all needed local ports and connections.My only suspect right now is the fact that I see the docker version of Greengrass is not updated since 1 year!Is it supposed to work? Maybe it is not compatible with latest Greengrass components or SiteWise most recent ones?Does someone know the solution to this?Let me know in case I need to provide more information.Thank you very much in advance for your support!FollowCommentFrancesco 3 months agoMaybe I need to add additional environment variables to the Greengrass container not specified on the DockerHub page?There is no much documentation about Docker deployments of Greengrass.Share"

Answer: "0Hi Francesco,The error indicates that the secrets are not available on the edge device. Most probably secret manager is not able to fetch the secrets.  It seems like you are configuring data source authentication. Here is a step by step guide for that - https://docs.aws.amazon.com/iot-sitewise/latest/userguide/configure-source-authentication-ggv2.html#create-secrets-ggv2.There could be multiple reasons for this failure:1. The Greengrass core device doesn't have policy to get secret value from cloud.2. Either the secrets manager is not configured at all or its configured with the incorrect Secrets ARN.3. The data source was added with wrong secrets.Please verify following on your end and see if they are configured as expected:1. Does the IAM role for your greengrass core device allow the "secretsmanager:GetSecretValue" action?2. Is the expected secret's ARN configured in the secret manager component's configuration at the time of the deployment? (https://docs.aws.amazon.com/iot-sitewise/latest/userguide/configure-source-authentication-ggv2.html#deploy-secrets-ggv2)3. Has the data source deployed with the secrets that were configured in step #2?You can also check the greengrass.log and  aws.greengrass.SecretManager.log files (located in/greengrass/v2/logs) to see if there are any warning/errors reported with respect to secret manager such as  retrieving secrets, assuming a role etc.CommentShareKurtAtAWSanswered 2 months ago"


Question: Load time of a MediaPackage livestream

"Hello,We experience very slow loading for ".m3u8" endpoints generated in MediaPackage. It can take up to a minute to show the livestream.Is there a way to improve the player loading time even by adding some delay of some sort?We use Apple HLS with default configuration:{  "Id": "endpoint-camera-4",  "ChannelId": "output-camera-4",  "Description": "",  "StartoverWindowSeconds": 0,  "TimeDelaySeconds": 0,  "ManifestName": "index",  "White...list": [],  "HlsPackage": {    "SegmentDurationSeconds": 6,    "PlaylistWindowSeconds": 60,    "PlaylistType": "EVENT",    "AdMarkers": "NONE",    "AdTriggers": [      "SPLICE_INSERT",      "PROVIDER_ADVERTISEMENT",      "DISTRIBUTOR_ADVERTISEMENT",      "PROVIDER_PLACEMENT_OPPORTUNITY",      "DISTRIBUTOR_PLACEMENT_OPPORTUNITY"    ],    "AdsOnDeliveryRestrictions": "RESTRICTED",    "ProgramDateTimeIntervalSeconds": 0,    "IncludeIframeOnlyStream": false,    "UseAudioRenditionGroup": false,    "IncludeDvbSubtitles": false,    "StreamSelection": {      "StreamOrder": "ORIGINAL"    }  },  "Origination": "ALLOW"}FollowComment"

Answer: "1What is the source that is providing the input HLS stream to AWS MediaPackage? Is it AWS MediaLive or some other encoder? MediaLive (perhaps other encoders as well) may take time to start the encoding channel that provides the HLS segments to MediaPackage. Please verify that the encoding source channel is running before checking MediaPackage endpoints.Also, please note that MediaPackage endpoints should not be used to provide HLS streams to public viewers directly. A CDN, such as CloudFront, should be used to deliver HLS content from MediaPackage endpoints.CommentShareMike-MEanswered a year agoREKAP a year agoYes we use AWS MediaLive as the input source. I will check on creating a custom CloudFront to deliver the streaming output. Thanks!Share0Depending on the player used, players usually have to cache 3 segments before starting to play the live stream. Try to reduce the segment size to reduce the amount of time the player is downloading segments before starting to play the live stream.CommentShareNuno_Qanswered a year ago"


Question: way to control appstream fleet hostname

"How can I control the hostname generation for appstream 2.0 ? When I have a fleet of windows instances that are scaling on a regular basis, how can I control hostname given to the appstream fleet instances so I dont have zombie AD objects in my AD ?FollowComment"

Answer: "3There is no way to assign a specific name to AppStream 2.0 computer objects. The objects have a specific description attribute which can be used for cleanup processes. The documentation can be found here: https://docs.aws.amazon.com/appstream2/latest/developerguide/active-directory-admin.html#active-directory-identify-objects.Additionally it is a best practice to use a dedicated OU or sub-OU for your AppStream instances to allow for easy identification and AppStream specific group policy objects.CommentShareJustin_Ganswered 10 months ago1You can't specify the hostnames for AppStream 2.0.As a best practice, specify a separate OU for AppStream 2.0 computer objects. https://docs.aws.amazon.com/appstream2/latest/developerguide/active-directory-admin.html#active-directory-oudnAppStream 2.0 does not delete computer objects. You can clean them up on a periodic basis like you would other computer objects.https://docs.aws.amazon.com/appstream2/latest/developerguide/active-directory-admin.html#active-directory-identify-objectsCommentShareJeremy_Sanswered 10 months ago"


Question: Kinesis Firehose Delivery Stream - S3 - JSON

I've got a client writing JSON to a Kinesis Stream with an S3 Firehose Destination. The resulting files have multiple JSON documents within (eg. {"data": "JSON Payload 1"}{"data": "JSON Payload 2"}{"data": "JSON Payload 3"} - which means it's not valid JSON and I can't easily rehyrdate it. Other than switching to something like a Lambda to specifically emit one file per document or switching to a format like YAML which would allow multiple documents per file is there a configuration within the delivery stream that will yield 1 file per document?FollowComment

Answer: "0What you are referring to is the JSON lines format and is a valid format for storing JSON documents - https://jsonlines.org/Have you tried using S3 Select - https://docs.aws.amazon.com/AmazonS3/latest/userguide/selecting-content-from-objects.htmlIt provides the ability to query JSON linesYou can try it from the Amazon S3 console as well as using SDKs.The following page provides example code in Java and points to blogs for Javascript and Python examples - https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-select.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 10 months agoEXPERTUrireviewed 10 months ago0Firehose adds end of line characters and each JSON message is stored in a separate line. Each individual file is a combination of mutiple JSON records. You could programmatically read the file and if you read it line by line, that should work in parsing each JSON object.If each record were written into multiple files, we will create multiple small files and small files impede performance (too much latency) for data analytics - whether you are using Spark/Hadoop/Presto or Amazon Athena. The way to address this “small files” issue is via compaction – merging many small files into fewer larger ones. This is the most efficient use of compute time; the query engine spends much less time opening and closing files, and much more time reading file contents.CommentShareAnanth Tirumanuranswered 10 months ago"


Question: AppSync Cognito Group and Secret Access

"I have an API with three different access modes: IAM, Cognito Users, and Cognito applications (using a secret). I am able to configure everything fine, for example, here's a field:type SomeMutation @aws_iam @aws_cognito_user_pools {    update(input: MutationInput!): Boolean!    @aws_cognito_user_pools(cognito_groups: ["EDITORS"])}However, I'd also like to allow a specific server side application client to access this API. This is a client that has a client_id and client_secret, and can get a token using those values. If I don't limit based on groups, the calls from this client work fine, but as soon as I create a group restriction, the app client is no longer authorized. Ideally, I'd like to be able to configure the authorization as follows (by including an authorized client_id):type SomeMutation @aws_iam @aws_cognito_user_pools {    update(input: MutationInput!): Boolean!    @aws_cognito_user_pools(cognito_groups: ["EDITORS"], cognito_clients: ["abcdefg"])}But I don't see any indication that this kind of control is possible. Will I have to write some custom authentication?FollowComment"

Answer: "0Hello,For answering this query I would like to touch upon the usage of Cognito Userpool Groups firstly ->In regards to Userpool Groups native functionality, you can use groups to control permissions to your resources using an IAM role.When you create a group in Amazon Cognito, you specify an IAM role by providing the role’s ARN. When group members sign in using Amazon Cognito, they can receive temporary credentials from the identity pools.Also note that individual users can be in multiple groups but you can assign precedence values to each group. The group with the better (lower) precedence will be chosen and its associated IAM role will be applied.Please feel free to read more about the UserPool Groups on our AWS Doc here [1].To summarize - The native functionality of Cognito Userpool groups is seen when integration Cognito Identity Pool with Userpool to determine which IAM role credentials are vended out.Now in regards to using groups for API permission control, as you may know that a group is actually a part of ID token or access token. Hence, you can choose to decode the JWT token [2] and create a custom authorizer based on the fields you are interested in.For example, here's an ID token with groups field ("cognito:groups") -{  "at_hash": "D-XXXXXXXXXXXXXXXXxOw",  "sub": "226XXXXXXXXXXXXXXXXXXXXXXXXd",  "cognito:groups": [    "test1"  ],  "email_verified": true,  "cognito:preferred_role": "arn:aws:iam::7XXXXXXXXXXXX:role/AdmXXXXXXXXple",  "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_XXXXXXXXX3",  "cognito:username": "test1",  "cognito:roles": [    "arn:aws:iam::7XXXXXXXXXXXX:role/AdmXXXXXXXXple"  ],  "aud": "3XXXXXXXXXXXXXXXXXXX",  "token_use": "id",  "auth_time": 1654193387, ....}Now, as you might know you can submit an ID or access tokens with requests to Amazon API Gateway and use an Amazon Cognito user pool authorizer for a REST API.I have mentioned about the flow in detail on another RePost Query as well which you can check here.If you are looking to use an authorization in terms of fields such as clients etc, then you want to look at Lambda authorizers [3] formerly known as custom authorizer. Basically, a Lambda authorizer is useful if you want to implement a custom authorization scheme that uses a bearer token authentication strategy such as OAuth or SAML, or that uses request parameters to determine the caller's identity.Also please note if you are looking for any custom solution/code queries, then these are best answered by the Cognito developer team who you can reach out using Github directly.https://github.com/aws-amplify/amplify-js/tree/master/packages/amazon-cognito-identity-jsWe also have the dedicated AWS Solutions Architect team which addresses the architecture and design level queries for custom solutions. I would suggest you reach out directly to our Sales team as they can help you to get in touch with our Solutions Architect (SA) team.You can request for a member of the sales (Business Development) team to contact you using any of the following methods:> Via form:    http://aws.amazon.com/contact-us/aws-sales/> Via Live Chat:   https://pages.awscloud.com/live-chat-contact-us.html> Phone support:   +1 (833) 662-9873 - 6:30am - 4:00pm (Pacific) Monday - Friday.Finally, if you run into any issues while trying to implement the solution or run into any errors, please feel free to open a support case with premium support team so that you can share your AWS resources for troubleshooting. Please note that development/architectural queries go out of scope for the Premium Support team as we are only expertised in troubleshooting of break fixes and errors with the AWS service when customers run into errors during implementation phase. In cases of finding a viable solution for considering scalability, security and limitations, reaching out to the Solution Architects or Dev team can help in assessing the viability and building of the solution as per your requirements.References:[1] https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-user-groups.html[2] https://aws.amazon.com/premiumsupport/knowledge-center/decode-verify-cognito-json-token/[3] https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.htmlCommentShareSUPPORT ENGINEERYash_Canswered a year agoJonNicholsXM a year agoThat really doesn't answer the question in regards to AppSync. I understand how Cognito works, and yes, I can use my own authorization logic to validate it. My question was whether it was possible to validate both groups and application clients, but to the best of my understanding, that isn't possible.Share"


Question: Is it possible to block web traffic (access to external sites) from AppStream Instance?

"A customer is using AppStream to serve its customers.They want to know that when their customer is connected to the AppStream instance, is it possible to block access to certain external web sites?FollowComment"

Answer: "0Accepted AnswerAppStream by default does not manage or control the network route the user accesses. However, customers can specify security groups to apply to the ENIs that AppStream creates/uses. There are on-instances ways of managing network access, but they're usually able to be circumvented and not easy to manage. If the customer has a well-known set of endpoints the user needs to connect to, the better approach would be to use network security groups to whitelist only those endpoints. That way the instance via network can only access them.Another approach would be to use a proxy server, which many enterprises use, to control access to the internet.CommentShareEXPERTMuraliAtAWSanswered 3 years ago"


Question: CloudFront client side 504 error

"I am accessing a web site that has real estate mls data. They use CloudFront as their cdn for images. On my computer I am getting the below error trying to load an image. On my wife's computer, right next to mine, on the same network, the images display normally. Tried multiple browsers with the same result. Anyone know why this might be happening? Thank you!504 ERRORThe request could not be satisfied.CloudFront attempted to establish a connection with the origin, but either the attempt failed or the origin closed the connection. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.Generated by cloudfront (CloudFront)Request ID: RmFHMe11uQ9UvwKZUt7s6EJ7nNuFJxR4j00jQMy9qsIwM5E0ACD_Sw==FollowCommentA-Shevchenko a year agoThere is some possibility that content for your wife's computer is cached (either on computer or on CloudFront for specific cookies/headers). I'd recommend to give a try with different client (PC which never accessed it before or mobile phone / tablet)Share"

Answer: "0Thank you for your answer! I think any configuration there would affect all my computers the same. It must be something specific to my computer. All of my computers are running Win 10. I've tried setting up a new profile in Edge but that made no difference. Also gets the error in Firefox and IE. I'll try creating a new user on my computer later and see if that works. CF does not have the capability to block a specific computer, does it?CommentShareAWS-User-7398923answered a year agokentrad EXPERTa year agoYou can block IP addresses and Bots via WAF ACLs, but that would give a different error code. I wonder if your CF logs would provide any clues?Share0It could be related to how CF is configured to cache errors.https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/GeneratingCustomErrorResponses.html#custom-error-pages-expirationCommentShareEXPERTkentradanswered a year ago0Update: Apparently there are numerous users having the same issue and the vendor is in contact with Amazon about it. Still don't have any idea why some users would be affected and others are not.CommentShareAWS-User-7398923answered a year ago"


Question: [bug report] I think this is an IAM bug.

"Proceed as follows:STEP 1 : create an inline policyName : testPolicy : ELBSTEP 2 : Declare differenct policies with the same nameName : testPolicy : API GatewaySTEP 3 : Confirm that the existing policy has disappeardName : testPolicy : API GatewayYou can see that the existing test/ELB poilcies have disappearedIn places other than inline-policy, duplicate declarations are prohibited.In this regard, I thought it was a bug and contacted the customer center, and the customer center told me to contact me here. Isn't it a bug to delete an existing policy from an inline policy?I also got a response that it's not a bug to use the API like this: https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutUserPolicy.html I think that things that are deleted from the web should be eliminated even if it is not at the API level.FollowComment"

Answer: "1Hello,The behaviour observed here is an expected behaviour by design. When adding another inline policy to an IAM identity, ensure that the policy name is unique. If the new inline policy uses the same name as an existing inline policy, the new policy will overwrite the existing policy.We have received feedback from our customers in regard to this behaviour and there's an already created feature request to improve the behaviour in future.CommentShareSUPPORT ENGINEERVarunanswered 7 months ago"


Question: Is there a possibility SNS topic subscription can filter messages based on custom message header ? And Does SNS supports message grouping ?

"Currently based on aws documentation I don't see that SNS supports header based routing. Would like to know if it can provide such functionality in future.Another question is , does SNS supports message grouping ?FollowComment"

Answer: "1Hello, good questionFor the first part, may be filter policies can be used (Note: A filter policy can have a maximum of 5 attribute names and Amazon SNS ignores message attributes with the Binary data type.)https://docs.aws.amazon.com/sns/latest/dg/example-filter-policies.htmlThe following is for the second part of the questionSNS seems to support publishing batches of up to 10 messages in a single API requesthttps://aws.amazon.com/about-aws/whats-new/2021/11/amazon-sns-supports-publishing-batches-messages-single-api-request/Blog post: https://aws.amazon.com/blogs/compute/publishing-messages-in-batch-to-amazon-sns-topics/CommentShareSrianswered a year ago"


Question: Run Container image Lamda with runtime args

"I need to run a container image in a lambda. For each run, I have to supply it a runtime application config file. How can I supply this runtime application config file?I do not want to rebuild the docker image for each run because there are no code changes; I just want to be able to run the same code, same lambda with a different application config-file.ThanksFollowComment"

Answer: "2Accepted AnswerThere might be couple of options -Use persistent storage, such as EFS, S3 or /tmp directory in certain scenarios;Refactor and leverage ENV in dockerfile, for exmaple;(Strongly Recommended) Refactor and use SSM Parameter Store or Secret Manager.CommentShareJason_Sanswered a year agoJason_S a year agoHi - Just to clarify, your main concern is don't want to rebuild the Lambda custom image that is part of a Cfn custom resource?If so, is it possible to have your Lambda function in a separate CloudFormation template and reference the ARN?Also where is the config file you are referring to stored right now?ShareAWS-User-7657011 a year agoThanks for the answers. I have a follow-on question please.I am using a cloudformation custom resource to invoke this lambda whenever there is changes to my config file. In other words it is invoked whenever the custom resource is created, updated, or deleted, AWS Cloud formation calls this lambda. Each invocation of this lambda will use a different config. I have to make this config accessible to this lambda created in the cdk. It is a large config file, I cannot put contents of this config into env variablesconst myHandler = new NodejsFunction(this, "myHandler", {  runtime: Runtime.NODEJS_14_X,  entry: "<entry>",  handler: "handler",  vpc: <vpc>,  securityGroup: <sg>,  functionName: "<funcName>",  timeout: Duration.minutes(10),  environment: {    <env variables>  },  role: <role>});ShareAWS-User-7657011 a year agoSo, my current situation is I have a custom resource defined like this.new CustomResource(this, "Resource1", {  serviceToken: myProvider.serviceToken,  properties: {    configsList: <list of config items>  }});Whenever the properties.configList changes the lambda function is invoked when I run cdk deploy. If there are no changes to the configsList then the lambda is not called.This is working well when my lambda is a nodejs function.But now my lambda is a container that I need to run and supply this configsList to it as a file. I am unable to figure out a way to do this.Share0In addition to Jason_S's answer:Make use of AppConfig - AWS service for managing and deploying configurationsCommentShareAWS-User-6196864answered a year ago"


Question: Amazon SES hotmail and live delivery error

"We use amazon SES as relay host, but our customers can not send invoices (we provide an application than generate invoices) to their customers that have an hotmail, live email.Our new users who try to sing up to our platform cannot activate their accounts from that email providers too.I checked if the ips was blocked on microsoft or listed in spamcop.net but they are not.Please help.FollowComment"


Question: Static Bootstrap website hosting - build issue

I have a static bootstrap website in codecommit. This is a simple HTML/CSS bootstrap website and does not have REACT. CSS and images in assets folder is not being displayed.Folder file structurecodecommit folder/index.htmlcodecommit folder/assets/img/*codecommit folder/assets/font/*codecommit folder/assets/css/*Default build settingsversion: 1frontend:  phases:    # IMPORTANT - Please verify your build commands    build:      commands: []  artifacts:    # IMPORTANT - Please verify your build output directory    baseDirectory: /    files:      - '**/*'  cache:    paths: []FollowComment


Question: Increased amount of writes after adding a replica to a non-empty table

"Hi!We've been using DynamoDB for quite some time already and never had any issues with it. We've never used global tables though. Yesterday we decided to add a new replica to a table in us-west-2. The table already contained ~60 million items totalling ~31 GB.The whole process of adding a new replica was very smooth, taking around 2 hours, no problem there. The weird stuff started to happen after the replica was created. I expected that both replicas would have roughly the same amount of writes that would correspond to the number of writes done by our application. But some crazy things started to happen with the original replica. The amount of writes increased significantly there even though the traffic coming from our application didn't change (see the attached picture). And the application still works only with the original replica in us-west-2.Does anyone know where these additional writes come from?FollowComment"

Answer: "0We've found the cause of the issue, so just in case anyone gets into the same trouble - the increased amount of writes is caused by propagation of TTL delete events.CommentShareoperutkaanswered 3 years ago"


Question: Updating data in governed tables

"Are governed tables insert/append only?  Is it possible to update data already in the table?  https://aws.amazon.com/blogs/big-data/part-3-effective-data-lakes-using-aws-lake-formation-part-3-using-acid-transactions-on-governed-tables/ has a good example of inserting data, but it doesn't look possible to define a primary key  to be able to dedupilcate data if you did another insert on the same row or a way to do an update.ThanksFollowCommentAWS-User-5606360 a year agoI see that for update-table-objects the etag is required "The Amazon S3 ETag of the object. Returned by GetTableObjects for validation and used to identify changes to the underlying data." so does that help with updates? What about with compaction when that s3 file doesn't exist and was compactedShare"

Answer: "0Hi,Lake Formation Governed Tables support object level ACID transactions. Record level transactions are not currently supported.hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year ago0It appears that the development team is still working on the update table method to support appends on Governed Tables. They are targeting Q1 2022 to have this feature complete. So as of now, there is no method that you can use out of the box to do an update based on the primary key.CommentShareAWS-User-1287467answered a year ago"


Question: ECS networking mode: host vs awsvpc performance

I have a latency-sensitive service to deploy on ECS.I need to know which of this two networking modes offer the best performance: host or awsvpc. I understand that with host we bypass Docker networking entirely and the container attach directly to the network interface of the EC2 while with awsvpc a new network interface is created specifically for the container. Are there differences in performance?FollowComment

Answer: "0HI,Both host and awsvpc networking modes provide better performance when compared to bridge networking mode in a ECS environment as both of them utilize the EC2 network stack. Using the awsvpc network mode simplifies container networking, you have more control over how containerized applications communicate with each other and other services within your VPCs. The awsvpc network mode also provides greater security for your containers by enabling you to use security groups and network monitoring tools at a more granular level within your tasks. Because each task gets its own elastic network interface (ENI), you can also use other Amazon EC2 networking features such as VPC Flow Logs to monitor traffic to and from your tasks. Additionally, containers that belong to the same task can communicate over the localhost interface. It supports both Linux and windows bases containers and is also supported in case you use Fargate.RegardsCommentSharepavananswered 2 months ago"


Question: How does the DynamoDb Point in Time Recovery Works ?

"Hi there,I have few questions on Dynamodb PITR (Point in time Recovery) backup feature. Could you guys clarify on the followingHow often do the PITR backup scripts run ?Will the backup scripts run for every CRUD operation on the table ?It has been mentioned that we could go back to any point in time in the last 35 days, Incremental backup works in such a way that it takes the difference from the previous backup and current table and takes backup. So Won't we lose the initial data from the backups post 35 days ?How is the backup size per month being calculated and respective cost being calculated ?ThanksFollowComment"

Answer: "2The questions you ask are all leading to implementation detail. PITR is a continuous backup solution allowing you to restore to a new table from any point in time over the previous 35 days.How often do the PITR backup scripts run ?There are no scripts running, its a continuous backup.Will the backup scripts run for every CRUD operation on the table ?As aboveIt has been mentioned that we could go back to any point in time in the last 35 days, Incremental backup works in such a way that it takes the difference from the previous backup and current table and takes backup. So Won't we lose the initial data from the backups post 35 days ?There is no data loss at all.How is the backup size per month being calculated and respective cost being calculated ?DynamoDB charges for PITR based on the size of each DynamoDB table (table data and local secondary indexes) on which it is enabled. DynamoDB monitors the size of your PITR-enabled tables continuously throughout the month to determine your backup charges and continues to bill you until you disable PITR on each table.All of the information you should need can be found in this video:https://youtu.be/yvBR71D0nAQ?t=2042CommentShareEXPERTLeeroy Hannigananswered 6 months agorePost-User-3288232 6 months agoThanks for your response,Do you have any idea about the following question?If a table with "Point-in-Time Recovery" enabled is deleted from DynamoDB, is it possible to run a Point-in-Time restore for that table, and if so how?Share"


Question: Pinpoint might be using the legacy cloud messaging API for push notification

"I am trying to set up push notification for my chime app instance users and as AWS suggest was using Pinpoint to do so. While setting up Pinpoint application, it needs FCM Key API which is the Server Key. But Looks like the FCM API V1 unlike cloud messaging API do not seem to have the server key generated. I am not sure if pinpoint is actually expecting us to still use the legacy API? If not how do I generate the Server Key for the FCM V1 api? I tried using the Web API Key but it sends a 401 Access denied from Firebase server. Any help will be appreciatedImage -https://imgur.com/a/5FpAkuZFollowComment"


Question: Advantages of "Access key ID & Secret access key" over "Username and password"

"I understand in AWS, "Access key ID & Secret access key" is similar to "Username and password".While using/configuring CLI, "Access key ID & Secret access key" is saved in "credentials" file. So it is similar to saving "Username and password" in a plain text file.In CLI, technically we can use only "Access key ID & Secret access key", but not "Username and password".Apart from this, is there any advantages exists of using "Access key ID & Secret access key" over "Username and password" ?FollowComment"

Answer: "5Access keys are long-term credentials for an IAM user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK).As a best practice, use temporary security credentials (IAM roles) instead of access keys. Please refer to section "Use IAM roles instead of long-term access keys" in the following link for more details: https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.htmlCommentShareIrfan_Sanswered a year ago1It is a matter of what kind of access is needed.AWS requires different types of security credentials depending on how you access AWS. For example, you need a user name and password to sign in to the AWS Management Console and you need access keys to make programmatic calls to AWS or to use the AWS Command Line Interface or AWS Tools for PowerShell.Additionally, You can also create and use temporary access keys, known as temporary security credentials. In addition to the access key ID and secret access key, temporary security credentials include a security token that you must send to AWS when you use temporary security credentials.https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keysHope this helps.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered a year ago0AWS requires different types of security credentials depending on how you access AWS. The article understanding and getting your AWS credentials explains the various types of credentials and covers username/password and programmatic credentials.CommentShareRoBanswered a year ago0None of the answers really address your question other than saying "it's best practice to use keys instead of username/password". The intuitive response to your actual question is that programmatic access can be more prone to a user mistakenly exposing their access credentials. If that were to happen, the "blast radius" of exposing keys is smaller than exposing the password. Why? Because the keys are only useful for accessing AWS whereas a username/password could potentially be used to access other accounts (even outside AWS) owned by the user — either directly or by social engineering.CommentSharedatasithanswered 4 months ago"