Question: Enable RDS Encryption with minimal downtime after creation

"I have 2 RDS instances (one mysql and one postgres) and I need to enable encryption after they were already created. The DBs are large, and I am concerned about potential downtime required to create a snapshot, restore the DB, and then complete the warming process.I estimate it would take ~5 hours to create the snapshot (Postgres ~1.1TB) and ~24 hours for the mysql (~4.5 TB). Then there is time to restore from snapshot and warm the DBs, and then they'd need to (I'm assuming) catch up transactions that may be happening during that gap of time.I'm thinking I would need to make sure they have a multi-AZ DB. Then create a snapshot for the DBs, encrypt the snapshot and restore to a new RDS instance. Then, could I use AWS DMS do on-going replication for the DB to catch up the transactions and then flip over to the new DB when there is an available small window for downtime?Is there a better approach or recommendation?FollowComment"

Answer: "0Accepted AnswerIf you don't want to go the route of taking snapshot, encrypting it and then restoring it, the only option left is to do  replication to an encrypted RDS, either using DMS or by setting up binlog replication (in case of MySQL)  or WAL replication (using pglogical) in case of PostgreSQL.   You could set up a new set of instances that are encrypted, and then use logical database replication to copy the data over, and then cut over to the new instances once replication lag is 0.  DMS isn't really needed if you are transferring data from MySQL to MySQL or PostgreSQL to PostgreSQL.https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Replication.MySQL.htmlhttps://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Replication.Logical.htmlCommentShareEXPERTTim Gustafsonanswered 2 years ago"


Question: Custom Distributor Packages "failed to download installation package"

"Hi all,I have been playing with SSM Distributor packages in the hopes of managing various agents across the fleet. I have been able to build / compile a couple of different packages successfully.Unfortunately when I attempt to deploy them to instances, as per the doco, ie;aws ssm send-command --document-name "AWS-ConfigureAWSPackage" --instance-ids "i-abcdefghijk" --parameters '{"action":["Install"],"installationType":["Uninstall and reinstall"],"name":["CustomPackage"]}'I am receiving the following error;aws ssm get-command-invocation --command-id 1234567-8910-1112-1314-abcdefghi --instance-id i-abcdefghijk{    "CommandId": "1234567-8910-1112-1314-abcdefghi",    "InstanceId": "i-abcdefghijk",    "Comment": "",    "DocumentName": "AWS-ConfigureAWSPackage",    "DocumentVersion": "",    "PluginName": "configurePackage",    "ResponseCode": 1,    "ExecutionStartDateTime": "2020-04-01T04:33:03.700Z",    "ExecutionElapsedTime": "PT1.75S",    "ExecutionEndDateTime": "2020-04-01T04:33:04.700Z",    "Status": "Failed",    "StatusDetails": "Failed",    "StandardOutputContent": "",    "StandardOutputUrl": "",    "StandardErrorContent": "failed to download installation package reliably, , Get : unsupported protocol scheme \"\"\nfailed to download installation package reliably, , Get : unsupported protocol scheme \"\"\nfailed to download installation package reliably, , Get : unsupported protocol scheme \"\"\n",    "StandardErrorUrl": "",    "CloudWatchOutputConfig": {        "CloudWatchLogGroupName": "",        "CloudWatchOutputEnabled": false    }}The error occurs on all custom packages for both windows and linux instances. Packages published by AWS still continue to deploy successfully.Has anyone written any packages and run into similar errors?RESOLVED - For anyone interested, even though the documentation says otherwise, if you refer to your custom package by its arn rather than the short name you will no longer have the issue. ie,aws ssm send-command --document-name "AWS-ConfigureAWSPackage" --instance-ids "i-abcdefghijk" --parameters '{"action":["Install"],"installationType":["Uninstall and reinstall"],"name":["arn:aws:ssm:ap-southeast-2:123456789101:document/CustomPackage"]}'Edited by: beefsupreme on Apr 1, 2020 3:55 PMFollowComment"

Answer: "0Hi @beefsupreme,Thank you for your interest in AWS Systems Manager. We have been able to fix the issue that you have seen when executing Distributor package with short custom name. With this fix, you will be able to install or uninstall your Distributor package using short name or arn with no issues. Please feel free to try again.Apologies for any inconvenience this may have caused to you. Please do not hesitate to reach out to us at any time.Sincerely,YutingCommentShareAWS-User-8408345answered 3 years ago"


Question: Securityhub Dashboard for executive

"please has anyone been able to create a dynamic dashboard from securityhub that is executive presentable.i need help with that... what i have is currently not working .FollowCommentMickael-AWS 10 months agoHello, could you please explain what is your solution right now ? Thanks.ShareTony-Ilo 10 months agoi have Securityhub setup and i also have auto suppression configured to auto suppress alerts that we already have approval for... i read the documentations you shared, and what am trying to understand is why do we need AWS data glue when prowler implementation was straight from S3 bucket ?Share"

Answer: "2Hello,I recommend you take a look to the following blog post: Visualize AWS Security Hub Findings using Analytics and Business Intelligence ToolsIt explains how you can build AWS Security Hub Findings dashboards using either Amazon QuickSight or Amazon OpenSearch Service.You can then customize Amazon QuickSight dashboards or Kibana dashboards to fit your users.CommentShareMickael-AWSanswered 10 months ago"


Question: AWS codepipeline integration with SonarQube

"Hi Team,Would like to know the steps involved in "AWS codepipeline integration with SonarQube". If any implemented successfully can you guide?FollowComment"

Answer: "0Your SonarQube instance needs to be accessible from the pipeline environment.Basically you need have your sonar.login and sonar.host.url need to be fed into your pipeline.Here’s a dead simple buildspec.yaml that will run a Maven build and scan, then push results to a SQ instance:env:  variables:    SONAR_LOGIN: "SONARQUBE_AUTHTOKEN"    SONAR_HOST: "SONARQUBE_URL"    #good to use parameter-storephases:  build:    commands:      - mvn test123  post_build:    commands:      - mvn sonar:sonar -Dsonar.login=$SONAR_LOGIN -Dsonar.host.url=$SONAR_HOSTThis was like completed few years back for one of my client. Also you can explore SonarCloud as well if possible. Checkout below documentation.https://aws.amazon.com/blogs/devops/integrating-sonarcloud-with-aws-codepipeline-using-aws-codebuild/CommentShareShashank Abhishekanswered 5 months agorePost-User-6304005 4 months agoThanks Shashank, I am exploring sonarcloud integration with our aws codepipeline now.The given doc about buildspec.yaml about maven build, can i have gradle buildspec.yaml.Share"


Question: "Amazon GameLift Server SDK Update, v4.0.2"

"Hello, All game developers. We just released a minor version update to the Amazon GameLift Server SDK. The new Server SDK version 4.0.2 fixes a known issue with the method StartMatchBackfill() . This method now returns a correct response to a match backfill request. Download the updated server SDK, and check out the release notes.The GameLift TeamFollowComment"


Question: glueContext handling java.io.CharConversionException with db2 driver

"We are receiving the java.io.CharConversionException when trying to read data from a DB2 database that has characters outside the UTF-8 encoding.  I tried adding an option("encoding", "ISO-8859-1") and option("charset", "ISO-8859-1") but neither seems to have any effect at all.  Is it possible to ask the glueContext to use a specific type of encoding?If not, what options do we have for handling characters that are throwing the CharConversionException?  We have been excluding the rows specifically though SQL but this is not a tenable solution.FollowComment"

Answer: "0Please check if the below format works for you. I have set other options similar to this in GLue 3.0sconf = SparkConf()spark_conf.setAll([    ('spark.executor.extraJavaOptions','-Ddb2.jcc.charsetDecoderEncoder=3'),     ('spark.driver.extraJavaOptions','-Ddb2.jcc.charsetDecoderEncoder=3')    ])sc = SparkContext(conf=sconf)glueContext = GlueContext(sc)spark = glueContext.spark_sessionjob = Job(glueContext)CommentShareAnanth Tirumanuranswered 6 months agorePost-User-4513773 6 months agoWe have this in our code already, but unfortunately it does not have any effect.  We have been able to set 'spark.sql.adaptive.enabled' to false, and that worked but the above code does not.I believe the difference might be due to this spark setting acting upon the already cluster, whereas the java level JVM settings need to be applied before the spark cluster is actually instantiated.  But, this is conjecture as I do not know how Glue 2/3 initializes its cluster.  All I know is that it is faster start up than Glue 1, which makes me think it is pulled from a "warm" image.Share0See the IBM Support article for more details related to this CharConversionException error https://www.ibm.com/support/pages/sqlexception-message-caught-javaiocharconversionexception-and-errorcode-4220After setting the parameters--conf 'spark.executor.extraJavaOptions=-Ddb2.jcc.charsetDecoderEncoder=3' --conf 'spark.driver.extraJavaOptions=-Ddb2.jcc.charsetDecoderEncoder=3'an exception will not be thrown when a non-UTF8 character is encountered but rather it will be substituted by its equivalent Unicode replacement character.CommentShareAnanth Tirumanuranswered 6 months ago0Hi @ananthtm thanks for the reply.  We have previously come across this solution, however the challenge we found was that unless we used Glue V1.0 we were unable to set these specific parameters.  We tried with both 2.0 and 3.0 to set these settings in the configuration file but they were ignored.  I believe it may be some issue with the VM for glue 2.0/3.0 are in some kind of warm-state and are not being loaded from a "cold-state" so there is no point at which these configuration parameters are being pulled in and configured in the Spark cluster.If you know of a way that we can set these configuration values in our Glue 3.0 (or in future 4.0) settings then we would be able solve multiple issues we have been having with illegal characters.Lastly, the reason we are using the V3.0 is because v1.0 is significantly slower to startup.  Is there a possiblity that these SPARK configuration options can be configured in the AWS account or job level?CommentSharerePost-User-4634955answered 6 months ago"


Question: Encoding profile for PS4

"Hi All,Looking to see if anyone has been successful in generating a job/presets that will playback on PS4 successfully.  This would be for DASH outputs.  The playstation developer documentation provides very high level requirements and have been testing some of the OTT presets and not having luck. Source vido is MP4 with stereo and optionally dd51 tracks available.Thanks for any input.FollowComment"

Answer: "0Hey Mike,Matthew from the AWS Team here. Hoping my colleagues and I can help on this.How are you trying to play the file? Over the internet or local usb?What type of error or playback issue do you experience?Cheers,MatthewCommentShareAWS-User-2011750answered 2 years ago0Hi Mike,Not sure if you've got any further info to hand.Meanwhile, I'll provide any info I have on this post.https://manuals.playstation.net/document/gb/ps4/music/mp_format_m.htmlThe key takeaway for USB is: When using a USB storage device, your video files need to be in a folder for your PS4™ system to recognise them.For streaming,  have you been able to confirm that the content plays on any other Dash player?CommentShareAWS-User-2011750answered 2 years ago0Hello,Just to add my colleague also has some useful notes when testing with video playback on PS4.What I learned so far from my testing with NexPlayer is that the PS4 doesn’t like the <SegmentTemplate> element to be present in both AdaptationSet and Representation elements at the same time. Here are few examples:The Dash manifest produced by EMT will either be skipped (so the player will jump to end of playback right away) or with certain modifications it also crashed the player. Here is an example of such manifest:“write segment timeline in representation” was sufficient to make the output works properly in all my tests. This by default is disabled on AWS Elemental MediaConvert.…<Period duration="PT10S" id="_PT0S_0" start="PT0S"><BaseURL>https://url.cloudfront.net/tm/url/url/</BaseURL><AdaptationSet bitstreamSwitching="false" frameRate="30/1" mimeType="video/mp4" segmentAlignment="true" startWithSAP="1" subsegmentAlignment="true" subsegmentStartsWithSAP="1"><SegmentTemplate timescale="90000"><SegmentTimeline><S d="180000" r="4" t="0"/></SegmentTimeline></SegmentTemplate><Representation bandwidth="296000" codecs="avc1.64000d" height="240" id="7" width="416"><SegmentTemplate initialization="asset_240_0_1_init.mp4" media="asset_240_0_1_$Time$.mp4"><SegmentTimeline><S d="180000" r="4" t="0"/></SegmentTimeline></SegmentTemplate></Representation>…We manually modified the manifest to remove the <SegmentTemplate> from either location and it worked in both cases:…<Period duration="PT10S" id="_PT0S_0" start="PT0S"><BaseURL>https://url.cloudfront.net/url/url/url/</BaseURL><AdaptationSet bitstreamSwitching="false" frameRate="30/1" mimeType="video/mp4" segmentAlignment="true" startWithSAP="1" subsegmentAlignment="true" subsegmentStartsWithSAP="1"><SegmentTemplate timescale="90000" initialization="asset_$RepresentationID$_init.mp4" media="asset_$RepresentationID$_$Time$.mp4"><SegmentTimeline><S d="180000" r="4" t="0"/></SegmentTimeline></SegmentTemplate><Representation bandwidth="296000" codecs="avc1.64000d" height="240" id="240_0_1" width="416"></Representation><Representation bandwidth="480000" codecs="avc1.64001e" height="360" id="360_0_2" width="640"></Representation><Representation bandwidth="640000" codecs="avc1.64001e" height="360" id="360_0_3" width="640"></Representation><Representation bandwidth="896000" codecs="avc1.64001e" height="360" id="360_0_4" width="640"></Representation><Representation bandwidth="1280000" codecs="avc1.64001e" height="360" id="360_1_5" width="640"></Representation><Representation bandwidth="1536000" codecs="avc1.64001f" height="540" id="540_1_6" width="960"></Representation><Representation bandwidth="1856000" codecs="avc1.64001f" height="540" id="540_1_7" width="960"></Representation></AdaptationSet>…Or:…<Period duration="PT10S" id="_PT0S_0" start="PT0S"><BaseURL>https://url.cloudfront.net/url/url/url/</BaseURL><AdaptationSet bitstreamSwitching="false" frameRate="30/1" mimeType="video/mp4" segmentAlignment="true" startWithSAP="1" subsegmentAlignment="true" subsegmentStartsWithSAP="1"><Representation bandwidth="296000" codecs="avc1.64000d" height="240" id="7" width="416"><SegmentTemplate timescale="90000" initialization="asset_240_0_1_init.mp4" media="asset_240_0_1_$Time$.mp4"><SegmentTimeline><S d="180000" r="4" t="0"/></SegmentTimeline></SegmentTemplate></Representation><Representation b…Hoping some of the information here is useful to you or anybody else trying to achieve similar!Edited by: MatthewH-AWS on Jun 9, 2021 2:09 AMCommentShareAWS-User-2011750answered 2 years ago0Sorry for the delay.We did find that the segment template was causing the issue and generated a lambda function to strip it off and create a custom copy for PS4.  We also got a response from Sony indicating that they should be releasing a new SDK Framework upgrade that will fix the issue (adding support for SegmentTemplate and a few other things).  WebMAF 2.8.0 "Add support for Indexed Addressing (SegmentBase) format in multi-period DASH content"CommentShareMikeE1answered 2 years ago"


Question: Access CloudDirectory from inside a VPC

"I've setup CloudDirectory, and I'm trying to access my CloudDirectory from a Lambda which is running inside a VPC.When executing the Lambda, I'm not seeing much except that it times out.The log states:[INFO]2019-04-01T14:48:10.921Z0604741e-681a-43db-9a47-0b91ec3a1809Starting new HTTPS connection (1): clouddirectory.eu-west-1.amazonaws.com[INFO]2019-04-01T14:49:11.630Z0604741e-681a-43db-9a47-0b91ec3a1809Starting new HTTPS connection (2): clouddirectory.eu-west-1.amazonaws.comAs soon as I take the Lambda outside of the VPC, it directly works, so it seems to be an issue from Lambda towards CloudDirectory when executed inside a VPC. Since this seems like a similar issue like accessing DynamoDB, SNS and other AWS services, I want to make a VPC Endpoint, however CloudDirectory does not seem to be listed as supported service.What is the best way to connect to CloudDirectory from inside a VPC, will the standard VPC Endpoints be supported?FollowComment"

Answer: "0Hello,At this time, Cloud Directory does not have integration with VPC Endpoints. We have taken this as a feature request and will consider it alongside other customer asks. In the mean time, the recommendation is to use VPC NATs to connect your VPC to the internet and then additionally add rules to your security group such that Cloud Directory is the only accessible internet endpoint.https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.htmlHopefully this helps, let us know if you have further questions about Cloud Directory.-MattCommentShareAWS-User-6675827answered 4 years ago0Thanks, I'll attempt to work it out with the NAT and Security Groups.CommentShareidoornanswered 4 years ago0Just discovered that CloudDirectory now supports VPC Endpoints!Thanks guys!CommentShareidoornanswered 4 years ago"


Question: Forward traffic from NLB to ALB in https

"Hello, I have the following setup -> API Gateway -> (through VPC Link) NLB (internal facing) -> ALB (internal facing)-> ECS.The NLB has a listener for the 443.  It forwards to the ALB target groups for TCP 443.When i tired https://"NLB domain":443 in api gateway, i got "Execution failed due to configuration error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target" error.  What am i missing here?  The listener for ALB target group doesn't allow certificate.Any help would be appreciated.  Thank you!FollowComment"

Answer: "0Hi.If you want to perform HTTPS communication toward NLB-ALB after SSL termination at API Gateway, you need to use ACM to configure SSL certificate and listener on NLB or ALB.CommentShareEXPERTiwasaanswered 7 months agorePost-User-1204407 7 months agoHello iwasa, Do you know how to configure on NLB?  I don't see such option when i use the ALB target group.  Thank you!Share"


Question: yum Configuration update-motd.conf not found

"yum Configuration update-motd.conf not foundmy ec2 yum tell me this problem, how can i solve this?FollowCommentMatt-B EXPERT7 months agoHi ThereCould you post the exact error message you are seeing? You can also post a screenshot but be sure to block out any private info like instance id or IP address.Share"


Question: Losing internet access with split tunnel on in aws client VPN

I have client VPN set up with split tunnel enabled and have just one route i.e. to target subnet in a VPC. I have gone throug other similar question on AWS re:Post and have made sure that I do not have 0.0.0.0 route in Routes associated with Cvpn endpoint. Also I am not supplying and DNS servers at the moment.I can see why I am loosing the internet access which is because a route entry is being pushed down to my local route table (i am using Linux Mint 21 and default openvpn client inbuilt into it to connect) for 0.0.0.0 -> 10.54.0.161 which does not make sense. That route entry should not be pushed by Cvpn to my host machine as I have split tunnel enabled.Not sure what am I doing wrong.FollowComment

Answer: "0Accepted AnswerHope this helps others having issues with CVPN on debian clients.I had got in touch with AWS Business support about this and they have suggested a workaround in form of using the AWS Client VPN GUI that is available for Linux. When connecting through that software, the default route does not get added but if you use the default open vpn client that gets shipped with linux mint that the issue pops up again.This should not be happening but they aren't sure about when AWS will prioritize fixing this. So the current solution is using the AWS CVPN GUI. Also the GUI is not supported for newer ubuntu versions but you will need to manually add a few dependencies and then it does work.ThanksCommentSharevinaynb-atanswered 3 months ago"


Question: How to specify 'ScanAll' procedure for AWS::Glue::Crawler DynamoDBTarget

"I was looking at the Glue Crawler resource creation docs, and saw that the DynamoDB Target object: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-glue-crawler-dynamodbtarget.htmlThe only allowed parameter is 'Path' for a DynamoDB Target of a AWS Glue Crawler resource. Interestingly, when I deployed my crawler, I noticed that the 'data sampling' setting was automatically enabled for my DDB data source. This is NOT the setting I want, so I am looking for a way to specify that the Crawler should scan the entire data source (DDB table).FollowComment"

Answer: "1You need to set ScanAll to true, I agree it is not well documented but seems to be the correct behavior looking at the core API.Resources:  GlueCrawler:    Type: AWS::Glue::Crawler    Properties:      Name: myCrawler      DatabaseName: myGlueDatabase      TablePrefix: myTable      Targets:        Type: DynamoDB        Path: myDynamoDBTable      SchemaChangePolicy:        UpdateBehavior: UpdateInPlace        DeleteBehavior: DeleteFromMetadata      Configuration:        ScanAll: trueCommentShareEXPERTLeeroy Hannigananswered 4 months agorePost-User-0483768 4 months agoInteresting... Take a look at the docs for providing a crawler configuration: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-glue-crawler.html#aws-resource-glue-crawler--examplesWhat would that look like for ScanAll? We need to specify Configuration -> something -> ScanAll: trueShareLeeroy Hannigan EXPERT4 months agoConfiguration is a string: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-glue-crawler.html#cfn-glue-crawler-configurationSharerePost-User-0483768 4 months agoYes, but what 'category' would ScanAll fall under in Configuration? i.e. table, partition, grouping, etcAlso I opened an official case with AWS support and they said that the 'ScanAll' feature simply isn't implemented for CF resources created via YAML/JSON.Share0Currently, the data sample can only be set to scanAll on the AWS console or CLI, so you would not be able to do this from CloudFormation. Scanning all the records from the table can take a very long time depending on the size of the table and is generally not recommended as it can also exhaust all your RCU for the table.If your intention for scanning whole table is to account for DynamoDB's non conformant schema, then a better approach would be to export your table to S3 using the export to S3 feature. Since the table content is dumped on an external system it will not affect your table and you will have more control over the performance (since you can control the reads without worrying about table limits or partition limits).CommentShareodwa_yanswered 4 months agorePost-User-0483768 4 months agoI tried running a crawler on an S3 bucket containing a direct export from DyanmoDB, but it just ran and created nothing. The crawler didn't fail, but it didn't create a data catalog.Could you clarify how you might configure a crawler to run on a DDB export like you mentioned?Share0Spoke with AWS support, they claimed that the feature isn't currently implemented. As of now, you are only able to provide a 'Path' value when creating crawler resources via YAML/JSON in CF.The only solution is to add an 'update-crawler' CLI command via script or pipeline after deploying the resource.CommentSharerePost-User-0483768answered 4 months ago"


Question: First Batch job fails with CannotPullContainerError

"I am trying to walk through the simple "Submit your first Batch job" for AWS Batch. I go through all of the 5 steps, choosing Fargate as the platform, and leaving all items at default values, and finally submit the job. However, the job fails with this status reason:CannotPullContainerError: inspect image has been retried 5 time(s): failed to resolve ref "docker.io/library/amazonlinux:latest": failed to do request: Head https://registry-1.docker.io/v2/library/amazonlinux/manifests/latest: dial tcp 34.237.244.67:44...I am probably missing something very basic, but have no idea what.  Thanks!FollowCommentAWS-User-1284415 a year agoUpdate: If I change the platform to EC2 it seems to work. Any ideas why Fargate does not?ShareAWS-User-1082088 a year agoI received the same error on Fargate as well, following the same steps. +1 for this question.Share"

Answer: "6Accepted AnswerHello! If using Fargate and the subnets associated with your Batch compute environment do not have a NAT Gateway attached, your job will fail as it cannot connect to the internet to pull the Docker image. To solve this issue, you can set the assignPublicIp parameter in the Batch job definition to be ENABLED. For more info on Fargate compute environments in Batch, check out this documentation.CommentSharepatrguhaanswered a year agoAWS-User-1284415 a year agoThanks very much. It would be worth adding this small detail to that tutorial.Share"


Question: Amazon WorkSpaces Connection Health Check Website link is broken

"Q: If I am located a significant distance from the region where my Amazon WorkSpace is located, will I have a good user experience?A: If you are located more than 2000 miles from the regions where Amazon WorkSpaces is currently available, you can still use the service, but your experience may be less responsive. The easiest way to check performance is to use the Amazon WorkSpaces Connection Health Check Website.I want to test VDI since its over 2000 miles.the web link is broken.**http://health.amazonworkspaces.com/ **fromhttps://aws.amazon.com/workspaces/faqs/FollowComment"

Answer: "0Hi -I'd recommend you launch a WorkSpace in your preferred region, and test the experience. That webpage provides recommendations on an AWS Region that may work, but doesn't provide a full view onto what your user experience may be. The best way to determine that is to test it with your specific workload to see if the experience is sufficient for you/your users.the web link is broken.The page loads for me. Can you describe what issue you're having attempting to load the page?CommentShareEXPERTMuraliAtAWSanswered a year ago"


Question: Custom Amplify & Cognito Authentication

"I would like to create a web app that authenticates just as AWS does for console login.A non-root user would first have to enter an account number (I can verify that the number entered is legit).The non-root user would then enter an email and password combination. That alone is ok, but I don't see how to confirm those credential using Amplify in combination with the account number. I only want the user confirmed if those credentials are paired with the account number.For root users, I would want to authenticate them only if the email and password can be confirmed with, presumably, a root user flag.Is there an Amplify API that allows email, password, and account parameters for authentication?Can you provide any guidance on how to authenticate root users based on email, password, and root user flag? Thanks.FollowComment"

Answer: 0I bet that the answer is through implementing a multi-tenant solution with custom attributes. My only lingering question is whether I should have a separate user group for each tenant. Is that advisable?CommentShareAWS-User-9698935answered a year ago


Question: MSK serverless BootstrapBrokerStringTls

"https://docs.aws.amazon.com/msk/latest/developerguide/msk-authentication.htmlReview the heading: 'To set up a client to use authentication'Item 3.  `On a machine where you have the AWS CLI installed, run the following command to get the bootstrap brokers of the cluster. Replace Cluster-ARN with the ARN of your cluster.aws kafka get-bootstrap-brokers --cluster-arn Cluster-ARNSave the string associated with BootstrapBrokerStringTls in the response.`If you try item 3, and you have serverless MSK, you get: An error occurred (BadRequestException) when calling the DescribeCluster operation: This operation cannot be performed on serverless clusters.So what do you do to setup SSL on clients who are using an AWS PrivateLink to access the brokers?At this time, I am blocked from being able to use the PrivateLink connection to the MSK cluster.  When I try, I get:ERROR [Producer clientId=console-producer] Connection to node -1 (XXX.kafka.us-east-1.amazonaws.com/XXX.XXX.XXX.XXX:9098) failed authentication due to: SSL handshake failed (org.apache.kafka.clients.NetworkClient) FollowCommenttheLoneCrusader a year agoTo further explain, I am using an user account that has appropriate IAM permissions to access the MSK clusters, hence the call on port 9098.Share"

Answer: "0Hiyou need to use the v2 API:aws kafka list-clusters-v2 --region <region-name>aws kafka describe-cluster-v2 --cluster-arn <value>list-clusters-v2: https://docs.aws.amazon.com/cli/latest/reference/kafka/list-clusters-v2.htmldescribe-cluster-v2: https://docs.aws.amazon.com/cli/latest/reference/kafka/describe-cluster-v2.htmlFor now, MSK Serverless only allows SSL via IAM and not MutualTLS. Follow this guide to achieve IAM authentication. https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.htmlCommentShareBenita-AWSanswered 9 months ago"


Question: Disable DNSSEC for a transferred domain

I recently transferred a .co domain into the route53 registrar. The old registrar had DNSSEC Enabled but  this is not supported in route53 at the registrar level.  I need to delete the DS records for this domain in the co zone but I don't see any way of doing it myself.Any help would be appreciated.FollowComment

Answer: 0I submitted a support request and it looks like they are handling itCommentShareScruffyDananswered 4 years ago


Question: Confused about Aliases and Key rotation.

"My company wishes to employ BYOK into KMS for S3 SSE. I'm trying to understand how we would go about rotating keys, and my understanding is that Aliases are the way to go. However, I'm unclear how exactly they work in my scenario.So for example, I create Bucket-a with default encryption using a CMK with imported KeyMaterial and with alias = alias/s3encrypt. I upload a file to the bucket which is encrypted using the original key material.I now wish to rotate the key, which has to be done manually because the key material was imported. So I now create a new CKM, import the new material and update alias/s3encrypt to reference the new CMK. When I look at the properties of my S3 bucket it's still referencing the original master key ID. So all new files and the original file will still be encrypted using the original master key ID, which means I have to retain that key. In other words, s3 doesn't appear to respect the alias?I thought the point of BYOK was to allow me to immediately crypto-shred - i.e. take full control of my keys and allow me to rotate when necessary, but it seems if I wish to permanently delete a key from AWS, I also have to take care of re-encrypting material that was encrypted using previous keys, and aliases don't offer a way around that? Or have I got the wrong end of the stick?Edited by: prys on Mar 18, 2020 6:46 AMEdited by: prys on Mar 18, 2020 8:35 AMFollowComment"

Answer: "0Yes, you are right. S3 does not re-encrypt your data under the new CMK by changing the alias.When you begin using the new CMK after manual key rotation, you have to keep the original CMK enabled so that AWS KMS can decrypt data that the original CMK encrypted. When decrypting data, KMS identifies the CMK that was used to encrypt the data, and it uses the same CMK to decrypt the data. As long as you keep both the original and new CMKs enabled, AWS KMS can decrypt any data that was encrypted by either CMK.Even in the case of automatic key rotation, rotating the CMK has no effect on the data that the CMK protects. It does not rotate the data keys that the CMK generated or re-encrypt any data protected by the CMK.CommentShareAWS-User-1849807answered 3 years ago0Thanks very much for your reply.Yes, that confirms the behaviour with respect to previously encrypted objects - i.e. you must retain the original master keys to maintain access. But can you confirm that updating the original alias to reference a new key has no effect on new objects uploaded into the bucket either? i.e. new objects will also be encrypted using the original key as opposed to the new key. In other words, S3 never really uses the alias - once you select an alias as the default encryption key, S3 associates with the master key, which doesn't change if you update the alias?CommentShareprysanswered 3 years ago0Can you tell me how you specified the CMK to use on the bucket? Did you use the CMK ARN or the alias?see here: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.htmlCommentShareAWS-User-1849807answered 3 years ago0Thanks again for your time with this.So I've tried it two ways - i.e. console and cli. The console allows me to select the alias (see screenshot_1.png). In this case I have an 'external' CMK (i.e. my own imported key mat) with alias = alias/s3encnew. However if I navigate away from the bucket and back in, s3 now shows my default encryption 'resolved' to the keyId of the alias - see screenshot_2.png. If I update the s3encnew alias to refer to a different keyId, the properties of my s3 bucket doesn't change - i.e. it still refers to the original keyId.With the cli, the command (aws s3api put-bucket-encryption....) only allows specification of a 'KMSMasterKeyID' - i.e. the key Id not the alias. It errors if I try to specify an alias within the --server-side-encryption-configuration json parameter.Edited by: prys on Mar 19, 2020 1:42 PMCommentShareprysanswered 3 years ago0Ok, I think I've got to the bottom of this...To associate a s3 bucket with an alias, don't select the alias from the S3 default encryption AWS-KMS drop-down list. Instead, select 'Custom KMS Arn' and then paste the arn of the alias you wish to use. Alternatively you can use the arn to specify the alias using the put-bucket-encryption cli command as the argument to the 'KMSMasterKeyID' parameter. Doing it either of these ways retains the S3 reference to the alias, as opposed to the target key specified by the alias.CommentShareprysanswered 3 years ago"


Question: How to stop instance stuck in stopping

"The instance is X-XXXXXXXXXXXXXXXXXXIt was unresponsive, did not ping, etc.Attempted to stop and stuck in stopping.Tried force stop and it is still stuck in stopping.*Edit: Removed instance ID - Elle G.FollowComment"

Answer: "0Accepted AnswerHello,I found this doc with further guidance on force stopping your EC2 instance: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesStopping.html.Additionally, this article on resolving a stuck EC2 instance might be what you're looking for: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-stuck-stopping-state/.If this isn't useful, I recommend opening a case within your Support center for other helpful resources: http://go.aws/support-center.Elle G.CommentShareEXPERTAWS Support - Elleanswered 7 months agotom2460 7 months agoThanks, I also discovered that from browsing similar questions.  I had completed the steps to start a replacement instance when the stuck instance finally stopped, so I was able to then just restart it.  The file system had the signature of having the "plug pulled" so I'm assuming there was some underlying hardware problem that was corrected or things finally timed out and gave me new hardware for the restart.But I also wondered that since I posted the instance ID, someone with the ability saw there was a problem and did something to allow the instance to stop.  Is this possible?Share"


Question: U2F Support for MFA on Safari 15

"For those of us who wish to use Safari for AWS, please provide us with the technical details of why we cannot use Safari (v15) if we want to use a U2F security key for MFA.U2F security key (YubiKey or any other compliant U2F device)Your browser does not support U2F. Learn morethanks! BillFollowComment"

Answer: "0Hi Bill, U2F is currently not supported on Safari browser and there is already a feature request for this. Please talk with your Account SA to add your customer influence to this existing feature request.CommentShareAbhijeetanswered a year ago"


Question: AWS new account

"Hi,What is going on with AWS new account registration? We are trying to register a new account for our company to make some services live. Its been 2 weeks since we have registered a new account and its stuck in verification process on AWS side. AWS called us for verification and that call was unfortunately missed and they suspended our account. Since then we are trying to reach AWS for re-activation of the account. We also have submitted the verification documents as well. But there is no response from AWS.I want to know why AWS is putting these type of restrictions on new account registration?I also find out that they have implemented the restriction of 1 vCPU for new account. This seems insane to me for a business account. If there is such a process AWS is willing to incorporate for new account then I wonder how businesses can rely on their services. Verification process taking 2 weeks and still we are nowhere.We are AWS customer for last 3-4 years but now this attitude is making us think to consider other cloud providers.I hope for AWS official can look into this matter.ThanksFollowComment"

Answer: "2Hello there,I'm terribly sorry to hear about any frustration or inconvenience this has caused. I can assure you, this isn't the experience we aim for.In order to uphold account security, I'm unable to speak about any account specifics on this platform. That said, I'd encourage you to share this valid feedback on your support case. By doing so, our internal team with the visibility and tools to directly assist can investigate these concerns with you.If you're interested in troubleshooting tips for creating new accounts, please consider checking out this guide:https://go.aws/create-account.Thank you,- AWS Support - JohnCommentShareEXPERTAWS Support - Johnanswered a year ago"


Question: "Even though I created a global IAM role with both "AmazonS3FullAccess" and "AWSGlueServiceRole" policies, I am still unable to select the role from the dropdown menu when creating a Data Pipeline."

FollowComment

Answer: "0Please refer to the link to create a pipeline role: https://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-iam-roles.html.Ensure that the trust relationship Principal of pipeline role is data pipeline service.Under Select your use case in the console, do one of the following:Choose Data Pipeline to create a pipeline role.CommentShareChunminganswered 2 months ago"


Question: How can we update the EMR cluster with ALAS2-2023-1909 ?

"Hi,We have a vulnerability risk on our EMR cluster. We wanted to know if the ALAS2-2023-1909( https://alas.aws.amazon.com/AL2/ALAS-2023-1909.html) patch validated for the default Amazon EMR AMI?We are using EMR release 5.36.0 and wanted to know what we need to do to update our instances with this latest patch.Please suggest what can be done. Thank you.FollowComment"

Answer: "0As per the instructions in ALAS2-2023-1909( https://alas.aws.amazon.com/AL2/ALAS-2023-1909.html) , all you need to do is run below command to update freetype package on your instances. I was able to test it on my EMR 5.36 cluster.sudo yum update freetypeAlso, adding below command in bootstrap script can also resolve this issue.sudo yum update -y --securityCommentShareKashifanswered 4 months ago"


Question: How to associate an api key to an API Gateway websockets API

"I've created a websocket api and I'm trying to secure it with an api key. I've checked the checkbox API Key Required in the $connect route and it is working fine as I get a 403 error when I invoke the API without api key from wscat. However, after creating an api key, I can't figure out how to associate it to the websockets API. I've tried from the console and also from aws cli, but no luck.Please, any help would be appreciated.Best regards,Juan Carlos GonzálezFollowComment"

Answer: "0As usually happens, the answer was in the documentation... In order to assign an api key to a websockets api, it must be done via usage plans:https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-key-source.htmlCommentShareJC_Gonzalez2answered 4 years ago"


Question: Nothing rendering on lyshine canvas editor

"Building a lyshine gem component and I have been able to get it to register with lyshine and be able to use custom assets an all of that.Issue now is that nothing is rendering to the canvas in the lyshine edtior.Here's my render function:void Cubism3UIComponent::Render() {this->threadMutex.Lock();const char* profileMarker = "UI_CUBISM3";gEnv->pRenderer->PushProfileMarker(profileMarker);if (this->modelLoaded) {if (this->m_threading == NONE && !this->tJob)csmUpdateModel(this->model);EBUS_EVENT_ID(GetEntityId(), UiTransformBus, GetTransformToViewport, this->transform);bool transformUpdated = false;if (this->transform != this->prevTransform) {this->prevTransform = this->transform;transformUpdated = true;}IRenderer *renderer = gEnv->pRenderer;bool drawOrderChanged = false, renderOrderChanged = false;for (int i = 0; i < this->drawCount; i++) {Drawable * d = this->drawables[this->renderOrder[i]];if (this->m_threading == NONE && !this->tJob)d->update(this->model, this->transform, transformUpdated, drawOrderChanged, renderOrderChanged);if (d->visible) {int flags = GS_BLSRC_SRCALPHA | GS_BLDST_ONEMINUSSRCALPHA;if (d->constFlags & csmBlendAdditive) {flags = GS_BLSRC_SRCALPHA | GS_BLDST_ONE;} else if (d->constFlags & csmBlendMultiplicative) {flags = GS_BLDST_ONE | GS_BLDST_ONEMINUSSRCALPHA;}if (this->texture != nullptr) renderer->SetTexture(texture->GetTextureID());else renderer->SetTexture(renderer->GetWhiteTextureId());renderer->SetState(flags | IUiRenderer::Get()->GetBaseState() | GS_NODEPTHTEST);renderer->SetColorOp(eCO_MODULATE, eCO_MODULATE, DEF_TEXARG0, DEF_TEXARG0);renderer->DrawDynVB(d->verts, d->indices, d->vertCount, d->indicesCount, prtTriangleList);}}if (drawOrderChanged) this->drawOrder = csmGetDrawableDrawOrders(this->model);if (renderOrderChanged) this->renderOrder = csmGetDrawableRenderOrders(this->model);} else {//draw a blank space}gEnv->pRenderer->PopProfileMarker(profileMarker);this->threadMutex.Unlock();}Cubism3UIComponent inherits from the UiRenderBus and connects to it through the Activate function. I can verify that the function is being called but i am not getting anything rendering to the screen.Portions of the code is based on UiImageComponent.d->verts and d-indicies have correct data and, through debugging, i can verify that they are correct.Im wondering if it's something with the transform or not.For the d->update function, this is what i have:void Cubism3UIComponent::Drawable::update(csmModel* model, AZ::Matrix4x4 transform, bool transformUpdate, bool &drawOrderChanged, bool &renderOrderChanged) {this->dynFlags = csmGetDrawableDynamicFlags(model)[this->id];if (this->dynFlags & csmVisibilityDidChange) this->visible = this->dynFlags & csmIsVisible;if (this->dynFlags & csmOpacityDidChange) {this->opacity = csmGetDrawableOpacities(model)[this->id];this->packedOpacity = ColorF(1.0f, 1.0f, 1.0f, this->opacity).pack_argb8888();for (int i = 0; i < this->vertCount; i++) this->verts[i].color.dcolor = this->packedOpacity;}if (this->dynFlags & csmDrawOrderDidChange) {this->drawOrder = csmGetDrawableDrawOrders(model)[this->id];drawOrderChanged = true;}if (this->dynFlags & csmRenderOrderDidChange) {this->renderOrder = csmGetDrawableRenderOrders(model)[this->id];renderOrderChanged = true;}if (this->dynFlags & csmVertexPositionsDidChange) {//vertexesconst int vertCount = csmGetDrawableVertexCounts(model)[this->id];//recreate buffer if neededif (vertCount != this->vertCount) {delete this->verts;this->vertCount = vertCount;this->verts = new SVF_P3F_C4B_T2F[this->vertCount];}this->rawVerts = csmGetDrawableVertexPositions(model)[this->id];this->rawUVs = csmGetDrawableVertexUvs(model)[this->id];//indiciesconst int icount = csmGetDrawableIndexCounts(model)[this->id];//recreate indices if neededif (this->indicesCount != icount) {delete this->indices;this->indicesCount = icount;this->indices = new uint16[this->indicesCount];}const unsigned short * in = csmGetDrawableIndices(model)[this->id];for (int i = 0; i < this->indicesCount; i++) this->indices[i] = in[i];transformUpdate = true; //make sure that we convert the data to lumberyard compatable data}//update data only when transform has changed.if (transformUpdate) {for (int i = 0; i < this->vertCount; i++) {AZ::Vector3 vec(rawVerts[i].X, rawVerts[i].Y, 1.0f);vec = transform * vec;this->verts[i].xyz = Vec3(vec.GetX(), vec.GetY(), vec.GetZ());this->verts[i].st = Vec2(this->rawUVs[i].X, this->rawUVs[i].Y);this->verts[i].color.dcolor = this->packedOpacity;}}}No idea what is wrong...Follow"

Answer: "0Accepted AnswerHi @REDACTEDUSERI don't see anything obviously wrong. Like you say it could be that the verts are not being transformed correctly. At the point that you call DrawDynVB your vert positions should be 2D coordinates in viewport space.I would suggest simplifying your render function until it draws something and work back from there. e.g. try changing your render function to draw a quad in the center of the viewport with a fixed color and UVs and see if that draws. If so put in more of your functionality bit by bit.Let us know how it goes or if you have further questions.RobSharerePost-User-4854644answered 6 years ago0I grabed "RenderStretchedToFitOrFillSprite" and "RenderSingleQuad" functions and merged them together for when there is nothing loaded into my render function and it does work correctly.This is the section of code for that://draw a blank spaceUiTransformInterface::RectPoints points;EBUS_EVENT_ID(GetEntityId(), UiTransformBus, GetCanvasSpacePointsNoScaleRotate, points);AZ::Vector2 pivot;EBUS_EVENT_ID_RESULT(pivot, GetEntityId(), UiTransformBus, GetPivot);AZ::Vector2 textureSize;textureSize.SetX(this->texture ? this->texture->GetWidth() : (100.0f));textureSize.SetY(this->texture ? this->texture->GetHeight() : (100.0f));AZ::Vector2 rectSize = points.GetAxisAlignedSize();const float scaleFactorX = rectSize.GetX() / textureSize.GetX();const float scaleFactorY = rectSize.GetY() / textureSize.GetY();const float scaleFactor = AZ::GetMin(scaleFactorX, scaleFactorY);AZ::Vector2 scaledTextureSize = textureSize * scaleFactor;AZ::Vector2 sizeDiff = scaledTextureSize - rectSize;AZ::Vector2 topLeftOffset(sizeDiff.GetX() * pivot.GetX(), sizeDiff.GetY() * pivot.GetY());AZ::Vector2 bottomRightOffset(sizeDiff.GetX() * (1.0f - pivot.GetX()), sizeDiff.GetY() * (1.0f - pivot.GetY()));points.TopLeft() -= topLeftOffset;points.BottomRight() += bottomRightOffset;points.TopRight() = AZ::Vector2(points.BottomRight().GetX(), points.TopLeft().GetY());points.BottomLeft() = AZ::Vector2(points.TopLeft().GetX(), points.BottomRight().GetY());// now apply scale and rotationEBUS_EVENT_ID(GetEntityId(), UiTransformBus, RotateAndScalePoints, points);// now draw the same as Stretchedstatic const AZ::Vector2 uvs[4] = { AZ::Vector2(0, 0), AZ::Vector2(1, 0), AZ::Vector2(1, 1), AZ::Vector2(0, 1) };AZ::Color color = AZ::Color(1.0f, 1.0f, 1.0f, 1.0f);IDraw2d::VertexPosColUV verts[4];for (int i = 0; i < 4; ++i) {verts[i].position = points.pt[i];verts[i].color = color;verts[i].uv = uvs[i];}Draw2dHelper::GetDraw2d()->DrawQuad(this->texture ? this->texture->GetTextureID() : renderer->GetWhiteTextureId(),verts,GS_BLSRC_SRCALPHA | GS_BLDST_ONEMINUSSRCALPHA,IDraw2d::Rounding::Nearest,IUiRenderer::Get()->GetBaseState());And it works fine.But when i load up the files that is needed by my component it goes blank.Might not be using transform correctly or something.SharerePost-User-8564951answered 6 years ago0I think it is rendering. But it's not being transformed correctly:https://image.ibb.co/g5HnAF/Capture.pnghttps://image.ibb.co/iW7nAF/Capture2.pngEDIT: soo... it is transforming "correctly" in that i can scale the image as evident with the two pictures and being able to zoom into it. but position and correct scaling to the element isnt there...EDIT2: Figuring it out! Got it to get to the center of the element:AZ::Matrix4x4 viewport;EBUS_EVENT_ID(GetEntityId(), UiTransformBus, GetTransformToViewport, viewport);UiTransformInterface::RectPoints points;EBUS_EVENT_ID(GetEntityId(), UiTransformBus, GetCanvasSpacePointsNoScaleRotate, points);UiTransformInterface::Rect rect;EBUS_EVENT_ID(GetEntityId(), UiTransformBus, GetCanvasSpaceRectNoScaleRotate, rect);//testing the scaling atmAZ::Vector2 rectSize = rect.GetSize();float scaleX = this->modelCanvasSize.GetX() / rectSize.GetX();float scaleY = this->modelCanvasSize.GetY() / rectSize.GetY();this->transform =viewport *AZ::Matrix4x4::CreateTranslation(AZ::Vector3(points.pt[UiTransformInterface::RectPoints::Corner_TopLeft].GetX() + (rectSize.GetX() / 2),points.pt[UiTransformInterface::RectPoints::Corner_TopLeft].GetY() + (rectSize.GetY() / 2),0.0f)) *AZ::Matrix4x4::CreateRotationZ(3.14) *//AZ::Matrix4x4::CreateScale(AZ::Vector3(50.0f, 50.0f, 1.0f));AZ::Matrix4x4::CreateScale(AZ::Vector3(scaleX, scaleY, 1.0f));SharerePost-User-8564951answered 6 years ago0Got it rendering properly.Everything is working fine now.SharerePost-User-8564951answered 6 years ago0Glad you were able to get it workinmg. Thanks for letting us know.SharerePost-User-8353690answered 6 years ago"


Question: AWS: Set step function timeout

"I am new to AWS. We have a yaml file defined like below to run our step function.I want to set a timeout for the step function in AWS parameter store and refer it in the file. I created a parameter from AWS console. But I am not sure how to refer it in the yaml file. After reading the documentation I understood that it is declared under "States" property as "Timeout".xxxStateMachine:    Type: AWS::StepFunctions::StateMachine    Properties:      StateMachineName: !Sub ${AWS::StackName}-StateMachine      RoleArn: !Sub arn:aws:iam::${AWS::AccountId}:role/roleName      DefinitionString:        !Sub        - |-          {          "Comment": "Calls xxx state update job invoker lambda",          "StartAt": "xxxCheckJob",          "States": {              "Timeout": ${},    // IS this where the timeout has to be defined?              "xxxCheckJob": {          "Type": "Task",          "Resource": "${lambdaBDCArn}",          "ResultPath": "$.isBusinessDay",          "OutputPath": "$",          "Next": "xxxCheckJobStatus"              },              "businessDayCheckJobStatus": {          "Type": "Choice",          "Choices": [                  {                    "Variable": "$.x",                    "BooleanEquals": true,                    "Next": "xxxStatexxJob"            },                  {                    "Not": {                      "Variable": "$.isBuxxy",                      "BooleanEquals": true                    },                    "Next": "SuccessState"            }                ]          },          "xxxStateUpdateJob": {          "Type": "Task",          "Resource": "${lambdaRSUArn}",          "ResultPath": "$.detail.requestParameters.invocationStatus",          "OutputPath": "$.detail.requestParameters",          "Next": "xxxStateUpdateJobStatus"          },          "xxxStateUpdateJobStatus": {          "Type": "Task",          "Resource": "${lambdaJSArn}",          "Parameters": {          "jobName.$": "$.invocationStatus.jobId"          },          "ResultPath": "$.jobStatus",          "OutputPath": "$",          "Next": "checkJobStatus"          },          "checkJobStatus": {          "Type": "Choice",          "Choices": [                  {                    "Variable": "$.jobStatus.status",                    "StringEquals": "FAILED",                    "Next": "FailState"            },                  {                    "Variable": "$.jobStatus.status",                    "StringEquals": "SUCCEEDED",                    "Next": "SuccessState"            },                  {                    "Not": {                      "Variable": "$.jobStatus.status",                      "StringEquals": "SUCCEEDED"                    },                    "Next": "Wait X Seconds"            }                ]          },          "Wait X Seconds": {          "Type": "Wait",          "Seconds": 20,          "Next": "xxxStateUpdateJobStatus"          },          "SuccessState": {          "Type": "Succeed"          },          "FailState": {          "Type": "Fail",          "Cause": "Invalid response.",          "Error": "ErrorA"          }          }          }        - {lambdaRSUArn: !GetAtt [ xx, Arn ],           lambdaJSArn: !GetAtt [ xx, Arn ],           lambdaBDCArn: !GetAtt [ xx, Arn ]}I have the following questions:How to access timeout value in the yaml file. Is this the syntax - "Timeout": ${parameterName}How to configure the step function so that it exits if the timeout reaches and job status is in pending state.How to configure the step function so that it does not exits if the timeout reaches and the job status is in running state.Can anyone help me configure these?FollowComment"

Answer: "0HiPlease review TimeoutSeconds documentation if it meets your need.  If the task runs longer than the specified seconds, the state will fail with a States.Timeout error name.https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-task-state.htmlhttps://docs.aws.amazon.com/step-functions/latest/dg/sfn-stuck-execution.htmlThere is a good tutorial showing the use:https://docs.aws.amazon.com/step-functions/latest/dg/tutorial-creating-activity-state-machine.htmlCommentSharerePostfanclubanswered a year agoAWS-User-2849832 a year agoThanks for the reply. Was wondering if I can use this specific to the status of the machine. For eg I want it to timeout only if the step function is stuck in pending statusShareAWS-User-2849832 a year agoWhen we start the job ,it initially goes into pending state before going into running .We want to have a timeout for just the pending state and not running stateShare"


Question: "AWS SageMaker - Extending Pre-built Container, Deploy Endpoint Failed. No such file or directory: 'serve'""

"I am trying to deploy the SageMaker Inference Endpoint by extending the Pre-built image. However, it failed with "FileNotFoundError: [Errno 2] No such file or directory: 'serve'"My DockerfileARG REGION=us-west-2# SageMaker PyTorch imageFROM 763104351884.dkr.ecr.$REGION.amazonaws.com/pytorch-inference:1.12.1-gpu-py38-cu116-ubuntu20.04-ec2RUN apt-get updateENV PATH="/opt/ml/code:${PATH}"# this environment variable is used by the SageMaker PyTorch container to determine our user code directory.ENV SAGEMAKER_SUBMIT_DIRECTORY /opt/ml/code# /opt/ml and all subdirectories are utilized by SageMaker, use the /code subdirectory to store your user code.COPY inference.py /opt/ml/code/inference.py# Defines inference.py as script entrypoint ENV SAGEMAKER_PROGRAM inference.pyCloudWatch Log From /aws/sagemaker/Endpoints/mytestEndpoint2022-09-30T04:47:09.178-07:00Traceback (most recent call last):  File "/usr/local/bin/dockerd-entrypoint.py", line 20, in <module>    subprocess.check_call(shlex.split(' '.join(sys.argv[1:])))  File "/opt/conda/lib/python3.8/subprocess.py", line 359, in check_call    retcode = call(*popenargs, **kwargs)  File "/opt/conda/lib/python3.8/subprocess.py", line 340, in call    with Popen(*popenargs, **kwargs) as p:  File "/opt/conda/lib/python3.8/subprocess.py", line 858, in __init__    self._execute_child(args, executable, preexec_fn, close_fds,  File "/opt/conda/lib/python3.8/subprocess.py", line 1704, in _execute_child    raise child_exception_type(errno_num, err_msg, err_filename)Traceback (most recent call last): File "/usr/local/bin/dockerd-entrypoint.py", line 20, in <module> subprocess.check_call(shlex.split(' '.join(sys.argv[1:]))) File "/opt/conda/lib/python3.8/subprocess.py", line 359, in check_call retcode = call(*popenargs, **kwargs) File "/opt/conda/lib/python3.8/subprocess.py", line 340, in call with Popen(*popenargs, **kwargs) as p: File "/opt/conda/lib/python3.8/subprocess.py", line 858, in __init__ self._execute_child(args, executable, preexec_fn, close_fds, File "/opt/conda/lib/python3.8/subprocess.py", line 1704, in _execute_child raise child_exception_type(errno_num, err_msg, err_filename)2022-09-30T04:47:13.409-07:00FileNotFoundError: [Errno 2] No such file or directory: 'serve'FollowComment"

Answer: "1Hi, @holopekochan!The serve script is installed by SageMaker PyTorch Inference Toolkit when you pip-install it in the Dockerfile.However, it's hard to say why it's not found in your container. Are you sure that you use the inference container, not training container, for your endpoint? If you go to the AWS Console > Amazon SageMaker > Models > your model, what ECR image it shows in Container 1 - Image?It will be useful if you can share the code that you used to setup the SageMaker PyTorch estimator (if any) how you define your PyTorchModel and how you deploy() it.CommentShareIvananswered 8 months agoholopekochan 8 months agoThanks for your hint. I found the problem. I used wrong docker image, EC2 one instead of SageMaker.I simplify my question and provide the answer here. Just in case, if someone get the same problem.ShareIvan 8 months agoHi, @holopekochan!Good catch! I'm glad that you have found it!Share0Accepted AnswerShould use the Sagemaker image763104351884.dkr.ecr.$REGION.amazonaws.com/pytorch-inference:1.12.1-gpu-py38-cu116-ubuntu20.04-sagemakerinstead of ec2763104351884.dkr.ecr.$REGION.amazonaws.com/pytorch-inference:1.12.1-gpu-py38-cu116-ubuntu20.04-ec2CommentShareholopekochananswered 8 months ago"


Question: Why can't I transfer a .guitars TLD to Route 53?

"According to https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/registrar-tld-list.html, the TLD .guitars may be registered with Amazon Route 53.However, ".guitars" does not appear in the dropdown at https://us-east-1.console.aws.amazon.com/route53/home?#DomainTransfer:Was support withdrawn? If so, why?FollowComment"

Answer: "2It was described in this document.It appears that new registrations are no longer possible.You can no longer use Route 53 to register new .guitars domains or transfer .guitars domains to Route 53. We'll continue to support .guitars domains that are already registered with Route 53.https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/guitars.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months agoEXPERTToni_Sreviewed 2 months ago0Thank you.CommentShareTreximoanswered 2 months agoRiku_Kobayashi EXPERT2 months agoFor the sake of community development, if my answer helps, I would appreciate your approval.Share"


Question: Who Created AWS re:Post?

Who created this re:Post software? Was it created in-house at Amazon or did a third-party create it?FollowComment

Answer: "8It was developed by a team at AWS.CommentShareAndrew_Banswered a year ago6Over the last four years, AWS re:Post has been used internally by AWS employees helping customers with their cloud journeys. Today, that same trusted technical guidance becomes available to the entire AWS community. Additionally, all active users from the previous AWS Forums have been migrated onto AWS re:Post, as well as the most-viewed content.Questions from AWS Premium Support customers that do not receive a response from the community are passed on to AWS Support engineers. If the question is related to a customer-specific workload, AWS support will open a support case to take the conversation into a private setting. Note, however, that AWS re:Post is not intended to be used for questions that are time-sensitive or involve any proprietary information, such as customer account details, personally identifiable information, or AWS account resource data.You can look at this blog if you need more information.CommentShareDhilipanswered a year agoEXPERTHernitoreviewed a year ago0Hopefully you can receive notifications when answers were posted but like Andrew mentioned re:Post is created in-house and not by a third party.That being said, please do accept answers if the answers resolve your question. That's a best practice in Q&A communities both for other viewers and also out of respect to other's time spent answering the questions.As always, Happy Cloud Computing.CommentShareJason_Sanswered a year agoLowLevelGrunt a year agoExplain how you and Andrew know that this software was created in-house.ShareJason_S a year agoBecause there is a pizza team behind it and go back to Dhilipvenkatesh_U's answer as well?ShareLowLevelGrunt a year agoA question like mine can only be answered if you're either an Amazon employee, you're one of the developers (assuming a third party), or by providing a link to something that answers the question (most likely written by an Amazon employee).  As far as I can tell, the question has not yet been answered.ShareJason_S a year agoYou might not have noticed the AWS icon on some of our avatars implies the respondent is an AWS employee.ShareLowLevelGrunt a year agoFair enough. I'll accept the answer.Share-3So, this software was created from scratch by a team at Amazon?CommentShareLowLevelGruntanswered a year agoJason_S a year agoWhile we are not allowed to disclose implementation details, as a general software development process today, nothing is "from scratch" scratch. There are many open source frameworks that may have played a role in re:Post, and other systems.And obviously, AWS services could have also supported re:Post.But by saying "developed by a team at AWS" it means the construction, like the UX, actual development etc. are owned by AWS team.Share-4User Dhilipvenkatesh_U is not actually answering my question, nor do the links provided have the answer. User Andrew_B doesn't appear to have any inside knowledge of the software's source, so this question is still not answered.CommentShareLowLevelGruntanswered a year ago"


Question: Amazon Connect - Web Chat Client Reference Implementation

"Hi All,I want to have a play with the new web chat features in Connect, but I can't find the docs/reference implementation mentioned in the FAQ section, can anyone post a link please?Q: How do I add Amazon Connect chat to my website or mobile app to enable my customers to contact me?By leveraging our open source reference implementation and a few lines of code, you can easily add Amazon Connect chat into your existing website or mobile app. Customizing and branding the chat experience is easy using Amazon Connect's APIs and client SDKs.Many thanksChris.FollowComment"

Answer: 1Accepted Answerhttps://github.com/amazon-connect/amazon-connect-chat-ui-examples/CommentShareDanBloyanswered 4 years ago


Question: [Announcement] The AWS Lambda console now supports bulk update of layers

"You can now select all or subset of the functions that use a Lambda layer, and update them simultaneously to a newer layer version in the Lambda console.Lambda layers provide a convenient way to package libraries and other dependencies that you can use with your Lambda functions. Using layers reduces the size of uploaded deployment archives and makes it faster to deploy your code. Previously, it was challenging to identify and update all the functions that used a specific layer version. With this release, the Lambda console displays a list of all the functions using a given layer and allows to select multiple functions to be updated with a newer layer version. This release eliminates the need to update one function at a time or utilize an external script to perform the update on multiple functions.Access the AWS Lambda console to get started. To learn more about updating layers see the AWS Lambda User Guide (https://docs.aws.amazon.com/lambda/latest/dg/invocation-layers.html).This capability is available in the regions where AWS Lambda is available, with the exception of the Regions in China. For more information on availability, please see the AWS Region table (https://aws-preview.aka.amazon.com/about-aws/global-infrastructure/regional-product-services/).FollowCommentNitin_T SUPPORT ENGINEERa year agoThis is an announcement migrated from AWS Forums that does not require an answerShare"


Question: AWS Secret Value - C# .NET Framework 4.8 - Unable to get IAM security credentials from EC2 Instance Metadata Service

"Hello,I'm trying to retrieve AWS Secret Value inside my .NET C# (.NET Framework 4.8) Application hosted on IIS in a EC2 instance like in the example showed here:https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets_cache-net.htmlThe exception I receive is the following:Exception Details: Amazon.Runtime.AmazonServiceException: Unable to get IAM security credentials from EC2 Instance Metadata Service.If I try to execute the command from CLI, the secret's are retrieved successfully.Can someone help please ?FollowComment"

Answer: 0The following GitHub and Stack Overflow sites describe similar errors and may be helpful. [1] [2][1] How to troubleshoot "Unable to get IAM security credentials from EC2 Instance Metadata Service."? · Issue #1699 · aws/aws-sdk-nethttps://github.com/aws/aws-sdk-net/issues/1699[2] .net - AWS DotNet SDK Error: Unable to get IAM security credentials from EC2 Instance Metadata Service - Stack Overflowhttps://stackoverflow.com/questions/60815037/aws-dotnet-sdk-error-unable-to-get-iam-security-credentials-from-ec2-instance-mCommentSharemn87answered 8 months ago


Question: How do I create a role for AWS Batch using the CLI

"How do I create a role for AWS Batch jobs on EC2 using the CLI? The role needs to have read-write permissions to an S3 bucket, e.g. s3://mybucket234. The role will be needed for the "aws batch create-compute-environment" command.FollowComment"

Answer: "0Hi.You create an ECS-trusted IAM role as follows:https://docs.aws.amazon.com/batch/latest/userguide/instance_IAM_role.htmlWhen using the CLI, use the create-role command.https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.htmlTrust the service using AssumeRole at creation time. Please refer to the following for the method.https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_policy-examples.htmlCommentShareEXPERTiwasaanswered a year ago"


Question: DynamoDB not able to Restore With Deny DeleteItem SCP

"Hi there,We have a service control policy attached for our account with explicit Deny on Dynamodb Delete Item.We have enabled Point in Time Recovery for the tables as well.When I was trying to perform Restore on a table, It's throwing error saying"User ....... not authorized to perform: dynamodb:DeleteItem on resource .... with an explicit deny in a service control policy"I would like to know why Restore table action requires DeleteItem action ?Is this right ?How do we handle this case without trading off the SCP policy ?ThanksFollowComment"

Answer: "2Accepted AnswerDeleteItem is required as part of the IAM policy but it is never used. Unfortunately this is by design and to restore a table you will need to grant the restore process DeleteItem permissions.My assumption here is that the permissions are required as restore to an existing table has been long talked about and perhaps DeleteItem permissions are required for that feature, if/when it becomes available.CommentShareEXPERTLeeroy Hannigananswered 6 months ago"


Question: Unable to establish DNSSEC chain of trust for .com domain hosted in Route 53

"When setting up DNSSEC for our example.com domain in the Route 53 console, I am able to complete the first part successfully. Now I need to establish the chain of trust.  AWS help tells me to add a DS record. However, DS is not an option in the "type of record dropdown" when using Quick Create.Using the wizard produces this error message:InvalidChangeBatch 400: RRSet of type DS with DNS name example.com. is not permitted in zone example.com.Does AWS automatically add the DS records for the .com zone?FollowComment"

Answer: 0The following documents appear to support DNSSEC settings themselves.I was wondering if there is something wrong with the way it is set up?https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-configure-dnssec.htmlCommentShareEXPERTRiku_Kobayashianswered 13 days ago


Question: Adding multiple elastic IP's to CENTOS server in EC2

"Hi, I am setting up an bulk email delivery server for a bank where they would be sending approximately 250K to 500K emails daily to all their customers like notifications, OTP's etc.Currently this server is in their on premise location which we are planning to move to AWS for better stability and performance.I need to map 6 elastic IP's to this one EC2 instance, can you please guide how can this be achieved.FollowComment"

Answer: "0First please read the following guideline before sending emails (if you want to use AWS SES service to send email)https://docs.aws.amazon.com/ses/latest/dg/best-practices.htmlThen to allocate 6 ips to your CentOS EC2 instance you can followCreate a new VPC or use an existing VPC in the AWS Management Console.Create 6 subnets in your VPC. You can use the same or different Availability Zones for the subnets, depending on your requirements.Launch an EC2 instance in one of the subnets you created. Make sure to choose a CentOS-based Amazon Machine Image (AMI) and an instance type that supports multiple network interfaces.After launching the instance, go to the EC2 Dashboard and click on "Network Interfaces"Click on "Create network interface" and configure it with the following settings: (Repeat the step for each of the 6 subnets you created earlier)Description: A brief description for the network interface (optional)Subnet: Choose one of the subnets you created in step 2Security groups: Select the appropriate security group for your instanceAuto-assign public IP: Choose "Disable" or "Enable" based on your requirementsClick on "Create" to create the network interface.Now, attach each network interface to your EC2 instance:"Network Interfaces" list > Attach > Choose your EC2 instance in the "Instance" field and click on "Attach"Allocate 6 Elastic IPs in the AWS Management Console by going to the "Elastic IPs" section under the "EC2 Dashboard".Click on "Allocate new address" and then "Allocate" for each Elastic IP you need.Associate each Elastic IP with a network interface:"Elastic IPs" > Actions >  "Associate Elastic IP address" >  "Network interface"  "Associate"CommentShareEXPERTsdtslmnanswered 2 months agoEXPERTskinsmanreviewed 2 months ago"


Question: Prevent AWS Config From Recording Based on Tag

"Hello,I'm trying to prevent AWS Config from recording resources with a specific tag in my organization. The end result I'm looking for is that I have EC2 instances, DynamoDB tables, etc with a tag "awsconfig" and a value of "disable" and these are not recorded in AWS config.I have found that you can configure the recorder to not record specific resources, however that wouldn't work since I have resources that I do want to capture that are the same type of resources I don't want to capture.Additionally I have found the AWS RDK which is cool, but acts on rules and has no effect on recording of resources. I also have found this question but it seems geared towards still recording the resources, just not having a rule run against them.Is what I'm looking to do possible or am I out of luck?ThanksFollowComment"

Answer: 0Have you tried applying that restriction in the AWS Config Role you are using for your recorder?CommentSharevtjeananswered a month ago


Question: All rows of calculated field are unavailable.

"I am trying to get a value for a calculated filed. I can't see the error in the calculated field, but the values for calculated field are unavailable.I am using sum function on a field which is integer and contains only 0 and 1.The calculated field is like SUM({field}).Any ans on why we see unavailable values in all rows of Dataset,Thanks in advance.FollowComment"

Answer: "1Accepted AnswerHi, @ursraviAre you saying that the calculation field cannot be used on the dataset edit screen as shown below?This is by design.Aggregate functions are only available during analysis and visualizationhttps://docs.aws.amazon.com/quicksight/latest/user/calculated-field-aggregations.htmlIt can be used for visual display on analysis and dashboard screens.CommentShareEXPERTiwasaanswered 9 months ago"


Question: How to view AWS Amplify error logs after web app was deployed?

"I have a NodeJS app which I deployed to AWS Amplify and everything went well (provision, build and deploy) but when I access the Amplify generated URL the app says - There's no page at this address.So the question is, where or how to check the Amplify error log messages to see what's the problem?ThanksFollowComment"


Question: Why do we need S3 bucket versioning enabled in order to do replication?

Why do we need S3 bucket versioning enabled in order to do replication?FollowComment

Answer: "1Accepted AnswerSome of the complexity of replication lies around deletion of objects and versioning plays a major role there.If you delete an object from the source bucket, the following actions occur by default:If you make a DELETE request without specifying an object version ID, Amazon S3 adds a delete marker. Amazon S3 deals with the delete marker as follows:If you are using the latest version of the replication configuration (that is, you specify the Filter element in a replication configuration rule), Amazon S3 does not replicate the delete marker by default. However you can add delete marker replication to non-tag-based rules, for more information see Replicating delete markers between buckets.If you don't specify the Filter element, Amazon S3 assumes that the replication configuration is version V1, and it replicates delete markers that resulted from user actions. However, if Amazon S3 deletes an object due to a lifecycle action, the delete marker is not replicated to the destination buckets.If you specify an object version ID to delete in a DELETE request, Amazon S3 deletes that object version in the source bucket. But it doesn't replicate the deletion in the destination buckets. In other words, it doesn't delete the same object version from the destination buckets. This protects data from malicious deletions.CommentShareEXPERTBehramanswered 2 years ago"


Question: Your Amazon Web Services Account Email Has Been Updated

"I got an email mentioning the above with the below, looks like my credentials have been compromised and someone changed the details apparently without requiring any confirmation of OTP or otherwise... I submitted via can't login as I cannot login to create a ticket !!... Doesn't seem that this should be so hard to report and get assistance with... Any advice ??Why doesn't any change require an OTP or confirmation of some sort ? This seems way too easy to be locked out.Greetings from Amazon Web Services,As you requested, the email address associated with your AWS account has been updated.Old email address: xxxxxxxxxxxxxx@xxx.xxxNew email address: Txxxxxxx@teleworm.usTo view or edit your account settings, please visit the “My Account” page athttps://console.aws.amazon.com/billing/home?#/account.FollowComment"

Answer: "0Hi, it sounds like someone has got access to your account's root user if they were able to change the main email address.  Have you been logging in only as the root user, or so you have an IAM user you can still use to get in?  AWS advise always applying MFA to the root user and then not using it except in emergencies; you're right about it being way too easy to be locked out if you don't do that.There are three ways to login as root if you've set them up.  Firstly the email address + password + (hopefully) MFA.  Failing that, "alternate factors" where you are contacted on the account email address and phone number, but this doesn't help if the email address has changed.  Failing that, contacting AWS and using your security questions & answers - if these are set up and whoever broke into your account hasn't reset them, you can get root access this way.Beyond that I believe you may be able to get access via some legal attestation process but I've never been there so don't know for sure.CommentShareEXPERTskinsmananswered 3 months agoEXPERTkentradreviewed 3 months agorePost-User-0139319 3 months agoAgreed, I quickly emailed the abuse link and contacted some folks on chat... I think it is way too easy for someone to hijack and way too hard to get someone to help... BUT once I got some help we quickly got the account restored and does not appear to be any malicious activity before I got it back.I think Amazon should amend the login page to recommend the MFA, I run a few lightsail instances and am not a sophisticated user, I would have appreciated a warning to activate MFA or at the least some sort of check against password and email changing....I also noted a large amount of bogus ssh attempts ( before this ) seems as though that is somewhat common as all 3 of my servers had roughly same in logs. On ubuntu this was the command sudo less /var/log/auth.logShareskinsman EXPERT3 months agoGlad it worked out!  I strongly recommend that you immediately:Put MFA on your root user and stop using itUse only an IAM User, again with MFAMake sure you have all three ways to login as root established and working.Share"


Question: CloudMap timeout and network errors in AWS Console

"Hello, When I try to access the CloudMap Namespace in the AWS console, either from CloudMap or from the Namespaces in ECS, the page never loads and a read Timeout or "NetworkingError: Network Failure" banner appears. I have tried this over a period of a few days and the issue has not resolved. The problem only occurs for me in ap-southeast-2 (Sydney) .I do have a public zone in namespaces which I created a while ago. I can no longer access it or use it. Even trying to select that namespace when creating tasks in ECS results in a timeout.Any advice out be appreciated, Thanks.TonyFollowComment"

Answer: "0If you are experiencing timeouts or network errors while accessing CloudMap Namespace in the AWS console, there are a few troubleshooting steps you can try:Check the status of the AWS Management Console service in the AWS Service Health Dashboard. If there is an ongoing issue with the service, it may affect your ability to access CloudMap.Check if there are any issues with your internet connectivity or network configuration that may be causing the timeouts or errors. Try accessing CloudMap from a different network or device to see if the issue persists.Check the CloudMap service limits for your AWS account, as you may have reached a limit that is causing the issue. You can view and modify your service limits in the AWS Service Quotas console.Check if there are any AWS IAM policies or permissions that may be blocking your access to CloudMap. Make sure that you have the required permissions to access the service and that your IAM policies are properly configured.CommentSharehashanswered a month ago"


Question: REST API with Static Outbound IP & Custom Domain

"Hi,I am trying to setup Lambda functions with API Gateway as the trigger. I'll be making external API calls from the functions and I need my IP to be allowlist with the provider, so it should be static. I also need to provide them the hostname from where the API calls will originate from, so the API gateway will be using custom domain. I have the domain registered on Godaddy and for this API Gateway, I want to use a subdomain.At the moment, what I have done is:Created a VPC Endpoint with subnets in all the availability zones in the region.Created a private Rest API and assigned the above VPCE to it.Created the same number of Elastic IPs as the availability zones.Requested a new certificate from ACM for the subdomain, put the CNAME records on GoDaddy and got the certificate issued.Created a Target Group with IP as target type, TLS as protocol and HTTPS as health check protocol and registered the default subnet's IPs of each availability zone. I used 403 as the health check status expected as this will be the status when the API will be invoked using NLB's DNS for health checks. The health check comes out to be positive.Created Internet Facing, IPv4 Network Load Balancer. The listener was setup with TLS as the protocol. I assigned the above created EIPs to this load balancer and the above generated certificate too.At this point, I am successfully able to invoke the private API Gateway using the NLBs domain. However, I get a security warning because the domain for which the certificate was issued for is not being used to invoke the API. I created a Custom domain for the API and assigned the same certificate to it as well. But still, I get the same warning on the client side. And if I try to invoke the API with the custom domain name, I get no response at all because the name does not get resolved.If I had my domain registered on AWS Route 53, I would've been able to create an Alias record that pointed to the NLB. Can I still do this with external registrar and will this even do anything for me?Can somebody please guide me what needs to be done to get this working? Really appreciate it & thanks in advance.PS. Sorry for the long detail if it's unnecessary.FollowCommentalatech EXPERT4 months agoCould you try with CNAME defined in your DNS pointing to the NLB?ShareAli Taimoor 4 months agoThat may allow me to invoke the API with the custom name but what about the requests to external API provider that I will be making from Lambda? I need the said custom domain name to be the origin of that request too.Share"

Answer: "1Accepted AnswerFrom the point of view of your code in your Lambda function, you do not specify the domain name, so this should be some out of bound process.I assume you could create some domain name and map it in the DNS to the IP addresses that you have assigned to the NAT Gateway. If for some reason it is not possible (because you do not own the IP address, but rather AWS does), you can also bring your own IPs to AWS and assign one of your IPs to the NAT Gateway.CommentShareEXPERTUrianswered 4 months agoAli Taimoor 4 months agoThanks! Understood it now. Really appreciate the help!Share0This might help you https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html#dns-nameCommentShareTarun Tiwarianswered 4 months agoAli Taimoor 4 months agoThank you for sharing the article Tarun! However, I am not sure if this is what I am looking for. I will get a custom domain name associated with the NLB following this, but I need this name to be the origin of the API requests that I'll be making from the Lambda functions too.Share0It is not clear to me what you are trying to achieve. There are two options:You want to make outbound calls from a Lambda function to some external API and you want those calls to originate from a fixed IP (in this case it doesn't matter that the function is triggered by an API Gateway.You want some external party to make API calls to API gateway and you need a domain name, with maybe a fixed IP.If it is the first option, you need to attach the Lambda function to a VPC, create a NAT gateway in the VPC and attache an Elastic IP address to the NAT Gateway. This way all traffic from the function will originate from that IP address.If it is the second option you need to use custom domain names for the API. If you actually need the IP to be fixed as well, you will need to create a Private API (in this case you do not need custom domain names, which are actually not supported for private APIs anyway) and use something like a Global Accelerator as described in this blog.CommentShareEXPERTUrianswered 4 months agoAli Taimoor 4 months agoThank you for helping out!I'd actually like both, inbound and outbound static IPs, however I can do without the inbound one i.e., static IP for the APIs that I will host. But for the outbound requests from Lambda, I definitely need at least one. The blog you shared is really helpful. Is there any way I can get the same custom domain name to appear as the origin of the API requests that I will be making from the Lambda functions?I am not sure if the provider validates this too or not but they did ask me for the hostname, so I am assuming they do.Share"


Question: How to encrypt a production unencrypted RDS Aurora MySQL 8 cluster

"I have a running RDS Aurora MySQL 8.0.23 cluster running in production. The database is unencrypted and I need to enable encryption for it. As far as I understand, this is not possible to do directly. The procedure I am evaluating is:Create a read replica on the current cluster.Stop replication on replica and annotate binlog filename and position.Promote the read replica to a new encrypted cluster (maybe it requires to do a snapshot before).Set up back replication with the original cluster using binlog file and position annotated before.Wait until replication lag is zero.Redirect production traffic to the new cluster.Stop replication.[Optional] Delete old cluster.I have two issues with the above procedure:Once created the replica, running commands like 'SHOW SLAVE STATUS' or 'SHOW REPLICA STATUS' return empty set, so I can't annotate binlog file and position. Please note that replication is enabled on the original cluster (binlog_format is set to ROW).It seems I can't promote the Aurora read replica to a new cluster, the options is missing on the available actions. But according to  the documentation it should be possible.Has anyone have feedback about the issues above? What is the current up-to-date procedure to encrypt and Aurora MySQL cluster with minimum downtime and no data loss?FollowComment"

Answer: "0Hi, thanks for the answer!According from here https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Replication.MySQL.html Aurora does support native binlog replication, although it does not use it apparently for read replicas. Would be possible to promote a read replica to a new cluster and enable MySQL binlog replication between the original cluster and the new one? Then I could redirect traffic to the new one once the replica lag is zero, minimizing the downtimeCommentShareLudoanswered 4 months agoGanesh Swaminathan 4 months agoCan you replicate bin-logs from an Aurora Unencrypted cluster to a new Aurora Encrypted cluster?Yes : see https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Replication.MySQL.html  as it has more details than I can cover here.Alternative: consider AWS Data Migration Service: https://aws.amazon.com/dms/  (I know this better than replication)Even though DMS is intended for migrations between different database engines - it should work for same database engines with different clusters.I would create a new cluster and migrate data via DMS in parallel and then cutover.Share0From the documentation : https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Overview.Encryption.htmlYou can't convert an unencrypted DB cluster to an encrypted one. However, you can restore an unencrypted snapshot to an encrypted Aurora DB cluster. To do this, specify a KMS key when you restore from the unencrypted snapshot.You can't create an encrypted Aurora Replica from an unencrypted Aurora DB cluster.So the process could be something similar to belowSchedule some down time for the applicationStop all traffic to the databaseCreate a final snapshot from the current unencrypted clusterImport that snapshot into a new encrypted clusterBring up your application now pointing to the new clusterAlso note that Aurora does not use bin log replication - the replication is done on the storage layer and not within MySQL.CommentShareGanesh Swaminathananswered 4 months ago0Alternative process to the one I mentioned above to minimize downtime by creating a new encrypted cluster and replicating data to it before cutting over.We are mostly following guidance here : https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Replication.MySQL.htmlEnable binary loggong on unencrypted Aurora cluster(note this requires a reboot as we are changing the cluster parameter group)Enable binary log retention on the unencrypted cluster.You do this by setting a configuration as Aurora does not allow you access to underlying logsCreate a snapshot of the unencrypted database.This is a fairly straightforward process with the console or aws cliCreate a new encrypted cluster from snapshotKey step here is to make sure you have a KMS key and you use that kms key id when restoring the snapshot (https://docs.aws.amazon.com/cli/latest/reference/rds/restore-db-cluster-from-snapshot.html  shows the --kms-key-id parameter to use)Create a replication user on unencrypted clusterenable replication on encrypted clustercontinue to replicate till ready to migrateWhen ready to migrate stop all traffic to unencrypted clustermonitor replication to ensure its complete to the encrypted clusterStop replication (on both encrypted cluster and unencrypted cluster)do some sanity checks, maybe shutdown unencrypted cluster cleanlyMigrate application to new encrypted clusterPlease make sure you accept the answer if it helps!CommentShareGanesh Swaminathananswered 4 months ago"


Question: Best practices for multi million row alter table operation on Aurora MySQL

"A customer is using Aurora MySQL. He has a table with several million entries where we need to ALTER the primary key / auto_increment column from INT(11) to BIGINT(20).He tried Percona's pt-online-schema-change, which works very well on a standalone Aurora instance. However, Aurora read replicas cannot be discovered by this tool and he is worried in general to bring something out of order when this tool executes a rename of the tables and if this is correctly propagated to all readers.See https://www.percona.com/doc/percona-toolkit/LATEST/pt-online-schema-change.html#cmdoption-pt-online-schema-change-max-lag for details on the replica lag detection feature from pt-online-schema-change.Are there any Aurora specific recommendations to make such a change?ThanksFollowComment"

Answer: "0Accepted AnswerI suspect your customer is thinking that aurora read replicas are like regular mysql read replicas and have a separate physical copy of the database.  They do not, they share a common storage network/volume.  Therefore, the read replicas can only reflect what has happened on the writer instance, and there should be no concern about the read replicas not acknowledging/reflecting the changes.CommentShareEXPERTRichard Waymire - AWSanswered 5 years ago"


Question: Cost related Tagging for EMR Serverless

"Hi team, I need some clarification on whether cost tracking is supported at the per-job level with EMR Serverless? For example, with regular EMR, costs are tracked at the cluster level, tagged by cluster id (aws:elasticmapreduce:job-flow-id). With Serverless, is the costs associated for each job submitted by application id or some other job identifier ( I am asking from cost granularity by tagging prospective)FollowComment"

Answer: "0You can tag new or existing applications and job runs. If you're using the Amazon EMR Serverless API, the AWS CLI, or an AWS SDK, you can apply tags to new resources using the tags parameter on the relevant API action. You can apply tags to existing resources using the TagResource API action.CommentShareAWS-User-4371564answered a month ago"


Question: Is AWS RDS for MS SQL (non RDS Proxy) a SaaS or PaaS service

Is AWS RDS for MS SQL (non RDS Proxy) a SaaS or PaaS serviceFollowComment

Answer: "0Hi,It is a PaaS because provides a platform to develop and manage applications, where allows you to run yourself while exploiting certain aws managed features.It differs from Saas as Saas apps focuses more on a fully managed consumable end-users application it self.If it clarifies, I d appreciate to have this as accepted answer so that community benefits for clarity, thanks!CommentShareEXPERTalatechanswered 3 months ago"