Question: How to handle Typescript lambdas using modules embedded in a CDK project

"I have a question that's kind of a CloudFormation question but I guess is really a CDK question.  My project layout looks like this:work\.├───cdk.out├───bin├───lib├───node_modules├───src│   ├───common│   ├───ep│   ├───sites│   └───static├───package.json├───tsconfig.json└───testThe directories ep, sites, and static are all individual lambdas; the constructor script calls them out like this:entry: path.join(__dirname, "../src/sites/sites.ts"),so that works great.  In the package.json I am very careful about what goes into 'dependencies' vs. 'devDependencies' to avoid conflicts and bloat.It occurred to me, though, that some day I might end up with other problems, like conflicts, so I was searching around to see if I can give each individual lambda (ep, sites, static) their own package.json and maybe even tsconfig.json.  I found a few things saying it works, but a few others saying it won't.  yarn build only shows it running tsc once.  I think the answer to this is to use modules but because of the way you define an entry point (as a path to a single file) I don't get the idea this would work.I'm not sure how to make the lambdas within the CDK project more independent.  Do I  need to build them into their own, separate projects (outside of the CDK project), bundle them (say with webpack), then have the CDK project reference the build outputs for each?  That sounds a little messier, and I like having the entire stack (lambdas and all) in one place.  Is there a more self-contained way to do this?Generally speaking, my lambdas are classes.  This means that each one has an entry point defined that's just a regular function.  If I knew how modules work, could I make each lambda be a module, that's its own class, and have 'entry' point to just a plain typescript function that's part of the CDK project that does something like:import { SpecialHandler } from ../xyz;export async function handleSpecialRequest(request: APIGatewayProxyEventV2): Promise<APIGatewayProxyResultV2> {    return new SpecialHandler.handleRequest(request);}FollowComment"

Answer: "0Accepted AnswerHi there!I've seen others tackle this problem with tooling like Learn (https://lerna.js.org/). However, I would be wary of going the monorepo direction as the CDK team has baked in a lot of tooling around packaging and deploying JS/TS lambda's. If you were to go this route you would be reinventing the wheel, I could only recommend it if the problem is prevalent and not just a hammer in search of a nail.CommentSharetherealdakotalanswered 7 months ago"


Question: Not able to compile Roberta-large model for batch size larger than 1

"I am trying to compile a Roberta-large model for inf1 instance for batch size 4. I was successfully able to compile the model for batch size = 1, but getting the following error when trying to compile it for batch size greater than 1.instance used for compilation : inf1.24xlarge...............................................................................................................Compiler status PASS---------------------------------------------------------------------------RuntimeError                              Traceback (most recent call last)/tmp/ipykernel_46053/3817965199.py in <module>      4     torch.cat([input_1['attention_mask']] * batch_size,0)      5 )----> 6 model_neuron = torch.neuron.trace(model, neuron_inputs, compiler_args=['-O2'],strict=False)      7 #reranker.config.update({"traced_sequence_length": max_length})      8 ~/pytorch_venv/lib/python3.7/site-packages/torch_neuron/convert.py in trace(func, example_inputs, fallback, op_whitelist, minimum_segment_size, subgraph_builder_function, subgraph_inputs_pruning, skip_compiler, debug_must_trace, allow_no_ops_on_neuron, compiler_workdir, dynamic_batch_size, compiler_timeout, single_fusion_ratio_threshold, _neuron_trace, compiler_args, optimizations, verbose, **kwargs)    192     with skip_inference_context() as s:    193         logger.debug("skip_inference_context - trace with fallback at {}".format(get_file_and_line()))--> 194         neuron_graph = cu.compile_fused_operators(neuron_graph, **compile_kwargs)    195     cu.stats_post_compiler(neuron_graph)    196 ~/pytorch_venv/lib/python3.7/site-packages/torch_neuron/convert.py in compile_fused_operators(self, neuron_graph, **kwargs)    407     408         # STEP 2: Invoke the graphs, passing an "op_converter" or compiler functor to be invoked on each subgraph - mutate the model--> 409         neuron_graph(*neuron_graph.example_inputs, op_converter=op_converter)    410     411         # STEP 3: (re)Import the compiled sub-graphs as fused neuron operators~/pytorch_venv/lib/python3.7/site-packages/torch_neuron/graph.py in __call__(self, op_converter, *inputs)    196             unique_tensor_map[unique] = execute.no_grad_tensor(tensor)    197         for op in self.operations:--> 198             self.run_op(op, unique_tensor_map, op_converter)    199             if op.name in self._op_name_to_free_uniques:    200                 for unique in self._op_name_to_free_uniques[op.name]:~/pytorch_venv/lib/python3.7/site-packages/torch_neuron/graph.py in run_op(self, op, unique_tensor_map, op_converter)    207         if op_converter is not None:    208             op = op_converter(op, inputs)--> 209         outputs = op(*inputs)    210         if len(op.output_uniques) == 1:    211             outputs = [outputs]~/pytorch_venv/lib/python3.7/site-packages/torch_neuron/graph.py in __call__(self, *inputs)    340     341     def __call__(self, *inputs):--> 342         return self.func(self, *inputs)    343     344     def uses(self, index):~/pytorch_venv/lib/python3.7/site-packages/torch_neuron/resolve_function.py in func_from_schema(schema, op, *args)     69     if isinstance(overloads, tuple):     70         overloads, argument_names = overloads---> 71     return overloads(**kwargs)     72      73 RuntimeError: The expanded size of the tensor (256) must match the existing size (4) at non-singleton dimension 1.  Target sizes: [4, 256].  Tensor sizes: [4]Below is the code which I am using for compiling the modelinput_1 = tokenizer.encode_plus(text=input_sent_a,                              return_tensors="pt",                              padding='max_length',                              truncation=True,                              max_length=512)batch_size = 4neuron_inputs = (    torch.cat([input_1['input_ids']] * batch_size,0),    torch.cat([input_1['attention_mask']] * batch_size,0))model_neuron = torch.neuron.trace(model, neuron_inputs, compiler_args=['-O2'],strict=False)#reranker.config.update({"traced_sequence_length": max_length})Any help would be appreciated.FollowComment"

Answer: "0I am not able to reproduce the issue here. can you please share the full code that reproduces this issue? also please share what version of torch_neuron is used.It looks like from the error that the expected input batch shape isn't as expected.Input batch shape should look like [batch_size, sequence_length] in this case [4, 256]. are you getting different shapes?CommentShareaws-amerrezanswered a month ago0Used torch-neuron version as 1.7.1.2.5.8.0The code works when we use batch_size = 1 but not working for batch_size=2As the model is custom model, we cant share the model over hereClearly error shows that there is problem with the output."Target sizes: [4, 256].  Tensor sizes: [4]" => Expecting response for every input but does not looks like it is giving the output.CommentSharesenthil-User-9261510answered a month ago0Please open a support case with AWS Support, so that we can help you accordinglyCommentShareAWS-User-7713788answered a month ago"


Question: x-forwarded-proto header missing in ALB

"Hi,Created ALB using ingress controller. Ingress.yaml has all the relevant annotations. Initial flow works fine i.e. browser->https://url->R53->public hosted zone-> public ALB-> service->podHowever, when integrate the service with SAML IDP, after successful authentication, SAML assertion fails as returned/redirect url to service is http:// rather than https://AWS docs mentioned, ALB supports x-forwarded headers but not able to get the client's original protocol as x-forwarded header is missing.  Look for help to know how to get x-forwarded-proto header in the request? Any specific annotation to get this? Thanks !!FollowComment"

Answer: "0Hello,There is a feature where you can either remove, append, or preserve x-forwarded header but currently it is only supported for x-forwarded-for and x-forwarded-proto is unaffected. If you are using, authentication feature for SAML authentication, in that case it won't work or your configuration has to be - ALB - auth -> cognito ---> SAML.[+] HTTP headers and Application Load Balancers - X-Forwarded-For - https://docs.aws.amazon.com/elasticloadbalancing/latest/application/x-forwarded-headers.html#x-forwarded-forCommentShareSUPPORT ENGINEERTanvi_Uanswered 7 months ago"


Question: AWS Rekognition Performance

"I'm having trouble finding any detailed performance specs on AWS Rekognition. Would anybody be able to point me in that direction? I've seen some metrics thrown around such as 1.5 second search time when using the SearchFaces API, but it doesn't state how many photos that search was against.I'm looking to design something fairly large that will have approximately 100 million indexed photos in a collection. That collection will be compared against by approximately 25,000 new photos every day. Basically I'm just looking to determine how this algorithm compares against some non-cloud algorithms (ie. Cognitec, Neurotech, etc.)Thanks!FollowComment"

Answer: "0Accepted AnswerUnfortunately, there's no simple answer to that question, as it depends upon complexity of the picture, among other things (e.g. > blog post < that talks about more or less than 5 faces in a picture).Some tips for optimizing performance can be found in the dev guide > here. <CommentShareDan_Hanswered a year agoGaryTurner a year agoIn our case all photos will always be of a single person. Passport photo style pictures.Share"


Question: BUG: Codecommit concept of "Latest version" for pypi packages wrong

"Python package version information is defined in  (PEP 440)https://www.python.org/dev/peps/pep-0440/.However version sorting in code artifact is not conformant to PEP440. In particular I noticed that for code artifact 1.0.0.dev1 > 1.0.0 while for PEP440 it should be 1.0.0.dev1 < 1.0.0. In other words if both versions 1.0.0 and 1.0.0.dev1 are present, code artifact will report 1.0.0.dev1 as the "Latest version", while, in reality 1.0.0 is the latest one.(Did not check how code artifact treats 1.0.0rc1 and friends)This bug will not prevent pip from working correctly, but it is quite annoying in the WEB GUI to code artifact. Please read and implement PEP440 version sorting in code commit. THX.Edited by: stefano-m on Aug 5, 2020 6:39 AMEdited by: stefano-m on Aug 5, 2020 6:40 AMEdited by: stefano-m on Aug 5, 2020 6:42 AMFollowComment"

Answer: "0Accepted AnswerThanks for reporting this issue. I have created a ticket to track it, we will get it fixed.CommentShareCarl Lewisanswered 3 years ago"


Question: Instance reachability check failed (Linux)

"It show "Instance reachability check failed" and I am unable to SSH to the Instance.I look into System Log, there is no throw error on log and Screenshoot show login dialog.All resource graphic is show instance is at Idle state.FollowComment"

Answer: "0Set Instance to STOP then Start again. After that, it is now working fine.Please note: Public IP will change, if you not use any elastic IP.CommentShareNKatanaanswered 2 years ago0I tried to stop the instance and started again. But this is still not fixed. I even tried changing the instance type but of no use.Kindly help.CommentSharerePost-User-6453712answered 10 months ago0I too getting this error frequently with ubuntu free tier.  Its horrible I feel to see every 12 hrs its showing up "Instance reachability check failed" status.Any suggesions?CommentShareSankaranswered a month ago-2Set Instance to STOP then Start again. After that, it is now working fine.Please note: Public IP will change, if you not use any elastic IP.CommentShareNKatanaanswered 2 years ago"


Question: Failure handling between S3 trigger and Lambda

We added the S3 trigger to Lambda. How is the failure handled between S3 trigger and Lambda? What will happen if the lambda throw error ? Will it retry ? What metrics we should monitor to capture this failure to alert for manual intervention ? Can we configure retries similar to SQS and monitor DLQ ?FollowComment

Answer: "1Depending on the error Lambda will retry. You can enable Lambda Destinations to get notified about errors.CommentShareEXPERTUrianswered a year ago1The relation between Amazon s3 and Lambda is event based; asynchronous invocation.So, Lambda queues the event before passing it to your function. As it is asynchronous, by default will retry it up to two times. The event is kept for up to six hours. If all attempts fail or the time is too long, the event is discarded.In order to capture the error, you need to configure the error handling in Lambda and define the destination in case of failure.Here the documentation describing how to do it: https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.htmlCommentShareAlexandre_Panswered a year ago"


Question: aws datasync agent offline

"i deployed the datasync agent (Hypervisor) locally and generated the activation code in the local console and entered in the cloud console. the agent shows online for about 1 minute. after that the status remains offline. all the network tests in the local console are successful, but the agent never comes online.FollowComment"

Answer: "0Hello, is the DataSync agent currently still in an offline state or was this an intermittent issue?   The local console verification is a good start and if those are successful ensure there are no network scanners that are potentially disabling communicating outbound from the agent.If the agent remains offline, a support ticket would allow us to determine the underlying issue.CommentShareDarryl_Dioanswered a year ago"


Question: Do any AWS Device Farm devices pass Android SafetyNet Attestation?


Question: Distributed Transaction for Cron Jobs with Saga Pattern

"The Saga Pattern is a preferred way to do distributed transaction with Lambdas. The orchestration will work with lambdas.Please review the picture in the above link as well as this image.My question is about if I use a Cron Job instead of one of the Lambdas to process ProcessPayment. Please see this image. This Cron Job will retrieve the customers who have a flight and rental car and charge them every 5 hours instead of immediately. This 5 hours delay in the steps would block the whole function to be delayed for more than 5 hours. If that happens for a few hundreds customers, we will have* hundreds of transactions waiting to be committed or rolled back*.What is the right way to add distributed transactional ability with Saga Pattern & Step functions if we use functions that don't run in sequential order and immediately?FollowCommentUri EXPERTa year agoI am not sure what you are trying to do. You can't really change one of the tasks to a cron job. You might have a task to create a cron job with a task token so the state machine will wait, but you can achieve it much simpler by just adding a Wait state.Please try to explain your use case better,Share"


Question: Downsize ebs for windows

"What's the best way to downsize the volume attached to a windows EC2? I know you can't go to modify and select a smaller size. But could you setup a new volume and just copy everything over, then attached that as the primary volume? Or is there something else that can be done?FollowCommentHemant Chugh a month agoboth options are valid it depends how you want to proceed.However for windows recommendation would be to  create a new volume and copy everything over.Share"

Answer: "0As you've stated, you can only increase the size of EBS volumes in-place, not shrink them. You will have to do as you've stated, copy the data over and then use that as the primary volume. You could even attach both volumes (smaller and larger one) to the same instance and copy from one drive to the other.CommentShareLawrence Aielloanswered 2 months agoEXPERTJonathan_Dreviewed 2 months ago"


Question: Next.js 13 can't deploy on AWS Amplify

"I have next.js 13 repo on AWS CodeCommit, then I try to deploy on AWS Amplify but I got error like this"Houston, there's a problem We are unable to process your request. Please reach out to your support representative."anyone has solution to solve this error?thank you.FollowComment"

Answer: "0This behaviour typically might arise due to AWS Account specific issues like compromised key on the account, billing issues etc. Please check if there are any pending action that needs to be taken from your end on the same. You could check for such communication on your primary email address as well as any cases created in AWS Account's Support Center.In case you still face challenges, please reach out to us via AWS Support Center.CommentShareSUPPORT ENGINEERVishal_Nanswered 2 months ago"


Question: XGBoost Reports Not Generated

"Hi!I have been trying to create a model using XGBoost, and was able to successfully run/train the model. However, I have not been able to generate the training reports. I have included the rules parameter as follows: "rules=[Rule.sagemaker(rule_configs.create_xgboost_report())]".I am following this tutorial, but I am using objective: "multi:softmax" instead of the "binary:logistic" used in the example.When I run the model everything is fine but only the Profiler Report gets generated and I do not see the XGBoostReport under the rule-output folder. According to the tutorial it should be under the same file path.Here is my code for the model if it helps any:s3_output_location='s3://{}/{}/{}'.format(bucket, prefix, 'xgboost_model')container = sagemaker.image_uris.retrieve("xgboost", boto3.Session().region_name, "latest")train_input = TrainingInput(    "s3://{}/{}/{}".format(bucket, prefix, "data/train.csv"), content_type="csv")validation_input = TrainingInput(    "s3://{}/{}/{}".format(bucket, prefix, "data/validation.csv"), content_type="csv")rules=[    Rule.sagemaker(rule_configs.create_xgboost_report())]xgb = sagemaker.estimator.Estimator(    image_uri=container,    role=sagemaker.get_execution_role(),    instance_count=1,    instance_type="ml.c5.2xlarge",    volume_size=5,    output_path=s3_output_location,    sagemaker_session=sagemaker.Session(),    rules=rules)xgb.set_hyperparameters(    max_depth=6,    objective='multi:softmax',    num_class=num_classes,    gamma=800,    num_round=250)Any help is appreciated! Thanks!FollowCommentHernito EXPERT2 years agoHi, can you please include the link to the tutorial you are following?Sharejughead a year agoHey Hernito! Sorry for the late response but here is the tutorial: https://docs.aws.amazon.com/sagemaker/latest/dg/debugger-training-xgboost-report.htmlAlso looks like my code formatting got messed up when I posted the question. I will try to reformat it again.Thanks!ShareDennis 9 months agoWas this issue ever resolved? I followed the same dev doc and I'm experiencing this exact issue with no resolve yet. I see someone suggested "rules" was receiving a URL instead of a list, but I've verified within my code that it's definitely a list.Share"

Answer: "0I believe the issue here is the rules parameter is receiving a URL, not an array of RuleBase objects, as required by the Estimator documentation.  Try re-writing your estimator accordingly, as suggested by the SageMaker Developer Guide:xgb = sagemaker.estimator.Estimator(   image_uri=container,    role=sagemaker.get_execution_role(),    instance_count=1,    instance_type="ml.c5.2xlarge",    volume_size=5,    output_path=s3_output_location,    sagemaker_session=sagemaker.Session(),    rules=[      Rule.sagemaker(         rule_configs.create_xgboost_report()      )     ])For more information on using Rules, check out the SageMaker Debugger documentation.CommentShareDan_Fanswered 2 years agojughead a year agoHey Dan! Thanks for your reply. It looks like the formatting on my code was messed up after I uploaded it, not sure why it changed the rules to a URL. I have updated the code to more accurately represent what I am trying to run. Could you please take another look? ThanksShare0Hello jughead, Has your problem of your code been resolve? Let us know. Also, remember to click on the "Accept" button when an answer provided in the community helped you. This allows other community members to also benefit from it. Thank you for your participation.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year agoarusso98 a year agoNo his problem clearly has not been resolved if you bothered to read the responses. Why don't you try resolving it so others can benefit.Share0Hi,I had the same problem. To be able to generate the xgboost report, make sure that you use xgboost version 1.2-1 in your image_uri and sklearn version 1.0-1 as your estimator_cls in FrameworkProcessor. Furthermore, set header to False in train, validation and test files in your preprocessing script so that you exclude them before you run estimator.fit(). This worked for me.CommentSharerePost-User-4115425answered 7 months ago"


Question: EC2 > Instances > Launch an instance ; for Application and OS Images Firewall necessary? even after setup security group

"Hi,I set up security group for the instance, as you know I added rules for the ports over thereDo I need to enable ufw ? When I did 'sudo ufw status', it says 'status inactive'ThanksSungFollowComment"

Answer: "0Security groups and UFW have overlap in what they do for your instance. They both can block traffic based on port, protocol and source addresses, but UFW has many additional features:automatically blocking addresses for incorrect authentication attemptsreporting and logging with rsyslog supportpacket forwardingscripting support for automationintegration with web hosting panels (WHM and Plesk for example)Security groups have a few advantages over software firewalls; API support and IAM integration are just a few examples. In a fleet of hundreds of instances it's often a more simple approach to change 1 security group rule than to change the UFW configuration of each instance individually. Software firewalls also consume resources within the operating system. If you add enough rules eventually the system can slow down as it checks each rule for every connection. Using security groups offloads this work for more efficient filtering.My recommendation is to start with security groups and then to only add a software firewall if these additional features are needed. Many customers use security groups and network ACLs without any software firewall, but there is certainly nothing wrong with adding one for a specific use case.https://help.ubuntu.com/community/UFWhttps://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-best-practices.htmlCommentShareJames Wanswered 3 months ago"


Question: How is the Burst Capacity related to the Baseline?

"I have a function with a steady load of 1000 concurrent function invocations.The question is, how is the initial burst calculated? Is it based from zero or based from the function baseline 1000 in this case?With zero based and a Burst Limit of 3000 the function can scale to 3000 concurrency. With baseline the function can burst to 4000 concurrency.FollowComment"

Answer: "1Accepted AnswerLambda functions run in execution environments. The burst limit is the number of new execution environments that need to be created to handle the requests. We use a bucket algorithm with a predefined token capacity (500 / 1,000 / 3,000, depending on the region) and a fixed refill rate of 500 tokens / min. When we need to create a new execution environment, we first take a token from the bucket, if one exists. If the bucket is empty, the request is throttled.This means that in the larger regions for example, if you are running at a steady 1,000 concurrency for some period of time, which allows the bucket to get full (6 minutes), you will be able to invoke additional 3,000 concurrent functions and get to 4,000 concurrency immediately.Note that the burst limit is shared across all functions in the account and that you can't scale beyond the account's concurrency limit, which is 1,000 by default.CommentShareEXPERTUrianswered 2 years ago0See below the quote from the documentation here. This implies the total concurrency you can have is 3000 and this is only applicable to the following regions US West (Oregon), US East (N. Virginia), Europe (Ireland). If you need additional concurrency, you can raise a request for quote increase for your Account and the region you are deploying your lambda functions."Your functions' concurrency is the number of instances that serve requests at a given time. For an initial burst of traffic, your functions' cumulative concurrency in a Region can reach an initial level of between 500 and 3000, which varies per Region. Note that the burst concurrency quota is not per-function; it applies to all of your functions in the Region."CommentShareOzioma Uzoegwuanswered 2 years ago"


Question: EC2 creating images

"Hi. I have two EC2 instances running linux which I use as a web/database server and a mail server. I occasionally want to back-up both of these as AMI images. What I now do is "Stop Instance", then I select "Create Image". I then wait until the images have finished creating ( I watch the progress under Elastic Block Store>Snapshots). When the images show 100% completion, I start my instances again and my backup is finished. I would like to know, is it ok to start the EC2 instances up before the image creation is complete? I am trying to minimize my downtime, which currently is about 15 minutes.FollowComment"

Answer: "0Accepted AnswerYes, you can restart everything once the snapshot gets to 'pending' according to the documentation, Create Amazon EBS snapshots:Snapshots occur asynchronously; the point-in-time snapshot is created immediately, but the status of the snapshot is pending until the snapshot is complete (when all of the modified blocks have been transferred to Amazon S3), which can take several hours for large initial snapshots or subsequent snapshots where many blocks have changed. While it is completing, an in-progress snapshot is not affected by ongoing reads and writes to the volume.CommentShareEXPERTkentradanswered a year agoEXPERTBrettski-AWSreviewed a year ago"


Question: Is AWS DataSync a bidirectional service?

"If DataSync is configured with an on-prem NFS mount as the source, and EFS as the target, will changes to the EFS volume be reflected on-prem?FollowComment"

Answer: "1Accepted AnswerHi!I have been looking for an answer to this question for a few hours.  This is the closest I have found.  However, I don't think that bidirectionality is supported.  Would be nice if someone found otherwise.https://docs.aws.amazon.com/datasync/latest/userguide/other-use-cases.html#opposite-direction-tasksTransferring files in opposite directionsTransferring data in opposite directions allows for workflows where the active application moves between locations. AWS DataSync doesn't support workflows where multiple active applications write to both locations at the same time. Use the steps in the following procedure to configure DataSync to transfer data in opposite directions.To configure DataSync to data transfers in opposite directionsCreate a location and name it Location A.Create a second location and name it Location B.Create a task, name it Task A-B, and then configure Location A as the source location and Location B as the destination location.Create a second task, name it Task B-A, and then configure Location B as the source location and Location A as the destination location.To update Location B with data from Location A, run Task A-B.To update Location A with data from Location B, run Task B-A.Don't run these two tasks concurrently. DataSync can transfer files in opposite directions periodically. However, it doesn't support workflows where multiple active applications write to both Location A and Location B simultaneously.CommentSharesharpedgewvanswered a year ago1Hi,DataSync moves data from a specified source location to a destination location using task executions. You can create two tasks to move data in both directions as outlined above.  However, it is not recommended to execute these tasks simultaneously for a bi-directional sync.  DataSync does not perform any collision detection or version reconciliation with writes occurring in both locations.  The task scans the source and destination for changes and will copy files based on the inventory at the time of the scan.CommentShareDarryl_Dioanswered a year ago"


Question: EC2 free tier snapshot data limit surpassed.

"I have been using the free tier of ec2 recently and have surpassed the 1gb limit of snapshot data but never have in any past months, so I am not totally sure what that means. I did have to remake my ec2 instance because I had lost my key pair and was wondering if in that process, I surpassed my snapshot data limit.FollowComment"

Answer: "0Greetings,It's possible you have created an AMI (Amazon Machine Image) which includes a snapshot of the root volume for your EC2 instance. This snapshot may have caused your account to surpass the free tier snapshot limit of 1GB.You can confirm this by following the steps below to view snapshots you currently own:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-describing-snapshots.htmlIf this snapshot/s have been created while an AMI was created, you can correlate the snapshot ID with the root volume by following these steps:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/RootDeviceStorage.html#display-instance-root-device-typeAt this point you should be able to determine if there is excessive snapshots and if they are correlated with an AMI. You can then delete any redundant AMI (including snapshot) to reduce the snapshot storage in your account.We'd appreciate if you'd update this thread with your findings, and hopefully confirmation of the issue being resolved.Regards, AntAWSCommentShareAntAWSanswered 3 months ago"


Question: Enabling SSL Policies for EKS Cluster without Loadbalancer

"Suppose an 'EKS Cluster' was created, and if no loadbalancers exists, is there any way to associate the 'SSL Policies' without loadbalancerFollowComment"

Answer: "0Yes, it is possible to associate SSL policies with an Amazon Elastic Kubernetes Service (EKS) cluster without using a load balancer. One way to do this is by using a Kubernetes ingress resource, which allows you to configure rules for routing incoming traffic to different services within your cluster.Here is a general overview of the process:Create an SSL certificate for your domain using AWS Certificate Manager (ACM) or another certificate provider.Create a Kubernetes Secret that contains the SSL certificate and private key. This can be done using the Kubernetes command line tool kubectl.Create a Kubernetes Ingress resource that references the secret and routes incoming traffic to the appropriate service within your cluster.Add an annotation to the Ingress resource to configure the SSL policy that you want to use.Deploy the Ingress resource to your EKS cluster.Please note that this is a high-level overview and you would need to do more research on how to set up and configure each of these services. And also you might need to check if your applications are compatible with this approach.CommentSharejayamaheizenberganswered 4 months ago"


Question: SageMaker Neo with SageMaker Serverless Inference possible?

Can I use SageMaker Neo to compile my model and then deploy it to SageMaker Serverless inference? Which instance type in Neo should I use in that case?FollowComment


Question: AWS Solution Certitfication

"Hi AWS Team,I have schedule my exam for AWS associate at  and the Pearson VUE proctor asked to reschedule the exam stating mismatch in name.Exam:SAA-C03 - AWS Certified Solutions Architect - Associate - English (ENU)Case number: 08980479Candidate:Dinesh PrabakaranCandidate ID:AWS03287353Registration ID:438167940FollowComment"

Answer: "1I am assume you need help to change your name. Extracted from https://www.aws.training/support=== Extracted ===To change your name on your AWS Certification Account, please submit a ticket to the AWS Training and Certification Support team (https://support.aws.amazon.com/#/contacts/aws-training). Select "Account Assistance" as the inquiry type and "Name Change" as the additional details and include the requested information in the description. If needed, our Support team will request documentation to process the edit. Once all necessary information is submitted, please allow up to two days for the change to be processed.CommentShareronald_lanswered 5 months ago"


Question: Error message: Additional Verification Required

"Hello,I am hitting the following error message when attempting to make an ACM certificate request: "Error message: Additional Verification Required".I am confused, as my domain is not a top ranked domain. And the domain is already verified in existing ACM certificates.It is a .by domainHow can we get this unblocked.ThanksFollowComment"

Answer: "0Hello,I understand you are receiving the error "Additional Verification Required." This means that ACM requires additional information to process this certificate request. This occurs as a fraud-protection measure if your domain ranks within the Alexa top 1000 websites. I see that you have mentioned that your domain is not present in this list and also that you already have some certificates issued for this domain.https://aws.amazon.com/premiumsupport/knowledge-center/acm-domain-certificate-allow-list/Since re:Post is a public platform, it isn't recommended to discuss in detail regarding your domain and the ACM certificate request over this platform for security and privacy reasons. The best way to resolve this issue is to file a ticket with AWS Support so that we can troubleshoot the root cause for this issue and help you resolve it.https://console.aws.amazon.com/support/home#/case/create?issueType=technicalCommentShareNuzhat_Sanswered a year agoSUPPORT ENGINEERSumukhi_Previewed 10 months ago"


Question: Backup elasticsearch from on-premise to AWS with encryption

"I have on-premise elasticsearch cluster and i have daily snapshots on NFSas we know elasticsearch make first full snapshot and then makes incremental ( only new data will write to new snapshot ) so i have 1 big directory where snapshots are stored for a year ( in elasticsearch the place where snapshot locates called snapshot repository )but for now i want to have a copy of my snapshots on AWS, and that data must be encrypted ( on client side preferably ) but elasticsearch cannot work encrypted snapshot repository ( when new snapshot are running, elasticsearch may delete or change older files, so if this files encrypted the snapshot process turn into failed state ) so for case with client-side encryption i choose these varianteveryday create new folder with (name-Date) format then register that snapshot repositorymake FULL snapshot to that directoryencrypt that directory using gpg or something elsecopy this encrypted directory to AWS S3but i have about 150 gb of data, and that data are growing, I'm afraid that it's redundant to make full backups every day and copy so much data ( and i must encrypt 150 gb data everyday)yeah i know about CMK (Customer managed keys and CloudHSM ) but according to internal reasons the client-side encryption method is preferable, is this solution good for that case or better solution exists? i think my solution works better when scheduling to run once a week but nor every dayFollowComment"

Answer: "1Yeah by the looks of it, it doesn't seem sustainable for you to continuously create full backupsI would suggest you to start doing incremental backups, which has 1 baseline backup and every backup after that will only backup the data that has been accessed or altered. This can be done with Elastisearch as it has an incremental backup feature.Another approach could be to use a backup solution that supports encryption at rest, such as AWS Backup. AWS Backup can be used to backup Elasticsearch snapshots stored in S3 and it supports encryption at rest using AWS KMS. This will allow you the ability to have encrypted data  wthout the need of performing daily client side encryption with elastisearchHowever, the best solution for your use case will depend on your specific requirements and constraints.I hope this helps, have a good oneCommentShareAWS_Guyanswered 3 months agorePost-User-9680164 3 months agoyeah but when i encrypt my snapshot repository on client side, the elasticsearch cannot write or read from that repo :(Share1If client side encryption is not mandatory, then you can evaluate the s3 repository plugin to create snapshots directly in S3 without the need to take full backups everyday ( approach you suggested ). It supports SSE--SydCommentShareSydanswered 3 months ago0While your current solution could work, you're right that it might not be the most efficient or cost-effective method, especially when dealing with daily full backups. Here's an alternative approach that could be more suitable for your use case:Create an initial full snapshot of your Elasticsearch data in the local NFS storage.Encrypt the snapshot using your preferred client-side encryption method (e.g., GPG).Upload the encrypted snapshot to AWS S3.For daily incremental backups:a. Create an incremental snapshot of your Elasticsearch data in the local NFS storage.b. Encrypt only the new or changed files from the incremental snapshot.c. Upload the encrypted files to the corresponding S3 folder, preserving the directory structure.Maintain an index file or manifest to keep track of the encrypted files and their relationships with the original snapshots.This approach ensures that you're only encrypting and uploading the new or changed data every day, reducing the storage and bandwidth requirements. You can also consider using AWS S3 Transfer Acceleration to speed up the transfer process.Please note that this solution assumes you have the necessary infrastructure and permissions to access and manipulate the Elasticsearch snapshots at the file level.In addition, you should consider implementing a data retention policy and lifecycle rules on your S3 buckets to automatically transition older snapshots to lower-cost storage classes or delete them when they're no longer needed. This will help you optimize storage costs while maintaining data availability.Lastly, be sure to test your backup and recovery process to ensure the encrypted snapshots can be decrypted and restored correctly.CommentShareZJonanswered 3 months agorePost-User-9680164 3 months agoThank you so much for you answer! but elasticsearch snapshots works not like that ;(Share"


Question: Cloudwatch logs to S3 continuous export

I am looking for the solution of exporting Cloudwatch logs to S3 continuously where there is log updates from application. I am looking for a automated log export from cloudwatch to S3.FollowComment

Answer: 1See: Example 3: Subscription filters with Amazon Kinesis Data Firehose.CommentShareEXPERTkentradanswered a year ago


Question: AWS Transfer Family - Private SFTP server connection closed

"Hi,I'm curently facing a problem trying to create a private SFTP Server (deployed in a VPC) using AWS Transfer Family.So here are the steps I followed:I started an EC2 in one of three subnets associated with the SFTP server (created in another step)Those subnets are privateI connected to the EC2 instance using session managerI created an ssh key named sftp_key to connect to the SFTP serverI Created an IAM role for the transfer service:{  "Version": "2012-10-17",  "Statement": [      {      "Effect": "Allow",      "Principal": {            "Service": "transfer.amazonaws.com"      },      "Action": "sts:AssumeRole",      "Condition": {        "StringEquals": {            "aws:SourceAccount": "<AccountId>"        },        "ArnLike": {            "aws:SourceArn": "arn:aws:transfer:eu-west-1:<AccountId>:server/*"        }      }      }    ]}Attached an inline policy to this role:{  "Version": "2012-10-17",  "Statement": [      {          "Sid": "AllowListingOfUserFolder",          "Action": [              "s3:ListBucket",              "s3:GetBucketLocation"          ],          "Effect": "Allow",          "Resource": [              "arn:aws:s3:::<BucketName>"          ]      },      {          "Sid": "HomeDirObjectAccess",          "Effect": "Allow",          "Action": [              "s3:PutObject",              "s3:GetObject",              "s3:DeleteObjectVersion",              "s3:DeleteObject",              "s3:GetObjectVersion"          ],          "Resource": "arn:aws:s3:::<BucketName>/*"      }  ]}Created a Role for logging management. This role has the following inline policy:{  "Version": "2012-10-17",  "Statement": [      {          "Sid": "CreateLogsForTransfer",          "Effect": "Allow",          "Action": [              "logs:CreateLogStream",              "logs:DescribeLogStreams",              "logs:CreateLogGroup",              "logs:PutLogEvents"          ],          "Resource": "arn:aws:logs:*:*:log-group:/aws/transfer/*"      }  ]}Created an SFTP Server using the CLI like this:aws transfer create-server --identity-provider-type SERVICE_MANAGED --protocols SFTP --domain S3 --endpoint-type VPC --endpoint-details SubnetIds=$SUBNET_IDS,VpcId=$VPC_ID,SecurityGroupIds=$SG_ID --logging-role $LOGGINGROLEARN --security-policy-name $SECURITY_POLICYSUBNET_IDS: list of 3 privates subnets idsVPC_ID: the concerned VPC IDSG_ID: ID of a security group. This group allows all access on port 22 (TCP) from the same subnets (SUBNET_IDS)LOGGINGROLEARN: Arn of the logging roleSECURITY_POLICY=TransferSecurityPolicy-2020-06Created a user with the CLI:aws transfer create-user --home-directory $DIRECTORY --policy file://sftp-scope-down-policy.json --role $ROLEARN --server-id $SERVERID --user-name $1 --ssh-public-key-body "$SSHKEYBODY"DIRECTORY=/<BucketName>/<userName>ROLEARN: Role created beforeSSHKEYBODY: public key of the ssh key created on the EC2sftp-scope-down-policy.json content:{  "Version": "2012-10-17",  "Statement": [      {          "Sid": "AllowListingOfUserFolder",          "Action": [              "s3:ListBucket"          ],          "Effect": "Allow",          "Resource": [              "arn:aws:s3:::${transfer:HomeBucket}"          ],          "Condition": {              "StringLike": {                  "s3:prefix": [                      "${transfer:UserName}/*",                      "${transfer:UserName}"                  ]              }          }      },      {          "Sid": "HomeDirObjectAccess",          "Effect": "Allow",          "Action": [              "s3:PutObject",              "s3:GetObject",              "s3:DeleteObject",              "s3:DeleteObjectVersion",              "s3:GetObjectVersion"          ],          "Resource": "arn:aws:s3:::${transfer:HomeDirectory}*"      }  ]}A VPC endpoint exists for the three subnets for the following services:com.amazonaws.eu-west-1.ec2com.amazonaws.eu-west-1.ssmcom.amazonaws.eu-west-1.ssmmessagesSo here is the problem:I tried to connect to the SFTP server from the EC2 launched in the first step using this command:sftp -vvv -i sftp_key <userName>@<ServerPrivateIp>the ssh logs shows that the connection suceeded but after that the connection closed directly.debug1: Authentication succeeded (publickey).Authenticated to <ServerPrivateIp> ([<ServerPrivateIp>]:22).No logs are created on CloudWatch Logs and I can see nothing special on CloudTrail logs.Can someone explain me what I missed ?FollowComment"

Answer: "0Hello wmegel@,Thank you for sharing all the details.Since you observed Authentication Succeeded, it implies that connection to the server was established and there shouldn't be any issues in terms of intermediate network. Concerning the error, I suspect it has something to do with the Trust relationship of the associated IAM Roles. Could you make changes as follows and test the behavior -For the Logging Role -{  "Version": "2012-10-17",  "Statement": [      {      "Effect": "Allow",      "Principal": {            "Service": "transfer.amazonaws.com"      },      "Action": "sts:AssumeRole",      "Condition": {        "StringEquals": {            "aws:SourceAccount": "<account-id>"        },        "ArnLike": {            "aws:SourceArn": "arn:aws:transfer:<region>:<account-id>:server/*"        }      }      }    ]}For the User Role -{  "Version": "2012-10-17",  "Statement": [      {      "Effect": "Allow",      "Principal": {            "Service": "transfer.amazonaws.com"      },      "Action": "sts:AssumeRole",      "Condition": {        "StringEquals": {            "aws:SourceAccount": "<account-id>"        },        "ArnLike": {            "aws:SourceArn": "arn:aws:transfer:<region>:<account-id>:user/<server-id>/*"        }      }      }    ]}Rest of the setup that you specified seems accurate to me. Could you make the above changes and test again to confirm if you can access S3 as desired?In regards to your question on logging, CloudTrail shows Management level API calls such as CreateServer, CreateUser. For data level calls to your server, CloudWatch log group for your server should show details. Probably, the logs didn't populate due to issues in Trust relationship for the logging role. Once you make the above changes, you should see logs being populated in CloudWatch log group for your server.I look forward to your update.Reference: https://docs.aws.amazon.com/transfer/latest/userguide/confused-deputy.htmlThanks,SagarCommentShareEXPERTsagarb-awsanswered a year ago"


Question: An unknown error on snapshot upgrade for PostgreSQL

"Hi, I have a manual snapshot created from a DB instance running on PostgreSQL 10.20 engine. I want to use this snapshot for creating a new DB instance that will run on PostgreSQL 14.2 through Cloud Formation. Since this snapshot is created from a different PostgreSQL version, I need to upgrade it first to 14.2 before I initiate the create operation (the stack creation fails otherwise). The snapshot upgrade fails as well with:errorCode: InternalFailureerrorMessage: An unknown error occurredI was upgrading the snapshot through AWS CLI (aws rds modify-db-snapshot command) and AWS console, but in both cases, it fails the same way.FollowComment"

Answer: "0Hi there!From the notes, I understand that you want to perform a PostgreSQL upgrade from engine 10.20 to 14.2 and you are currently getting an error. Please correct me if I misunderstood.Please note that if you're creating or updating your CloudFormation stack, you can receive an "Internal Failure" error when an operation on a resource fails. You can also receive this error if your stack fails to deploy, please refer to outlined AWS documentation [1] to help you troubleshoot the issue.However, since you also mentioned that the snapshot upgrade fails, I replicated the instance on my side with the specifications and managed to upgrade successfully through the AWS CLI.This is the command I ran:aws rds modify-db-snapshot --db-snapshot-identifier postgresql-cli-snapshot --engine-version 14.2And the result:{    "DBSnapshot": {        "DBSnapshotIdentifier": "postgresql-cli-snapshot",        "DBInstanceIdentifier": "postgresql",        "SnapshotCreateTime": "2022-07-01T12:02:33.917000+00:00",        "Engine": "postgres",        "AllocatedStorage": 100,        "Status": "upgrading", }I hope you find the above information helpful.Have a great day ahead!References:[1] https://aws.amazon.com/premiumsupport/knowledge-center/cloudformation-internal-failure-error/CommentShareLettyanswered a year ago"


Question: Disable hosted UI

Is there a way to disable the hosted UI?  We have built our own login/registration forms and I would like to disable Cognito's hosted forms to prevent access to them.FollowComment

Answer: "0I believe you can just delete the userpool domain...then the hosted ui is gone.  If you have verification enabled it must be set to 'code' (not 'link') as the link points at that domain and will prevent user signup if the domain is not set.CommentShareredecanswered 5 years ago0Have you figured out if/how to do this?  I have been unable to figure out/understand how to use the Cognito Auth API without being redirected to the Cognito Hosted UI.Thanks,EricCommentSharebenzeanswered 5 years ago0Here is how to use the token endpoints without having to use the hosted UI. https://forums.aws.amazon.com/message.jspa?messageID=832873#832873https://stackoverflow.com/questions/49012091/aws-cognito-authorization-code-grant-flow-without-using-the-hosted-uiBut the hosted UI will still be active which is my issue.Edited by: CognitoUser on Mar 16, 2018 5:25 AMCommentShareCognitoUseranswered 5 years ago0Hi,I can understand why you might not want the hosted UI to be even available, but that's not possible today if you want to use the OAuth2.0 flows.Is the issue that you don't want users to sign up or sign in directly with a username/email and password using the hosted UI, but you want to only allow that through your UI? If so, you can uncheck Cognito User Pool from the Enable Identity Providers section of the App client settings (under App integration) in the Cognito console. If Cognito User Pools is unchecked, a user may still see the federated options if they find their way to the hosted UI, but they can't sign in or sign up directly in the User Pool with username/email and password.I hope that helps.-TimCommentShareAWS-User-0233959answered 5 years ago"


Question: Unable to run tests reliably

"I have a number of Lambda functions installed in several regions.Over the last few weeks it has become generally impossible to run Tests from the code editor.When I click "Test", a "Execution results" tab opens and a spinner starts in the "Test" button but no results are ever displayed. These are generally short-lived functions (on the order of tens of milliseconds) so I would expect them to return within a few seconds.Occasionally, a Test invocation works, but it is very rare.No entries are made in Cloudlog indicating that the function never actually starts.Any idea what could be causing this? I am confident it is not the code nor the test configs.And now they are running fine for some reason.Closing because nothing changed.Edited by: AWSRegularUser on Sep 17, 2021 12:32 PMFollowComment"

Answer: 0Nothing changed but the tests I was running started returning.CommentShareAWSRegularUseranswered 2 years ago


Question: Best practice sending SMS with EC2 PHP without the AWS PHP SDK

Hello!We would like to use text messages SMS to our clients for certain functions of our website. We are using EC2 with Apache and like to send an SMS with PHP without using the AWS PHP SDK. We cannot find out how to send commands with PHP directly to AWS SNS or to AWS Pinpoint. The telephone numbers come from our database so using 'topics' would seem not usable.Any help is appreciated!FollowComment

Answer: "1Accepted AnswerSince you are running the PHP app on an EC2 instance, you can attach an instance profile to the instance to make the SNS or Pinpoint API calls with SDK with minimal configurations. If you need an alternative way, an easy workaround is to use a REST API in API Gateway. You can have the API method to make an SNS/Pinpoint API call. So, the end users in this case PHP app on EC2 can hit the API endpoint to indirectly send messages through SNS/Pinpoint. However, it is still recommended that you secure the API.How do I use API Gateway as a proxy for another AWS service?Security best practices in Amazon API GatewayWhat is the reason behind not wanting to use AWS SDK?CommentShareTaka_Manswered 6 months agorePost-User-3079576 6 months agoPardon me for the late response. The API workaround seems acceptable for us. We prefer not to use the AWS SDK for PHP because we could not find the way to build the SDK with only the SNS components and its dependencies. Now we would need the entire SDK loaded on the server which creates a lot of code clutter and unnecessary tools we do not need nor want.Thank you for your time to answer my question.Share"


Question: FleetCapacityExceededException - Unable to reserve a process on fleet

"Hi there,We're using the GameLift Realtime servers, but after an amount of time running a fleet we've noticed that calls to CreateGameSession will start to throw an exception:FleetCapacityExceededException - Unable to reserve a process on fleetThis seems like a resource leak of some kind, but we're unsure what that actual issue is. When the problem occurs, we bump the instance count and eventually just replace the fleet with a new one.As far as the data available on the GameLift Management Console is concerned, we have plenty of Available game sessions and Available player sessions. We're running no less than a single instance in a fleet, with 50 Concurrent processes.The dashboard also indicates 50, 100, or 150 active and healthy Server processes all the time depending on whether we have 1, 2, or 3 instances in the fleet. This actually seems strange to me, shouldn't this number potentially fluctuate as server processes start/terminate?Our script  is based on the documentation (https://docs.aws.amazon.com/gamelift/latest/developerguide/realtime-script.html), so I believe we're exiting correctly (otherwise I would assume the issue would crop up much faster?) We have the exact same tickLoop function that periodically checks for active players and exits if none are left:async function tickLoop() {    const elapsedTime = getTimeInS() - startTime;    logger.info("Tick... " + elapsedTime + " activePlayers: " + activePlayers);    if ( (activePlayers == 0) && (elapsedTime > minimumElapsedTime)) {        logger.info("All players disconnected. Ending game");        const outcome = await session.processEnding();        logger.info("Completed process ending with: " + outcome);        process.exit(0);    }    else {        setTimeout(tickLoop, tickTime);    }}I was hoping a GameLift engineer might take a look at our fleet and illuminate what the problem is:Region: us-east-1FleetId: fleet-******CheersFollowComment"

Answer: "0Unable to reserve a process on a fleet generally means things:That you have no spare processes left to host game sessions. You should be able to see this in your fleet metrics (https://docs.aws.amazon.com/gamelift/latest/developerguide/monitoring-cloudwatch.html). There should be an available game session metricsIf you don't see available game sessions then I would guess is that you are not calling TerminateGameSession / ProcessEnding to clean up the game sessions. Confirm your tick loop is running as expected and you see calls to ProcessEnding being made.You are out of threads/memory/cpu so your server cannot respond in time/successfully. Check your instance metrics to confirmTry larger instances or fewer servers per instance and ensure you are not CPU/memory bound.Otherwise you're encountering some SDK/GameLift communication bugs, in which case we can get GameLift service team to investigate, but please check 1 & 2 first.CommentSharerePost-User-5332620answered 3 years ago0Hi Pip -- hope you're well,First, in the past week we've experienced this issue on:May 24th at 10:30 AM PSTMay 24th at 10:36 AM PSTMay 27th at 6:09 PM PSTNow for your points, I'll attach some graphs / logs here. So:Available game sessionsIt appears we have enough available game sessionsREMOVEDUPLOADAre we calling TerminateGameSession / ProcessEnding correctly?Here are some logs from a particular process ending:28 May 2020 17:54:00,382 [INFO] (server.js) 1646: All players disconnected. Ending game28 May 2020 17:54:00,397 [INFO] (gamelift.js) 103: Calling GameLiftServerAPI.ProcessEnding28 May 2020 17:54:00,713 [INFO] (gamelift.js) 108: GameLiftServerAPI.ProcessEnding succeeded with optional result: undefined28 May 2020 17:54:00,713 [INFO] (server.js) 601: Completed process ending with: trueShould we be concerned about the undefined optional result?GameLiftServerAPI.ProcessEnding succeeded with optional result: undefinedCPU usageREMOVEDUPLOADMemory usageThe red, orange, & blue lines represent the first, second, & third instance in our fleet over time.REMOVEDUPLOADThreads -- I'm not sure if/how to track this metric. Instead here are the number of established connections:Again with red, orange, & blue for the first, second, & third instance in each fleet over timeREMOVEDUPLOADBased on these metrics, I don't think I see anything glaringly obvious? Maybe our CPU usage is a little too high? We only topped out ~80%.CommentSharerePost-User-3562821answered 3 years ago0Thanks for the update. I will file an issue with the GameLift service team to take a look.CommentSharerePost-User-5332620answered 3 years ago0Hello Kip,I have investigated the FleetCapacityExceededExceptions you are seeing, and found that they are due to server-processes beginning registration with our service, but not completing the registration for some time. This causes server-processes to look available in metrics, but not actually be available for gameSession placement.From looking at logs, the cause of this issue is that the on-box process that registers server-processes is starved for threads and doesn't have resources to complete the process registration. Looking at ec2 metrics, I see that some of the instances in the fleet hit 100% CPU utilization at times as well. These fleetCapacityExceededExceptions can likely be solved by reducing the # of concurrent server processes.I'll work to improve "AvailableGameSession"  metric to be more accurate. In the meantime, reducing # of concurrent server processes should solve this issue you're seeing.CommentSharerePost-User-3818694answered 3 years ago0Looking at the debug messages, they're pretty much all related to log upload.  Looking closer, it looks like the same files are being uploaded many times.  The need to copy/compress/upload all these files is why you're seeing large log volumes as well as high cpu.It looks like when one process terminates aux proxy sets off uploading logs across all processes, not just the one that terminated.  My guess is that when you called Process ready you passed in /local/game/logs instead of (or possibly in addition to) /local/game/logs/<pid>.  You need to ensure that you are only specifying the process-specific log directory to be pulled.  If you correct that then I believe your problem should go away.CommentSharerePost-User-0985817answered 3 years ago0To clarify, I believe that you are specify the per-pid directory correctly in process ready.  The issue is that you also have the parent directory specified on the fleet itself.  If you remove the parent from the fleet configuration I think that your issue should go away.CommentSharerePost-User-0985817answered 3 years ago0Hi @REDACTEDUSERJust to clarify, we're using the GameLift Realtime Servers product. I'm a bit confused by your comment, I don't think this is something we control on our end?Taking a look at the application logs:[gl-user-remote@ip-10-22-80-142 ~]$ cd /local/game/logs[gl-user-remote@ip-10-22-80-142 logs]$ grep -R "Realtime server started" | head -n 52952/server.log.2020-06-01-02:01 Jun 2020 02:19:45,742 [INFO] (gamelift.js) 223: Realtime server started! Calling GameLiftServerAPI.ProcessReady with processParameters: {"Port":1908,"LogParameters":{"LogPaths":["/local/game/logs/2952"]}}3422/server.log.2020-06-01-02:01 Jun 2020 02:19:46,531 [INFO] (gamelift.js) 223: Realtime server started! Calling GameLiftServerAPI.ProcessReady with processParameters: {"Port":1922,"LogParameters":{"LogPaths":["/local/game/logs/3422"]}}2875/server.log.2020-06-01-02:01 Jun 2020 02:19:46,197 [INFO] (gamelift.js) 223: Realtime server started! Calling GameLiftServerAPI.ProcessReady with processParameters: {"Port":1916,"LogParameters":{"LogPaths":["/local/game/logs/2875"]}}3377/server.log.2020-06-01-02:01 Jun 2020 02:19:47,142 [INFO] (gamelift.js) 223: Realtime server started! Calling GameLiftServerAPI.ProcessReady with processParameters: {"Port":1938,"LogParameters":{"LogPaths":["/local/game/logs/3377"]}}2961/server.log.2020-06-01-02:01 Jun 2020 02:19:46,793 [INFO] (gamelift.js) 223: Realtime server started! Calling GameLiftServerAPI.ProcessReady with processParameters: {"Port":1931,"LogParameters":{"LogPaths":["/local/game/logs/2961"]}}Assuming LogPaths is the parameter we're talking about, they do seem to be specified on a per-pid basis.CommentSharerePost-User-3562821answered 3 years ago0There's a log paths parameter attached at the fleet level.  This is combined with the paths that you register for each process.  It looks like you can't update this -- it is only specified when you create the fleet.  How did you create your RTS fleet?  via the console, CLI, or something else?  If CLI, do you have the command that you used (and also where you got the command from).  I am wondering if we might have bad/misleading instructions out there somewhere, but I was unable to find them looking around a bit.CommentSharerePost-User-0985817answered 3 years ago0@REDACTEDUSERhttps://docs.aws.amazon.com/cli/latest/reference/gamelift/create-fleet.html--log-paths (list)This parameter is no longer used. Instead, to specify where Amazon GameLift should store log files once a server process shuts down, use the Amazon GameLift server API ProcessReady() and specify one or more directory paths in logParameters . See more information in the Server API Reference .Edit: Looks like you're right about the LogPaths parameter, though:$ aws gamelift describe-fleet-******{    "FleetAttributes": [        {            ...            "LogPaths": [                "/local/game/logs"            ],            ...        }    ]}So we should try creating a new fleet via the CLI and specifying an empty list for the --log-paths parameter? Seems like it's still a bug that this is the default value?CommentSharerePost-User-3562821answered 3 years ago0Yeah, that's what it sounds like to me.  I'll see if I can track down where this log paths is being assigned. If nothing else, it definitely is doing the wrong thing in the cases where customers are using more than one server per host.Let us know if creating via the CLI allows you to work around this issue.  describe-fleet-******CommentSharerePost-User-0985817answered 3 years ago0Hi @REDACTEDUSERThanks for taking a look at this! We'll reduce the # of concurrent server processes and see how that fares.About CPU usage, I'm taking a look at one of our fleet instances and notice that much of the CPU goes towards a java auxproxy process. I assume this is the "...on-box process that registers server-processes...". At this particular moment, it doesn't seem to dip below 50% CPU usage and is very often sitting between 75% to 100% CPU usage. This is the fleet in question:Region: us-east-1FleetId: fleet-******Working with GameLift, we were looking to find a way to specify a log level for the base server process. We ran across this todo:// TODO (GLIFT-10345): allow developers to specify log level in --devargsWe find the current default info level very verbose for our production environment. We'd ideally like to bump this up to at least warn.So, without any knowledge about what the auxproxy process does nor how it works, I'm curious about how much CPU time is spent on logging. Taking a look at the one instance in the fleet above:# pwd/local/whitewater/Logs# ls -lShtotal 1.6G-rw-r--r-- 1 gl-auxproxy gl-auxproxy 945M Jun  2 04:51 auxproxy.log-rw-r--r-- 1 gl-auxproxy gl-auxproxy 123M Jun  2 04:51 auxproxy-metrics.log# cat auxproxy.log | grep "\[DEBUG\]" | wc -l | xargs printf "%'d\n"3,932,761# cat auxproxy.log | grep "\[INFO\]" | wc -l | xargs printf "%'d\n"690,643This fleet has been up for ~26 hours now and auxproxy has produced almost 4 million lines of debug logs. Between the logs auxproxy generates itself and the verbose application level logs it ingests/processes/uploads/other -- does this seem correct/normal?Once again, I don't know much about this process, so please let me know if I'm missing something or whether this is completely normal. Otherwise, maybe a higher log level for our production environment might help us out?P.S. We really would love a supported way to specify the log level (GLIFT-10345) 😄CheersCommentSharerePost-User-3562821answered 3 years ago0@REDACTEDUSERHappy to say that starting a fleet via the CLI and emptying the --log-paths attribute worked a charm. Thanks for your help debugging this issue and also thanks to @REDACTEDUSERWe're back up to 50 concurrent processes per instance and our CPU usage is looking much better. Here's a graph over the past week. The blue line on the right is the new instance in the fleet without that pesky LogPaths attribute, the other lines are the other various instances we ran over the week:REMOVEDUPLOADCheersCommentSharerePost-User-3562821answered 3 years ago0The underlying issue which caused the log paths to be incorrect for multiple servers on a host should be fixed. Please let us know if you experience any issues!CommentSharerePost-User-1112179answered 3 years ago"


Question: First time setting up Security hub emails

"https://aws.amazon.com/blogs/security/how-to-set-up-a-recurring-security-hub-summary-email/I have been following the steps in the link above but its still not working when i check cloud formation I see that it says create failed next to SendSecurityHubSummaryEmailLambda and i get the following error Resource handler returned message: "Error occurred while GetObject. S3 Error Code: NoSuchKey. S3 Error Message: The specified key does not exist. (Service: Lambda, Status Code: 400. Seems like everything else create smoothly but this part. wondering what am I missing. Thank youFollowComment"

Answer: "0Accepted AnswerThank you for your submission.The CloudFormation deploys ok in my testing (again just now).1/ make sure you copy both the sec-hub-email.zip and the security-hub-email-summary-cf-template.json (2 files) into the S3 bucket2/ The S3 Bucket name is just the name 's3-bucket-with-your-files'3/ the S3 key name doesn't need a prefix path if you don't have prefixes. (that might be confusing from the blog screenshot).  If I uploaded the zip right into the bucket without creating any folders, the value 'sec-hub-email.zip' is all that you would put into that parameter.4/ make sure you accept (click the check box) that CloudFormation might create IAM resources.Thanks,-JustinCommentShareJustin_Canswered 9 months agorePost-User-1164312 9 months agoThank you so much. following your advice and steps I was able to get it working. I really appreciate you taking the time to get back to me.Share"


Question: Lex Internal Server Error (deployed from Terraform)

"I am trying to use Terraform to deploy an Amazon Lex bot that uses a Lambda function for fulfillment. I am able to deploy the bot with intents and slot types, and I can successfully build the bot for testing. However, when I try to test the bot, I receive an internal server error message.The strange thing is, if I manually add a new intent to the bot, and build again, I am able to test all of the bot intents successfully.Does anyone know if this is an AWS issue? Or if it is something that can be addressed in my Terraform files?Thanks.FollowCommentAjayM-AWS a year agoHello, thank you for reaching out. Would it be possible for your to share additional details around the Lex version (V1 or V2) and API that you are testing with.Additionally, any details around the Error message would be great beneficial. Please feel free to message me directly regarding this and I can assist.Thank you for your time.Share"


Question: My EC2 instance suddenly stopped working

"Hello,Please I need some help.I've been running an EC2 instance for about a year without issues, and this morning suddenly a customer told me he couldn't access the server anymore.It looks like Amazon EC2 panel says it's running normally.But I cannot access the server via public address.If I try to login via console .sh script, it gives error 'Operation timed out'.And If I try to connect via the AWS EC2 panel, it gives error as well: "There was a problem connecting to your instanceWe were unable to connect to your instance. Make sure that your instance’s network settings are configured correctly for EC2 Instance Connect."I really need to make it work asap, can someone please help me to understand what is going on ??Appreciate your help, thank you,FollowComment"

Answer: "1Accepted AnswerAny chance you're looking in the wrong region?CommentShareJohn Voldanswered a year ago0Finally I was able to find the instance running, it was that I was not checking the correct zone.However, I wasn't able to login to the instance via login sh script or via the AWS EC2 panel.I had to STOP and re run the EC2 instance, which changed the public IP address ( a mess, I had to redirect many things) and I lost lot of data from the customer's database.I still don't know what could happen, I'm afraid it can happen again at any moment.CommentShareAWS-User-6742391answered a year agoBrettski-AWS EXPERTa year agoIf you require a static public IP address, use an "Elastic IP" for your instance rather than a "Public IP". That way, the Elastic IP address will persist through reboots and shutdown/restart cycles.Share0Why EC2 instance is disappear?using/constructing an AMI that does not have SSH properly set up. using/constructing an AMI that does not boot properly (network and/or sshd issues) and failing to look into console output. instance reboot failing.How do you recover EC2 instance?You can create an Amazon CloudWatch alarm that monitors an Amazon EC2 instance and automatically recovers the instance if it becomes impaired due to an underlying hardware failure or a problem that requires AWS involvement to repair. Terminated instances cannot be recovered.Recover your instance :https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-recover.htmlCommentShareUsha kumarianswered a year ago"


Question: Can't purchase the first reserved instance?

"When trying to order the first reserved instance, I suddenly  see this:Error : Your current quota does not allow you to purchase the required number of reserved instances (Service: AmazonEC2; Status Code: 400; Error Code: ReservedInstancesLimitExceeded; Request ID: 1603690b-ab02-4697-a232-774efe3d53b5; Proxy: null)(with 20 reserved instances/mo default limit in effect)Will the above go away some day, or I shall contact the support?FollowComment"

Answer: "0The answer from support/service teams, citing:"Our service team informed that No Upfront Reserved Instances (RIs) can pose a significant billing risk to accounts that are lightly used or are new, as they're a contractual obligation to pay monthly for the entire term of the RI. For this reason, lightly used accounts and new accounts are unable to sign up for No Upfront RIs until a successful billing history is built with us."In other words, the mentioned cryptic error message meaning was like this: "You are paying too little for our services; thus we have to restrict access to certain products. Since we only are computer-friendly, our response was meant for automated processing. We hope our support team assisted in translating the error into human-readable form".Something like that.Actually, I would prefer that the above be stated in plain text both in docs and in response from console - instead of forcing me to waste time of both myself and of support/service teams to decipher the error code.CommentSharetemmokananswered 3 years ago"


Question: SMB File Share SG joined to domain

"I have been testing with EC2 storage gateway with file share joined to our domain. I have added admins in file access settings. I am trying to move our on prem shared drive to aws using storage gateway. Enabled windows ACL. Mainly two questions:1)Which is the best way to prevent users (with access to file share) to add permissions for another users? Any user that has access to the file share can modify permissions, even his own permissions.2)Also the ntfs permissions already assigned on shared drive on prem doesn't get copied with copying folders to file share. It just sets to everyone when copied to file share. Since it's a large amount of data (around 10 TB), if i do robocopy will the permission also moved to file share? I will be doing robocopy on our file server. File share is mapped on server.FollowComment"

Answer: "1Hello,You can control permissions on the SMB file share granularly using NTFS ACLs from Windows explorer or using PowerShell.To prevent users to change/grant permissions to other domain users, you would need to ensure those AD user/group are not granted Change Permissions or Full Control NTFS permissions on specified file/folder. However, please note that the owner of the file/folder can always change permissions for themselves or grant permissions to others regardless of any existing permissions on that file/folder. Please refer here for additional information.With robocopy command, please ensure that you are using /S flag to copy NTFS ACLs. You can use the following robocopy command which would copy data, attributes, timestamps, NTFS ACLs and ownership information. Please refer here for more information.robocopy Y:\ Z:\ /copy:DATSO /secfix /e /MT:8Additional references:https://docs.aws.amazon.com/filegateway/latest/files3/best-practices-copying-files-on-windows.htmlhttps://docs.aws.amazon.com/filegateway/latest/files3/smb-acl.htmlhttps://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateSMBFileShare.html#StorageGateway-CreateSMBFileShare-request-AdminUserListCommentShareSuryaanswered 4 months ago"


Question: Unable to access EC2 Instance over the Public IP Address

"I was able to access the ec2 instance on Public IP, however I am unable to access the instance now, I have 2 instances running with the similar configurations, I am able to access one of them however the other one is not responding on the Public IP, please suggest what to do.FollowComment"

Answer: "1Did your EC2 machine stop and restart or did it hibernate? In those cases, a new public IP address would have been assigned. If you want the public IP addresses not to change you should get Elastic IPs. Refer to this documentation - https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/using-instance-addressing.htmlA public IP address is assigned to your instance from Amazon's pool of public IPv4 addresses, and is not associated with your AWS account. When a public IP address is disassociated from your instance, it is released back into the public IPv4 address pool, and you cannot reuse it.You cannot manually associate or disassociate a public IP (IPv4) address from your instance. Instead, in certain cases, we release the public IP address from your instance, or assign it a new one:We release your instance's public IP address when it is stopped, hibernated, or terminated. Your stopped or hibernated instance receives a new public IP address when it is started.We release your instance's public IP address when you associate an Elastic IP address with it. When you disassociate the Elastic IP address from your instance, it receives a new public IP address.If the public IP address of your instance in a VPC has been released, it will not receive a new one if there is more than one network interface attached to your instance.If your instance's public IP address is released while it has a secondary private IP address that is associated with an Elastic IP address, the instance does not receive a new public IP address.If you require a persistent public IP address that can be associated to and from instances as you require, use an Elastic IP address instead.If my answer resolved your issue, please upvote and accept my answer. ThanksCommentShareEXPERTIndranil Banerjee AWSanswered a year ago0Hi , there can be multiple reasons.Check your instance is in public subnet and route table in the subnet has igw there is no block in acl as well as in sgSometime some isp having routing issue, check with other isp/mobile internetCheck if any internal firewall /rule/av is blocking or blacklisted your ip.Check if any external firwall/waf has blacklisted the ip .CommentSharesouravanswered a year ago"


Question: Step Machine - is there any kind of intrinsic functions for if statements?

"I'm pretty new to Step Machines, I've created a relatively complex machine - which works quite well and is hooked up to API gateway. There's one piece of it which just feels a bit ugly to me, I've created this example but let me be clear that this is a "fake" example so explaining better ways of doing it via the API or whatever doesn't help much, I just want to achieve what I'm showing below but ideally in a neater way. I should also add what I've done works, but just isn't pretty.Basically I set a variable using the pass functions with two different outputs based on a choice, what it feels like I should be able to do is something LIKE;"S.$": "States.If($.resolution>1000,'Desktop','Mobile')"{  "Comment": "A description of my state machine",  "StartAt": "Choice",  "States": {    "Choice": {      "Type": "Choice",      "Choices": [        {          "Variable": "$.resolution",          "NumericGreaterThan": 1000,          "Next": "Status is OK"        }      ],      "Default": "Status is Fail"    },    "Status is OK": {      "Type": "Pass",      "Next": "DynamoDB PutItem",      "Result": {        "type": "Desktop"      },      "ResultPath": "$.display"    },    "Status is Fail": {      "Type": "Pass",      "Next": "DynamoDB PutItem",      "Result": {        "type": "Mobile"      },      "ResultPath": "$.display"    },    "DynamoDB PutItem": {      "Type": "Task",      "Resource": "arn:aws:states:::dynamodb:putItem",      "Parameters": {        "TableName": "MyDynamoDBTable",        "Item": {          "Name": {            "S.$": "$.name"          },          "DisplayType": {            "S.$": "$.display.type"          }        }      },      "End": true    }  }}FollowCommentRodney Lester 8 months ago"Choice" is the function to use.Share"

Answer: "0This is the list of intrinsic functions. As you can see, it does not include an if function.Your only option is to use a Choice state.I will raise it to the service team.CommentShareEXPERTUrianswered 8 months ago0Hello, currently there is no intrinsic function in Step Functions which can control the execution flow like Choice state. Choice state is the only viable option right now in this use case. Please refer to [1] for more information on Intrinsic Functions in Step Functions[1] Intrinsic functions: https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-intrinsic-functions.htmlCommentShareSUPPORT ENGINEERAWS-User-0774443answered 8 months ago"


Question: API Gateway: Using a Cognito User Pool authorizer to inject userid and email into request

"I inherited an API Gateway setup that uses a Cognito User Pool as an authorizer. For some reason, the Lambda functions that serve the API do the authorization all over again, taking the "Authorization" header from the request and doing their own JWT decode routine. So far as I know this is unnecessary, since if the request gets to this point the user is already authenticated against Cognito.So I think I can remove that extra layer of authentication. My question is about getting access to the user's Cognito attributes such as username and email. The code right now uses the "cognito_idp" boto3 client to make a "get_user" call with the access token from the "Authentication" header. I have to think that this is redundant! But while the request has fields for Cognito user attributes, they're all set to None.Am I missing something about the proper way to get access to a user's attributes via the Cognito authorizer?FollowComment"

Answer: "1Accepted AnswerIf you have set Cognito User Pool Authentication in API Gateway, you are right that API Gateway will block the request if it is not a valid user.The identity token or access token from Cognito User Pool will be a JWT token. Validating the JWT at the backend is an extra layer of protection if your backend wants to ensure that there is no rogue actor in the middle that is sending requests with fake JWT tokens directly bypassing the API Gateway. There are other ways to prevent that scenario, but the person from whom you inherited the application may have had that thought process.Also if your backend needs claims from the JWT token to do other things and need access to the claims, then the backend has to parse the JWT.If users have registered in the Cognito user pool user properties such as email and phone number, then those properties should be available in the JWT claims. Do you see those as blank for a user who has those properties set in the Cognito user pool?CommentShareEXPERTIndranil Banerjee AWSanswered 10 months agoEric 10 months agoThanks very much for this reply! I appreciate the background on the JWT validation, and the fact that there might be a good reason for doing the validation over again in the Lambda function.As for the Cognito user attributes, I was expecting them to be present in the context that is passed to the Lambda. There's supposed to be a "context.authorizer" object, with a further "claims" attribute, but the "authorizer" attribute doesn't exist. Other documentation mentions a "context.identity" object, which I see, and a "context.identity.cognito_identity_id" attribute, but that is None in my case.The username is indeed available via the decoded JWT payload. So it looks like my options are to read it from the JWT payload and skip the Cognito lookup, or do the Cognito lookup and skip the JWT token decoding. But I was expecting that the Cognito user attributes would be made available via the "context" argument to the Lambda! Is this not the case?Thanks againShareIndranil Banerjee AWS EXPERT10 months agoDid you do the mapping in the Integration Request to get the fields from the Cognito identity token context to the integration, as explained in this - https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enable-cognito-user-pool.htmlUnless the mapping is done, it won't automatically show up in your backend.ShareEric 10 months agoThat's what I was missing! Thanks so much for that pointer. It will be very nice to clear all this unnecessary code out of there.Sharewz2b 4 months agoI follow what you are saying here, but you authenticate to the API using the Access token, not the ID token.  If he is using the standard JWT Authorizer on his routes, I do not think that will accept the ID token.  It has to be the access token, and that doesn't give you all those claims.Share"


Question: SSL Not Showing

"Hello,I have a Certificate for my WordPress website from ACM that is for both mydomain.com and www.mydomain.com, which is verified, issued and in use through CloudFront. I had the SSL certificate until Monday(8/26) night, and now it's gone. While it was active it showed validity until September, 2020. Wednesday(8/27) evening, I reinstalled the ACM and CloudFront and reinstalled a Load Balancer that used them.What would be causing this issue, something with WordPress or AWS or something else entirely?Or do I just have to wait the 24-48 hours for everything to be properly completed?Edited by: hafizbhuyan on Aug 28, 2019 7:26 AMFollowComment"

Answer: "0Hi, I think I might have a solution for you, please check you Private Message so we can get in contact.CommentShareAWS-User-3365552answered 4 years ago"


Question: SES Sending from Unapproved IP

"We use SES for sending emails and we recently received some from a batch of emails that were delivered with an IP address that isn't part of the SPF record for amazonses.com (and were therefor bounced).Emails were received from the below IPs in the same batch, but the first one is not part of the SPF record.104.47.61.5054.240.48.30https://mxtoolbox.com/SuperTool.aspx?action=spf:amazonses.com:104.47.61.50Was this just a once off issue or out of date SPF records?FollowComment"


Question: Failed to create environments: "..." - 1 validation error detected: value " at 'tags.3.member.value' failed to satisfy constraint: Member must have length greater than or equal to 1 Go to ...

"When I tried to create an enviroment to run cloud 9 service, I ´ve got the next error:Note: "model-K" is the name of my enviroment.I wonder how to solve this error, if I should create a stack in CloudFormation to solve it or if there is another way to solve it.FollowComment"


Question: MDE installation on RPA server loses communication with RPA clients (AAE)

"Hi,A Windows 2012 server has Symantec antivirus installed and a console of an RPA application (AAE). To install MDE, first we proceed to uninstall Symantec AV, to later install MDE antivirus. Once MDE is installed, we proceed to restart the server. At the time of validating the RPA application, it is identified that the RPA clients lose communication with the RPA console since in the screen does not appear.Files names and paths suggested by the vendor (AAE) have already been added to the MDE exception list, on RPA clients and server, but the problem has not been resolved, because this issue has a couple of months trying..We need to know how to resolve this issue, or if necessary if we can have a liability waiver to keep Symantec AV installed on this server.We have been trying for several months different actions such as adding some exception rules in the AV MDE without success.Can you help us please to know what’s happening?.FollowComment"

Answer: "0Hello,Thank you for reaching out, my name is Josue and I will be assisting you today.Antivirus in the cloud can get tricky as some features can be a bit of an overkill; I have seen cases on which the AV would disable the ENI as it detected it as an intrusive resource.I'd suggest to stick to best practices by the AV provider to ensure resources are not disrupted, Firewall is allowing the desired inbound connectivity for the ports required and is fully compatible in a cloud environment you can govern and manage accordingly. If you have official documentation you would like us to take a look we can do so as best efforts.I hope this information is helpful. Please do let me know in case of any other question on which I can help you out. I will be happy to do so.CommentShareSUPPORT ENGINEERJosueAWSanswered 7 months ago"


Question: Is it possible to modify the JITP Policy for a registered CA?

"Once the CA is registered, I can't see how to change the JITP policy.The only way I found was to remove the CA and register it again with the new policy, which can be inconvenient.Is there any way to update the JITP policy?Txs!FollowComment"

Answer: "1Another option would be to use a policy name in your provisioning template. With a policy name you can reference an existing policy which you can change outside of the provisioning template.Cheers,PhilippCommentSharePhilipp Sanswered 3 months agopfuentes69 3 months agoThanks, Philipp!This sound quite more practical.I checked the man page and I only see reference to the policy names referring to the security policy inside the JITP policy, but not to the full JITP policy itself?Can you point me to some instructions on how to specify the policy name when registering a CA?Cheers!SharePhilipp S 3 months agoHi pfuentes69, please take a look at the link I posted and search for PolicyName. To use a named policy you create your IoT policy before you use it in the template. Assuming you named the policy my_aws_iot_policy your template entry would look similar to:"policy" : {            "Type" : "AWS::IoT::Policy",            "Properties" : {                "PolicyName" : "my_aws_iot_policy"            }        }Share0I think I found an answer...aws iot update-ca-certificate --certificate-id $CA_CERTIFICATE_ID \       --no-remove-auto-registration \       --new-auto-registration-status ENABLE \       --registration-config "<NEW_POLICY>"As explained here: https://catalog.us-east-1.prod.workshops.aws/workshops/7c2b04e7-8051-4c71-bc8b-6d2d7ce32727/en-US/provisioning-options/just-in-time-provisioningCommentSharepfuentes69answered 3 months ago"


Question: SES - Non Verified email in Sandbox

Customer is on Sandbox testing it. They can test successfully using verified email. However they want to test the non-verified email in sandbox. Is this a possibility?Is there a way to test it without verifying the email? How do we know it will work outside of SES sandbox?FollowComment

Answer: "1Accepted AnswerHi,This is not possible: https://docs.aws.amazon.com/ses/latest/dg/request-production-access.htmlWhile your account is in the sandbox, you can use all of the features of Amazon SES. However, when your account is in the sandbox, we apply the following restrictions to your account:For sending authorization, neither you nor the delegate sender can send email to non-verified email addresses.CommentShareEXPERTalatechanswered 4 months agorePost-User-9121173 4 months agoCan the customer move to production and back to sandbox again?Sharealatech EXPERT4 months agoDont think so: https://repost.aws/questions/QUdq_OhXzaQR-_4e7gNydekw/how-to-move-to-aws-ses-sandbox-mode. If above answer clarified, I d appreciated if can be accepted, so that community can benefit for clarity, thanks!Share0It is possible to move back to sandbox from production mode. To do so you would open another limit increase case and request to move back to sandboxCommentShareSUPPORT ENGINEERRichard Wanswered 4 months ago"


Question: [suppliers]how to complain our suppliers

"Can our company change the suppliers? If not, how can I complain to AWS suppliers? Ask them questions and they always don’t answerFollowCommentChris_G EXPERT9 months agoHello, any subscriptions or licenses you purchase through the marketplace make you a direct customer of the partner.  You can reach out to the partner directly.  Their support information should be listed on their partner pages within the marketplace.Share"

Answer: "0For questions and issues with products listed in AWS Marketplace, please reach out to the respective vendors. If the vendors provide support, their contact information can be located in their product detail page in AWS Marketplace.CommentShareJoseph Shihanswered 9 months ago"


Question: App runner linked  custom domain not working when I type  www in browser

I have successfully linked my app runner instance to the root my domain (mydomain.com) and everything is working fine .. However when I type www.mydomain.com I get a 404. How can I route traffic from www to mydomain?? I have tried creating an Alias record but its not working.FollowComment

Answer: "0Hi,You could look in this article https://repost.aws/knowledge-center/redirect-domain-route-53.The solution typically uses S3 bucket to perform redirection.Thought working, another approach I tried with my own hands was to use CloudFront functions: https://medium.com/@alatech/domain-redirection-with-cloudfront-functions-32a6732d589dDepending on traffic  and cost appetite, you can decide what is the best approach to redirect from apex to another domain based on above articles.I hope it helps ;)CommentShareEXPERTalatechanswered 2 months agoThaDev 2 months agoI tried this but it didn't work, I want to redirect traffic from www.mydomain.com to mydomain.com.Share"


Question: SSE-C objects can't be replicated.

"I was trying to replicate some sse-c objects to an s3 bucket in another account but it seems it's not working.According to https://docs.amazonaws.cn/en_us/AmazonS3/latest/userguide/replication-config-for-kms-objects.html, no extra configuration should be needed.Other non sse-c objects are replicating fine.Any insight would be helpful. THANKS!FollowComment"

Answer: "0Hello, Thanks for reaching out. All newly uploaded SSE-C objects will be replicated based on your replication configuration. We recommend using S3 Batch Replication for replication of existing objects. If this still does not answer your question/ resolve the issue, we recommend reaching out to me, or your account manager or AWS support for a deeper dive.CommentShareAnagha Vittalanswered 6 months agoChunkun 6 months agoI tried uploading new sse-c encrypted objects after setup the replication rule and it's not replicated. We don't need to replicate existing objects.Share0Please reach out to me via email (anvittal@amazon.com) for detailed analysisCommentShareAnagha Vittalanswered 6 months ago"


Question: Web Service Buffer and read Quota settings

We have a web service accessed from outside of AWS via a load Balancer. It works fine from small payloads but fail once the payload grows to around 4 mb. How to find the network setting and adjust them is needed on the Load Balancer? (non -AWS web client has already had setting increased)FollowComment

Answer: "0To troubleshoot the issue with your web service failing when the payload size grows to around 4 MB, you can investigate and adjust the network settings on the Load Balancer in AWS. Here are some steps you can follow:Determine the Load Balancer type: Identify the type of Load Balancer you are using, as AWS provides different load balancing options such as Classic Load Balancer (CLB), Application Load Balancer (ALB), and Network Load Balancer (NLB). Each type has its own set of configuration options and considerations.Check Load Balancer settings: Review the current settings of your Load Balancer. Specifically, pay attention to parameters related to request and response sizes, timeouts, and buffer limits. These settings can impact the handling of larger payloads.Adjust Load Balancer settings: Depending on the Load Balancer type, you may need to adjust different settings. Here are some areas to focus on:Connection limits: Ensure that the maximum number of connections allowed by the Load Balancer is sufficient for your application's needs.Idle timeouts: Increase the idle timeout value if the request processing takes longer due to larger payloads.Request and response size limits: Adjust the maximum request and response size limits to accommodate larger payloads. For example, in ALB, you can modify the http.request.header.bytes, http.request.body.bytes, and http.response.body.bytes parameters.Buffering: Check if buffering options are enabled on the Load Balancer. Depending on the Load Balancer type, you may have control over request/response buffering, and enabling or adjusting buffering settings can help handle larger payloads.Monitor logs and metrics: Enable access logs and review the logs generated by the Load Balancer. This can provide insights into any errors or failures occurring during the request/response process. Additionally, monitor relevant metrics such as connection counts, request rates, and response times to identify any anomalies or performance bottlenecks.Consider scaling: If increasing the Load Balancer settings doesn't resolve the issue, it may be necessary to scale up the capacity of your Load Balancer or consider using multiple Load Balancers in a distributed manner to handle larger payloads efficiently.Remember to test and validate the adjustments made to the Load Balancer settings to ensure they effectively address the issue without causing any unintended consequences.CommentSharehimanshustallongmailcomanswered 18 days ago"


Question: Amazon Linux 2 - Can't set locale

"I am in the last month of my Free Tier trial and I have a t2.micro instance running Amazon Linux 2.I logged into my instance today trying to update it with yum, which I have done many times before, but now when I log in or use yum, I get a bunch of warnings that it can't set the locale to en_US.utf-8, which is set in the environment variables.Is there any way of fixing these warnings?FollowComment"

Answer: 0sudo nano /etc/environmentadd these lines:LANG="en_US.UTF-8"LC_ALL="en_US.UTF-8"LC_CTYPE="en_US.UTF-8""Ctrl + X" to exitWrite "yes" to confirm the changesAnd ENTER.CommentShareronaldtorresanswered 2 years ago


Question: Next image doesnt appear in Ground truth labelling

HiI am using groundtruth labelling to label my images. I am facing an issue at the workers end that next image doesnt appear at their screen even when they submit a label on an image.Kindly guide me how to resolve this issue.ThanksFollowComment

Answer: "0Check if there are any errors or warnings in the job details page. and then ensure that the job settings are configured properly. Check if the "Maximum number of objects per image" and "Minimum number of objects per image" settings are set correctly. If these settings are not configured properly, it may cause issues with the next image appearing. If the worker has not finished labeling the previous image, the next image will not appear. Ask the worker to complete the previous image and submit the label.CommentShareEXPERTsedat_salmananswered a month ago0Thanks for your replyI am using the signle image labelling task to label my image. So when i select the single label and press submit. It should proceed to the next image.I have removed the old images, changed their name and uploaded, if this could be the problem, but it didnt worked even.So the problem is still there. While no error is shown in the job labelling window.Please suggest me the possible reasons of this error.RegardsCommentShareAI Learneranswered a month ago0Hi,I am still looking for the solution of my problem.Would be grateful if anyone can help me out on it.ThanksCommentShareAI Learneranswered a month ago"


Question: Kinesis - tools to operationally manage streams

"Are there any third-party tools that customers can use to operationally manage Kinesis streams?For example, if a customer has dozens of Kinesis streams, outside of using AWS Console and scripting against CloudWatch, does a graphical tool exist to help with the operational burden of managing multiple Kinesis streams.FollowComment"

Answer: "0Accepted AnswerCloudWatch dashboards are pretty powerful when it comes to visualizing CloudWatch metrics across multiple resources, incl. Kinesis streams. Would that help?One limitation is that you can only visualize data from within the same account, multi-account was a roadmap item last time I checked.Going beyond that, DataDog comes to mind as one external system to visualize across accounts and with more features.These tools are for monitoring the streams, managing in terms of create, update and delete is different.Update with autoscaling like functionality can be done by Ian's wonderful Kinesis scaling utility (https://github.com/awslabs/amazon-kinesis-scaling-utils)Create and delete should not be that common and is pretty easy already through the API/SDK/CLI.Please let me know if this helps or detail the use case more.CommentShareMartin Schade _AWS_answered 7 years agoEXPERTsedat_salmanreviewed 13 days ago"