Question: API Gateway - Exposing Backend APIs - Authentication

"We have purchased software running on EC2 and we need to expose several REST APIs externally. The problem is that the APIs require OAuth authentication, and API Gateway only supports client certificate. This is a major deficiency, I doubt there are many APIs, public or private, that support client certificate authentication.How can I call the target API from API Gateway? The only thing I can think of is to use a Lambda that obtains the token and makes the API call. Is this the only alternative? I'd rather not have to create, maintain, and pay to run a Lambda.Also I see that there are solutions for caching secrets and environment variables across Lambda invocations, but no solution for caching arbitrary data such as the bearer token. I'd rather not have to obtain a new token for every call. I've seen some suggest using a class variable, the implication being that the class will persist until the container is shut down. However this assumption isn't backed up by any AWS documentation that I can find.Any insights or suggestions are appreciated.FollowComment"

Answer: "0You need to use Lambda, but how about using "Custom Authorizer" as shown in the following document?https://aws.amazon.com/jp/blogs/compute/introducing-custom-authorizers-in-amazon-api-gateway/CommentShareEXPERTRiku_Kobayashianswered 17 days ago0As you indicated, API Gateway can't support what you need. You will need to implement a Lambda functions. The Lambda function will cache data between invocations if you save them in global/class variables, so you can do it once, or whenever the token expires. You could also cache the information in some external source, such as DynamoDB, so that you can share it between different Lambda instances and even between different Lambda functions (if you choose to create a different function for each of the backend APIs for instance).CommentShareEXPERTUrianswered 16 days ago"


Question: Best practices when upgrading RDS instance generations?

"A customer wants to upgrade their RDS instances to the modern instance generations.They want to know, are any common issues when going from an older generation to the latest? (e.g. m3 to m5, r4 to r5 etc.)When they perform the change of instance type, what are the best practices to follow?FollowComment"

Answer: "0Accepted AnswerSome considerations:Following are some things to consider when scaling up an RDS instance:Before you scale, make sure you have the correct licensing in place for commercial engines (SQL Server, Oracle) especially if you Bring Your Own License (BYOL). One important thing to call out is that for commercial engines, you are restricted by the license, which is usually tied to the CPU sockets or cores.Determine when you want to apply the change. You have an option to apply the change immediately or during the maintenance window specified for the instance.Storage and instance type are decoupled. When you scale your database instance up or down, your storage size remains the same and is not affected by the change. You can separately modify your DB instance to increase the allocated storage space or improve the performance by changing the storage type (such as to General Purpose SSD to Provisioned IOPS SSD).There is minimal downtime when you are scaling up on a Multi-AZ environment because the standby database gets upgraded first, then a failover will occur to the newly sized database. A Single-AZ instance will be unavailable during the scale operation.Take a look at:https://aws.amazon.com/blogs/database/scaling-your-amazon-rds-instance-vertically-and-horizontally/CommentShareEXPERTJPanswered 3 years ago"


Question: AWS CDK: What is the best way to implement multiple Stacks/NestedStacks & share resources?

"I’m currently working on a serverless application developed using AWS CDK in TypeScript. Also as a convention, we follow the below rules too.A stack should only have one table (dynamo)A stack should only have one REST API (api-gateway)A stack should not depend on any other stack (no cross-references), unless its the Event-Stack (a stack dedicated to managing EventBridge operations)The reason we are following these rules because then, each stack can be deployed independently without any interferences of other stacks. In a way, our stacks are equivalent to micro-services in a micro-service architecture.At the moment all the REST APIs are public and now we have decided to make them private by attaching custom Lambda authorizers to each API Gateway resource. Now, in this custom Lambda authorizer, we have to do certain operations (apart from token validation) in order to allow the user's request to proceed further. Those operations are,Get the user’s role from DB using the user ID in the tokenGet the user’s subscription plan (paid, free, etc.) from DB using the user ID in the token.Get the user’s current payment status (due, no due, fully paid, etc.) from DB using the user ID in the token.Get scopes allowed for this user based on 1. 2. And 3.Check whether the user can access this scope (the resource user currently requesting) based on 4.This authorizer Lambda function needs to be used by all the other Stacks to make their APIs private. But the problem is roles, scopes, subscriptions, payments & user data are in different stacks in their dedicated DynamoDB tables. Because of the rules, I have explained before (especially rule number 3.) we cannot depend on the resources defined in other stacks. Hence we are unable to create the Authoriser we want.Solutions we could think of and their problems:Since EventBridge isn't bi-directional we cannot use it to fetch data from a different stack resource.We can invoke a Lambda in a different stack using its ARN and get the required data from its' response but, AWS has discouraged this as a CDK Anti PatternWe cannot use technology like gRPC because it requires a continuously running server, which is out of the scope of the server-less architecture.There was also a proposal to re-design the CDK layout of our application. The main feature of this layout is going from non-crossed-references to adopting a fully-crossed-references pattern. (Inspired by layered architecture as described in this AWS best practice)Based on that article, we came up with a layout like this.Presentation LayerStack for deploying the consumer web appStack for deploying admin portal web appApplication LayerStack for REST API definitions using API GatewayStack for Lambda functions running business-specific operations (Ex: CRUDs)Stack for Lambda functions runs on event triggersStack for Authorisation (Custom Lambda authorizer(s))Stack for Authentication implementation (Cognito user pool and client)Stack for Events (EvenBuses)Stack for storage (S3)Data LayerStack containing all the database definitionsThere could be another stack for reporting, data engineering, etc.As you can see, now stacks are going to have multiple dependencies with other stacks' resources (But no circular dependencies, as shown in the attached image). While this pattern unblocks us from writing an effective custom Lambda authorizer we are not sure whether this pattern won't be a problem in the long run, when the application's scope increases.I highly appreciate the help any one of you could give us to resolve this problem. Thanks!FollowComment"


Question: DRS Error: Failed to connect using HTTP channel

"I'm running a drill on servers that are using the same configuration in DRS.  One of the servers fails with the Error: Failed to connect using HTTP channel.  The other servers failover as expected.  All servers are using the default security group created by DRS.  The launch templates are similar, same subnet, etc.  How can I troubleshoot the HTTP error?FollowComment"


Question: Pricing of lightsail's load balancer within free trial period?

"Hi,May I know in aws lightsail within free trial period, is load balancer a free trial service? I would like to test out its function.Thank you.FollowComment"

Answer: "1Accepted AnswerIt is 18 USD per month as described in this document.https://aws.amazon.com/lightsail/pricing/?nc1=h_lsI don't think load balancers are included in the free quota.If this answer leads to a resolution, please approve the answer for the betterment of the community.CommentShareEXPERTRiku_Kobayashianswered a month ago0Just to add, you can find Lightsail product prices at this page, along with Free Tier information: https://aws.amazon.com/lightsail/pricing/CommentSharerePost-User-9223736answered a month ago"


Question: Getting AccessDenied Error Trying to Get Wildcard SSL with Certbot and Route53 Plugin

"I have been tasked with setting up Wilcard SSL for some domains. These domains are hosted through AWS Route53.I am using Certbot on an Ubuntu 20.4 machine (we're using Lightsail), where the apps are hosted. I have also installed the Route53 DNS plugin for Certbot.I run this command:sudo certbot certonly --dns-route53 --email '**@**.**' --domain 'mywebsite.rocks' --domain '*.mywebsite.rocks' --agree-tos --non-interactiveReal domains remove for security reasonsI get this error:An error occurred (AccessDenied) when calling the ListHostedZones operation: User: arn:aws:sts::*********:assumed-role/**********/********** is not authorized to perform: route53:ListHostedZones because no identity-based policy allows the route53:ListHostedZones actionLet me explain first how I set up the IAM user in the AWS console.I created a new Policy with this config{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "route53:GetHostedZone",                "route53:ChangeResourceRecordSets",                "route53:ListResourceRecordSets"            ],            "Resource": "arn:aws:route53:::hostedzone/WHAT-EVER-MY-ID-IS-HERE"        },        {            "Effect": "Allow",            "Action": "route53:ListHostedZones",            "Resource": "*"        }    ]}Replacing WHAT-EVER-MY-ID-IS-HERE with my actual domain's Hosted Zone IDI then created a new IAM User and during set-up, I attached the above Policy to the user.I then created an Access Key for my new User and took note of the AccessKeyId and SecretAccessKey. This has access to be used programmatically.On the server, I created a config file at /root/.aws/config as instructed in the documentation. I also tried ~/.aws/config but as I am using sudo the former seemed the preferred location (I could be wrong though, and during my tests, neither worked anyway)And as previously aforementioned, I run the command and get the error.Searched the web high and low for a solution, but cannot find one.Appreciate any help I can get from folk.FollowComment"


Question: AWS DMS Duplicate entry error

"I'm running AWS DMS task in full load + ongoing replication mode, both source and target are aws aurora mysql. Target database was created by cloning source and truncating all tables to preserve the schema. For one of the tables replication always fails with following error:2022-06-23T17:12:05 [TARGET_LOAD ]E: RetCode: SQL_ERROR SqlState: 23000 NativeError: 1062 Message: [MySQL][ODBC 8.0(w) Driver][mysqld-5.7.12-log]Duplicate entry '1213210-50' for key 'PRIMARY' [1022510] (ar_odbc_stmt.c:4828)I have verified that there is no duplicates in source database table, the tables have identical schema in both source and target, and both source and target table has primary key with auto increment.The only workaround I found was to drop the table on target db and let DMS create it, but DMS creates it without indexes and foreign keys that we need. Is there any fix for this error that would allow me to preserve the table schema?FollowComment"


Question: EKS service not allowing selection for VPC

When I try to select a VPC for a cluster it says "You are not authorized to perform this operation". So How do I get permission?FollowComment

Answer: "0To create EKS cluster and configure VPC for it, an IAM user or role needs to have permissions to create and describe an Amazon EKS cluster. For more information, please see Create a Kubernetes cluster on the AWS Cloud.CommentSharerePost-rajbnaganswered 7 months ago"


Question: Detached EBS volumes?

"If I have EBS volumes (type gp2) created, but do NOT have themattached to any EC2 instance, do those EBS volumes generatecharges/cost to my AWS account?Thanks in advance.FollowComment"

Answer: "0Accepted AnswerYes, you will be charged even if the EBS volume is unattached, see below statement from the documentation:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-detaching-volume.htmlAfter you detach a volume, you are still charged for volume storage as long as the storage amount exceeds the limit of the AWS Free Tier. You must delete a volume to avoid incurring further charges. For more information, see Delete an Amazon EBS volume.CommentShareEXPERTTushar_Janswered 5 months agoEXPERTBrettski-AWSreviewed 5 months agoTLChandler 5 months agoHello Tushar_J, many, many thanks for your awesome reply to my query.  Your answer tells me exactly why I received the announcement that I did.     Happy 2023!!!Share"


Question: Invoking AWS SSM in Lambda

How do I invoke "AWS-CreateRdsSnapshot" SSM document via a Lambda function?FollowComment

Answer: 1In Python you would use start_automation_execution - it needs the target (RDS instance) which the automation is going to run on. Your lambda iam role will also need permission for this actionCommentShareEXPERTPeter_Ganswered 6 months ago


Question: "AWS IoT Gateway Sent To New Zealand, No longer connects outside of the USA"

"I am attempting to trouble shoot a MTCDT-L4N1-246A gateway that was sent to New Zealand. In the USA it was known to work on frequency US915 and we had no issues. Once it arrived in New Zealand it no longer connected. The frequency was changed to AU915 and we know devices connect to the gateway, new AU915 certs were made and placed on the gateway. However, the gateway is perpetually on "Connection status - Disconnected" regardless of any changes that are made. Are there are any recommended changes to make to establish a connection?FollowComment"

Answer: "1Accepted AnswerCan you access the Basic Station logs (I haven't used a Multitech before)? If so, please share, because that will likely give clear insight into what the problem is.Are you working in the same account and AWS region? If not, do you have other working gateways in this account and region? If not, have you created the IoTWirelessGatewayCertManagerRole?https://docs.aws.amazon.com/iot/latest/developerguide/connect-iot-lorawan-rfregion-permissions.html#connect-iot-lorawan-onboard-permissionsnew AU915 certs were made and placed on the gatewayLooking in the Multitech manual, you would have updated the Gateway Cert and Gateway Key of the Basic Station Configuration with the new CUPS certificate and key. If this is a different account or AWS region, you would also need to update the URI setting. Normally you would use the CUPS URI and let Basic Station get the LNS settings. If so, I would think Credentials should be set to CUPS.https://docs.aws.amazon.com/iot/latest/developerguide/connect-iot-lorawan-onboard-gateway-add.htmlwe know devices connect to the gatewayWhat are you observing to make this statement? I'm curious because devices don't connect to gateways.CommentShareEXPERTGreg_Banswered 3 months agorePost-User-2309685 3 months agoThank you for the insight, I will work on gathering the Basic Station Logs but due to the nature of MultiTech it will take some time.I have created it. I will change the region to Asia Pacific (Sydney) and see if that resolves the issue.As for the the devices connecting to the gateway I should have been more clear. The devices are not AWS devices, they are PCBs connecting to the MultiTech gateway, their EUI's are appearing in the gateway logs, so I know from MultiTech to the PCBs is functional, and that cellular and GPS are also functioning.Share0Hello!AWS IoT Core for LoRaWAN customers can use US902-928, EU863-870, AS923-1 or AU915 frequency bands to connect LoRaWAN gateways and devices that are physically present in countries that support the frequency ranges and characteristics of these respective bands. US902-928 and EU863-870 bands are commonly used in the North America and European regions respectively. AS923-1 is commonly used in Australia, New Zealand, Japan, Singapore, and Taiwan among other countries. AU915 is commonly used in Argentina, Chile, and other South American countries.Please go through the below mentioned linked for more information:[+] https://aws.amazon.com/iot-core/lorawan/CommentSharerePost-User-8131306answered 3 months ago"


Question: Missing EventBridge events from s3

"I have a target configured to log eventbridge events on the default bus.  I just activated events from an s3 bucket, then I uploaded 3 files to the bucket, waited a few minutes, and deleted the files.  Finally (about 1 hour later) I uploaded one more file.I see exactly 1 'Object Deleted' event from around the time I deleted 3.  I would expect to see 3 'Object Created', 3 'Objected Deleted' at the earlier time, then one 'Object Created' at the subsequent time; no apparent errors in CloudTrail; all of this done using the console (after a similar pattern observed when updates were made via CloudFormation).Anything else I can do to debug?FollowComment"

Answer: "0Hello,Thank you for contacting AWS Re:post. I understand that you are setting up events in EventBridge and observing the following behavior:When you delete objects in bulk(i.e using console or Cloudformation), that event is logged as one delete event and not separated for every object.We were able to confirm the above behavior and it is expected in Cloutrail logs. As mentioned in the following document, difference in Cloudtrail and Server access logs, we see that Logging of keys in a batch delete operation is not logged in Cloudtrail. However it is logged in Server Access logs.https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.htmlIn this case,  you can use Server Access logs to get detailed logs for every delete event.https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.htmlPlease do not hesitate to reach out to me if you have any other questions, comments or concerns.CommentShareSUPPORT ENGINEERAjinkya B-AWSanswered a year ago"


Question: How to implement IPC Request/response instead of pub/sub mechanism in Greengrass V2 ?

"Hey Team,We want to implement request/response over IPC, the way normal REST APIs are working. Is there any provision in Greengrass v2 Sdks ? Since we are currently using pub/sub which is async. Instead of that we want sync implementation.Could you please help with some reference for the same.Regards,Nalay PatelFollowComment"

Answer: "1Accepted AnswerGreengrass does not implement request/response in our IPC, but this doesn't mean that you don't have any solutions. You're able to run any communication protocol you like, such as HTTP or gRPC by deploying a server as one of your components and then connecting to that server from other components.CommentShareEXPERTMichaelDombrowski-AWSanswered 5 months ago1You can use future to make your request appear as synchronous. When you publish the request you return a future to the caller that gets completed when the response is received or after a timeout.The following gives a blueprint for such implementation (to be completed with proper error handling and shutdown behavior for the server).Let's say you have a client and a server. The client sends a request on topic /work/req and the server responds on a topic /work/resp.The following code allows the client to call send_request_sync() to have a synchronous process of the request.On the "client" side:from awsiot.greengrasscoreipc.clientv2 import GreengrassCoreIPCClientV2from awsiot.greengrasscoreipc.model import (     PublishMessage, JsonMessage, ReceiveMode, SubscriptionResponseMessage)import typingfrom concurrent.futures import Futureimport asynciofrom uuid import uuid4client = GreengrassCoreIPCClientV2()def send_request_sync(val: int):    f = Future()    sub = None    token = str(uuid4())    print(token)    def handle_response(msg: SubscriptionResponseMessage):        print(msg.json_message.context.topic)        print(msg.json_message.message)        if (msg.json_message.message['req_token'] == token):            print("Closing subcription")            sub[1].close()            print("Setting future")            f.set_result(msg.json_message.message)        sub = client.subscribe_to_topic(topic='/work/resp',                                 receive_mode=ReceiveMode.RECEIVE_ALL_MESSAGES,                                 on_stream_event=handle_response)        client.publish_to_topic(topic='/work/req',                         publish_message=PublishMessage(json_message=JsonMessage(message={"m":val, "req_token": token})))        return ffuture_1 = send_request_sync(1)result = future_1.result(timeout=10)On the "server" side:from awsiot.greengrasscoreipc.clientv2 import GreengrassCoreIPCClientV2from awsiot.greengrasscoreipc.model import (     PublishMessage, JsonMessage, ReceiveMode, SubscriptionResponseMessage)import typingimport timeimport asyncioclient = GreengrassCoreIPCClientV2()def handle_request(msg: SubscriptionResponseMessage):    print(msg.json_message.context.topic)    print(msg.json_message.message)    time.sleep(5)    client.publish_to_topic(topic='/'.join(msg.json_message.context.topic.split('/')[:-1] + ['resp']),         publish_message=PublishMessage(json_message=JsonMessage(message=msg.json_message.message)))    sub = client.subscribe_to_topic(topic='/work/req',                                 receive_mode=ReceiveMode.RECEIVE_ALL_MESSAGES,                                 on_stream_event=handle_request)async def main():    await asyncio.Event().wait()asyncio.run(main())CommentShareEXPERTMassimilianoAWSanswered 5 months ago"


Question: DynamoDB Global tables do not support stream filtering.

"Is it true that DynamoDB global tables do not support stream filtering?  This is according to comments here https://dev.to/aws-builders/new-dynamodb-streams-filtering-in-serverless-framework-3lc5 . If true, when do you expect to support this? This is a really crucial issue as we recently started using Global Tables and this feature is a must for us.FollowComment"

Answer: "2Accepted AnswerCurrently DynamoDB does not support Stream Filters for Global Tables, that is, Global Tables have to be direct replicas of each other and you cannot filter which data is replicated.The feature you mention is on the Lambda side, specifically on the Event Source Mapping. This mapping is used on your Lambda consumers to map to your DynamoDB Stream. Regardless if the table is a Global Table or not, this filtering will still work if you have a Lambda consuming from your DynamoDB Stream.I hope that clears up your question.CommentShareEXPERTLeeroy Hannigananswered a year agosimon a year agothank you for your clarification. marry xmass.Share"


Question: How do I keep ETL job script from executing when there is no data

"I have a Glue ETL script which I will eventually have execute via Lambda with S3 event trigger.  But for now I am just running regularly.  If there is no new data, then the script runs and produces errors since my transformations have empty DataFrames.I am using Bookmarks.  My ingest and export sections are using transformation contexts.  But my regular transformation code is not wrapped inside any sort of if-clause or anything like that.So my code looks like this:import sysfrom awsglue.transforms import *from awsglue.utils import getResolvedOptionsfrom pyspark.context import SparkContextfrom awsglue.context import GlueContextfrom awsglue.job import Jobfrom pyspark.sql.functions import to_timestamp, to_date, date_formatfrom awsglue.dynamicframe import DynamicFrameimport pyspark.sql.functions as f## @params: [JOB_NAME]args = getResolvedOptions(sys.argv, ['JOB_NAME'])sc = SparkContext()glueContext = GlueContext(sc)spark = glueContext.spark_sessionjob = Job(glueContext)job.init(args['JOB_NAME'], args)# Data Catalog: database and table namedb_name = "my-database"tbl_name = "my-table"# Script generated for node S3 bucketS3bucket_node1 = glueContext.create_dynamic_frame.from_options(    format_options={"quoteChar": '"', "withHeader": True, "separator": ","},    connection_type="s3",    format="csv",    connection_options={"paths": ["s3://my-bucket/my-folder"], "recurse": True},    transformation_ctx="S3bucket_node1",)df = S3bucket_node1.toDF()df = df.drop("col6") df = df.withColumn("time", f.unix_timestamp("time", 'dd-MM-yyyy HH:mm:ss') * 1000)df = df.withColumn("timegmt", f.unix_timestamp("timegmt", 'dd-MM-yyyy HH:mm:ss') * 1000)df = df.withColumn("value", df.VALUE.cast('int'))df = df.withColumn("filename", f.split(f.input_file_name(), '/')[4])df = df.withColumnRenamed('VID', 'vid')df = df.withColumnRenamed('ALTID', 'altid')df = df.withColumnRenamed('VTYPE', 'vtype')## SPARK DF -> DYNAMIC DFdynamic_df = DynamicFrame.fromDF(    df,    glueContext,    "convert_ctx")# Data Catalog WRITEDataCatalogtable_node2 = glueContext.write_dynamic_frame.from_catalog(    frame = dynamic_df,    database = db_name,    table_name = tbl_name,    transformation_ctx = "DataCatalogtable_node2",)job.commit()so I am trying to put logic so that it doesn't try to execute all those transformations if there is in fact no new data (i.e. empty DataFrame).FollowComment"

Answer: "2Accepted AnswerI don't love this method because it causes overhead but I'm not sure there is a better way: before you convert back to the dynamic frame add something that checks to see if the dataframe is empty. Another common way is to count the number of rows in the dataframe and if it is not zero then proceed, however, the take method is more performant as it evaluates less partitions/rows.if df.take(1):    <do your write command>job.commit()CommentSharetjtollanswered a year agoEXPERTFabrizio@AWSreviewed a year agobfeeny a year agoThanks, I did read about this method and variations of it, such as looking for empty data frames.  I figured there would be a way that worked off the bookmarks.  I mean if the bookmarks determine there is no new data seen, then that would be an easy way to gate out as well.  I will use this method though for now.Share"


Question: How to implement Composite Sort Keys

"Best Practices for Using Sort Keys to Organize Datahttps://docs.aws.amazon.com/amazondynamodb/latest/developerguide/bp-sort-keys.htmlpresents the following example structure for a sort key:\[country]#\[region]#\[state]#\[country]#\[city]#\[neighborhood]I have searched for any information or example on how to implement Composite Sort Keys and have found nothing useful.in Secondary Indexes (local or global):How does one define a composite sort key?How are these composite sort keys updated when one or more of the included attributes is modified?One obvious solution would be to create a new string attribute that contains the concatenated attribute values, and then reference this "calculated" attribute as the SK attribute. The application layer would then be responsible for updating the calculated attribute each time any one of the attributes included in the concatenation was updated. This seems the kind of thing the database should do automatically (like function indexes in some relational database do). Also, another  downside of this approach is the duplication of the attribute values and resulting waste of storage space (or at least the extra cost of such storage).Is there a better solution?FollowComment"

Answer: "0The application layer manages it, that's often the case with NoSQL and DynamoDB specially.The point of DynamoDB is to use extra storage space but gaining speed, because storage is cheaper than processing power.CommentSharemojimianswered 4 years ago0Yes, you should concatenate the data in your application to create the composite sort key. The primary key should be selected based on your access patterns so that you retrieve the required result set as efficiently as possible by avoiding unnecessary round trips to the database. This means that you will duplicate (and de-normalize) some of the data to gain the efficiencies in speed and performance. The datamodel you pick depends entirely on your application access patterns and business requirements. This NoSQL best practice is documented here: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/bp-general-nosql-design.html#bp-general-nosql-design-conceptsThat said, there are a few ways to lower your storage costs although the effort is greater than the benefit. I would encourage you to weigh the overall application requirements before finalizing your approach. For example, you can store the concatenated data values in the sort key only and not store them as individual attributes. The tradeoff would be to parse the sort key in your application if you require it. Also, you can store abbreviations for the data values. For example, you may have a “status” attribute with values [Success, Failure, In Progress]. You can represent this data set as [S,F,I] and use a config file to match the values on the fly using your application.CommentSharePadma_awsanswered 4 years ago"


Question: How do I take down an OLD website?

"I have a problem that I am having a hard time getting an answer to.  I just found out that I have TWO websites - one OLD and one new.  The old site is from 2017 and I just found out that it is still active.  The original website was built in WP, it was then rebuilt in Square Space and then rebuilt in Duda.  Because both sites are live it is causing me problems. After hours of investigating, I have just been informed that the OLD website is hosted by Amazon but I cannot contact anyone at Amazon to bring the site down - the OLD site is http://colesvilletravel.com - this is the site that need to be taken down.  My new site is https://www.colesvilletravel.com.How and who do I contact to take down the OLD site - http://colesvilletravel.com - please help - it is really cause me a problem and I cannot move forward.  CindyFollowComment"

Answer: "0Can I log into my AWS account?If you no longer need an AWS account, please follow the instructions below to cancel your account.https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/close-account.html#closing-the-accountIf this answer has led to a resolution, please approve the answer for the betterment of the community.CommentShareEXPERTRiku_Kobayashianswered 2 months agorePost-User-7560324 2 months agoIf I cancel the account will the website come down?  How do I confirm that Amazon is HOSTING the account?  I have gotten so many answers I need to be sure that Amazon is the HOST of this OLD website.  Is there a way for me to confirm that Amazon is the host?  How can I see if the is live on Amazon?ShareRiku_Kobayashi EXPERT2 months agoIf you terminate your AWS account, all of the resources running in your account will no longer be available, so if your website is hosted, it will be shut down.You must log in to your AWS account to check if it is hosted.Is the newer site not hosted on AWS?If the newer site is hosted on AWS, the newer site will also be unavailable when you cancel.Sharealatech EXPERT2 months agoActually according to this: https://repost.aws/knowledge-center/terminate-resources-account-closure, “ Closing your account doesn't automatically terminate all your active resources.”. So you must get access to the account and terminate the resources.Share0Both the "old" and "new" websites are being hosted by Amazon - you end up on the same Amazon network load balancer in Northern Virginia in both cases.The www address (after jumping through a few CNAMEs):$ host www.colesvilletravel.comwww.colesvilletravel.com is an alias for s.multiscreensite.com.s.multiscreensite.com is an alias for global.multiscreensite.com.global.multiscreensite.com is an alias for d1-hitch-nlb-360be683c5f2457b.elb.us-east-1.amazonaws.com.d1-hitch-nlb-360be683c5f2457b.elb.us-east-1.amazonaws.com has address 35.172.94.1d1-hitch-nlb-360be683c5f2457b.elb.us-east-1.amazonaws.com has address 100.24.208.97The plain address, without the www, is an A-record for one of the IPs on that NLB:$ host colesvilletravel.comcolesvilletravel.com has address 100.24.208.97Using curl it appears that everything, whether plain HTTP or HTTPS, with or without the www, ends up at https://www.colesvilletravel.com/ with the redirect being handled by nginx running on something on the other side of the NLB.Either your organisation pays a bill to AWS every month for this infrastructure and you administer it yourselves in-house, or you pay a third-party (does multiscreensite.com sound familiar?) to do it for you.CommentShareRWCanswered a month ago"


Question: Batch ArrayProperties configured from input in Step Functions

"I'd like to have the size of a Batch job be configurable from inputs of a Step Function.However, both:"ArrayProperties": {  "Size": "$.ArraySize"}and"ArrayProperties": {  "Size": $.ArraySize}do not work. The former complains that type, string, is invalid for the paramter, and the latter complains of a syntax error.Is it what I'd like to achieve possible?FollowComment"

Answer: "1Accepted AnswerHi,This should be possible. Can you please try the following:        "ArrayProperties": {            "Size.$": "$.ArraySize"        },I have just tried this out and the size parameter now takes it's value from the input. Please check out this part of our documentation for additional details in setting parameters -> https://docs.aws.amazon.com/step-functions/latest/dg/input-output-inputpath-params.html#input-output-parametersIf this does not work, kindly send your task state and I will check if I may have missed anything.CommentShareSUPPORT ENGINEERRyan_Aanswered a year agoyodiggity a year agoThanks; this works.Share"


Question: Are BYOIPs available to subaccounts?

"If we transfer IP addresses to AWS (BYOIP), can those IP addresses be made available as Elastic IPs to a subaccount?FollowComment"

Answer: 0Good question.  The only way to do this today is to use Amazon's VPC IP Address Manager (IPAM) and integrate IPAM with AWS Organizations.Then you can specify an "IPAM admin" account and share those IPAM pools with other accounts in the organization: https://docs.aws.amazon.com/vpc/latest/ipam/enable-integ-ipam.htmlCommentSharejsoncanswered a year ago


Question: Use Nvidia GPU in AWS Batch

"For a job, I run puppeteer in the headful mode in AWS Batch. I found a docker file that uses the image node:16.5-slim, then downloads Chrome, and then uses Xvfb.If I run it on an EC2 instance with GPU, Chrome still uses the integrated video card (llvmpipe) not taking advantage of the powerful Nvidia GPU.I found online a couple of attempts, one I heard they had to switch to Windows (not supported by AWS Batch). They also used an AMI only available on EC2: https://stackoverflow.com/questions/67813309/run-headful-chromium-with-nvidia-gpu-and-xvfb-on-ec2-instance-with-primeAnd the other solution also doesn't seem to be suitable because of its complexity to set up: https://boygiandi.medium.com/ch%E1%BA%A1y-chrome-v%E1%BB%9Bi-gpu-tr%C3%AAn-instance-ec2-aws-69369d73235aI wonder if there is a docker image I could use as a starting point where the Nvidia GPU is already set up and Chrome could take advantage of it with only a few extra configurations. Thanks!FollowComment"


Question: api gateway binary data

"This question relates to https://repost.aws/questions/QUEPFLM_x_SJaZNkBJ-pYYPg/upload-jpeg-to-lambda where no satisfactory answer was provided.I have created a working example of an image download, reachable here:https://xmv92e5ly4.execute-api.eu-west-2.amazonaws.com/prod/uploadThis end point will correctly return a binary image. The lambda source code is pretty simple:const fs = require('fs')exports.handler = async (event) => {    // TODO implement    console.log(fs.readdirSync('/mnt/data/uploads'));    const response = {        statusCode: 200,        isBase64Encoded: true,        headers: {            'Content-Type': 'image/jpeg'        },        body: fs.readFileSync('/mnt/data/uploads/small_biometriclogin_1a968aa583.jpg').toString('base64')    };    return response;};On the api gatway side, i did pretty much nothing except for entering */* as Binary Media Types.My questions are:why does the code above stop working if i put as Binary Media Types image/jpeg, or anything other than */* (image/* for example)?a similar set up (end point reachable here https://apigwtest.punch-in.co.uk/uploads/small_biometriclogin_1a968aa583.jpg), with Binary media types set to / returns only text, no binary.FollowComment"


Question: set up jupyter lab in AWS lightsail

"I want to run a Jupyterlab server in AWS lightsail. I create a lightsail instance (bitnami LAMP), install anaconda, install jupyter -- everything goes well. If I edit~/htdocs/index.htmlI can see the result in an external browser by going tohttp://34.345.3.190(pretending that 34.345.3.190 is my lightsail instance's IP address), so apache is working and port 80 is open. If I runjupyter-lab --no-browserfrom inside the lightsail instance (having ssh'd in), everything appears to be fine, so no problem with jupyterlab. It tells me to access jupyter at http://localhost:8888/labNow I go to Networking in my lightsail instance and "add a rule" choosing Custom, TCP, 8888 to open the 8888 port, but this is where things go wrong.http://34.345.3.190:8888/labgives me "unable to connect" in my external browser.If I runss -tuln | grep 8888I gettcp   LISTEN 0      128                           127.0.0.1:8888        0.0.0.0:*If I runsudo nmap -sT -O localhostI getPORT     STATE SERVICE22/tcp   open  ssh80/tcp   open  http443/tcp  open  https3306/tcp open  mysql8888/tcp open  sun-answerbookDevice type: general purposeIf I runnetstat -antop | grep 8888I gettcp        0      0 127.0.0.1:8888          0.0.0.0:*               LISTEN      6911/python3.9       off (0.00/0/0)This sounds relevant, but it's EC2 specific and I couldn't get it to work in lightsail:https://docs.aws.amazon.com/dlami/latest/devguide/setup-jupyter-configure-client-linux.htmlFollowComment"

Answer: 1Jupyter needs additional configuration in order to receive connections from origins other than localhost. Have you tried the solution described here? https://stackoverflow.com/a/43500232CommentSharetanbriananswered a year agovodoaldus a year agoThank you! Let me try. I'll report back.Share


Question: Add bending to Entity without rollup bar

"Hey all, So I was wondering how to give an entity bending so that it is affected by wind. I currently want to do this to a tree I've imported from speedtree. I know before you would use the role up bar and add the entity under the vegetation tab but I was wondering if it were possible to drag and drop the entity .cgf file into the level and add bending to it, rather than using the outdated method of using the vegetation paint brush and adding the tree like thatFollow"

Answer: "0Accepted AnswerHey @REDACTEDUSERSharerePost-User-5738838answered 5 years ago0So, @REDACTEDUSERSharerePost-User-8843326answered 5 years ago0@REDACTEDUSERCan you tell me what version of Lumberyard that you are using? If you do not have the RollupBar, I am going to assume that you created a new project with the ProjectConfigurator.exe. When new projects are created in Lumberyard 1.12 the CryEntityRemoval gem is enabled by default. This gem removes all legacy systems. If you have this gem enabled, disable it, then rebuild your project. Once you do this, the RollupBar should return and the familiar Vegetation tool will become available again. Please let me know if this helps you and good luck!SharerePost-User-1190460answered 5 years ago"


Question: Removing unknown account on which I have no control from my organization

"Hey all, the following happened:Situation:I invited an account to my organizationI did a mistake by putting the wrong e-mail addressThe random person owning the account with this email accepted the invitation, and is now part of my organizaitonComplication:4. This is very dangerous for me given his activity is now billed on my organization so I want to remove him5. AWS doesn't let you remove account from your organization that don't have their own billing info, which is the case of this person6. Contacting this person didn't workSolution I need:How to remove an account that has no billing information and that you do not control from your organization??? It seems crazy that AWS does not allow me to do this given the risk I am at in this context.FollowComment"

Answer: "1What about canceling the account itself?If you are managing the parent account for Organizations, you may cancel it.https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_close.htmlAlternatively, you can contact AWS support with a case study on "Account and billing" and they may be able to provide you with an answer.CommentShareEXPERTRiku_Kobayashianswered 15 days ago"


Question: Set S3 Glacier vault's storage class

How do i set the storage class of an S3 Glacier vault (to deep archive)?FollowComment

Answer: "2Amazon S3 Glacier vaults can only be stored in a single Storage Class  for a cost of $0.0036 per GB/Month in the N. Virginia region.For an enhanced Amazon S3 Glacier experience, you can use the Amazon Simple Storage Service (S3) console instead of the Amazon S3 Glacier  service. Accessing and using the Amazon Simple Storage Service (S3) Glacier storage classes through the Amazon S3 APIs and Amazon S3 console provides enhanced functionality for data management and cost optimization. This is where you can find Deep Archive storage class.For more information about Amazon S3 Storage Classes, please refer to the following links:https://aws.amazon.com/s3/pricing/https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.htmlhttps://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html#sc-glacierhttps://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html#sc-compareYou would have to download all your data from your Amazon S3 Glacier vault and then upload the data to an Amazon S3 bucket. You can use an EC2 instance with a S3 VPC Endpoint to eliminate any out-of-region data transfer charges. You can configure the data to be stored in the Deep Archive storage class during the upload using parameters in your SDK or CLI request. You can also configure the data to be moved to the Deep Archive storage class after being uploaded via a Lifecycle Policy or the S3 Console.For more information about setting the storage class of an object, please refer to the following links:https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html#sc-howtosetExample AWS CLI request to upload a single object to the Amazon S3 Glacier Deep Archive storage class:$ aws s3 cp downloads\glacierVault\test.txt s3://mybucket/test.txt  --storage-class DEEP_ARCHIVEExample AWS CLI request to upload an entire directory to the Amazon S3 Glacier Deep Archive storage class:$ aws s3 cp downloads\glacierVault\ s3://mybucket/glacierVault/ --recursive  --storage-class DEEP_ARCHIVEFor more information about the above CLI commands, please refer to the following links:https://awscli.amazonaws.com/v2/documentation/api/2.0.34/reference/s3api/put-object.htmlhttps://docs.aws.amazon.com/cli/latest/reference/s3/cp.htmlTo retrieve an object that is stored in the Deep Archive storage class, refer to the following links:https://repost.aws/knowledge-center/restore-s3-object-glacier-storage-classhttps://docs.aws.amazon.com/cli/latest/reference/s3api/restore-object.htmlCommentShareAWS SA Neilanswered 5 months agoEXPERTChris_Greviewed 5 months ago"


Question: Redshift error: authentication method 13 not supported when creating a user with sha256 hashed password

"The redshift docs say when creating a new user, you can specify your password as cleartext, md5 hash, or sha256 hash with a salt.  Two valid formats they give for sha256 are sha256|<cleartext password>, and sha256|<digest>|<salt>.  I tried both formats when making a user and came up with the same error:  error: authentication method 13 not supported.I tried psql that came with postgres version 14, and psql that came with version 13, both reported the same error.  I also tried connecting with Navicat, and it reported the same error.Do we need to run SET password_encryption TO sha256 or something similar?FollowComment"

Answer: 1I believe you are seeing an incompatibility with the Postgres psql support for sha256 based passwords. Can you try using the rsql command-line tool to connect?https://docs.aws.amazon.com/redshift/latest/mgmt/rsql-query-tool.htmlCommentShareDon_Danswered 7 months agoEXPERTFabrizio@AWSreviewed 7 months ago


Question: how to read delta lake format data for SageMaker training

I want to read data from Databricks output and format the data for SageMaker trainingFollowComment

Answer: "1You have a couple of options:Amazon SageMaker DataWrangler. You can use Databricks as a data source in SageMaker Data Wrangler.  This allows you to interactively query the data stored in Databricks using SQL, and preview data before importing it. Once the data is imported you can cleanse, engineer features, and prepare it for training. Please refer to the blog below for more information: https://aws.amazon.com/blogs/machine-learning/prepare-data-from-databricks-for-machine-learning-using-amazon-sagemaker-data-wrangler/AWS Glue: Assuming the Delta Lake table are stored in S3 you can build a Glue job to read, transform , and prepare the data for Sagemaker training. More info can be found here: https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-format-delta-lake.htmlCommentShareNZanswered 2 months ago"


Question: IoT services by project?

"Hi,I plan to have several distinct IoT projects on my account which will not share devices or business logic. I also need to be able to configure separate production and development environments for these projects so that testing can occur without impacting production.It's unclear to me how this should be done. With most other services, you start by creating a container or an environment, like with data you might create separate databases, or with servers, separate Ec2 instances.When I started working with IoT services, I was surprised that I didn't have to start by setting up such an environment.I assume that people are able to run distinct dev and production environments, and different projects, without having to resort to getting different Amazon accounts for each project. What's the right way to do this?Thanks,FrankFollowCommentFrank a year agoAs an example, I have a rule that forwards messages from topics to SQS under certain conditions. I'd want to make sure that a rule intended for one project doesn't process things from a different project. I'm not seeing any obvious way to restrict the scope of rules this way.Share"

Answer: "1Accepted AnswerIf you want true isolation between your lower environments (Staging, QA, etc) and production, you need to use separate accounts. This is true, even outside of the AWS IoT services.For your rule example, you can specify the source in your Rule query statement to restrict what topic filter gets sent to SQS.CommentShareJeremy_Sanswered a year agoFrank a year agoThanks. What about using different Regions to separate them? I notice that the Rules and Things I create are region-specific, I assume the endpoint would be different in a different region as well.ShareGreg_B EXPERTa year agoYes the endpoint is different in different regions. Nonetheless, multiple accounts is generally considered best practice. This whitepaper is well worth a read: https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/organizing-your-aws-environment.htmlShare"


Question: Running a query on Athena and received an error.

"I'm guessing I don't have access to the datalake I'm querying, BUT I've already onboarded my AWS accounts to access the database. Can someone tell me where I can check these permissions?FollowComment"

Answer: "1When you get Insufficient Lake Formation permissions on a table, I would suggest that you check the permissions for the user you are using to the database and the table in Lake formation. Here are the instructions to check your permissions.If you haven't granted permissions under Lake formation, you would have to grant at the database level () and at table level (select and describe permissions). Try the below steps and let me know if you still face any issues:STEP 1: Database accessTo grant access, please Go to "AWS Lake Formation" > "Data Lake permissions"Choose the IAM users and roles from drop downChoose Named data catalog resourcesChoose database (dont choose tables) and provide "Describe" access (or more as needed)If it is not resolved, proceed to Step 2STEP 2: Table accessTo grant access, please Go to "AWS Lake Formation" > "Data Lake permissions"Choose the IAM users and roles from drop downChoose Named data catalog resourcesChoose Table(s) and provide "Select" & "Describe" access (or more as needed)CommentShareAnanth Tirumanuranswered 8 months ago"


Question: AWS RDS & Cloudwatch Free Tier Charges

"Hi,I started using RDS under AWS Free tier. As per documentation, I was expecting 750 hours of RDS single instance availability without any charge. Below are the details of the charge from billing. I had a basic test table with <100 rows of data. Is there some config change that I need to avoid this charge.RDS$0.115 per GB-month of provisioned gp2 storage running MySQL4.684 GB-Mo$0.54$0.115 per RDS GB-month of provisioned GP2 storage3.006 GB-Mo$0.35Similarly for Cloudwatch I am getting charges without specifically activating any alarm. Below is an alarm for my cloudwatch. My provisioned capacity range from 1-10 read / write per second. So not clear how is the below alarm applicable and why is there a charge for this alarm? Do I need to make some changes to DynamoDB & CloudWatch config?In alarm2022-03-26 22:44:22ConsumedWriteCapacityUnits < 30 for 15 datapoints within 15 minutesRegards,DBeingsFollowComment"

Answer: "1You say you've just started using RDS: but is this a new account?The free tier for RDS is only valid for the first year of the account after it was created - if your account is older than that, you'll be charged for the RDS instance.CommentShareAWS-ADolganovanswered a year agodbeing a year agoYes, this is a new account and its just about 5 months since I started on free tierShare0Hello there! Sorry to hear about your concerns with billing.I suggest opening a support case with our Billing Team directly, so they can look at your specific resources and advise on how to resolve those charges: http://go.aws/support-center.This documentation outlines free tier limitations for RDS- specifically, the instance size type will make a difference on how billing works: https://aws.amazon.com/rds/free/.-- Leo W.CommentShareMODERATORAWS Support - Leoanswered a year ago"


Question: AWS DMS Source Mongo DB target PostgreSQL change data type in transformation rule

"I am running a DMS migration task,Source - Mongo DBTarget - Postgres SQLOne of the integer field in mongo has 5% values in string and rest values in integer data type.After migration to Postgres the String values is as it is and all integer values in that column becomes null.I also tried adding a transformation rule where I changed that column data type to int2, int4, stringbut still only 5% data comes with changed data type but rest of values are NULL which were integer type in mongo DB.How will I be able to change all values to Integer type or all to string type.As I do not want to lose any data.FollowComment"


Question: "Notebook" tab not showing in the EMR console

"Here is what I have :Amazon EMRClustersSecurity configurationsBlock public accessVPC subnetsEventsHelpWhat's newHow can I use the EMR notebook ?Edited by: ChristopheL on Dec 11, 2019 8:10 AMFollowComment"

Answer: "0I had to change my region, as EMR notebooks are not available in all regions…CommentShareChristopheLanswered 3 years ago0Hi,Your understanding is correct. EMR notebooks are not available in some regions. The list of supported regions can be found here:https://aws.amazon.com/about-aws/whats-new/2018/11/introducing-emr-notebooks-a-managed-analytics-environment-based-on-jupyter-notebooks/CommentShareAWS-User-1057810answered 3 years ago"


Question: Will the described IoT endpoints change?

When we describe an IoT endpoint for a specific region using the AWS CLI - e.g. for the iot:CredentialProvider and region eu-west-1 - will this IoT endpoint change in future? Or does this endpoint remain stable forever?The question refers to the AWS CLI Command Reference:https://docs.aws.amazon.com/cli/latest/reference/iot/describe-endpoint.htmlThank you for your reponses.FollowComment

Answer: "2Accepted AnswerHi,Thanks for the question! The returned value for calls to DescribeEndpoint are stable once created/described. It is expected that these endpoints will be used devices with long lifecycles, hence the long-term stability of the FQDN. This holds true for the various endpoints (data plane, jobs, credential provider, etc.).CommentShareGavin_Aanswered 4 months ago"


Question: AWS Abuse Report - Never got one of these before

"We have been using an LS instance (preconfigured Ubuntu 20.04lts VM) running PLESK and a wordpress site for our church. Has been up for about a month. Today, I got an email from AWS about an abuse. The report shows that the IP6 was doing automated crawling:******* * Log Extract:<<<****We are seeing automated scraping of Google Web Search from a largenumber of your IPs/VMs. **********There's nothing in the data of the report except this:+----------------------------------------+--------------------------+----------+---------------------+| Source | Time_UTC | Destination | DestPort |+----------------------------------------+--------------------------+----------+---------------------+2600:1f18:6502:5000:a087:4d0e:325:9709 2021-12-13 22:17:01 2607:f8b0:4004:808::2004 443The prebuilt VM (an ubuntu 20.04 LTS preconfigured with Wordpress/plesk) had IP6 enabled by default.So I need some help as this is not my area of expertise.When I run NETSTAT -AN, I see no established connections over that IP6 address. Since we don't use IP6, I have disabled it. But there was no established IP6 connections to any endpoint, let alone the one noted specifically above).Still, I'm concerned my system is compromised. I don't really know what to do. I had the Network config and the WAF limiting access, bu somehow the system looks to have been compromised.How do I root out whether there's a breach, an already in place virus or malware or rootkit? How do I scan my system for threats?FollowComment"

Answer: "1Some additional guidance if you need it:You don't mention if you replied back to the Abuse report email. If not, do make sure to reply and let them know the actions you have taken so far and any additional actions you plan to take. This is to ensure the Abuse team do not take further action against your account because they had not heard back from you.Some websites with forum/social features will do automatic link expansion when someone posts a URL in a chat. This requires the server to make outbound connections to download a preview of the page. This can cause unexpected patterns of outbound web traffic from your server. If you have such features on your site consider disabling them.You do not mention how you keep your WordPress application up to date or what plugins it has. In my experience the most critical part of keeping this application secure is rigorously keeping it updated and being very careful which plugins you install. You can get guidance on this from https://wordpress.com/support/security/ as well as many other third-party guides for running WordPress.To eliminate any malicious changes to the underlying host you can to backup the WordPress data, redeploy a new LS instance, disable IPv6 from the beginning, ensure all components are fully patched, apply the appropriate network security layers, then restore your backup, update DNS to point to the new server and see if the problem recurs. You can delete the original instance, although you can keep it offline and investigate further but this will add to your costs.If this still does not resolve the issue the next steps I'd recommend would be deploying additional tools to get low-level visibility into your network traffic, such as VPC FlowLogs, AWS Network Firewall and enabling both the Amazon GuardDuty  service and the Amazon Detective service the enables you to see complex network flows from your instances. However these all have service charges so if your application is very cost sensitive you may want to use them only for a short period until the problem is resolved. (Several of these services do have free trials for a limited period of time) If it fits into your budget it is highly recommended to keep Amazon GuardDuty running all the time to monitor for network and AWS account level security issues.CommentShareDaniel_Sanswered a year agoRWITDIRECTOR a year agoHi Friend:I have been out with an infected molar removal. Not fun. Just getting back into the swing here.Yes, I reported back to Abuse, looking for their guidance and help (and patience) as I root cause this and remediate.We have all social media features of WP disabled. No public ccommenting/posting, no plugins for this. It's all just basic pages really.I use PLESK Obsidian with Wordpress Tool kit to keep the site up to date. I typically do updates daily (not automatic b/c I need to test). I have the AWS network configuration locked down to IP4 now. (IP6 has since been disabled.) Have a new Network Rule in AWS's network config to only allow SSH access fromy my corporate IP. I am running Immunity 360 to help look for threat via plesk on my single WP instance. (we only have the one).I just installed CLAMAV and it's not finding anything.I run Wordfence with 2FA on our admin accounts.At this point, I have no idea what the process source is. But obviously, there is some process running that is making the connections. NETSTAT-AN doesnt' show anyhing active outbound to 443.  I may have to install wireshark and try to figure out how to do some outbound capture on 443 for next steps. But really, I need to find the process that is making the connections and root it out.I may end up taking the approach to build a new instance. But TBH, that is only going to leave me unknowing of how this system got compromised so that I can harden it even further. I need to do that.Share0Hello,there are few potential things to do:Scan instance with Amazon Inspector, though it might be not freeScan instance with some antivirus software (like ClamAV). Here is example (refer to the first part only, I believe you don't need to automate it for regular actions)If your instance doesn't need to make outgoing connections to internet (like your app doesn't need to load anything from internet) - you can configure outbound rules in security group to prevent such connectionsRegarding the WAF - note, that it protects the app itself from incoming threats, but it doesn't help if app is compromised and does some bad things by itself.CommentShareA-Shevchenkoanswered a year ago"


Question: How to suppress carnaval monitor in case of deployment is progress for an ECS Fargate Service

"Hi All,We own a Fargate Service that experiences latency spikes during and shortly after deployment. This is a expected as the Cache that is utilized requires time to build. These spikes are noticeable in the us-west-2 region, as in other regions, traffic remains stable even during downtimes, and the cache is quickly filled.We want to suppress the alarms for us-west-2 during and soon after the deployment as it is false alarm and is expected.Is there any default cloud watch metric present to know if ECS Fargate Service is in deployment ?Is there any strategy present for suppressing the alarms such use cases ?FollowComment"


Question: AWS Connect automation scripts

"Hi ,I have created a Terraform scripts  for Amazon connect instance like Hour of operation, Queues, Routing Profile etc. . However there are some dependencies  like hour of operation dependent on queue   etc . My question is do we need to run scripts on sequence wise like hour of operation run first then run queue. Do we need to run  as sequential or  we  can run in one go  with  some options like depends_on etc. Please Suggest.RegardsJoFollowComment"

Answer: "1Accepted AnswerIn Terraform, most resource dependencies are handled automatically. It analyses expressions within a resource block to find references to other objects, and treats those references as implicit ordering requirements when creating, updating, or destroying resources.However, there are some resources that have hidden dependencies and must be explicitly defined by using depends_on.More information from this document: https://www.terraform.io/language/resources/behavior#resource-dependenciesI've seen a few IaC documentations that mention if you need to explicitly define the dependency but sometimes it doesn't.  One way to find out is to test your configuration.CommentSharejoahnaanswered a year ago"


Question: How can one revive "aws.iot.SiteWiseEdgePublisher" from the broken state given relevant methods like Deploy etc. don't work?

"I have a production SiteWise Gateway running on an AWS SSM node but for no apparent reason, the "aws.iot.SiteWiseEdgePublisher" component stopped working and went into a Broken state. The Greengrass nucleus and other components are running, and reporting green on their health on the console.Tried:Used the AWS console (SiteWise -> Edge (gateway)) to downgrade or upgrade the publisher to trigger deployment, but the core device responded on downgrade but after that went to broken state, and not responding to other deployment requests.Tried using the Greengraas CLI on device to restart or stop the service but no results.Tried deployment from IoT Core on the core device but no response and deployment failed.Hard reboot on the servers that run Greengrass but publisher is still in broken stateSo I tried the above but none yielded any results, so any suggestion/advice? I would prefer not to touch the Sitewise deployment because it has quite a lot of machine models and assets mapped to incoming data, so it will be massive work.FollowCommentPhilipp S 9 months agoWhat do you mean exactly by "broken state"? Can you provide relevant error messages?ShareMassimilianoAWS EXPERT9 months agocan you think of anything that might have changed in the setup (device, permissions, etc) before the component went in Broken state? You can find the logs in /greengrass/v2/logs, but please be careful in not posing sensitive dataSharerePost-User-Roshan 9 months ago@Philips: With Broken State I mean that the component is broken as reported by AWS, and is not working (aka Broken).@MassimilianoAWS: To be honest nothing has changed, we haven't changed any setting such as device, permission or configuration. But I did check the logs for the component, and below are some snippets other than Info or WARN:2022-08-25T09:44:08.866Z [INFO] (Copier) aws.iot.SiteWiseEdgePublisher: stdout. [ERROR] 2022-08-25 12:44:08.864 [ComponentService-Executor-0] SiteWisePublisherProcess - {"message":"Failed to start publisher process: (ProvisionException) Unable to provision, see the following errors:. {scriptName=services.aws.iot.SiteWiseEdgePublisher.lifecycle.Startup.Script, serviceName=aws.iot.SiteWiseEdgePublisher, currentState=STARTING}2022-08-25T09:44:08.866Z [INFO] (Copier) aws.iot.SiteWiseEdgePublisher: stdout. {scriptName=services.aws.iot.SiteWiseEdgePublisher.lifecycle.Startup.Script, serviceName=aws.iot.SiteWiseEdgePublisher, currentState=STARTING}2022-08-25T09:44:08.866Z [INFO] (Copier) aws.iot.SiteWiseEdgePublisher: stdout. 1) Error in custom provider, org.mapdb.DBException$GetVoid: Record does not exist, recid=31793. {scriptName=services.aws.iot.SiteWiseEdgePublisher.lifecycle.Startup.Script, serviceName=aws.iot.SiteWiseEdgePublisher, currentState=STARTING}2022-08-25T09:44:08.866Z [INFO] (Copier) aws.iot.SiteWiseEdgePublisher: stdout. at com.amazon.iot.sitewise.component.publisher.guice.ComponentSDKModule.provideConnectorStreamReader(ComSharerePost-User-Roshan 9 months ago2022-08-25T14:56:06.788Z [INFO] (Copier) aws.iot.SiteWiseEdgePublisher: stdout. [ERROR] 2022-08-25 17:56:06.785 [ComponentService-Executor-0] ComponentService - {"message": "An error occurred while attempting to start process SiteWisePublisherProcess: (ComponentStartupFailureException) Failed to start up publisher."}. {scriptName=services.aws.iot.SiteWiseEdgePublisher.lifecycle.Startup.Script, serviceName=aws.iot.SiteWiseEdgePublisher, currentState=STARTING}2022-08-25T14:56:06.791Z [INFO] (Copier) aws.iot.SiteWiseEdgePublisher: stdout. [ERROR] 2022-08-25 17:56:06.789 [main] ComponentService - {"message": "Failed to start component: Failure occurred while attempting to start processes, see log entries for more information"}. {scriptName=services.aws.iot.SiteWiseEdgePublisher.lifecycle.Startup.Script, serviceName=aws.iot.SiteWiseEdgePublisher, currentState=STARTING}2022-08-25T14:56:14.138Z [INFO] (Copier) aws.iot.SiteWiseEdgePublisher: stdout. [ERROR] 2022-08-25 17:56:14.137 [ComponentService-Executor-0] SiteWisePublisherProcess - {"message":"Failed to start publisher process: (ProvisionException) Unable to provision, see the following errors:. {scriptName=services.aws.iot.SiteWiseEdgePublisher.lifecycle.Startup.Script, serviceName=aws.iot.SiteWiseEdgePublisher, currentState=STARTING}2022-08-25T14:56:19.219Z [INFO] (Copier) aws.iot.SiteWiseEdgePublisher: stdout. [ERROR] 2022-08-25 17:56:19.218 [ComponentService-Executor-0] SiteWisePublisherProcess - {"message"Share"


Question: Connecting to Aurora PostgreSQL serverless v2 from lambda

As I understand Data API is not supported yet for Aurora PostgreSQL serverless v2. I couldn't find any detailed instructions on how to connect from a lambda to Aurora PostgreSQL serverless v2. Can i assume that instructions here Connecting to RDS from lambda are applicable?  If not can I be pointed to something similar?FollowComment

Answer: "0Yes, we can use this document.Aurora Serverless v2 also supports RDX Proxy, but watch the price if you use it.The minimum charge is 8 ACUs, so the minimum is $87.6/month regardless of ACUs for Aurora Serverless v2. (for us-east-1)https://aws.amazon.com/rds/proxy/pricing/CommentSharehayao-kanswered a year ago"


Question: Amazon connect quick connect

"Hi ,While creating a AWS quick connect via terraform there is a list of 34 users we need for which we need to create a quick connect resource  where the quick_connect type is "USER" . However. this. should be created via Terraform dynamically with help of for_each loop or Count etc. Can someone suggest  how we can achieve this , if I can place  some variables in variables.tf file  like userid arn etc.RegardsJoFollowComment"

Answer: 0This link covers an option using for_each:  https://developer.hashicorp.com/terraform/language/meta-arguments/for_eachCommentShareAWS-User-9371299answered 6 months ago


Question: Does Amazon EC2 F1 instance have FPGA board with HBM?

"Does Amazon EC2 F1 Instance have FPGA development board with HBM, e.g., Virtex UltraScale+ HBM VCU128 (https://www.xilinx.com/products/boards-and-kits/vcu128.html)?FollowComment"

Answer: "1Amazon EC2 F1 Platform Features1-8 Xilinx UltraScale+ VU9P based FPGA slotsPer FPGA Slot, Interfaces available for Custom Logic(CL):One x16 PCIe Gen 3 InterfaceFour DDR4 RDIMM interfaces (72-bit with ECC, 16 GiB each; 64 GiB total)AXI4 protocol support on all interfacesReference Links to Followhttps://github.com/aws/aws-fpga/https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/accelerated-computing-instances.html#fpga-instanceshttps://aws.amazon.com/ec2/instance-types/f1/CommentShareEXPERTsdtslmnanswered 13 days agorePost-User-1006681 13 days agoSo the answer is No? The FPGA board connected to any Amazon EC2 F1 instance has no HBM?ShareAWS-Harrison 9 days agoIf you look up the FPGAs used in F1 instances (Xilinx UltraScale+ VU9P), there is no mention of HBM being able on that hardware.Share"


Question: Is there any way to detect the human voice in Amazon Lex?

"I have a scenario where I am making an outbound call using Amazon Connect StartOutboundVoiceContact API. This outbound call hits another contact flow which is an inbound contact flow. Is there any chance to detect, when the call is picked up by the agent? Or how can I detect the human voice in the contact flow so, then I can transfer the call to my agent.Actually, I want to start an outbound call, when it hits another contact flow and this call will then placed to the queue, so when the agent picks up the call then I transfer this call to my agent. Is there any possibility to detect this? If yes, then please guide?Edited**I want to make an outbound call in which AWS Lex is configured in the contact flow. The outbound destination number also configured with a third party (or any other IVR) that asks some question from us like what is your tax id, what is your name, etc, etc. So, I want to answer all these questions with the help of Lex bot, where I have already configured required intents. So, the bot will answer these question and then third party IVR transfers the call to their agent. I want to know that when their agent picks up the call then our call should be routed to our agent not before. We don't want to wait in the queue. That's why I am asking for human voice detection so we can implement it in our use case. Any other solution will be highly appreciated.FollowCommentMagda 5 months agoCan you please provide the details of actual the use case rather than a solution? An outbound call placed via API will trigger a contact flow as soon as it's answered by the recipient, so if your destination is another Amazon Connect instance flow there will actually be two contact flows executed at the same time. What are you trying to do? Why are you calling another Connect instance? Also, are you using the outbound campaign or simply call the API from a web page or a job/service?ShareAWS-User-8471608 5 months ago@Magda, the question is updated, If you are still not getting this, please let me know. I think you will get this now easily.Share"

Answer: "0A workaround for this is to put the call into a queue as a callback.  Since Connect callback is agent first, you will always secure the agent first than the requested caller.Another way is after the bot collected all the info, create a task to be routed, the instruction on the Task is for the agent to call the customer that left all the info.CommentShareClarenceChoianswered 5 months agoAWS-User-8471608 5 months agoActually, my scenario is opposite. We are the callers that start outbound call, we have a responding bot that answers to those question that are asked by some company's bot. So, your solution would work for the company not for us who are starting the outbound call.We have control on the first IVR (or contact flow) not on the second IVR. If you still need more information then please ask.Share0This is a very interesting use case you are trying to solve for, I wonder what real life use case you would apply this to. We do not have any way to detect "human" voice today to solve for your use case. You can build an integration that leverages a control backplane, but it will be complex and not easy to support operationally.CommentShareMagdaanswered 5 months ago"


Question: Querying bridged MQTT passing into DynamoDB

"I can't get a rule working, for MQTT messages being passed into IOT.In the Test rule I'm subscribing to "mygateway2-out/////+" and which gets the following JSON:{"topicFilter": "mygateway2-out/////+","qos": 0,"messages": [{"format": "json","topic": "mygateway2-out/61/1/1/0/0","timestamp": 1621297559099,"payload": 14.9}]}I have a DynamoDB table with 'sample_time' and 'value' and am trying to populate it with a Rule that looks like this:SELECT messages,(SELECT VALUE payload FROM messages) as value,FROM 'mygateway2-out/////+'I'm not getting anything populated in the table.  I've also tried:SELECT payload FROM 'messages' as valueandSELECT payload FROM messages as valueandSELECT messages, (SELECT VALUE payload FROM messages) as valueandSELECT VALUE payload FROM messages as valueNone of which is inserting any rows in my table.FollowComment"

Answer: "0The problem I had was the bridged MQTT was not sending the 'payload' in json format.{"format": "json","topic": "mygateway2-out/20/0/1/0/0","timestamp": 1621717535170,"payload": 56}I would not have had this problem if the "payload" was sent like this:..."payload": {"temperature": 28}So I needed to build the json sql query to convert the payload into a numerical value:SELECT cast(concat(substring(decode(encode(, 'base64'),'base64'),0, 2), ".", substring(decode(encode(, 'base64'),'base64'),3, 8)) as Decimal) AS value FROM 'mygateway2-out///1/0/0'Now the numerical values get inserted as "NUM" (numbers) in my DynamoDB table.CommentSharenzbaxtermananswered 2 years ago"


Question: http authorizer lambda permissions

"Hi team,I created an HttpAuthorizer via CDK and attached to it the lambda function authorizerbut I don't find a way to allow the API gw to call my lambda authorizer.on the console we have the option: "automatically authorize API gw to call your function"I even create an API role and give it permission to call my lambda authorizer but there is no way to link it to the HttpAuthorizer.is there a way like a boolen to enable API gw to call my lambda authorizer or to link the apiRole directly to the HTTP authorizer ?Thank you!!FollowComment"

Answer: "0Accepted AnswerI figured it out using this link :https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-lambda-authorizer.htmlI need to create a permission for lambda authorizer and construct the source ARN manually :sourceArn : source-arn "arn:aws:execute-api:region:accountId:api-id/authorizers/authorizer-id"sourceArn: `arn:aws:execute-api:${Aws.REGION}:${Aws.ACCOUNT_ID}:${myapi.apiId}/authorizers/${myhttpAuthorizer.authorizerId}`,CommentShareJessanswered a year ago"


Question: AWS certificate manager certificate renewal

"The certificate renewal process was unsuccessful due to Cloudflare configuration for our domain(Cloudflare just blocked Let's Encrypt validation requests). Approximately 7 hours ago we updated the Cloudflare configuration and it shouldn't block Let's Encrypt anymore, but we still didn't receive any requests from them, and our SSL certificate is still pending validation. Unfortunately for us, this certificate expires today, and we don't have a lot of time for that. I've tried requesting a new one, but it was also unsuccessful(certificate validation failed), and importing the Cloudflare origin certificate also was unsuccessful(import failed). I can't find any logs to debug that, and can't force Cert Manager to try to validate us one more time. Please help us.FollowComment"

Answer: "01.To renew an imported certificate, you can obtain a new certificate from your certificate issuer and then manually re-import it into ACM. This action preserves the certificate's association and its Amazon Resource name (ARN). Alternatively, you can import a completely new certificate. Multiple certificates with the same domain name can be imported, but they must be imported one at a time2. You can use an imported certificate with any AWS service that is integrated with ACM. The certificates that you import work the same as those provided by ACM, with one important exception: ACM does not provide managed renewal for imported certificates. 3. Make sure you configured your 3rd party (CloudFlare) settings appropriately.  Reference links:https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.htmlhttps://docs.aws.amazon.com/acm/latest/userguide/acm-services.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/certificate-fails-to-auto-renew/CommentShareEllie_Banswered 10 months ago"


Question: "Clicking Add rule with the rule builder for a Web ACL in AWS WAF does nothing (no errors), the browser console shows WAFLimitsExceededException, we have no other WAFs"

"I've created my first WAF/Web ACL for a Cloudfront distribution, I'm trying to block some links by query string matches. When I click Add rule, there are no errors thrown, nothing happens. Checking the browser console shows:WAFLimitsExceededException: AWS WAF couldn’t perform the operation because you exceeded your resource limit.We have no other WAFs, and only one Web ACL I've just created and want to add a single Rule on.FollowComment"

Answer: "0There are multiple things that can cause this, the error you are facing is not only limited with having only one WAF WebACL. For more details with the quotas specifically for WAFv2 - https://docs.aws.amazon.com/waf/latest/developerguide/limits.htmlCommentShareTimothy_Manswered a year agowilliama a year agoI went through that list already, we have only 1 WAF WebACL, 0 Rule groups, 0 Ip sets, our requests per second is well below the limit, no custom request headers, no custom response headers, no custom response bodies, no log streams setup for the WebACL. Other errors show, eg. if I fail to fill in a field or configure it incorrectly, but just setting up a query string match rule, shows no error at all, and nothing happens when I click Add rule. When I open the browser console, I see the error I've mentioned about WAFLimitsExceeded. The UI displays nothing.Share0Can you confirm that you are using WAFv2 and not Classic WAF? Classic WAF has lower limits compare to WAFv2.Classic WAF quotas - https://docs.aws.amazon.com/waf/latest/developerguide/limits.htmlWill you be able to share the raw request body from the browser console when you see the error? (e.g. HTTP Archive (HAR) file) Please remove any sensitive information from it. Next, this can be correlated with Cloudtrail as well, I assume you are using WAFv2 so it should appear in "UpdateWebACL" API Call.Finally, I do recommend creating a support case for this. Looking forward for your response.CommentShareTimothy_Manswered a year agowilliama a year agoIt is v2, not the classic WAF, after experimenting a little I found the issue was that the length of the string I was using in the filter, when I increased the size, I was still not seeing an error in the UI but I saw it in the network response that I had exceeded the character limit. There seems to be a gap between the lengths where it shows the correct error or the generic limits exceeded error.Share"


Question: IOT MQTT Message cost/billing appears larger than expected. Per character maybe?

"I deployed a prototype AWS FreeRTOS device in the field last week and my message count appears way out. By my count I received nearly 5000 messages over mqtt.But according to my first bill that was 230,000 messages costing 23c - AWS IoT USW2-Messages.Am I doing something wrong? Is the cost really per character maybe? My average message length is about 50.Thanks in advance.FollowComment"

Answer: "0Accepted AnswerHi. Messages are metered in 5KB increments.By my count I received nearly 5000 messages over mqtt.Messages are metered in both directions, although PUBACKs are only metered when they are device to service. Details on metered messages here: https://aws.amazon.com/iot-core/pricing/additional-details/#MQTT_Message_MeteringDo you use other features, like shadows, that you perhaps aren't counting in the 5000?You can use tools like Protocol Metrics in CloudWatch to see more about the message activity. More information here:https://docs.aws.amazon.com/iot/latest/developerguide/monitoring_overview.htmlhttps://docs.aws.amazon.com/iot/latest/developerguide/metrics_dimensions.htmlCommentShareEXPERTGreg_Banswered a year ago0Thanks for the link. I found this there "MQTT PUBLISH (received from device)Metered on the size of the payload and topic in bytes"Marked as Solved.CommentSharexrstokesanswered a year ago"


Question: Amazon Linux Routing Challenge

"Hi Everyone, I have not worked with AWS for some time so pls bear with me.I have the following topology:VPC 10.10.0.0/16Public subnet 10.10.0.0/24 containing an Amazon Linux instance (call it the 'Firewall') with a single NIC, IP addr = 10.10.0.150 and EIP = 3.45.120.240 (fictitious)Private subnet 10.10.1.0/24 with Windows RDS (10.10.1.10) and Windows AD DS (10.10.1.5)Route table applied to the public subnet routes 0.0.0.0/0 to IGW and 10.10.0.0/16 to localRoute table applied to the private subnet routes 0.0.0.0/0 to the firewall NIC and 10.10.0.0/16 to localKernel routing is enabled (ip_forward=1) and the filter table chains (input/forward/output) are configured to ACCEPTI use iptables on the firewall to DNAT inbound 3.45.120.240:3388 to 10.10.1.10:3389 and masquerade (SNAT) outboundBasically, any instance in the private subnet routes in/out via the firewall with public IP address 3.45.120.240. I note private instances have a default gateway of 10.10.1.1. I assume this is an IP bound to the VPC?I recently built a new firewall using Amazon Linux with the same config as the current (old) firewall, except private IP = 10.10.0.254 and EIP = 45.67.3.43 (fictitious). I want to replace this new with the old.My issue: when I update the target for route 0.0.0.0/0 to the NIC of the new firewall, I do not see any traffic routing thru it (I am connected via SSH running tcpdump). If I start a repeating PING from Windows RDS to 1.1.1.1 and run tcpdump on the old firewall, I can see the ICMP flow, but when I flip the target for 0/0 route to the new firewall I see no packet flow. Both the old and new firewall have a default route 0.0.0.0/0 to 10.10.0.1. I assume this is the VPC router?Packets from the private subnet do not appear to be reaching the new firewall and I do not know why. How do I troubleshoot further - is there a way to examine packet flow within the VPC? Thank you.FollowComment"

Answer: "1Accepted AnswerYou don't mention this but just in case: Make sure that the source/destination check for your firewall instance is disabled as per our documentation for NAT instances.Second: You can see where packets are being routed in a VPC by using VPC Flow Logs.Third: VPC is an overlay network so doesn't necessarily behave quite the way that an on-premises network will. A good thing to watch here is Another Day Another Billions Flows but because that takes time - one of the things that happens in a VPC is that the flow path is cached so when you change routes you may not see the packets flow along that "new" route immediately. You might try stopping the existing ping or try sending ICMP echo requests to another destination.CommentShareEXPERTBrettski-AWSanswered a year ago0Thank you for the response. The NAT instances link is helpful. On the old FW I have src/dst check stopped, however, on the new FW it is not stopped (like I said, it's been a while!). I will stop the src/dst check and try tomorrow morning AEST as I have a handful of users now logged on. Thanks again! :-)CommentShareBiscuitTinanswered a year ago0For testing purposes I added a new route for my public home IP address with target of the new firewall and deployed a new Windows instance. It is working! Happy days.CommentShareBiscuitTinanswered a year ago"


Question: How to restrict database users for RDS Postgres using AWS Managed AD trusted with customer on-prem AD

A customer would like to restrict db access to their RDS Postgres instances to only specific AD users. Postgres authentication flow is Postgres RDS -> Managed AD -> on-prem AD.  Is there a way using either AD domain groups or other method to grant only specific users to RDS instances?FollowComment

Answer: "0Accepted AnswerRDS Postgres can be configured to connect to an AWS Managed Active Directory for user authentication. The AWS Managed Active Directory can then be connected to an on-premises AD through a forest trust.This will allow you to authenticate users from either directory.The following two links explains how to set this up.https://aws.amazon.com/about-aws/whats-new/2019/10/amazon-rds-for-postgresql-supports-user-authentication-with-kerberos-and-microsoft-active-directory/https://docs.aws.amazon.com/quickstart/latest/active-directory-ds/scenario-2.htmlThis step is the bulk of the work:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/postgresql-kerberos-setting-up.htmlThe way RDS Postgres manages users is that a local Postgres database user will still need to be created to match the AD account for every user that needs access. I don't believe its possible to do this for an AD group and have all users in the group just workTherefore, just because the RDS instance is using kerberos to AD, it doesn't automatically give users access.You will need to run PSQL commands like these:CREATE USER "username@CORP.EXAMPLE.COM" WITH LOGIN;GRANT rds_ad TO "username@CORP.EXAMPLE.COM";Note that the capitalization of the domain is essential. It must be in CAPITALS.The username is also case sensitive and must match the username in AD (windows ignores the case so you might not be aware of any capitalization in user names)CommentShareWarren_Panswered 3 years ago"


Question: cloud native services

"Hello!I'm a newbie here so I'm learning aws services while categorising themI understand the definition of cloud native services; microservices, using containers...but I'm having a hard time to tell apart whether it's cloud native or cloud enabledFor example, is EC2 cloud-native? is AWS Elastic Beanstalk cloud-native?There are 170+ services and I need help!!!Thanks in advance!FollowComment"

Answer: "0The best way tolook at it is to compare with what you would do on-prem.  Sure some services (e.g. serverless ones like Lambda) wouldn't have a role on-prem soyou can think of the as cloud native.  With other services though it depends how you use them.  If you just did a plain lift-and-shift of a 3-tier web application from on-prem to cloud with all tiers running in EC2 then no, that's not cloud native.  However if you used RDS for your DB, made your other tiers use EC2 Autoscaling with immutable instances, and leveraged AWS services for session store, authentication etc. in ways that aren't possible on-prem, and that leverage the flexibility and elasticity of Cloud then yes that's cloud native.CommentShareEXPERTskinsmananswered 4 months ago"


Question: Content Localization workflow fails at the end of translation

"Hello everybody,we've successfully deployed the Content Localization service with the CloudFormation template. When we upload a video in the Content Localization Web App, the following error is raised:{  "error": "ValueError",  "cause": {    "errorMessage": "Exception: 'Stage Translate encountered and error during execution, aborting the workflow'",    "errorType": "ValueError",    "stackTrace": [      "  File \"/var/task/app.py\", line 315, in complete_stage_execution_lambda\n    return complete_stage_execution(\"lambda\", event[\"Name\"], event[\"Status\"], event[\"Outputs\"], event[\"WorkflowExecutionId\"])\n",      "  File \"/var/task/app.py\", line 460, in complete_stage_execution\n    raise ValueError(\n"    ]  }}The error is raised at the end of the translation. GraphInspector shows the stage "Complete Stage Translate" in red color. CloudWatch logs show the same error and don't provide additional info. The marked comments in the code shortly before the ValueError is raised indicate that might be a known issue (lines 437-460 in /var/task/app.py):########### SEE THIS COMMENT:         # Start the next stage for execution        # FIXME - try always completing stage        # status == awsmie.STAGE_STATUS_COMPLETE:############ KNOWN ISSUE?        workflow_execution = start_next_stage_execution(            "Workflow", stage_name, workflow_execution)        if status == awsmie.STAGE_STATUS_ERROR:            raise Exception("Stage {} encountered and error during execution, aborting the workflow".format(stage_name))    except Exception as e:        logger.info("Exception {}".format(e))        # Need a try/catch here? Try to save the status        execution_table.put_item(Item=workflow_execution)        update_workflow_execution_status(workflow_execution["Id"], awsmie.WORKFLOW_STATUS_ERROR, "Exception while rolling up stage status {}".format(e))        logger.info("Exception {}".format(e))                raise ValueError(            "Exception: '%s'" % e)Do you have any idea on how to solve this issue?Thank you very much in advance!Best regardsFollowComment"


Question: Lifetime of tasks created by StartSpeechSynthesisTask

"I just began testing with the StartSpeechSynthesisTask api, and I noticed that every task I started is displayed in the list returned by ListSpeechSynthesisTasks.Am I supposed to delete the tasks when they are no longer needed, and if so how?  I am deleting the audio files written to S3, but I don't know how to manage the tasks.Thanks!FollowComment"

Answer: "0Hi James,Thank you for reaching out. You do not have to delete any request after they are processed, since this is expected API behaviour. ListSpeechSynthesisTasks api returns all requests if status is not set through call. You can set Status=inProgress or Status=scheduled in order to see the ones not processed yet. Optionally you can set MaxResults which will be listing most recent requests.You can see more details related to this api here: https://docs.aws.amazon.com/polly/latest/dg/API_ListSpeechSynthesisTasks.htmlThanks,FatihCommentShareAWS-User-7152847answered 3 years ago0Thanks for the help FatihCommentShareJames P. Brettianswered 3 years ago"


Question: What are the changes in AWS Aurora MySQL database engine 2.04.0?

There is currently no docs for the changes in Aurora MySQL database engine as listed on in the  https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Updates.20Updates.html .I accidentally selected this DB engine and only found out once my param groups no longer work for it. Was curious what has changed since the last release.FollowComment

Answer: "0I am interested too. With all this compliance certifications, how can a release reach production without proper documentation?CommentSharepgtaboadaanswered 4 years ago0Just a FYI, Amazon updated the docs in my original post at some point. They added 2.04 and 2.04.1 on the 25th of March. A full 2 weeks after my original post.A little disappointed with what Amazon have done with that but I am happy that it now is resolved. That is assuming 2.04.2 or 2.05 aren't released currently.CommentSharebradvmjanswered 4 years ago"


Question: Get Thing ID (ARN) in Lambda IoT MQTT handle

"Can a Lambda action get the Thing ID (its ARN, or some way to uniquely identify it)?  Is the answer different if you do or don't use basic ingestion?I searched the forum before I asked this, one clue I found was this:https://repost.aws/questions/QUT4KAUvqKQOS0v2Abgpxt-g/aws-io-t-thing-connected-event-find-the-thing-name-from-eventwhich suggest I can change the role to include:        "Resource": [          "arn:aws:iot:us-east-1:123456789012:client/${iot:Connection.Thing.ThingName}"        ]if I get the idea behind that, I could force devices to set their MQTT client id to be the same as their ThingName, and to use that I would include clientId() in the SELECT.Is that the simplest way?--CFollowComment"

Answer: 0Accepted AnswerI re-read the previous posts that were similar and I think that's the best way ... so I'm going to close this.CommentSharewz2banswered 7 months ago


Question: DMS: From on-premise to RDS + NAT Gateway - Best Practices

"Hi,I've started this journey with AWS and hope someone can shed some light regarding proper configuration.I'd like to use DMS to sync db from On-premise to newly setup AWS RDS db (running within VPC#1)To connect to the on-premise db I originally created NAT gateway (running within VPC#2) as the db is firewalled and needs static IP to gain access.I've quickly realized the DMS needs single instance that works with both endpoints - that's where my issue is.What are my options for this?-Do I create new NAT gateway within VPC#1?-Do I use Peering connection between VPCs?What are the best practices for setting something like that.FollowComment"

Answer: 1Accepted Answeri would suggest creating replication instance in same vpc as db but in public subnet so that you can still connect to rds and also onprem having public ip address which can be white-listed to gain access.CommentShareAWS-User-8174525-subhashanswered a year ago


Question: Getting access denied error for SFTP user

"I am getting access denied for user when WINSCP tries to list the directory structure, "Error listing directory '/.'"I have the following policy for user{"Version": "2012-10-17","Statement": [{"Sid": "AllowListingOfUserFolder","Action": ["s3:ListBucket","s3:GetBucketLocation"],"Effect": "Allow","Resource": ["arn:aws:s3:::BUCKET234"]},{"Sid": "HomeDirObjectAccess","Effect": "Allow","Action": ["s3:PutObject","s3:GetObject","s3:DeleteObjectVersion","s3:DeleteObject","s3:GetObjectVersion"],"Resource": "arn:aws:s3:::BUCKET234/*"}]}This is the trust relationship{"Version": "2012-10-17","Statement": [{"Sid": "","Effect": "Allow","Principal": {"Service": "transfer.amazonaws.com"},"Action": "sts:AssumeRole"}]}There is no scope down policy, what am i missing ?FollowComment"

Answer: "0Hello avijaws,Based on the error provided it looks like WinSCP is trying to list root "/" and it is failing. If you are not using the restricted option (logical directories) for your User and you try to list the root "/" the operation will give an Access Denied if you do not have permissions to list all the buckets (s3:ListAllMyBuckets).On WinSCP under Advanced Site Settings of your Session -> Environment -> Directories you can Uncheck the option "Remember last used directory" and also clear the "Remote directory" field so it wont connect to "/".Another option is to use logical directories or the Restricted option if you are using the AWS Transfer Console. Find your User, edit the configuration, select the bucket and optionally the home directory and click the restricted option. By doing that the user will be restricted (chroot) to his home folder and when WinSCP tries to list the root "/" the content of the home directory will be listed since the root will be mapped to the /bucket/folder.I hope the above information is helpful. Please feel free to write back if you still have issues.Kind regards,PanagiotisCommentShareAWS-User-0349305answered 2 years ago"


Question: How to correctly grant roles with redshift serverless?

Using AWS documentation for granting roles on Redshift Serverless (https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-monitoring.html) - it says I should run this command to grant a role:grant "sys:operator" to "IAM:<correct IAM user name here>";This command always results in this error.ERROR: syntax error at or near ""sys:monitor"" Position: 7 [ErrorId: 1-6372a5f7-38f7a17f6443bdfc4f6b348f]What am I missing? Is the documentation incorrect?FollowComment

Answer: "0Accepted AnswerYes, the documentation needs to be updated.Please use this command:grant role "sys:operator" to "IAM:<correct IAM user name here>";I'll request that the page is updated.CommentShareDon_Danswered 7 months agoEXPERTAWS-User-Nitinreviewed 7 months agotjtoll 7 months agoAppreciate it!Share"


Question: EIP locked to your account

"I have EIP 54.229.118.186 which I wish to release. I can't, I assume that's because it has reverse DNS set. I don't have a support contract.Can someone give me a clue who I should contact?EDIT: I saw this form to set rDNS on an EIP - https://console.aws.amazon.com/support/contacts?#/rdns-limits. I didn't find a form to remove rDNS from an EIP.Edited by: StephenDayX on Nov 2, 2020 4:49 AMFollowComment"

Answer: 0Seems this happens a lot.Short version - fill in the form at  https://console.aws.amazon.com/support/contacts?#/rdns-limits.  Add comment "please remove rDNS"CommentShareStephenDayXanswered 3 years ago


Question: Lightsail's Singapore server cannot connect

"Xshell cannot be linked due to system damage. There are important data in it. How to deal with itThe status check failure in the indicator chart is displayed as 1FollowCommentAlex a year agoHello, can you please provide some more information? How are you trying to connect to your server? Are you using SSH or some other protocol?Share"


Question: Delta between connection status events for LoRaWAN gateways and status from console (LoRaWAN specific details)

"Hello,We use connection status events for LoRaWAN gateways to store the state and display the connectivity gateway status in our application.We observe that the last stored connection status differs from the console (LoRaWAN specific details).Do these two tools correspond to the same "functionality"?Has the problem already been reported to you?Best regardsFollowComment"

Answer: "0They are supposed to come from the same source. But if you see some event notification being dropped. We can look into it. We will use some internal hardware to test it now. You can also contact our customer support and give the gateway ID so that we can search the logs with a narrower query.CommentShareAWS-User-Russanswered 4 months agoSteve 4 months agoDid you test it ? Have you some results to share ?Share0The status on the console (LoRaWAN specific details) should be same as the status you receive from the status events.When you mention that the console status differs, do you see different status from the events even after refreshing the window ?I tested by powering off my gateway and i got event status "Disconnected" and the console page remains "connected" until i refresh the browser. Is that the same issue ?Ideally these two functionalities are same.CommentSharesunriseanswered 5 months ago0Even if I refresh the window, I still see this desynchronization (between LoRaWan specific details and event notifications).From the console (LoRaWan specific details) the information is still valid, the problem comes from the events status (AWS IOT>Settings>LoRaWAN and Sidewalk event notifications), I don't know if we lost some notifications or if these notifications are not sent.CommentShareSteveanswered 5 months ago"