Question: "Configured VPC NAT instances stopped working yesterday (03.03.2022, eu-central-1)"

"Hi,I'm confronted with a really annoying problem currently. My custom VPC (3 public subnets, 3 private subnets -> internet access through NAT instances) broke out of the blue yesterday.My infrastructure is deployed via CloudFormation and yesterday I updated a stack where three NAT instances for my VPC are located (for each public subnet there is one NAT instance deployed in it). They have worked flawlessly before yesterday and as a new Amazon Linux 2 version was released (I reference the AMI ID via /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-arm64-gp2), these instances got updated to use the newest AMI. Since then I have problems routing traffic from private subnets to the internet as things are not working as expected anymore.The current primary point of failure is that my CodePipeline fails because a CodeBuild action fails. The temporary CodeBuild instance is deployed in one of the three private subnets and then has to download a CodePipeline artifact from S3 through the internet. This step fails with the following error:CLIENT_ERROR: RequestError: send request failed caused by: Get "https://s3.eu-central-1.amazonaws.com/<S3-bucket-name>?location=": dial tcp 52.219.170.173:443: connect: no route to host for primary source and source version arn:aws:s3:::<S3-prefix>The thing is: before yesterday's last stack update which altered the NAT instances, everything was working as expected and CodePipeline succeeded. CodeBuild was able to download the necessary artifacts from S3 and the VPC and NAT instances were set up correctly. Then the update came in and CodeBuild fails now.The only thing that was changed was the AMI ID for the NAT instances (and I replaced absolute strings for "ProjectName" in my CodeBuild actions in CodePipeline with !Ref to the AWS::CodeBuild::Project resources which should have nothing to do with my current problem). After the updated NAT instances were not working anymore, I set their AMI IDs to explicit older versions as I assumed that there is a problem with the newest Amazon Linux 2 version. However, even with the older AMIs I'm not able to get the NAT instances working again (at least not for CodeBuild, but I noticed that ECS services running on an EC2 instance (which is also deployed in a private subnet) lost connection to the internet as well). I even redeployed the whole infrastructure to check if there is a problem on the side of AWS but the problem persists.The problem got me really frustrated now as everything was working fine. Then a small update was applied and now the NAT instances fail even if I havn't changed anything in the VPC and NAT configuration. Where should the problem be now if not on the side of AWS? My currently deployed NAT instances are configured as described by AWS and as they have worked before, they are reachable via SSH and can access the internet via the VPCs internet gateway. Still, CodeBuild continues to fail with the mentioned error and the internet seems not to be accessible from private subnets as it was the case before yesterday.I would be more than glad if anyone has suggestions how this problem can be resolved now.Thanks in advance!FollowComment"

Answer: "0Accepted AnswerUpdate: I redeployed the NAT instances AGAIN (complete deletion and new launch) without any user data and did the NAT configuration manually AGAIN exactly as shown in the AWS guide for setting up NAT instances. The "Validate VPC settings" run in CodeBuild still produces errors as well as I can't reach the VPC internet gateway from a test instance inside one of the three private subnets via Reachability Analyzer.HOWEVER: I retried executing CodePipeline again and CodeBuild is able to access the necessary artifacts through the internet again. I have no idea why it is suddenly working again as I have no idea why it didn't work in the first place. You have to trust me here that I really changed no NAT configurations, they worked before yesterday and then they didn't work anymore after an AMI update which wasn't the cause of the problem. Now I configured the NAT instances manually once again and suddenly CodeBuild has access to the internet again.Of course I am happy that it works again now but it still leaves a bad taste as I still have no idea what exactly the reason was for these issues. Given that there is paid a good amount of money for my infrastructure it makes me wonder how stable this VPC environment really is. Sure, I use NAT instances instead of NAT gateways but it would be like trying to crack a walnut with a sledgehammer as I only need a fraction of the resources that a NAT gateway provides. I read comments since years that these NAT gateways are too expensive for simple tasks and this situation still hasn't changed so I am forced to use NAT instances, which seem to work until they don't. Or there was something inherently off in AWS'es VPC service itself (at least for eu-central-1), who knows...Edit: I'm going to set the instance's user data to the exact configuration again as provided in the AWS guide. The adjusted commands have worked, too, and made the configuration persistent so that it would survive a reboot but I'm going to better stay on the safe side now.CommentShareCzyzeanswered a year ago0I added some information in the comments, as far as I can see it, it is not a problem related to the Amazon Linux 2 AMI as I (as mentioned in the question) tested older Amazon Linux 2 AMIs as well and the problem remains. The VPC and NAT configurations shouldn't generate any issues as they have worked before.As there was a VPC service incident in eu-central-1 yesterday, might it be possible that something is still off with the VPC service, causing routing issues even if everything is configured as it should be?CommentShareCzyzeanswered a year agoMatt-B EXPERTa year agoAre you able to reach the NAT instance from the EC2 instance in the private subnet?ShareCzyze a year agoAs I redeployed the whole infrastructure I'm stuck in the CodePipeline building stage right now where I only test with CodeBuild's temporary instance if it is working. In CodeBuild's "Edit Environment" menu I can "Validate VPC settings" and it fails with the standard error which I had some time ago when setting up the VPC for the first time:"The VPC with ID vpc-xxxx might not have an internet connection because CodeBuild cannot find the 0.0.0.0/0 destination for the target NAT gateway with subnet ID subnet-xxxx. Verify your VPC has an internet connection through the device with ID i-xxxx."ShareCzyze a year agoI could try and set up an instance in one of the private subnets but then I also need to set up SSH access and probably ICMP for it (right now I only have TCP (HTTP and HTTPS) enabled as inbound traffic to the NAT instances from within the VPC (as recommended in the AWS guide)). Do you think it is helpful to set up a test instance to maybe gain additional info?ShareCzyze a year agoAll in all it is a bit suspicious that "CodeBuild cannot find the 0.0.0.0/0 destination for the target NAT gateway" even though the routes should be configured correctly and have worked until yesterday.ShareMatt-B EXPERTa year agoYes i think it would be helpful to quickly spin up an EC2 instance in the same private subnet where codepipeline's temporary instance is.  Then you can test connectivity to your NAT instance over ICMP then to the internet.Since your test instance will be in the private subnet, you will need to also setup a Bastion in the public subnet to get to it.  See https://aws-quickstart.github.io/quickstart-linux-bastion/#_launch_the_quick_startOR setup SSM Session Manager which doesnt use SSH.  See https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started.htmlAnother option is to use the Reachability Analyzerhttps://docs.aws.amazon.com/vpc/latest/reachability/what-is-reachability-analyzer.htmlShareShow 4 more comments0WHen you change the AMI in Cloudformation, the instance is replaced.If you are using a regular Amazon Linux AMI (not NAT specific), did you set up the instance after it was launched or do you have the commands embedded in Cloudformation somewhere?sudo sysctl -w net.ipv4.ip_forward=1sudo /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADEsudo yum install iptables-servicessudo service iptables saveIs it possible the source/destination check flag was reset on the NAT instance?https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheckAlso double-check the route tables for the private subnets and be sure the 0.0.0.0/0 route is pointing to the NIC of the NAT instance and not labeled as "Blackholed"As a side note, If you use an existing NAT AMI, AWS recommends that you migrate to a NAT gateway. NAT gateways provide better availability, higher bandwidth, and requires less administrative effort. If NAT instances are a better match for your use case, you can create your own NAT AMI. For more information, see Compare NAT gateways and NAT instances.CommentShareEXPERTMatt-Banswered a year agoCzyze a year agoHi mthwbarb, thanks for your quick answer!I disable source/destination check in the template, so it is always turned off for the instances.I have 3 custom route tables, one for each private subnet. They have the default entry plus a custom route:Destination                      Target0.0.0.0/0                          <NAT instance ID> (which gets resolved to the corresponding network interface of the instance: eni-xxxxxxxxxxxxxxxxx)I understand that NAT gateways might be the easier and better solution but they are too expensive for my use case.ShareCzyze a year agoAbout the Amazon Linux 2 configuration, it is configured with user data in the template, e.g.:#!/bin/bashsudo bash -c 'echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf'sudo sysctl -psudo yum -y updatesudo yum install -y iptables-servicessudo systemctl enable iptablessudo systemctl start iptablessudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADEsudo service iptables savesudo yum install -y aws-cfn-bootstrapsudo /opt/aws/bin/cfn-signal -e 0 --region ${AWS::Region} --stack ${AWS::StackName} --resource NatInstance1ShareCzyze a year agoThe configuration is slightly different than described in the AWS guide to make the settings persistent between potential reboots. I changed "sudo sysctl -w net.ipv4.ip_forward=1" as shown above, some days before I was still using "sudo sysctl -w net.ipv4.ip_forward=1" and all other commands, only "sudo bash -c 'echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf'" and "sudo sysctl -p" was exchanged. Everything worked fine, now it is not working even when trying the exact configuration from the guide.Share"


Question: AWS EKS completly ignores 'topologySpreadConstraints'

"Hey there,When using AWS EKS 1.21, currently 1 node running, (incl. cluster-autoscaler with correctly functioning asg)  and creating a deployment with 5 replicas and specifying 'topologySpreadConstraints' like this:      topologySpreadConstraints:        - maxSkew: 1          topologyKey: kubernetes.io/hostname          whenUnsatisfiable: DoNotSchedule          labelSelector:            matchLabels:              app: xxxthe scheduler ignores this completly and schedules all pods on the same node. (even though there is the 'DoNotSchedule')How can this be fixed? I want the cluster-autoscaler to see, that 2 nodes can not be scheduled.Thanks in advance.FollowComment"

Answer: "0Accepted AnswerIt is Kubernetes scheduler, not EKS, that schedules the pod.That said, because you only had one node in one zone, the scheduler did not violate your constraints.The skew is always 0. Please refer here as to how the skew is calculated.Cluster Autoscaler does not consider this constraint when making scaling decisions.You might want to consider increase the minimal and desired instance in your ASG.CommentShareJason_Sanswered a year agoTheMrone a year agoThank you. Is there a way to do this without having minimal / desired capacity set?Share"


Question: Advice on setting up a platform to host PHP app + MySQL databases + subdomains

"Hello,I need advice on setting up the infrasture for a SaaS system we are building. Our system is as follows;For one instance (on a high-level is this).Website for users to login and view data that has records stored in a database + any files they upload (such as PDFs etc..). The website is based on PHP backend.Then there is a MySQL databse to host the records.Then we'd be replicating this for any client who decides to buy our service (so a new instance under foo1.domain.com gets created). The setup is similar to what wordpress.com offers for the users.I'd like to utilize AWS services for it and what is the best place to get started? Any advice? I'd also like to have a way to keep track of the child instances (either in one EC2 instance) remotely to view their usage and disable any which haven't been used.FollowComment"

Answer: 0AWS SaaS Boost may be a good fit for your use case. It's open source and free to use (you'll be billed for the AWS services you consume). Check it out on GitHub https://github.com/awslabs/aws-saas-boost and see the getting started guide as well as recordings of the "office hours" from Twitch https://github.com/awslabs/aws-saas-boost/discussions/106.CommentShareAWS-User-3855171answered a year ago


Question: AWS Lambda: You do not have sufficient permission. Access denied

"We are currently getting this error on the AWS Lambda page: You do not have sufficient permission. Access denied.This started when AWS opened a case 10 hours ago and which is yet to be fixed. Also, some of the lambda services are down and just throwing internal server errors.The  AWS Support team is not helping at all as this has been going on for 10 hours with no valid solution and they keep on waiting for their internal response team. Our core business system is down and cant do anything because we don't have access to Lambda. Whats the faster way to fix this.FollowCommentcarlo-mencarelli a year agoDo you have CloudTrail enabled? If so you may be able to see the actual API request being made in the backend that is getting denied.Besides that, is it any part of Lambda or a particular page such as a specific Lambda's settings, the functions page, or something similar?SharerePost-User-6918125 8 months agoI'm currently facing this same issue with my account. AWS lambda has been inaccessible for the past two days now. I urgently need helpShare"

Answer: "1Hi there,I'm terribly sorry to hear about the frustration here. I've located your cases internally and see that one has been resolved. If you require additional assistance on this topic, please do reach out via your open case so our Support team can review further. Depending on the topic of concern, you can also reopen your resolved case, if needed.You can see our most recent update here: go.aws/support-center— Chrissy B.CommentShareEXPERTAWS Support - Chrissyanswered a year ago"


Question: Can AWS Glue handles complex transformation jobs like Talend. Can any one share their observations around AWS Glue vs any standard ETL

"Hiwe are evaluating the capabilities of AWS Glue vs Talend. Can anyone point me towards an article or list down points that we need to be aware of Glue will help us?One key requirement is moving data from S3 to Redshift by transforming it as per business usecase.ThanksSamFollowCommentAWS-User-3357040 a year agoI am still new to AWS Glue. I think you do have a lot of flexibility for transformations if you author your own job which is basically writing your own code.  However, for data warehousing solutions, it does not appear GLUE is not very useful for ELT type of transformations eg. update dimension table in Redshift.Share"

Answer: "2Starting from @amanbajw's answer that is well formed and comprehensive.A couple of additional snippet of information that could improve it, answering some specific aspect of the questions:Complex transformation: AWS Glue has multiple transform out of the box, for example aggregate transform, relationalize (to unnest complex json), SQL Transform that allows to code your complex transformation in SQL , Custom code transform that allows to code your complex transform in Python or Scala.Amazon S3 to Amazon Redshift: AWS Glue has a native connector to Amazon Redshift and allows to read and write data into Redshift natively, the Redshift connector has also pre and post actions that allows also to implement upsert based on Redshift best practices.ELT in Redshift with Glue: to run ELT in Redshift , best practices would be to use Glue Python Shell jobs to start the processing in Redshift using the native python library to connect to the DB or the Redshift Data API. An example can be seen in this blog post.hope it helpsCommentShareEXPERTFabrizio@AWSanswered a year agoCloudXL a year agoThat's excellent info, Fabrizio.Share1Hi Sam,Selecting the appropriate ETL tool depends on a lot of factors such as your organization's IT landscape, knowledge with specific tools, SME availability, target state, licensing costs/constraints, operational cost to support the solution (Talend or Glue) etc. I won't go into technical comparison between Talend and Glue but there're a few points around the solution which you may want to consider along with the ones I mentioned above...AWS Glue is serverless so you don't need to spend time & money on undifferentiated heavy-lifting (managing servers, patching, upgrades etc.)You can use Glue Crawler to catalog the data on S3 allowing you to leverage Redshift Spectrum to query the data residing in S3 instead of moving the data to Redshift. You'll need to determine the use case for the solution but you don't have to move all the data to Redshift from your data lake.AWS Glue is tightly integrated with other AWS services and if your organization is planning to migrate to AWS, factor in the integration costs. From experience, enterprises tend to spend a lot on integrating their tools & solutions and it is one of the key criteria in any tool/vendor solution. As an example if you're building a data lake on AWS as per modern data architecture, Glue is pre-integrated with Lake Formation, data catalog etc. and you can leverage the same identity & access controls (single pane of glass).In short, I encourage you to look at the business outcome and target state as part of your tool/technology/solution selection instead of a purely technical comparison.CommentShareamanbajwanswered a year ago0Thanks, Aman. We will be looking at multiple use cases with data at the enterprise level. When we use so many services from AWS for data analytics, we do want to find tools that can replace old tech to save time and money.  Hence, I wanted to gather info on what we can be achieved with glue. As AWS brings new features daily, I am expecting in no time glue will be defacto ETL for most transformation projects.CommentShareCloudXLanswered a year ago"


Question: IAM resources requires region and account id?

I tried simplifying my IAM policy https://github.com/kaihendry/terraform-aws-canary/blob/main/iam.tf#L39 from"arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/lambda/cwsyn-*"to"arn:aws:logs:::log-group:/aws/lambda/cwsyn-*"And now it doesn't work. Why?FollowComment

Answer: "0Accepted AnswerARN of CloudWatch Log Group requires region code and account id in the path. If you do not want to specify region code/account name in the path, you should try like below."arn:aws:logs:*:*:log-group:/aws/lambda/cwsyn-*"Paths can include a wildcard character, namely an asterisk (*). Please refer to below link.https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.htmlCommentShareEunsu_Shinanswered 6 months ago0Please refer to the details on the resources ARN : https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.htmlarn:partition:service:region:account-id:resource-id arn:partition:service:region:account-id:resource-type/resource-id arn:partition:service:region:account-id:resource-type:resource-idTo look up the ARN format for a specific AWS resource, open the Service Authorization Reference, open the page for the service, and navigate to the resource types table.Looks like for log group it isarn:${Partition}:logs:${Region}:${Account}:log-group:${LogGroupName}Note : You can specify IAM and AWS STS ARNs using the following syntax. The Region portion of the ARN is blank because IAM resources are global. Reference : https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.htmlarn:aws:iam::account:root  arn:aws:iam::account:user/user-name-with-patharn:aws:iam::account:group/group-name-with-patharn:aws:iam::account:role/role-name-with-patharn:aws:iam::account:policy/policy-name-with-patharn:aws:iam::account:instance-profile/instance-profile-name-with-patharn:aws:sts::account:federated-user/user-namearn:aws:sts::account:assumed-role/role-name/role-session-namearn:aws:iam::account:mfa/virtual-device-name-with-patharn:aws:iam::account:u2f/u2f-token-idarn:aws:iam::account:server-certificate/certificate-name-with-patharn:aws:iam::account:saml-provider/provider-namearn:aws:iam::account:oidc-provider/provider-nameCommentShareEXPERTAWS-User-Nitinanswered 6 months ago"


Question: Upvoting and Devoting

Will points awarded by Upvoting or Devoting be reversed when the voting is removed? Seems like with devoting it is not reversing.FollowComment

Answer: "0Accepted AnswerHello Munchbat_T,The upvoiting/downvoting point system is working as expected.  I've tested it to make sure. When you downvote either a question, answer or comment, both the person that performs the downvote, and the person that got the devote lose one point. You can refer to the table in **How does the points system work FAQ **in the help section located at the top right. Here is the direct link.If you have seen something different, please provide details and links to the questions and the users profiles involved.Thank you!MonicaCommentShareSUPPORT ENGINEERMonica_Lluisanswered a year agoMunkhbat_T SUPPORT ENGINEERa year agoThanks, it seems all reflected already now. Although it took some days.Share0Thank you for confirming.  The reflection should happen soon, though.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago"


Question: Amazon Connect Outbound campaign - The status sticks to Created

"I have created an Outbound Campaign but its status remains at "Created". Why?I try to do this procedure, but I can't. I'm guessing it has to do with the fact that this status seems to be stuck.https://aws.amazon.com/fr/blogs/contact-center/make-predictive-and-progressive-calls-using-amazon-connect-high-volume-outbound-communications/thanksFollowCommentAWS-User-3764216 7 months agoHey Luc,  When you run the Pinpoint Journey by pointing to the Campaign, then it will update the status to "Running".Share"

Answer: "0Hi Luc, when your pinpoint journey sends the call to Connect outbound campaigns the campaign will change to Running.CommentShareAWS-User-9371299answered 7 months ago"


Question: postgREST -- http API calls fail though other connections are working

"Hey guys!i'm evaluating RDS as a possible solution for a company database migration.  I've spun up a Postgres instance and successfully connected via psql , and my postgREST API server is successfully connected and listening on port 3000.I've read the security-group tutorial and have added inbound security rules to allow for connection to port 3000 from my IP (ditto for 5432).  However, when I try a postgREST call with curl to port 3000, the server does not respond and postgREST does not log the request.I've been fiddling with the security settings, etc, and reading the docs all afternoon but can't figure out where the configuration is wrong.  [I even tried temporarily allowing inbound to port 3000 from all traffic, but that didn't work either.  I tried routing the postgREST call to 5432, which at least got a server response, but that response iscurl: (52) Empty reply from serverI must be missing something critical.  Any and all help / insight will be much appreciated!Edited by: MisterOctober on Jul 22, 2019 8:48 AMEdited by: MisterOctober on Jul 22, 2019 8:48 AMFollowComment"

Answer: "0You did not really explain how/where you are running postgRESTi am guessing on EC2? in that case, make sure you are adding the rule to the SG of the EC2 instance, and not the RDS instanceCommentShareruslan-tanswered 4 years ago0Howdy Ruslan! Thanks for taking the time to look at my question.My test unit of postgREST associated with this RDS instance is running on a local machine; sorry for the lack of clarity.I've got another instance running great on DigitalOcean (postgres _ postgREST running on same VM), but clearly I'm doing something wrong with this RDS _ remote postgREST config.Edited by: MisterOctober on Jul 23, 2019 2:39 PMCommentShareMisterOctoberanswered 4 years ago0You are running postgrest locally so aws has nothing to do with it.You need to open the port 3000 on your local machine, not in rds.How are you testing, what is your exact curl line?It should be like curl http://localhost:3000/ ....CommentShareruslan-tanswered 4 years ago0Thanks for your help, Ruslan!  I ended up moving postgREST to an EC2 instance, but was having the same problem {plus some!}-- the fix ended up being :** to set the RDS instance port 5432 ingress rule source ID to _the security group, rather than the CIDR IP block, of the EC2 instance.**postgREST API calls are now working properly in all respects.  Bellissimo!p.s. special thanks also to Pooja @ AWS Support for the analysis and additional tipsEdited by: MisterOctober on Jul 30, 2019 3:10 PMedited for clarityEdited by: MisterOctober on Jul 30, 2019 4:06 PMCommentShareMisterOctoberanswered 4 years ago"


Question: Can't find App Runner SLA

What's the service level agreement for App Runner? How many 9s?Looked around but couldn't find it.https://aws.amazon.com/legal/service-level-agreements/?aws-sla-cards.sort-by=item.additionalFields.serviceNameLower&aws-sla-cards.sort-order=asc&awsf.tech-category-filter=*all&aws-sla-cards.q=app%2Brunner&aws-sla-cards.q_operator=ANDFollowComment

Answer: "1Accepted AnswerHello,App Runner does not currently offer SLA.CommentSharehayao-kanswered 3 months ago"


Question: DataPipelineDefaultResourceRole not appearing in EC2 Instance Role dropdown

"I'm trying to create a data pipeline to export Dynamodb data to S3, but after following the online guide to the letter, the DataPipelineDefaultResourceRole isn't in the dropdown referred to above, the DataPipelineDefaultRole is auto-populated. Can someone tell me what's wrong?FollowComment"

Answer: "0Hello,This issue can occur if the Instance Profile is not attached to your  DataPipelineDefaultResourceRole as the dropdown list includes instance profiles. Please check this link for more details https://aws.amazon.com/premiumsupport/knowledge-center/iam-role-not-in-list/If your DataPipelineDefaultResourceRole is already attached to the instance profile and you still see the issue, please open a support ticket with our datapipeline team and we will assist you.CommentShareSUPPORT ENGINEERVishali_Nanswered a year agoJeffdVery a year agoThanks for your response, the DataPipelineDefaultResourceRole is now attached, however the data pipeline still isn't completing, I'm getting 'An EC2 ClientInternalError has occurred' - Should I raise a ticket for this or can you offer any advice as to what could cause this? If I need to raise a ticket how exactly do I do this as I'm new to the company I'm working for and AWS so have not raised a ticket before?Share"


Question: AWS Step Function Output for container services

When using Step Functions with a container service like EKS or ECS how does output work for those steps? From the below two linked questions it seems as if input is done by either passing the input to the command override or by passing it as an environment variable. How do these jobs return output to be consumed by the following step?Input questions:https://repost.aws/questions/QUQqIMl4s6QFKWtGeABPhgVA/step-functions-pass-input-into-fargate-instancehttps://repost.aws/questions/QUCWMj_HPIQi6nmpUrbS3UTQ/step-functions-lambda-and-ecsEDITAccording to this blog there isn't a way to output from ECS or Fargate tasks. So the outputs need to be deterministic based on the previous inputs. Can anyone confirm this and does this go for EKS as well?https://nuvalence.io/blog/aws-step-function-integration-with-ecs-or-fargate-tasks-data-in-and-outFollowComment

Answer: "1Accepted AnswerHello,The answer in that re:Post post has great advice on using .waitForTaskToken for being able to have a more dynamic output from ECS/Fargate and is accurate : https://docs.aws.amazon.com/step-functions/latest/dg/connect-ecs.htmlI managed to test using a.waitForTaskToken by following the instructions here: https://docs.aws.amazon.com/step-functions/latest/dg/callback-task-sample-sqs.htmlThe way the example works (based on the instructions and I confirmed on my end):Step Functions passes a message that includes a task token to an Amazon Simple Queue Service (Amazon SQS) queue.Step Functions then pauses, waiting for that token to be returned.The Amazon SQS queue triggers an AWS Lambda function that calls SendTaskSuccess with that same task token. Below is the code showing how this can be done using a Lambda function:console.log('Loading function');const aws = require('aws-sdk');exports.lambda_handler = (event, context, callback) => {    const stepfunctions = new aws.StepFunctions();    for (const record of event.Records) {        const messageBody = JSON.parse(record.body);        const taskToken = messageBody.TaskToken;        const params = {            output: "\"Callback task completed successfully.\"",            taskToken: taskToken        };        console.log(`Calling Step Functions to complete callback task with params ${JSON.stringify(params)}`);        stepfunctions.sendTaskSuccess(params, (err, data) => {            if (err) {                console.error(err.message);                callback(err.message);                return;            }            console.log(data);            callback(null);        });    }};When the task token is received, the workflow continues.The "Notify Success" task publishes an Amazon Simple Notification Service (Amazon SNS) message that the callback was received.So we can apply this to ECS/Fargate now based on the understanding above since Step Function services ECS/Fargate integration support Task Tokens:Step Functions invokes ECS/Fargate with a task tokenStep function then pauses waiting for that token to be returned.ECS/Fargate sends back a SendTaskScucess with that same task token. You can use the code mentioned above as an example to scaffold a solution from. You can see from the code the following:        const params = {            output: "\"Callback task completed successfully.\"",            taskToken: taskToken        };where can modify “output” to have any type of message you’d like. They use \"Callback task completed successfully.\" but you can change this to be whatever you like such as a location of where data is stored in S3/DynamoDB/elsewhere.When the task token is received the workflow continues.From the blog post you linked where it says there isn’t a way to output from ECS or Fargate tasks and mention storing in S3, I believe they’re talking about writing data (let’s use a .jpeg image as an example). So following that blog post then, you can write your .jpeg image to S3, and then return in the “output” the location of where the .jpeg image was stored in S3 so that the next step in your Step Function knows the location and can continue to doing some processing by giving the location to another task in the step function.CommentShareSUPPORT ENGINEERTim_Panswered a year agoacrookes-fe a year agoThank you for the very thorough answer to this question. This really covers my question and have what I need to continue  with this.Cheers!Share"


Question: Cannot Provision Number in Chime

"When trying to provision a number, I receive the following error: Your service has been restricted. If you feel like you have received this message in error, please submit a support request in the upper right with the category “Voice Calling”.What is causing this issue? If it is because I am new to Chime, what is the expected turnaround time for this?FollowComment"

Answer: "0This generally happens on accounts with limited billing history (new accounts). It's simply a part of the fraud protection on PSTN calling. After you submit the request, unless there are other concerns with your account, it could take about 3 business days.CommentShareDougLanswered a year ago"


Question: AWS Prometheus SNAPSHOT to S3

"With AWS Prometheus, is it possible to create a SNAPSHOT and store to S3 bucket?https://prometheus.io/docs/prometheus/latest/querying/api/#snapshotFollowComment"


Question: Cognito user account problem.

User "sky.soo@amazipoint.com" was deleted automatically;User "ericjsh@ms68.hinet.net" did not receive Sign Up or Reset password verification code;Thank you for helping!FollowComment

Answer: 0Accepted AnswerEnable Cognito log to tracing its.CommentSharerePost-User-8737890answered a month ago


Question: "How do i "SET" and "REMOVE" using the same UpdateExpression when querying DynamoDB, while keeping the query safe of "SQL injections" [python/boto3]"

"[using python/boto3]I need help writing a (hopefully simple) DynamoDB query that accepts a mode_id input variable and a list of algorithm_indexes [ints],then go to that row in the DB,remove from the "algorithms" attribute (of type List) the specified indexes,and update "last_change" attribute with the timestamp variable.Example =>Inputs:mode_id = 3algorithm_index = [0,2]So if this is my row in DynamoDB:{  "mode_id": {    "N": "3"  },  "algorithms": {    "L": [      {        "S": "test1"      },      {        "S": "test2"      },      {        "S": "test3"      }    ]  },  "created": {    "N": "1680025806"  },  "last_change": {    "N": "1682959324"  },  "version": {    "S": "v666"  }}**The algorithms List in DynamoDB result should be only ["test2"] and the "last_change" value changes to the current timestamp. **The final result for the UpdateExpression should be (i think):REMOVE algorithms[0], algorithms[2]; SET last_change=123123This is the code i started writing:# get current timestamp timestamp = Decimal(int(time()))# indexes to be removed: update_expression = "REMOVE "expression_attribute_values = {}expression_attribute_names = {}index = 0for v in algorithm_index:    index += 1    update_expression += f"#alg{index}, "    expression_attribute_names[f"#alg{index}"] = f"algorithms[:val{index}]"    expression_attribute_values[f":val{index}"] = v# remove ", "update_expression = update_expression[:-2]print(f"update_expression: ", update_expression)print(f"expression_attribute_names: ", expression_attribute_names)print(f"expression_attribute_values: ", expression_attribute_values)# concatenate timestamp to the "UpdateExpression"update_expression += f"; SET last_change={timestamp}"# update query table.update_item(    Key={'mode_id': mode_id},    UpdateExpression=update_expression,    ExpressionAttributeNames=expression_attribute_names,    ExpressionAttributeValues=expression_attribute_values,    ReturnValues='UPDATED_NEW')Prints should look like:update_expression: REMOVE #alg1, #alg2expression_attribute_names: {'#alg1': 'algorithms[:val1]', '#alg2': 'algorithms[:val2]'}expression_attribute_values: {':val1': 0, ':val2': 2 }Some highlights:The query should be secure so no one can "SQL inject" malicious inputs, that's why the "ExpressionAttributeValues" is for, right? (i know it's not SQL! i just don't know what other term there is for "sql injection" for this case).I want to remove a list of items (that's why i use the for-loop), but at the end i want to use a "SET" to update the "last_change" column too.I'm splitting between the "REMOVE" and "SET" using a ";" (is this right?)Since removing list items nest the value ("REMOVE attribute[index]"), i nested it in the the "ExpressionAttributeNames" too, which lead to the value in "ExpressionAttributeValues".i didn't use any "ExpressionAttributeNames/Values" for the timestamp since it is self generated and nothing can tamper with it.Is it done well?Thanks!FollowComment"

Answer: "1SQL injections in DynamoDB are not the same as a relational database. DynamoDB doesn't execute any code, so the injections would only be to remove something in the item, that item being scoped to the individual item you are actioning, meaning there is a very small blast radius.I'm splitting between the "REMOVE" and "SET" using a ";" (is this right?)No, it should just be split with a spaceREMOVE #alg1, #alg2 SET last_change = :yCommentShareEXPERTLeeroy Hannigananswered a month agorePost-User-666 a month agoI think i wasn't so clear with my statement...i have some parts in my code where i concatenated stuff directly to the UpdateExpression like:update_expression = f"REMOVE algorithms[{user_input_var_here}]"Which i guess is the "bad practice". (please correct me if im wrong here)That's why i started using "ExpressionAttributeValues", to apply this protection ( <- by escaping sensitive strings?)Share"


Question: What is threshold limits for AWS Step Functions?

"AWS Step Functions has a hard quota of 25,000 entries in the execution event history. Are these quota function wise or per account wise? Also how can i calculate how much quota is my step function consuming?FollowComment"

Answer: "2Hi,AWS Step Functions has a hard quota of 25,000 entries in the execution event history per execution, but AWS provides some workarounds described on the following developer guide page to avoid reaching limits on long-running executions.CommentShareMikel Del Tioanswered 14 days agoEXPERTalatechreviewed 13 days agoEXPERTUrireviewed 14 days ago-1The quota for AWS Step Functions is applied at the account level, not per function. The limit of 25,000 entries in the execution event history applies to the total number of entries across all your Step Functions executions within the AWS account.To calculate how much quota your Step Functions are consuming, you need to consider the number of entries in the execution event history. Each state transition, input/output data, and other relevant information is recorded as an event in the execution history.You can use the AWS Step Functions APIs or the AWS Management Console to retrieve the execution event history for your Step Functions executions. The APIs provide methods like ListExecutions and GetExecutionHistory that allow you to fetch the execution history and analyze the number of events.Keep in mind that other operations, such as starting executions or creating state machines, do not directly consume the execution event history quota. It is primarily related to the number of events recorded during the execution of your Step Functions.By monitoring and analyzing the execution event history, you can determine how close you are to reaching the quota limit. If you find that you're approaching the limit or need to manage the quota more effectively, consider implementing strategies like periodically archiving or purging older execution history data that is no longer needed.If you require a higher quota for the execution event history, you can consider requesting a limit increase from AWS Support. They can provide guidance on the process and assess your specific requirements to determine if a limit increase is possible for your account.CommentShareEXPERTsedat_salmananswered 14 days agoUri EXPERT14 days ago25,000 is the limit per execution. Meaning, if you execute the same state machine twice, each execution will have the limit of 25K entries.Also, this limit is a hard limit and can't be increased.Share"


Question: "With Amplify, can India users be directed to a nearby server to improve load times?"

"Using Amplify, can I route users in India to a nearby server to improve their loading times?  And continue to route US users to US servers?FollowComment"

Answer: "0If you haven't already, you'll want to look into Amplify Hosting. It leverages Cloudfront, which has numerous global POPs including India and the US.If you need to force users to stay with a region, you can do this with Cloudfront, but also with Route53 with GeoLocation RoutingCommentShareC Mencarellianswered 4 months ago"


Question: Upgrade nvidia-driver in Amazon EKS AMI with nvidia gpu support

"The current EKS optimized Amazon Linux AMI ships nvidia-driver version 470. Unfortunately, our software requires version 510. Is there an official AMI with such version, or how could I upgrade the nvidia-driver in the AMI or perhaps using an overridden bootstrap command?FollowComment"

Answer: "0You can automate the install of the nvidia drivers via User Data in the launch template for your clusters. Here's the docs for managed node group launch templates that might help, https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.htmlCommentShareRay Kanswered 7 months agorePost-User-9606589 7 months agoI don't think it's an efficient method to install something at the boot of the worker node. Anyway, it might be done as a last resort, however, unfortunately the Amazon repo for nvidia packages (which is used for the gpu supported AMI) doesn't have any newer nvidia and cuda related packages. Could it be updated to have nvidia-510 packages as well? If so where to file such request?Share"


Question: Lightsail Distribution produces an error

"I just enabled distribution for my website, but getting an error:What is wrong?klionsky-orgSSL certificate, klionsky.orgRequested on:July 3, 2021, 1:15 AMStatus:Valid, in useDistribution:Status: EnabledDefault domain: d19p3ng5aeb0ha.cloudfront.netCustom domain: klionsky.org504 ERRORThe request could not be satisfied.CloudFront attempted to establish a connection with the origin, but either the attempt failed or the origin closed the connection. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.Generated by cloudfront (CloudFront)Request ID: 9B24Qe-WXe2ooIWsb0DPhIaBgYK2TRekbjFhNsHYAc0rZ6GuLECMwg==FollowComment"

Answer: "0I found the problem:I have not finished the setup.I just added CNAME record but missed this one:Choose an address (A) record to point an apex domain (e.g., example.com) to your distributionin other words, now my (A) record points to my distribution instead of Static IP address.CommentShareDanielAT2021answered 2 years ago"


Question: ECS Fargate Task in EventBridge has ResourceInitializationError

"I have created an ECS Fargate Task, which I can manually run. It updates a Dynomodb and I get logs.Now I want this to run on a schedule. I have setup a scheduled ECS task through EventBridge and through the UI in the ECS cluster. However, this does not run.My looking at the EventBridge logs I can see that the container has been stopped for the following stopped reason:ResourceInitializationError: unable to pull secrets or registry auth: execution resource retrieval failed: unable to retrieve ecr registry auth: service call has been retried 3 time(s): RequestError: send request failed caused by: Post https://api.ecr....I thought this might be a problem with permissions. However, I tested giving the Task Execution Role full power user permissions and I still get the same error. Could the problem be something else?FollowComment"

Answer: "1There are two roles associated with a Fargate task: The Task Role, and the Task Execution Role.The Task Execution Role needs all the permissions needed to start the task, including pulling the container image from ECR, obtaining and decrypting any secrets needed to launch the container, and dispatching logs and telemetry data to CloudWatch. The container runtime runs in the Task Execution Role context.The Task Role, on the other hand, needs all the permissions that are required by the task containers after launch. For example, if your application needs to access S3 or DynamoDB, the Task Role would contain those policies granting access to the application.So it is important to distinguish those two roles: Task Execution role is used before launch; the Task Role is used after launch. It is possible that you associated the policies with the Task Role instead of the Task Execution role.CommentShareEXPERTMichael_Fanswered a year agomhairi a year agoThanks, that's a good suggestion but I have been adding permissions to the Task Execution Role. I tested adding PowerUser permissions to the Task Execution Role, and I still have exactly the same error, so I think it's not a permissions issue.Sharemarcus a year ago@mhairi, did you get this to work? I'm thinking it is a network issue, but cannot figure it out. thanksShare"


Question: Right directory structure to optimize read throughput

We are trying to determine how to organize our S3 bucket for optimizing Read operation for this use case. We have a daily job that will write few single digit million files (each file less than 1 MB) to the bucket. The read pattern would be spread throughout the day with parallel requests to read one different file per request. We are thinking to choose between 3 optionsWrite job creates new directory for each daily run in the bucket. Distributes few files in the daily directory into 36 sub-directories hashed by last character in alphanumeric file name (26 characters + 10 digits)The bucket contain 36 directories and each directory contains new directory for each daily run.Manually create 36 partitions and find a way to randomly distribute data (if at all possible)Which of these options will provide maximum throughput for randomly accessing each file? We are looking at the docs here https://docs.aws.amazon.com/AmazonS3/latest/userguide/organizing-objects.htmlRemember the read traffic on a particular day will be interested in reading data for a single day's run. So for option 1 will route all daily read requests to single directory which will limit throughput to 5500 as mentioned in the best practices https://docs.aws.amazon.com/AmazonS3/latest/userguide/optimizing-performance.htmlWhich options here will give us the highest throughput?FollowComment


Question: Aurora read replica for RDS Postgres and long-term use

"Hello,according to documentation, Aurora Read Replica for RDS Postgres is designed to be used as a migration step from RDS Postgres to Aurora.I was thinking of adding read replica to RDS and realized that Aurora could also be used.Are there any downsides, if Aurora read-replica was used for long term read-replication of RDS Postgres without actually ever fully migrating to Aurora but keeping the RDS instance instead?FollowComment"

Answer: "1Note that when you create a Read Replica for the RDS PostgreSQL instance, its the native logical replication which comes into play. Meaning, the disadvantages of having a RDS Read Replica will stay even if you use Aurora PostgreSQL as a Read Replica.But there are a couple of things which you might want to make a note of:Evaluate if having an Aurora Read Replica for RDS PostgreSQL is making sense in terms of using Aurora features and if the price is justifiable to the businessThere might be occasions when you might have to run Aurora PostgreSQL read replica to a different PostgreSQL version than its Primary i.e. RDS PostgreSQL instance as the Major upgrades might not be released on the same dateCommentShareD-Raoanswered 9 months ago0Answering my own question; When Aurora is in read-replica mode for RDS, no furher reader instances can be added: "Creation of an Aurora Replica in a cluster which is already replicating from an RDS for PostgreSQL master is not allowed."I guess full Aurora migration is needed by promoting the Aurora cluster and only after that, read replicas can be added.CommentSharerePost-User-4879440answered 9 months ago"


Question: How do I trigger a Ansible on an EC2 instance from our hosted react site?

"I have a react site which allows us to store specific device information, and we also have created an ec2 instance which takes that data and allows us to configure the device. We are trying to create a way to run the playbook within the EC2 using a button on the website, however currently drawing a blank on how to do so.If possible can any one help at all?FollowComment"

Answer: "1Hi,I believe this depends on the Ansible product you are implementing, i.e. if you have Tower or other third party utilities. Another factor is where you are hosting your playbooks.This piece of Red Hat documentation may be the answer you're looking for.Worth noting: Ansible is written in a way that it assumes your playbooks are local using Python's os.path module, but limitations may also depend on what you're trying to accomplish with your playbook(s). If you are using Tower, here's the API integration reference documentation. You could also use Tower's webui to control playbook runs, if that's a feasible alternative.CommentSharemramlanswered 5 months agorePost-User-4585733 4 months ago@mraml We were try to do it without using third party utilities and doing it solely on AWS. The one idea I had was to connect the button to aws run command and have that run the script on AWS when triggered. But with that I struggle to make it trigger with the details of a specific user, or even how to trigger the run command from the button.Share"


Question: SkillBuilder Subscription with AWS Credits

"Hi, I would like to enroll to Skill Builder monthly subscription. Before paying, it mentions that Your subscription fee will be billed to your AWS account..Will this charge directly on credit card associated to the account, or will it take from some existing AWS credits?ThanksFollowComment"

Answer: 0Accepted AnswerAWS Credits won't apply to SkillBuilder. SkillBuilder is technically under Training and Certifications which is excluded from credit eligibility.Ref: AWS Credits Terms and ConditionsCommentShareC Mencarellianswered 4 months ago


Question: events not matching any rules

what happens to events which are sent to event bus but not matching rule to deliver it to target ?FollowComment

Answer: "1Accepted AnswerEvents that do not match any rule are discarded. If you have archive enabled, they will be added to the archive.CommentShareEXPERTUrianswered 4 months ago1Hello,Not sure about the exact outcome aimed from this question but will try to provide useful answer.Once in the event bus, events are stored for a particular amount of days in something which we can name archive. Reaching deadline these events are purged, in the meantime there is a feature which allows user to replay events from particular archive, if needed.Hope this helps!Regards,TottiCommentShareTodor Todorovanswered 4 months ago1According to https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-rule-dlq.html:When an event isn't successfully delivered to a target because of retriable errors, EventBridge retries sending the event. You set the length of time it tries, and number of retry attempts in the Retry policy settings for the target. By default, EventBridge retries sending the event for 24 hours and up to 185 times with an exponential back off and jitter, or randomized delay. If an event isn't delivered after all retry attempts are exhausted, the event is dropped and EventBridge doesn't continue to process it. To avoid losing events after they fail to be delivered to a target, you can configure a dead-letter queue (DLQ) and send all failed events to it for processing later.CommentShareEXPERTalatechanswered 4 months ago"


Question: why must an RDS always have two subnets

"Hello,Tried asking this on acloudguru as I was going through some courses on AWS, but no luck. Maybe I will get lucky here? :)Trying to understand RDS deployment better.When I create an RDS instance, it requires me to define two subnets. Even if I just deploy a single instance (non-multi AZ, even backups disabled though that should not be related).What are the who subnets used for?I read various discussions all over the internet, stating some thing like:-If you change to multi-AZ, then these two are used as a basis. But why would you need to pre-define it before going multi-AZ?-The second subnet would be used to store your backups and logs. But elsewhere I read those are actually put into S3. What is it?-That AWS uses these two subnets to deploy your RDS. Does it then randomly pick one subnet, deploy the RDS there, and keep it there forever? What is the need for the second subnet then?-That in case of failure, AWS would automatically transition the RDS to the second subnet. This kind of makes sense, but does this really happen? If so, when does the transition get triggered, what kind of downtime is to be expected, is the new RDS built from latest backup? What if I disabled the backup?-Some other reason?I found this old thread here asking the same question: https://forums.aws.amazon.com/thread.jspa?messageID=542662䟆But even that question/answers lists two different options from the AWS staff: one answer saying just in case you decide to go multi-AZ, and/or a second answer saying it provides automated failover. See questions above.Thanks,FollowComment"

Answer: "1Hi,Amazon RDS FAQs actually address this very question.Link: https://aws.amazon.com/rds/faqs/For Multi-AZ deployments, defining a subnet for all Availability Zones in a Region will allow Amazon RDS to create a new standby in another Availability Zone should the need arise. You need to do this even for Single-AZ deployments, just in case you want to convert them to Multi-AZ deployments at some point.Q: The second subnet would be used to store your backups and logsA:  No, the second subnet is NOT used for backups and logs.Q: That AWS uses these two subnets to deploy your RDS. Does it then randomly pick one subnet, deploy the RDS there, and keep it there forever? What is the need for the second subnet then?A: On RDS creation, you are allowed to choose an Availability zone preference. If you choose "No preference", then RDS will randomly choose to deploy one of the subnets and will keep it there forever (unless you update config to Multi-AZ). The second subnet is just sitting there doing nothing waiting for you to upgrade to Multi-AZ.Q: That in case of failure, AWS would automatically transition the RDS to the second subnet.A: No, it will only transition to the second subnet if Multi-AZ is enabledQ: If you change to multi-AZ, then these two are used as a basis. But why would you need to pre-define it before going multi-AZ?A: Most likely because AWS would rather you use multi-AZ (and also wants the migration to multi-AZ be as simple as a possible).Hope this helps!-randyCommentShareRandyTakeshitaanswered 4 years ago0ok thanks. i missed that. i guess it must be something to do with the backend implementation to ease the conversion later if needed. in any case, thanks for the answer!CommentSharemagicbunnyanswered 4 years ago"


Question: How to refresh the access token in aws amplify from front end react app ?

"We have a react based front end app. It uses amplify in front end to interact with cognito.We use hosted cognito login page in our react web app.When we send the access token to backend api backed by API GW which uses cognito to authorize and authenticate.The issue is sometime the access is getting expired. It looks like the access token is available for 1 hour only.How do we know whether the token is valid or not in front end code using aws amplify ?If it is expired, how do we use amplify sdk/api to refresh and get the new token without refreshing the page ?Note:When we manually refresh the page, it is working.We want to perform the api call make it as a successful api call without asking the user  to manually refresh the page.FollowComment"

Answer: "1Accepted AnswerHi Navin,You should just call Auth.currentSession() method, as Amplify will handle that, see this: https://docs.amplify.aws/lib/auth/manageusers/q/platform/js/#retrieve-current-sessionHope it helps and appreciated an accepted answer if so, so that benefits community when searching for similar issues, cheers!CommentShareEXPERTalatechanswered 3 months ago"


Question: Sagemaker Data Capture does not write files

"I want to enable data capture for a specific endpoint (so far, only via the console). The endpoint works fine and also logs & returns the desired results. However, no files are written to the specified S3 location.Endpoint ConfigurationThe endpoint is based on a training job with a scikit learn classifier. It has only one variant which is a ml.m4.xlarge instance type. Data Capture is enabled with a sampling percentage of 100%. As data capture storage locations I tried s3://<bucket-name> as well as s3://<bucket-name>/<some-other-path>. With the "Capture content type" I tried leaving everything blank, setting text/csv in "CSV/Text" and application/json in "JSON".Endpoint InvokationThe endpoint is invoked in a Lambda function with a client. Here's the call:sagemaker_body_source = {            "segments": segments,            "language": language        }payload = json.dumps(sagemaker_body_source).encode()response = self.client.invoke_endpoint(EndpointName=endpoint_name,                                       Body=payload,                                       ContentType='application/json',                                       Accept='application/json')result = json.loads(response['Body'].read().decode())return result["predictions"]Internally, the endpoint uses a Flask API with an /invocation path that returns the result.LogsThe endpoint itself works fine and the Flask API is logging input and output:INFO:api:body: {'segments': [<strings...>], 'language': 'de'}INFO:api:output: {'predictions': [{'text': 'some text', 'label': 'some_label'}, ....]}FollowComment"

Answer: 0Accepted AnswerSo the issue seemed to be related to the IAM role. The default role (ModelEndpoint-Role) does not have access to write S3 files. It worked via the SDK since it uses another role in the sagemaker studio. I did not receive any error message about this.CommentShareRichardanswered 10 months ago


Question: My certificate request is taking a long time to validate

"Yesterday, I bought two web addresses on AWS, then put in a certificate request. In the certificate request, I requesteddomain1domain2www.domain1www.domain2and the auto-validation (not the email) choiceIt's almost 20 hours since I entered the request, and the status is still "Pending Validation".I've been reading a lot about CNAME. I haven't created any CNAMEs directly... I thought this would be done along with certificate issuance.Is this normal, or do I have a problem? If I have a problem, what should I do about it?Edited by: TJ78 on Nov 26, 2019 3:14 PMEdited by: TJ78 on Nov 26, 2019 3:18 PMFollowComment"

Answer: "0This was a CNAME issue after all. I deleted the long running request I had come here for advice on, and went through the process again... but a little more carefully. I went through and installed the CNAMEs for each domain before clicking "continue". Almost immediately my first domain name patterns were approved. Now all of my domain names are and the certificate has been issuedCommentShareTJ78answered 4 years ago"


Question: How to add a wire to connect an HLS kernel and an RTL Kernel  in Vitis

"Hi,How can we add a wire (or some wires) to connect an HLS kernel and an RTL kernel in Vitis?I want to use the RTL kernel to read some values in the HLS kernel for debugging. Can we avoid using the "Streaming Connection" which is too much for the simple reads?Thank you!SamFollowComment"

Answer: "0Hello,Xilinx strongly recommends the usage of AXI-Stream connections between two kernels, as it is a much safer mechanism and allows more automation by the tools.It is however possible to use the Vitis "connect" connectivity option to directly and manually connect individual kernel ports. When using this feature, Vitis will not perform any checks. The user is therefore responsible to ensuring the correctness of the specified "connect" option. This is considered an expert feature. You can find more details about this feature in the online documentation:https://www.xilinx.com/html_docs/xilinx2021_1/vitis_doc/vitiscommandcompiler.html#clt1568640709907__section_gzy_xkc_w4bCommentShareThomasXilinxanswered 2 years ago"


Question: Multi-region Cognito?

"There is a 4 years old thread on aws forums but i think there is still no support for multi-region cognito?https://forums.aws.amazon.com/thread.jspa?messageID=777006we run on us & asia regions and cognito is the single bottleneck. We can run databases, APIs etc cross-region but not cognito :( One thing is lag. We can either support US or Asia customers better now :( But another high topic is disaster recovery & failover.This month was real bad for AWS, it was down in US regions for 3 times in a month. Last year, AWS was also down during Q4 of 2020 and Q4 is most important Q of the year for many because of holiday sales.We run on n.virginia (probably most pop region?) and it was heavily affected during this December, when the traffic is at it's peak and everyone just looks how AWS region is down and $ is not collected from the peak sales period. I bet a lot of you had that frustration during this December 2021 too. And also 2020, while AWS was down during Q4 of 2020 too.AWS talks constantly - everything fails, do multi region. Follow the 5 pillars.How can we follow AWS best practises when core service which is in use by user for any API call can not run by AWS's best practises? What's the point to run database in multi-region as failover if user can't access it anyways because of the 1st service it needs to hit is single-region and it is down?The thread around this started back in 2017 Mar, It's been 4 years already and still no option to run multi-region authorization.AWS, Is there any progress on this?FollowComment"

Answer: "1Thanks Sean. In terms of the 2nd option, it looks like passwords can't be replicated. so how does that factor in? Will the user have to reset the password during a Disaster and reset it again when the primary comes back online?CommentSharePKanswered a year ago0While I cannot answer the question on when multi-region support is arriving I can give some suggestions that I have seen people use. I don't know the use case you have (identity pools, user pools, or both) so I will talk about user pools since that is the common use case.The underlying database used by Cognito is highly resilient and I would expect it to survive a regional failure. However, it would be unavailable for the duration of a regional failure and that may well be unacceptable. If this is the case, and until multi-region support arrives, I would suggest the following:First. Don't store user credentials in the Cognito database. Instead federate via SAML as this removes the biggest issue with single region use, the inability to back up user credentials. I prefer this anyway as I really want a single database of record for all my users and that often already exists.Second. Design for failure. Assume that the region will fail and either build out parallel Cognito infrastructure in another region, or have the Cloudformation to do so ready to go. This is a cost vs. RTO trade off as to whether it is better to have warm or cold standby in your use case.Finally. If at all possible store only transient session data in the database. Ideally if the region fails then you should be able to cold start in another region with minimal impact. If the data needs to persist then run regular backup jobs to walk the database and copy the data out according to your RPO.CommentShareSean_Lanswered a year agoPK a year agoThanks Sean. In terms of the 2nd option, it looks like passwords can't be replicated. so how does that factor in? Will the user reset the password during a Disaster and reset it again when the primary comes back online?Share0We experience the same issue and got stuck solving it. But for us is also important synchronization of user pool app clients across the regions.Seems like we have to completely rid of Cognito from the solution and secure our API with API keysCommentShareMikhail Chumakovanswered 7 months ago"


Question: How do I clear the buffer cache in AWS RDS oracle?

"ALTER SYSTEM FLUSH BUFFER_CACHE;I tried to delete the buffer cache using , but I don't have permission.I ran the following command in AWS DOCS.EXEC rdsadmin.rdsadmin_util.flush_buffer_cache;But I got the error "SQL Error [900] [42000]: ORA-00900".What should I do?FollowComment"

Answer: "1To clear the buffer cache in AWS RDS Oracle, you can try running the following command as the RDS superuser:EXEC rdsadmin.rdsadmin_util.flush_buffer_cache;Note that this command requires superuser privileges, so you may need to grant yourself the necessary permissions before running it. Additionally, you may need to run the command in a specific schema, such as rdsadmin, to avoid the ORA-00900 error.If you are unable to run the command or are still encountering errors, you can try using the ALTER SYSTEM command instead:ALTER SYSTEM FLUSH BUFFER_CACHE;This command may require the ALTER SYSTEM privilege, which you can grant to yourself using the GRANT statement. For example:GRANT ALTER SYSTEM TO myuser;Keep in mind that clearing the buffer cache can have a negative impact on database performance, so it should only be done as a last resort and under the guidance of a qualified DBA.CommentShareRobert Dahlborganswered 6 months agojoker 6 months agonot all three Any other way?Share"


Question: mturk - create_qualification_type: checkbox with multiple possible answers

"In my stupid test I need the worker to 'check' dog+mouse, and leave 'cat' un-checked.I can't make it bring a score other than 0!does anybody having a working example please?Here is my code:I have a questions XML with something like this:        ...        <AnswerSpecification>            <SelectionAnswer>                <MinSelectionCount>0</MinSelectionCount>                <MaxSelectionCount>4</MaxSelectionCount>                <StyleSuggestion>checkbox</StyleSuggestion>                <Selections>                    <Selection>                        <SelectionIdentifier>dog</SelectionIdentifier>                        <Text>Dog</Text>                    </Selection>                    <Selection>                        <SelectionIdentifier>cat</SelectionIdentifier>                        <Text>Cat</Text>                    </Selection>                    <Selection>                        <SelectionIdentifier>mouse</SelectionIdentifier>                        <Text>Mouse</Text>                    </Selection>           <... close above tags ...>With a corresponding AnswerKey:  <Question>    <QuestionIdentifier>identify_animals</QuestionIdentifier>    <AnswerOption>      <SelectionIdentifier>dog</SelectionIdentifier>      <AnswerScore>1</AnswerScore>    </AnswerOption>    <AnswerOption>      <SelectionIdentifier>cat</SelectionIdentifier>      <AnswerScore>0</AnswerScore>    </AnswerOption>    <AnswerOption>      <SelectionIdentifier>mouse</SelectionIdentifier>      <AnswerScore>1</AnswerScore>    </AnswerOption>  </Question>Then come the value mapping:  <QualificationValueMapping>    <PercentageMapping>      <MaximumSummedScore>2</MaximumSummedScore>    </PercentageMapping>  </QualificationValueMapping>FollowComment"

Answer: "0IM EIN ANI LI MI LIThanks to this answer:https://stackoverflow.com/questions/12468424/how-to-make-an-answer-key-xml-for-a-multi-answer-checkbox-questionspecI have two things learned:There is no need to specify scores of zero. This is the default.Using the following AnswerKey, the worker will get 100 only if marking dog+mouse and leaving 'cat' unchecked. any other combination will get her 0.<AnswerKey xmlns="http://mechanicalturk.amazonaws.com/AWSMechanicalTurkDataSchemas/2005-10-01/AnswerKey.xsd">  <Question>    <QuestionIdentifier>identify_animals</QuestionIdentifier>    <AnswerOption>      <SelectionIdentifier>dog</SelectionIdentifier>      <SelectionIdentifier>mouse</SelectionIdentifier>      <AnswerScore>2</AnswerScore>    </AnswerOption>  </Question>  <QualificationValueMapping>    <PercentageMapping>      <MaximumSummedScore>2</MaximumSummedScore>    </PercentageMapping>  </QualificationValueMapping></AnswerKey>I will add as a note that it is quite weird that Amazon's schema server, mechanicalturk.amazonaws.com, is totally unavailable.CommentShareishahakanswered 3 years ago"


Question: Amazon QLDB Streams - Unknown record format with unreadable characters

I created a QLDB stream with consoleBut the record data contains unreadable charactersAnd it doesn't look like it is in JSON formatI tried to stream a dynamoDB table to the same data stream and it works perfectlyWhat happened to QLDB Streams?FollowComment

Answer: "0I have written some blog posts with associated GitHub repositories for streaming data from QLDB out to different back end data stores. An example post is linked below, but there are several more if you look on that siteHow I streamed data from Amazon QLDB to DynamoDB using Nodejs in near-real timeThe data on the stream is in ION format, and as it is on a Kinesis Data Stream it is also base64 encoded, hence the output you are seeing.CommentShareEXPERTMatt Lewisanswered 5 months ago"


Question: "unable to pay, complete payment button greyed out"

"when trying to pay for an invoice, "complete payment" option Is greyed outFollowComment"

Answer: "1Accepted AnswerHey therePlease check to make sure that you have filled out all of your payment detailsIf you have filled everything out, i suggest using a different browser, or using googles incognitoIf the problem still persists, i recommend opening a ticket with AWSCommentShareAWS_Guyanswered 2 months ago"


Question: Azure Guest accounts can't sign in using AWS SSO with Azure SAML

"AWS SSO with Azure using SAML works only for users that were created in the Azure tenant as internal users. These users can sign in with SSO succesfully.However whenever we invite an external user/guest to our Azure tenant, their UPN "username"  gets a prefix added #EXT#. I believe this is causing issues for them to sign in using SSO in AWS.AWS SSO returns a "Looks like this code isn't right. Please try again" error.Steps to reproduceSet up AWS SSO with Azure AD using SAML (including provisioning through SCIM)Create a new external user in Azure AD. Notice that their User Principal Name gets #EXT#Assign permissions to this Azure AD user so it is allowed to sign in AWSSign in with this user into AWS SSO through the SSO link mentioned in AWS dashboardNotice you get the "looks like this code isn't right. Please try again" errorNow do the same steps but create an internal user. you will notice this works.FollowComment"

Answer: "2Since AZURE is a Microsoft product we just hacked it.. One of our 'Super Admins' on Azure updated the 'User Principal Name' and removed the #EXT# and then we forced a re-provision for those users from AZURE to AWS and the users can login now.CommentShareSduntanswered 7 months agoMike 7 months agoIt works by removing the #EXT# but it's not ideal. We need to remember ourselves whenever we invite an external user to our AWS account we need to edit their User principal name. Ideally AWS SSO should handle the hashtag so it works out of the box... or Microsoft shouldn't use hashtags in their external users but don;t think they will change thisShare0Yep, I am getting the same error but with Google Workspaces as a providerCommentSharerePost-User-7313203answered 7 months ago0You can configure a transform in AzureAD to return the email address value instead of the UPN for any claims that contain #EXT#. Make sure 'Specify output if no match' is set to user.userprincipalname (or whatever you normally use) for regular azure members.For a vanilla SAML configuration, that would be the following claims:Unique User Identifier (nameidentifier)nameCommentSharePete Stanleyanswered 3 days ago"


Question: Unable to modify nginx config on CodeBuild deployment to EBS

"We're using CodeBuild to automatically deploy to EBS.  We need to modify nginx with a proxy.conf file containing:client_max_body_size 20M;to allow us to upload photos to S3.  So far none of the documented methods to do this have worked.  I initially attempted the following yaml content in .ebextensions/nginx_files.config:files:"/etc/nginx/conf.d/01_proxy.conf":mode: "000644"owner: rootgroup: rootcontent: |client_max_body_size 20M;container_commands:01_nginx_reload:command: “systemctl reload nginx”This had no effect.  After more research I discovered the new method for modifying the nginx config on Amazon Linux 2 is creating the conf file within the .platform directory.  I tried using both these paths:./platform/nginx/conf.d/00_proxy.conf./platform/nginx/conf.d/elasticbeanstalk/00_proxy.confThe 00_proxy.conf file is created on the EC2 instance in /var/app/staging, but is never copied to /etc/nginx/conf.d or /etc/nginx/conf.d/elasticbeanstalk.  The next thing I tried was launching a script from Buildfile to copy the file into the correct place.  I can see in /var/log/messages on the EC2 instance that Buildfile runs the script, but gets a permission denied message when attempting to copy.  If I execute the cp command with sudo I get errors about needing a root password.  How can I get around this permission issue?FollowComment"

Answer: 1I figured it out.  I had to change discard-paths from yes to no in the CodeBuild Buildspec file and add a Procfile to the project that pointed to the full path of the jar file.  The full .platform directory structure needs to remain intact for the nginx conf files to be able to end up in the correct location within the /etc/nginx directory.  This is what I ended up with in the Buildspec file:artifacts:files:- target/myapp.jar- .ebextensions//*- .platform//*- Buildfile- Procfilediscard-paths: noCommentSharejhesteranswered 2 years ago


Question: How can we ask for new features in re:Post?

How can we ask for new features in re:Post?FollowComment

Answer: "4Accepted AnswerHello,You can provide your feedback at https://repost.aws/feedback to share new ideas and experience with re:post.CommentShareSUPPORT ENGINEERJosueAWSanswered a year agoEXPERTHernitoreviewed a year ago"


Question: UI2.0 Bug Lumberyard 1.25 (Big Bad Bug)

"Hi Lumberyard Team 🙂I found a big bad bug in script canvas editor & UI 2.0 for Lumberyard 1.25😍   😍 :star_struck:Please see this video (Unlisted) 👇https://www.youtube.com/watch?v=fA_eUahEih4I am lover bugs for finding 😊Internet is expensive in Iran, so I could not download 1.26 ☹ 😕Please fix itThank you🙏 🌹Follow"

Answer: "0@REDACTEDUSERSharerePost-User-8224505answered 3 years ago0This has happened to me when I rename an open Script Canvas graph or function in Windows File Explorer.  It crashes the editor. I think it might be because the Asset Processor has control of the file and it is not expecting changes to the file from the OS.Sometimes I'll also have an issue if I have a Script Canvas function open and a graph that uses the function open too.  If I save the function, the editor might crash.  Something else to watch out for.SharerePost-User-7039295answered 3 years ago0Hi @REDACTEDUSERPlease see this Big Bad Bug video 🙂  and  Please read Description Finite_StateThank you 🌹 🙏SharerePost-User-8224505answered 3 years ago0Hey @REDACTEDUSERThanks for reporting this issue, I've pinged the Script Canvas team to check it out.The video is very helpful but do you think you could also create a bullet point set of steps that a developer could follow to reproduce the bug and outline exactly what the symptoms are. It'll make reproducing and fixing it much easier.Thanks!TomSharerePost-User-0765265answered 3 years ago0You're welcome, But Everything is clear step by step in the video, right?I save as my graph in Windows Desktop, then The editor collapses  🙂You did not reproduce the bug and disintegration in the editor with this video?Thank you Dear @REDACTEDUSER🙏 😊SharerePost-User-8224505answered 3 years ago0It is helpful for sure but there's no commentary which makes it more difficult to figure out each step. Having a list of steps makes it easier to follow/reproduce than having to skip back and forward in the video, just for future reference :slight_smile:Having both is usually best, our internal bug reports are in that form and it just makes our lives a little easier. We still really appreciate you taking the time to record the video and report it!The SC team is aware and will be looking into this,Thanks!TomSharerePost-User-0765265answered 3 years ago0@REDACTEDUSERSharerePost-User-8224505answered 3 years ago0Very interesting bug indeed. I also notice that there appeared to be some small boxed shaped outline in the corner where you were pressing. Did you notice if you were getting some kind of pop up window that was preventing the window from closing?REMOVEDUPLOADSharerePost-User-7587634answered 3 years ago0But I wonder why the maximize button and minimize button work but close button does not work?!If you have seen the full video of the big bad bug, I have shown it.[quote="ScaredZebra, post:9, topic:9682"]Did you notice if you were getting some kind of pop up window that was preventing the window from closing?[/quote]I tested again , I Found 😍  small boxed shaped outline 😉I record a video , then publish here ...SharerePost-User-8224505answered 3 years ago0Thanks @REDACTEDUSERUser opens LYUser selects View > Layout > reset > default layoutUser selects a saved slice that has a saved ScriptCanvas attached via the inspector (component card)User clicks the open button from the ScriptCanvas window.Please note script canvas window main header is a bit off screen at this point.User drags right edge which cause the window frame to snap into view.User does “Save as”. User renames the ScriptCanvas script as a new file name. (OptimizeTags0000000001)Please note the notification “Failed to save OptimizedTags”User does a “Save as” again, but this time the directory location is changed to the desktop and saved as (OptimizeTags00001)At this point the ScriptCanvas file appears to be broken (Script is grayed out)ScriptCanvas window close button appears to be non responsive.Main Editor window close button appears to be non responsive.Flashes of a box in the top right corner appear to be covering button when user clicks on close button.Thanks,JoshuaSharerePost-User-7587634answered 3 years ago0@REDACTEDUSERSharerePost-User-8224505answered 3 years ago0[quote="ScaredZebra, post:11, topic:9682"]Can you also let us know what that error said.[/quote]Yes , of course , But I have questions  if it is possible , let me know According to the steps I showed you in the video, did you reproduce this bug? Were you able to reproduce this bug in 1.25 and 1.26 ?You know , I use 1.25 , These bug occur at 1.25 ✅SharerePost-User-8224505answered 3 years ago0[quote="ScaredZebra, post:11, topic:9682"]It appears the video was not attached.[/quote]Boxed shaped outline is Script Canvas Editor , Please see this new video bug (Unlisted)  👇 🙂https://www.youtube.com/watch?v=oloPA1wCWjI&feature=youtu.beSharerePost-User-8224505answered 3 years ago0[quote="_AhmadKarami, post:12, topic:9682"]ate in Iran and everyone was asleep, sorry for the delay, I apologize, I will upload the video soon until another hour …[/quote]No problem at all. Thanks for giving us all these details :slight_smile:SharerePost-User-7587634answered 3 years ago0[quote="_AhmadKarami, post:14, topic:9682"]But I have questions if it is possible , let me know According to the steps I showed you in the video, did you reproduce this bug? Were you able to reproduce this bug in 1.25 and 1.26 ?[/quote]So my working branch is a future release branch and I'm unfortunately unable to test this feature at the moment. However, I have reported this issue to our development team and they are already taking a look at the issue.One note I see is that the directory of desktop might be related. Can you save your SC file into the project folder and see if this issue goes away? thanks JoshuaSharerePost-User-7587634answered 3 years ago0[quote="ScaredZebra, post:16, topic:9682"]So my working branch is a future release branch and I’m unfortunately unable to test this feature at the moment. However, I have reported this issue to our development team and they are already taking a look at the issue.[/quote]OK, hopefully in the next version 1.27 we will see a lot of features and bug fixes ✅ 🙂SharerePost-User-8224505answered 3 years ago0[quote="ScaredZebra, post:15, topic:9682"]No problem at all. Thanks for giving us all these details :slight_smile:[/quote]You're Welcome Dear Joshua 🙏 🌹[quote="ScaredZebra, post:16, topic:9682"]One note I see is that the directory of desktop might be related. Can you save your SC file into the project folder and see if this issue goes away?[/quote]Yes, exactly, the desktop folder causes this Big Bad Bug (problem) , Yes, I can save Script canvas files into the project folder\Script Canvas folder , Does Work!SharerePost-User-8224505answered 3 years ago0In this new video, I showed how to get the answer and how to close the editor, and of course, what window causes the editor not to close, be sure to see the complete to the last second ✅ 👇 😉[quote="_AhmadKarami, post:13, topic:9682"]Boxed shaped outline is Script Canvas Editor , Please see this new video bug (Unlisted) 👇 🙂 YouTubeUI 2.0 Big Bad Bug Lumberyard 1.25-BBB 2[/quote]SharerePost-User-8224505answered 3 years ago0Thanks for the clarification on the issue. There are some technical restrictions around reading and writing files outside your active project folder. Can you keep these files inside your project folder? Reason being is that every asset in the game needs to go through Asset Processor. So it needs to live where Asset Processor can get at it. Otherwise, AP won't build it, and we won't be able to load it.SharerePost-User-7587634answered 3 years ago0I tested save as my file of script  canvas , I can save my file inside D:\LY125\dev\StarterGame Folder, and Does work , then I tested save as my file of script  canvas , I can not save my file inside D:\LY125\dev Folder, and Does not work + Like what happens in the video above, a big bad bug happens 🙂SharerePost-User-8224505answered 3 years ago"


Question: AWS Lambda@Edge created using AWS CDK doesn't put Log to CloudWatch

"I created a simple Lambda@Edge function like below.'use strict';exports.handler =  async function(event, context, callback) {    const cf = event.Records[0].cf;    console.log('Record: ', JSON.stringify(cf, null, 2));    console.log('Context: ', JSON.stringify(context, null, 2));    console.log('Request: ', JSON.stringify(cf.request, null, 2));    callback(null, cf.request);}And I deployed it using AWS CDKv2 `experimental EdgeFunction like below        const edgeFunction = new cloudfront.experimental.EdgeFunction(this, 'EdgeFunction', {            runtime: Runtime.NODEJS_14_X,            handler: 'index.handler',            code: Code.fromAsset(path.join(__dirname, '../../../../lambda/ssr2')),        });and also I set it up as edge function for a Distribution        const distribution = new Distribution(this, 'Distribution', {            defaultBehavior: {                origin,                cachePolicy: CachePolicy.CACHING_DISABLED,                viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,                edgeLambdas: [                    {                        functionVersion: edgeFunction.currentVersion,                        eventType: LambdaEdgeEventType.VIEWER_REQUEST,                    }                ]            },But when I tried sending the request to the Distribution, the log didn't show up anything.I checked the permission, the role already has permissionAllow: logs:CreateLogGroupAllow: logs:CreateLogStreamAllow: logs:PutLogEventsI expect the function write logs to the CloudWatch. What did I miss?UPDATE 1Below is the role document,{    "sdkResponseMetadata": null,    "sdkHttpMetadata": null,    "partial": false,    "permissionsBoundary": null,    "policies": [      {        "arn": "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",        "document": {          "Version": "2012-10-17",          "Statement": [            {              "Effect": "Allow",              "Action": [                "logs:CreateLogGroup",                "logs:CreateLogStream",                "logs:PutLogEvents"              ],              "Resource": "*"            }          ]        },        "id": "ANPAJNCQGXC425412345",        "name": "AWSLambdaBasicExecutionRole",        "type": "managed"      }    ],    "resources": {      "logs": {        "service": {          "icon": "data:image/svg+xml;base64,PHN2ZyB2aWV3Qm94PSIwIDAgNjQgNjQiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CiAgPGcgdHJhbnNmb3JtPSJzY2FsZSguOCkiPgogICAgPGRlZnM+CiAgICAgIDxsaW5lYXJHcmFkaWVudCB4MT0iMCUiIHkxPSIxMDAlIiB4Mj0iMTAwJSIgeTI9IjAlIiBpZD0iYSI+CiAgICAgICAgPHN0b3Agc3RvcC1jb2xvcj0iI0IwMDg0RCIgb2Zmc2V0PSIwJSIvPgogICAgICAgIDxzdG9wIHN0b3AtY29sb3I9IiNGRjRGOEIiIG9mZnNldD0iMTAwJSIvPgogICAgICA8L2xpbmVhckdyYWRpZW50PgogICAgPC9kZWZzPgogICAgPGcgZmlsbD0ibm9uZSIgZmlsbC1ydWxlPSJldmVub2RkIj4KICAgICAgPHBhdGggZD0iTTAgMGg4MHY4MEgweiIgZmlsbD0idXJsKCNhKSIvPgogICAgICA8cGF0aCBkPSJNNTUuMDYgNDYuNzc3YzAtMy45MDktMy4yMDItNy4wOS03LjEzOC03LjA5LTMuOTM1IDAtNy4xMzYgMy4xODEtNy4xMzYgNy4wOSAwIDMuOTEgMy4yIDcuMDkgNy4xMzYgNy4wOXM3LjEzNy0zLjE4IDcuMTM3LTcuMDltMi4wMSAwYzAgNS4wMTEtNC4xMDMgOS4wODctOS4xNDcgOS4wODctNS4wNDMgMC05LjE0Ny00LjA3Ni05LjE0Ny05LjA4NyAwLTUuMDEgNC4xMDQtOS4wODYgOS4xNDctOS4wODYgNS4wNDQgMCA5LjE0OCA0LjA3NiA5LjE0OCA5LjA4Nm04LjQ0IDEzLjY5N0w1OC41IDU0LjIwM2ExMy4wMzMgMTMuMDMzIDAgMDEtMS45NDcgMi4xNmw2Ljk5OCA2LjI3YTEuNDc0IDEuNDc0IDAgMDAyLjA2Ni0uMTA3IDEuNDUzIDEuNDUzIDAgMDAtLjEwOC0yLjA1Mm0tMTcuNTg4LTIuODEyYzYuMDQzIDAgMTAuOTU4LTQuODgzIDEwLjk1OC0xMC44ODVzLTQuOTE1LTEwLjg4NC0xMC45NTgtMTAuODg0Yy02LjA0MSAwLTEwLjk1NyA0Ljg4Mi0xMC45NTcgMTAuODg0IDAgNi4wMDIgNC45MTYgMTAuODg1IDEwLjk1NyAxMC44ODVtMTkuMTkgNi4yQTMuNDgzIDMuNDgzIDAgMDE2NC41MjkgNjVhMy40NzUgMy40NzUgMCAwMS0yLjMyMi0uODgzTDU0LjkzMSA1Ny42YTEyLjkzNSAxMi45MzUgMCAwMS03LjAwOSAyLjA2Yy03LjE1IDAtMTIuOTY3LTUuNzc5LTEyLjk2Ny0xMi44ODIgMC03LjEwMiA1LjgxNy0xMi44ODEgMTIuOTY3LTEyLjg4MSA3LjE1MSAwIDEyLjk2OSA1Ljc3OSAxMi45NjkgMTIuODgxIDAgMi4wMzgtLjQ5MiAzLjk2LTEuMzQ0IDUuNjc0bDcuMzA5IDYuNTRhMy40NDQgMy40NDQgMCAwMS4yNTYgNC44NzJNMjEuMjggMjkuMzkzYzAgLjUxOS4wMzIgMS4wMzYuMDk0IDEuNTM2YS45OTQuOTk0IDAgMDEtLjgyMyAxLjEwNmMtMi40NzIuNjM0LTYuNTQgMi41NTMtNi41NCA4LjMxIDAgNC4zNDggMi40MTMgNi43NDggNC40MzkgNy45OTYuNjkxLjQzMyAxLjUxLjY2NCAyLjM3My42NzNsMTIuMTIyLjAxMS0uMDAyIDEuOTk3LTEyLjEzMS0uMDFjLTEuMjQ2LS4wMTQtMi40MjgtLjM1MS0zLjQyOC0uOTc3QzE1LjM3NyA0OC43OTcgMTIgNDUuODkgMTIgNDAuMzQ1YzAtNi42ODMgNC42LTkuMTUzIDcuMy0xMC4wMjYtLjAyLS4zMDctLjAzLS42MTctLjAzLS45MjYgMC01LjQ2IDMuNzI4LTExLjEyMyA4LjY3Mi0xMy4xNzEgNS43ODItMi40MDcgMTEuOTA4LTEuMjE0IDE2LjM4NCAzLjE4OSAxLjM4OCAxLjM2NCAyLjUyOSAzLjAyIDMuNDA0IDQuOTM3YTYuNTA5IDYuNTA5IDAgMDE0LjE1NC0xLjUwMmMzLjAwMiAwIDYuMzgyIDIuMjY0IDYuOTg0IDcuMjE1IDIuODEyLjY0NCA4Ljc1MyAyLjg5NCA4Ljc1MyAxMC4zNjIgMCAyLjk4MS0uOTQxIDUuNDQ0LTIuNzk4IDcuMzE5bC0xLjQzMy0xLjQwMWMxLjQ3My0xLjQ4OCAyLjIyLTMuNDc5IDIuMjItNS45MTggMC02LjUzMi01LjUwNC04LjE1Ny03Ljg3My04LjU1MWExLjAwMiAxLjAwMiAwIDAxLS44MjMtMS4xNTdjLS4zMjktNC4wNTUtMi43NTMtNS44NzItNS4wMy01Ljg3Mi0xLjQzNyAwLTIuNzg0LjY5NS0zLjY5NyAxLjkwN2ExLjAwNiAxLjAwNiAwIDAxLTEuNzUtLjI1OGMtLjgyMy0yLjI2Ni0yLjAxLTQuMTcxLTMuNTI1LTUuNjYxLTMuODgtMy44MTYtOS4xODQtNC44NS0xNC4xOTUtMi43NjYtNC4xNyAxLjcyNy03LjQzNyA2LjcwMi03LjQzNyAxMS4zMjgiIGZpbGw9IiNGRkYiLz4KICAgIDwvZz4KICA8L2c+Cjwvc3ZnPgo=",          "name": "Amazon CloudWatch Logs"        },        "statements": [          {            "action": "logs:CreateLogGroup",            "effect": "Allow",            "resource": "*",            "service": "logs",            "source": {              "index": "0",              "policyName": "AWSLambdaBasicExecutionRole",              "policyType": "managed"            }          },          {            "action": "logs:CreateLogStream",            "effect": "Allow",            "resource": "*",            "service": "logs",            "source": {              "index": "0",              "policyName": "AWSLambdaBasicExecutionRole",              "policyType": "managed"            }          },          {            "action": "logs:PutLogEvents",            "effect": "Allow",            "resource": "*",            "service": "logs",            "source": {              "index": "0",              "policyName": "AWSLambdaBasicExecutionRole",              "policyType": "managed"            }          }        ]      }    },    "roleName": "MyProject-EdgeFunctionFnServiceRoleC7B72E4-1DV3AZXP558ZS",    "trustedEntities": [      "lambda.amazonaws.com",      "edgelambda.amazonaws.com"    ]  }I just tried using the Test in the Lambda Panel. All the tests send logs to the CloudWatch. However when I send request to the CloudFront, it didn't send anything.UPDATE 2I just found out from StackOverflows that the log is being stored not centrally but distributed to regions.  Something like below/aws/lambda/us-east-1.MyProject-EdgeFunctionFn44308ADF-loJeFwXXzTOmSo instead of opening it from Lambda panel, I need to open it in the CloudFront panel. Somewhat I couldn't find it in any AWS documentations.Referenceshttps://aws.amazon.com/id/blogs/networking-and-content-delivery/aggregating-lambdaedge-logs/https://stackoverflow.com/questions/66949758/serverless-aws-lambdaedge-how-to-debug#:~:text=Go%20to%20CloudWatch%20and%20search,%2D%3E%20Lambda%40Edge%20Errors%20.FollowComment"

Answer: "0Accepted AnswerOh I think I see now, this is an issue I've faced before with lambda@edge logs too. The logs print to cloudwatch log groups in whatever region was used to accent the content. Since the lambda@edge replicates in all of the used Edge locations, while you're dealing with 1 lambda function you're actually dealing with up to a few dozen lambda@edge functions. So look in Cloudwatch Log Groups for edge lambda log groups in all regions close to where you are located.To find that in the CloudFront panel go to Telemetry->Monitoring, Choose the Lambda@Edge tab, select the appropriate lambda version, then in the top right corner there will be a dropdown called View Function Logs - there you can see all the regions where logs are available.CommentShareSteven_Ganswered a year agopetrabarus a year agoJust curious though, I only notice that it is mentioned in AWS blog but I couldn't find it in any documentations. I am wondering if that is the case, or it is actually mentioned in docs but I missed it.Sharepetrabarus a year agoNever mind. It's mentioned here. My bad.https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-cloudwatch-metrics-logging.htmlShare0Make sure the role's trust policy for the lambda@edge lists two principles: lambda.amazonaws.com and edgelambda.amazonaws.com. If it only has the first one you'll need to add a custom role to the edge function in the cdk:new Role(this, 'Lambda-Edge-Role', {      assumedBy: new CompositePrincipal(          new ServicePrincipal('lambda.amazonaws.com'),          new ServicePrincipal('edgelambda.amazonaws.com'),      ),       managedPolicies: [           ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole')      ]}I believe the EdgeFunction construct is supposed to do that automatically but since it's experimental it's worth it to make sure.CommentShareSteven_Ganswered a year agopetrabarus a year agoI just posted the Role document. It seems that it is correct because I just tried using the Test in the Lambda Panel, and all the tests send logs to the CloudWatch. However when I send request to the CloudFront, it didn't send anything. Seems like I am missing something.Share"


Question: Account level IAM vs IAM Identity Center

"We have multiple AWS Accounts that all have their own individual IAM Users/Groups and permissions. These are all from acquisitions. We've created an AWS Organization and enabled all features.My question is, when we add an external IDP for SSO, will the Users/Groups at the Account level IAM remain intact? Based on the documentation I believe they will, and at this point we can start migrating the Users/Groups out of the Account level IAM and into the Org level SSO?Some of these accounts are critical and I just want to be really clear before I potentially make a huge mistake.FollowComment"

Answer: "0Accepted AnswerCorrect, when you enable AWS IAM Identity Center (formerly SSO), nothing happens to your existing IAM users, groups, roles or policies in the accounts.  You can continue to use them in parallel with SSO.See this previously answered question:https://repost.aws/questions/QUfNomVCt5TCiac7oQoT8n0A/can-i-keep-existing-iam-users-and-add-sso-to-our-accountsCommentShareEXPERTMatt-Banswered 8 months ago"


Question: Lambda is triggering multiple times and it sends duplicate emails

"Hi,I've configured a Lambda to send emails via ses using nodeJS and it is being triggered via pg_cron - a postgres CRON-based Lambda invocation.Problem that I'm facing is multiple invocation of same lambda is happening in seconds even if my frequency of invoking lambda function is 2 mins or 5 mins. This is causing duplicate emails at destination and seems intermittent too.Any help or suggestion would be helpful.Thank you!FollowComment"

Answer: "0There could be two root cause of your problem.SES is sending duplicate emails. Although SES is designed to send only one copy of the message but if in case it don't receive an acknowledgement from the recipient email server then it treat it as a failure and would do a retry of that message. please check for the duplicate message if the message id is same or not.Duplicate invocation of lambda. first check your cron scheduler. second, review your cloud watch logs check if the duplicate invocation has same request id? if it is a duplicate invocation , use this configuration to handle the retries - https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-errorsCommentSharedinsajwaanswered 23 days agoSaif Ali Khan 17 days agoI've checked the logs and the request-id seems different, check the image I posted. Any thoughts?Share0Another possibility is that your Lambda function is raising an exception after sending email, triggering the Lambda service to retry.  This would be visible in the Lambda function logs which you've probably already checked though.CommentShareEXPERTskinsmananswered 23 days agoSaif Ali Khan 17 days agocheck the image I posted below. It just took seconds in the next invocations though I have configured 2 min scheduleShare0CommentShareSaif Ali Khananswered 17 days ago"


Question: instead of using docker ip address of container how can app use assigned IP address of AWS Lightsail

"Hi,I have a static IP address assigned to AWS Lightsail instance. This IP Address was cleared for me to get access to MariaDB. I am now using docker for my project and docker has another IP address than that of the instance. This results in an error stating: "IPxxx" is not allowed to connect to this mariadb server. Is there anything I have to do within AWS to get this access? Thanks in advance.FollowCommentPavel - AWS 7 months agoNeed clarification, please. Are you asking how to run a docker container so that it looks as if its network requests originate from the instance on which it runs?Sharedivyashie_16 7 months ago@Pavel-AWS yeah that's exactly what I am looking for if it's possible, thanksShare"

Answer: "1From description in docker reference, you'll probably want to run on host network: --network host option. Please check out other network options in the reference, and see which  likely applied to your use case. But to me it sounds like you need host.With the network set to host a container will share the host’s network stack and all interfaces from the host will be available to the container.CommentSharePavel - AWSanswered 7 months agodivyashie_16 7 months agoHey, I tried using network_mode: host in my docker-compose file. However, I get an error that: "host" network_mode is incompatible with port_bindings. Prior to host, I was using bridge network and basically the error that I get on AWS Lightsail "172.19.0.2' is not allowed to connect to this MariaDB server" where "172.19.0.2" is the app container IP address.Sharedonleyataws 7 months agoThe port bindings settings are only available in certain networking modes. In "host" mode, since your services running inside the container are sharing the host's network stack, any service you start there will bind to the port on the host. This means that port bindings are essentially meaningless in this mode and should be removed from your docker file and/or startup parameters.Share0Is this an RDS MariaDB instance running inside AWS or is it RDS running on EC2 or is it RDS running on-prem?When you say "This IP Address was cleared for me to get access to MariaDB" what exactly do you mean?Also is the docker container running inside an EC2 or on an on-prem machine?If everything is running inside AWS, you may want to check the security group around RDS MariaDB allows inbound traffic on the MariaDB port from the security group of the EC2 instance on which docker is running.It will be more helpful if you can provide an architecture diagram?CommentShareEXPERTIndranil Banerjee AWSanswered 7 months agodivyashie_16 7 months agoHi, MariaDB is running separately not in AWS. I am referring to the static IP address of my AWS Lightsail instance. I meant "whitelisted" so that I can only get access to MariaDB if I am requesting through this IP address. The docker container is running inside my AWS Lightsail instance. I do not have an architecture diagram really.Share"