Question: How to track usage of bandwidth allowance? Is it aggregated?

"Hi,I read the FAQ concerning bandwidth billing. I still have following questions:1.) Is bandwidth allowance aggregated on an account basis?Let's say I have two LS-instances. Both come with an bandwidth allowance of 1TB. Both are running throughout the entire month. Instance-A uses up 1.2TB of outgoing traffic. Instance-B uses up 10GB. Will I have to pay an overage?2.) Where can I track the bandwidth usage? Currently I'm using vnstat but obviously I'd like to see it somewhere on the lighsail-console-page.Thank you!FollowComment"

Answer: "2I wrote code that makes JSON output in a more readable format(Using jq):aws lightsail get-instance-metric-data --instance-name Ubuntu-512MB-Tokyo-1 --metric-name NetworkOut --period 2628000 --start-time 1546304400 --end-time 1893456000 --unit Bytes --statistics Sum | jq -r '.metricData[] | "\(.timestamp | strftime("%Y-%m-%d")): \(.sum/1024/1024) MB"'Output:2019-05-02: 679.5360774993896 MB2019-06-02: 1300.1841659545898 MBCommentShareghostiamanswered 4 years ago1That sadly answers neither my first or second question.The "Billing and Account Manangement" under https://amazonlightsail.com/docs/ doesn't give me enough information. Is bandwidth allowance aggregated on an account basis? Let's say I have two LS-instances. Both come with an bandwidth allowance of 1TB. Both are running throughout the entire month. Instance-A uses up 1.2TB of outgoing traffic. Instance-B uses up 10GB. Will I have to pay an overage?NetworkIn and NetworkOut shows the hourly usage for the maximum timespan of two weeks.I want to know if I'm close to reaching my monthly allowanceCommentShareAnotherGuyanswered 6 years ago0Hello,Thank you for using Lightsail.Currently, the best way to gauge your usage is to monitor the NetworkIn and NetworkOut on the Instance metrics page.You can find some information about how network transfer billing works under "Billing and Account Manangement" at https://amazonlightsail.com/docs/.Thank you,GabrielCommentShareGabriel - AWSanswered 6 years ago0Hello,I've escalated your questions to someone who can answer in greater detail.Thank you,GabrielCommentShareGabriel - AWSanswered 6 years ago0Hi,The data transfer quotas are on a per-instance basis, so you would be charge 0.2TB overage in the scenario you describe.There is unfortunately no total metering of your instance data transfer. The best way to currently see if there is an overage charge is to set up a billing alarm:http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/free-tier-alarms.htmlWe're working on surfacing more data about your instance data transfer levels.ThanksCommentShareAWS-User-4674287answered 6 years ago0Thank you for the answer!The overage should show up as operation "Bundle:1GB" in the cost-explorer, right? So that way I should be able to monitor any costs and not be surprised at the end of the month?CommentShareAnotherGuyanswered 6 years ago0So there is an option of getting the bandwidth usage for an instance using the CLI. I had to play around a bit and found out that there only will be an output if the unit used is Bytes. Megabytes, etc does not work and results in an empty output.Documentationhttp://docs.aws.amazon.com/cli/latest/reference/lightsail/get-instance-metric-data.htmlExample usage:aws lightsail get-instance-metric-data --instance-name Amazon_Linux-1GB-Virginia-1 --metric-name NetworkOut --period 2700000 --start-time 1488326400 --end-time 1490100240 --unit Bytes --statistics SumOutput:{    "metricData": [        {            "timestamp": 1488326400.0,             "sum": 2282458598051.0,             "unit": "Bytes"        }    ],     "metricName": "NetworkOut"}CommentShareAnotherGuyanswered 6 years ago0The instance name in this command is the one used in the "Name" tag?Does it have to be an instance that was launched using Lightsail?Edited by: es3web on Nov 13, 2018 1:33 PMCommentSharees3webanswered 5 years ago0Bandwidth monitors are helpful in telling how much data you used within a single day. Many corporations naturally propose their customers a bandwidth usage meter, which is the identical thing as a bandwidth monitor. Though, the bandwidth meters from most telecoms show how much data you’ve used in a day, week, and month. There are bandwidth monitors that are intended towards IT specialists, and others that everyone can easily utilize it. Here we will let you know which ones are the best Bandwidth Monitors in case you are looking for it but for more detailed description go for this website  https://appuals.com/real-time-bandwidth-monitors/1- PRTG Network Monitor: PRTG Network Monitor has a lot of detailed features that make it a controlling tool. You can simply check traffic volume at an IP level, though checking events. It can also act as a packet sniffer for an impression of Layer 4 services. PRTG Network Monitor has a complete dashboard of tools at your removal, such as a bandwidth monitor. It functions by observing sensors on your network. These devices such as things like the CPU load of your server, packet sniffing, traffic at a switch port, SNMP, and many others.2- BitMeter OS: BitMeter OS uses a web-based interface, which means to say that you can monitor the tool via a web browser. Otherwise, you can utilize the command-line interface. It does not have a lot of, but it covers the basics effortlessly. The time you introduce the web-interface, you will see a graph that recaps your network’s present download/upload rate, and the average and peak utilization.CommentSharenaheedkhan11answered 4 years ago0Those tools, while useful, won't accurately track the billable Lightsail traffic because all traffic goes over a single interface, regardless of if it is going to the internet or internal resources.If you have internal Lightsail resources (other instances, databases, S3, etc) then the data provided by those tools will inflated.davidCommentShareDavid Ganswered 4 years ago0jq FTW!I recently discovered that tool and find it invaluable.I'm using it for my LetsEncrypt DNS auth script (still working on it).CommentShareDavid Ganswered 4 years ago"


Question: How to deploy 4 lambdas in typescript using a code pipeline ?

"My customer is looking to deploy the app infra via a code pipeline which has the source, lint, compile, build, package and deploy stages. The lambda is in typescript and there are 4 lambdas which should be deployed for this app. Is there a need to have a different codepipeline for each lambda deployment or can I deploy all the lambdas in a single code pipeline. If there is a single pipeline, how will the app code linting, building, compiling and packaging happen for all the 4 lambdas ? Is it going to be in parallel? If yes, then would there 4 parallel runs of lint, compile and so on. Is there any reference architecture ?FollowComment"

Answer: "0Hello,You can use AWS SAM to deploy an application which could include 1 or more Lambda functions. With AWS SAM, you can deploy multiple functions in the same application easily.Here you can find more information on who to build and deploy resources using AWS CodePipeline with AWS SAM.But we highly recommend to analyze if those functions must be deployed in 1 or multiple pipelines following the Well Architected Framework.Regards.CommentShareJoan_Banswered a year ago"


Question: "Sorry, you've reached your maximum limit of Lightsail Instances"

"I can't create another "Instance" as I get the following error, "Sorry, you've reached your maximum limit of Lightsail Instances : 2. If you're new to Lightsail, please try again later. If the issue persists, please contact Customer Support."Why is this and how do I fix this?FollowComment"

Answer: 1You can request quota increases if your usage within a region exceeds the Lightsail quotas. https://docs.aws.amazon.com/general/latest/gr/lightsail.html .CommentShareleftbrainstuffanswered 2 months ago


Question: Is there a way to know if number of Load Balancer's backend changed?

"I frequently run below script to get actual IP addresses of ec2 instances working as a Load balancer's backend.TG_ELEMENTS=`aws elbv2 describe-target-health --target-group-arn $TG_ARN --query 'TargetHealthDescriptions[*].Target.Id' --profile $PROFILE`for i in $TG_ELEMENTS ; do    aws ec2 describe-instances --instance-id $i --query 'Reservations[].Instances[].PrivateIpAddress' --profile $PROFILEdoneMostly returned TG_ELEMENTS list is the same (scalling is not so frequent).I was wondering if there is a way to do some small query to know if target group / load balancer's backend change, and if so do some extra queries to get these IP address list?FollowComment"

Answer: "1This doesn't exactly answer your question but you may want to consider using eventbridge events for triggering an action for scaling activity. See here for list of events. You can for example get an event when a new instance is launched and trigger a lambda which can get any additional information you need (eg ip address) as the instance id is emitted in the event. You can then trigger any other action you need.Another common method to perform actions during scaling events is to use lifecycle hooks. With lifecycle hooks you can pause the scale out and scale in activities and perform a custom actionBoth these methods can be used to let you know the ip addresses of any instances which are being added to your autoscale groups. The actions could be send an SNS notification via email or update a dynamodb table to maintain an accurate list of ip addressesCommentShareEXPERTPeter_Ganswered 6 months agorePost-User-5949499 6 months agoThank you for your comment, I'll try it.I'm also open to any other suggestions in that matter.Share"


Question: Very high CPU steal after moving instance from eu-west-1 to eu-west-2

"Hi,I took an AMI of an EC2 instance in eu-west-1 and moved it to eu-west-2.Since then, I have been experiencing intermittent, but very severe, CPU steal.I suspect there is a noisy neighbour on the new London hypervisor as I changed nothing else (same instance size etc).See attached graph. The times are in UTC. The white gap is the time where I stopped the eu-west-1 instance (data on the left of the gap) and spun an AMI of it up at eu-west-2 (data on the right of the graph).https://imgur.com/a/R56dKyqThe instance id is i-0bbb311336550f3e9Any ideas? Can an engineer check for any other EC2 guest on this hypervisor at the shown times in the graph to see if there was excessive activity?Or are ECUs clocked/throttled differently at eu-west-2 even for the same t2.micro instance type?ThanksFollowComment"

Answer: 0Realised this was about CPU credit usage. Nevermind :)CommentSharemig5mxanswered 4 years ago


Question: Change platform of EC2 instance

How can I change a EC2 instance platform from using Linux 2 to Linux? The python version in the EC2 instance (a 3.7 version) is better suited for Linux (not Linux 2): https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html.Thank you - BrendanFollowComment

Answer: "0Based on my research the only option is to launch linux instancesCommentShareSandeepVudataanswered a year agoAWS-User-1377122 a year agoThank you. Actually, Linux 2 seems to be okay so far, so the issue is no longer urgent. Thanks again.Share"


Question: Clarification on OpenSearch Serverless pricing

"The pricing page states:Customers will be billed for a minimum of 4 OCUs (2x indexing includes primary and standby, and 2x search that includes one replica for HA) for the first collection in an account.And (for us-east-1) it gives the OCU pricing as "$0.24 per OCU per hour".Does this mean that the minimum cost for using OpenSearch Serverless is $700.80 per month ($0.24 x 4 x 730)?FollowComment"

Answer: "1Accepted AnswerAWS Director of Product Management for OpenSearch, Carl Meadows, just clarified this in a comment on the AWS Blog:That is correct - during the Preview - when you spin up your first collection - 4 OCUs will begin billing - which are redundant compute to support both indexing and search requests. The good news is that these OCUs can support multiple collections and will only scale up when more compute is needed to support your various workloads. As we go forward to GA and beyond we will look at additional options to help lower the entry point and drive greater cost efficiency like pause and reduce on indexing and search when there are no requests coming in etc.CommentShareajspetneranswered 6 months ago-2The minimum cost could be better estimated usinghttps://calculator.aws/#/addService/OpenSearchServiceI tried the below options to get an estimate. Please input based on your needs to come up with your closest estimate. Note: Actuals may vary from estimatesData instances - On demand -  c4.2xlarge.search 1 instance(s) x 0.587 USD hourly x (20 / 100 Utilized/Month) x 730 hours in a month = 85.7020 USD (Amazon OpenSearch Service data instance cost)Dedicated master instances - will be always at 100% utilization - c4.2xlarge.search 1 instance(s) x 0.587 USD hourly x (100 / 100 Utilized/Month) x 730 hours in a month = 428.5100 USD (Amazon OpenSearch Service dedicated master instance cost)Storage - GP3 - EBS - 100 GB - 100 GB x 0.122 USD x 1 instances = 12.20 USD EBS Storage Cost (gp3) General Purpose SSD (gp3) - Storage monthly cost: 12.20 USDCommentShareAnanth Tirumanuranswered 6 months agojesse360 6 months agoThe question was about Serverless OpenSearch, without running dedicated instances.If it were dedicated instances, I think the minimum price is $13.14/month, with a single t2.micro instance. That's why I'm so surprised that the serverless pricing has a $700/month minimum.Shareajspetner 6 months agoAs @jesse360 wrote, I am looking for clarification OpenSearch Serverless pricing. You provided dedicated pricing.Share"


Question: Can't empty (full!) bucket

"Somehow one of my S3 buckets got full of THOUSANDS of log files. I'm not sure what they are or how they got there, but there are tons of files that are 692(ish) bytes. I'm trying to empty the bucket to delete it, but every time I do that it takes so long to delete all the files that I think it gets stuck when my display goes to sleep. It's currently stuck after deleting 2,017,996 files that amount to 1.5 gig. Similar thing happened after leaving it on overnight last night. Any ideas how to get rid of this bin so I stop being charged for it? Is there some backend way to delete a bin without emptying it, or a hack to empty literally millions of files??FollowComment"

Answer: "2There are a variety of options you can use to empty a bucket. They are listed here.A really good option is to have lifecycle policies do the deletion (expiration) for you. See this link for setting up a lifecycle policy and this link specifically covers expiration. With this you can have the policy expire/delete any objects that are older than X. That should help you remove anything old. One thing to keep in mind is that there might be a delay between the expiration date and the date at which Amazon S3 removes an object. You are not charged for expiration or the storage time associated with an object that has expired.CommentSharePaul Frederiksenanswered a year agoRidgepointMatt a year agoI'll give this a try. I have a new rule set for current versions to expire after one day. That should do it, correct? Or do I need to do anything with noncurrent versions? (THANK YOU!!)SharePaul Frederiksen a year agoThat should do it! If you have versioning turned on, you may also want to include the noncurrent versions. If you don't have it on, you should be covered. Keep in mind that once the object is deleted, it's gone forever!Share0Accepted AnswerThank you, Paul! So far all my files are still there, so I just added a noncurrent rule to try that. I'll leave it over the weekend and hope to come back to an empty bucket next week. Thanks again.CommentShareRidgepointMattanswered a year agoPaul Frederiksen a year agoGlad I could help!Share"


Question: CloudFront giving access denied to subfolders

"Hello,I have one CloudFront site that will not display index.html folders off the main site.  These are discrete JavaScript map applications and keep all needed resources within their own root folder.This site points to a S3 bucket with public access and the correct GetObjects policy.  The static web site hosting all works fine and all folders and subfolders work without issue or error.In CloudFront both the cloudfront domain and the cname domain both show the root site without issue.  However and subfolder that contains an index.html file will only return the generic access denied xml response.  I have tried adding individual origins and behaviors (which I have never had to do for this kind of site) and nothing has worked.The only way I have these folders working is by adding them to other buckets/sites that are working.  All of the bucket settings are identical to those in the non working bucket.I have tried creating new buckets and cloudfront sites to no avail.Thanks for any help or suggestions.FollowComment"

Answer: 0I have figured out my issue.  When I created the distribution in CloudFront I must not have had static hosting turned on because the origin to the bucket did not include the s3-website-us-region in the name.  I have added the correct origin and issue is solved.CommentShareccheesemananswered 2 years ago


Question: failed to patch module botocore

"I am getting the following error in my Lambda logsfailed to patch module botocoreIts a Flask app deployed using Zappa. Essentially following the instructions athttps://docs.aws.amazon.com/xray/latest/devguide/xray-sdk-python-patching.htmlhttps://docs.aws.amazon.com/xray/latest/devguide/xray-sdk-python-serverless.htmlhere is the codeimport boto3from aws_xray_sdk.ext.flask.middleware import XRayMiddlewarefrom aws_xray_sdk.core import patcher, xray_recorderfrom aws_xray_sdk.core import patch_allpatch_all()Modules installed areaws-xray-sdk==2.11.0boto3==1.26.69botocore==1.29.69It is successfully patching the requests package.I want to try and resolve this as I believe my downstream calls to services like SSM and S3 are not being tracked in Xray.Thanks for any helpFollowComment"

Answer: "0The patch process is probably (I'm taking a little bit of a guess here) trying to overwrite the botocore and boto3 code in place. That's not going to work as a Lambda function can only write to /tmp. I'm not sure why the requests library is getting patched successfully - unless it is already at the version that you require.Instead, consider creating a Lambda Layer which contains the appropriate versions of the code that you need and then using that Layer with the Lambda function. This is the best solution if you have multiple functions using the same libraries.You could also create an archive of the entire function which includes the libraries you need. This is good if you only have a single function.Ideally, you don't want to patch at runtime as this will increase the cold start time of your function.CommentShareEXPERTBrettski-AWSanswered 3 months agorodos 3 months agoThe patch technique is dynamic in memory, not a file thing. It uses the python "wrapt" module. The actual patch code can be seen at https://github.com/aws/aws-xray-sdk-python/blob/master/aws_xray_sdk/ext/botocore/patch.pyI am still digging. I am finding others with related issues but nothing that has been able to resolve my core problem so far.ShareBrettski-AWS EXPERT3 months agoThe Lambda runtime environment is Firecracker which is a (deliberately) cut-down hypervisor and underlying operating system to allow for rapid start of Lambda functions and also aid in securing the system. This could also explain why patching in memory works on EC2 but doesn't in Lambda. So my suggestion above still stands: Start the execution of the function with the library versions that are required.Sharerodos 3 months agoIts not firecracker. The way you are describing firecracker as a cut down hypervisor resulting in a cut down Python in Lamba that is different to the Python on EC2 or any other environment is off track. Given some modules DO successfully patch that hypothesis is false anyway.  It's something about the context and a bit esoteric, but it will make sense when found. It may be the library version as you say, I just don't agree its because of the hypervisor or the inability to modify file system areas. Lambda yes, firecracker no.ShareBrettski-AWS EXPERT3 months agoWithout going through the Firecracker code as well as every step of the patch process I wouldn't rule it out - it would be quite easy to get (as you say) an inconsistent result where some patches work and others don't depending on what they (the patching processes) are doing. I've seen other cases where Python libraries work fine on EC2 but don't in Lambda because somewhere they require specific kernel calls or permissions that are not allowed or not present in the Lambda environment.Share0Hi,Does it help if you add import botocore at the top of your code?CommentShareEXPERTalatechanswered 3 months agorodos 3 months agoNo, according to the documentation you don't need to. Also checked the code for the SDK and it does this for you.From https://github.com/aws/aws-xray-sdk-python/blob/master/aws_xray_sdk/core/patcher.pyif module_to_patch == 'boto3':modules.add('botocore')I can patch it locally. So I think it relates to it being in Lambda.Share"


Question: Unable to upgrade RDS from gp2 to gp3 in management console

"See attached image. I am going to configure in the management console and set the storage type to gp3, that's it. It is automatically choosing the minimum/default values of 3000 IOPS and 125mbps for me. I have tried changing the disk size as well.You can't specify IOPS or storage throughput for engine postgres and a storage size less than 400.FollowCommentKameron_B a month agoHello - per the following docs: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html#gp3-storage any volume under 400GiB will result in the above message for Postgres RDS DB instances since 3,000 IOPS/125 MiBps is the only available specification. Just to confirm, if you did increase your volume size please be sure it is above 400GiB and it has been 6 hours since the modification.Share"

Answer: "1Accepted AnswerIf the console does not give the expected results, you can always use the CLI.This worked for me:aws rds modify-db-instance \    --db-instance-identifier your-instance-name \    --storage-type gp3 \    --apply-immediatelyCommentShareadrian-AWSanswered a month ago0In this case, you can either increase the storage size of your RDS instance to meet the minimum requirement of 400 GB or consider changing the database engine to one that allows you to specify IOPS and storage throughput for gp3 storage.If you decide to increase the storage size of your RDS instance, you can do so by modifying the RDS instance in the AWS Management Console and selecting a larger storage size. Keep in mind that increasing the storage size may also increase the cost of your RDS instance.Alternatively, you could consider changing the database engine to one that supports gp3 storage and allows you to specify IOPS and storage throughput. For example, the MySQL and Oracle database engines support gp3 storage and allow you to configure IOPS and storage throughput. However, keep in mind that changing the database engine may require you to modify your application code and database schema to ensure compatibility with the new engine.CommentSharehashanswered a month ago"


Question: Error: Invalid "caPath" option supplied

"Hi,I tried to connect my thing to the aws iot core and it was working perfectly locally but when I uploaded the code to the server I am getting this weird error:throw new Error(exceptions.INVALID_CA_PATH_OPTION);^Error: Invalid "caPath" option supplied.I tried every single root ca from this link https://docs.aws.amazon.com/iot/latest/developerguide/managing-device-certs.html but I'm getting the same error.Can someone help me ?FollowComment"

Answer: 0It turned out that you have to change the name of the file as well not just replace the file content.CommentShareGESanswered 4 years ago


Question: Aws Rds Setup With Phpmyadmin with snn

I can easily setup AWS rds with phpmyadmin but the problem come with SSL connection. I am totally confused with AWS bundle certificate also how to use it with phpmyadmin to encrypt the connection to rds from phpmyadminFollowComment

Answer: "1You can use the configuration provided inside the PHPMyAdmin configuration file.You can use the  below  Steps to  Configure the  SSL Connection  with RDS by using PhpmyadminDownload the Certificate Bundle by using the link form the AWS documentation https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.htmlGo to the Configuration File in Phpmyadmin https://www.apt-browse.org/browse/ubuntu/trusty/universe/all/phpmyadmin/4:4.0.10-1/file/etc/phpmyadmin/config.inc.phpUpdate the Properties with the Example Below, You need to add correct path of the rds-combined-ca-bundle.pem file. and the ssl_ca, ssl_key are optional i believe// Use SSL for connection$cfg['Servers'][$i]['ssl'] = true;// Client secret key$cfg['Servers'][$i]['ssl_key'] = // Client certificate$cfg['Servers'][$i]['ssl_cert'] = '/etc/mysql-certs/rds-combined-ca-bundle.pem';// Server certification authority$cfg['Servers'][$i]['ssl_ca'] = // Disable SSL verification (see above note)$cfg['Servers'][$i]['ssl_verify'] = false;If you have any troubles please let me knowCommentShareGanesh Kudikalaanswered a year ago0I followed this guidehttps://www.webagentnavigator.com/webagent-blog/creating-and-using-a-mariadb-database-on-amazonrdsAnd i am using ssl_ca to indicate to the bundled cert and not ssl_cert, it works but which should i use actually?Also the other option i am not Using like the key as AWS doesn't provide it.CommentShareOmanswered a year agoGk1234 a year agossl_ca is fine, as per the article you have shared, If it works, really great.Share"


Question: Impact of Adding NAT Gateway on Network Latency in a VPC with an On-Premise Gateway

"Hi, I have deployed an ECS Fargate using an existing VPC that has an on-premise gateway. The infrastructure was deployed using Terraform and, initially, the ECS was able to pull images from ECR. However, when I deployed the service using a GitHub action, the task was unable to pull images from ECR and timed out with an error message saying "unable to pull images from repository, API timeout." To fix this issue, I created a public NAT gateway associated with the VPC and created a NAT route to the private subnet.However, I have noticed that other services deployed in AWS are now reporting huge network latency when they connect to the on-premise. Could this be happening as a result of adding the NAT?FollowComment"

Answer: "1NAT Gateway won't add more than a few ms of latency. However, a NAT Gateway won't need to be in the path to connect to on-prmises. As long as there is a route in the private subnet(s) that routes to the on-premises gateway, traffic will not flow through the NAT Gateway.CommentShareAWS-James-Devineanswered 4 months ago"


Question: Allowing permission to Generate a policy based on CloudTrail events where the selected Trail logs events in an S3 bucket in another account

"I have an AWS account (Account A) with CloudTrail enabled and logging management events to an S3 'logs' bucket in another, dedicated logs account (Account B, which I also own).The logging part works fine, but I'm now trying (and failing) to use the 'Generate policy based on CloudTrail events' tool in the IAM console (under the Users > Permissions tab) in Account A.This is supposed to read the CloudTrail logs for a given user/region/no. of days, identify all of the actions the user performed, then generate a sample IAM security policy to allow only those actions, which is great for setting up least privilege policies etc.When I first ran the generator, it created a new service role to assume in the same account (Account A): AccessAnalyzerMonitorServiceRole_ABCDEFGHIWhen I selected the CloudTrail trail to analyse, it (correctly) identified that the trail logs are stored in an S3 bucket in another account, and displayed this warning messsage:Important: Verify cross-account access is configured for the selected trail The selected trail logs events in an S3 bucket in another account. The role you choose or create must have read access to the bucket in that account to generate a policy. Learn more.Attempting to run the generator at this stage fails after a short amount of time, and if you hover over the 'Failed' status in the console you see the message:Incorrect permissions assigned to access CloudTrail S3 bucket. Please fix before trying again.Makes sense, but actually giving read access to the S3 bucket to the automatically generated AccessAnalyzerMonitorServiceRole_ABCDEFGHI is where I'm now stuck!I'm relatively new to AWS so I might have done something dumb or be missing something obvious, but I'm trying to give the automatically generated role in Account A permission to the S3 bucket by adding to the 'Bucket Policy' attached to the S3 logs bucket in our Account B. I've added the below extract to the existing bucket policy (which is just the standard policy for a CloudTrail logs bucket, extended to allow CloudTrail in Account A to write logs to it as well), but my attempts to run the policy generator still fail with the same error message.{    "Sid": "IAMPolicyGeneratorRead",    "Effect": "Allow",    "Principal": {        "AWS": "arn:aws:iam::1234567890:role/service-role/AccessAnalyzerMonitorServiceRole_ABCDEFGHI"    },    "Action": [        "s3:GetObject",        "s3:GetObjectVersion",        "s3:ListBucket"    ],    "Resource": [        "arn:aws:s3:::aws-cloudtrail-logs-ABCDEFGHI",        "arn:aws:s3:::aws-cloudtrail-logs-ABCDEFGHI/*"    ]}Any suggestions how I can get this working?FollowComment"

Answer: "1Accepted AnswerHello,Based on the message being returned, it would indicate that the S3 bucket policy attached to S3 log bucket in Account B, is not allowing the IAM Access Analyzer Service-linked role in Account A, access to read the log files stored in the S3 log bucket. In case of using AWS KMS Key to encrypt Cloudtrail log files[1], the attached Key policy does not allow the Service-linked Role in Account A, access to decrypt the encrypted log files.As indicated in the AWS link here[2], you would need to ensure that the S3 log bucket in Account B, has the following bucket policy attached:{"Version": "2012-10-17","Statement": [{"Sid": "PolicyGenerationBucketPolicy","Effect": "Allow","Principal": {"AWS": ""},"Action": ["s3:GetObject","s3:ListBucket"],"Resource": ["arn:aws:s3:::<Log_Bucket_name>","arn:aws:s3:::<Log_Bucket_name>/AWSLogs/organization-id/${aws:PrincipalAccount}/"],"Condition": {"StringEquals": {"aws:PrincipalOrgID": "organization-id"},"StringLike": {"aws:PrincipalArn": "arn:aws:iam::${aws:PrincipalAccount}:role/service-role/AccessAnalyzerMonitorServiceRole*"}}}]}In case of using AWS KMS to encrypt Cloudtrail log files before storing them in the S3 log bucket, the attached KMS Key policy also needs to be updated, to allow the Service-linked role, to decrypt the encrypted log files:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"AWS": ""},"Action": "kms:Decrypt","Resource": "","Condition": {"StringEquals": {"kms:EncryptionContext:aws:cloudtrail:arn": "CROSS_ACCOUNT_ORG_TRAIL_FULL_ARN","aws:PrincipalOrgID": "organization-id"},"StringLike": {"kms:ViaService": "s3..amazonaws.com","aws:PrincipalArn": "arn:aws:iam::${aws:PrincipalAccount}:role/service-role/AccessAnalyzerMonitorServiceRole"}}}]}Additionally, if using ACLs to control access to the S3 log bucket in Account B, you may need to change the Object Ownership setting for your bucket. Set Object Ownership to one of the following options:Bucket owner enforced (recommended)Bucket owner preferred[1] Encrypting CloudTrail log files with AWS KMS–managed keys (SSE-KMS) - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html[2] IAM Access Analyzer policy generation - Generate a policy using AWS CloudTrail data in another account - https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation.html#access-analyzer-policy-generation-cross-accountI sincerely hope this helps!CommentShareSUPPORT ENGINEERBradley_Aanswered 10 months agorePost-user-2700970 10 months agoThanks Bradley - following the guidance in your 2nd link, I finally managed to get this working! I initially tried just updating the policy attached to the bucket, but it needed the suggested change to Object Ownership as well before I was successfully able to generate policies for my IAM users and roles. Many thanks for your help!Share"


Question: Deprecation of MySQL Amazon RDS running M3

"I have a Reserved instances rds m3.medium that is reserverd along 08 of March 2023, but AWS retired this instances.  I would like to cancel this RI.By e-mail Announcement of AWS quote:"How will my reserved instance(s) impacted?If you have Reserved Instances on M1, M2, M3, R3, or T1, you will be able to cancel them after you create new Reserved Instances for the same value or higher with M5, R5, or T3 respectively."Do I would like to know how to cancel this RI?FollowComment"

Answer: 1Accepted AnswerThank you for asking your question.Please open a support case to ask this? customer support team will be able to provide how to proceed this RI conversion process.I hope this might help.CommentShareYUTAKA_Hanswered 4 months ago


Question: There are 2 regions in my EC2 Container Registry

"Can i remove one of them, because i only use one region? If its possible, how is it?FollowComment"

Answer: "2Accepted AnswerHi,ECR allows to configure Cross Region Replication at the private registry settings level, which automatically copy images to multiple other repositories in different accounts and/or regions. Could you check if it is enabled?CommentShareMikel Del Tioanswered 8 days agorePost-User-6448003 8 days agoYes it's enabled, so I should choose one between region replication or account replication that's why I have two regions. Thank you for the answer!Share"


Question: SES - not able to receive emails from the containing domain btinternet.com?

"Hi,We are having an issue with a large number of customers not being able to email into our system due to the domain btinternet.com being blocked. is there a simple way to view all blocked IPs and addresses to see if it is just a simple case of adding the domain to the allowed domain list?Regards,AdamFollowComment"


Question: Automatic Fleet Creation

"Hello everyone! Currently I am working on a multiplayer game, while testing online matches using c5.xlarge fleets, I’ve found out that at least in the us-east-1 region the maximum number of instances is 15 for that instance type in that specific region, we know that AWS allow us to request a quota increase for it.Example case:Assuming we have 2 active fleets, what happens if both fleets are full and there are players wanting to join a game session, we use Flexmatch matchmaking and we know that a matchmaking ticket can wait until a game session is available for a player, but how could we create new fleets based on player demand so there will be always a game session available?.My questions are:Is there a way to automatically create additional fleets when needed based on some metrics?Does GameLift have an auto scaler for fleets or could we use a similar AWS service for that purpose, like creating new fleets when needed?Or are there any recommendations in a way to solve this requirement?Thank you everyone for your help beforehand.FollowCommentShahad_C 4 months agoNot a direct answer, so leaving a comment. You could use the Application AutoScaling service to register a Custom Scalable Target to scale the fleet.  Workflow:AutoScaling is given a metric by you to monitorWhen the metric is high, a request is sent to an API GatewayThe API Gateway config sends a call to GameLift increasing the fleet sizehttps://docs.aws.amazon.com/autoscaling/application/userguide/services-that-can-integrate-custom.htmlExample for Kinesis vs GameLift: https://aws.amazon.com/blogs/big-data/scaling-amazon-kinesis-data-streams-with-aws-application-auto-scaling/Share"

Answer: "0Hi,You can enable auto-scaling on a single fleet to ensure there is always sufficient capacity to meet increasing demand for game sessions. Please refer https://docs.aws.amazon.com/gamelift/latest/developerguide/fleets-autoscaling.html.For your use case, you could configure Target based auto-scaling which scales a fleet capacity based on the  PercentAvailableGameSessions metric. If you need more fine grained control you could also look into using Rule based auto-scaling policy.Thanks!CommentShareShashankJ_AWSanswered 3 months ago"


Question: Corn Job not working on AWS Lightsale wordpress

"We are using a plugin called: GPT AI Power: Complete AI Pack.The plugin require us to set up a cor job. we did follow their instructions on https://gptaipower.com/how-to-add-cron-job/Result, nothing is working on lightsale. the instructions work on a lightsale server with cpanel but not working on lightsale wordpress without cpanel.the plugin is saying:ImportantYou must configure a Cron Job on your hosting/server. If this is not done, the Bulk Editor feature will not be available for use.It appears that you have not activated Cron Job on your server, which means you will not be able to use the Bulk Editor feature. If you have already activated Cron Job, please allow a few minutes to pass before refreshing the page.FollowCommentAWS-raymond 2 months agoHello, what version of WordPress are you using on Lightsail?  The latest version of WordPress runs on Debian 11: https://aws.amazon.com/marketplace/pp/prodview-bzstv3wbn5wkq .  If you're using the latest version, you can refer to the help info of the Debian operating system for setting up the cron job.  Thanks.Share"


Question: Digital signature doesn't appear on pdf documents in Amazon Workdocs preview

Is there a way to see the digital certificate in pdf documents?But if I download the pdf the signature appears.FollowComment


Question: AWS IoT DynamoDB rule not able to read value SELECTed from topic() function

"I'm trying to get data from an AWS IoT MQTT topic into DynamoDB using a rule. An example topic is cooler/cooler42/sensors and example message{  "waterTemp": 10,  "timestamp": 1580370731383}I've defined the query like so, to extract the deviceName (e.g. cooler42) from the topic and insert it into the JSON:SELECT *, topic(2) AS deviceName  FROM 'cooler/+/sensors'This does indeed seem to work, as if I republish the message to another topic I now see the same JSON with deviceName added:{  "waterTemp": 10,  "timestamp": 1580370731383,  "deviceName": "cooler42"}My understanding is that all 3 fields should now be available for use within my DynamoDB rule like so:https://i.stack.imgur.com/gO9SG.pngHowever I can see from CloudWatch that the rule is failing with error One or more parameter values were invalid: An AttributeValue may not contain an empty string (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: ValidationException and the partition key (aka hash key) is coming through as empty:{    "ItemRangeKeyValue":"1580370731383",   "IsPayloadJSON":"true",   "ItemHashKeyField":"deviceName",   "Operation":"Insert",   "ItemRangeKeyField":"timestamp",   "Table":"SensorDataTest2",   "ItemHashKeyValue":""        <--- Empty}Am I not able to use the deviceName I've just SELECTed from the topic name in the rule? If not is there another way to extract it?NB If I manually publish a message onto the topic already including the deviceName then it does work fine, but I'm working in a constrained environment and don't want the extra payload size.NB I've also posted this question to SO:https://stackoverflow.com/questions/59982125/aws-iot-dynamodb-rule-not-able-to-read-value-selected-from-topic-functionFollowComment"

Answer: "0Accepted AnswerHi Taran,The question was answered on https://stackoverflow.com/questions/59982125/aws-iot-dynamodb-rule-not-able-to-read-value-selected-from-topic-function (Kudos to Ben T.)To paraphrase:You cannot reference an alias (i.e. deviceName) created using the AS clause in Action substitution templates. However, you can use the same operations in the Action substitution templates - in this case ${topic(2)} for DDB partition key value.CommentShareAWS-User-9734230answered 3 years ago"


Question: EC2: Tagging Metadata (Get Tag Created Date/Time)

"I hope you can help me.I would like to retrieve the timestamp of when a tag was last updated (or created if it's never been edited).I was hoping to use Python (with boto3) to retrieve this information.  I have investigated and it doesn't appear that this information is available.  Does anyone know any different?Many thanks in advance,LeeFollowComment"

Answer: "0Hi ThereIf you have CloudTrail enabled, you can retrieve the information from the trail.  For example, you can look for an event from the CreateTags API call on a particular EC2 instance.  (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTags.html)Here are instructions for viewing CloudTrail eventshttps://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-console.htmlCommentShareEXPERTMatt-Banswered 8 months ago"


Question: SSL Certificate Ineligible and not in use

I Purchased SSL certificate from 3rd party and upload the same in my AWS server as i have not renewed the SSL certification intime. After uploading the SSL certificate it is showing SSL Certifiticate is not in use and ineligible. Please help me out to resolve this issueFollowComment

Answer: "1If I'm understanding your question correctly, you uploaded your certificate into AWS Certificate Manager (ACM) but your certificate is ineligible for renewal because it has expired.  In this situation, the correct course of action is to request a new certificate.  See Renew ineligible ACM certificates for more details.CommentShareMiguelUTanswered 8 months ago"


Question: Issue importing an image as an AMI

"I am trying to import an image as an AMI and I keep getting the message below. I am using RHEL7. I have converted the file to raw. I have put the file in the S3 bucket.When I type the command belowaws ec2 describe-import-image-tasks --import-task-ids import-ami-(number)I get the following error."Status": "deleted","StatusMessage": "ClientError: No valid partitions. Not a valid volume.",I am running the following command to import the image as an AMI.aws ec2 import-image --description "Image Name" --license-type BYOL --disk-containers file://containers.jsonMy containers.json file looks like[{"Description": "Image Name","Format": "raw","UserBucket": {"S3Bucket": "my-import-bucket-name","S3Key": "imagename.raw"}}]Please advise. Note: When I posted this on here the formatting got messed up.FollowComment"

Answer: "0Hi THereYou mentioned that you converted the file format to raw.  What do you mean by that?  What environment are you exporting your VM from?  Can you try one of the other formats listed here?  https://docs.aws.amazon.com/vm-import/latest/userguide/vmimport-image-import.html#export-vm-imageCommentShareEXPERTMatt-Banswered 3 months agorePost-User-2968909 a month agoI used following command to create raw image : "qemu-img convert -O raw input_image.qcow2 output_image.raw". I think currently its a permission problem I am just not able to issue aws ec2 import-snapshot command due to some permission/role issues. The vmimport policy i added doesn't seem to work. Appreciate your prompt reply. Thanks much.SharerePost-User-2968909 a month agoThe disk is in raw format. It is supported as mentioned in the docs: When importing a VM as an image, you can import disks in the following formats: Open Virtualization Archive (OVA), Virtual Machine Disk (VMDK), Virtual Hard Disk (VHD/VHDX), and rawShare"


Question: AWS Partner Certification

"Hello,this is Rocco and I work for a AWS Partner so I have the access to some internal resources. Since I am studying for a Developer Associate certification, at certain point it is required to enroll the following courses:Advanced Developing on AWSPlanning and Designing Databases on AWSThey are courses enrlolled by third-part companies or by AWS. I would ask if I can partecipate to both of them for free next time they are provided (June, if I don't mistaken).Otherwise it will be appreciate where I can find the material to study by myself related to the courses.Thank you in advance,RoccoFollowComment"

Answer: "0Not sure why those two classes are listed. The AWS Ramp-Up Guide: Developer  is a good todo list for prepping for the exam.Another one in Skill Builder (requires as subscription): Developer Learning Plan (includes Labs).CommentShareEXPERTkentradanswered 2 months ago0Perfect Kentrad, thank you very much for the feedbackCommentSharerePost-User-6323336answered 2 months ago"


Question: ELB Returns 502

"Hi,I have a private EC2 instance that sits behind an internal ELB (single instance at the moment). The software runs in Wildfly 11.Target group shows it healthy. And I can use curl using ip address from another instance in a different vpc.I also have a separate private instance (with a index.html on apache) and an internal ELB that has no problem with curling ELB DNS.But it returns 502 when I curl the ELB dns name. Any idea where to look at?Access log entry,http 2019-11-11T22:57:04.899824Z app/DummyELB-2/b71c4db727f11413 172.31.14.179:60746 10.1.4.217:80 -1 -1 -1 502 - 127 293 "GET http://internal-dummyelb-2-1122730003.ap-southeast-2.elb.amazonaws.com:80/ HTTP/1.1" "curl/7.61.1" - - arn:aws:elasticloadbalancing:ap-southeast-2:xxx:targetgroup/DummyTG-2/738f12f02eeddb57 "Root=1-5dc9e740-f43a035fdc04fec2373217d6" "-" "-" 0 2019-11-11T22:57:04.898000Z "forward" "-" "-" "10.1.4.217:80" "-"ThanksEdited by: mumbo on Nov 11, 2019 6:25 PMFollowComment"

Answer: "0Hi Hlulanib,Well I thought it the same.But turned out to be a problem with how I setup  forwarding requests to port 8080 in the target group. I have set the override port to 8080 in the health check rather than in target group.CommentSharemumboanswered 4 years agoAWS-User-0538853 a year agoHi Mumbo, I tried doing this. Keeping only the health check default port as the same, but seems to still give the same issue. Can you explain what you mean by the target group port ?Share0Hi502 is an HTTP error that indicates that the load balancer was unable to parse the response sent from the registered instances.Looking at the access log entry you provided I see that the processing time values is set to -1 -1 -1 this happens if load balancer cant can’t dispatch the request to a registered instance. This can happen if the registered instances closes the connection before the idle timeout or if the client sends a malformed request. The value can also be set to -1 if the registered instance does not respond before the idle timeout.Backend instance could have closed the connection with a TCP RST or a TCP FIN while the load balancer had more request for the instance <<< so make sure the keep alive duration of the instance is shorter than the idle timeout value of the load balancer, making the keep alive duration of the load balancer greater than the instance, to ensure that the load balancer is responsible for closing the connection with your instance.Idle timeout range is from 1 to 4,000 seconds.Application Load Balancer idle timeout setting: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#connection-idle-timeoutClassic Load Balancer Idle timeout setting: https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/config-idle-timeout.htmlhope this helps.Thank youHlulanibCommentShareHlulanibanswered 4 years ago"


Question: Sync aws s3 glacier files not checking timestamp of file size but only file existence on destination ?

"How to sync aws s3 glacier files not checking timestamp of file size but only file existence on destination ?We regularly backed up our picture source files (it's about a couple of hundred thousands) to AWS glacier, using --size-only and --delete option (as timestamp of the files could be differ depending of the fact that editing software change timestamp every time it has been accessing a file). So that files only edited, so differed in size were synced, as well as those files that were no more existing on source were deleted on s3 destination. But recently when we changed the editing software version it had to upgrade its catalog and, much worse, while updating it wrote to some files such as JPG or DNG some inner metadata, which itself led to change in their size. Consequently, now --size-only option is not enough, it now doesn't matter at all as AWS tries to sync about 80% of files that were not updated by editing and don't have any actual differences on source, but about of metadata adding has tiny differences in size. In fact it looks like we have to re-upload 80% of the files again, without any reasons to.So I wonder, is there a possibility to sync local and s3 buckets based only on the existence of a file, not about its timestamp of size ?FollowComment"


Question: Is App Runner (ECR) compatible with ARM64 CPU architecture?

"When deploying an application in App Runner through an ECR image I'm getting the following error inside the container: "exec format error". The docker image was built on a MacBook Air M1 laptop. After some googling, the error message seams to indicate an issue related to the cpu architecture.I found support for ARM64 in ECS (https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-arm64.html), but it requires some special configuration on the task to indicate the cpu architecture. I can't find documentation that explains if ARM64 is supported by App Runner or not.In case it is not supported, it will be great to have this kind of information in the App Runner FAQ or a limitations page in the service documentation.FollowCommentYusufVendii 6 months agoHi, I'm not sure Apprunner supports ARM64 yet. Here is an open request for it on the AppRunner roadmap. https://github.com/aws/apprunner-roadmap/issues/98You can also add your voice by upvoting the request.Share"


Question: Why decreasing UDP traffic for a constant data rate?

"I send UDP traffic from/to AWS to/from an external network device (outside AWS). The constant data rate that I configure to send by an application is 1 Mbps. At the starting time, it seems to be sending/receiving this constant data rate. However, suddenly it goes down to less than 1 Mbps (e.g. 600kbps). Why could this be happening?FollowComment"

Answer: "0I work with an EC2 instance which, particularly, is a t2.xlarge being up to 1 Gbps of network performance. Then I launch an application that generates UDP traffic with a rate of 1Mbps. Then I do not understand why the constant data rate of 1 Mbps reduces to 600kbps when the network performance is up to 1Gbps.CommentShareAWS-User-2490495answered a year agoBrettski-AWS EXPERTa year agoBear in mind that t2 instances are a previous-generation instance; perhaps t3 might be better. Also: t2 and t3 work on CPU credits; so if you consume your CPU credits the performance of the instance will be slower; and that may lead to the data rate going down because there isn't enough CPU resources to process your stream. Check CloudWatch Metrics to see what is happening with CPU credits. A m5 instance might be better in this case.Share0Is your application in an EC2 instance?  Network performance has a baseline + burst bandwidth.  You may be exceeding the baseline and eventually running out of burst capacity.  This page provides a bit of transparency though it's a few years old now - https://cloudonaut.io/ec2-network-performance-cheat-sheet/CommentShareEXPERTskinsmananswered a year ago"


Question: Dynamodb Cross account and cross region private access

"Hi all,I have a DynamoDB table managed in account A in the region R1.A client (Lambda) in account B in region R2 has to read this table from account A/R1The requirement is that the traffic shall not go over the public Internet.What is the best way to establish it?I'm trying to use VPC peering between A and B accounts and connect to VPC endpoint for Dynamodb. But as far as I understand it's not possible :(FollowComment"

Answer: "0Hello,Have you taken a look at this solution?https://repost.aws/knowledge-center/vpc-endpoints-cross-region-aws-servicesCommentSharetyler_applebaumanswered 2 months agoalex-filichkin 2 months agoIt's not relevant.Share0From the VPC FAQ:Q. Does traffic go over the internet when two instances communicate using public IP addresses, or when instances communicate with a public AWS service endpoint?No. When using public IP addresses, all communication between instances and services hosted in AWS use AWS's private network. Packets that originate from the AWS network with a destination on the AWS network stay on the AWS global networkThe use of a public IP address on a network does not mean the traffic is necessarily going across the internet. What the statement above is saying is that the public IP addressing AWS uses is routed on the AWS network. If the traffic is between two IP addresses that are owned by AWS then it does not go over the internet.So for your situation: You can have a Lambda function in one region access DynamoDB in another region and it stays on the AWS network - it does not go over the internet.As for the DynamoDB VPC Gateway Endpoint: It is only accessible from within the VPC that it is created in which is why VPC peering won't work in this case.CommentShareEXPERTBrettski-AWSanswered 2 months ago"


Question: Aws athena- query both s3 and rds

"We are currently aws thena to analyze event data that we save as jaon to s3 using firehouse and it works well. Now we would like to perform queries that 'join' the s3 data with data from our rds mysql database. How can this be done? (Btw, we are using Tableau to query the data)FollowCommentSanjeeb 3 months agoYou can try the option to take the S3 data to Tableau ( see the link - https://www.tableau.com/blog/how-get-access-amazon-s3-data-directly-tableau) and do the join of S3 and RDS at tableau side and meet your requirement.Share"

Answer: "0Hi,Amazon Athena is a service that enables a data analyst to perform interactive queries in the Amazon Web Services public cloud on data stored in Amazon Simple Storage Service (S3).Unfortunately, we cannot use schemas from RDS is Athena. As a work around you can use Glue ETL to join these two tables i.e one in Athena and one in RDS (both maintained in Glue Catalog).You can use glue crawler with connection to the RDS table to create the schema.https://docs.aws.amazon.com/glue/latest/dg/add-crawler.htmlhttps://docs.aws.amazon.com/glue/latest/dg/console-connections.htmlFor example of joining tables in ETL please check on the below link as a reference:https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-python-samples-legislators.htmlI hope above information is helpful. If you are facing any issue and require technical guidance you can reach out to the AWS Support team.Have a good day :)CommentShareAWS-User-4025440answered 4 years ago0Hi there!As of now, previous answer is not only option you have to query multiple data sources from Athena.Now you can use Athena Federated Query that allows you to run queries with data from S3, Amazon DynamoDB, Apache HBase, Amazon DocumentDB, Amazon Redshift, Amazon CloudWatch Logs, AWS CloudWatch Metrics, and JDBC-compliant relational data sources such MySQL, and PostgreSQL under the Apache 2.0 license.Refer to this link for more information about how to achieve this: https://aws.amazon.com/blogs/big-data/query-any-data-source-with-amazon-athenas-new-federated-query/CommentShareMiguel Romeroanswered 2 months ago"


Question: Route 53 - domain verification failure

"Hi there,I bought a domain through Route 53 and was trying to link the domain that I bought with WorkMail in AWS also because I would like to use the domain for my business.All records were put in Route 53, and the NS is matching with the record too. However, the status is still pending so far.Could anyone help with this issue?My domain is luminous-edu.comKindly regards,ShawnFollowComment"

Answer: "0Hi Shawn,I'm sorry to hear you're experiencing problems with the verification of your domain. I checked your domain and indeed the NS records seem to be correct but I am unable to resolve any of the required domain records on your domain.Can you double check that the domain records are correctly added in Route 53?Kind regards,RobinCommentShareMODERATORrobinkawsanswered 3 years ago0Hi Robin,Thank you for your reply.I double-checked the TXT record and it is matching with the value in WorkMail.I even put the alternative TXT record in Route 53, but it is still pending.Even I wasn't sure If I needed to put the TXT record in my Lightsail, I put it in the Lightsail too.I'm using the domain for the Lightsail too.So far, I only put TXT records to verify the domain.Can you kindly check again?Regards,Taesung KimCommentSharetskimanswered 3 years ago0Hi Taesung Kim,I can now resolve your TXT domain record and looking in our systems I can see that the domain is verified now.When using LightSail you need to add the domain records in LightSail as this is the authority over the domain and not Route 53. To complete adding the domain to WorkMail you can add all required records in LightSail and you should be good to go.I will check with the service team if we can update documentation for this.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 3 years ago"


Question: AWS Update Payment Method - Unable to add new credit card or bank account

"Every time I try adding a new billing method in "My Billing Dashboard > Payment Methods", I am given an error message similar to this one."Your card ending in #### was not added. Please verify the card information and try again."I have tried 3 credit cards and 2 bank accounts to update my AWS service billing method and have received a similar error message each time.Is there an alternative way to add a new billing method to get around this error? I have been using the same credit card for over a year but had to cancel it last month, so I currently do not have a valid credit card on my AWS account.Edited by: AndrewB192 on Oct 22, 2018 3:05 PMEdited by: AndrewB192 on Oct 22, 2018 3:05 PMFollowComment"

Answer: "0Hi AndrewB192,Sorry to hear of the trouble you've had adding a new payment method.AWS accepts most major credit and debit cards, please have a look at this page for info on Managing Your AWS Payment Methods: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-payment-method.html#designate-defaultAlso, please reach out to Accounts and Billing Support team who will be provide further direct assistance: https://console.aws.amazon.com/support/v1#/case/createRegards,Amy J.CommentShareMODERATORAWS Support - Amy Janswered 5 years ago0Hi AndrewB192,Thank you for following through by reaching out via the Support Center concerning this.I've reviewed the case you provided and do see it has now been updated with the need for further actions to be taken on your end.Please follow up further on this matter via your case, as to ensure we can have this matter resolved.Thank you for your patience and understanding surrounding this matter.Kind regards,Craig E.CommentShareEXPERTAWS Support - Kraiganswered 5 years ago0Hi Amy, I reached out to the support team on October 21st. They stated that they were escalating my case on October 22nd. However, I haven't heard from them yet and have not been able to get my payment info updated.I am really worried at this point that AWS will not allow me to update my billing info in time to make my payment due date.My case number is 5*********, any help is appreciated!CommentShareAndrewB192answered 5 years ago0Thanks Craig. The support team was able to help me and I have been able to successfully update my payment methods!In case anyone else runs into this issue, I was unable to update my payment information because I had an access key that the AWS team identified as being compromised. After I deleted the key, I received an email thanking me for deleting the compromised key and I was able to add a new CC to my payment methods.Edited by: AndrewB192 on Oct 30, 2018 2:50 PMCommentShareAndrewB192answered 5 years ago0Hi AndrewB192.I have the same problem:Your card ending in **** is not supported for payments to AWS seller in your region. Please try adding one of the following supported cards: mastercarddebit, MasterCard, American Express or Visa.How did you remove access key? I'm not able to login to the console.CommentShareannesiukanswered 2 years ago"


Question: AWS Glue Job Error - Exception in User Class

"I'm trying to run a simple AWS Glue job to convert a file from CSV to Parquet. Does anyone know what this error means?2021-08-11 05:40:28,288 ERROR glue.ProcessLauncher (Logging.scala:logError(91)): Exception in User Classjava.lang.reflect.UndeclaredThrowableExceptionat org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1862)at org.apache.spark.deploy.SparkHadoopUtil.runAsSparkUser(SparkHadoopUtil.scala:64)at org.apache.spark.executor.CoarseGrainedExecutorBackend$.run(CoarseGrainedExecutorBackend.scala:188)at org.apache.spark.executor.CoarseGrainedExecutorBackend$.main(CoarseGrainedExecutorBackend.scala:281)at org.apache.spark.executor.CoarseGrainedExecutorBackendPlugin$class.launch(CoarseGrainedExecutorBackendWrapper.scala:10)at org.apache.spark.executor.CoarseGrainedExecutorBackendWrapper$$anon$1.launch(CoarseGrainedExecutorBackendWrapper.scala:15)at org.apache.spark.executor.CoarseGrainedExecutorBackendWrapper.launch(CoarseGrainedExecutorBackendWrapper.scala:19)at org.apache.spark.executor.CoarseGrainedExecutorBackendWrapper$.main(CoarseGrainedExecutorBackendWrapper.scala:5)at org.apache.spark.executor.CoarseGrainedExecutorBackendWrapper.main(CoarseGrainedExecutorBackendWrapper.scala)at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)at java.lang.reflect.Method.invoke(Method.java:498)at com.amazonaws.services.glue.SparkProcessLauncherPlugin$class.invoke(ProcessLauncher.scala:47)at com.amazonaws.services.glue.ProcessLauncher$$anon$1.invoke(ProcessLauncher.scala:75)at com.amazonaws.services.glue.ProcessLauncher.launch(ProcessLauncher.scala:123)at com.amazonaws.services.glue.ProcessLauncher$.main(ProcessLauncher.scala:29)at com.amazonaws.services.glue.ProcessLauncher.main(ProcessLauncher.scala)Caused by: org.apache.spark.SparkException: Exception thrown in awaitResult:at org.apache.spark.util.ThreadUtils$.awaitResult(ThreadUtils.scala:226)at org.apache.spark.rpc.RpcTimeout.awaitResult(RpcTimeout.scala:75)at org.apache.spark.rpc.RpcEnv.setupEndpointRefByURI(RpcEnv.scala:101)at org.apache.spark.executor.CoarseGrainedExecutorBackend$$anonfun$run$1.apply$mcV$sp(CoarseGrainedExecutorBackend.scala:201)at org.apache.spark.deploy.SparkHadoopUtil$$anon$2.run(SparkHadoopUtil.scala:65)at org.apache.spark.deploy.SparkHadoopUtil$$anon$2.run(SparkHadoopUtil.scala:64)at java.security.AccessController.doPrivileged(Native Method)at javax.security.auth.Subject.doAs(Subject.java:422)at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1844)... 17 moreCaused by: java.io.IOException: Failed to connect to /172.36.215.7:35553at org.apache.spark.network.client.TransportClientFactory.createClient(TransportClientFactory.java:245)at org.apache.spark.network.client.TransportClientFactory.createClient(TransportClientFactory.java:187)at org.apache.spark.rpc.netty.NettyRpcEnv.createClient(NettyRpcEnv.scala:198)at org.apache.spark.rpc.netty.Outbox$$anon$1.call(Outbox.scala:194)at org.apache.spark.rpc.netty.Outbox$$anon$1.call(Outbox.scala:190)at java.util.concurrent.FutureTask.run(FutureTask.java:266)at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)at java.lang.Thread.run(Thread.java:748)Caused by: io.netty.channel.AbstractChannel$AnnotatedConnectException: Connection refused: /172.36.215.7:35553at sun.nio.ch.SocketChannelImpl.checkConnect(Native Method)at sun.nio.ch.SocketChannelImpl.finishConnect(SocketChannelImpl.java:716)at io.netty.channel.socket.nio.NioSocketChannel.doFinishConnect(NioSocketChannel.java:323)at io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.finishConnect(AbstractNioChannel.java:340)at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:633)at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:580)at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:497)at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:459)at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858)at io.netty.util.concurrent.DefaultThreadFactory$DefaultRunnableDecorator.run(DefaultThreadFactory.java:138)... 1 moreCaused by: java.net.ConnectException: Connection refused... 11 moreEdited by: jinsanz on Aug 11, 2021 8:54 AMEdited by: jinsanz on Aug 11, 2021 8:55 AMEdited by: jinsanz on Aug 11, 2021 8:56 AMFollowComment"

Answer: "0I had this exact problem/error.I solved the problem by upgrading the job to use Glue 3.0 with Spark 3.1.  Glue version 2.0 with Spark version 2.4 gets this error.  I am using Python as the ETL language.  My connection is JDBC to a SQL Server database.  The Crawler works just fine so the connection and database and tables are in good order.Add a little more detail for @enricu :I have the older configuration running in production but have not touched it.  It still runs ok.  I was replicating that job in a lower environment to test changes to the ETL.   So if you need to make changes to an existing implementation you will probably need to upgrade.  This may or  may not be impactful depending on your implementation.Job that errors:Name<JobName>IAM role<JobRole>TypeSparkGlue version2.0Python version3Spark version2.4ETL languagepythonNew Job that does not experience that error:Name<JobName>IAM role<JobRole>TypeSparkGlue version3.0Python version3Spark version3.1ETL languagepythonEdited by: mystic on Sep 22, 2021 4:40 PMCommentSharemysticanswered 2 years agoPatryk 5 months agoIn my case, I'm using Glue 4.0 and I'm getting the same problem. However it started occurring when I've tried to consume parquet files, that AWS DMS generated. It works fine for files, that I generate with Python pandas library and dataframeShare0Right now I have same problems as your. So please tell me if you passed it and how do you do? Thank you.CommentShareduongnhanswered 2 years ago0I'm having the same issue... The thing is that it worked before. I made a few changes to my CF and after that it started failingCommentShareEnricuanswered 2 years ago0After going through all of the logs ("All logs" link in the runs list), I've found the real cause of the issue, which was a typo in SQL statement. Try to go through all of the logs, so you might find more details about this issueCommentSharePatrykanswered 5 months ago"


Question: AWS client VPN - SSH to EC2 instance with custom ssh port

"We just set up a AWS client VPN, associated with private subnet and route traffic through NAT gateway to internet. This way to get a static public IP.We have debian EC2 instances with custom SSH port, for example port 56565 instead of port 22. When connected with AWS client VPN, we were not able to SSH to the EC2 instance with ssh port 56565. Have verified all the security groups, network ACL and routing, seems like the AWS client VPN is blocking the non-standard ports. Anyone has some insight on this? Is it possible to configure it?FollowComment"

Answer: "1Do you have a rule set up in the security group that EC2 has to allow connections from the security group that AWS Client VPN has?I don't think AWS Client VPN is doing anything to deny communication.Also, make sure that all communications are allowed in the outbound rules of the AWS Client VPN security group.CommentShareEXPERTRiku_Kobayashianswered a month agorePost-SL-Wang a month agoHi, thanks for the suggestions!For EC2 instance security group, I have allowed the VPN external IP for All traffic and All ports(for testing purpose)AWS VPN security group also has All traffic allowed in the outbound rule.For the same EC2 instance, I'm able to ssh into it on Port 22 with VPN connected, but not able to connect when the ssh port is set to 56565.To me, looks like there is some default restrictions on the special ports.Share0AWS Client VPN does not block other ports.Please check below guide, specifically step 5 "Provide access to the internet" and step 6 "Verify security group requirements".https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/cvpn-getting-started.htmlCommentShareMatt_Eanswered a month agorePost-SL-Wang a month agoHi, I'm able to access the internet and also able to ssh to the same EC2 instance when ssh port is set to 22.ShareMatt_E a month agoMake sure port 56565 is being allowed on the EC2 security group, the target EC2.Make sure port 56565 is being allowed on the EC2 ACL.Make sure port 56565 is being allowed on the CVPN ENI subnet ACL. When you create your CVPN is going to be associated with one or more than one subnet, make sure port 56565 is being allowed on all the subnets ACL that are associated with CVPN ENI's, for instance, you may have 3 subnets for your CVPN (subnet A, subnet B, and subnet C) each of those subnets may have a different ACL, you would need to make sure those subnets allow port 56565.If all above being checked and still unable to connect, I suggest checking your EC2 VPC flow logs to see if traffic is reaching the EC2.Share"


Question: How to establish connection between Unity and AWS DynamoDB for WebGL platform ?

"Hello,I'm trying to establish a connection between DynamoDB and Unity to do CRUD operation on a WebGL platform using AWS mobile SDK for unity. In editor mode we are able to do read and write operation but if we take WebGL build and run it in browser there AWS is not talking with Unity. I tried by creating Lambda function to have a gateway for Unity and AWS DynamoDB to establish connection, but still couldn't achieve it.Please guide me on how I can fix it and over come this hurdle.Thank you,LakshmanFollowComment"


Question: AWS MSK connector for datagen source is failing without errors

"Hi ,We have a msk cluster provisioned and try to create custom connector datagen source for s3, but its failing without errors, we can only see below logs in broker logs:[2022-08-26 12:52:00,713] ERROR [ReplicaFetcher replicaId=3, leaderId=1, fetcherId=1] Error for partition __amazon_msk_connect_offsets_S3-Sink-Orders_ae585cdd-321c-4e70-8de0-a115ed0e127b-4-13 at offset 0 (kafka.server.ReplicaFetcherThread)org.apache.kafka.common.errors.UnknownTopicOrPartitionException: This server does not host this topic-partition.[2022-08-26 12:52:00,713] ERROR [ReplicaFetcher replicaId=3, leaderId=1, fetcherId=1] Error for partition __amazon_msk_connect_offsets_S3-Sink-Orders_ae585cdd-321c-4e70-8de0-a115ed0e127b-4-19 at offset 0 (kafka.server.ReplicaFetcherThread)org.apache.kafka.common.errors.UnknownTopicOrPartitionException: This server does not host this topic-partition.[2022-08-26 12:52:00,713] ERROR [ReplicaFetcher replicaId=3, leaderId=1, fetcherId=1] Error for partition __amazon_msk_connect_offsets_S3-Sink-Orders_ae585cdd-321c-4e70-8de0-a115ed0e127b-4-7 at offset 0 (kafka.server.ReplicaFetcherThread)org.apache.kafka.common.errors.UnknownTopicOrPartitionException: This server does not host this topic-partition.[2022-08-26 12:52:00,713] ERROR [ReplicaFetcher replicaId=3, leaderId=1, fetcherId=1] Error for partition __amazon_msk_connect_offsets_S3-Sink-Orders_ae585cdd-321c-4e70-8de0-a115ed0e127b-4-1 at offset 0 (kafka.server.ReplicaFetcherThread)org.apache.kafka.common.errors.UnknownTopicOrPartitionException: This server does not host this topic-partition.FollowComment"


Question: "Redshift Maximum tables limit exceeded problem, how to prevent this behavior"

"Hi,we have recently deployed our data warehouse into Production. There is lot of ETL done using stored procedures within Redshift.my ETL workflow is as follows,Data from DB2 system is staged within Redshift. and then the data is moved into Data warehouse using Redshift procedures. I have a 2 node RA3 cluster. (with node Type: ra3.xlplus)every now & then my ETL is failing with following errorSQL Error [XX000]: ERROR: Failed to incorporate external table "xxxxxx.covera" into local catalog. Maximum tables limit exceeded. The maximum number of tables per cluster is 20000 for this instance type. The limit includes permanent and temporary tables.In my ETL redshift procedures,I use cross database queries in the procedures.I cannot disable Temporary Tables as we are using CTE, and local temp tables to perform ETL using Redshift procedures.when I queried STV_TBL_PERM, I see there are lot of Temporary Tables created within Redshift, I have seen ~20000 tables. I can understand why I am getting above error.I am not able to understand the need for this temporary tables by redshift, and why are they persisted forever.Table name looks exactly like this localhost@232987@465587@  .how can I delete these temporary tables automatically?Can you please give some insight.RegardsShivFollowComment"

Answer: "0Hello Shiv,The limit on maximum number of tables includes permanent tables, temporary tables, datashare tables, and materialized views. External tables are counted as temporary tables. Temporary tables include user-defined temporary tables and temporary tables created by Amazon Redshift during query processing or system maintenance. Views and system tables aren't included in this limit.https://docs.aws.amazon.com/redshift/latest/mgmt/amazon-redshift-limits.htmlWork-around :-I would suggest you to delete unnecessary local tables, this includes permanent and temporary tables or consider resizing to 4xlarge/8xlarge/16xlarge node type which can have a maximum of 100,000 tables.https://docs.aws.amazon.com/redshift/latest/dg/r_CREATE_TABLE_usage.htmlThank you !CommentSharePriyaAWS2020answered a year ago"


Question: Cannot restore RDS snapshot

"I am unable to restore a snapshot as of 4pm central today. I restore 2 snapshots throughout the day, and when I tried to start a restore this afternoon, I am unable to select the same options as before. I do not have the option to select provisioned or available versions anymore. Has anyone seen this happen before? How can I fix this?FollowComment"

Answer: "0Hi AWS-Phil-PB,From the notes, I understand that you are unable to restore your RDS snapshot as you are unable to select some options. Please correct me if my understanding is wrong.As a workaround to your issue, I recommend to try using other tools like RDS API or AWS CLI to perform the restore. Below is an example of AWS CLI command to restore from the snapshotaws rds restore-db-instance-from-db-snapshot --db-instance-identifier db7-new-instance --db-snapshot-identifier db7-test-snapshot --db-instance-class db.t3.smallPlease see the documents in links [1], [2] for steps and how to use AWS CLI as well as RDS API for restoring from a snapshot.I hope the above information is helpful.References:[1] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_RestoreFromSnapshot.html#USER_RestoreFromSnapshot.Restoring[2]https://docs.aws.amazon.com/cli/latest/reference/rds/restore-db-instance-from-db-snapshot.htmlCommentShareAsisiphoanswered a year ago"


Question: Athena Query result giving back empty table

"Hi! I used Athena Query maker to take some data from a CSV file and create a table and database from it. I've added all the columns that I have in my CSV, including the correct types (timestamp, string), the query is correct, it runs, but I get an empty table as an output. I can't tell where is the problem, any idea helpsThe query:CREATE EXTERNAL TABLE IF NOT EXISTS `flightsfromcsv`.`detailsofflight` (  `Departure` timestamp,  `From` string,  `Arrival` timestamp,  `To` string,  `Companyinfo` string )ROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe'WITH SERDEPROPERTIES ('field.delim' = ',')STORED AS INPUTFORMAT 'org.apache.hadoop.mapred.TextInputFormat' OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'LOCATION 's3://nameofbucket/'TBLPROPERTIES ('classification' = 'csv');The CSV has only the " , " delimiter and it contains the following columns: Departure, From, Arrival, To, CompanyinfoFollowComment"

Answer: "0Athena suggests to use lower case for table names and table column names. Please refer below linkhttps://docs.aws.amazon.com/athena/latest/ug/tables-databases-columns-names.htmlCommentShareKirananswered 5 months agorePost-User-1415664 5 months agoI changed it to lowercase, still outputs an empty table..Share0Hello,I noticed that in location parameter for Create Table you have provided backet name only (LOCATION 's3://nameofbucket/'). Make sure that this bucket only consist csv data with schema provided in table DDL. I am suspecting this backet consist other folders and files due to which Athena generated emplty results. Please check this location again and if ithis bucket consist other folder and files, then move the csv file to different prefix and in location provide s3 location till prefix which consist csv files with mentioned schema.CommentShareShubham_Panswered 5 months ago0After creating table you need to add partitionsMSCK REPAIR TABLE <tablename>;CommentShareMilindOkeanswered 5 months ago"


Question: Does an S3 bucket have to be provided for a Braket DWave run?

In the braket examples for DWave machines there is the use of an S3 bucket to store results.  I find this useful when running in non-blocking mode but in the case where I am willing to wait for the results this pushing of the results to an S3 bucket as well seems like a waste that I need to clean-up later.  Can the storage of results to S3 be turned off?FollowComment

Answer: "0S3 is fundamental to the operation of the Braket service; there really isn't any notion of running a task without a bucket (unless you're using the local simulator), since all results will ultimately have to be retrieved from S3.CommentShareCodyanswered 3 years ago0Thank you.CommentShareAussieV123answered 3 years ago"


Question: AD Connector-Unable to connect to the On-Premises Active Directory

"I am trying to create a AD Connector to connect to On-prem Active Directory. I am seeing the below errorConfiguration issues detected: SRV record for LDAP does not exist for IP: 10.0.0.10, SRV record for Kerberos does not exist for IP: 10.0.0.10. Please verify existing configuration and retry the operation.FollowComment"

Answer: "1AD Connector uses Kerberos for authentication and authorization of AWS applications. LDAP is only used for user and group object lookups (read operations). With the LDAP transactions, nothing is mutable and credentials are not passed in clear text. Authentication is handled by an AWS internal service, which uses Kerberos tickets to perform LDAP operations as a user.AD Connector needs to obtain the _ldap._tcp.<DnsDomainName> and _kerberos._tcp.<DnsDomainName> SRV records when connecting to your directory. You will get this error [2]  if the service cannot obtain these records from the DNS servers that you specified when connecting to your directory. For more information about these SRV records, see SRV record requirements -- [1]Error Link-https://docs.aws.amazon.com/directoryservice/latest/admin-guide/prereq_connector.html#srv_records -- [1]https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ad_connector_troubleshooting.html -- [2]CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months ago"


Question: Replace root keypair for ec2 instance

"Hello There,my question is:How do I replace the root (default) keypair for my ec2 instance, in my ec2 dashboard?I know how to add (delete) public ssh keys in the .ssh/authorized_keys file on the machine (linux),but I want to completely replace my root keypair,ALSO in my ec2 dashboard.Goal is, to make it impossible to login with the old root keypair onto the machine(neither from ssh client nore ec2 instance connect),and only with the new one.I found it impossible to replace my ec2 root keypair in my ec2 dashboard;and even if I delete its public ssh key in the authorized_keys file,I am still able to connect ...If not with ssh cient, so at least with ec2 instance connect, which clearly uses the old root keypair.Seems to me, as if the default keypair is binned to the ec2 instance.So, there must be a solution to this.Otherwise it means that you cannot replace the default root keypair for your ec2 instance.Thanks for an answer.AndyFollowComment"

Answer: "1Accepted AnswerHi,It is unclear to me what you mean by "root keypair", but perhaps you'll find the information you need in the following documentation:Delete your public key on Amazon EC2 - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/delete-key-pair.htmlAdd or remove a public key on your instance - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/replacing-key-pair.htmlI hope this helps!Kind regards,MarilynAWSCommentShareMarilynAWSanswered 10 months agoEXPERTkentradreviewed 10 months agoandy 10 months agoThanks.I mean the default keypair, which you give your instance, when you start it for the first time.You can see the keypair name in the ec2 instance settings.You can use it to ssh into your machine with username root / or ec2-user.I don't know how to replace this one keypair.Although I deleted public keys for both, root user & ec2-user, I still can login to my machine from my ec2 dashboard (ec2 instance connect) -with both, root or ec2-user.How is this actually possible?It shouldn't be, right?I would like to be able to replace that keypair, which is binned to my ec2 instance, and delete it.There seems to be no solution for this.You guys from aws need to think about how users may replace that default (beginner) keypair with another one.ShareMarilynAWS 10 months agoHi Andy,The public key is stored in two different places:In Amazon EC2On the instanceIf you want to get rid of the key pair on your instance, you must delete it from the instance. The documentation at this link https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/replacing-key-pair.html explains how to do it.On the page linked above, we say this:When you launch an instance, you are prompted for a key pair. If you specify a key pair at launch, when your instance boots for the first time, the public key material is placed on your Linux instance in an entry within ~/.ssh/authorized_keys.To delete the public key from the instance, you need to edit ~/.ssh/authorized_keys and delete the public key in that file. The steps for how to do this are in the page linked above.Kind regards,MarilynShare0Thanks Marilyn.As for my purpose, I found the solution.I replace public keys for root & for ec2-user on my instance;afterwards no one can login into my server using the old private key.However, although I deleted these public keys, I am still able to login to my instance via ec2 instance connect.How is this possible?! (I thought ec2 uses the private key for this; as it seems it may uses a different approach and I can login to my machine without usage of any keypairs from ec2 dashboard?)The 'old' (default/beginner) keypair is still being shown as default keypair in my ec2 instance dashboard. - I don't know how to replace that here.My wish would be, that there is a way to delete this old key, and replace it.Also in the ec2 dashboard.[And that even via ec2 instance connect, I won't be able to login to my machine anymore, once I deleted the old public key / replaced keypair.]It is a strange feeling, that I am still able to connect to my instance via ec2 instance connect, although I have deleted the public key (for my beginner/default instance keypair) on the machine.Thank you,God bless,AndyCommentShareandyanswered 10 months agoMarilynAWS 10 months agoHi Andy,I'm sorry this is so confusing! Hopefully the information below will clear things up. I'll have to post multiple comments due to the restriction of number of characters allowed in a comment.ShareMarilynAWS 10 months agoHowever, although I deleted these public keys, I am still able to login to my instance via ec2 instance connect.How is this possible?! (I thought ec2 uses the private key for this; as it seems it may uses a different approach and I can login to my machine without usage of any keypairs from ec2 dashboard?)Answer:This is how EC2 Instance Connect works: When you connect to an instance using EC2 Instance Connect, the EC2 Instance Connect API pushes a one-time-use SSH public key to the instance metadata where it remains for 60 seconds. An IAM policy attached to your IAM user authorizes your IAM user to push the public key to the instance metadata. The SSH daemon uses AuthorizedKeysCommand and AuthorizedKeysCommandUser, which are configured when EC2 Instance Connect is installed, to look up the public key from the instance metadata for authentication, and connects you to the instance.You can find more information about EC2 Instance Connect at this link: https://docs.aws.amazon.com/en_us/AWSEC2/latest/UserGuide/Connect-using-EC2-Instance-Connect.htmlEC2 Instance Connect is not using your key pairs that you created and uploaded to Amazon EC2 or which you created by using Amazon EC2. EC2 Instance Connect creates its own one-time use keys. The IAM policy will restrict who can connect to the instance with EC2 Instance Connect.ShareMarilynAWS 10 months agoThe 'old' (default/beginner) keypair is still being shown as default keypair in my ec2 instance dashboard. - I don't know how to replace that here.Answer:The EC2 instance dashboard continues to display which key pair was specified at launch, even if you delete that key pair. We mention that here in the doc: https://docs.aws.amazon.com/en_us/AWSEC2/latest/UserGuide/describe-keys.html#identify-key-pair-specified-at-launch. Please see the note in the blue box that calls this out.ShareMarilynAWS 10 months agoMy wish would be, that there is a way to delete this old key, and replace it. Also in the ec2 dashboard.Answer:The EC2 dashboard just shows what key was specified at launch. If you've subsequently deleted the key from the instance, you won't be able to connect to the instance using that key. I'm sorry that this is confusing.ShareMarilynAWS 10 months agoIt is a strange feeling, that I am still able to connect to my instance via ec2 instance connect, although I have deleted the public key (for my beginner/default instance keypair) on the machine.Please read the documentation about EC2 Instance Connect at this link: https://docs.aws.amazon.com/en_us/AWSEC2/latest/UserGuide/Connect-using-EC2-Instance-Connect.htmlYou can allow who can access an instance by creating an IAM policy and attaching that IAM policy to any user who should connect to your instance.I hope this helps! It's a lot of info to take in, but hopefully by reading the documentation carefully, you'll get the information you need.Share0Thank you very much Marilyn.That was a Very good answer to my question!CommentShareandyanswered 10 months agoMarilynAWS 10 months agoYou're welcome! Glad I could help.Share"


Question: Request: Support for ".jetzt" Domains

Please consider supporting ".jetzt" TLD. Thank you :-)FollowComment

Answer: "0Unfortunately the Norwegian ccTLD .no is not currently supported on Route 53 for domain registration. However, you can still purchase the domain from another registrar and point the domain name servers to Route 53.For a list of currently supported ccTLDs, you can find the list here: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/registrar-tld-list-geographic.htmlCommentShareEXPERTChris_Ganswered a year ago"


Question: My domain - with an elaborate WordPress site has gone missing

"We created 2 instances and built a WordPress website on one of them - and set it so that   'aarkt.com' "pointed" to that WordPress site.By mistake we changed the IP address of the 'A' record for aarkt.com to be the IP address of the "empty" instance. The site disappeared (no surprise).We changed the IP address of the  'A' record for aarkt.com back to the instance where we had built the WordPress site but the website did not return. Various attempts to locate that WordPress install have failed. And aarkt.com still points to "nowhere".We do not have "AWS CloudTrail console" - but that should be irrelevant given that we know the correct/original IP address anyway.Detail:The 2 instances that were created were:a) Instance ID i-06a5e30bd17282e83 with Public IPv4 address of  3.12.166.41b) Instance ID i-0d1bb4797af9333f0 with  Public IPv4 address of  3.80.147.131We changed the 'A' record IP address from 3.12.166.41 to 3.80.147.131 and aarkt.com vanished. Of course: Instance ID i-0d1bb4797af9333f0 (with  Public IPv4 address of  3.80.147.131) has nothing in it.The problem is that when we changed the IP address of the 'A' back to 3.12.166.41, the WordPress install that we set up in Instance ID i-06a5e30bd17282e83 did not re-appear.Obviously we must have changed something else by accident. We were attempting to set up an SSL certificate at the time, maybe "something got in the middle" so to speak.The ultimate goal of course is to "get the site back" - to have 'aarkt.com' point to the WordPress site we set up in instance a (see above).A good start might be getting access to the (rather elaborate) WordPress site that was set up using instance a, and then worry about making aarkt.com point there.Note: we do not have "AWS CloudTrail console" or any other tracking program set up.FollowComment"

Answer: 0You should login to the AWS console and check the public IP addresses of the instances and compare to your notes.  If you stop an instance and then later start the instance the public IP can/will change.  If you intend to have a static IP address that does not change when the instance is stopped you will need to allocate an Elastic IP (EIP) and then associate it with the instance.  The below link provides deeper info on Elastic IPs.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.htmlCommentShareEXPERTiBehranswered a month ago


Question: Not able to connect ESP8266 to AWS CORE

"Hi I am trying to connect to AWS IOT core with my ESP8266 , but not able to do so.It just prints ............ but not connected , I am not able to figure out what the issue is?FollowCommentSidd 9 months agoI am using the same code as mentioned here, In my console, I am not able to connect with AWS. Please see the thread I have added images there too.https://repost.aws/questions/QUmMfkh_RUQPKviKPSsZm0pQ/esp-8266-keeps-disconnecting-with-aws-iot-getting-client-errorShare"

Answer: "0Accepted AnswerHi Sidd. You said you use the same code as that question. Some points:have you created a Thing named ESP8266 in AWS IoT Core?have you created a certificate and private key and installed them on your device?is that certificate registered in AWS IoT Core, activated, and attached to your ESP8266 Thing?are you using the same IoT policy as shown in that other question? is it attached to your certificate? (please be aware that the policy shown in that other question is setup for the ap-south-1 region and it has a fake account number.)is the MQTT_HOST value in your firmware correct for your account and region?Have you enabled CloudWatch logging? https://docs.aws.amazon.com/iot/latest/developerguide/monitoring_overview.html Do you have any errors in CloudWatch?CommentShareEXPERTGreg_Banswered 9 months agoSidd 9 months agoYes, I have created, the thing and attached the policy accordingly.2.Yes installed the certificate while creating the thing.I'm not sure about the third point. How to do that, it is attached to thing I think?Yes using the same value.5.Yes copied it directly from the settings.Issue may be in 3, 4 point I think.ShareSidd 9 months agoIn place of resource ARN I have given '*' , so that It allows everything.ShareGreg_B EXPERT9 months agoThe policy needs to have your region and your account number (if you use the specific policy from the other question).To check certificate and policy attachment: AWS IoT Core console->All devices->Things->ESP8266->Certificates you should see the ID of the right certificate and Status should be Active. Then click on the Certificate ID and you should see the attached policies.ShareSidd 9 months agoHi Greg it worked , thanks for helping.Share"


Question: CloudWatch Logs Insights/Log Streams Timezone

"Is there a way to set the timezone to UTC instead of local timezone in Logs Insights for all users on a team? Similarly, is there a way to set all log groups/log streams to use UTC instead of local timezone besides doing all of them manually?FollowComment"


Question: Error on upgrading amplify GraphQL Transformer v1 to v2

"I'm using the guidelines on https://docs.amplify.aws/cli/migration/transformer-migration/ to migrate an Amplify Project from v1 to v2, but when I try to do an "amplify push" after succesfully ran "amplify migrate api" I'm getting this error:CREATE_FAILED      AuthRolePolicy049E37F651            AWS::IAM::ManagedPolicy     Thu Jan 13 2022 10:21:04 GMT-0300 (Argentina Standard Time) Cannot exceed quota for PoliciesPerRole: 20 (Service: AmazonIdentityManagement; Status Code: 409; Error Code: LimitExceeded; Request ID: 430bca73-5e2f-47a9-8f99-d1b1ed4e9483; Proxy: null)Before the migration I didn't have any quota limitation issue, I don't know if it is related to the migration or if it's a limitation of the new transformer version.What can I improve on my schema.graphql to reduce the value on "PoliciesPerRole"?Thanks!FollowComment"


Question: Can Cognito be configured to not require email verification when users sign up?

"In order to reduce friction for new users when starting out, I want to configure Cognito to allow new users to access my app without having to verify emails first.Is there a way to do this?FollowComment"

Answer: "0I believe this is related to the selection of MFA and/or your options for which attributes you want to verify for purposes of self-recovery of forgotten passwords. Under "MFA and verifications" on the Cognito user pool's console do you have "no verification" selected? If not, try that selecting "No verification."On the Cognito dashboard under attribute verification it says:"Verification requires users to retrieve a code from their email or phone to confirm ownership. Verification of a phone or email is necessary to automatically configure users and enable recovery from forgotten passwords."Note that if you go with the "no verification" option then users may not be able to reset their own passwords, which may not be what you want.You could also consider to automatically confirm users from a registered domain (see link below):https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-sign-up.htmlHope this helps.CommentShareAWS-User-4441565answered 2 months ago"


Question: Cloudformation  AWS::RDS::DBInstance.Properties.Engine aurora-mysql value for version 8 (Aurora 3.x)

I am writing a Cloud Formation Template to create a new Aurora MySql version "8" cluster/database and I see that the value for Engine is either:aurora (for MySQL 5.6-compatible Aurora).aurora-mysql (for MySQL 5.7-compatible Aurora).https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbinstance.html#cfn-rds-dbinstance-engine.Is there a value for a MySQL 8.x compatible Aurora?Or do I have to create the "aurora-mysql (for MySQL 5.7-compatible Aurora)" version and then upgrade it to version 8 (or 3.x).OR do I use the EngineVersion property some how?ThanksFollowComment

Answer: "0Accepted AnswerThis CLI command will return the valid values:aws rds describe-db-engine-versions --engine aurora-mysql --query 'DBEngineVersions[?contains(SupportedEngineModes,provisioned)].EngineVersion'CommentSharemarkwilhelmanswered 2 months ago0Thank you for asking your question.To create Aurora MySQL3 (MySQL8.0 compatible version), you can use aurora-mysql as Engine, and set EngineVersion like 8.0.mysql_aurora.3.03.0This is document issue, I'll open internal ticket for this.I hope this might help.CommentShareYUTAKA_Hanswered 2 months agomarkwilhelm 2 months agoThank you, this was helpful. I also found a command (afterwards) that lists the values:aws rds describe-db-engine-versions --engine aurora-mysql --query 'DBEngineVersions[?contains(SupportedEngineModes,provisioned)].EngineVersion'.Returns...["5.7.mysql_aurora.2.07.0","5.7.mysql_aurora.2.07.1","5.7.mysql_aurora.2.07.2","5.7.mysql_aurora.2.07.3","5.7.mysql_aurora.2.07.4","5.7.mysql_aurora.2.07.5","5.7.mysql_aurora.2.07.6","5.7.mysql_aurora.2.07.7","5.7.mysql_aurora.2.07.8","5.7.mysql_aurora.2.11.1","5.7.mysql_aurora.2.11.2","8.0.mysql_aurora.3.01.0","8.0.mysql_aurora.3.01.1","8.0.mysql_aurora.3.02.0","8.0.mysql_aurora.3.02.1","8.0.mysql_aurora.3.02.2","8.0.mysql_aurora.3.02.3","8.0.mysql_aurora.3.03.0"]Share"


Question: Unable to view the dashboard

"When I clicked the dashboard link, it took me to the QuickSight default home page (not the dashboard view). If it's an access issue, I'd expect an error message indicating "no access", however there's no error returned and that's why I'm confused. Could anyone help me figure this out? Thanks!FollowComment"

Answer: "0Hi thereFrom the note I understand when you open a dashboard it takes you to the QuickSight default home page, not the dashboard view.Please note QuickSight is a default page when you want to open dashboard  from there you will see available dashboards, choose Dashboards at left. Choose any dashboard on the page you want to open it.I hope this helps.Reference:https://docs.aws.amazon.com/quicksight/latest/user/using-quicksight-ui-start.htmlCommentShareNonkululekoanswered a year ago"


Question: Denied as Amazon affiliate again !

"I am new to the Amazon affiliate program - I was given my user ID and after a week was denied. I have made multiple sales, posted the OA in my bio and created a website that I own (via purchase from godaddy)- www.amomazon.org - this is what my violation was - can someone help me understand ?The violation/s include the following:Your website is a search engine site which is not allowed in our program and does not meet our content standards. An example can be found here: https://Www.Google.comYour website/app is a popular site rather than a complete and valid URL owned by you where you intend to display links to Amazon. As a reminder, if you are applying using a social media page, we need the full URL for your individual page on that site in order to process your application. An example can be found here: https://Www.GoDaddy.com  Help !FollowComment"

Answer: 1The domain name is almost identical to amazon.com so it like you are pretending to be Amazon.Change that domain name / company name and you can become an affiliate.CommentShareCarlos Marlianswered 3 months ago