Question: OnPressed event fired multiple times for single key-press

"hi.I use InputEventNotificationBus to get input, but the OnPressed event is fired multiple times for single key press!Follow"

Answer: "0Accepted AnswerHi there! you could try to use InputChannelEventListenerexample code hereSharerePost-User-2514050answered 4 years ago0I noticed that the OnPressed() function is called once for each input component.So if you have 4 input components, that function will be called 4 times.SharerePost-User-3337236answered 4 years ago0That's what I was looking for.Thanks.SharerePost-User-3337236answered 4 years ago0Another feature to be aware of is: consuming or not consuming events. Those callbacks have a bool return value that allows you to indicate if you wish to consume the event.SharerePost-User-9447706answered 4 years ago0Hi @REDACTEDUSERIf I understand it, it's used for ui purposes?SharerePost-User-3337236answered 4 years ago0Thank you for the clarification.SharerePost-User-3337236answered 4 years ago0Yes but it's a more general idea that some listener have a higher priority than others and can consume those events.SharerePost-User-9447706answered 4 years ago0See a comment here:dev\Code\Framework\AzFramework\AzFramework\Input\Events\InputChannelEventListener.h        //! Override to be notified when an input channel is active or its state or value is updated,//! unless the event was consumed by a higher priority listener, or did not pass the filter.//! \param[in] inputChannel The input channel that is active or whose state or value updated//! \return True if the input event has been consumed, false otherwisevirtual bool OnInputChannelEventFiltered(const InputChannel& inputChannel) = 0;SharerePost-User-9447706answered 4 years ago"


Question: Should we combine or split application and Infrastructure code for microservice projects deployed in EKS.

"We are designing the architecture of a microservice solution where,We will have tens of container-based microservices deployed in the EKS cluster.Our microservices are java spring boot applicationsThere will be base infrastructure components such as VPC, Subnets, CloudFront, EKS, ALB, etc.There will be infrastructure components shared across multiple microservices such as RDS, EFS, API Gateway, etc.Each microservice could have its own dedicated cloud infrastructure (DynamoDB, SQS, etc.).We will be using AWS CDK for deploying all the infrastructure components (3,4 and 5).In addition to infrastructure components we will have Kubernetes configurations such as helm, configmap, policy as code (PoC) components related to OPA policies, Monitoring As code components etc. associated with each microservice.We are trying to figure out an appropriate Git repository structure here. A few things we already decided to do are the following.Have CDK code for the base infra (3) and shared infra (4) in a single GitRepo and manage the deployment of it through some infra pipeline separately.Each springboot microservice will have its own application Git Repositories which will be tied up with its own codepipeline CI process that builds the container and registers in ECR upon commits at the main branch (trunk-based model).The confusion we have here is where to store the infrastructure code that is associated with each microservice (items 5 and 7 in the above list). We thought of two options here and we find merits and demerits to both the options.Option#1 : Keep the infra codes ( 5 & 7) related to the microservices in the application repository associated with the microservice.ProsEasy to sync application and infra changes together as it's in a single repo. Infra and app changes can be deployed together and roll back together as well.ConsSince app and infra codes are stored in the same repo, any infra change could trigger the app build pipeline.  And similarly, an app code change could trigger automated infra deployment pipelines (if we have an automated CDK deployment pipeline). Considering app build is part of the CI process and infra deployment falls into the CD part, it would be tough to manage the CI/CD pipeline efficiently.Typically CI jobs would initiate code scans, code coverage checks, container scans etc. we wouldn't want to trigger those CI stages for simple changes in the infra segment of the code such as a change in configuration item or change in monitoring as a code component etc.In the standard CI/CD pipeline, after the docker container is built and registered in ECR repo, the container tag will be updated in the helm configuration (which is now stored in the app repository), this could trigger the CI flow again.In CD pipeline we typically execute automated E2E test, API test etc. One wouldn't want them to be triggered for simple infra changes alone.Option#2  : Each microservice will have two repositories. One for keeping the application code, and another one for keeping all the infrastructure code (5 & 7) associated with it.ProsIsolation between infra and application codes enables us to segregate CI and CD processes without conflict.ConsIt would be challenging to sync application and infra changes as they are now in two different repositories.Our question is ,Looking at various articles, there are multiple ways to do it, but we would request advice from AWS community what is the best repo design that suits our unique case explained above.Do you have any specific advice on how infra associated with a microservice (CDK) and app container deployment in EKS can be integrated in a single deployment pipelineReference materials usedhttps://devops.stackexchange.com/questions/12803/best-practices-for-app-and-infrastructure-code-repositorieshttps://www.youtube.com/watch?v=MeU5_k9ssrshttps://www.youtube.com/watch?v=f5EpcWp0THwFollowComment"

Answer: "0All good questions and references. I may bring a third option (or variation of option 1) to the table since you will be deploying to EKS.Define your application specific resources through Kubernetes manifest files. You could either use AWS Controllers for Kubernetes (ACK) or Crossplane to achieve that.This would keep everything in the same repo, you have your app CI triggered by an app code change, and the resource deployment would be handled by the CD part when you deploy your Kubernetes manifests. (maybe using a GitOps operator such as ArgoCD or Flux)CommentShareogaumondanswered a year ago"


Question: 'Permission denied' connecting from instance to database

"I cannot connect from my Lightsail instances to the Lightsail database, always 'permission denied'.I can connect to the same database remotely with public mode enabled.In my app I have the connection string defined as:'db' =>['dsn'         => 'mysql:dbname=dbmaster;host=endpoint;port=3306','username'    => 'username','password'    => 'password','persistent'  => false,'log_queries' => false,'reconnect'   => false,'queries'     =>['SET NAMES UTF8',],],Edited by: Lester on Apr 7, 2020 6:05 PMPreview looks fine, published version not same, special characters converted to html entity codes.FollowComment"

Answer: "0If anyone else encounters this, this was the reason:"..By default, the httpd_can_network_connect_db Boolean is off, preventing Apache HTTP Server scripts and modules from connecting to database servers.."https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-security-enhanced_linux-working_with_selinux-booleanssetsebool -P httpd_can_network_connect_db onCommentShareLesteranswered 3 years ago"


Question: Line over text in Rekognition

"Cheers!I am using Rekognition to detect text in a picture. At one point I have to detect whether text has a line over it or not. By line, I mean whether text is crossed out (like in supermarket catalogues when you have an original price crossed out and the discounted price not crossed out). Is something like that possible with Rekognition? Thanks!FollowComment"

Answer: 0This is not something that can be done in Rekognition.You would like need to build your own vision recognition model that is trained to identify 'crossed-out numbers'. This could be done using Amazon SageMaker and LOTS of sample images with numbers crossed-out and not crossed-out. Using SageMaker isn't as simple as using Amazon Rekognition.CommentShareJohn Rotensteinanswered a year ago


Question: [BUG] Possible bug - not all logs of the AWS EB application appear in the CW web.stdout.log

"Bug Report:Description: Not all logs of the deployed AWS Beanstalk application appear in the corresponding log group (/var/log/web.stdout.log) in AWS CloudWatch (nor in /var/log/web.stdout.log on the EC2 instance).Steps to Reproduce:Deploy the demo application to AWS Beanstalk.Check the corresponding log group (/var/log/web.stdout.log) in AWS CloudWatch.Some logs are missing.Expected Result: All logs of the deployed application should appear in the corresponding log group (/var/log/web.stdout.log) in AWS CloudWatch.Actual Result: Not all logs of the deployed application appear in the corresponding log group (/var/log/web.stdout.log) in AWS CloudWatch.AWS Beanstalk Environment Configuration:Environment type: Single instance (also tried with multiple instances)Platform: Corretto 8 running on 64bit Amazon Linux 2/3.4.6 (also tested with a couple of earlier versions)Instance type: t3.micro (also tested on t2.medium and t2.small)Log streaming to CloudWatch enabledAWS CloudWatch Log Group:Log group name: /var/log/web.stdout.logUsed workaround: None.Severity: HighAdditional Details (bug reproduction): The demo application is a simple java application for writing 100000 log lines to stdout from 10 threads (10000 logs per thread). When the application is deployed to AWS Beanstalk and the logs are checked in AWS CloudWatch, not all logs appear in the corresponding log group (/var/log/web.stdout.log).Demo Application:Repository link: https://github.com/grigoart/aws-eb-log-bug/Build jar by running gradle jar or use application.jar from repository (java version "1.8.0_151")Running locally:java -jar application.jar > log.txtwait for ~1 min and stop the applicationwc -l log.txtoutput: "100000 log.txt" (as expected)Running in AWS EB Environment:deploy jarwait for ~1 minverify that AWS CW log group /var/log/web.stdout.log does not have all the logs (e.g. all numbers >1000 are missing). According to AWS CW log insights there are only 1000 log entries (see the image below)alternatively:connect to EC2 instance using SSHwc -l /var/log/web.stdout.logoutput: "2360 /var/log/web.stdout.log" (unexpected result, should be >= 100000)FollowComment"

Answer: "0Accepted AnswerGot the answer from tech support:The rate-limiting errors were observed in “/var/log/messages” file.... the rate-limiting signals were being sent by “journald” service.Solved by configuring "rsyslog” and “journald” services through .ebextensions (workaround solution provided by tech support):files:    /tmp/Test.txt:        mode: "000644"        owner: root        group: root        content: |            $SystemLogRateLimitInterval 0            $SystemLogRateLimitBurst    0            $ImjournalRateLimitInterval 0    /tmp/script.sh:        mode: "000755"        owner: root        group: root        content: |            #!/bin/bash            #Fetching grep values for if condition to check whether the update has been performed or not.            value=$(grep -f /tmp/Test.txt /etc/rsyslog.conf)            value1=$(grep -w 'RateLimitInterval=0' /etc/systemd/journald.conf)            value2=$(grep -w 'RateLimitBurst=0' /etc/systemd/journald.conf)            # Updating /etc/rsyslog.conf file            if [ ! -z "$value" ]            then            echo "Match Found"            else            echo "Modifying /etc/rsyslog.conf"            echo -e '$SystemLogRateLimitInterval 0\n$SystemLogRateLimitBurst    0\n$ImjournalRateLimitInterval 0' >> /etc/rsyslog.conf            fi            # Updating /etc/systemd/journald.conf file            if [ ! -z $value1 ]            then            echo "Match Found for RateLimitInterval"            else            echo "Adding RateLimitInterval=0 to /etc/systemd/journald.conf"            echo -e "RateLimitInterval=0" >> /etc/systemd/journald.conf            fi            if [ ! -z $value2 ]            then            echo "Match Found for RateLimitBurst"            else            echo "Adding RateLimitBurst=0 to /etc/systemd/journald.conf"            echo -e "RateLimitBurst=0" >> /etc/systemd/journald.conf            ficommands:    01_run_script.sh:         command: ./tmp/script.sh     02_restart_journald:        command: systemctl restart systemd-journald    03_restart_rsyslog:        command: systemctl restart rsyslogCommentSharerePost-User-7373571answered 15 days ago0Did you enable the streaming environment's logs to the CloudWath Logs ?  You can do it using Console (for detailed steps how to achieve this please check [2]), using EB CLI [3] or using configuration files [4]. After completing these steps you should be able to see these CloudWatch LogGroups and the environment will start streaming appropriate logs into them.[1] Enabling Elastic Beanstalk enhanced health reporting https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/health-enhanced-enable.html[2] Using Elastic Beanstalk with Amazon CloudWatch Logs https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.cloudwatchlogs.html[3] Instance log streaming using the Elastic Beanstalk consolehttps://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.cloudwatchlogs.html#AWSHowTo.cloudwatchlogs.streaming.console[4] Instance log streaming using the EB CLI https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.cloudwatchlogs.html#AWSHowTo.cloudwatchlogs.streaming.ebcli[5] Instance log streaming using configuration fileshttps://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.cloudwatchlogs.html#AWSHowTo.cloudwatchlogs.filesCommentShareRam_AWSanswered 2 months agorePost-User-7373571 2 months agoDid you enable the streaming environment's logs to the CloudWath LogsYes I did, see the "AWS Beanstalk Environment Configuration" section of the question.After completing these steps you should be able to see these CloudWatch LogGroups and the environment will start streaming appropriate logs into them.I see some logs of my application in the CW log group, the problem is that they are partial/incomplete, i.e. some log lines are missing.I assume the problem is somewhere between application -> /var/log/web.stdout.log (within the EC2 instance) rather than between /var/log/web.stdout.log -> CW.Share"


Question: tensorboard with custom docker image without notebook

"Hi,Is it possible to use tensorboard with a custom docker image without using a notebook ? Is there any other method to monitor the training process ? I'm using the tensorflow object detection API and currently exposing metrics (only loss) from cloudwatch using a regex but I'd like a more detailed way like tensorboar.. is that possible ??ThanksFollowComment"

Answer: "0Yes, it is possible to use tensorboard outside of the SageMaker notebooks.Here is an example https://github.com/awslabs/amazon-sagemaker-examples/blob/master/sagemaker-python-sdk/keras_script_mode_pipe_mode_horovod/tensorflow_keras_CIFAR10.ipynb that uses TensorBoard to compare the training jobs.All of it can be run locally.CommentShareAWS-User-3757847answered 3 years ago0For anyone interested I made a tutorial for this:https://github.com/roccopietrini/TFSagemakerDetectionEdited by: rokk07 on Jan 25, 2021 2:28 AMCommentSharerokk07answered 2 years ago"


Question: Can you edit the data in an Amazon QuickSight dashboard after it's published?

"We have a table visual that includes a raw data dimension and another dimension that's a calculated field. The calculated field dimension has a dependency on the raw data dimension in the table.Two questions in this scenario:Can we edit the data displayed in the table after the dashboard is published?If we can edit the dashboard after it's published, and a change is made to the raw data dimension, would there be a change in the calculated field in the same table if the calculated field includes a dependency?FollowComment"

Answer: "1Accepted AnswerAn Amazon QuickSight dashboard is a read-only snapshot of an analysis, so the the data displayed within a published dashboard can't be edited.To allow dashboard users to use a calculation within a dashboard and transform data that is shown in an analysis, you can use parameters in Amazon QuickSight.CommentShareAWS-User-4620747answered 2 years ago"


Question: api.ecr.eu-west-2.amazonaws.com resolves to external IP instead of interface endpoint

"We have setup multiple endpoints all the same way within our organisation but the api.ecr.eu-west-2.amazonaws.com seems to resolve to the external IP rather than the interface endpoints. An example of the different responses can be seen below, is there a reason for this or a fix?$ nslookup rds.eu-west-2.amazonaws.comServer:         127.0.0.53Address:        127.0.0.53#53Non-authoritative answer:Name:   rds.eu-west-2.amazonaws.comAddress: 172.16.1.60Name:   rds.eu-west-2.amazonaws.comAddress: 172.16.2.132Name:   rds.eu-west-2.amazonaws.comAddress: 172.16.3.168$ nslookup api.ecr.eu-west-2.amazonaws.comServer:         127.0.0.53Address:        127.0.0.53#53Non-authoritative answer:api.ecr.eu-west-2.amazonaws.com canonical name = ecr.eu-west-2.amazonaws.com.Name:   ecr.eu-west-2.amazonaws.comAddress: 52.94.53.88FollowComment"

Answer: "0Might be worth checking which ECR endpoint type you used, as there are two options when creating an endpoint for ECR:com.amazonaws.region.ecr.dkr: This endpoint is used for the Docker Registry APIs. Docker client commands such as push and pull use this endpoint.com.amazonaws.region.ecr.api: This endpoint is used for calls to the Amazon ECR API. API actions such as DescribeImages and CreateRepository go to this endpoint.I've tested, and confirmed an nslookup with com.amazonaws.region.ecr.api returns the interface endpoint.CommentShareTom-Banswered 3 months agoAlex 3 months agoHi Tom,Thanks for the reply, we have both of the endpoints deployed but the error message we got was that it was unable to retreieve ecr registry auth. This was caused by "https://api.ecr.eu-west-2.amazonaws.com/": dial tcp 52.94.53.88:443: i/o timeout. Which is because we're blocking external access so trying to get it through the endpoint.ShareTom-B 3 months agoAlex,Are you using a custom dhcp option set in this VPC?ShareAlex 3 months agoNo we are just using the default DHCP setShareTom-B 3 months agoPlease check your VPC DNS setting are set to:DNS hostnames: EnabledDNS resolution: EnabledI was able to re-create your issue with DNS hostnames disabled, though it did take a while after enabling the setting for it to start using the local IP'sShareAlex 3 months agoHi Tom,Thanks for reaching out again. I've checked in all the VPC's and both the DNS settings we're enabled.The setup of these are that the endpoints are setup in a network account and the hosted zones for them is then associated with the other accounts. Seems strange that all the other endpoints are fine just the ECR one causing issues.ThanksAlexShare"


Question: Amazon SES list email templates bug

"Steps to reproduce:Add 300 email templates in us-east-1 regionTry to listEmailTemplates with AWSJavaScriptSDK in a loop with 10 value page size.Expected result:All emails are listedCurrent result:Error while pagination:Invalid PageToken <AAAAAAA....Everything works fine in us-west-2 regionFollowCommentchebsi a year agoSeeing same issue on us-east-1 and logged a case for it.Also occurring when max-items=1 and page-size=1 so you may not even need 300+ templates, maybe you just need to do many requestsShare"


Question: sessions manager console login failure

"I am not able to session into my ec2 instant. However, I am able to ssh into the instant. I have created an ssm role assigned AWSSSMFull Access permissions yet cannot connect to the instant. When I attempt to connect from the console using the sessions client, I get this error:The required IAM instance profile isn't attached to the instance. You can attach a profile using AWS Systems Manager Quick Setup.Please help.FollowCommentjoahna 9 months agoCan you check the IAM role that you used in your EC2? Does it have an Instance Profile ARN (found in the Summary section of the IAM Role)?Sharecamden 9 months agoarn:aws:iam::999342559036:instance-profile/SSM-SAT-INST(Yes I did)Share"


Question: Can we only have ONE Network Firewall per VPC?  Is Net Firewall the only service with the naming convention vpce-<id> for it's endpoints?

I have a few questions for Network Firewalls.Can we onlyhave one per vpc?Is Net Firewall the only service with the naming convention vpce-<id> for it's endpoints?FollowComment

Answer: "1You can have more than one Network Firewall per VPC but I'd question why you want to do that. If you're trying to maintain separation of traffic between separate applications I'd strongly recommend separate VPCs (and even separate accounts) as it gives you much easier ways of controlling access (human and network) with less risk of permission overlap than putting everything in a single VPC.No, other services use a similar naming convention. Again, why? Knowing this helps to give better, more contextual answers.CommentShareEXPERTBrettski-AWSanswered 6 months agoEXPERTTushar_Jreviewed 6 months ago"


Question: SNS / Pinpoint Service Limit

"Hello,Customer is looking to send out 1Lakh SMS (promotional SMS) in 15 minutes window.Does SNS / Pinpoint support this scale?Are there any constraints or limitations that I should be aware of while proposing some numbers?Also if there is any documentation or architecture around to support such scale would be helpful.ThanksFollowComment"

Answer: "0Accepted AnswerBoth sns & Pinpoint can send 20 sms/second with default quota, which result in 18000 sms sent in 15min window. Your customer would have to open a support case to ask for more and then see what the reply would be. They could potentially use multiple accounts to work around this.https://docs.aws.amazon.com/pinpoint/latest/developerguide/quotas.htmlCommentShareJaroslav-AWSanswered 3 years ago"


Question: partitioning s3 access logs to optimize athena queries

"Hi,When enabling s3 access logs on a bucket, there is this great feature that the generated logs can be queried through Athena.One thing I can however not figure out, is how to partition the external table so I can limit the data scanned e.g. by date.The generated file structure is likes3://my-access-logs/2022-02-15-11-11-18-6E829E27FAAA289As3://my-access-logs/2022-02-15-11-11-19-2870C85C7E0D2B20..s3://my-access-logs/2022-02-16-11-01-01-6E829E27FAAA289A...I added a "PARTITIONED BY (dt string)" to my table creation DDL, and then added partition likeALTER TABLE my_logs_table ADD PARTITION (dt = '2022-02-15') location 's3://my-access-logs/2022-02-15'However, when querying the table no data is scanned, and no rows are returned (even if I don't specify a filter on dt in my query).Most examples I could find always deal with s3 structures where there is a hierarchical folder structure, like 2022/02/15/xxxAnybody has any solution for this?Thanks,BertFollowCommentChris_G EXPERTa year agoAthena needs partitions to be by folder.  It cannot partition individual files by their name.Share"

Answer: "1You need to create partitions, this can be achieved by writing a simple AWS Lambda code.Event based serverless architecture:S3 Access Log Bucket (PUT event notification) --> SQS  --> Lambda in batch mode of 10 (Parses file name and perform S3 copy while adding partition prefix)For example:Input: s3://my-access-logs/2022-02-15-11-11-18-6E829E27FAAA289AOutput:Option-1 s3://my-access-logs/pt_date=2022-02-15/2022-02-15-11-11-18-6E829E27FAAA289AOption-2 s3://my-access-logs/year=2022/month=02/day=15/hour=11/2022-02-15-11-11-18-6E829E27FAAA289AAdditionally, you can have aggressive s3 "Lifecycle Policy" to delete the original logs in 1 day to save on storage costs.Once this is done, you can register Athena table with HIVE partitions and query it seamlessly.Alternatively, there is this blog which utilized Glue to perform this in a batch mode - https://aws.amazon.com/blogs/big-data/easily-query-aws-service-logs-using-amazon-athena/CommentShareAWS-User-8934518answered a year agoRussSayers 6 months agoThis is very helpful - thank you!Share"


Question: Using AWS Java SDK 2.0 WebIdentityTokenFileCredentialsProvider gives SdkClientException

"This is cross posted on StackOverflowhttps://stackoverflow.com/questions/75389388/using-aws-java-sdk-2-0-webidentitytokenfilecredentialsprovider-gives-sdkclientexI have an application that already works using Kinesis. The application uses AWS Session Credentials but we are switching to using either AWS Session Credentials or Web Identity Token (software.amazon.awssdk.auth.credentials.WebIdentityTokenFileCredentialsProvider) depending on the deployment environment.When I add in the code to use WebIdentityTokenFileCredentialsProvider I get the stacktrace below. I can't provide the code but rest assured I'm setting an HTTP client for Kinesis. But if you look at the stacktrace it shows that a default HTTP client is being configured via the Provider deep within the AWS SDK code. I have no influence over the Credentials Provider setting the HTTP client as the WebIdentityTokenFileCredentialsProvider doesn't give me a way to tell it that I don't need a default HTTP client being set.I know one option is to create my own implementation of the WebIdentityTokenFileCredentialsProvider but I'd rather not do that.Question: What else can I do to work around this?Caused by: software.amazon.awssdk.core.exception.SdkClientException: Multiple HTTP implementations were found on the classpath. To avoid non-deterministic loading implementations, please explicitly provide an HTTP client via the client builders, set the software.amazon.awssdk.http.service.impl system property with the FQCN of the HTTP service to use as the default, or remove all but one HTTP implementation from the classpath    at software.amazon.awssdk.core.exception.SdkClientException$BuilderImpl.build(SdkClientException.java:102)    at software.amazon.awssdk.core.internal.http.loader.ClasspathSdkHttpServiceProvider.loadService(ClasspathSdkHttpServiceProvider.java:62)    at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)    at java.base/java.util.Spliterators$ArraySpliterator.tryAdvance(Spliterators.java:1002)    at java.base/java.util.stream.ReferencePipeline.forEachWithCancel(ReferencePipeline.java:129)    at java.base/java.util.stream.AbstractPipeline.copyIntoWithCancel(AbstractPipeline.java:527)    at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:513)    at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)    at java.base/java.util.stream.FindOps$FindOp.evaluateSequential(FindOps.java:150)    at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)    at java.base/java.util.stream.ReferencePipeline.findFirst(ReferencePipeline.java:647)    at software.amazon.awssdk.core.internal.http.loader.SdkHttpServiceProviderChain.loadService(SdkHttpServiceProviderChain.java:44)    at software.amazon.awssdk.core.internal.http.loader.CachingSdkHttpServiceProvider.loadService(CachingSdkHttpServiceProvider.java:46)    at software.amazon.awssdk.core.internal.http.loader.DefaultSdkHttpClientBuilder.buildWithDefaults(DefaultSdkHttpClientBuilder.java:40)    at software.amazon.awssdk.core.client.builder.SdkDefaultClientBuilder.lambda$resolveSyncHttpClient$7(SdkDefaultClientBuilder.java:343)    at java.base/java.util.Optional.orElseGet(Optional.java:364)    at software.amazon.awssdk.core.client.builder.SdkDefaultClientBuilder.resolveSyncHttpClient(SdkDefaultClientBuilder.java:343)    at software.amazon.awssdk.core.client.builder.SdkDefaultClientBuilder.finalizeSyncConfiguration(SdkDefaultClientBuilder.java:282)    at software.amazon.awssdk.core.client.builder.SdkDefaultClientBuilder.syncClientConfiguration(SdkDefaultClientBuilder.java:178)    at software.amazon.awssdk.services.sts.DefaultStsClientBuilder.buildClient(DefaultStsClientBuilder.java:27)    at software.amazon.awssdk.services.sts.DefaultStsClientBuilder.buildClient(DefaultStsClientBuilder.java:22)    at software.amazon.awssdk.core.client.builder.SdkDefaultClientBuilder.build(SdkDefaultClientBuilder.java:145)    at software.amazon.awssdk.services.sts.internal.StsWebIdentityCredentialsProviderFactory$StsWebIdentityCredentialsProvider.<init>(StsWebIdentityCredentialsProviderFactory.java:71)    at software.amazon.awssdk.services.sts.internal.StsWebIdentityCredentialsProviderFactory$StsWebIdentityCredentialsProvider.<init>(StsWebIdentityCredentialsProviderFactory.java:55)    at software.amazon.awssdk.services.sts.internal.StsWebIdentityCredentialsProviderFactory.create(StsWebIdentityCredentialsProviderFactory.java:47)    at software.amazon.awssdk.auth.credentials.WebIdentityTokenFileCredentialsProvider.<init>(WebIdentityTokenFileCredentialsProvider.java:86)    at software.amazon.awssdk.auth.credentials.WebIdentityTokenFileCredentialsProvider.<init>(WebIdentityTokenFileCredentialsProvider.java:46)    at software.amazon.awssdk.auth.credentials.WebIdentityTokenFileCredentialsProvider$BuilderImpl.build(WebIdentityTokenFileCredentialsProvider.java:200)FollowComment"

Answer: "0Accepted AnswerI figured out the issue. I had added an exclusion for the dependency for UrlConnectionHttpClient in the AWS dependencies use but it wasn't being honored by Gradle. The reason being that there was another internal library that we have that also brings in AWS dependencies. Gradle let the internal dependency override the explicit exclusion I had added. So when I added the exclusion in that library for the dependency that contains UrlConnectionHttpClient it finally excluded it.For the record we manually set the HttpClient but what happens with WebIdentityTokenFileCredentialsProvider is it's looking at the classpath and if it finds more than one it throws the exception noted above.CommentSharecwaanswered 3 months ago0Hello,In regards to the error -SdkClientException: Multiple HTTP implementations were found on the classpathThis usually means that you have more than one HTTP client in your classpath (ApacheHttpClient and UrlConnectionHttpClient for example), the SDK was not able to choose one by default. You need to explicitly set which http client you want to use in the client definition.If you still have any Java SDK issues, please feel free to post them here -https://github.com/aws/aws-sdk-java/issuesReferences:[1] https://aws.amazon.com/blogs/developer/introducing-aws-common-runtime-http-client-in-the-aws-sdk-for-java-2-x/CommentShareSUPPORT ENGINEERYash_Canswered 3 months ago"


Question: Does AWS Batch support EC2 Spot stop/start and hibernation

"Does AWS Batch have support for EC2 spot stop/start and hibernation options to handle interruptions?The options are documented here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-interruptions.htmlBut I am unable to find reference of whether AWS Batch can support this. From my understanding, if a Spot instance is terminated, AWS Batch retries the job from the start.FollowComment"

Answer: "0Accepted AnswerNo, AWS Batch does not support EC2 spot stop/start and hibernation options with a managed compute environment (CE). If a Spot instance is terminated, AWS Batch will retry the job (from the start) per your retry strategy defined in your job definition. It is possible for your job to resume progress if it has checkpointing built-in and you save your data somewhere that can be accessed again (e.g. EFS).You can use hibernation with unmanaged CE. However, since it is not officially supported, your job might be “stuck” when Spot reclaims your instance and the instance goes into hibernation. This job will continue to be in “running” state and stay at the top of your job queue, preventing other jobs from running if you have hit your max vCPU limit in your CE.CommentShareAWS-Reyanswered 5 years ago"


Question: EC2 CloudTrail's Events

"Does CloudTrail able to track EC2 events which are happened manually, for instance,  during EC2 SSH connection session?FollowComment"

Answer: "3Accepted AnswerNo. CloudTrail logs events that occur on the AWS APIs. As stated in the docs:Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Events include actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs.Under the Shared Responsibility Model, operating system events, including SSH connections, are the responsibility of the customer.CommentShareEXPERTbwhaleyanswered 4 months agoEXPERTTushar_Jreviewed 4 months ago"


Question: "AWS GuardDuty & RDS, what are the features exactly?!"

"Hi,We're going through an Audit (It is my first year at this company) and I'm trying to find evidence, if we have any, that we monitor for data exfiltration attempts specifically (or other intrusion detection at the SQL level). I am having a hard time getting a straight answer as there's a guard duty blog post here that claims rds protection though I can't find any reference to this function in Guard Duty's user guide.Perhaps if this is monitored through AWS Cloud Trail then Guard Duty doesn't list those separately? Guard Duty does claim to use Cloud Trail as a source but then doesn't list anything regarding that under finding types... I'd assume it would report the findings similarly but not sure on what or where?Anyways, I'm sure I'm missing something obvious here but if I can get some general guidance on how to figure out what CloudTrail finding results look like or more specifically for RDS findings it would be greatly appreciated!FollowComment"

Answer: "0Hello!Hopefully I can provide some clarity on this for you! As per the blog post that you shared, Amazon GuardDuty does generate findings related to Amazon RDS. However, as you point out, RDS is not listed in the GuardDuty Finding types documentation.This is because exfiltration-related RDS findings are created based on AWS CloudTrail management logs and fall under the Exfiltration:IAMUser/AnomalousBehavior finding type. Note that findings ending with /AnomalousBehavior are generated by GuardDuty's anomaly detection machine learning model, considering details like the requester, the location that the request originated from, and the specific API call that was made. I don't have an exhaustive list of all of the RDS API calls that could trigger this finding type, but from the documentation for this finding type:"The API observed is commonly associated with exfiltration tactics where an adversary is trying to collect data from your network using packaging and encryption to avoid detection. APIs for this finding type are management (control-plane) operations only and are typically related to S3, snapshots, and databases, such as, PutBucketReplication, CreateSnapshot, or RestoreDBInstanceFromDBSnapshot."When a finding like this is created, it will look very similar to the example in the blog post, except instead of the Discovery finding type, it will be Exfiltration. You'll have visibility into all of the request details, as well as the API calls that were determined to be anomalous.To learn more about this, I'd recommend exploring the IAM finding types documentation - especially the findings ending in IAMUser/AnomalousBehavior. Also, if you need an example to share for your audit, you can generate sample findings by following these steps.CommentSharedmarshnnanswered 7 months ago"


Question: Cloudfront S3 access logs - access denied?

"Hello,I've configured a cloudfront distribution for my S3-hosted website, that all works great. I've also configured an S3 bucket to get the logging, which is being put in there.I'm now trying to get access to those logs.. I can see them in the bucket "<distribution>.<date>.<id>.tgz, but whatever I try I can't seem to get them off there. Downloading doesn't work - S3 returns me an access denied.The bucket is set to private and AWS-KMS encrypted, and  even trying to download them via the 'Download' button in the S3 UI tells me to sod off.I'm the only one with access on my account, I have Administrator access, and there's no policy denying me.What am I doing wrong?FollowComment"

Answer: "0In the end, the issue had to do with KMS encryption. I was using the default aws/s3 key, but since cloudfront logs arrive from a different account, it was using the KMS key of the cloudfront account, which I can't access.Switched to AES256 for now, will investigate later if i can workaround this issue.CommentSharejdeluyckanswered 4 years ago0Hey there.  I had the same problem and was finally able to solve.I had three issues.  (1) I didn't set KMSMasterKeyID initially in my CFT.  I just specified SSEAlgorithm: aws:kms.  I assumed this would make AWS use my default key.  I was wrong.  Instead the log delivery service used its own key to encrypt the log files.  This caused the Access Denied issue when I tried to download or view the log files.  (2) Once I set KMSMasterKeyID to one of my own CMKs, the log delivery service stopped writing files.  (3) for KMSMasterKeyID, I used ID from the Ref function, not the ARN.  Nothing complained at deploy time but at runtime, no log files were being written.  I was never able to find much in CloudTrail to help debug.  I noticed the difference after staring the AWS Console showing the bucket's KMS setting and realized my mistake.To solve (1), I created my own CMK.To solve (2) and (3), I referenced my CMK by its ARN in my CFT.  The AWS docs have the solve but I was stuck for hours until I realized I was referencing a bad ID (not using ARN) in my CFT.Here's the link to the AWS docs that discuss the correct approach.  https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html#AccessLogsKMSPermissionsHere's my key policy:{    "Version": "2008-10-17",    "Statement": [        {            "Sid": "Give root user of AWS account full control of key.",            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam::<your-account-goes-here>:root"            },            "Action": "kms:*",            "Resource": "*"        },        {            "Sid": "Allow logging agent for CloudFront to use the key.",            "Effect": "Allow",            "Principal": {                "Service": "delivery.logs.amazonaws.com"            },            "Action": "kms:GenerateDataKey*",            "Resource": "*"        }    ]}Edited by: geeeoff on Dec 29, 2019 9:28 AMCommentSharegeeeoffanswered 3 years ago"


Question: Oracle RDS Monitoring beyond free space

We want to monitor Oracle RDS instances beyond allocated DB storage such as Tablespace utilization so that we can generate CW metric alarm.FollowComment

Answer: "0Monitoring RDS instances, including Oracle, goes beyond just checking for free space. Amazon CloudWatch provides a wide range of metrics for monitoring your RDS instances. These metrics include CPU utilization, database connections, read and write operations, and many others.For monitoring tablespace utilization specifically, you can enable Enhanced Monitoring for your RDS instances. Enhanced Monitoring provides metrics in real time for the operating system that your DB instance runs on. You can view key operational metrics for your DB instance load, including active sessions, I/O, and system metrics, which can help you analyze and troubleshoot your database performance.However, please note that Enhanced Monitoring doesn't provide tablespace utilization out of the box. Oracle tablespaces are specific to Oracle databases and aren't directly exposed as a metric in RDS or CloudWatch.For tablespace-related metrics, you will have to query the Oracle system views directly. You can create a procedure in Oracle to gather this information and then use RDS Events or a Lambda function to trigger a custom CloudWatch metric.SELECT    df.tablespace_name "Tablespace",   totalusedspace "Used MB",   (df.totalspace - tu.totalusedspace) "Free MB",   df.totalspace "Total MB",   ROUND(100 * ( (df.totalspace - tu.totalusedspace)/ df.totalspace)) "Percent Free"FROM   (SELECT       tablespace_name,      ROUND(SUM(bytes) / 1048576) TotalSpace    FROM       dba_data_files    GROUP BY       tablespace_name) df,   (SELECT       ROUND(SUM(bytes)/(1024*1024)) totalusedspace, tablespace_name    FROM       dba_segments    GROUP BY       tablespace_name) tuWHERE   df.tablespace_name = tu.tablespace_name;CommentShareEXPERTsdtslmnanswered 10 days agorePost-User-9219791 9 days agoThank you. Do you mean to trigger the DB stored procedure via Lambda function and trigger the Lambda using EventBridge? How do I create an alarm based on a specific metric?Share"


Question: Cloudformation Template - Amazon Lex Voice Setting Engine

"Hello,Is there a way to set the Polly voice setting to either "neural" or "standard" using the Cloudformation template to create a Lex bot?Documentation for Cloudformation which is missing the Engine keyword: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lex-bot-voicesettings.htmlFrom what I have seem, it looks like an omission on the Cloudformation side. In the Lex Console, we can set any voice to be either standard or neural. When we download the bot, we can see that there is a keyword for the engine: ""voiceSettings":{"engine":"neural","voiceId":"Ivy"}". Only Cloudformation is missing that engine setting. Unfortunately, it seems to always default to the standard voice. I tried adding in the Engine keyword in my CFN template just to see if it was working but not documented, unfortunately, it is not the case; it doesn't work.Let me know if I am missing anything.Thanks,FollowComment"

Answer: "0Accepted AnswerHi,Know you asked this 3mo ago and likely moved on, but answering in case others have the same question.You're correct that the CFT support for Lex does not currently do anything with the 'Engine' property passed as part of the 'VoiceSettings'' property in a AWS::Lex::Bot resource.  Behind the scenes, the AWS::Lex::Bot resource will result in an API call to create_bot_locale:response = client.create_bot_locale(    botId='string',    botVersion='string',    localeId='string',    description='string',    nluIntentConfidenceThreshold=123.0,    voiceSettings={        'voiceId': 'string',        'engine': 'standard'|'neural'    })Because the 'engine' property is not honored, the value defaults to 'standard' in the API call.I submitted a feature request but in the meantime, you can create a lambda custom resource or a CloudFormation resource type to overcome this. Your custom resource type would take in the same parameters currently passed in AWS::Lex::Bot and make a call to create_bot_locale API including the voiceSettings.engine property value which you would set to 'neural' in your template. Creating the Lambda custom resource is pretty trivial but you would need to support the update and delete cases as well. See docs for Lambda-backed Custom Resources, or the newer preferred mechanism, CloudFormation Registry Resource Types.CommentShareScott_Kanswered 7 months agoJohn 7 months agoHello,Sorry for not closing the question. It was made available around a month or two ago in the CFN templates.I never had to use the APIs directly, so I never encountered this problem, but for the sake of the product growth, thanks for making this enhancement request.Thanks,Share"


Question: How to install nvidia drivers on Amazon Linux?

My ec2 instance is of type g4dn.xlarge. I tried nvidia-smi but it seems the drivers are not pre-installed so I want to install them.I couldn't find much documentation for Amazon Linux online. On the nvidia instructions it isn't specifically mentioned.When running sudo cat /etc/os-release I get this output:NAME="Amazon Linux"VERSION="2023"ID="amzn"ID_LIKE="fedora"VERSION_ID="2023"...So i tried to follow the instructions for fedora (randomly fedora34) but I got errors during the installation (I guess because of incompatibility).Any help highly appreciated.FollowComment

Answer: "0Hi Nina,Would it be ok for you to use an AMI with the drivers pre-installed:https://aws.amazon.com/marketplace/pp/prodview-64e4rx3h733ru?sr=0-3&ref_=beagle&applicationId=AWSMPContessaCommentShareEXPERTMassimilianoAWSanswered 2 months ago"


Question: Data Pipeline and IAM errors

"I am trying to create a very simple Data Pipeline to simply run an AWS CLI command within an EC2 resource.  I get these errors in the pipeline..Object:Ec2InstanceERROR: Please add following permissions to the role ('DataPipeline_FullAccess') for uploading logs to s3: s3:Put*WARNING: Error occurred while validating resourceRole 'EC2_DataPipeline_FullAccess'. Need iam:ListRolePolicies and iam:GetRolePolicy to validate. Error: User: arn:aws:sts::407737248259:assumed-role/DataPipeline_FullAccess/EDPSession is not authorized to perform: iam:ListRolePolicies on resource: role EC2_DataPipeline_FullAccess (Service: AmazonIdentityManagement; Status Code: 403; Error Code: AccessDenied; Request ID: ffb0d91c-e693-49d5-bad7-7bdbff283c66; Proxy: null)I have added S3 full access to the DataPipeline_FullAccess role.I have added IAM full access to both the DataPipeline_FullAccess and EC2_DataPipeline_FullAccess, it was unclear which really needed it.I have reviewed this...https://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-iam-roles.htmlstill did not work.  fyi,  you all have an invalid permission here...  "elasticmapreduce:GetCluster",I also tried to use the default  AWSDataPipelineRole  role, which I am seeing now is no longer valid.Help, I have been working on this for 3 hours now trying everything.FollowComment"

Answer: "0fixed,  I had a "Permissions Boundary" set on the role accidentally.  Also, be sure to following the steps of Creating the Role in the console, selecting the Data Pipeline service, and then the 2 options for data pipeline and ec2.  This applies a default for the role and trust relationships.CommentSharerlanganswered 2 years ago"


Question: [Glue] Fail to connect to MySql running on EC2

"I am trying to connect to MySql which is running on EC2 instance in VPC. However, I got the following error message and could not crawl tables.ERROR : Could not find S3 endpoint or NAT gateway for subnetId: subnet-xxxx in Vpc vpc-xxxxxI already created security group for Glue (http://docs.aws.amazon.com/ja_jp/glue/latest/dg/populate-add-connection.html) and attach it to EC2 instance and glue.So does anyone know how we can connect to MySql running on EC2?  Is there any special settings I have to do for this problem?I am guessing that there is network issues because AWS says that Glue supports MySql running on Amazon EC2.https://aws.amazon.com/glue/faqs/?nc1=h_lsEdited by: Masahiko on Dec 28, 2017 3:51 AMFollowComment"

Answer: "0Now I can connect to MySql which is running on EC2 instance.What we did:replaced NAT instance with NAT gatewaySet security group to EC2 instanceCommentShareMasahikoanswered 5 years ago0Hello Masahiko,Can you please help me how you were able to connect to MySQL running on EC2. I am having difficulty for the same.here is what I have done so far -Launched Linux Public EC2.Launched Linux Private EC2. Created NAT Gateway.Connected private EC2 through Public EC2 and Installed MySQL Server on private EC2.Created Database Employee on MySQL Server.GRANT ALL PRIVILEGES ON Employee.* TO 'root'@'<Private EC2 IP>' IDENTIFIED BY '<password>';Inbound Security group attached to Private EC2 instance -All TCP TCP 0 - 65535 sg-<SG ID>MYSQL/Aurora TCP 3306 0.0.0.0/0JDBC URL while setting up connection from Glue to MySQL DBjdbc:mysql://ip-<ip address>.ec2.internal:3306/EmployeeError I am getting is - "Host 'ip-<ip address>.ec2.internal' is not allowed to connect to this MySQL server"Can you please help?Please let me know if I need to provide any more details about it.Thanks,DhirajCommentShareDhirajDDanswered 4 years ago0I am able to connect to MySQL DB installed on Private EC2 instance now. Performed everything from scratch right from dropping and recreating VPC and all steps I mentioned in earlier post. Able to crawl MySQL Tables into Glue Catalog DB now.Thanks,DhirajCommentShareDhirajDDanswered 4 years ago"


Question: How to generate an event to a microservice from a cloudwatch alert

I need to generate an event in order to a microservice can proseced it.  That event must be generate from aws cloudwatch alert. ¿How can I implement it?FollowComment

Answer: "2Hi, not sure how you intend your microservice would consume the event?Would your microservice be able to consume EventBridge events (e.g. through an ECS task, lambda function or API destination)? If so, you might be interested by the fact that alarms automatically publish all their state and configuration change events to EventBridge (cf. https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-and-eventbridge.html), so you could simply write a rule that watches for CloudWatch Alarm event patterns and set the target to your microservice entry point?CommentShareJscanswered 8 months agoEdilson Florez 8 months agoHi Jsc, thanks a lot for your comment. I'm going to check.Share"


Question: Pass scripting variables to html in Sumerian

"Hi folks, I've got an html3d element for use in a scene (it's actually part of a group of entities). I want to pass data to it from a script that reads JSON content from S3.1. My understanding is that I can't use the script tags inline or with src= from within the html, so how do I get the variables into the html?2. I'm looking at module://sumerian-aws/api, but can't see how to issue an API call to read from S3 - is there a tutorial on this?Thankyou!FollowComment"

Answer:
"1Accepted AnswerRegarding item 1, here's a useful approach...In Sumerian, with your HTML3D entity selected, open it for editing in the text editor. Set the entity's HTML code to something like this:
Hello world.
You'll then be able to change the content of the HTML3D entity using standard Javascript DOM code like this:var contentElement = document.getElementById('my-html3d-content');contentElement.innerText = 'My new content.';  // or .innerHTMLRegarding item 2, Sumerian doesn't have built-in integration with Amazon S3. But no worries, you can still make calls to S3 if you first add the AWS Javascript SDK as an external dependency to your project.For details on adding Javascript libraries to a Sumerian project, see "External Dependencies" in the Sumerian User Guide.Reference this documentation on getting started with the AWS SDK for Javascript.And see these examples of interacting with S3 using Javascript in the browser.CommentShareKrisanswered a year ago0Awesome, thank you!CommentSharebatfinkanswered a year ago"


Question: Trouble saving changes to light sail Wordpress settings file tagline

"I lost the pw for my light sail Wordpress site. I reset the pw via sql commands. I can now get in, but when I save changes to Wordpress Settings, the changes do not propagate to the site. In particular I can not get the updated site tagline to update. It stubbornly remains the original setting and I want to change it. I have tried forcing a new reload in my MacOs Chrome browser, and in Safari, but the site stubbornly retains the original tagline. I am wondering if this has something to do with updating my password via SQL command line like so:UPDATE wp_users SET user_pass = md5('new_password') WHERE ID = 1; it worked. I can edit the site via the WP dashboard, but there seems to be a communication problem with resetting the tagline. thanks for any help. Jim AllisonFollowComment"

Answer: "0HiI don't believe changing the user password via the database has anything to do with this. I am managing a bunch of WordPress sites and have done this countless times.If there is a caching plugin installed within the site (Ex: nitropack) or if there is a cashing function in your host, try clearing the cache on that end.Assuming everything else is working and this is only related to the tagline. We can try to change this from the functions.php file or directly from the database.Updating the functions.php -> Add the following line to your functions.php fileupdate_option( ‘blogdescription’, “put your site tagline here” );Update the database -> On the wp-options table change the blogdescription field.Hope this helps.CommentShareBisinaanswered 11 days ago"


Question: Amplify Javascript Client for Auth is not able to access auth session

"I am using the code from the aws examples https://docs.amplify.aws/lib/auth/manageusers/q/platform/js/#retrieve-current-authenticated-userand after signing up, signing in, I am trying to update the email.  once I call the change email address, I am always getting an error:Uncaught (in promise) TypeError: user.getSession is not a functionwhich seems to come deep within the aws amplify auth module.Trying to find out what is wrong?If you follow the code below this is the order in which it is used.async function signUp(username, password) {try {const { user } = await Auth.signUp({username,password,attributes: {email: username//,          // optional//phone_number,   // optional - E.164 number convention// other custom attributes},autoSignIn: { // optional - enables auto sign in after user is confirmedenabled: true,}});console.log(user);console.log(currentAuthenticatedUserSession());} catch (error) {console.log('error signing up:', error);}}async function confirmSignUp(username, code) {try {await Auth.confirmSignUp(username, code);} catch (error) {console.log('error confirming sign up', error);}}async function signIn(username, password) {try {const user = await Auth.signIn(username, password);user.Session=user.signInUserSession;console.log(user);} catch (error) {console.log('error signing in', error);}}async function changeEmail(newEmail){// Send confirmation code to user's old email// Calling this line here seems to not be passing the session as it errors out with the error posted in the beginning above.Auth.updateUserAttributes(currentAuthenticatedUserSession(), {'email':newEmail}).then((data) => console.log(data)).catch((err) => console.log(err));}//I have made several variations of this function, but nothing works.async function currentAuthenticatedUserSession(){Auth.currentSession().then((user) => {console.log(user);return user}).catch((err) => console.log(err));}async function changeEmailComplete(code){// Collect confirmation code and new email, thenAuth.verifyCurrentUserAttributeSubmit('email', code).then((data) => console.log(data)).catch((err) => console.log(err));}FollowComment"

Answer: "0Accepted AnswerFound this which solved the problem:https://github.com/aws-amplify/amplify-js/issues/10108and also updated the changeEmail() to:async function changeEmail(newEmail){// Send confirmation code to user's old emailconst user = await Auth.currentAuthenticatedUser();await Auth.updateUserAttributes(user, {'email':newEmail}).then((data) => console.log(data)).catch((err) => console.log(err));}CommentSharerePost-User-6569438answered 5 months ago"


Question: MSK Problem with Full Disk

"Hi,I have a problem because my MSK Disk was full, when I re-sized the EBS, what time take this proccess? because I re-sized 500 GB to 1TB (13 hours have passed since the modification) and I can't send data to MSK.  . I need reboot brocker? or It's automaticallyFollowComment"

Answer: "0When Kafka service is already in failed state due to no disk space, it will not automatically recover after increasing disk volume. The additional storage is made available right away, however, you need to reboot brokers manually to bring them back online. We do have plans to improve our internal workflow to detect and auto-mitigate this in the future, though.CommentShareSUPPORT ENGINEERJavier Grinonanswered 9 months ago"


Question: Access reviews in AWS identity Center

"Hi, just moved our AWS accounts into AWS Organizations and starting to enroll user accounts in AWS Identity Center and closing down old local user accounts in AWS IAM.Problem: With the new Identity Center I can't find a good consolidated view on an individual users actual access. Things get really muddy with how access with authorisation is provisioned to an individual user and a group. I understand the process and have individual Users that are attached to Groups, but then the step comes with adding a Group to one or more Permission Set (with underlying IAM policies) to one ore more AWS Accounts.ISO27001 and other standards requires Access Reviews on a regular basis (for example quarterly). That was pretty easy doing in AWS IAM by reviewing AWS account by AWS account per user/group. But in Identity Center I can't seem to find a way to start at an individual user and get a consolidated view of either a single user/group or on a single AWS account to review who has access and what that user is authorised to do.Am I missing something or how is this supposed to be done in AWS Identity Center?FollowComment"

Answer: "0To confirm: You were using the IAM Management console, under users, "last activity" column for manual compliance reviews.  And this column is not available in IAM Identity Center user console.Per https://aws.amazon.com/iam/identity-center/features/: Audit access events across applications and AWS accountsAll administrative and multi-account access activity is recorded in AWS CloudTrail, giving you the visibility to audit IAM Identity Center activity centrally. Through CloudTrail, you can view activity such as sign in attempts, application assignments, and directory integration changes. For instance, you can see the applications that a user accessed over a given period or when a user was given access to a specific application.Are you using CloudTrail?CommentSharerePost-User-4039873answered 5 months agoMagnus 5 months agoYes, among other thing the "last activity" column was used but the key thing that is reviewed was who has access to what, reviewing things as permission creeps etc and segregation of duties more of a governance review where the account owner was forced to make decisions if the right user/individuals had access to their account with the right policies in place (some of them may never have been used as they are there for incident management). So in this case I'm not really interested (but of course we are interested of that too) in what activity has happened rather the governance and decisions about what access rights is present for a user and within the accounts.And yes, we have an AWS Organizations wide CloudTrail in place in line with AWS Well-Architected and delegated account for Identity Center in place where daily identity and access management takes place. Are there some good bluer prints in place to get started in what happens from an IAM perspective?Share"


Question: EventBridge API Destination Not Sending Origin Header In Post Request

"We have a business requirement to transform and send a request via a POST, with a custom 'origin' header value.When trying to send the request with the header key 'origin' and the header value 'blah' I can see that it arrives at the destination with any origin header. If I send the header 'origin1' with value blah, I can see this arrive at the destination.Is there a list of hidden reserve headers that cannot be modified?Is an alternative solution to integrate with API Gateway or a Lambda that could add this header and send the request on?FollowComment"


Question: How do I pass a string to inline lambda function in Cloudformation for S3 bucket name

"I am trying to create a S3 bucket using Custom Resource and Inline lambda function using a name passed to it in Cloudformation. How do I pass a string for the bucket name as a parameter to the inline lambda function? I tried in vain to use the event['ResourceProperties']['BucketName'] which is a string defined under Custom Resource section and also tried to use Environment: Variables: None of these two seem to be working.FollowCommentEvan 5 months agoCan you add the code here? Why are you using a custom resource?ShareJMK 5 months agoMyS3Resource:Type: AWS::CloudFormation::CustomResourceProperties:ServiceToken: !GetAtt S3BucketLambda.ArnBucketName: !Sub cache-${AWS::AccountId}Region: !Ref AWS::RegionS3BucketLambda:Type: AWS::Lambda::FunctionProperties:FunctionName: IndexHandler: index.handlerRuntime: python3.7Role: !Join ["", ["arn:aws:iam::", !Ref "AWS::AccountId", ":role/companyname/aws-projectname-lambda-role"]]MemorySize: 128Timeout: 10Description: "Testing S3"Environment:Variables:BucketName: "cache-11223344"Code:ZipFile: |import boto3import osimport cfnresponse      s3_client = boto3.client('s3')      def handler(event, context):        bucketName = event['ResourceProperties']['BucketName']        this_event = event['RequestType']        regionName = event['ResourceProperties']['Region']        response_data = {}        try:          if this_event in ('Create', 'Update'):            output = s3_client.head_bucket(Bucket=bucketName)            print (output['ResponseMetadata']['HTTPStatusCode'])        except Exception as e:          try:            response = s3_client.create_bucket(Bucket=bucketName)            print (response)            response_data['Data'] = json.dumps(response)          except Exception as e:            print (str (e))Share"

Answer: "0HiIf you are passing parameters to the stack that you want to use in the bucket name then this is possible.There are two ways I use to create bucket names.  Note, all this can also be used in a Lambda if you are putting the lambda code "inline" in the CloudFormation template.First with a parameter for bucket name [bucketname].In the resource section I can then just use "!Ref bucketname" under the bucket resource to reference the parameter.The other way I have used, especially in multi-landscape, is referencing one or many parameters and concatenating text along with text using !Sub.For example with parameters for [landscape], [tier], [environment] and pseudo parameters I could create the following naming.!Sub bucket-${AWS::Region}-${landscape}-${tier}-${environment}.Might be worth taking a look at the AWS CloudFormation Workshop.Hope this helps and solve your challenges.CommentShareRobin Fordanswered 5 months agoJMK 5 months agoThank you, Mr. Ford, for your response. I do not want to use the parameter as I want the name to be dynamically created. I will try the second option you have suggested.ShareJMK 5 months agoSo, I used !Sub to define the bucket name under Custom Resource section, but the name never gets passed to the function.Share"


Question: EC2 connect fail

"I‘m in beijing china，i just have launched an ec2 instance today in singapore, but connection to the ecs was failed,any suggestions for the problem? do i need a vpn to go through or there are any other reasons?FollowCommentwang1107 3 months agoDo i need to alloc an eip and bind to the ecs？Share"

Answer: "0Check a few things:Is the instance on a public subnet?Has a public IP been created?Was the port released in the security group?These are the necessary settings to be able to access without the need for a VPN.CommentShareedmarinhoanswered 3 months agowang1107 3 months ago1、 public ip is ok, but it can't be pingedPublic IPv4 address13.212.152.132 | open addressPrivate IPv4 addresses172.31.36.25Public IPv4 DNSec2-13-212-152-132.ap-southeast-1.compute.amazonaws.com | open address2、security group was configured automaticly，i didn't add any other security rules.Inbound rules–sgr-0ec3389805bcdb4f3AllAllsg-09ca4ada4bc0ccd27 defaultOutbound rules–sgr-08103528b35f77164AllAll0.0.0.0/0defaultShare"


Question: AWS Backup Dynamo - best practice for my setup

"Good afternoon all.  I have a DynamoDB that stores data in monthly tables and some central ones.  Once the month is over, that data doesn’t change.   Those monthly tables and other critical tables have PITR on and after the 35 days, I don’t need that on as the data doesn’t change but also don’t want/need to back them up daily.   So the question isFrom the reading (https://aws.amazon.com/backup/features/) it appears that its a full, then incremental, so after the 35 days and the table stops being written, can I leave the backup flag on (since nothing changes, I shouldn’t pay any additional) right and only the new tables/data will be written?Bonus: (this may have to goto the dynamo forum), but after the 35 days,  if that table doesn’t change does PITR continue to charge, and if so, can something in the AWS backup job say turn it off after x days?Thanks allFollowComment"

Answer: "1Accepted AnswerCan you leave the PITR on after 35 days? Yes, if you'd like.Will it continue to charge? Yes, because you pay by the GB consumed in the backup. Even without writes, the PITR backup consumes space.Can you turn it off? Yes. If you do then unless you have another backup (On Demand) you'll lose a recovery path should someone accidentally delete any data.Side note: You might consider changing tables for previous months to the newly introduced Standard-IA table class, if the tables don't see much read traffic. It could provide a cost savings.Last note: There's another recent feature where DynamoDB integrates with AWS Backup and this would let you do an On Demand backup when "closing" the table and have AWS Backup migrate the backup to cold storage.CommentSharejzhunteranswered a year ago0So @jzhunter - I setup a backup job and the resource is setup by tag.  I have some old static tables and can see I have 12 recovery points, and I see the same table daily for a week.So from what I understand, if the table didn't change, I am not charged, however, with multiple restore points, I think its taking up the space multiple times so I am charged, does that make sense?So, the right plan would be PITR on for the tables that change and continue to backup via AWSbackup.   After 45 days, remove the PITR and remove the backup flag knowing the latest is the most recent.As a fail safe, I can add a tag like quarterly snapshot and let that backup as a just in case but again if its not changing, that maybe overkill.CommentSharelraymondanswered a year agojzhunter a year agoHi, sorry to be slow in response, I wasn't beeped about your reply.It depends on your motivation for doing backups. PITR is good for recovering from a user or application error, where perhaps some items get deleted erroneously and you want to undo that delete. On-Demand backups (also backups managed via AWS Backup) are good for long term storage of a snapshot as of a point in time. If your table isn't changing and you've got a snapshot made since the last change, then there's no value in keeping PITR, or even in continuing with more daily backups.Perhaps you could enable PITR backups while the table is live and keep a singular On-Demand backup after it's frozen.Share0Ah ok ... so from what you say, I should do the following (and do this programmatically) ....After the 35 days of PITR, that YYYY-MM table becomes static, and with much less reads, I think the Standard-IA is a great idea.  I am just not entirely sure I follow about the PITR cost and/or recovery.   How I logically thought about it, was if on 12/1 the 2021-12 table was created, PITR enabled, AWS backup will still pick it up due to the backup tag.   On 1/5 (give or take), no new data will goto the 2021-12 table, so I should be able to turn that PITR off.  No data will change, so aws backup already has that table, so if anything ever happened I could just do a restore of that table by itself.   With that, I would assume i would pay more in December due to PITR as well as AWS Backup, but then in January, that storage change and PITR end would save and I would have that table in AWS Backup.As the aws backup job runs daily, since that table never changed, I would never need to do an onDemand backup, but as you said, I could set that backup job to transfer to cold after X days knowing it would only be if an emergency hit.Thank you for the quick reply, as I haven't had much experience with AWS backup, but seeing how powerful it is, trying to move more to it!CommentSharelraymondanswered a year ago"


Question: Update php ini file on Elastic Beanstalk

"Hello, i deployed REDCap with the cloudformation template from Vanderbilt University [https://github.com/vanderbilt-redcap/redcap-aws-cloudformation]. Issue i have is not able to upload file exceed more than 2M. i have to update the php.ini file so to increase some paramters like max_execution_time, max_file_uploads,max_file_size etc .....i tried to dowload the zip file of the version of the application and then in the .ebxtensions directory add a config file but every time i re-deployed this my beanstalk crashed and revert back to the old version. Below is my custom config filefiles:"/etc/php.d/project.ini" :mode: "000644"owner: rootgroup: rootcontent: |upload_max_filesize=64Mpost_max_size=64MIs there any step i missed ?ThanksFollowComment"


Question: Pinpoint Proyect and Campaing Names as table for QuickSight

Hi everyone.I have a question.. I'm looking for campaing name of pinpoint to include in my quicksight dashboard..  unfortunally I only have pinpoint metrics table generated in S3 and only campaing id (not name)... where I can find or get pinpoint campaign name ? is there son configuration or event..or table?FollowComment


Question: sls login in cloud9

Hi. I am investigating if I can move my workflow to Cloud9. A problem that has come up is that I can't login with serverless (sls login). The program indicates that it opens a new browser in order for me to login but I don't get an URL and opening a browser in Cloud 9 does not work.~/environment/slim7-api-s3v7.1 (jm-development) $ sls loginServerless: Logging you in via your default browser…How do I solve this?RegrdsJohanFollowComment

Answer: 0Removing the org parameter solved this for me.CommentSharejohanmattssonanswered 3 years ago


Question: Providing S3 access to MediaPackage for "live-to-VOD"

"I am creating a "live-to-VOD" workflow with MediaPackage, and I'm trying to understand how to best implement the correct policy to allow MediaPackage to do it.I will have many buckets (one per customer), and I need MediaPackage to be able to push assets into all of those buckets. Is there a way to grant MediaPackage access to all buckets with a sort of wildcard, or, does each bucket need to be expressly added in a new and separate policy?FollowComment"

Answer: "0Accepted AnswerHi chrisatmb, thanks for your query! I can see you've found some documentation on this. It is indeed possible to use wildcards to specify several buckets. For setting up the correct permissions for MediaPackage Live-to-VOD I'd start here:https://docs.aws.amazon.com/mediapackage/latest/ug/setting-up-create-trust-rel.htmlNote there are slightly different policies for VOD Vs Live-to-VOD. This should get you started but please let us know if you have any questions!CommentShareAWS-User-0287910answered 3 years ago0Ah, I see from the following guide that it's possible to use a wildcard for all S3 buckets like so:arn:aws:s3:::*https://docs.aws.amazon.com/AmazonS3/latest/dev/s3-arn-format.htmlCommentSharechrisatmbanswered 3 years ago"


Question: Nagios and Cloudwatch integration

"A customer wants to explore the possibility to send some Cloudwatch alerts based on certain conditions, to their existing Nagios Dashboard.Have found that there are some plugins that could be a valid solution:https://github.com/level23/nagios-cloudwatch-metricsHas anybody an up to date workaround that may fit or previous customer experiences?FollowComment"

Answer: "0Accepted AnswerI handled nagios in production around 6 years ago, so my information may be outdated.Consider this as a starting point for a potential 'hack' of a solution:Cloudwatch -> SNS (API call: https://SomeEndpoint ) EX: php/python script served by nginx/apache with basic/digest authOn alarm; the above endpoint call  a function/script that changes nagios alert depending on incoming alert. NAGIOS can mimic cloudwatch's status by leveraging its own state:  OK, WARNING, UP, DOWN etc.. so  script will parse incoming content within the API call and act accordingly.Possible advantages:Reduce hits on  API, as NAGIOS will not constantly hit cloudwatch API. it's being triggered only on cloudwatch status change.No credentials needed on Nagios box or any other box for that matter, as this is just a restful API call initiated by SNSSNS api call will handle the retry for you in case of restful api hiccup.Optional: As a fail-safe, to make sure you are alerted if/when an alarm does not reach NAGIOS. you can do the following:4.1. In addition to the mentioned API call; you can fan out the SNS topic to an SQS queue with a cloudwatch monitor of >1 message for longer than 5 minutes.At the end of our endpoint triggered script (mentioned above) you can add a function that deletes related message from queue. if script did not execute. (aka failed)  message will remain in queue and CloudWatch SQS alarm will go off and do whatever you need it to do, such as send e-mail to OPS mailing list.CommentShareAWS-User-3403893answered 5 years ago"


Question: Charge per hour of RDS MySQL

"Hi,I have received an invoice with a huge MySQL RDS hourly charge, and I don't know what it is due to. Do I need to close transactions somehow to stop the timer? What could I be doing wrong?$ 1.072 per RDS db.r6g.2xlarge Single-AZ instance, 66 hours in 3 days in April...Thanks in advance.Jaime I.FollowComment"

Answer: "0You should only get those charges if you have an active RDS database instance.  Have a look that Region those charges were for, and look in the RDS console under that region.CommentShareEXPERTskinsmananswered 2 months agorePost-User-9157199 2 months agoThank you skinsman, yes I have an active database instance, and I am billed from Stcokholm which is correct. What surprises me is the amount of hours charged. I wonder if it is mandatory to explicitly close any kind of connection or thread in the javascript code, jusgt in case I am leaving these processes open. I can review the process list often, but that is not a solution...To connect, I useJdbc.getConnection().createStatement().executeQueryThanks againShareskinsman EXPERT2 months agoRDS pricing is bases on the number of hours your instance is running, it's nothing to do with connections made by clients.  As soon as you create an instance you're charged the hourly rate for every hour it's running, so 24 hours per day even if no clients ever connect.  You can stop a database temporarily (then you're charged only for storage) for up to a week but you have to start it again to use it.If you can tolerate the cols starts and the MySQL version is suitable, you can use Aurora Serverless v1 which can scale down to 0 when not in use.Share0Thank you very much, skinsman. Obviously I purchased the wrong product.What do you mean with 'cols starts' ? Is it 'cold starts'? I will read about it.BRCommentSharerePost-User-9157199answered 2 months agoskinsman EXPERT2 months agoYes, sorry I meant "cold starts".  There's a bit of info about it here in addition to AWS documentation - https://www.linkedin.com/pulse/coping-aurora-serverless-v1-cold-starts-web-steve-kinsman.Please "Accept" my answer if this helps, to make it more visible to others seeking help.Share"


Question: Reserved Instance purchase - stuck in payment pending

"Hello.I just purchased / tried to purchase a reserved instance.The problem is that the status seems to be stuck as "Payment pending"Reserved Instance ID: ae907301-9f78-4b0f-b070-3f9fba5a0ea9What can I do from here?Regards,simkinFollowComment"

Answer: 0answered in chatCommentSharesimkinanswered 2 years ago


Question: AWS Inspector - Scan on-premise VMs - CIS Benchmarks

"Hello,I would like to ask about the possibility to run Inspector Scan from AWS account to scan VMs which are existing in on-premise network.If that not doable at this time, could you please advise with any alternative tool to scan same Rules Package that Inspector does: CIS Operating System Security Configuration Benchmarks-1.0Many thanks,MaanFollowComment"

Answer: "0Accepted AnswerHello Maan,Thank you for your question.At this time, it is not possible to run Inspector Scan for on premise servers and it currently only works for EC2 and container workloads on AWS.There is an existing feature request for this and you can keep track of this through our what's new page - https://aws.amazon.com/new/We do not have an ETA as to when this feature will be implemented.However, an alternative tool is available by CIS called CIS-CAT Pro which is available for on premise environments. Please be aware that since this is a third party tool, AWS cannot speak to its validity and does not offer support for this tool.Regardless, I have linked the alternative tool below for reference.CIS-CAT Pro:https://www.cisecurity.org/cybersecurity-tools/cis-cat-pro_preCommentShareEntasa_Canswered 10 months agoSUPPORT ENGINEERSumukhi_Previewed 10 months ago"


Question: Help with CodeArtifact - policy

"Hi,I have created a Domain and a Repo with PyPi as the upstream repo.When I now try to get pip from the PyPi I am getting the following error.An error occurred (AccessDeniedException) when calling the GetAuthorizationToken operation: User: arn:aws:iam::847674911784:root is not authorized to perform: sts:GetServiceBearerToken on resource: arn:aws:iam::847674911784:rootIt would be helpful if someone can through some light on how to progress on this one.The aws cli command isaws codeartifact login --tool pip --repository my-repo --domain my-domain --domain-owner 847674911784Regards,RamsterFollowComment"

Answer: "0Just to elaborate, I have the following policy at the domain level set up.{"Version": "2012-10-17","Statement": [{"Sid": "ContributorPolicy","Effect": "Allow","Principal": {"AWS": "arn:aws:iam::847674911784:root"},"Action": ["codeartifact:CreateRepository","codeartifact:DeleteDomain","codeartifact:DeleteDomainPermissionsPolicy","codeartifact:DescribeDomain","codeartifact:GetAuthorizationToken","codeartifact:GetDomainPermissionsPolicy","codeartifact:ListRepositoriesInDomain","codeartifact:PutDomainPermissionsPolicy","sts:GetServiceBearerToken"],"Resource": "*"}]}CommentShareRamsteranswered 3 years ago0Hi,You need to have a statement like this in your IAM user or role policy:{                 "Effect": "Allow",          "Action": "sts:GetServiceBearerToken",          "Resource": "*",          "Condition": {              "StringEquals": {                  "sts:AWSServiceName": "codeartifact.amazonaws.com"              }          }}There are some other examples at https://docs.aws.amazon.com/codeartifact/latest/ug/auth-and-access-control-iam-identity-based-access-control.html#limit-token-duration.CommentShareCarl Lewisanswered 3 years ago0Hi Carl,Thanks for the note.Can you elaborate your response please.I am using the root user to create the domain and the repos. I am not using any one IAM role or IAM user to login and then create a Domain or Repo. In this case - where should I add the statement you have mentioned in your response.Help Plz.Regards,RamsterCommentShareRamsteranswered 3 years ago0Ramster,The root user is not intended for accessing resources in your account, see https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html. I suggest creating a normal IAM user and then attaching one of the CodeArtifact managed policies to it.Carl.CommentShareCarl Lewisanswered 3 years ago0Thanks Carl.I figured this one out.This is what I did.I created a user called codeartiFor this User I attached the existing policy -- AWSCodeArtifactAdminAccessI also added an inline policy to this effect{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["codeartifact:"],"Resource": ""},{"Effect": "Allow","Action": "sts:GetServiceBearerToken","Resource": "*","Condition": {"StringEquals": {"sts:AWSServiceName": "codeartifact.amazonaws.com"}}}]}Then I downloaded the user credentials (Access / Secret)I went to my .aws file and edited the 2 files.In the credentials file i added this user credentialsuser1aws_access_key_id=STUFFaws_secret_access_key=MOre STUFFIn the config I created a config like thisprofile user1region=us-west-2output=tableThen in the cli command line I sued it like this..aws codeartifact login --tool pip --repository my-repo --domain my-domain --profile user1Works like a treat.I installed a few Python packages and also did a deploy and it works fine.The Ramster.Edited by: Ramster on Nov 27, 2020 5:20 PMCommentShareRamsteranswered 3 years ago0Great! Glad you got it working.CommentShareCarl Lewisanswered 3 years ago0Hi Carl,I am trying to use Codebuild in conjunction with codeartifact. I manually created the artifact repo and now I have all I need in my-repo plus the upstream repo as well. The task I now have is to use this repo in my build so that my build uses the packages from these repo and does not use egress traffic to reach out to PyPI when I use pip install << package name >>To that effect, I have added a single line for the codebuild to use the repo.aws codeartifact login --tool pip --repository my-repo --domain my-domain --domain-owner 847674911784I get the same issue as before, but I guess I am struggling for the solution. I can think of 2 solutions here.Log-In as user code artifact which I have created (which has stsToken bearer auth) and then use codebuild in that sessionIn the prebuild steps, somehow configure awscli in the container which it is running to set up profile for user codeartifact and then in the login command use --profile user1Am I missing any other easy option out?Regards,RamsterCommentShareRamsteranswered 3 years ago0Hi,When you sayI get the same issue as before,I assume you mean that you are getting this error when using CodeBuild:An error occurred (AccessDeniedException) when calling the GetAuthorizationToken operation: User: arn:aws:iam::847674911784:root is not authorized to perform: sts:GetServiceBearerToken on resource: arn:aws:iam::847674911784:rootPlease see the instructions here: https://docs.aws.amazon.com/codeartifact/latest/ug/using-python-packages-in-codebuild.html#python-packages-in-codebuild-iamBasically you need to edit the IAM role that is used by CodeBuild to have permissions to call GetAuthorizationToken (and other CodeArtifact operations).CommentShareCarl Lewisanswered 3 years ago0Thanks Carl. This is what I did.I figured out the Service Account / Role my codebuild was using (created when i first created the codebuild jobIn IAM for the service account / Role I edited and added the permissions as provided in https://docs.aws.amazon.com/codeartifact/latest/ug/using-python-packages-in-codebuild.html#python-packages-in-codebuild-iamThen i did the normal stuff - like getting my packages into the repoIn the BuildSpec.yml, used the aws login command as mentioned in my threads before to ensure Code build uses packages from my repo.The build is successful and works like a treat.CommentShareRamsteranswered 3 years ago"


Question: DNSSEC Key Google Domains Using Lightsail Instance/Static IP/Lightsail Distribution Nameserver

"My domain is parked at Google Domains.  I use a Lightsail INSTANCE to host a Wordpress app, which is distributed through a Lightsail DISTRIBUTION using custom Name Servers.  Using custom Name Servers with Google Domains disables Google's DNSSEC.  In order to enable DNSSEC, Google's DNSSEC setting is asking for the following from third party provider (in my case, Lightsail): Key Tag, Algorithm, Digest Type and Digest.Does my setup allow me to get this information WITHOUT having to TRANSFER MY DOMAIN to Route 53?  The domain is new and may not be transferred for 60 days.   Thank you in advance.FollowCommentdonleyataws 7 months agoWhat custom name servers are you using with the Lightsail distribution? Are you using a Lightsail domain and the "assignments" feature to provide DNS resolution to your distribution?Share"


Question: Unable to connect to Cloudtrail

"Hi team,Please note that while accessing this component,we are getting this error.There seems to be a problem with your session.Please try again in a few minutes or log in again.If the problem persists try clearing your browser cookies.Could you please help us what could be the root cause?FollowComment"

Answer: "0Hi,From the question I understand that when attempting to access Cloudtrail in the AWS console you are getting an error linked above.Based off of the error this would likely be an issue with your session rather than with the Cloudtrail console. I am linking the service health dashboard here (1) and there have not been any noted issues with Cloudtrail in the last week.If the issue with your session persists after logging out and back in to the AWS console again I would recommend creating a case with AWS support. This will allow an engineer to investigate the issue further and gather the additional information needed in order to resolve this problem.I hope you have a great rest of your day!References(1) https://health.aws.amazon.com/health/statusCommentShareSUPPORT ENGINEERPatrick_Vanswered a year ago"


Question: boto3 "logging" into the AWS SSO

"Hi, is it possible to "login" into the AWS SSO, so the "session access keys" would be created, using boto3?FollowComment"

Answer: "0Accepted AnswerHey there,Indeed you can access AWS accounts through AWS SSO by using Boto3. You're going to be looking for the SSO and SSO-OIDC API suites. You will still need to confirm CLI access via a browser, but you can make it so that the browser opens up with the validation code already input, and all the end-user needs to do is click a button on the screen. From here, you then just need to set the profile details as you see fit. I.e. Create a named profile, or set Environment variables.CommentShareCiaran Carragheranswered a year ago"


Question: Nginx Custom Config in Elastic BeanStalk Docker Plateform

"I'm using EB Env with Docker Platform to Deploy my NodeJS Application as Nginx Proxy With Immutable Deployment Pattern. I got errors related to large files upload, timeout etc. Now i want to overrides the configs for the Nginx.I'v created the .platform/nginx/conf.d/proxy.conf in the root of the project of NestJS with the conent;client_max_body_size 100M;How I deploy;Build docker image on github actionsPush the Image on ECR, and Update the Dockerrun.aws.json with latest URL of ECR repoTrigger EB Deployment using  Dockerrun.aws.jsonNow when i connect to the new Instance Created after deployment, I go to /etc/nginx/conf.d/elasticbeanstalk and i can't see the proxy.conf file there, not event the config i applied in any of the nginx config.$ tree.├── conf.d│   ├── elasticbeanstalk│   │   └── healthd.conf│   ├── elasticbeanstalk-nginx-docker-upstream.conf│   └── healthd_logformat.conf├── default.d├── fastcgi.conf├── fastcgi.conf.default├── fastcgi_params├── fastcgi_params.default├── koi-utf├── koi-win├── mime.types├── mime.types.default├── nginx.conf├── nginx.conf.default├── scgi_params├── scgi_params.default├── uwsgi_params├── uwsgi_params.default└── win-utfWhat I'm doing wrong here.FollowComment"


Question: Console logins not appearing in CloudTrail logs

"I'm trying to create an alert for AWS console logins. I've set up a CloudTrail trail that is multi-region, enabled for all accounts, and is logging all API activity. It's creating log files in my S3 bucket, but those files never include events for console access. I'm logging in and out over and over again and then pulling the files but do not find login events in them. Also, when I go to the CloudTrail event history and search for "Event name = ConsoleLogin" it does show me some login events but the most recent one is from 13 days ago and I've logged in many times since then. When I'm looking at the event history I have my region set to us-east-1. Any ideas what I could be doing wrong here would be amazing, thanks!FollowCommentlarryjkl a month agoI dont know a lot; but are you seeing other more recent types of management events (   "managementEvent" : true ) in the bucket?Share"


Question: How to make C++ component appear in the editor?

"I'm following this user guide: Creating a Componentto create a C++ component for Lumberyard, but I don't know where did I go wrong that the component won't appear in the editor.I did the following step:Add new file into the project I created:PlayerCtrlComponent.cpp & PlayerCtrlComponent.hI copy the code of a component (CameraRigComponent) for thePlayerCtrlComponent, I do this for testing purpose, I just want to see if the component actually can be assigned to an entity.I edit the following things of copied CameraRigComponent, just to make the editor think the component is not duplicated:*namespace Camera ---> TestTest*GUID, I replace the own one with the new one*class name CameraRigComponent --> PlayerCtrlComponent*Edit the following code    void PlayerCtrlComponent::GetProvidedServices(AZ::ComponentDescriptor::DependencyArrayType& provided){provided.push_back(AZ_CRC("PlayerCtrlService"));}void PlayerCtrlComponent::Reflect(AZ::ReflectContext* reflection){...editContext->Class<PlayerCtrlComponent>("Player Ctrl", "The Player Ctrl component can be used to add and remove behaviors to drive your player entity")->ClassElement(AZ::Edit::ClassElements::EditorData, "")->Attribute(AZ::Edit::Attributes::Category, "TestTest")...}Close the Lumberyard Editor & rebuild the project that I created (I re-build only that project, using Visual Studio feature: project only > build only Empty_Project)After the build is success, I re-open the Lumberyard Editor, but the component doesn't show up when I click the button Add component for an Entity.Am I missing something?Follow"

Answer: "0Accepted AnswerFinally I figured it out. No wonder why I did this all morning and still can't find anything in the editor. I must re-build my game project (Lumberyard's way).So here I sum up the hold thing:(Thepurpose of the following step is to make a component appear in the editor, I gonna borrow the code of the component CameraRig cause it's the simplest component)Assume your project name is Empty_ProjectStep 0: Read the manual so you have basic understanding for the component C++ structureProgrammer's Guide to Entities and Components & Using Gems to Add Modular Features and AssetsStep 1: Close Lumberyard Editor if it's opened & open the game project with Visual StudioStep 2: Ok, here I borrow the code of CameraRig component for education purpose only.Add the classes of the file:CameraRigComponent.cppCameraRigComponent.hCameraFramework's header filesDon't forget to edit the namespace, GUID.You can edit the Category for the componentFor example, I changed it to HDNShare->Attribute(AZ::Edit::Attributes::Category, "HDNShare")//"Camera")(At this moment it's just these files, it could be changed in the future though)Step 3: Register the component (Thanks to brunohgouveia for reminding me this). You can check the file CameraFrameworkGem.cpp.Actually I copy the whole CameraFrameworkModule class, just remove this code of that class                    // This is an internal Amazon gem, so register it's components for metrics tracking, otherwise the name of the component won't get sent back. // IF YOU ARE A THIRDPARTY WRITING A GEM, DO NOT REGISTER YOUR COMPONENTS WITH EditorMetricsComponentRegistrationBusAZStd::vector<AZ::Uuid> typeIds;typeIds.reserve(m_descriptors.size()); for (AZ::ComponentDescriptor* descriptor : m_descriptors){typeIds.emplace_back(descriptor->GetUuid());}EBUS_EVENT(AzFramework::MetricsPlainTextNameRegistrationBus, RegisterForNameSending, typeIds);As a matter of fact, it did tell you (a third-party writing gem) don't copy this code.Also pay attention to the namespace and GUID (just like in step 2)Step 4: don't forget to edit the waf file (empty_project.waf_files), you can check this file as an example.Step 5:Build Only Empty_Project (In Visual Studio, Right click Empty_Project > Project Only > Build Only Empty_Project), make sure the build issuccessful.Step 6: Rebuild game project as Lumberyard tell you: Rebuilding Your Game ProjectStep 7: After rebuilding successfully, open Lumberyard Editor and now you can find your component.REMOVEDUPLOADSharerePost-User-6460635answered 5 years ago0First, thank you for your answer.So when I when replace the "Empty_ProjectSystemComponent" with "PlayerCtrlComponent" in the file "Empty_ProjectModule.cpp" (this file register the component), I got a bunch of linkage error. So I think I'll focus on making the "Empty_ProjectSystemComponent" appear in the edit now (This is the default component which is generated automatically by Lumberyard). But I don't know why this "Empty_ProjectSystemComponent" won't appear in the editor. How to make "Empty_ProjectSystemComponent" appear in the editor?SharerePost-User-6460635answered 5 years ago0Did you register your PlayerCtrlComponent?https://docs.aws.amazon.com/lumberyard/latest/userguide/component-entity-system-pg-registering-your-component.htmlSharerePost-User-0998249answered 5 years ago0thanks for your help.About the linkage error I mentioned earlier in the first comment, I figure it out, it just because I forgot to add PlayerCtrlComponent.cpp & PlayerCtrlComponent.h into the file "empty_project.waf_files". After I edit the file empty_project.waf_files, I can register the PlayerCtrlComponent with the file Empty_ProjectModule.cpp.About the "AppearsInAddComponentMenu", the PlayerCtrlComponent has this attribute because it's a copied of CameraRigComponent.So I think the culprit must be something else, because the PlayerCtrlComponent still doesn't show up.I think I better re-read the user manual (Programmer's Guide to Entities and Components &Using Gems to Add Modular Features and Assets) again to make sure I didn't miss anything. I'll be back when I've done reading.SharerePost-User-6460635answered 5 years ago0First, Empty_ProjectSystemComponent is a System component (which I believe it's not going to show up in the Entity View, but in the "SystemEntity Editor", so first check if it shows up there).Docs: https://docs.aws.amazon.com/lumberyard/latest/userguide/component-entity-system-pg-creating-system-components.htmlSecond,I believe that if you don't have a separate EditorComponent implementation for you component, you need to add the "AppearsInAddComponentMenu" attribute to the component ClassElement whendefining it to the EditContext (also take a look in the link above).Beaware that I just started with Lumberyard (2~3 days ago) and thats whatI think it's going on. The engine code is well architected and organized, but it's quite huge and I don't really have a solid knowledgeof these systems yet. Therefore, I'm not 100% confident that I'm right.SharerePost-User-0998249answered 5 years ago"


Question: KMS Key rotation

"Once KMS key rotation is enabled to 1 year rotation (as example, the key was created 13 months back), when would the CMKs be rotated ? Would it be one year once it was enabled or one year after the key was created ?FollowComment"

Answer: "0Accepted AnswerIt would be one year after it was enabled.When you enable automatic key rotation for a customer managed CMK, AWS KMS generates new cryptographic material for the CMK every year. AWS KMS also saves the CMK's older cryptographic material in perpetuity so it can be used to decrypt data that it encrypted. AWS KMS does not delete any rotated key material until you delete the CMK.Key rotation changes only the CMK's backing key, which is the cryptographic material that is used in encryption operations. The CMK is the same logical resource, regardless of whether or how many times its backing key changes. The properties of the CMK do not change, as shown in the following image.More details can be found at the documentation page below :https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.htmlCommentShareAWS-User-8343510answered 6 years ago"