Question: What are TLS 1.0 or TLS 1.1 connections and Cloudfront

I have received an email from AWS advising me that apparently I have TLS 1.0 or TLS 1.1 connections that need "action" and I must update all client software and enforce the bucket items to TLS 1.2 or higher.I have NO IDEA what this means nor can understand what I need to do as I am not able to understand/follow the Knowledge Center article.Can someone explain this to me in simple English and provide that appropriate assistance as I am not tech savvy.Thank youFollowCommentBrettski-AWS EXPERT11 days agoCould you link to the Knowledge Center article? That would help to provide advice.Share

Answer: "0I have seen this before in another aws repost.I believe there is a report of clients making cli/api calls to aws endpoints using old tls versions.I think your notification may have specified which api endpoints are effected.If this is the case you will have to use cloudtrail to locate who’s making these soo calls and what tls version they are using. They may need to upgrade the AWS cliAs for the bucket item, I’ve not heard of AWS notifying however you can enforce on buckets not to use tls less than 1.2CommentShareGary Mcleananswered 10 days agoFrances-7059226 10 days agoThank you for your answer HOWEVER as I stated, I am NOT tech savvy - I have no idea of what you are talking about nor what this email from AWS is talking about. Nor what I am supposed to do.I don't know what a CLI call is or tis version.I don't understand who or what is calling whoAll I understand is that I was recommended to use AWS to upload videos/audios as a storage facility for future use.  Do I now have to remove all my files to an external hard drive?Thank you,Share0Hi.When you use AWS resources from SDK, JDK or command line interface (CLI) you make calls to API from AWS, to make this calls a secure protocol is used (TLS), the TLS version is related to the version of the SDK/JDK/CLI used.  If you received the notification it means that some software is accesing your account with a rather old version and the action to be taken is to update SDK/JDK/CLI from that software in order to upgrade TLS version to 1.2.   This software can be something you developed by you organization, a third partie developed software or a SaaS you use that integrates with AWS, i.e. backup solutions, SIEM ingesting your logs.In this related blog post you find guidance for two actions you can take:a. Understand what resources are afected, that info you can look at the Personal Health Dashboard for our account (login to your account and then look for Persoal Health Dashboard.b. Find what calls are using TLS older than 1.2 using CloudTrail logs, this logs will provide with some information like credentials beings used, IP and library used.  That usually is a clue to find what program is involved in the calls to API.I might also add to check IAM Access Analyzer to find out access from other accounts or federated users accesing your account and reviewing the credential report as it is likely and old SDK/JDK/CLI use might be related to a user that has not rotated passwords or access keys.Update: If notice is related to Cloudfront accesing S3 Origin, you can check this documentation and select TLS 1.2 for origin access protocol.Hope this answers clarifies path for action.CommentShareromerogtanswered 10 days ago"


Question: How to set/change the default consumer_timeout parameter in AWS MQ rabbitmq brokers?

"Dear Support;we have switched our broker to AWS MQ rabbitmq, but we have realized that some of the tasks we execute have ETA longer than the default rabbitmq consumer_timeout parameter, which is set to 30 min for the rabbitmq broker version we use (3.9.16). Despite being easy to reconfigure the parameter locally using the rabbitmq.conf file or rabbitmqctl tool, I cannot find a way to set it via the broker's web console.Could you let me know how to do that? I find it frustrating that such fundamental parameters cannot be tweaked easily.PS. I have also found a thread stating I should open the case with Amazon MQ Support, so there you go.FollowComment"

Answer: "1Hello there,Kindly note that we(AWS) currently support the configuration of the consumer_timeout on Amazon MQ for RabbitMQ brokers. You may need to open a support case to Amazon MQ support from your AWS console Support Center and request for your broker to be configured with the desired consumer_timeout.CommentShareSudeep_Sanswered 6 months ago"


Question: Using Aurora Postgres with MSSQL Linked Server

"Is it possible to setup a linked server connection between Aurora or RDS (PostgreSQL) and an on-prem MSSQL server using Windows authentication with the on-prem Active Directory (and its AD-Connector on AWS)?The purpose of this setup is for ongoing work, not a migration, and ideally, we would like to create a single connection to the AWS database which will in turn query the on-prem DB and fetch data from there for our query.I am familiar with this blog post: https://aws.amazon.com/blogs/database/implement-linked-servers-with-amazon-rds-for-microsoft-sql-server/ but it doesn't mention Windows Authentication.Thanks!FollowComment"

Answer: "1Accepted AnswerYou may want to check out if the tds_fdw extension is supported on your Aurora PostgreSQL version: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraPostgreSQL.Extensions.html#AuroraPostgreSQL.Extensions.14There are examples showing you how to connect to a Microsoft SQL Server:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.PostgreSQL.CommonDBATasks.Extensions.foreign-data-wrappers.html#postgresql-tds-fdwGood luck!CommentSharerobcubeanswered 4 months agorePost-User-5941005 4 months agoThanks! For the future - regrading Windows Authentication with this plugin, it doesn't look like it's doable unless MSSQL is using mixed authentication.https://dba.stackexchange.com/questions/96885/foreign-data-wrappers-windows-authenticationShare"


Question: EC2 instance stuck in "shutting-down"

"Hello, My EC2 instance i-0bde7222f1f949e94 is stuck in state "shutting-down". Can you please terminate/reboot it? ThanksFollowComment"

Answer: "0Accepted AnswerHello,The instance has now moved to a stopped state, you can go ahead and start the instance again.The reason as to why the instance failed the status checks was because the underlying hardware had become impaired.The following are examples of problems that can cause system status checks to fail:Loss of network connectivityLoss of system powerSoftware issues on the physical hostHardware issues on the physical host that impact network reachabilityI have taken the above from the following link.-- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-system-instance-status-check.html#types-of-instance-status-checksCommentShareAWS-User-8424448answered 4 years ago"


Question: Run lightsail container service with privileged mode

"Hello,I need to run my lightsail container service with privileged mode. How can I do that?This is because my container has mount to an S3 bucket where I used s3fs. But for this to be successful the container needs to run with --privileged mode.Thanks in advance!FollowComment"

Answer: "0This isn't possible at the moment, but I'll pass on your request to the team!CommentSharetanbriananswered a year ago"


Question: Cognito User Pool : callback URL for Android Serverless app

"Hello guys !I want to create an Android app that uses AWS to do heavy calculations (ie generate images with stable diffusion). The app will ask for these AWS ressources with Amazon API Gateway.Unregistered users must not be able to access this API (they have to register and pay, first). I want to use Google Login as only way to sign in and log in (just like most games on Android ; no passwords). I heard Cognito User Pool was designed for this purpose.But now, I’m quite confuse. I need a callback URL to create a Cognito User Pool, but I don’t have any servers. I don’t have an URL to redirect to. How does this works ? Am I missing something ? Can’t I use Cognito this way, to ensure that only registered users can access my Amazon API Gateway ?Thanks in advance !FollowComment"

Answer: "1Accepted AnswerHi,I'd say the point is how to manage the authentication process. Amazon Cognito user pools can help you implement Social sign-in, for example using Google, but still there have to be integrations running at the back-end. One of those integration is actually between Amazon Cognito and the Identity Provider (IdP) which is Google in this case.You can take a look at https://docs.aws.amazon.com/cognito/latest/developerguide/authentication.html that explains “Your app users can sign in either directly through a user pool, or federate through a third-party identity provider (IdP). The user pool manages the overhead of handling the tokens that are returned from social sign-in through Facebook, Google, Amazon, and Apple, and from OpenID Connect (OIDC) and SAML IdPs. After successful authentication, Amazon Cognito returns user pool tokens to your app. You can use the tokens to grant your users access to your own server-side resources, or to the Amazon API Gateway.”Another option that you could evaluate is Amazon Cognito identity pools (federated identities), instead of Amazon Cognito user pools. These are a couple of references that might help. Pay particular attention to the second link wiht the authentication flow.https://docs.aws.amazon.com/cognito/latest/developerguide/getting-started-with-identity-pools.htmlhttps://docs.aws.amazon.com/cognito/latest/developerguide/authentication-flow.htmlOf course, there are always trade-offs, pros and cons.I hope this helped and good luck!!!CommentShareSergioAanswered 3 months ago"


Question: alb  Average connection duration

"Hello Everyone,I have one confusion in ALB pricing. What is Average connection duration (in second) in LCU pricing?FollowComment"

Answer: "0Hello,Regarding the LCUs for the Amazon Application Load Balancer,  connection duration is not related directly to the LCUs for pricing.  It would assist with determining your highest LCU if you know how much data the connection was passing and the durations of that connection.The LCUs that are used for pricing are the following:New connectionsActive connectionsProcessed bytesRule evaluationsHope this helps, here is AWS public pricing for ALB. Some additional context for the "duration" computation can be found in pricing example #3https://aws.amazon.com/elasticloadbalancing/pricing/?nc=sn&loc=3CommentShareAWS-User-0357409answered 4 months ago"


Question: Enabling SNAT for eksclt created EKS cluster

I have an EKS cluster provisioned using eksctl.At the moment the any outbound traffic (to the Internet) from pods running in the cluster comes from the public IP address of the EC2 node that it is running on. I would like to implement SNAT so that the outbound connections appears to come from a fixed set of addresses (or address since I'm starting with a single NAT Gateway) no matter how many nodes we end up adding to the cluster.I have found the following in the documentation that appears to cover this situation:https://docs.aws.amazon.com/eks/latest/userguide/external-snat.htmlBut I have some questionsWhen provisioned eksctl appears to have created 2 Subnets for each Availability Zoneeksctl-[cluster name]-cluster/SubnetPublic[AZ Name]eksctl-[cluster name]-cluster/SubnetPrivate[AZ Name]Each node only appears to have interfaces linked to the SubnetPublic and the attached routing table default route is via a Internet Gateway.By contrast the SubnetPrivate default route is via a NAT Gateway.Questions:I assume that if I use kubectl set env daemonset -n kube-system aws-node AWS_VPC_K8S_CNI_EXTERNALSNAT=true I can roll that back by running kubectl set env daemonset -n kube-system aws-node AWS_VPC_K8S_CNI_EXTERNALSNAT=false?Once I apply the change above the I would also need to change the default route on the SubnetPublic to point to the NAT Gateway instead of the Internet Gateway?The SubnetPrivate is not actually being used for anything?FollowComment

Answer: "0Hey,The use case which you are looking for where all the outbound connections from the cluster should appears from a specific IP can be achieved using NAT gateway.Currently as you have mentioned your nodes are in public subnet with internet gateway in the route table. Launch nodes into Private subnets which have NAT gateway in route table. This will make sure any outbound connection from the pods will appear to be from the IP of the NAT gateway.Refer to https://docs.aws.amazon.com/eks/latest/userguide/creating-a-vpc.html, which give more information on this.Irrespective of SNAT status, this will make sure the outbound traffic to internet will appear from NAT gateway IP.To answer your specific queries:Yes it can be reverted back to "false" by executing "kubectl set env daemonset -n kube-system aws-node AWS_VPC_K8S_CNI_EXTERNALSNAT=false"No do not make any change to public subnet, instead use private subnet to launch nodes.Ideally Private subnet should be used to launch nodes.CommentShareSUPPORT ENGINEERLakshay jainanswered 9 months agohardillb 9 months agoIf I want to do this without having to restart/recreate my running nodes is that possible?ShareLakshay jain SUPPORT ENGINEER9 months agoThat is possible but you will have to make modifications at the VPC and Subnet level which includes recreation of the NAT gateway. This can make the things complex. So the recommended solution will be to recreate the nodes in existing private subnet and deleting the public subnet nodes.Share"


Question: Cannot query Athena tables as the Glue crawler generated data having = instead of : in the column values

"I have created tables in Athena using Crawler to run on S3 path having GZ file format data, the table is generated but has data with = between key value pairs than : between themSample data from table:payload={x=[{y={z=123, code=null, p=null, q=null}}],r=10}I can query the data by dot for some, but for the ones inside array I am unable to use json_extract functions.How can I add the separator as : instead of = or make some change in Athena while querying to extract values from array ?FollowComment"

Answer: "0This issue seems to be related to source data. During my replication I found that the input data should be something like below to get the output you are seeing Athena.{"string": "payload={x=[{y={z=123, code=null, p=null, q=null}}],r=10}"}Also, please note that Athena only reads json files that confirm with formats mentioned in [1]. Hence, request you to please reach out to support engineering with your input data to better understand the issue at hand.————————Reference:[1] https://aws.amazon.com/premiumsupport/knowledge-center/error-json-athena/================Have a nice day!CommentShareSUPPORT ENGINEERArunanswered 10 months ago"


Question: IAM authentication for RDS secured behind secrets manager

"Hi,We have mysql RDS which is behind secrets manager and I have created IAM profile which includes EC2 and RDS full access polices and mysql is enabled for IAM authentication. How do we connect from java application i.e tomcat context file  using IAM authentication for RDS , it works using secrets manager via access key and secrets access key. Our clients want to connect to RDS using IAM but RDS is behind secrets manager.Thanks,Easwar.FollowComment"

Answer: 1Have you followed the steps listed here?Once you completed the prerequisites you can generate an IAM auth token using the AWS Java SDK.CommentShareJason_Sanswered a year ago


Question: Route53 record(s) to centralize VPC interface endpoints across multiple VPCs/regions

"Hi,we tried to follow both articles:[1] https://aws.amazon.com/blogs/networking-and-content-delivery/centralize-access-using-vpc-interface-endpoints/[2] https://aws.amazon.com/blogs/architecture/using-vpc-endpoints-in-multi-region-architectures-with-route-53-resolver/to create an organization-wide centralized access to some (S3, Api-Gateway, SSM) AWS services using VPC interface endpoints but it's not clear what record(s)  I need to insert into Route53 PHZs.Adding only a domain root alias record (named like the zone) pointing to the VPC Endpoint as described in [1], doesn't work for me, applications trying to resolve resources names like:m01olkffr5.execute-api.eu-central-1.amazonaws.commybucket.s3.eu.-central-1.amazonaws.comfail with "unknown host".Should I use a wildcard (*) record?Thanks in advanceFollowComment"

Answer: "1Accepted AnswerYes, for s3 and to support all bucket.s3... URL, you will need a wildcard record in the PHZ.   This ( https://aws.amazon.com/blogs/networking-and-content-delivery/secure-hybrid-access-to-amazon-s3-using-aws-privatelink/) provides great detail on different options to work with S3 endpoints, with PHZ instruction under 'option 3'.For API Gateway,  when you associate endpoint with the REST API, API gateway will create the alias record for you (for <api>-<vpce id>.execute-api.... ).   You may not want to create wildcard record for *.execute-api.., if not all your API calls go through the same VPC endpoint.CommentShareBo_Ganswered a year ago1Hello,When centralizing access to VPC Interface Endpoints powered by PrivateLink, you should create a record that covers all possible queries that you would want to forward to that endpoint. So taking for example, Amazon S3: if you only want to forward queries for examplebucket to that endpoint then you would only create a record for examplebucket.s3.<region>.amazonaws.com and have it point to that VPC endpoint. If you want to forward all S3 queries to that endpoint, then you can create *.s3.<region>.amazonaws.com.CommentShareEXPERTScottanswered a year agoEXPERTHernitoreviewed a year ago1Hi! The first blog you list (Centralize access using VPC interface endpoints to access AWS services across multiple VPCs) explains very good the steps to follow to configure PHZs and ALIAS records. So, in the example of an S3 VPC endpoint, you first create the PHZ s3.eu-central-1.amazonaws.com, and later the ALIAS record mybucket.s3.eu-central-1.amazonaws.com pointing to the VPC endpoint (as it is explained in Step 2). That configuration should work.Have you associated the PHZ to all the VPCs that need the DNS resolution? You can try to use the wildcard option to check if the rest of the configuration is done properly. If with the wildcard does not work, maybe you need to check again that you followed all the other steps correctly.CommentSharePablo_Sanswered a year ago"


Question: Accessing Redis from an external app not hosted on AWS

"Hello, I am looking into using redis from an app not hosted in AWS. I saw in documentation that it's not recommended due to security concerns other than in testing/development with a VPN. Is there any documentation on what those concerns are? I need to present to my manager an explanation of why it's not recommended.FollowComment"

Answer: "1Accepted AnswerGiven that Redis is a database (yes, in-memory but that's the idea - for speed): We strongly recommend that you don't expose databases to the Internet directly. It opens them to attack, abuse, etc.Could you limit access to Redis (or any database) to specific remote IP addresses? Yes. But it's pretty easy to make a mistake there; and if there are many users of the application then that becomes impractical and difficult to maintain.Could you limit access using some sort of authentication (could be username/password; could be API key; etc.)? Yes. But now your database is open to brute-force attacks; potential DDoS; and so on.If you allow access to Redis via a VPN (presumably site-so-site but client VPN also qualifies) and only allow access via the VPN then generally (from a security perspective) that's a "private" connection (the "P" in VPN") so you have controlled who can connect.TL;DR: Security best practice says "don't allow access to databases over the Internet unless you really know what you're getting into".CommentShareEXPERTBrettski-AWSanswered a year agoAWS-User-7464390 a year agoThanks for the information, that really helps in what I tell my manager.Share"


Question: Why Does My EBS Volume Consumption Increases Day-by-Day

"Hello, I have a EC2 Free Tier instance. My volume consumption increases even though I don't do anything. I'm sharing examples. Here is my disk storage from Ubuntu terminal. The total size of the server is 3.6G and 3.5G of it is the OS based files. My Node.js server is running in home/ubuntu and its size is 104MHowever, my EBS consumption on bills page increases day by day. First it was 4.225G then it jumped up 4.864G and this morning it's 5.536G. As you can see I'm only charged for Frankfurt region I have no other EBS resources on different regions but it still growing up.I have no idea why it is increasing please help.Edit: I have only 1x25G gp2 SSD and no snapshots.FollowComment"

Answer: "0Accepted AnswerIt says "GB-Mo" that is gigabytes per MONTH. Reason why it is increasing is because time goes by.You said you have provisioned 25GB EBS disk -> after a month this number will be about "25GB-Mo".Ps. It has nothing to do with how much of it you have actually "used". This is something AWS can not know for a block device like EBS.CommentShareKalluanswered 4 months agoEXPERTskinsmanreviewed 4 months agoutkuonursahin 4 months agoOkay I thought about that too. But in that case shouldn't it increase 104M per-day since my running Node.js server's size is 104M? Yesterday it was 4.864G and this morning 5.536G it increased almost 700M. Does it account the OS based files? But if it account OS files, in that case shouldn't it increase 3.5G per-day since it's the size of OS files? I'm totally confused now. Your clarification will be much appreciated, thanks.Share0To expand on Kallu's answer, you have a 25GB disk which as he said would consume 25 GB-Mo per month, i.e roughly (25/30) GB-Mo per day  = 0.8 GB-Mo per day, which is about what you're seeing.CommentShareEXPERTskinsmananswered 4 months agoutkuonursahin 4 months agoThanks for answer. Will it exceed the 30GB-mo? I decided to take 25GB disk on purpose to avoid exceeding the 30GB free-tier limit. Is it safe like that? Is there any chance to exceed the limit?ShareNataliya_G EXPERT4 months agoNo, it will not exceed that limit, unless you decide to add more storage (inscrease the volume size or add new volume). You are charged for what you provision in the case with ESB volumes. If you only created one volume that's 25Gb large, then you should not run over the free tier limit. Also consider that if you are making snapshots of your EBS volume (backups), they are billed separately, and you need to check if you are covered by free tier for snapshots, too.Share"


Question: EC2 in region us-east-2c network issue

"We have noticed network connectivity issues at our EC2 server in region us-east-2c , specifically we are unable to connect to it for SSH and Web services while still being able to access the server from SSM manager , cloudwatch recorded a drop in network traffic during 8:30 AM UTC , we are not using aws support package , anyone have this problem ?FollowComment"

Answer: "2I would check to see if any changes have been made to your instance's Security Group or the NACL assigned to the subnet.You can utilize the VPC Reachability Analyzer to troubleshoot your network traffic flow.https://aws.amazon.com/blogs/aws/new-vpc-insights-analyzes-reachability-and-visibility-in-vpcs/One other note - If you stop and start an instance your instance is usually deployed to different hardware.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html#what-happens-startCommentSharetedtrentanswered 6 months ago0this problem lasted for about 30 minutes, we didn't edit Security Group or Network ACL parameters before, during the crash I was able to access the server via SSM session and I found that the server lost connection to the internet because when trying to ping and resolving some domains and IP addresses like 8.8.8.8 , 1.1.1.1 , google.com etc returned no responseCommentSharehoangvietanswered 6 months ago"


Question: Is it possible to change the language or custom text of Hosted UI Cognito ?

I'm very confused that Can we custom the text or change language (maybe from english to japanese) ? it's very basic and I wonder that why I can't do it on AWS Console.FollowComment

Answer: "1Hi, unfortunately seems this is not yet a supported feature.https://repost.aws/questions/QURSGiIGzQQ1iyUWLufsRxuQ/how-to-translate-cognito-hosted-ui-formsIf using amplify there may be a possibility (https://docs.amplify.aws/ui/customization/translations/q/framework/react/) but seems more a workaround than a proper solutionCommentShareEXPERTalatechanswered 2 months ago"


Question: Can SQS Standard Queue give priority to some messages in the Queue

Is it possible to give high priority with SQS Standard Queue or FIFO QueueFollowComment

Answer: "2Accepted AnswerNo. SQS does not have any form of priority queues. If you need that, create several queues, each with a different priority and consume them in the right order.CommentShareEXPERTUrianswered 8 months agorePost-User-4021996 8 months agoHi Uri, Thank you for the response. Awesome. It is clear to me now.Share"


Question: Connect opt out of a queue to leave a voicemail

"Customer wishes to have voice contacts in queue for a maximum of 5 mins. Play a message every 60 seconds where the caller is asked "to leave a voicemail press 8 or continue to hold". After 5 mins force to voicemail. "Customer Queue" flows are very picky. I had a complete logical design, however when attempting to publish I get errors of block placement. It appears that Connect wants to keep a call in queue (which is logical). However needing to get out that queue is also needed at times.FollowCommentcarldestefano a year agoTo those that answered, THANK YOU. I am traveling this week and will not have time for few days to digest and work with what appears to be great info so far. I will definitely be following up.Share"

Answer: "0I believe the issue you might be facing is trying to play message before a loop prompt block (https://docs.aws.amazon.com/connect/latest/adminguide/loop-prompts.html)So to work around this.Drop a loop prompt block on and interrupt every 60 seconds, then Play your message and offer a voicemail. Create a loop that after 4 times you force the customer to a non staffed queue and to leave a voicemail.You can also interrupt after 20s and daisy chain your logic as needed never returning back to the loop prompt block. Do not set below 20s as this can cause odd behaviour due to the agent being allowed 20s to pickup the contact.ThxCommentShareDanBloyanswered a year ago0Hello, as @DanBloy mentioned, you may be receiving an error due to the placement of a Loop prompt blocks, or the absence of one, in your Customer queue flow. Ensure the Loop prompts block is the first block after the entry point, and build out your logic from there.In my experience, the logic you have described can lead to a bad customer experience. It is nice to have escape logic so a customer isn't stuck waiting in queue, but forcing the customer to voicemail after a specific duration after they have repeatedly chosen to remain holding can be optimized. Consider adding logic in your primary Contact flow prior to placing the call into queue to divert the caller to Voicemail. You could include logic to notify the user if the oldest call waiting is over 5 minutes, and then either force the call to voicemail there or give the option to be placed into queue. This type of check can reduce the number of abandoned calls (every call that goes into queue and then gets routed to voicemail will count as abandoned) and empower the caller to immediately choose to leave a voicemail without waiting the initial 60 seconds you set in your loop prompt interrupt.Enjoy.CommentShareSteven_Wanswered a year ago0Suprisingly enough I just finished writing article for my blog about Amazon Connect where I give example of sending call to Voicemail directly from Customer Queue flow:https://contactcenterdude.blogspot.com/2021/12/voicemail-in-amazon-connect-part-1.html(more specifically see Step 6)Hope that helps.CommentShareContact Center Dudeanswered a year ago"


Question: Status check fails if ec2 is changed to the past date

"I want to operate on the past date.However, if you set the system date to a date in the past, you will not be able to communicate in about one hour, and a status check error will occur.Error 'Instance connectivity check failed with'If the time synchronization is set and restarted, since the above problem does not occur, we think that it is an obstacle when setting the system date in the past.Due to problem separation, creating the same type of instance and setting the time in the same way in the same way caused the same failure.Is there a way to avoid it?OS: CentOS7Instance ID: i-041a2f09dbad0d8d0Instance type: c5.largeAvailability zone: ap-northeast-1aFollowComment"

Answer: "0We received technical support and resolved it.I confirmed that the event will be reproduced in the verification environment using an instance that starts with the same AMI as the instance where the event occurred.When updating the IP address after the dhcp client updated the date, the IP address could not be updated, the network connection was lost, and the instance status failed with the record that could be confirmed.If it is the same event as above, you can think of a way to temporarily set the network to static (static) as a workaround.I will inform you the specific operation procedure below.Stop time synchronization service$ sudo systemctl stop chronydPlease check the network settingsExecute the following command and make a note of the setting contents.$ ifconfig$ routeChange the network interface settingsPlease correct the setting file '/etc/sysconfig/network-scripts/ifcfg-ens5' according to the customer's environment based on the contents confirmed in 2.Description exampleBOOTPROTO=noneIPADDR=10.15.0.226NETMASK=255.255.255.0GATEWAY=10.15.0.1DEVICE=ens5ONBOOT=yesTYPE=EthernetUSERCTL=noExample of description so farChange the name of an unnecessary setting fileBecause unnecessary network interface settings exist, restart of the network service will fail. Please change unnecessary setting file name with the following command.$ sudo mv /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/org_ifcfg-eth0Restart the network service.After changing the configuration file, restart the service with the following command.$ sudo systemctl restart network※ When restarting the instance (OS restart), please note that the contents set in 3 will be rewritten to the original DHCP setting.If the event recurs even if you change the network settings above, please share the following information. - syslog (files of /var/log/messages mainly when an event occurs)CommentShareymgr002answered 4 years ago"


Question: Domain verification fail with CentOS Web Panel DNS

"Hi,I have few domains which are managed by the DNS Server of CentOs web panel installed in a lightsail server. While everything works (e-mail delivery to domain, ns lookups, connecting to website), SES keep failing to verify the domain.I have set up all entries for domain verification and DKIM as mentioned in SES account. And it looks like following._amazonses.royalmasarena.lk. 14400 IN TXT "uzNxwTy9rTgXIHWBwseLheYyfWF51fYw8A0iMYA1S70="4egyg2u6vckv5dboykbexwob7pdvgjjl._domainkey.royalmasarena.lk.  14400 IN CNAME 4egyg2u6vckv5dboykbexwob7pdvgjjl.dkim.amazonses.com.ykk6yaefjzpbhgqo2rc7p7ex7qwvrhtv._domainkey.royalmasarena.lk.  14400 IN CNAME ykk6yaefjzpbhgqo2rc7p7ex7qwvrhtv.dkim.amazonses.com.vuyvh63hsfnwtk3ghd7xd73na24q7j3f._domainkey.royalmasarena.lk.  14400 IN CNAME vuyvh63hsfnwtk3ghd7xd73na24q7j3f.dkim.amazonses.com.And I followed the verification troubleshooting process, and there is nothing wrong in nsloockup results I get as far as I can see. All the entries are there as SES requested.All I can think of is SES verification process is having trouble connecting to the dns server running in my light sail.has anyone else encountered this issue? and Managed to solve it?Or has anyone else got domains managed by CentOs web panel and got SES verification working?Any help will be appreciated.FollowComment"

Answer: 0Found the issue.I had not properly forwarded the NS setting from the place I purchased the domain. I got the test results from a old cached setting that I had in the previous DNS.CommentShareRakhithaanswered 4 years ago


Question: How can I integrate S3 with SendOwl?

"The instructions for doing so indicate that I needed to Visit Amazon S3 and generate a new Access Key and Secret, which I've done. Unfortunately, this has not worked. I get the error message, "The authorization mechanism you have provided is not supported. Please use AWS4-HMAC-SHA256." when I attempt to download the file, and I suspect it might be a permissions issue. Further clarification from SendOwl's instructions:We currently use the v2 signing method, so your files will need to be stored in certain AWS regions for this to work. After doing a bit of digging around, I believe that my region, US-East (Ohio), meets the criteria, so I can only imagine that I have failed to set the proper permissions in S3 into place.FollowComment"

Answer: "0Hi,is there any reason why you cannot use version 4 instead of v2?Have a look at this: https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.htmlHope it helps ;)CommentShareEXPERTalatechanswered a month ago0Looks like the instructions indicated the the bucket needs to have proper permissions, but the error you provide doesn't seem to indicate the issue is permissions.I would first reach out to SendOwl and provide them the error.  This may be due to the application's configuration.Once you can connect, make sure your S3 has the proper permissions.CommentShareCarlos del Castilloanswered a month ago"


Question: Does FSx Gatway transfer writes to AWS FSx immediately?

"We are interested to use AWS FSx for Windows plus install FSx File Gateway at our main site. There will be multiple users using the File System, some from within the site and others will be accessing FSx directly from the internet. Our concern is whether a change made from a user on-site will be synchronized immediately and be visible to other users, or if there is a delay.What is the minimum time does the FSx Gateway send its changes to the main AWS FSx? Is it near real-time, or more (like minutes)? Does a "write" stay on the FSx Gateway cache for a while or is it written immediately to the FSx?Thanks in advance.FollowComment"

Answer: "0It depends on your network and bandwidth.   You can monitor the CachePercentDirty CW metric to get an idea.From https://docs.aws.amazon.com/filegateway/latest/filefsxw/troubleshooting-file-gateway-issues.html:If the CachePercentDirty metric is 80 or greater, your file gateway is writing data faster to disk than it can upload the data to Amazon S3. Consider increasing the bandwidth for upload from your file gateway, adding one or more cache disks, or slowing down client writes.If the CachePercentDirty metric is low, check the IoWaitPercent metric. If IoWaitPercent is greater than 10, your file gateway might be bottlenecked by the speed of the local cache disk. We recommend local solid state drive (SSD) disks for your cache, preferably NVM Express (NVMe). If such disks aren't available, try using multiple cache disks from separate physical disks for a performance improvement.***You also should  be aware of users writing/changing files on the FSx file system directly, and those changes being available on the gateway.  This is the "Automated cache refresh settings" option.  See: (THis is for Storage Gateway but the same concept applies for FSx)https://aws.amazon.com/premiumsupport/knowledge-center/storage-gateway-automate-refreshcache/CommentShareEXPERTMatt-Banswered a year ago"


Question: Need help to determine why some of game sessions in GameLift fleet are running forever.

"I'm using Gamelift as dedicated server for my multiplayer game.Everything works well, just one problem: in my game fleet dashboard, sometime for unknow reason, some game session are running forever, doesn't shutdown. Please see my attached screenshot below.I've tried every way I can think to terminated a game session. even I write a script to report game session as unhealthy if the game session is running for more than 2 hours, but it seem doesn't work.Is there anyway I can check what happend for these game session? Or how can I check log to see what's the error? (because the game session does not shutdown so I can't see log).Here is some additional information about my game fleet:Fleet id: fleet-91342684-5597-4fbe-9854-51f4aa1fc0e4Example a game session that doesn't shutdown:session id: arn:aws:gamelift:ap-southeast-1::gamesession/fleet-91342684-5597-4fbe-9854-51f4aa1fc0e4/669aa29f-eb0d-4f46-b52b-7a456c2a3354ip: 54.179.179.230port: 8127Thank you very much for your help! I've been struggled with this problem for months :DFollowComment"

Answer: "0A new thing I notice is that for these servers that have long living time, they cost CPU too much! It seem like they are stuck in a loop or something like that, because all other script in my game is not run when it happend. Any advices for me? I'm stucking too 😂CommentShareInWaveStudioanswered 7 months ago"


Question: Payment Edenred card - Brazil

"I tried to add an M#####card credit card in the cards list for payment, but I get the following message:"Your card ending in #### is not supported for payments to AWS seller in your region. Please try adding one of the following supported cards: Elo, M#####card, American Express, Discover-Elo or Visa."This card is for sure a M#####card issued card and I have used it for other payments, both national and international.Any tips to use this looking good card to pay?Edit: Removed "Card starts with xx* btw" as it included partial card info — Ben. GFollowComment"

Answer: "1I suggest opening a billing support case for this problem. You can open a case by clicking the ? with a circle in the console top banner -> Support Center, Create case, Choose Account and billing support, Type -> Billing, Category -> Payment Issue and then you can fill in your question. This will go to the billing experts.CommentShareEXPERTShlomo Dubrowinanswered a year ago"


Question: Connect to Greengrass Core V2 - no cipher suites in common TLS-ECDHE-ECDSA-...

"Hi, I am trying to connect a client device to a Greengrass Core (V2) and encounter the error in the following image on the core. I checked the list of cipher suites sent by the client in Client hello and two of them are found on this page : TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 and TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256. Is there any special setting required to support TLS-ECDHE-ECDSA-... ciphers? Thanks!FollowCommentMichaelDombrowski-AWS EXPERTa year agoHi, the page you linked is for Greengrass V1 only as shown in the banner at the top.Share"

Answer: "0Hi,The enabled cipher suites depend on your Java installation, you can follow https://support.azul.com/hc/en-us/articles/360061894852-Which-security-protocols-and-cipher-suites-are-enabled-in-a-specific-Java-Release-bundle in order to see what cipher suites are included as supported by your Java installation.CommentShareEXPERTMichaelDombrowski-AWSanswered a year agorePost-User-8111296 a year agoHi, I just tried the suggested method and TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 and TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 are part of the list of supported ciphers. Any other debugging suggestion? Thanks!ShareMichaelDombrowski-AWS EXPERTa year agoOnly TLS v1.2 is supported by Greengrass for security. Does your device support TLS v1.2?Please also provide the list of supported ciphers from your Java installation as well as the client device.ShareMichaelDombrowski-AWS EXPERTa year agoPlease also provide the full logs from Greengrass prior to and including the cipher error.Look for any other warnings or errors.SharerePost-User-8111296 a year agoHi, I attached GG log and list of ciphers from the Java installation and the client (from the SSL handshake) here: https://www.transfernow.net/dl/20220707OJeeNbgh. Yes, the device supports TLS v1.2.SharerePost-User-8111296 a year agoI also checked the server certificate used by the broker using this command: openssl s_client -showcerts -connect localhost:8883 and it seems to be ECDHE-RSA-AES256-GCM-SHA384. Maybe this is the issue? Then how can I configure the MQTT broker to use ECDSA?ShareShow 3 more comments"


Question: no identity-based policy allows the secretsmanager:GetSecretValue action

"Apologies in advance if i'm doing something dumb. I'm super new to AWS and docker, have only started learning them this week, and this is my first attempt at making a function via Docker image.I created an image and a function in AWS Lambda but trying to run it gives me an error:{  "errorMessage": "An error occurred (AccessDeniedException) when calling the GetSecretValue operation: User: <user_here> is not authorized to perform: secretsmanager:GetSecretValue on resource: <resource_here> because no identity-based policy allows the secretsmanager:GetSecretValue action",  "errorType": "ClientError",  "requestId": "ccfb336b-2383-4b3f-8525-98ff213032bf",  "stackTrace": [    "  File \"/var/task/app.py\", line 85, in lambda_handler\n    secret = get_secret()\n",    "  File \"/var/task/app.py\", line 30, in get_secret\n    raise e\n",    "  File \"/var/task/app.py\", line 26, in get_secret\n    get_secret_value_response = client.get_secret_value(SecretId=secret_name)\n",    "  File \"/var/runtime/botocore/client.py\", line 391, in _api_call\n    return self._make_api_call(operation_name, kwargs)\n",    "  File \"/var/runtime/botocore/client.py\", line 719, in _make_api_call\n    raise error_class(parsed_response, operation_name)\n"  ]}here's some of my template.yaml (replaced some stuff with <> but the key definitely exists and works)    Properties:      PackageType: Image      Architectures:      - x86_64      Policies:        - AWSSecretsManagerGetSecretValuePolicy:            SecretArn: arn:aws:secretsmanager:<region_here>:<account_here>:secret:<path>/google-api-key-??????i watched a bunch of videos like this one to create a role with the policy to read the secrets https://www.youtube.com/watch?v=bZCFxueebVQ and read a bunch of SO posts, but still can't get it to work :(Here's a list of actions for that key as it appears in the function settings:Allow: secretsmanager:GetResourcePolicyAllow: secretsmanager:GetSecretValueAllow: secretsmanager:DescribeSecretAllow: secretsmanager:ListSecretVersionIdsEdit: I looked through the logs, and for some reason the logs only go back to around noon, even tho I've run the function multiple times since, especially after changing the role. Yet the logs still only show the previous role[ERROR] ClientError: An error occurred (AccessDeniedException) when calling the GetSecretValue operation: User: arn:aws:sts::<user>:assumed-role/<old_role_here>/<my_function> is not authorized to perform: secretsmanager:GetSecretValue on resource: <secret_path> because no identity-based policy allows the secretsmanager:GetSecretValue actionThat makes me think it never updated the role... But it does show it in the function settings.So confused ...Edit2: Made a new function with the new role that has a policy to read the secret. Tried running the function. Still same error. Went to read the logs. Got an error "Log group doesn't exist"Even more confused ...FollowCommentsimon 4 months agoHave a read through this doc if you haven't already. https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-policy-issues/Sharesimon 4 months agoAnd also take a look here re log group https://aws.amazon.com/premiumsupport/knowledge-center/lambda-cloudwatch-log-streams-error/Share"

Answer: "0Hello,Can you confirm if the role accessing the secret has the permission defined in its IAM policy. The error message seem to be a permission issueCommentShareAdeyinianswered 3 months ago"


Question: Pearson Vue exam did not launch and then cancelled

"Hello,The AWS Cloud Practitioner exam does not load through Pearson Vue platform. I was scheduled to take the test on Friday, December 3 2021 at 10:30 am CET.I did all the system checks the day before and joined the online exam platform 30 minutes in advance as recommended. The security tests passed.Initially after 45 mins of waiting, a proctor checked all my surrounding and he said that he will release the exam. But the exam Window didn't launch because of technical issues (precisely "browserlock.exe" is not loading). The proctor asked me to close the session and we tried relaunching the OnVue software, which did not work again. Then he disconneted the call and also the exam session.I had to start the exam session again, because the proctor closed the previous session, but this time I had to wait another 1 hour to connect with a Proctor. The 2nd Proctor also tried to release the exam, but after few tries he gave up and told me that he will connect to some technical support. Again the exam session was ended.The 3rd time when I tried to start the exam session, I could not find the exam link. Few moments later, I received a mail that the exam is cancelled and the fee will be refunded.So many months of preparation, course trainings and energy wasted because of technical issues.The certification is part of our Company's internal Employee development plan to help educate developers and system engineers in migrating to AWS.I,  part of Architecture Team, have to deliver a Cloud solution to our On-Premises software in mid February. But with this kind of experience, I could not encourage the others to pursue these certification paths to educate ourselves.I hope there is more reliability in these certifications, in order to motivate ourselves to learn about the new technologies and also to reach our milestones that we set for ourselves.I appreciate if someone could find a solution to my problem and probably help me take the exam (because currently I am not sure if the exam will launch)Following are my schedule exam details for your reference:**Exam:SAA-C02-AWS Certified Solutions Architect - Associate-ENUCandidate:   Venkata Naveen BantuCandidate ID:   AWS02482326Registration ID:  409543687Date:Friday, December 3, 2021Time:10:30 AM Central European Time**Thank you,Best regards,Naveen BantuFollowComment"

Answer: "0Naveen,I am sorry to hear about your Online Proctoring experience. We continually work with Pearson VUE to improve the Online Proctoring experience. If you were testing on an employee-provided device, it is possible that there are background applications and security related features that will prevent you from taking an Online Proctored exam on that machine. We encourage candidates to review the technical requirements at https://home.pearsonvue.com/aws/onvue and consider testing on a personal device. Additionally, you may also test in a test center.If you have any further questions, please let me know!KimAWS CertificationCommentShareKimWD-AWSanswered a year ago0Hello Kim,I was testing on my personal laptop and the technical requirements were all checked before the start of the exam. Not sure why the exam did not function.While rescheduling, can I re-use my 50% discount voucher from Solution Architect Challenge (which expired on December 4) ?Thank you,Best regards,Naveen BantuCommentSharebantuNaveenanswered a year ago"


Question: API Gateway Lambda integration SelectionPattern doesn't match

"My Lambda-backed API Gateway endpoint always returns 200 regardless of integration responses.I have a rather simple GET endpoint:    public void process(InputStream inputStream, OutputStream outputStream) throws IOException {        Tenant tenant = tenantsDao.getTenant(inputStream);        if (tenant != null) {            this.getObjectMapper().writerWithView(Tenant.TenantData.class).writeValue(outputStream, tenant);        } else {            throw new ApiKeyNotFoundException("API key not found.");        }    }This correctly prints the error when I execute it via CURL:$ curl https://<my_api_url>/keys/foo -v…< HTTP/2 200 …{"errorMessage":"API key not found.","errorType":"…"}Even though I have the integration response mapping set:    ApiMethodGetKeysApiKey:        Type: "AWS::ApiGateway::Method"        Properties:            RestApiId: !Ref "ApiGatewayV1"            ResourceId: !Ref "ApiResourceKeysApiKey"            HttpMethod: "GET"            AuthorizationType: "CUSTOM"            AuthorizerId: !Ref "ApiAuthorizerV1"            RequestValidatorId: !Ref "ParametersOnlyValidator"            RequestParameters:                method.request.header.Authorization: true                method.request.path.apiKey: true            MethodResponses:                -                    StatusCode: 200                -                    StatusCode: 404            Integration:                Type: "AWS"                IntegrationHttpMethod: "POST"                Uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${!stageVariables.KeyFetchingTarget}"                Credentials: !GetAtt "ApiGatewayRole.Arn"                RequestTemplates:                    application/json: |                        {                            "tenantId": "$context.authorizer.tenantId",                            "apiKey": "$input.params('apiKey')"                        }                IntegrationResponses:                    -                        StatusCode: 200                    -                        StatusCode: 404                        SelectionPattern: ".*API key not found.*"                        ResponseTemplates:                            application/json: |                                {                                    "message": "$input.path('$.errorMessage')"                                }                PassthroughBehavior: "NEVER"Am I missing something?API Gateway execution logs shows that the Lambda error header is set properly:(2f8d1403-be70-11e9-a7ce-dd90ab730381) Endpoint response headers: {Date=Wed, 14 Aug 2019 08:47:45 GMT, Content-Type=application/json, Content-Length=720, Connection=keep-alive, x-amzn-RequestId=1f731b7f-5f10-4c3d-87b1-b879379d7d5f, X-Amz-Function-Error=Unhandled, x-amzn-Remapped-Content-Length=0, X-Amz-Executed-Version=$LATEST, X-Amzn-Trace-Id=root=1-5d53cab1-6b333258463add60633ec5a8;parent=4013ac81631b59eb;sampled=1}(2f8d1403-be70-11e9-a7ce-dd90ab730381) Endpoint response body before transformations:{    "errorMessage": "API key not found.",    "errorType": …FollowComment"

Answer: "0The issue was resolved with assistance of AWS support team. The issue was, that if we format integration endpoint like that API Gateway doesn't recognize that it's a Lambda and handles response in different way (falls back to generic AWS integration).Proper format of integration URI should be:Uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${!stageVariables.KeyFetchingTarget}/invocations"CommentSharerafalwrzeszczanswered 4 years ago"


Question: What exactly happens when an S3 Continuous backup Recovery point expires?

"Hello Community!Lets say I set up a Continuous backups of my S3 bucket to be done on a Daily basis with a retention of 10 days.As far as I know, for all the period of retention only ONE Recovery Point is created by AWS Backup Jobs and that ONE indeed does allow me to restore from almost whenever it is created to almost any actual moment until the retention periond ends.QUESTION: What EXACTLY happens when that ONE Recovery Point is EXPIRED after it's retention period ends at day 11?Will I loose ability to recover to any point in time within ALL 10 subsequent days covered by that Recovery Point (which, basically means the continuous backups are not that continuous)?Or will the recovery point stay and never expire, but only the time from which I can restore changes to a later point?AWS documentation (https://docs.aws.amazon.com/aws-backup/latest/devguide/point-in-time-recovery.html) recommends the following:"Because continuous and snapshot backups offer different advantages, we recommend that you protect your resources with both continuous and snapshot backup rules."Does this mean it is NOT enough to have Continuous backups ONLY if I don't need to have a retention more than max 35 days covered by Continuous backups?Thank you!FollowComment"


Question: "XDMA transfer fails when writing to BRAM, Peek/Poke also not functional"

"Hello all,I've built a design where I planned to test XDMA functionality, as well as Peek/Poke functionality.Here is the image of the design:https://imgur.com/Mx4HVDqAddress map:https://imgur.com/Bmg87S6F1 IP settings:https://imgur.com/G5WPoFHAFI: afi-0a8ee3b4101930666, AGFI: agfi-08d6f213d9161b558dmesg log after fpga-load-local-image {AGFI} call: https://pastebin.com/L3eRq5NdHere is the code and output I tried to use for testing XDMA.https://pastebin.com/XVnpVZA6Here is the code and output I tried to use for testing Peek/Pokehttps://pastebin.com/T8eRQEhSNone of these two produce any dmesg output.Few questions:Any reason why I'm not successful in read/write over XDMA to BRAM (DDR operations are successful)?Why is Peek/Poke failing?Should I be able to use Peek/Poke over PCIS interface (not in the same time when using PCIS for XDMA), or should I use OCL instead?EDIT: To correct myself, I shouldn't even be able to write to BRAM via XDMA on this design, but I observed that on a design that is same like this one, just without OCL enabled.EDIT 2: I discovered that I need SUDO to be able to attach execute fpga_pci_attach. Is there any way to work around that, and not use SUDO? Anyway, now peek/poke is functional. Still, question of writing to BRAM element via XDMA persists.Edited by: jelicicm on May 18, 2021 6:48 AMFollowComment"

Answer: "0Hi,Please see our answers below:Any reason why I'm not successful in read/write over XDMA to BRAM (DDR operations are successful)?AWS From your design/addr space, I see that DDR is on PCIS-BAR and BRAM Controllers are on OCL interface. Please note that OCL is 32-bit AXI-Lite Interface, and PCIS is 512-bit AXI4 Interface. Please ensure AXI Interconnect supports both. The XDMA (DMA Engine) is mapped to transfer data through PCIS Interface, therefore you see data transfers to DDR but not to BRAM. Please connect/define address space for BRAM in the PCIS range and it should work.Why is Peek/Poke failing?AWS Did you try using the PCIe APIs provided by AWS? Useful links below:-- https://github.com/aws/aws-fpga/blob/master/sdk/userspace/fpga_libs/fpga_pci/fpga_pci.c#L337-- https://github.com/aws/aws-fpga/blob/master/hdk/cl/examples/cl_dram_dma/software/runtime/test_dram_dma.c#L324Should I be able to use Peek/Poke over PCIS interface (not in the same time when using PCIS for XDMA), or should I use OCL instead?AWS Yes, you should be able to use peek/poke access to PCIS (even when XDMA is in operation). Please note, that these two are queued internally and can impact latency when both are active.Please refer to the following information for non-root access to FPGAhttps://github.com/aws/aws-fpga/tree/master/sdk#using-fpga-as-non-root-userPlease reach us if you need any additional details.Thanks!ChakraEdited by: awschakra on May 18, 2021 11:31 AMCommentShareawschakraanswered 2 years ago0Hello Chakra,thank you very much for your answers! I figured out I was stupid when setting up address map and therefore my reads/writes were failing.Can I please ask you one more thing:Please note that OCL is 32-bit AXI-Lite Interface, and PCIS is 512-bit AXI4 Interface. Please ensure AXI Interconnect supports both.  Can you explain further on how to "ensure" this? I set "register slice" option for every slave and master interface to "Auto". Also, Fifo Depth for each interface is set to 32. Should I do anything else, or should this be enough?CommentSharejelicicmanswered 2 years ago0Hello Chakra,thank you very much for your answers! I figured out I was stupid when setting up address map and therefore my reads/writes were failing.Can I please ask you one more thing:Please note that OCL is 32-bit AXI-Lite Interface, and PCIS is 512-bit AXI4 Interface. Please ensure AXI Interconnect supports both.  Can you explain further on how to "ensure" this? I set "register slice" option for every slave and master interface to "Auto". Also, Fifo Depth for each interface is set to 32. Should I do anything else, or should this be enough?CommentSharejelicicmanswered 2 years ago0Hello,Apologies for delayed relayed response on this post.Since you are connecting OCL and PCIS bus to the interconnect, I would make sure that the AXI Crossbar/Interconnect IP handles two masters with different AXI protocols -- AXI-Lite for OCL, and AXI4 for PCIS.Please let us know if you need any additional details.Thanks!ChakraCommentShareawschakraanswered 2 years ago"


Question: Notification channel in Amazon managed Grafana

"Hi,I setup a notification channel in Amazon Managed Grafana workspace to publish to an SNS topics.When testing notification channel in the workspace, I don't receive any publish to the topic.If I tested to publish message in the Amazon console, I could successfully receive the email (I subscribed the topics with an email subscription).Anything I missing in the Grafana setup?I tried all 3 Auth Provider (Workspace IAM Role, Access & secret key, ARN) and none of them works.Thank you.FollowComment"

Answer: "0Idk if this is still a problem for you, but I struggled with the same problem and found that the automatically generated by Grafana IAM role has a permission to publish to SNS in the form of arn:sns.....:grafana-. So, your SNS topic name must start with 'grafana-', or you'll have to change the permission.CommentShareFrancoanswered 4 months ago"


Question: "Unable to launch com.apple.Maps because it is restricted." error message

"Hello,While debugging some failed iOS XCTestUI tests, one the the tests (which requires the use of Apple Maps app), fails with error::Failed to launch com.apple.Maps: The operation couldn’t be completed. Unable to launch com.apple.Maps because it is restricted.Obviously, Maps app is "restricted" from being used.Question is:  why is it restricted? Is this AWS's policy? Is there some action that I particularly need to do in order to have "permission" to use Apple Maps app?Thank you!FollowComment"

Answer: "0Thank you for reaching out us regarding the above query.  I would like to share that as of now, the"com.apple.Maps" application is blocked on DeviceFarm public fleet due to security considerations for the service. If you would like to have unrestricted access to default system apps, you would need to purchase and test on our private device offeringI would like to thank you for allowing us to improve the service by raising this query. I have passed this feedback to the DeviceFarm internal team and requested them to consider this as a feature request. While I am unable to comment on if/when this feature may get released, I request you to keep an eye on our What's New and Blog pages for any new feature announcements.Having said that, in case you face further challenges, please feel free to open a support case with AWS using the following link.CommentShareSUPPORT ENGINEERSubhayu_Manswered 7 months ago"


Question: Control Tower and IAM User with Programmatic Access

"I am working through a Control Tower workshop, and my understanding from the documentation is that IAM Identity Center (formerly AWS SSO) is where I go to create new users going forward with a Control Tower setup.  However, for a scenario where I need to create a User with Programmatic Access (Access Key ID and Secret Access Key), I don't see that as an option in IAM Identity Center.  Is the recommended approach to use IAM in that scenario and create the account there?  If so, will that cause confusion down the road with some user accounts not being managed by IAM Identity Center and others in IAM?FollowComment"

Answer: "1Accepted AnswerHi, when using AWS Identity Center, programmatic access credentials become temporary. This fits more within the best practice recommendations of not having long life credentials. The AWS CLI can support integration with IAM Identity Center, https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html. A user would run the CLI login process. It will retrieve a temporary Access Key ID and Secret Access Key and use those for the session. The duration of the session can be configured within the Identity Center permission set. IAM based credentials can still be used, but the recommendation is they are limited to Service Access (as an example Automation tools or SaaS products that need access).CommentShareJimmy_Manswered 8 months agoRyan 8 months agoThanks Jimmy.  My scenario is what you are referring to in the last sentence...I need an account for Service Access, so it sounds like IAM is still the goto for that scenario.  I appreciate the additional context for the CLI login process with the temp keys.Share"


Question: My Lambda function is not getting invoked all of a sudden.

"Hi,I had written a lambda function, and it was working as per the requirement. But suddenly past 2 days the lambda function is not getting invoked.I'm invoking the lambda function from java end using the "invokeAsync(req)" method.But same function if run on the AWS console,it works fine.I am using US-EAST-1 region.It was working fine for the past 25 days but stopped working for the past 2 days. ie the lambda function is not getting invoked by the "invokeAsync (req)" method from Java end. I am stuck in this for the past 2 days and not getting where I am going wrong. Please can anyone help?I tried asking it on stack overflow.But my question is getting downvoted and deleted though I had uploaded my code and all the dependencies I am using.Any help appreciated. Thanks!FollowComment"

Answer: "1Debug issue :First make sure that the IAM Role attached to your Lambda function has CloudWatch log write access.Now try to invoke the lambda function and switch to monitor tab in lambda console and click the CloudWatch log button.You will be redirected to the logs, open the latest log and see if there are some error logged.Make sure that the service that invokes the lambda function has sufficient permission.**Maybe its region issue : **If you are experiencing issues for Lambda service in us-east-1 region.You can check the health status here.**Still facing issue : **Please contact the AWS Support team. They might be able to look into your lambda function and account to find the cause.CommentShareNikhil K Whizlabsanswered a year agoAWS-User-9639096 a year agoHow do I contact AWS support? is there any email?  I was redirected back to ask the question here. Please can you send their email id?Share0Start with the CloudWatch logs (check under the monitor tab in the console for a link to the logs if you don't know where they are) and check if the lambda is being triggered at all. If it is then there is an issue with the lambda and add some debug output to check in cloudwatch, if it's not then it could be a policy issue. Maybe invoke it synchronously from java and see if you have any error messages you can work with.CommentShareRollerblade7answered a year agoAWS-User-9639096 a year agoHi , Sorry I forgot to mention about the cloud watch logs, the cloud watch logs are empty, meaning the most recent logs are the logs, from 2 days prior(as I have mentioned in the question.) After that I havent got any logs. I can post a pic here of them, but I dont think theres an option to post a pic here.ShareRollerblade7 a year agoThen your lambda isn't being triggered, or doesn't have permission to log to cloudwatch (that doesn't make sense if you can run it from the console and it logs).Something changed in the last 2 days, probably some configuration/permission..I would start by eliminating the obvious:test that it is still working via the consolecall it asynchronously in the code you haveadd a DLQ maybe?call it in the same way you are in java, but from a different environmentcheck your environment that you are calling the lambda fromShare0What calls the Lambda function?  Is it tied to an API gateway?  An S3 event?   An EventBridge rule?  Directly from a client application?The first place I'd check is in the CloudWatch logs to see if any errors are being reported.The second place I'd check is CloudTrail to see what happened around the time that the Lambda function stopped working.  Is it possible that someone updated an IAM role or policy?  Maybe a new SCP was enabled?  Perhaps a NACL or security group is preventing a call from getting to your Lambda?CommentShareEXPERTTim Gustafsonanswered a year agoAWS-User-9639096 a year agoHi , Sorry I forgot to mention about the cloud watch logs, the cloud watch logs are empty, meaning the most recent logs are the logs, from 2 days prior(as I have mentioned in the question.) After that I havent got any logs. I can post a pic here of them, but I dont think theres an option to post a pic here.Share"


Question: GENERIC_INTERNAL_ERROR: S3 service error

"Hi ,Im getting below error after running the query.This query ran against the "xxxx" database, unless qualified by the query. Please post the error message on ourFollowComment"

Answer: "0Hello,Thank you for bringing this up.  Could you please raise a support ticket with Athena Team so that we can help you on this issue/Error according to the Query ID of the execution.CommentShareHarsha_Tanswered 5 months ago"


Question: Suggestions for Web based App Solution Development

"Good day , I wanted to know what would be the good tools for my use Case.We would like to Build a web based Admin Dashboard for my Organisation.Which is a Financial Services provider. Basically a CRM with more Functionality like Loan Origination, Portfolio Management, Collections etc.I would also like to link the Application to AWS's new quantum ledger database.FollowComment"

Answer: "2Hi, @IrvineJFirst, you can use the QLDB driver on the AWS SDK to interact with the QLDB API.https://docs.aws.amazon.com/qldb/latest/developerguide/getting-started-driver.htmlAs you can see in the link, it is available in the following programming languages.Java, .NET, Go, Node.js, PythonNext, let's talk about dashboards. Dashboards can be realized in various ways.If you want to use AWS services, you can use Amazon QuickSight.And with Amazon QuickSight, you can embed your dashboard into an external website/web system, or simply require your users to sign in to QuickSight.QLDB is not yet integrated with QuickSight. Therefore, it is necessary to regularly export QLDB data to S3, RDBMS, etc.You can use AWS Glue for export.CommentShareEXPERTiwasaanswered 10 months ago1Hi, @IrvineJIn case you are looking for options to build a custom dashboard web application then you may also explore Amazon Amplify . It allows to develop web applications leveraging AWS AppSync  with GraphQL API and by default uses Amazon DynamoDB and Amazon S3 for data persistence. Amazon QLDB can be added to AWS Amplify as a custom resource to process some ledger-specific transactions and then stream data to Amazon DynamoDB through Amazon Kinesis Data Streams and AWS Lambda.CommentShareNikolay_Vanswered 10 months ago"


Question: Delete CloudWatch Log Groups using AWS Lambda function

"Hi AWS,I need a lambda function which can delete log group with no retention period and with no KMS key configuredFollowComment"

Answer: "1Accepted AnswerThe following code can be used to delete a log group that is not encrypted by KMS and has no retention period set.import boto3def lambda_handler(event, context):    logs_client = boto3.client('logs')    response = logs_client.describe_log_groups()    for log_group in response['logGroups']:        if 'retentionInDays' not in log_group and 'kmsKeyId' not in log_group:            log_group_name = log_group['logGroupName']            logs_client.delete_log_group(logGroupName=log_group_name)The following is a reference document.https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/logs/client/describe_log_groups.htmlhttps://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/logs/client/delete_log_group.htmlCommentShareEXPERTRiku_Kobayashianswered 14 days ago0Check this post https://repost.aws/questions/QUHbpGyG6vRCetY14qoNxSWg/delete-cloudwatch-log-groups-using-aws-lambda-functionCommentShareManikandananswered 14 days ago"


Question: Problem adding multiple CNAME records to AWS Route53

"I'm trying to verify my AWS domain to use SES and am having problems creating the DNS records that AWS is telling me to add. I have to create 3 CNAME records but it will only accept 1 record even though there's a tip that says add multiple records on new lines:Error occurred Bad request. (InvalidChangeBatch 400: RRSet of type CNAME with DNS name \052.XXXX.org. does not contain exactly one resource record.) I use * as the subdomain name because the root level is not allowed to contain a CNAME record. If I try to add 3 records using * subdomain I get the following error:Error occurred A record with the specified name already exists. (InvalidChangeBatch 400: Tried to create resource record set [name='\052.XXX.org.', type='CNAME'] but it already exists) At this point I'm confused as to how to add these 3 records. Any help would be appretiatedFollowComment"

Answer: "2Accepted AnswerDNS records should be created one by one.Perhaps what you are trying to do is "verify the DKIM domain ID" as described in the following document.https://docs.aws.amazon.com/ses/latest/dg/creating-identities.html#just-verify-domain-procCommentShareEXPERTRiku_Kobayashianswered a month agoglez a month agoYes, that is what I am trying to do.  I tried combo because there's a tip that says add them on their own lines but its barfs when I do.  I tried individual records as can be seen from the above error it will only let me add 1 CNAME entry not 3."Error occurred A record with the specified name already exists. (InvalidChangeBatch 400: Tried to create resource record set [name='\052.XXX.org.', type='CNAME'] but it already exists)"ShareRiku_Kobayashi EXPERTa month agoRecord name is the Name column in the document.Record name must be entered up to _domainkeyValue must be set to one corresponding to Name.Cname records should be set one by one.Shareglez a month agoduh.  I knew I was missing something.  Thanks for the help.Share"


Question: Action execution failed InternalError. Error reference code: a7866898-c8b7-4ebb-bd1a-83eab7bdc8f6. code pipeline to deploy to S3

"i am having problem deploying build artifact to S3 , after code build built the artifact i can see the artifact stored in codepipeline's S3 but when tries to deploy to S3 it is havingAction execution failedInternalError. Error reference code: a7866898-c8b7-4ebb-bd1a-83eab7bdc8f6.is there a log ? that i can debug further ?FollowComment"


Question: "in aws s3 java sdk 2, what is the class for S3 batch operation?"

I could not find documentation for S3 batch operation in aws s3 java sdk 2. please help.FollowComment

Answer: 0Here are some examples on S3 Batch Operations. See if they helphttps://docs.aws.amazon.com/code-samples/latest/catalog/code-catalog-java-example_code-s3control.htmlCommentShareSandeepVudataanswered a year agoAWS-User-3035982 a year agothat is for sdk v1. wondering if there is one for sdk v2? I could not find any reference in its doc. Thanks.Share0It would be under the S3 Control Client. See https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/services/s3control/S3ControlClient.htmlCommentShareArjun Ranswered 4 months ago


Question: Where can i get help with Amazon Gamelift... Not here anyway!

"My title says it all. There is no action in this forum, so where can i get any support on my bugs?FollowComment"

Answer: "0Accepted AnswerHi-I am not totally up to speed with how someone is supposed to know this (I'll find out), but the gamedev forums can be found here:https://forums.awsgametech.com/Hope that helps!CommentShareAWS-User-2901110answered 4 years ago0The Gametech forum Brian posted a link for is the Lumberyard forum. To view GameLift-specific posts, select the "GameLift" tag.CommentShareSellaanswered 4 years ago"


".Edited by: Jerry Hong on May 12, 2021 5:04 PMFollowComment"

Answer: "0.Edited by: Jerry Hong on May 12, 2021 5:05 PMCommentShareJerry Honganswered 2 years ago"


Question: Correct permissions to Restore an Aurora Backup from AWS Backup with KMS

"Hello, here is the situation, we have AWS Backup configured to backup Aurora Clusters, the Aurora Cluster is encrypted with a CMK of KMS.Now, that we want to restore a backup using the AWS Backup Console, the process says it finished successfully but the restored Aurora Cluster has 0 instances. So I think there is an issue of permissions to use the KMS key, but I have tried different permissions to no avail. Is there a document that specifies the correct permissions for this to work ?Thanks in advanced.Kind Regards,FollowComment"

Answer: "0You can look at CloudTrail event history around the time when you run the restore to see if any CreateDBInstance call is failing/giving an error. The error code would tell the missing permission.Please also look at any other API calls around that timestamp to note any additional API calls which gave an error.CommentShareShivam_Ganswered a year agoHigher a year agoHello Shivam,I did and I got no errors, I see the following actions:StartRestoreJob, RestoreDBClusterFromSnapshot, CreateGrant, RestoreStartedI could not find any error in CloudTrail, the Bakcup Restore Job shows as Completed, the RDS Cluster is there with status of Available but with 0 instances.Share"


Question: Why does the Kinesis Firehose output "Throttling error encountered when calling Kinesis".

"I use a Kinesis Data Stream connected to a Kinesis Firehose (Delivery stream). Some data failed to write a below message.Throttling error encountered when calling Kinesis. This can be due to other applications calling the same APIs as the Firehose delivery stream, or because you have created too many Firehose delivery streams with the same Kinesis stream as the source.I never used ether multiple data streams or multiple firehoses. Why did this message output?FollowComment"

Answer: "1How much data are you trying to move through the data stream to the firehose to S3 (per second)?Kinesis Data Stream size, write, etc limits (and how to increase shards) is linked > here <  Hopefully it's something straightforward like capacity, and can be resolved with an extra shard.Troubleshooting on the Firehose service is > here <  I'd recommend looking at the data freshness metric section - that talks about throttling.CommentShareDan_Hanswered a year ago0Thank you for your answer. Your answer seems to be correct.My Kinesis Data stream reported the throttling issue on reads. And this warning was not important because Kinesis Firehose could retry. After a short wait, the data was correctly recieved.CommentShareHidekatsu Izunoanswered a year ago0Hi there, the issue occured might due to you have multiple consumers for the Kinesis data stream, for the limitation, the Kinesis Data Fireshose use GetRecords API to retrieve data from data stream, for GetRecords API, it has 5 TPS for hard limit, which means you cannot invoke the API 5 times per second.If the issue persist, you could try to do the following methods to optimize:recude the consumer counttry to slow down the polling rate for other consumers (since you cannot control the pulling rate for Firehose)enable Enhanced fanout for your other consumersCommentShareCloudMananswered a year ago"


Question: Issue creating Lambda function layer versions in parallel process

"HiWe are using Terraform (v0.13.5 with AWS provider "hashicorp/aws v3.38.0") to deploy AWS resources into our accounts. Some of these resources are Lambda functions with Lambda layers.We make use of certain automated processes (Gitlab pipelines) to run those deployments. We can change several Lambda functions at the same time.We use the same Lambda layer for ALL the Lambda functions, but create different versions of that layer with different code (ZIP files) and attach each version to a concrete Lambda function.Lately we realized that when modifying several Lambda functions at the same time, the code in the different versions of the same layer is mixed!!! So the code that should go for a concrete layer version is also appearing in other versions created at the same time.For example:when we modify several Lambda functions at the same time (let's say L001 and L002), two new versions of layer MYLAY are created for each, and the corresponding version is linked to each of the modified Lambda functions. So we have L001 with MYLAY-001 and L002 with MYLAY-002. This is how we expect it, so fine so farEach version of the layer should have its own code (different ZIP files)We have detected that the code for MYLAY-001 is also appearing in MYLAY-002, even though the ZIP files used to create those versions are different!!!So from my point of view, it seems that the way in which AWS is creating the layer versions for the same layer is not compatible with parallel creation.Can anyone confirm of shed some light on how AWS is creating those versions?I guess the best approach considering the previous is to use different layer for each Lambda function, indeed.Thanks in advance and best regardsLuisFollowComment"

Answer: "0That is odd behaviour. I'd strongly encourage you to raise a support ticket to investigate that particular issue.Otherwise: I don't think your strategy of using Lambda Layers is quite right. Yes, it might work but storing different data in each Layer is probably a bad pattern to use. My guess is that you're doing it so that the Lambda function doesn't have to load anything externally at startup but it still seems a little wrong.Please reach out to your local AWS Solutions Architect to talk about your requirements and the best way to achieve that. Or: Ask a question here on re:Post with what you're trying to achieve.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: "Error - ENOENT" while creating a lambda function via cdk

"I have a node js project which used as a lambda authorizer in AWS. The node project structure will be like below/authorizer    /lib       -index.js-package.json-node_modules-package.lock.jsonI am creating a CDK in typescript to create the lambda function as shown below.I have given the "entry" value as the path of "index.js".But I am getting this below error after that lineCan you guide me, what exactly missing here? any issue with bundling?FollowComment"

Answer: 0Reading the docs https://docs.aws.amazon.com/cdk/api/v1/docs/aws-lambda-nodejs-readme.html#local-bundling as if esbuild is not available it will try to use docker to build. Which looks to be why the error is coming up?CommentShareAWS-Useranswered 10 months ago


Question: Creating an AMI from AWS Lambda

How to create the AMI and take auo backup using the lambda function of running EC2.FollowComment

Answer: 0Accepted Answerif you want to create AMI using lambda at a particular time like triggering lambda with cron job and take AMI backup of ec2 you can follow my blog :https://knowihave.blogspot.com/2018/09/aws-auto-ami-backup-across-all-region.htmlcode also available on my git :https://github.com/harsh4870/AWS-auto-ami-backup-across-all-regionCommentShareharshmanvaranswered 4 years ago0if you want to create AMI using lambda at a particular time like triggering lambda with cron job and take AMI backup of ec2 you can follow my blog :https://knowihave.blogspot.com/2018/09/aws-auto-ami-backup-across-all-region.htmlcode also available on my git :https://github.com/harsh4870/AWS-auto-ami-backup-across-all-regionCommentSharechaganlalanswered 4 years ago


Question: moving rds aurora serverless from Public subnet to private subnet within same VPC

"Hi I had checked the process suggested by aws guidelines video and url link related to this issue, but unable to move** RDS aurora serverless mysql database** from public to private, can anyone please help me with this or at least tell me the viability of this process. I am unable to proceed with the step in the above url : Remove the public subnets and add private subnets on your DB instance as it is saying both public subnets are in use, i thought to proceed, but later on** I don't have the option to reboot the rds aurora mysql db**FollowComment"

Answer: "0Hello,The document you are referring to is for RDS, and not for Aurora Serverless, hence you will not be able to move the subnets and reboot since those steps are not applicable here. If you are using Aurora Serverless v1, it should already be private, even if the subnets are public. Reference: "You can't give an Aurora Serverless v1 DB cluster a public IP address. You can access an Aurora Serverless v1 DB cluster only from within a VPC."Another option is to create a new subnet group only with private subnets, and restore a snapshot of your cluster into that subnet group.CommentShareShivam_Ganswered a year agoCarlos Garces 3 months agoLooks like is not posible to change the DBSubnetGroup of an existing Aurora Serverless v1There is no option on the Web UI. You only have access to the cluster, not the instance.Share"


Question: Network Load Balancer to ECS Fargate doesn't send traffic to healthy tasks even they are registered correctly in target group

"I'm building a service running on ECS Fargate, the setup is below:Network Load Balancer IPv4/Internal listens to TLS:443 port and forward to a target group, available in 3 AZs with 3 subnet eachECS Fargate has 3 tasks running (each runs in a different AZ) and registered to the target group and are all healthy based on HTTPS 200 status code ping healthy check.However I find requests sending to the NLB are dropped (responded with 503 errors), it never reach our ECS tasks. I've tried recreate NLB and related things and search everywhere I could. But still have no clue on how to fix it. Could someone help?FollowComment"

Answer: "0A 503 error response from the Network Load Balancer (NLB) usually indicates that the targets are either not healthy or not properly configured.Ensure that your NLB, target group, and ECS tasks are all within the same VPC and that the subnets for each are correctly configured.Double-check that the NLB listener is correctly forwarding traffic to the target group and that the target group is configured with the correct target type (IP) and protocol (HTTPS).And please check the following for NLB Access Logs to view the exact errorhttps://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-access-logs.htmlCommentShareEXPERTsdtslmnanswered a month agoWei Wang a month agoConfirmed NLB, Target Group, ECS Cluster/Service/Tasks are all in the same VPCConfirmed Target Group configuration Target Type as IP and Protocol as TLS:443, and all registered targets are healthy (HTTPS 200 status code health check), 3 AZs, 1 task for each AZ.Share0When using a NLB, the NLB does not care whether the target replies with a HTTP code or not, it tries to establish the connection with TCP and that's it. So it seems to me it might not be able to do that.A NLB does not have a SG, instead, the Security Group Rules (Ingress here) used are the ones of the service. That includes for the NLB to do the healthcheck. Make sure your SG ingress allows for the NLB to perform the healthcheck. To check, you can try to do telnet <container IP> <port> and see whether your NLB would be able to perform the test. Do that from an EC2 instance for example, placed in the same subnet as your NLB.Hope this helps,CommentShareJohnPrestonanswered a month ago"


Question: aws lambda - ES6 module error : module is not defined in ES module scope

"Based on these resources :https://aws.amazon.com/about-aws/whats-new/2022/01/aws-lambda-es-modules-top-level-await-node-js-14/https://aws.amazon.com/blogs/compute/using-node-js-es-modules-and-top-level-await-in-aws-lambda/it is clear that aws nodejs 14.x now supports ES6 module.However, when I to run a nodejs app with ES6 module, I get this errorundefined   ERROR   Uncaught Exception  {    "errorType": "ReferenceError",    "errorMessage": "module is not defined in ES module scope\nThis file is being treated as an ES module because it has a '.js' file extension and '/var/task/package.json' contains \"type\": \"module\". To treat it as a CommonJS script, rename it to use the '.cjs' file extension.",    "stack": [        "ReferenceError: module is not defined in ES module scope",        "This file is being treated as an ES module because it has a '.js' file extension and '/var/task/package.json' contains \"type\": \"module\". To treat it as a CommonJS script, rename it to use the '.cjs' file extension.",        "    at file:///var/task/index.js:20:1",        "    at ModuleJob.run (internal/modules/esm/module_job.js:183:25)",        "    at process.runNextTicks [as _tickCallback] (internal/process/task_queues.js:60:5)",        "    at /var/runtime/deasync.js:23:15",        "    at _tryAwaitImport (/var/runtime/UserFunction.js:74:12)",        "    at _tryRequire (/var/runtime/UserFunction.js:162:21)",        "    at _loadUserApp (/var/runtime/UserFunction.js:197:12)",        "    at Object.module.exports.load (/var/runtime/UserFunction.js:242:17)",        "    at Object.<anonymous> (/var/runtime/index.js:43:30)",        "    at Module._compile (internal/modules/cjs/loader.js:1085:14)"    ]}I have already added "type": "module" in package.jsonpackage.json{  "name": "autoprocess",  "version": "1.0.0",  "description": "",  "main": "index.js",  "type": "module",  "scripts": {      },  "author": "",  "license": "ISC",  "dependencies": {    "@aws-sdk/client-sqs": "^3.41.0",    "aws-sdk": "^2.1030.0",    "check-if-word": "^1.2.1",    "express": "^4.17.1",    "franc": "^6.0.0",    "is-html": "^3.0.0",    "nodemon": "^2.0.15"  }}index.json'use strict';import StringMessage from  './StringMessage.js';module.exports.handler = async (event) => {   var data = JSON.parse(event.body);    //other code goes here   let response = {      statusCode: 200,      headers: {                },      body: ""  };  console.log("response: " + JSON.stringify(response))  return response;};I have also tried replacing "module.exports.handler" with "exports.handler ". this does not work either. error message shows "exports is not defined in ES module scope"What am I doing wrong?additional info:I am uploading the function code via zip fileFollowComment"

Answer: "1Accepted AnswerHi, try replacing the line:module.exports.handler = async (event) => {withexport const handler = async (event) => {You can import you modules outside of the handler with the command below and then use within the handler:import {StringMessage} from  './StringMessage.mjs';CommentSharepete-from-AWSanswered a year agoaz-gi a year agochanging to :export const handler = async (event) => {worked. Thank youSharekasenlow a year agoMine still doesn't workShare"


Question: API Gateway Mapping Template missing toJson

"API Gateway seems to have limited VTL support, and in particular 2 key features are missing that AppSync VTL does support - $util.toJson and #return. Are these on the roadmap or are there workarounds? I know I can always fall back to Lambda, but I'm specifically trying to do as much in the mapping template as possible.FollowComment"


Question: "Cognito well-known url(discovery document) doesn't have many other endpoints like revoke, logout"

"Hi,I am trying to use cognito but the discovery document via the url https://cognito-idp.us-east-1.amazonaws.com/<user pool id>/.well-known/openid-configuration doesn't have endpoints like logout, revoke.Is there a way to include them into the discovery document? Because I try to extract the endpoints from the discovery document.Currently it looks like this{     "authorization_endpoint": "https://xyz.auth.us-east-1.amazoncognito.com/oauth2/authorize",     "id_token_signing_alg_values_supported": [         "RS256"     ],     "issuer": "https://cognito-idp.us-east-1.amazonaws.com/userpool",     "jwks_uri": "https://cognito-idp.us-east-1.amazonaws.com/userpool/.well-known/jwks.json",     "response_types_supported": [         "code",         "token"     ],     "scopes_supported": [         "openid",         "email",         "phone",         "profile"     ],     "subject_types_supported": [         "public"     ],     "token_endpoint": "https://xyz.auth.us-east-1.amazoncognito.com/oauth2/token",     "token_endpoint_auth_methods_supported": [         "client_secret_basic",         "client_secret_post"     ],     "userinfo_endpoint": "https://xyz.auth.us-east-1.amazoncognito.com/oauth2/userInfo" }Although cognito has logout and revoke endpoint but its not part of the discovery document urlEx- https://mydomain.auth.us-east-1.amazoncognito.com/logout, https://mydomain.auth.us-east-1.amazoncognito.com/oauth2/revokeFollowComment"

Answer: "0Accepted AnswerYou are this is not the case today.Still the discovery endpoint is a JSON document, so nothing prevent you from hosting your own version with extended information as you see fit and point your information to it. While preferable, the RFC does not mandate that the discovery document is hosted on the same FQDN as the OIDC provider.You can for example use a Lambda function that will retrieve the original document, enrich it it and return the result to the requester.CommentShareJeff Lombardo-AWSanswered 4 months ago"


Question: AWS Cost Optimization : Load Balancer Clean Up

Trusted Advisor is listing that Idle Load Balancers (1) - Reason (Low request count) and Monthly savings($18.00) and LB State is "-"is it safe to delete the LB? please suggest?FollowComment

Answer: "0Accepted AnswerSee below from the documentation:https://docs.aws.amazon.com/awssupport/latest/user/cost-optimization-checks.htmlIdle Load BalancersDescriptionChecks your Elastic Load Balancing configuration for load balancers that are idle.Any load balancer that is configured accrues charges. If a load balancer has no associated back-end instances, or if network traffic is severely limited, the load balancer is not being used effectively. This check currently only checks for Classic Load Balancer type within ELB service. It does not include other ELB types (Application Load Balancer, Network Load Balancer).Recommended ActionIf your load balancer has no active back-end instances, consider registering instances or deleting your load balancer. See Registering Your Amazon EC2 Instances with Your Load Balancer or Delete Your Load Balancer.If your load balancer has no healthy back-end instances, see Troubleshooting Elastic Load Balancing: Health Check Configuration.If your load balancer has had a low request count, consider deleting your load balancer. See Delete Your Load Balancer.CommentShareEXPERTTushar_Janswered 6 months ago"


Question: AWS Lightsail - PTR & SMTP

"Hi GuysNew to AWS Lightsail. I have created a WordPress instance with Lightsail. I need some help as I am new and not very savvy in this case.The I have associated a static IP to the WordPress site and it is running fine. I am having some issue with email rejection and not sure why. Something to do with PTR and SMTP.The domain is pointing to Office 365 Email using "Microsoft" Name Servers. Basically they are hosting the DNS records, from there the domain is pointing to Lightsail instance using and IP "A" Record. That is all. Now I just want to know if this cause any issues and or if I need to implement anything else also who to use PRT and where.Appreciate any help in advance.BenFollowComment"

Answer: "0Hi Ben, Happy to try to help. Wordpress lets you send emails from it's own wordpress system, as well as leveraging an external SMTP address. Your Name Servers are running externally (which is fine), but if you are using Wordpress as your SMTP, I recommend configuring it with a plugin like https://wordpress.org/plugins/wp-mail-smtp/ which does all the heavy lifting for you. Usually you'll need to add a TXT record if I'm not mistaken, to your DNS rules. Let me know if this helps get you on the right track or not but I think this will be your simplest solution to have better results.CommentShareBrian Grafanswered 10 months ago"


Question: CloudFormation RDS Script

I wrote a YML script for cloudformation configuring alert script is very simple and according to our need except i am facing an issue i want a dropdown RDS instance list in this script I tyred to read Aws documentation and other forms if any when have any idea please share .Note i created same script for ec2 instance in which a dropdown menu is visible and show all available ec2 instances mention below is the RDS scriptParameters:sns:Type: StringDefault: Enter snstopic NameDescription: Enter Your Sns Topic Name.EmailAdrs:Type: StringDefault: Enter Your Email AddressDescription: Enter Your Email Address.DBinstance:Type: 'AWS::RDS::DBInstanceIdentifier'Default: Select Your InstanceDescription: Select Your Instance from Dorpdown list.Resources:snstopic:Type: 'AWS::SNS::Topic'Properties:TopicName: SampleTopicSubscription:- Endpoint: !Ref EmailAdrsProtocol: emailRdsEventSubscription:Type: 'AWS::RDS::EventSubscription'Properties:SubscriptionName: RdsfailureEnabled: trueSnsTopicArn:Ref: snstopicSourceType: db-instanceEventCategories:- failureSourceIds:- !Ref DBinstanceFollowComment

Answer: 2Accepted AnswerHi ThereThere are only certain AWS-Specific parameters that are supported in a drop-down list.  AWS::RDS::DBInstanceIdentifier is not supported.  You are correct though that ec2 instance is one of the supported parameters which explains why it worked for you in that case.  You can use a custom list of AllowedVaulues for your RDS instances but you would need to keep it updated.See this URL for the full list of supported AWS-Specific Parameter typeshttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html#aws-specific-parameter-typesCommentShareEXPERTMatt-Banswered 9 months agoEXPERTChris_Greviewed 9 months agoMuhammadNafees 9 months agothanks Maat-b for the help and guide about CSV method.. is it possible for you to please share any link or yml code how to import a list using CSVShareMatt-B EXPERT9 months agoYou can do something like this in your templateDBinstance:     AllowedValues:        - Instance1        - Instance2        - Instance3    Type: String     Default: Instance1    Description: Select Your Instance from Dropdown list.Share0great I checked and test the code it is working perfectly  thanks for helpCommentShareMuhammadNafeesanswered 9 months ago


Question: "How much GPU memory are available on the g4, g5, p3d, and p4d series instances?"

"Is there a link that shows how much GPU memory is available on the following GPU instances on AWS?g4-series instances (NVidia T4)g5-series instances (NVidia A10)p3d-series instances (NVidia V100)p4d-series instances (NVidia A100)Update: the information is available for the p3d series and g5 series, though not for the g4 series or the p4 series instances. Is it possible to retrieve the information for the latter two instances anywhere (without having to launch the instances)?FollowComment"

Answer: "1Accepted AnswerThis link has a table that compares instances' GPU memoryhttps://docs.amazonaws.cn/en_us/AmazonECS/latest/developerguide/ecs-gpu.htmlCommentShareYoFayedanswered 3 months ago1Hello Nathaniel,You can find this information on the launch blogs here:for G4 series: 16GB GPU Memory https://aws.amazon.com/blogs/aws/now-available-ec2-instances-g4-with-nvidia-t4-tensor-core-gpus/for P4 ultraclusters:  320GB GPU Memory https://aws.amazon.com/blogs/aws/new-gpu-equipped-ec2-p4-instances-for-machine-learning-hpc/Hope this helpsCommentSharegeorgios_sanswered a year ago"


Question: [Gamelift] Stop players from entering a game session

"I would like to stop players from entering a game session once a minimum number of players have joined. Here's an example:The maximum number of players that could be in a given game session is 50.The minimum number of required players to start a game session is 25.Once the minimum of 25 players is reached, I would like to "close" the game session so that new players cannot join this game sessionI know that in the matchmaking rule set, there is this logic:    "teams" : [{        "name": "allplayers",        "maxPlayers" : 50,        "minPlayers" : 25    }],However, with the above logic, players can still enter the game session after the 25 limit is reached. How can I "close" the game session once the 25 limit is reached? By "close", I mean that new players cannot join this running game session.Thanks!FollowComment"

Answer: "1Hi!There are a couple of ways you could potentially do this.Once the game session has started, you can invoke UpdatePlayerSessionCreationPolicy through the server SDK with a DENY_ALL policy. This prevents the game session from accepting new playersAlternatively if this decision is being made outside of the game server itself (for instance a backend client service):You could call the UpdateGameSession API with the required max player session count, to update the maximum number of players that can be connected simultaneously to the game session.You could call the UpdateGameSession API with a DENY_ALL player session creation policy. This will prevent the game session from accepting any new players.Thanks!CommentShareShashankJ_AWSanswered 20 days agoOptimalGamer 19 days agoThanks! Will try this out and keep you updated!Share"