Question: ERROR: Max frame length of 65536 has been exceeded

not a particularly large data set but I receive the following error:[code]ERROR org.apache.tinkerpop.gremlin.driver.Handler$GremlinResponseHandler  - Could not process the responseio.netty.handler.codec.http.websocketx.CorruptedWebSocketFrameException: Max frame length of 65536 has been exceeded.at io.netty.handler.codec.http.websocketx.WebSocket08FrameDecoder.protocolViolation(WebSocket08FrameDecoder.java:426)at io.netty.handler.codec.http.websocketx.WebSocket08FrameDecoder.decode(WebSocket08FrameDecoder.java:286)at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:501)at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:440)at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:276)at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1518)at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1267)at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1314)at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:501)at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:440)at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:276)at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163)at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:714)at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:650)at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:576)at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:493)at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989)at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)at java.lang.Thread.run(Thread.java:748)Max frame length of 65536 has been exceeded.[/code]I can query up to around 20 of them but more of them I get this error (only 31 total)The vertices are all of one type/label - query is g.V().hasLabel('DATALABEL').valueMap(true).toList()the vertices do have a good few properties including set property types of json stringsFollowComment

Answer: "0Accepted AnswerIt is likely the large number of properties that you're trying to fetch.  You will need to increase the maxContentLength() on your client (per:  https://stackoverflow.com/a/53188692/10130372) to address this issue.Unless you are trying to do this for simplicity sake, it is typically of little benefit to store things like JSON strings or extraneous properties in the graph that are not used as part of your graph traversals.  Presently, Gremlin cannot "break open" a JSON string and query the contents within it.  Also realize that every vertex, vertex property, edge, and edge property in Neptune is indexed on write.  These extra properties will contribute to the overall capacity needed in your cluster.  Again, a lot of developers will choose to go this route for simplicity.  Another approach would be to store such values in a key/value table (DynamoDB) or S3 and fetch them separately from the graph traversal.CommentShareTaylor-AWSanswered 2 years ago0thanks. external storage/fetch isnt a great option for the current usecase -simplicity is part of it but not all - I also receive the data for the vertices as objects with those fields as json already. I am considering breaking out the objects as separate vertices though - the dev on that part is still uncertain if he want to retain multiple or just the latest. if multiple will likely move to external verticeswould breaking the objects out be an improvement or no particular benefit for size/efficiencies. They json fields are never used for searchesCommentSharephilcroslandanswered 2 years ago"


Question: Creating a "Live With" Experience similar to Instagram

"Hi all – I looking to build a feature similar to "Live With" that Instagram has.To describe the feature at a basic level: I want a livestream of two streams that originate from two separate mobile apps. How this would work is:Participant A starts livestreaming from their iOS/AndroidParticipant B is asked to join the livestream.Participant B starts livestreaming from their iOS/AndroidViewers see a single stream of Participant A and B speakingI'm a noob to the AWS video products but I couldn't figure out (1) whether this is possible, (2) what tools could be composed to replicate this experienceFollowComment"


Question: Urgent - Pearson VUE revoked exam due to name mismatch

"Hi AWS Team,I have schedule my exam for AWS developer associate at 11: 15 AM IST today(17-10-2021) and the Pearson VUE proctor revoked the exam stating mismatch in name.Pearson VUE case ID : 07199249AWS Candidate ID : AWS00503341I have already raised the aws support case using https://support.aws.amazon.com/#/contacts/aws-training.I haven't heard back yet. I need to complete the certification ASAP as per my company guidelines. Kindly do the needful to make the necessary name change and to reschedule the exam.Thanks.FollowComment"

Answer: "1vignesh9597,At this time, you can schedule a new appointment. Please be sure to review our ID Requirements at https://aws.amazon.com/certification/policies/during-testing/#ID_Requirements before scheduling. If you are unable to produce the required ID, you will be unable to test.KimAWS CertificationCommentShareKimWD-AWSanswered 2 years ago0Will i get any voucher or refund for the revoked exam, i contacted the Pearson VUE customer support and they said to first change the name on the AWS side and then let them know, so that they will help me to re-schedule the exam.Here you are asking me to schedule a new appointment, its contradicting.CommentSharevignesh9597answered 2 years ago0We do not provide vouchers/refunds in these cases as the policy is communicated prior to registering for an appointment and throughout the registration process.CommentShareKimWD-AWSanswered 2 years ago0Its really disappointing the way AWS is handing it, i have done two certifications in Microsoft Azure via Pearson VUE and never came across this problem. They enabled a popup before giving the final confirmation to check on the names matching with government proofs, instead giving long and long instructions which i am afraid how many go through in this busy world.The Pearson VUE proctor said my name had been updated in their system as "vignesh vignesh" instead of "Vignesh A" i.e. my first name has also been updated as a last name, don't know how could that happen.Having around 8 years of industry experience and in the busy schedule, it is a mere waste of time and money and thanks for this. I have not expected an reputed organization like amazon is handling a typical name mismatch issue that so many of the aspirants came across like this. In this forum itself i have seen most the issues related to name mismatch, and yet no option of warning aspirants before submitting, its bizarre.CommentSharevignesh9597answered 2 years ago0AWS should correct its way of doing handling it. The exam registration made it impossible to update the full name in the registration profile and there is no request change name link besides the name field. This is AWS functionality bug but it makes candidates to pay the price!CommentSharerePost-User-3020935answered 7 months ago"


Question: Mixing ECS Fargate IPV6 and Network Load Balancers

"Is it possible to create an ECS service on Fargate with an IPV6 IP address and attach a network load balancer to the service? If I setup an ECS service on Fargate on an IPV6 subnet then the tasks it creates correctly have an IPV6 IP address assigned to them. However, if I use the same configuration for the service but add a network load balancer then the tasks created no longer have IPV6 IP addresses assigned to them. This occurs whether the target group has an IPV6 target or an IPV4 target.FollowComment"


Question: Certificate signing in EKS

"A customer needs to generate X509 certificates in Kubernetes for their extensions (validating/mutating/conversion webhooks). Standard way is to use CertificateSigningRequest for this purpose, but EKS does not have CertificateSigning admission controller installed, so the CSR is not getting signed.Is there either a way to enable CertificateSigning admission controller on EKS or any other best practice for generating and renewing X509 certificates for EKS cluster internal usage (i.e. kube-apiserver <-> custom-developped-webhook)?FollowComment"

Answer: "0Accepted AnswerI have encountered a similar issue. Admission controllers(mutating/validating) and kube-apiserver only communicate over HTTPS. The admission controller needs TLS certs.I have few solutions to this problem that don't come natively with EKS but you can  use Open source solutionsUse Cert-manager (X.509 certificate management for Kubernetes) ; cert-manager is a certificate management controller that can run on EKS. cert-manager will issue certificates from Let’s Encrypt, HashiCorp Vault, Venafi, a simple signing key pair, or self signed. Big benefit is it will ensure certificates are valid and up to date, and attempt to renew certificates at a configured time before expiryAn open source tool  called k8s-webhook-cert-manager can also be used in this scenarioLink:  https://github.com/newrelic/k8s-webhook-cert-managerAnother open source tool is available which is based on the above tool called k8s-webhook-certificatorLink: https://github.com/Trendyol/k8s-webhook-certificatorI would recommend using cert-manager on EKS which is a CNCF project. If not other 2 tools mentioned.CommentShareAWS-User-3386302answered 2 years ago"


Question: SNS text messages

"Hello, I have an SNS account that already has been moved out of sandbox. I would wish to verify a user number during sign up and/or as a MFA measure during sign in. However SNS does not seem to send the code to my user. I dont know what the problem could be; please assistFollowCommentJaccoPK a year agoWhat region did you use? There are a few exceptions to in which region you need to get out of the sandbox.ShareJaccoPK a year agohttps://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-email-phone-verification.htmlShare"

Answer: "0Hi,I would first recommend you to enable SNS SMS Delivery Status Logs and check the providerResponse for any clues why SMS was not sent.However, if you require additional help please contact AWS Premium Support and provide the following additional details needed for further investigation:AWS Account IDAWS region3 - 4 SNS SMS logs (i.e. not older than 72 hours)Lastly kindly note that SMS messages in the following Amazon Cognito Regions are rerouted through the corresponding supported Amazon SNS Regions.--------------------------------------------------------|Amazon Cognito Regions | Supported Amazon SNS Regions |--------------------------------------------------------|US East (Ohio)         | US East (N. Virginia)        ||Asia Pacific (Mumbai)  | Asia Pacific (Singapore)     ||Asia Pacific (Seoul)   | Asia Pacific (Tokyo)         ||Canada (Central)       | US East (N. Virginia)        ||Europe (Frankfurt)     | Europe (Ireland)             ||Europe (London) | Europe (Ireland)             |--------------------------------------------------------CommentSharesyumaKanswered a year ago"


Question: What IAM policies were used for the AWS Transfer Family managed workflows video tutorial?

What IAM policies can be used to replicate the two demos in AWS Transfer Family Managed Workflows Demo | Amazon Web Services?FollowComment

Answer: "0Accepted AnswerThe following IAM policies can be used for the video's demo's AWS Transfer Family workflow execution roles. For more information, read Construct an execution role for workflows, and create an IAM role with a trust policy for transfer.amazonaws.com.Demo 1This demo covers AWS Transfer Family copy and tag steps. The workflow copies an object to an archive bucket and tags the object. Copy requires reading from the source bucket, writing to the destination bucket, and HeadObject access. Tagging requires two actions since the S3 bucket has versioning enabled, and can be limited to a condition with the specific tag the workflow is applying. If doing this in your environment, ensure your IAM policy resources are set to the most restrictive for your workflow.{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "CopyRead",            "Effect": "Allow",            "Action": [                "s3:GetObject",                "s3:GetObjectTagging"            ],            "Resource": "arn:${Partition}:s3:::${SourceBucketName}/${ObjectName}"        },        {            "Sid": "CopyWrite",            "Effect": "Allow",            "Action": [                "s3:PutObject",                "s3:PutObjectTagging"            ],            "Resource": "arn:${Partition}:s3:::${DestinationBucketName}/${ObjectName}"        },        {            "Sid": "CopyList",            "Effect": "Allow",            "Action": "s3:ListBucket",            "Resource": [                "arn:${Partition}:s3:::${SourceBucketName}",                "arn:${Partition}:s3:::${DestinationBucketName}"            ]        },        {            "Sid": "Tag",            "Effect": "Allow",            "Action": [                "s3:PutObjectTagging",                "s3:PutObjectVersionTagging"            ],            "Resource": "arn:${Partition}:s3:::${DestinationBucketName}/${ObjectName}",            "Condition": {                "StringEquals": {                    "s3:RequestObjectTag/Archive": "yes"                }            }        }    ]}Demo 2This demo covers AWS Transfer Family workflow custom and delete steps. The workflow invokes an AWS Lambda function, then deletes the S3 object, and has a custom step as an exception handler. It requires s3:DeleteObject access and lambda:InvokeFunction access for the two AWS Lambda functions. If doing this in your environment, ensure your IAM policy resources are set to the most restrictive for your workflow.{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "Delete",            "Effect": "Allow",            "Action": [                "s3:DeleteObject"            ],            "Resource": "arn:${Partition}:s3:::${BucketName}/${ObjectName}"        },        {            "Sid": "Custom",            "Effect": "Allow",            "Action": [                "lambda:InvokeFunction"            ],            "Resource": [                "arn:${Partition}:lambda:${Region}:${Account}:function:${FunctionName}",                "arn:${Partition}:lambda:${Region}:${Account}:function:${FunctionName}"            ]        }    ]}CommentShareblayzeanswered a year ago"


Question: Identity Center not sending OTP emails to users created using the CreateUser API

"https://docs.aws.amazon.com/singlesignon/latest/userguide/userswithoutpwd.htmlAccording to this documentation, users created in the Identity Store using the CreateUser API should receive their password by email but it does not work. I don't receive any email (I tried several email addresses).What I have done:I created users using this API call : https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_CreateUser.htmlI followed the documentation and enable this feature (see the screenshot attached)I did check my spamsWhen a manually reset the user password, I do receive an email from Identity CenterFollowComment"


Question: Access Issue with video

"Hi friends,I am having issue getting video from an S3 object to play in an external player. I am sure that I have set the bucket permissions to PUBLIC but cannot get the video to play.Is there anything I can try to double check I have allowed the object to be 'public'?Thanks for your help.JonathanFollowCommentBrettski-AWS EXPERTa month agoCould you expand a little on "having issue"? If you test the URL with (say) curl or wget does it work and the issue you're having is only in the browser? Or is it a permissions problem as you suggest (no access method works)?Share"

Answer: "0Is the bucket policy set up to allow get and list from outside?CommentShareEXPERTRiku_Kobayashianswered a month agoJDCO a month agoHi Riku, thanks for replying. As far as I am aware I made the bucket public with full access so that I can stream video from AWS to an external player.Share"


Question: Build succeeds but backend changes are not deployed

"On Amplify console after a push to a connected branch the build goes trough all the steps and there are no errors, the Backend section of the Build tab seems to detect the changes like new storage and so on. But the changes are not deployed to the actual backend, I don't see my new tables on dynamo or new code on lambda. etc.This is happening on all environments. It was working and now all of a sudden it stopped working on all builds.FollowComment"

Answer: "0I might not have all the context behind this question, but I will assume you added the DDB tables with the command amplify add storage and you can see them now in the config file, I will also assume you created the function using amplify add function or amplify update function, if that is the case those changes need to be deployed with amplify push before then can be used. Once this is created every time there is a change on the function the pipeline should detect them and deploy the updated code.Check in your amplify console if the resources are defined in there, if that is the case please ignore my answer, if not definitely do a push. I hope this helps!CommentShareestsernaanswered a year agoAWS-User-3673786 a year agoYes you are talking about Ampliy CLI and that works, I do that in my dev environment. But then when I push to master I have a webhook to trigger a build on the Amplify Console and then this issue happens, everything builds correctly but the backend is not deployed.Share"


Question: Handle and return errors in lambda hapening on the init phase

"Hi team,I used this answer to exit my lambda when an error occur in Redis connect (Thank you @Indranil Banerjee AWS for your answer)https://repost.aws/questions/QURgqZS0xaQcmfI0PkfT-4QA/handle-errors-in-lambda-hapening-on-the-init-phaseas my code ins in node js/javaScript not python I used process.exit() instead of sys.exit()but my lambda still fails with a generated error and I can't return back my error response :return {    statusCode:"500",    headers: {      "Content-Type": "application/json",      "Access-Control-Allow-Origin": "*",    },    body: JSON.stringify(MyresponseErrorObject),  };if I do my returnreturn {    statusCode:"500",    headers: {      "Content-Type": "application/json",      "Access-Control-Allow-Origin": "*",    },    body: JSON.stringify(MyresponseErrorObject),  };after process.exit() it will be unreachable code.is process.exit() the right way to exit lambda function in nodeJs (like sys.exit() in python) ?my lambda still fails as shown in the screenshot above(this is a simulated error I made a mistake on the Redis URL so I can simulate the error and handle it properly outside the event handler code)appreciate your help on this.Thank you!FollowComment"

Answer: 0Can you please take a look at "Designating a function handler as an ES module" section in https://docs.aws.amazon.com/lambda/latest/dg/lambda-nodejs.htmlAlso take a look at this blog https://aws.amazon.com/blogs/compute/using-node-js-es-modules-and-top-level-await-in-aws-lambda/CommentShareEXPERTIndranil Banerjee AWSanswered 7 months ago


Question: How does EC2 hop to a publicly accessible RDS endpoint?

"Hey team, say I have an RDS endpoint that's publicly available. I then access this endpoint from an EC2 instance.What happens at the network layer? Does the request go to the public internet? Ideally, the system would know that the we're inside the same vpc and hop right over. How could I confirm this?FollowComment"

Answer: "0Accepted AnswerAssuming your ec2 instance is in the same VPC as the RDS database, then it will route using the private subnet. You can confirm this by using nslookup from the ec2 instance, you should get the private ip address.CommentShareMODERATORphilawsanswered 6 months agoEXPERTTushar_Jreviewed 4 months agoBrettski-AWS EXPERT6 months agoThis is a good way to check which IP address (public or private) the EC2 instance is obtaining. I'd also note that I would not be making a RDS endpoint public - that's definitely not a good security practice.Share"


Question: Aurora Postgresql instance flapping with storage "errno = 32"

"Have an aurora postgresql cluster that has been down for multiple hours. Tried rebooting instances in the cluster, adding new read replicas and upgrading instances. Nothing seems to work.One of the existing instances I see the follow log seeming to indicate that the process is flapping. I've done some searching, but nothing seems to document what errno = 32 actually means.2022-03-31 20:18:43 UTC::@:[18331]:LOG: setting shmemname /mnt/hugetlbfs/aurora-postgres-buffer-cache2022-03-31 20:18:44 UTC::@:[18331]:LOG: Storage initialization failed. result = 1988, errno = 322022-03-31 20:18:44 UTC::@:[18329]:FATAL: Can't handle storage runtime process crash2022-03-31 20:18:44 UTC::@:[18329]:LOG: database system is shut downAny idea what's wrong with my cluster and/or how I can fix it?FollowComment"


Question: RDS sql-server snapshot export to S3

"Is there any change in the announcement that is found here?https://aws.amazon.com/about-aws/whats-new/2020/01/announcing-amazon-relational-database-service-snapshot-export-to-s3/Amazon RDS Snapshot Export to S3 can export data from Amazon RDS for PostgreSQL, Amazon RDS for MariaDB, Amazon RDS for MySQL, Amazon Aurora PostgreSQL, and Amazon Aurora MySQL snapshots and is now available in US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Ireland), and Asia Pacific (Tokyo) Regions.I do not see the "sql-server" nor Mumbai region in the above statement.FollowComment"

Answer: "1Accepted AnswerHello,As mentioned in the docs: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ExportSnapshot.htmlAmazon RDS supports exporting snapshots in all AWS Regions except the following:Asia Pacific (Jakarta)AWS GovCloud (US-East)AWS GovCloud (US-West)The following table shows the engines that are supported for exporting snapshot data to Amazon S3:Amazon RDS for PostgreSQLAmazon RDS for MariaDBAmazon RDS for MySQLAmazon Aurora PostgreSQLAmazon Aurora MySQL With Amazon RDS for SQL Server - you have the ability to execute native backup and restore for Microsoft SQL Server databases using full/diff backup files (.bak files), which will be saved directly on S3.For more information: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.htmlCommentShareRoni Vered - AWSanswered a year ago"


Question: Using KVS WebRTC as a Producer for KVS

"Is it possible to setup KVS WebRTC as a producer for Kinesis Video Stream?I am looking to create a browser based cloud audio recorder / dictation tool. There will be no need to connect with a peer, but I do need to to stream audio from the browser into Kinesis Video Stream. It appears that the only producers for Kinesis Video Stream are all app-based rather than browser based.An alternative approach might be to avoid WebRTC and find another way of streaming from the browser to Kinesis Video Streams, maybe a server based producer that relays from the browser?FollowComment"

Answer: "0To clarify, you do not need to establish any p2p connections, just capture the audio stream from the microphone to then transcribe the audio? If so, just use the Transcribe Streaming service directly from within the browser: https://docs.aws.amazon.com/transcribe/latest/dg/streaming.htmlCommentShareEXPERTDavid Maloneanswered a year ago"


Question: Getting a 401 when trying to access OpenSearch serverless dashboard

"Trying out opensearch serverless, setup dataaccess policies, network policies, VPC endpoints and when trying to access Dashboard, I am receiving a 401.Looking at Developer tools debug screen, I see the following as response hint, what network-policy-deny is this refering to ?X-Aoss-Response-Hint:X01:network-policy-denyFollowComment"

Answer: "1Error 401 while accessing OpenSearch serverless dashboard generally occurs when you are  a collection has VPC access type but you are trying to access it from the public internet.  I kindly request you to check if the request to access dashboard is coming from the same VPC in which the collection is created.For more details on network settings for OpenSearch serverless collection, I kindly request you to follow reference[1].Please let me know If you are using VPC access type and sending the request through the same VPC and still facing this issue or have any other concerns/queries related to the same, please feel free to reach back to me and I will be glad to assist.Reference:[1] Network access for Amazon OpenSearch Serverlesshttps://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.htmlCommentShareSUPPORT ENGINEERAkashDanswered 4 days agoEXPERTFabrizio@AWSreviewed 2 days ago"


Question: Bug Report: default_collation_for_utf8mb4 of parameter group not applied after RDS restart

"I want to report a bug. I use RDS with MySQL 8.0.31I set default_collation_for_utf8mb4=utf8mb4_general_ciAfter RDS is modified, I run "show global variables like 'default_collation_for_utf8mb4';" and the value indeed changed to utf8mb4_general_ci.But after I restart my RDS instance, the default_collation_for_utf8mb4 goes back to utf8mb4_0900_ai_ci, which breaks our replication to MySQL 5.7 instance.Please check this bug.Thank youFollowComment"

Answer: "0It seems that the default_collation_for_utf8mb4 parameter is not being persisted after an RDS restart. This could be due to a configuration issue or a bug in RDS itself.One workaround you can try is to create a custom parameter group that sets the default_collation_for_utf8mb4 parameter to the desired value. Then, associate your RDS instance with this custom parameter group. This should ensure that the desired value for default_collation_for_utf8mb4 is applied even after an RDS restart.CommentSharehashanswered a month agorePost-User-0087010 a month agoHello, sry I didn't explained clearly. I am already using a custom parameter group. Even though I am using a custom parameter group, after a restart of RDS, the value still resets. Thats the bug.Share"


Question: Lambda Provisioned Concurrency on Version vs. Alias

"I have Lambda function that is fronted by an Application Load Balancer.  The Lambda function has an alias called live. The ALB is pointing to the live alias (ie. target of the ALB is arn:aws:lambda:us-east-1:123456789012:function:MyLambda:live)I have assigned provisioned concurrency (2 instances) to the live alias but noticed in the invocations graph that none of the invocations to the live alias are using provisioned concurrency.First question:  Why is live showing all invocations not using provisioned concurrency despite 2 instances allocated? What's the best way to troubleshoot this?Second question: When assigning provisioned concurrency we have an option of allocating to the version that the live alias points to, or allocating to the alias.  Which is better? Allocate to the version that the Alias is pointing to? or allocate to the Alias?FollowCommentprolutions GmbH a year agoHi Mike,We experience the same behavior. The only difference is that our calls come from an API Gateway.Despite provisioned concurrency, when calls hit the function it starts new instances and the ones provisioned are not used. Then we have delays because of the cold start.Another strange thing is that we have provisioned 5 instances and we always have 10 instances running. We don't know why.(to find out how many instances are running, we count the log streams in cloud watch)Do you (or anyone else) have a solution?Regards,FlorianShare"


Question: NotAuthorizedError on eb create command

"I'm trying to host a django app in EBS. I completed till creating the Application. For creating the environment, I provided the command eb create lesoko-app-env. And I'm getting the following error:Creating application version archive "app-9591-220712_120615798305".ERROR: NotAuthorizedError - Operation Denied. Access Denied.Please let me know the solution for this. Thank youFollowCommentAshish_P a year agoCan you please check if you have AdministratorAccess-AWSElasticBeanstalk policy attached to the IAM User running "eb init" command ? If it's already attached, can you please mention all the policies attached to IAM User running "eb init" command ?Share"

Answer: 0Resolved it by changing the permissionsCommentSharerePost-User-1778305answered a year agorePost-User-3877868 4 months agoWhat permissions? I'm trying to do the same thing for my Flask App and getting the same error.Share


Question: Using PrivateLink NLB to ALB Port Redirection

"According to the blog post, you will be able to configure single ALB as a target in NLB.So what will be the required design if the target ALB has port redirection scenario like 80 to 443?FollowComment"

Answer: 0Because NLB is only using a single TCP port (443 - HTTPS) to communicate with the ALB the redirect can't be done on the ALB. I'd recommend using CloudFront instead so that the 80->443 redirect happens before it hits the load balancer.CommentShareEXPERTBrettski-AWSanswered a year agocnnn a year agoWhere do you put the CloudFront if you refer the below diagram?https://lucid.app/lucidchart/eb7dbf0a-5d99-42e6-9bc7-15d5856b3f2c/edit?invitationId=inv_d678e922-fabe-44b1-a708-e6c7837c2ad6ShareAWS-User-3043836 a year agoI also have the same question. In our case when we start doing redirection in our ALB from http - 80 to https - 443 then this results in a loop and fails with ERR_TOO_MANY_REDIRECTS.Share


Question: Key pair is not valid

"Hi!I have a problem launching a new EC2 instance with Ubuntu 22.04. The main problem is that when I create a new key pair, this download the ppk, but when I add the ppk to Putty, this fails because the ppk is not valid.To connect via SSH I follow the way that I always used to connect to my other instances (also with ubuntu).Host "ubuntu@MYIP"port "22"Connection type "SSH"and in SSH>Auth I add the ppk file with the key pairThe weird thing is that when I add it to filezilla with the same conf, this work perfectly.Someone had the same problem and knows how to solve it?(I create 5 instances with 5 key pairs, and the problems was the same in all)Thank uFollowComment"

Answer: "0First, ensure the keypair is correct and associated to the Instance. If correct, you can follow the steps on the documentation Connect to your Linux instance from Windows using PuTTY to connect to the Instance.Note if the .ppk keypair is not working, retry creating a .pem key then Convert your private key using PuTTYgen to connect to the InstanceIf the issue persists. Feel free to Contact  AWS Premium SupportCommentShareChibuike_Aanswered a year ago0I briefly tested connecting to an AMI2 EC2 machine via Ubuntu on my laptop. I encountered a number of problems trying to connect with SSH. One was solved by ensuring the ssh key had rw or read only permission to the owher only (rw------- or r-------- permissions). I think it's an SSH v3 feature. The users home directory should also be tied down to the user only.I'm not sure about AWS Ubuntu instances, but also make sure you connect to your cloud machine using the correct username.Best of luckCommentSharerePost-User-8756184answered 10 months ago"


Question: subscription charges and ongoing costs

I have recently received an email saying that my free tier is coming to an end.  Could you please let me know how I proceed from here and how I can find out exact costings.  It is not easily found nor readily explained in the communications I have received.  Can you contact to help with this issue.MichaelFollowComment

Answer: "0Hi there,The best way to review the services you're being charged for is by going to the AWS Billing Console. You can find more information about the AWS Billing Console at the following link:https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/getting-viewing-bill.htmlI would also recommend reaching out to AWS Support if you'd like to have someone explain this to you further via email, phone or chat. You can contact AWS Support at the following link:https://support.console.aws.amazon.com/support/homeCommentShareorangepandaanswered 2 months ago"


Question: AWS Workdocs drive crashes on Mac M1

"I get the error in the Mac console:failed to load/rebuild extensions: Incompatible architecture: Binary is for x86_64, but needed arch arm64eUnsupported Error: one or more extensions are unsupported to load Kext com.Amazon.WorkDocs.Drive.kext.osxfuse v303.8.3 in executable kext bundle com.Amazon.WorkDocs.Drive.kext.osxfuse at /Library/Filesystems/AmazonWorkDocs.fs/Contents/Extensions/10.16/osxfuse.kextUnsupported Error: one or more extensions are unsupported to load Kext com.Amazon.WorkDocs.Drive.kext.osxfuse v303.8.3 in executable kext bundle com.Amazon.WorkDocs.Drive.kext.osxfuse at /Library/Filesystems/AmazonWorkDocs.fs/Contents/Extensions/10.16/osxfuse.kextAre there any plans to get an ARM version?FollowComment"

Answer: "1This has been an issue since the M1s came out -- which was not so recently at this point -- and there has been zero response from Amazon, other than admitting that the software is incompatible with any modern Mac.Folks on the old forum have asked repeatedly if there are any plans to resolve the issue and have gotten crickets.  It's a thumb in the eye to Mac users, but what do you expect?CommentShareSubtle Matteranswered a year agoAlexander JP a year agoCrazy isn’t it?!  Our whole company uses Apple products and are heavy into AWS services.   You would think since now they have M1 virtual machines that they would have plans for the office services to port over.Share1I agree with Subtle Matter here, it's been more than a year and a half since the release of M1 chips, and we haven't been able to see any answer from Amazon as to when or if they plan to release a version for M1. This is really a bummer for us (100% apple product) and Apple from now on only sells M1.CommentShareKevin Mooreanswered a year ago0Accepted AnswerToday I tried downloading and installing the latest version and it's working.  Wondering what will happen with the next update of Ventura?CommentShareAlexander JPanswered 7 months ago0Hi, all.Today's update adds support for Apple Silicon MacBooks.https://aws.amazon.com/jp/about-aws/whats-new/2022/10/amazon-workdocs-support-apple-silicon-macbooks/CommentShareEXPERTiwasaanswered 7 months agoAlexander JP 7 months agoDoes not work with MacOS 13.0 (22A379) VenturaGet the following error during setup:Last login: Wed Oct 19 21:33:00 on ttys000/Applications/WorkDocs\ Drive.app/Contents/MacOS/WorkDocs\ Drive ; exit;######## ~ % /Applications/WorkDocs\ Drive.app/Contents/MacOS/WorkDocs\ Drive ; exit;dyld[1854]: Library not loaded: /System/Library/Frameworks/CHIP.framework/Versions/A/CHIPReferenced from: <0AFFE028-D1BE-3C34-95FB-E61F2D0C40AB> /Applications/WorkDocs Drive.app/Contents/MacOS/WorkDocs DriveReason: tried: '/System/Library/Frameworks/CHIP.framework/Versions/A/CHIP' (no such file), '/System/Volumes/Preboot/Cryptexes/OS/System/Library/Frameworks/CHIP.framework/Versions/A/CHIP' (no such file), '/System/Library/Frameworks/CHIP.framework/Versions/A/CHIP' (no such file, not in dyld cache)zsh: abort      /Applications/WorkDocs\ Drive.app/Contents/MacOS/WorkDocs\ DriveSaving session......copying shared history......saving history...truncating history files......completed.[Process completed]SharerePost-User-7793762 7 months agoI am getting this exact same issue, weirdly it worked on my M1 ultra MBP until I updated to VenturaShare0You may find this page useful.Installing Amazon WorkDocs DriveAmazon WorkDocs Drive isn’t supported on Apple silicon products.CommentShareholykzmanswered a year ago0You can find both MacOS versions from: https://amazonworkdocs.com/en/clientsTo check which processor your Mac is using, select  About This Mac from the Apple menu  in the corner of your screen.  For example, you might have an "Intel Core i7".I have found that rebooting whenever the contents of "Amazon WorkDocs Drive" in the users home directory is empty.  Rebooting the Mac seems to help ensure the folder is mounted.  You can also check to make sure the mounted disk space is not zero bytes (i.e.: 0Bi) using the df -h command from a terminal window.CommentShareAWS-User-6508506answered 5 months ago"


Question: ALB Authenticate Rule with Cognito error: OAuth flows must be enabled in the user pool client

"I have a simple Cognito user pool (no federation) with an app client with all 5 available auth flows enabled:ALLOW_ADMIN_USER_PASSWORD_AUTHALLOW_CUSTOM_AUTHALLOW_REFRESH_TOKEN_AUTHALLOW_USER_PASSWORD_AUTHALLOW_USER_SRP_AUTHThe pool already has AWS-provided domain configured.When I attempt to integrate it into an authenticate rule for my ALB, I got the following error:OAuth flows must be enabled in the user pool clientHow can I make this work?FollowComment"

Answer: "0Accepted AnswerI figured out what's wrong. I did not configure a hosted UI for the app client, which is an unlisted requirement for OAuth.CommentSharekhuongduybuianswered a year ago0Hi,Did you create a domain for the user pool? this is required to enable oauth2 endpoints.CommentShareEXPERTMahmoud Matoukanswered a year agokhuongduybui a year agoYes, I already created a domain. Does it have to be a custom-owned domain? Should I expect to see a DIFFERENT auth flow than the 5 listed ones?Share"


Question: Office hours or support from AWS

"Hi, does anyone know how I contact a member of AWS support directly please?FollowComment"

Answer: "2You need to get a support plan: https://aws.amazon.com/premiumsupport/plans/ at least the developer one to be able to create a ticket using this URL: https://us-east-1.console.aws.amazon.com/support/home?region=us-east-1#/If all you need is a service limit increase, you can do so from this URL: https://us-east-1.console.aws.amazon.com/support/home?region=us-east-1&skipRegion=true#/case/create?issueType=service-limit-increaseIf you are trying to report a security incident, you can try this: https://aws.amazon.com/premiumsupport/knowledge-center/potential-account-compromise/If your lost access to your AWS account, you can do this: https://aws.amazon.com/premiumsupport/knowledge-center/sign-in-account/if your are trying to report a vulnerability, you can use this: https://pages.awscloud.com/GLOBAL_GC_vulnerability-reporting_2021127_7014z000000rnU1.htmlCommentShareSergio Castineyrasanswered a year ago1Hello - Adding to the above answer would like to add - once you are in a support plan - you also get access to Account Managers and Technical Account Managers and they can guide you in your journey through AWS.https://aws.amazon.com/premiumsupport/plans/Hope this helps. ThanksCommentShareEXPERTNIRUPAM_danswered 10 months ago"


Question: TEXTRACT DRIVER LICENSE DOES NOT RETURN EYECOLOR  DATA FOUND ON BOTTOM OF LICENSE

Why does Textract studio  GUI not return** EYE color and GENDER  at the bottom of the driver license?  In fact all the other keys here are irrelevant!Azure can do it ... OOB.*Edit: Image does not meet re:Post Community Guidelines & has been removed - Ben G.FollowCommentrePost-SoniaA-8678285 9 months agoWaiting for answer from my comment where to send docs  requestedShare

Answer: "0Hi,Thanks for using Textract. As a machine learning service, AWS Textract might not detect all the results in certain documents. However, we are continuously improving our quality. If you can keep an eye on AWS Textract public release, which is the channel we use to announce quality update. Do you mind sharing your sample document that we can take a look and understand why it did not work for your use case?ThanksFangCommentShareAWS-User-6835124answered 9 months agorePost-SoniaA-8678285 9 months agoYes i can can i mail it to you Fang? are you from product? I compared it to Azure Forms Rec - They were able to extract it and that was OOBSharerePost-SoniaA-8678285 9 months agoI am new to Amazon came from Msft. What channel is that ?Share"


Question: KDA (Flink) to S3

"A customer is building a streaming solution that processes messages from their customers.  Data in the stream is sent from multiple customers - each JSON in the stream has a customerId that tells you what customer originally sent the data.They want to store a copy of this data on S3, but partitioned by customerId.  We could do this with multiple Firehoses (one for each customer).  Is this possible to do with Flink - so use Flink to pull from the Kinesis stream and send to multiple destinations on S3, into files based on customer Id?  I'm guessing this is possible - is it easy and can we use any existing libraries?ThanksFollowComment"

Answer: 0Accepted AnswerThis post describes how you can use KDA/Flink for exactly that use case: https://aws.amazon.com/blogs/big-data/streaming-etl-with-apache-flink-and-amazon-kinesis-data-analytics/. The section "Persisting data in Amazon S3 with data partitioning" describes how to realize data partitioning and you can find the sources on GitHub: https://github.com/aws-samples/amazon-kinesis-analytics-streaming-etl.CommentShareSteffen Hausmannanswered 3 years ago


Question: How to manually back up an Amazon Workspace?

"I'd like to manually back up an Amazon Workspace.  I want to manually trigger a backup, try some experiment (like installing a new program), and then if the experiment fails, restore from the backup I just made.  I know that Workspaces are automatically backed up at 12 hour intervals, but a 12 hour interval is way too long.  If I have to revert, I could lose 12 hours worth of work!  Is there any way to manually trigger a backup?FollowComment"

Answer: "0There is no way to trigger a manual backup of the WorkSpaces data drive.  Additionally, WorkSpaces only backup the user drive (D drive) for a WorkSpace.  The OS Drive (C: drive) is not backed up during a backup job so any programs installed will not be restored during a WorkSpaces rebuild.Please see Mayank_J's response below for documentation regarding the restore / rebuild processCommentShareRobert_Fanswered 9 months agoMayank_J 9 months agoThe Workspaces service does backup both root (C:) and user (D:) volumes in form of snapshot every 12 hours. But depending on whether you rebuild a Workspace[1] or restore a workspace[2] it would differ how those snapshots are used.[1] https://docs.aws.amazon.com/workspaces/latest/adminguide/rebuild-workspace.html[2] https://docs.aws.amazon.com/workspaces/latest/adminguide/restore-workspace.htmlShareJoe Valentine 4 months agoThis is absurd. I need the ability to manually backup Workspaces builds in progress; Workspaces from which our images are created, and need backup before and after major updates/installs. If said install breaks the workspace I am building for image-creation, then I get to start completely from scratch because AWS is blocking user's access to manually use a built-in function of AWS, workspace-backup.Not allowing the manual backup of individual workspaces is utterly inexcusable, in my sincere opinion. There is no excuse for such penny-pinching restrictions being placed on paying customers.ShareMayank_J 3 months agoYou can take manual backup of the data using any 3rd party tools but you can't rebuild or restore Workspaces using that backup. You can only restore the data from that backup. Workspaces restore and rebuild functionality will always use the snapshots taken by the service.Share"


Question: Log Subscription Filter To Opensearch

"I have enabled a CloudWatch log subscription filter which auto generates Lambda function. The Lambda function is supposed to stream log data to Opensearch domain. Does the Lambda function create a new index and indices in Opensearch? Currently, I only see the system indexes present in Opensearch domain.FollowComment"

Answer: "0You're right. The lambda function will create indices with name like cwl-YYYY.MM.DD. You can change the naming pattern by modifying the code in the lambda function where the variable indexName is being declared.Since you are using OpenSearch for indexing log data, consider UltraWarm which provides a low-cost storage tier for older read-only data like logs which you might query less frequently.Related blog post - https://aws.amazon.com/blogs/aws/general-availability-of-ultrawarm-for-amazon-elasticsearch-service/CommentShareNandhananswered a year agoAWS-User-TistaTech-AD a year agoI thank you for the great feedback. Somewhere there's a disconnect between the auto Lambda function and Opensearch. From CloudWatch metrics, I can see the Lambda function is being called and new logs are being processed. In Opensearch, document metrics have increased, but I don't see any additional indexes or indices when I access the Opensearch dashboard from the browser.  Documentation is very limited on this functionality. Would you happen to have detailed documentation for a complete end to end log subscription filter stream to Opensearch.ShareNandhan a year agoTo see a list of indices currently in your OpenSearch domain, you can try the following GET request from browser or postman that can access your OpenSearch domain : https://<your_os_domain_endpoint_url>/*?expand_wildcards=all . Replace <your_os_domain_endpoint_url> with your domain endpoint found in AWS Console.Instead of *, you can use cwl* in the request which will list all indices starting with cwl i.e https://<your_os_domain_endpoint_url>/cwl*?expand_wildcards=all .If the new index is not listed, it could be the case that there is some error indexing the documents at lambda whether due to the access policy defined for your OpenSearch domain or other reasons. You could check the lambda logs in Cloudwatch for any errors. Some common issues are document here - https://aws.amazon.com/premiumsupport/knowledge-center/opensearch-troubleshoot-cloudwatch-logs/I couldn't find an end-to-end guide other than the one in this documentation - https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_OpenSearch_Stream.html. However I did find this post about setting up publishing RDS logs to CloudWatch and streaming that to OpenSearch which documents most of the steps to follow - https://aws.amazon.com/blogs/database/analyze-postgresql-logs-with-amazon-elasticsearch-service/ .Hope that's useful with the issue you are facing.Share"


Question: Remove ACM Certificate used for deleted VPN connection

"Hello,i have deleted a VPN connection which was established by using ACM private certificates, but i cannot delete the certificates used for this connection:Command:aws acm delete-certificate --certificate-arn arn:aws:acm:eu-central-1:41xxxxxxxx39:certificate/7ef2226a-515b-4f90-aca7-72fefddb9a86Output:An error occurred (ResourceInUseException) when calling the DeleteCertificate operation: Certificate...In the documentation it is mentioned as follows:"For certificate-based authentication, delete all Certificate Manager (ACM) private certificates used for the Amazon Web Services-side tunnel endpoints for the VPN connection before deleting the VPN connection.""You cannot delete an ACM certificate that is being used by another Amazon Web Services service. To delete a certificate that is in use, the certificate association must first be removed."So far i understand my mistake, but i am not able to remove this certificate association via WebUI or CLI.The list certificates gives output as follows:"CertificateArn": "arn:aws:acm:eu-central-1:41xxxxxxxx39:certificate/7ef2226a-515b-4f90-aca7-72fefddb9a86","DomainName": "vpn-0ea809fb052c8c149.endpoint-0"Where DomainName is the certificate association, which i have to delete first (i guess) in order to delete the certificate, but i didn't find a way to do this.Can you help me to sort this problem out?Kind RegardsFollowComment"

Answer: "0If you look at your AWS console please navigate to VPC -> Virtual Private Network (VPN) -> Site-to-Site VPN Connections. The error message points to a connection with the ID vpn-0ea809fb052c8c149 which is still defined there.If you can find it you have the possibility to select it and  use different certificates via the menu entry Actions -> Modify Tunnel certificate. The certificate vpn-0ea809fb052c8c149.endpoint-0 indicates that it is the first tunnel in use.Theoretically the certificate can also be assigned on a different service by mistake. Can you try to get the full error message? If you navigate to AWS Certificate Manager -> Certificates and select the certificate in question you will see the Associated Resources section, which will point you to the right direction.If you can't find any VPN connections defined I would recommend to open a support ticket to have the case investigated.CommentShareEXPERTAndreas Seemuelleranswered a year agoIan_0778 a year agoHi Andreas,yes, there isn't any VPN connection defined, as i have deleted it. It is just ACM which is still claiming it is there.It was my mistake, because i deleted it and later i saw that certificates have to be deleted previously which leaded to my current problem.The full error message is: An error occurred (ResourceInUseException) when calling the DeleteCertificate operation: Certificate arn:aws:acm:eu-central-1:411581576539:certificate/7ef2226a-515b-4f90-aca7-72fefddb9a86 in account 41xxxxxxxx39 is in use.The vpn connecetion has been deleted but still shows up in ACM as associated ressource.Thank youShare0Hi Ian,I'm sorry but in this case I can only recommend you to open a support request. The service team will be able to remove this association and you can delete the certificate afterwards.CommentShareEXPERTAndreas Seemuelleranswered a year ago"


Question: Metamask not connecting to Private Ethereum network setup using AWS Ethereum BlockChain Template

"Hi,I have created a private Ethereum block chain using the AWS provided Ethereum Blockchain template in us-east-1. I have followed the following How-Tohttps://docs.aws.amazon.com/blockchain-templates/latest/developerguide/blockchain-templates-ethereum.html#blockchain-ethereum-prereq-vpcThe stack gets up, i can see the stats and explorer urls using the bastion host. But Metamask does not connects to the provided url on port 8545. What could be the reason. although port 8545 responds to telnet, this means its not blocked. I am head over heels to find a solution so that metamask connects and i can see my chain.Chain ID i have given in the stack is 4444FollowComment"

Answer: "0Hello,Thank you for using AWS Blockchain.It's unfortunate to hear that you are encountering difficulty while establishing connection from Metamask. Due to lack of visibility on the implementation used at your end and error occurred at your end, it is difficult to identify what could be missing in the network configuration.I understand that you have followed the VPC Prerequisites,please note if security group rules are not configured as per the requirements that could also block connection to established. I'd recommend you to verify the Security Group Prerequisites because that configuration also falls under the networking configuration and after verifying the security group configuration.If you still continue to encounter the issue, I'd recommend you to reach out to AWS Support for further investigation of the issue along with all the resource details as sharing resource details is not recommended to share on this platform.Open a support case with AWS using the link: https://console.aws.amazon.com/support/home?#/case/createCommentShareSUPPORT ENGINEERKartik_Ranswered a year ago"


Question: Changing domains/Workmail Forwarding

"Hi,I am phasing out an old workmail email and moving to a new Workmail email @ a different domain. I have 2 questions I am having trouble with:How do I create a rule that duplicates any email sent to the old address and sends a copy to the new address? Does this need to be done in workmail or within my MX records?Is there a way for me to copy all the folders/subfolders (including their contents) I have created to my new workmail? Or even better to the Microsoft Outlook Program??Thank you for your help in advance.BrettFollowComment"

Answer: "0Hi Brett,To forward messages from one organization to another you can use mailbox rules. You have two options, a redirect to preserve the original sender or a forward. There is a limitation on the redirect! When the sender has configured SFP WorkMail cannot redirect the message as this will cause the SPF check to fail on the recipient side.For the migration of you folders, if you have Windows Outlook you can export you entire mailbox to a PST file and import that in the new mailbox.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 4 years ago0Hi Robin,How do I export as you described?CommentShareBsj0002answered 4 years ago0Hi Brett,Please look at this Microsoft documentation page for instruction for your Outlook version:https://support.office.com/en-us/article/export-or-backup-email-contacts-and-calendar-to-an-outlook-pst-file-14252b52-3075-4e9b-be4e-ff9ef1068f91This page also contains instructions on how to import the pst again.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 4 years ago"


Question: RDS connections in Lambda

"In server setup, the connections to RDS DB (Aurora) instances has pool where the connections are bit long lived and cached. This will give us faster connectivity. I would like to understand the guidance on this scenario for serverless/lambda. With lambda there is no sessions and no connections are cached. I think it will create connections every time, it might impact the performance. Are there any workaround or solves/guidance for Lambda ?  Is it okay to open the connection every time with the DB instances ?Any leads on this will be super helpful ?FollowComment"

Answer: "3Accepted AnswerLambda functions execute in micro VMs. Lambda reuses the micro VM between invocations. For this reason we recommend you create the connection to the database outside the handler (in the init code) and leave it open. As the micro VMs are completely isolated, you can't use a connection pool as you do in servers. For this reason we created RDS Proxy. RDS proxy maintains a connection pool to the database. Your Lambda functions connects to the proxy instead of the directly to the database.CommentShareEXPERTUrianswered a year agoEXPERTBrettski-AWSreviewed a year ago"


Question: AWS Amplify & Cloudflare DNS Issues

"I have a site up and running on AWS amplify, but I keep running in to DNS issues.I have all the right settings on my DNS provider Cloudflare, but I think the issue is that I can't set an ANAME record. Cloudflare only allows A records or uses flattened CNAME records. As AWS Amplify doesn't have a fixed IP address for my site, I've set up my DNS in Cloudflare with a flattened CNAME record. However, I think this is causing the Domain Activation in AWS Amplify to fail. It runs for a few days, and then fails and then my website is unaccessible with an origin DNS error.I've tried to get my Domain Activation finalised a few times over the last week and it fails every time.Unfortunately I can't move my DNS hosting over to AWS Route 53 as it doesn't accept .ai domain addresses, so I'm not sure how I can solve this issue.Has anyone else come across this problem and found a solution or a work-around?FollowComment"

Answer: "1Thank you - that is helpful. I think the issue was having the records proxied in Cloudflare, so now I've turned that off I'm hoping the domain will be verified.CommentShareSeanBanswered a month ago0Accepted AnswerLooks like Dillon Lara has found a way to make it work.Check out his entry that provides step-by-step instructions on how to set this up:https://dillonlara115.medium.com/how-to-connect-a-subdomain-on-cloudflare-to-aws-amplify-5c79415facaHope this helps!CommentShareCarlos del Castilloanswered a month ago"


Question: Does AWS Glue work with Serverless Aurora DB clusters?

"When I try to add a Connection in AWS Glue, I see our provisioned Aurora DB clusters listed, but not our serverless ones. Is this expected, and is there a way to connect AWS Glue to serverless Aurora DB clusters?FollowComment"

Answer: "1Accepted AnswerYou can connect AWS Glue to your serverless Amazon Aurora DB clusters by using a JDBC connection.For more information, see Connecting to an Amazon Aurora DB cluster in the Amazon Aurora user guide. Also, Use AWS Glue to run ETL jobs against non-native JDBC data sources on the AWS Blog.CommentShareEXPERTSerhatanswered 4 years ago"


Question: About Unlimited testing plan(Device farm) - STARTS AT $250.00 / MONTH

"Hi all,I have planned to run 5000 devices (android/iOs) automate testing at a time. So could I purchase 1 slot of this Unlimited testing plan(Device farm) - STARTS AT $250.00 / MONTH. That means Device Farm will execute my tests on up to five thousand devices at a time. Is it right? Please give me an advice.Regards.FollowComment"

Answer: "0Accepted AnswerHi,The unlimited testing plan corresponds to concurrency.E.g. If you buy 1 slot it will run on 1 device at a time. You can choose more devices in a run but it will only go through the list 1 at a time as you have 1 slot. If you buy 10 slots, you can run on 10 devices at time.So in your case if you want to run on 5000 devices in parallel using the slot model you would have to buy 5000 slots.I would encourage you to first deep dive or share your use case. Do you want to test scale of 5000 devices? If yes, are you testing your front end or backend. Without knowing much, my guess is you are trying to stress test  the backend rather than test your app.I would be happy to suggest a path forward once you share your use case.CommentShareNikhil_Danswered a year agoAWS-User-7834443 a year agoThanks for your explaination.Share"


Question: Pinpoint SMS OTP: Amount of retries

"Hi,I use SMS OTP in my application which works fine. But if a customer gets a SMS and have to input the code within our application I struggle how to detect the amount of retries. (Of course I can do this on client side)So if I set AllowedAttempts = 3 and send 10 times the same wrong code I do not know how many attempts are left nor that the maximal number of attempts are exceeded. This feels like a bug for me.{   "ResponseMetadata":{      "RequestId":"xxxxx",      "HTTPStatusCode":200,      "HTTPHeaders":{         "content-type":"application/json",         "content-length":"15",         "connection":"keep-alive",         "date":"Sat, 23 Jul 2022 15:19:28 GMT",         "x-amzn-requestid":"xxxx",         "access-control-allow-origin":"*",         "x-amz-apigw-id":"VuesDF7pliAFecQ=",         "cache-control":"no-store",         "x-amzn-trace-id":"xxxx",         "x-cache":"Miss from cloudfront",         "via":"xxxxx.cloudfront.net (CloudFront)",         "x-amz-cf-pop":"FRA56-P2",         "x-amz-cf-id":"xxxxx"      },      "RetryAttempts":0   },   "VerificationResponse":{      "Valid":false   }}Why is  "RetryAttempts":0 not changing? It is always 0?The Valid field is changing to true if I send within 3 attempts the correct code otherwise it stays allways false.Any idea what is going on here?FollowComment"


Question: Can I get indian and china states in route53 geo dns ?

"I got it in dns geo dns service from cloudns, can route53 give me same options?FollowComment"

Answer: "0Hello,It is possible to create Geolocation-Routing-Policies with source-locations of China and India.See also: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy-geo.htmlCommentShareHeikoMRanswered 6 months ago0I need states in India and China, not country.Same as USA states (Alabama, Virginia etc)CommentSharerePost-User-8493321answered 6 months ago0Oh, I am sorry :).No, currently only US and Ukrainian states are supported (Same in China-specific-AWS-Account)SincerelyHeikoCommentShareHeikoMRanswered 6 months ago"


Question: Slow Email Delivery

"Hi,We are hosting our application on an instance in Mumbai (Staging) and N. Virginia (Production). We were using the SES service via Ireland for both instances. Our application is built on NodeJS and uses the AWS JS SDK.We noticed the emails are sent in an instant via staging application server while the emails took time via production instance, sometimes as long as 20 minutes. So, we added SES service in N. Virginia region as well.But still, the email delivery is impacted and takes longer to deliver. Since we use the JS SDK, it sends via the endpoint and not via SMTP we believe. Also, the production instance is behind an Application Load Balancer.Edited by: mobcasttech on May 14, 2019 11:55 AMFollowComment"

Answer: "0Hi,An email can get delayed 1) before arriving at SES 2) inside SES 3) after leaving SES. I'm happy to check further details, if you can provide me the message-ID of the email which got delayed so that I can check the time-stamps at my end.Three places where your email could get delayed when sending through SEShttps://aws.amazon.com/blogs/messaging-and-targeting/three-places-where-your-email-could-get-delayed-when-sending-through-ses/Regards,Gaurav @ AWSCommentShareAWS-User-7751712answered 4 years ago"


Question: How to Connect to AWS RDS (MySQL) Instance from My Laptop?

"Created the RDS instance and took the following steps.Edited the security rule, as follows.Made the RDS publicly accessibleHowever, even after these, my laptop (running Ubuntu 22.04) connected to the internet cannot connect to this instance from terminal. The error I get readsERROR 2003 (HY000): Can't connect to MySQL server on 'tensorflow-dump.c1ufsal2345guu.ap-southeast-1.rds.amazonaws.com:3306' (110)So is there any other bottleneck that I should be aware of to enable this connection from my laptop? My separate Amazon EC2 (running Ubuntu) instance can connect to this RDS instance. Does it mean for non-AWS instances, it has to connect via specific static IP or do I have an easier option?FollowComment"

Answer: "0Hi della,I assume you already followed this troubleshooting guide (https://aws.amazon.com/premiumsupport/knowledge-center/rds-connectivity-instance-subnet-vpc/).Apart from above you should:modify inbound rule to your custom IP, not the whole internet at least temporarily for testingcheck if your laptop firewall allows you to talk to 3306 - check this guide: https://aws.amazon.com/premiumsupport/knowledge-center/rds-cannot-connect/You can check logs - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_LogAccess.Procedural.Viewing.htmlConsider having DB on private subnets and use bastion with SSMto access (https://aws.amazon.com/premiumsupport/knowledge-center/rds-connect-ec2-bastion-host/)Let me know if helpedCommentShareEXPERTalatechanswered 4 months ago"


Question: AppStream - Visual FoxPro App

"Hi, I am new to appstream and running into an issue I'm not sure how fix.Installed a VSP app and it runs fine under Admin.  Switch to the other users, both can run it also if I just launch the EXE.  I'm mapping the initialization datafiles to %USERPROFILE% so it picks up which user is logged in and looking to setup home directories with S3.However, when I add to the image builder, it will not launch and says it can't find files under c:\program files\amazon\photon\ ... which is not even the directory I have the app running.  Any pointers?  Thank you.FollowComment"

Answer: "0When you switch user to test the application, you should open image assistant and choose the application from there. That will ensure it can launch from the application catalog once you create a fleet. https://docs.aws.amazon.com/appstream2/latest/developerguide/tutorial-image-builder.html#tutorial-image-builder-test-applicationsIf the fleet is domain joined, make sure you test the image with a user with the same permissions as the end user.If you remove your customizations to %USERPROFILE%, does it work correctly? Would enabling home folders on the stack meet your needs? https://docs.aws.amazon.com/appstream2/latest/developerguide/home-folders.htmlCommentShareJeremy_Sanswered 9 months ago"


Question: AWS billing - no charges associated in my bank

"I received an email from AWS with a billing of $0.11, but I don't see any associated charges on my credit card from my bank.FollowComment"

Answer: "1First, I would suggest to check the status of the charge in your billing console: Billing Dashboard -> Bills. Check the relevent month, which you got the message about. For example, if it's supposed to be a monthly charge, and for example if it's for March 2023, you can find more info under "Payment information", specifically "Payment status". Check if it's "Paid", "Received", or anything else... It may be that the monthly charges up to a particular amount (potentially, below $0.12 or maybe below $0.13???) are automatically waived, and your total monthly charges just happened to fall within that "window". Depending on what you find in the payment information of your billing console, if you still have other questions or concerns, please open a support case from your account and ask our billing support team for more info or advise regarding this, as they are best positioned to help you depending on your specific account/billing settings: https://docs.aws.amazon.com/awssupport/latest/user/case-management.htmlCommentShareEXPERTNataliya_Ganswered 2 months ago"


Question: Transfer Family server with custom identity provider API gateway within same VPC

"Hi All,I have transfer family server hosted in VPC with public/internet access and custom identity provider using API gateway. My question is, can I add custom identity provider api gateway in same VPC as transfer server. I have tried but did not work and read on some two year old post that it is not currently supported in transfer family. am I missing anything here? Please advise.ThanksKiranFollowComment"

Answer: "0Hello Kiran,Can you please provide the exact error message you are getting? Also, can you please describe your use case in more detail? Are you trying to use AWS Transfer service with a Private API Gateway endpoint instead of a Regional API Gateway endpoint?CommentShareAdrianRaduZ-AWSanswered a month ago"


Question: AWS Database Migration Service

A customer of mine is interested in switching from Amazon RDS (MYSQL) to Amazon RDS (Aurora).His concern:The RDS instances that he is currently using are not in a VPC.  When he started using the instances the default was not a VPC.  Will that have any implications on the DB migration tool?It was not 100% clear to me in the documentation.Thank youFollowComment

Answer: "0Accepted AnswerFrom the DMS announcement blog post:The service supports many different migration scenarios and networking options. One of the endpoints must always be in AWS; the other can be on-premises, running on an EC2 instance, or running on an RDS database instance. The source and destination can reside within the same Virtual Private Cloud (VPC) or in two separate VPCs (if you are migrating from one cloud database to another).Since DMS is meant to support a wide variety of networking scenarios including on-premises, an RDS instance on the classic platform is also supported.CommentShareEXPERTAWS-User-0860851answered 7 years agoEXPERTsedat_salmanreviewed 13 days ago"


Question: MongoDB migration to DynamoDB

"Hello,I ask these questions because I couldn't found much information about used case or best answers about migration MongoDB to DynamoDB.Does DynamoDB support ObjectId, which is used as a unique key in existing MongoDB, in a similar form?Is it a good way to store partition keys by dividing them by geographical criteria when designing a global table?If I want to build a DynamoDB table as a global table, is the Global Secondary Index an essential part of the design?Should the sort key be used for all items that are subject to the query conditions among queries that query the collection in the existing MongoDB?It will be so helpful if you guys give some advice of  those questions or commendThank you so muchFollowComment"

Answer: "0The Partition Key is a Hash key used to shard so you have to be careful & creative with its design to ensure it's well-distributed; so certain values & hence partitions don't get overloaded.  Generally you'd want something more fine-grained than geographical criteria but it depends on the use case.  Also note a table's primary key must be unique; it can be either the Partition Key or Partition Key + Sort Key.The attributes in your Sort Key depend on the specific queries you want to run.  Design that plus secondary indexes to support the queries.A Global Secondary Index is called "Global" because, as opposed to a Local Secondary Index, it allows you to retrieve across partitions instead of local to one partition.  It's not related to Global Tables.CommentShareEXPERTskinsmananswered 4 months ago0In addition to what @skinsman already mentioned, you should have a read at https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/best-practices.html where you find detailed information on best practices for defining your tables and indexes in DynamoDB.For an hands-on learning experience, have also a look at https://amazon-dynamodb-labs.workshop.aws/CommentShareEXPERTMassimilianoAWSanswered 4 months ago0Hi,Before answering the qns I want to set the context for DynamoDB. First of all, DynamoDB is a key value store unlike MongoDB, which is a document database. DynamoDB works on a distributed architecture wherein the data is partitioned and spread across multiple partitions using something called Partition Key. Partition key and Sort key play a cornerstone role in designing DynamoDB schema. DynamoDB schema design works on a few tenets - 1) Understanding the use case; 2) Identification of access patterns or query patterns; 3) Iterative approach on data modeling and schema design;Does DynamoDB support ObjectId, which is used as a unique key in existing MongoDB, in a similar form? - DynamoDB has primary key (simple - Partition Key; composite - Partition Key + Sort Key), which can be used to uniquely identify each and every items in the table. But it is not self created like MongoDB, it has to be populated by the application.Is it a good way to store partition keys by dividing them by geographical criteria when designing a global table? - Partition key and Global table does not have correlation. In case of Global table, all records will be there in all the regions that are added as part of Global table.If I want to build a DynamoDB table as a global table, is the Global Secondary Index an essential part of the design? - This is where point no. 2 (identification of access patterns) becomes paramount. Global secondary index (GSI) plays a role in the schema design based on the access patterns. Global tables and GSIs have no correlation vis-a-vis design.Should the sort key be used for all items that are subject to the query conditions among queries that query the collection in the existing MongoDB? - It is better to have sort key for all items, which gives flexibility in data modeling. What should be the sort key and how it would be used would completely depend on the queries and the access patterns that you are trying to solve.CommentSharerePost-User-6950484answered 4 months ago"


Question: Elastic Beanstalk environment stuck updating (auto-scaling to zero doesn't unblock it)

"Good morning,I have an Elastic Beanstalk environment stuck updating. I switched the auto-scaling to zero (desired, min, max) and the instance has been removed. But the status is still "updating".The last operation was to add a listener to the ELB through the EB UI to open port 443. I tried to remove manually the listeners from the ELB but nothing changed.I can't deploy, abort the operation, or clone.What should I do?FollowComment"

Answer: "0Please try these steps to resolve the issue:Restart the environment from the AWS Management Console.If restarting the environment doesn't help, terminate the environment and create a new one with the same configuration.If the issue persists, raise a support ticket with AWS to resolve the issue.CommentShareGabriel Olaleyeanswered 4 months ago"


Question: Messages did not get processed by the lambda when the sqs acts as event source

"I have two lambdas and one sqs fifo queue.First lambda was used to add all the messages to the queue.And when the message meets certain pattern in the sqs queue, the second lambda will be trigged to process all the filtered data in the queue.BUT, if I send multiple messages into the queue, say 4 messages in 3 second, then very likely only 2 messages will get processed by the second lambda, although all the 4 messages meet my filter pattern.Currently I changed the batch size to 1, just in case, but nothing changed.Don't know why it happened, it looks like the lambda is very unstable. Any help will be appreciated.FollowCommentJack-Angel-369 a year agoHi Sorry did not see your answer. Yes in a basic plan you can use only one Lambda... maybe try launching a request ++Share"

Answer: 0Ok so there might be possibility of have two consumers over here like two functions added to the queue to consume the message. when you have multiple consumers added to the SQS then message gets polled from the queue. Now once a message is processed by first lambda function then lambda service will delete the message from the queue which is why the other function is not getting the other message.Suggestion would be to use sqs sns fanout option where you will have two queues for each lambda functions and queues will be added as destination/subscriber to an SNS topic. So you will have to send message to the topic which will get forwarded to both the queues and then to the lambda functions.CommentShareShivamanswered 2 months ago


Question: "Centralized logging - one region, perhaps one account (S3/VPC)"

"Hi, struggling with consolidating logs. I want to enable server access logging in S3 as well as VPC flow logging. Both need to have a logging bucket per region. That is not very scalable. Can't this be consolidated into one bucket? I'd also be fine having it all sent to a centralized log-archive account, if possible, but that probably needs bucket replication and doesn't solve the original issue of so many buckets required. Config logs and cloudtrail logs are nicely consolidated, but server access logs and VPC flow logs are not. A related point is if server access logging must be enabled (security-wise) on the bucket where server access logging takes place, don't you get into an endless loop? :/Thanks!FollowComment"

Answer: "1Here is a AWS Solution that covers this subject, Centralized Logging.CommentShareEXPERTkentradanswered a year agoAWS-User-8416516 a year agoThanks! I did look at that, it's the one solution that always comes up when searching for centralized logging, but tbh it looked way too complicated for what I want, with Kinesis, OpenSeach, Kibana, etc. I don't need all of that. I just want to minimize the amount of buckets for my logging, which seems  extensive when one just enables all logging to be Security Hub compliant.GuardDuty can analyze those logs just fine, or even Cloudwatch, I don't need to do OpenSearch/Kinesis/Kibana overhead, I think :/ but please correct me if I'm wrong!Thanks again, I do appreciate the prompt response!Share"


Question: JDBC and RDS PostgreSQL TLS Encryption connection problem

"We used AWS EC2 instance and RDS PostgreSQL, and we deployed java program on EC2 instance, using jdbc for query. According to the AWS&JDBC documentation, AWS RDS PostgreSQL supports TLS encrypted connection by default, jdbc also uses encrypted connection by default(We did not set the sslmode parameter). But when I capture the packet on EC2, I see the packet in plaintext, why?Command on EC2 Instance:sudo tcpdump -i any port 5432 -w pgtest.pcapI was expecting to see TLS1.3 or TLS1.2, but the packet  content is all PGSQLFollowComment"

Answer: "0Hello thereAccording to the information given,I can fully understand that you want your password to be encrypted.RDS for PostgreSQL uses and expects all clients to connect using SSL/TLS, but you need to require it to use to request connection [1].This means your connection string would still have to specify an SSL certificate like :  $ psql -h db-name.555555555555.ap-southeast-1.rds.amazonaws.com-p 5432 dbname=testDB user=testusersslrootcert=rds-ca-2019-root.pem sslmode=verify-full You can require that connections to your PostgreSQL DB instance use SSL by using the rds.force_ssl parameter.By default, the rds.force_ssl parameter is set to 0 (off). You can set the rds.force_ssl parameter to 1 (on) to require SSL for connections to your DB instance for more information using SSL with a PostgreSQL DB instance.Learn more about How can you stop Amazon RDS for PostgreSQL from logging my passwords in clear-text in the log files.Resource:[1]https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.SSL.html[2]https://aws.amazon.com/premiumsupport/knowledge-center/rds-postgresql-cleartext-logging/CommentShareNosiphiwoanswered a year ago0HiIf requires ssl connection then need to specify in thePG parameter group rds.force_ssl [1] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.SSL.html#PostgreSQL.Concepts.General.SSL.RequiringJDBC connection string to specify ssl mode and other parameters https://jdbc.postgresql.org/documentation/head/connect.htmlThe default mode I think is prefer for PostgreSQL, which mentioned in the PG doc [2] https://www.postgresql.org/docs/current/libpq-ssl.html: "I don't care about encryption, but I wish to pay the overhead of encryption if the server supports it."  It is when certificate exist otherwise will not use.CommentShareSUPPORT ENGINEERKevin_Zanswered a year ago"


Question: SageMaker Model Registry - how to set the Stage column of a Model Package?

"Each version of a model (i.e. versioned Model Package) in a Model Package Group in SageMaker Model Registry has some metadata attached to it. You can see its Status, Short description, Modified by as well as Stage it is currently deployed on.This can be seen in the docs here on the screenshot below the 5. point on that list.My question is - how do we explicitly (or implictly) set the Stage of a given Model Package? I know that changing the approval status can be done by calling update_model_package method. What about the Stage?It magically happens when we use provided MLOps templates, but even after a thorough browsing of every generated file (SM Pipelines, CodePipeline, CodeBuild etc.) I could not find the exact API call. It probably has something to do with the sagemaker:deployment-stage Tag but setting it up on Endpoint, Endpoint Config or Model (the old construct of pre-2020 SageMaker that is still used by SageMaker Inference) did not work. You can't set tags on a Model Package.FollowComment"

Answer: "1You are right that the way to reference the stage is to propagate the tags all the way down to Model, EndpointConfig and Endpoint. When you do that through the MLOps template, CodeBuild and CloudFormation take care of the tagging.You might need to create_model from the model package as well, here's a working example:import boto3client = boto3.client('sagemaker')role = '<my_role_arn>'model_package_arn = '<my_model_package_arn>'my_tags = [    {'Key': 'sagemaker:deployment-stage', 'Value': 'my_stage'},    {'Key': 'sagemaker:project-id', 'Value': 'my_project_id'},    {'Key': 'sagemaker:project-name', 'Value': 'my_project_name'},]client.create_model(    ModelName='testing-stage-model',    PrimaryContainer={        'ModelPackageName': model_package_arn,    },    ExecutionRoleArn=role,    Tags=my_tags)client.create_endpoint_config(    EndpointConfigName='testing-stage-endpoint-config',    ProductionVariants=[        {            'VariantName': 'AllTraffic',            'ModelName': 'testing-stage-model',            'InitialInstanceCount': 1,            'InstanceType': 'ml.t2.medium',        },    ],    Tags=my_tags)client.create_endpoint(    EndpointName='testing-stage-endpoint',    EndpointConfigName='testing-stage-endpoint-config',    Tags=my_tags)CommentShareTulio Albertoanswered 2 years ago"


Question: How can I get permissionsSets assigned to a specific group/user using the Identity center API?

"I'm using Java JDK 2.X version. I have a usecase where I want to retrieve the permissionsets associated with a given group/user using the Identity Centre API. I was referring to the following links and I don't see such an API offered or any relationship mapping in any of the API.I've referred to an API (ListPermissionSetsProvisionedToAccount) that provides all the permission sets that have been provided to a specific AWS account, but for my use case, I want to list permission sets for a specific group/user.Links:IAM Identity Center API Referencehttps://docs.aws.amazon.com/singlesignon/latest/APIReference/welcome.htmlIdentity Store API Referencehttps://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/welcome.htmlMany thanks for reading.FollowComment"


Question: Only one CPU used while parallel processing in Sagemaker

"I am using a Sagemaker instance a 24xlarge to process a DataFrame of about 23 GB. I tried to use Pandarallel's parallel_apply() function on a Pandas DataFrame with 48 workers.However, when I run the top command from the Terminal, I only see one process working with around 100% CPU utilization, but nothing happens. Eventually the favicon turns to the 'Done' icon, which usually means the code is done running, but CPU util stays high and the code cell still has the asterisk next to it.I would expect multiple processes each with high CPU utilization, or one process with close to %9600 utilization. The same thing happens when I try the swifter package and modin which are also supposed to parallelize Pandas functions.What's going on here and how do I fix this problem?FollowComment"

Answer: "0Hello,Thank you for using AWS Sagemaker.Looking at the above query, I understand that you are using a Sagemaker instance to process a Dataframe and using Pandarallel's parallel_apply() function for parallel processing however only one CPU is being used while doing the same.Please note that third-party libraries such as pandarallel and code review is outside the scope of AWS Support [1]. That said, I had a look at the library's GitHub page and found some relevant issues:https://github.com/nalepae/pandarallel/issues/52https://github.com/nalepae/pandarallel/issues/131https://github.com/nalepae/pandarallel/issues/122I recommend you to kindly go though above links and check if upgrading pandarallel version, or workarounds suggested can help in your case.Finally, you could also consider using Spark clusters for dealing with very large data. You can create an EMR-backed Notebook instance following this guide:https://aws.amazon.com/blogs/machine-learning/build-amazon-sagemaker-notebooks-backed-by-spark-in-amazon-emr/To further understand the issue more in depth if it lies at Sagemaker end as I have limited visibility on your setup and code used, I'd recommend you to reach to AWS Premium Support by creating a support case[2] so that the engineer can investigate the root cause of the issue.Reference:—————[1]  https://aws.amazon.com/premiumsupport/faqs/[2] Open a support case with AWS using the link: https://console.aws.amazon.com/support/home?#/case/createCommentSharerePost-User-9561832answered 23 days ago"


Question: panamacredsagent consuming CPU

"Dear, today my workspace showed a panamacredsagent process consuming a lot of CPU, the whole machine is on 100%.Does anybody know what is this and how can I lessen its processing?Thank you!FollowComment"

Answer: "0Dear Customer,This is Qais from AWS support. As I understand, the process PanamaCredsAgent on your Workspace is consuming high CPU and you would like to get a solution for this. Please let me know if this needs any correction.In general, the PanamaCredsAgent is a component of STXHD service and is used when you access the workspace using WebAccess.To test you can set the service to manual and monitor CPU usage:Firstly from the Task manager kill the process consuming high CPU i.e, PanamaCredsAgent.Open services.msc -> check for the service 'STXHD Hosted Application Service’ and click on properties.Change the startup type to ‘Manual’ and stop the service.Please monitor the CPU after this and check if you are still seeing any issues.One of the reasons for this issue is: If the agent is unable to fetch/obtain any of the required information that might be deleted on the workspace or missing from the workspace somehow and hence continuously consuming high CPU. Performing a fresh install of the agent would be a good option as it would be installing the latest version with all the required files and drivers.The agent is actually required if the Webaccess is enabled for the directory, in case you are not using this functionality you can leave the service as disabled.I hope this helps and I have clarified your queries.Regards,QaisCommentShareAWS-User-6602361answered 4 years ago0I experienced the same issue this morning. A simple reboot of the WorkSpace solved it.CommentShareceeteeanswered 4 years ago"


Question: Change from default TFN to new 10DLC

"Hi...we're using Cognito and sending MFA codes to users via SNS.  We started with the default TFN but experienced long delays in deliverability so we applied for a 10DLC.  Now that our 10DLC has been approved we want to start using it.  My question is: how do I switch from using the default TFN to our new 10DLC?  I've looked all around the SNS and Pinpoint consoles but I don't see any options to change the default number.  It appears that in Pinpoint console it allows me to delete the default TFN, if I do that will my 10DLC become the default?   Please help.FollowComment"

Answer: "0I ended up deleting the TFN and now my messages are being sent via the 10DLC number.CommentSharehugobanswered 2 years ago0If you no longer require TFN number and want to use just DLC number to deliver SMS messages, then you can go ahead and remove TFn number using Pinpoint Console. This will make your dlc number default.CommentShareaws-Anirudhanswered 2 years ago"


Question: Adding new driver to pyodbc in Glue Python shell

How can I add an ODBC driver to my Glue Python shell job? I am trying to use the pyodbc library and can see with pyodbc.drivers() the MySQL and PostgresSQL are available however I would like to add a different driver. Note that I specifically asking for Python Shell jobs not Spark Glue jobs.FollowComment

Answer: "0For Python V 3.9 or upwards, please follow https://docs.aws.amazon.com/glue/latest/dg/add-job-python.html#create-python-extra-librarypyodbc is already supported by python shell Glue jobs - so, you should be able to import that library directly.For other libraries (or other version of pyodbc), please provide a whl/egg file or use pip commands.For older versions, download the wheel file from https://pypi.org/project/openpyxl/#files and uploaded it to Amazon S3 and get the S3 URI. if you are creating/editing the Python shell in the console: Job Details , Advanced properties, Additional Python Files. If you are using command lines use these properties:--default-arguments '{"--extra-py-files" : ["s3URI"]}CommentShareAnanth Tirumanuranswered 4 months agorePost-User-5209884 4 months agoI understand that the pyodbc library is supported in Python shell Glue jobs. My question is about adding new ODBC drivers to my Glue job so that I can use them with pyodbcShareAnanth Tirumanur 4 months agoThe drivers for Ms SQL should be available in Python Shell job. Please try the following:Create a glue connection to your database (it's in Glue Console > Connections > Choose JDBC),test the connection make sure it can hit your databaseNow in your job, you must set it to reference/use this connection. (Check Settings).I have connected to MS SQL is my Glue Shell job using pymysql. https://pymssql.readthedocs.io/en/latest/Please let me know if you still face any trouble. If this helps, please upvote/accept answer.ShareGonzalo Herreros 4 months agoTo elaborate on the second option proposed there (install a different version), you can use --additional-python-modules the value is passed directly to pip so you can ask for a specific version, for instance  --additional-python-module with value "pyodbc==4.0.34"Share"


Question: Permission denied running job in AWS Glue

"Hello,I am trying to run my first job in AWS Glue, but I am encountering the following error: "An error occurred while calling o103.pyWriteDynamicFrame. /run-1679066163418-part-r-00000 (Permission denied)".The error message indicates that the permission has been denied. I am using an IAM Role that has AmazonS3FullAccess, AWSGlueServiceRole, and even AdministratorAccess. Although I understand that this is not ideal for security reasons, I added this policy to ensure that the IAM Role is not the issue.I have attempted to use different sources (such as DynamoDB and S3) and targets (such as Redshift and Datacatalog), but I consistently receive the same error. Does anyone know how I can resolve this issue?Thank you in advance!FollowCommentAritro Sen 3 months agoCould you please elaborate more on your use-case ? what is this glue ETL job trying to do ?ShareGonzalo Herreros 2 months agoIs it possible you are trying to write into a bucket in a different account or with a policy that restricts you?ShareVaibhav J 2 months agoAlso, please check if there's a bucket policy on s3 bucket that's blocking access for Glue job.Share"

Answer: "0Accepted AnswerHi TherePlease check the S3 bucket policy.  Even if your IAM role has S3FullAccess, the bucket policy could be preventing the object writes.Also see Why does my AWS Glue job return the 403 Access Denied error? for more troubleshooting steps.CommentShareEXPERTMatt-Banswered 2 months ago"


Question: X-Ray not working like expecting

"The idea is the following:Codecommit has a notification rule.Notification's target it's an sns topic.The topic's target is a lambda function.Minimally I want lambda X-Ray trace when the notification occurs. If all trace better.I post a message from the SNS Topic console, the X-Ray trace is generated with SNS and Lambda.However, if I trigger a notification, the trace is not generated (Lambda runs correctly).I would like to know if I can make the complete or partial trace be generated when generating a notification in CodeCommit.UpdateMy lambda logs insights:Post message from SNS Topic:"_X_AMZN_TRACE_ID": "Root=1-62gd6bfa-6ag9233f49fe8faf6ef7ed16;Parent=4b19513e742ad199;Sampled=1"Codecommit notification:  "_X_AMZN_TRACE_ID": "Root=1-62d56c36-3bg3f6fbaa075b171b9fdba6;Parent=2f5f68ffyf25388e;Sampled=0"My lambda Function has active tracing, and has permissions, but I don't know why the second case don't get sampled. It should be tracing all the invocations, being sampled or not sampled...FollowCommentprashataws a year agoAWS CodeCommit is not yet integrated with X-Ray, so it will not generate or propagate a trace on the SNS notifications it is generating. However, since Lambda is fully integrated you should see a trace with a Lambda node every time it is invoked, either through CodeCommit notification or via the SNS Topic console. Is that not the case?Can you print the value for _X_AMZN_TRACE_ID environment variable in your Lambda function and see if the trace id is being generated properly and is being sampled?Share"


Question: share code commit repositories between aws accounts

"Hi team,I have 3 AWS accounts: DEV, STG and PRODmy code commit repositories are in the DEV account.I don't want to duplicate those repositories on the STG and PROD accounts.So that my repositories in the DEV account be the single point of truth. and I can be able to create a release from the STG or the PROD using the DEV repositories.Is there a best way/architecture to achieve this? without doing a workaround on the build spec (like using keys and doing git pull ... on the build spec of STG and PROD).I followed points 1 and 2 o this tutorial :https://docs.aws.amazon.com/codecommit/latest/userguide/cross-account.htmlafter that, I can see DEV repositories in PROD account  with switch role but I can't create a codeBuild/ code pipeline project ... because the role switched give only permission to DEV repos, but  I want to create the codeBuild in PROD not DEV using the DEV repos (even I give to the role switched more permissions the codeBuild created from PROD was actually created in DEV not in PROD)Just want to create a new code deploy for fargate in PROD that relies on tags / repos generated from DEV account, so when creating the code deploy in PRD account I can select DEV repos/ tags as source.can we use the RAM service to share repos ?appreciate any help.FollowComment"

Answer: "1Hi,Yes this is a possible use case. You can create CodeBuild or CodePipeline in Prod or Stg account, and reference to the Repo in Dev account. To do this, you would need a role created in Dev account which can be assumed by Prod or Stg account. See this blog for your reference.CommentShareSUPPORT ENGINEERZhiyuan_Lanswered a year ago"


Question: 304 for upload when all settings are public

"hello,this is my first time with aws.i am trying to upload image from website to S3.all my settings are public as fare as i understand, yet i getResponse {type: "cors", url: "https://s-cart-x.s3.eu-central-1.amazonaws.com/", redirected: false, status: 403, ok: false, …the settings:Permissions overviewAccessPublicBlock all public accessOffBlock public access to buckets and objects granted through new access control lists (ACLs)OffBlock public access to buckets and objects granted through any access control lists (ACLs)OffBlock public access to buckets and objects granted through new public bucket or access point policiesOffBlock public and cross-account access to buckets and objects through any public bucket or access point policiesOffBucket policy{"Version": "2012-10-17","Id": "Policy1627561847500","Statement": [{"Sid": "Stmt1627561827637","Effect": "Allow","Principal": "","Action": "s3:GetObject","Resource": ["arn:aws:s3:::s-cart-x/","arn:aws:s3:::s-cart-x"]}]}Object ownershipObject writerThe object writer remains the object owner.Cross-origin resource sharing (CORS)[{"AllowedHeaders": [""],"AllowedMethods": ["PUT","POST","GET","DELETE"],"AllowedOrigins": ["http://localhost:3000"],"ExposeHeaders": []},{"AllowedHeaders": [""],"AllowedMethods": ["PUT","POST","GET","DELETE"],"AllowedOrigins": ["https://s-cart-x.herokuapp.com"],"ExposeHeaders": []}]help.FollowComment"

Answer: "0this is what solve the trick... partially(i cant believe amazon dont have a wizard to this.. but: )i have changes the policy{"Version": "2012-10-17","Id": "Policy1627561847500","Statement": [{"Sid": "Stmt1627561827637","Effect": "Allow","Principal": "","Action": ["s3:GetObject","s3:GetObjectAcl","s3:GetBucketLocation","s3:ListBucket","s3:PutObject","s3:PutObjectAcl","s3:DeleteObject"],"Resource": ["arn:aws:s3:::s-cart-x/","arn:aws:s3:::s-cart-x"],"Condition": {"StringLike": {"aws:Referer": ["https://shopping-cart-x.herokuapp.com/","http://localhost:3000/seller/NewProductScreen"]}}}]}the issue now - is that the cors AllowedOrigins have to be AllowedOrigins:"*" ...it fails with localhost:3000... or localhost:3000/myPathCommentSharexoxoxoxoanswered 2 years ago0so this is the cors setting that fix the localhost for me[{"AllowedHeaders": [""],"AllowedMethods": ["PUT","POST","GET","DELETE"],"AllowedOrigins": ["http://localhost:3000"],"ExposeHeaders": ["x-amz-server-side-encryption","x-amz-request-id","x-amz-id-2","Connection","ETag"]},{"AllowedHeaders": [""],"AllowedMethods": ["PUT","POST","GET","DELETE"],"AllowedOrigins": ["https://s-cart-x.herokuapp.com/"],"ExposeHeaders": ["x-amz-server-side-encryption","x-amz-request-id","x-amz-id-2","Connection","ETag"]}]so by now finly s3 is working....it was a nightmer -CommentSharexoxoxoxoanswered 2 years ago"


Question: AWS IoT Fleet Provisioning doesn't publish certificate response

"Good afternoon,I have created a fleet provisioning template but when I publish to "$aws/certificates/create/json" the IoT backend does not publish a response.Region: us-east-2Cloudwatch log output: (trimmed)EVENT:MQTT Client Connect MESSAGE:Connect Status: SUCCESSEVENT:MQTTClient Subscribe TOPICNAME:$aws/certificates/create/json/accepted MESSAGE:Subscribe Status: SUCCESSEVENT:MQTTClient Subscribe TOPICNAME:$aws/certificates/create/json/rejected MESSAGE:Subscribe Status: SUCCESSEVENT:PublishEvent TOPICNAME:$aws/certificates/create/json MESSAGE:PublishIn Status: SUCCESSEVENT: CreateKeysAndCertificate Status: SUCCESS MESSAGE: Successfully created keys and certificate with id xxxI would expect this to be followed by a PublishOut event. I can verify that the certificate is generated and pending activation but my client never gets a response.Please let me know how to solve this issue.FollowComment"

Answer: "0Finally figured it out, you need to set a client ID and have a non-zero client ID length in your connection packet to the broker.If the client ID length is zero the broker should generate a random client ID, which judging by the logs it does correctly (Eg: '$GEN/a5e20039-82c0-4069-a0ff-9a86d8dd2b03') but the backend does not publish a certificate creation responseCommentSharedpeters1answered 2 years ago0I was having the same issue and it was driving me crazy. Thanks for the solution!CommentShareecwillisanswered 2 years ago"