Question: IN chime SDK Broadcast Media to IVS showing  "playback URL undefined"

"We are facing issue while click Broadcast Media to IVS although it is creating a IVS channel but it doesn't show the playback URL.FollowCommentrecursivecodes 3 months agoCould you please provide more details about the issue you are facing? Are you trying to run a particular sample application with the Chime SDK? Are you receiving any errors in the browser console, or the application logs?Shareupon cloud 3 months agowe are using https://github.com/aws/amazon-chime-sdk-js/tree/main/demos/serverless. this demo with --chime-sdk-media-pipelines-region <control region> --chime-sdk-media-pipelines-endpoint <service endpoint>we are facing below error in browser consolehttps://xxx.execute-api.us-east-1.amazonaws.com/Prod/startLiveConnector?title=dddddddd Failed to load resource: the server responded with a status of 502 ()Please adviseSharerecursivecodes 3 months agoWe would need additional information from your logs/console output in order to troubleshoot further. Can you share your complete console output when you start/deploy the demo? Also, any extended log output from the error itself. Did the IVS channel get created properly (you can confirm this in the IVS console)? Looking forward to your reply.Shareupon cloud 3 months agoplease find a detailsbefore broadcast to IVS clickhttps://www.dropbox.com/s/kd8l3uo6halc24l/befor%20broadcast%20to%20IVS%20click.png?dl=0After Broadcast to IVS click https://www.dropbox.com/s/atx9khj1wf7sf5f/after%20broadcast%20to%20IVS%20click.png?dl=0IVS channel is created properlyhttps://www.dropbox.com/s/odhq9211uirueot/IVS%20channel%20created%20like%20this.png?dl=0Sharerecursivecodes 3 months agoThere is a new demo for this functionality that is being worked on that should make this easier. I will post a follow-up here when that is available.ShareShow 1 more comment"

Answer: 0You would get this error if you did not create the needed service-linked role for media pipelines.Guide: https://docs.aws.amazon.com/chime-sdk/latest/dg/create-pipeline-role.htmlAWS CLI: aws iam create-service-linked-role --aws-service-name mediapipelines.chime.amazonaws.com(This is mentioned in the serverless demo deployment guide but it's easy to miss.)CommentShareDougLanswered 3 months agoupon cloud 3 months agoHIwe have already created service-linked role for media pipelines and it creates a IVS channel every time we click "Broadcast to IVS button"  but  shows the "playback URL undefined"ThanksShare0we are using https://github.com/aws/amazon-chime-sdk-js/tree/main/demos/serverless.this demo with --chime-sdk-media-pipelines-region <control region> --chime-sdk-media-pipelines-endpoint <service endpoint>we are facing below error in browser consolehttps://xxx.execute-api.us-east-1.amazonaws.com/Prod/startLiveConnector?title=ddddddddFailed to load resource: the server responded with a status of 502 ()Please adviseCommentShareupon cloudanswered 3 months ago0A repo with a similar purpose has been updated here: https://github.com/aws-samples/amazon-chime-live-eventsPlease take a look at this repo and see if this helps.  It is doing fewer things so hopefully easier to work with.CommentShareschuettcanswered 3 months ago


Question: API HTTP Gateway path rewrite question

"Hi,I have API HTTP Gateway with ALB backends and I'm trying to migrate fromAPI Gateway -> internet-faced ALB  (using HTTP URI integration)toAPI Gateway -> VPC link -> internal ALB.My routes look like "/app1/{proxy+}". and in the first case, I used "https://app1.example.com/{proxy}",  which rewrites "api.example.com/v1/app1/user/add" to "https://app1.example.com/user/add".Now I'd like to do the same rewrite with VPC link integration and I couldn't find a way to do that.Rewriting the path with "$request.path" giving me "/app1/user/add", and "$request.path.proxy+" giving me "/v1/app1/user/add".FollowComment"

Answer: "1Accepted AnswerHello,Thank you for reaching out to us and sharing the detailed use-case.The correct mapping parameter to overwrite the path would be as below :/$request.path.proxyUsing "$request.path.proxy+" will give you "/v1/app1/user/add" as path as it is a catch all greedy path variable. This can be verified using context variable $context.path in access logging.The correct way is using "$request.path.proxy" [1] which will give you the value "user/add" as path for the integration which is partially correct as it will throw 4xx error at the backend due to the missing initial "/".Therefore, using "/$request.path.proxy+" will give you the proper value "/user/add" as path output which is suits your use-case. Please let me know if you still face any issues after implementing my above suggestion.References:[1] https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-http.htmlCommentShareSUPPORT ENGINEERNamratha_Kanswered a year agovitaly_il a year agoMany thanks!BTW, I think there is a typo: 'Therefore, using "/$request.path.proxy+" will give you the proper value "/user/add"' should be 'proxy', not 'proxy+'.Share"


Question: VPC Flow Logs and DX

"Do VPC Flow Logs capture traffic between the VPC and DX? I would assume yes, but wanted to be 100% correct.FollowComment"

Answer: "0Accepted AnswerVPC FlowLogs capture traffic from/to network interfaces in your VPC, so this will include traffic over DX as well.http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/flow-logs.htmlCommentShareAWS-User-8075018answered 7 years ago"


Question: Spamhaus SBL Removal request

"My mail server crashed yesterday (11/6) and had tobe rebuilt. It was built using AWS Lightsail and I was not able tofigure out how to move the Elastic IP from the previous instance tothe new instance. So when it was rebuilt it got a new IP address (44.226.7.217). Thisdomain has been in use for years to send mail and is NOT an openrelay. It uses SMTP authentication and TLS to protect it againstunauthorized use.It appears that the new IP is listed in Spamhaus' SBL and that theonly way to get removed from that is to have AWS request removal. Howdo I do that? I didn't see a form for it.I've already filled out and had the work completed to have rDNS setup (https://aws.amazon.com/forms/ec2-email-limit-rdns-request?catalog=true&isauthcode=true) which says that it works with spamhause, but my ip is still listed in SBL (https://www.spamhaus.org/query/ip/44.226.7.217).FollowComment"

Answer: "0Once the rDNS record was setup and propagated I was able to request removal myself via https://www.spamhaus.org/lookup/.Edited by: teamo on Nov 8, 2019 8:34 AMCommentShareteamoanswered 4 years ago"


Question: Amazon Workspace session timeout on Ubuntu

"Hi, How to set up a session timeout for Amazon Workspace (Ubuntu 22) to automatically log out remote users after a period of inactivity, such as 10 minutes.Thanks,Anoop KFollowComment"

Answer: "1Accepted Answerhi,Amazon WorkSpace has a session timeout of 1 hour for inactive sessions. This means that if you leave your WorkSpace inactive for more than an hour, you will be automatically logged out.To change the session timeout for your WorkSpace on Ubuntu, you can follow these steps:Open the Terminal on your Ubuntu WorkSpace.If you use lightdm service already, then edit the /etc/lightdm/lightdm.conf file using a text editor of your choice.Command: sudo nano /etc/lightdm/lightdm.conf.Add the following line at the end of the file:autologin-user-timeout=x(x = number of seconds that you want the user to be logged out)This will enable the logout and the user will be logged out due to inactivity after the time mentioned above.Save the file and exit the text editor.Restart the LightDM service by running the command sudo systemctl restart lightdm.CommentShareArunanswered 3 months ago"


Question: Macie Job Runs Forever

"Hello,I tried running Macie job on a bucket with just a few small files. The job is running for more than 10 hours and it does not look like it is going to end. There are no errors anywhere (including in cloudtrail). Any idea of what could be the issue?FollowComment"

Answer: "0Hi @yossico - some things to look into:Have any findings been generated?Have classification results been generated (exported to the S3 bucket that the product strongly recommends you set up)?Has the job completed running now, 2 days later?What were the formats of the files being scanned?CommentShareChris Simmonsanswered 9 months agoyossico 9 months agoHi Chris, thank you for your answer.We shutdown the account on Friday. It was used for a course. The job was running for almost a day when we did that and did not end.We haven't checked the two first items you listed.It was a four lines txt file.We also haven't check cloudwatch logs, which I macie use to look for errors.we ran the same in a different region and everything worked smooth (aws health dashboard did not show any issue with the service).Thanks,YossiShare"


Question: What do I need to allow for my Security group to receive inbound traffic from SQS in lambda?

"I have a Lambda inside a VPC with a static IP.I have not implemented this before and I'm wondering when implementing my security group what ports or/and protocols do I need to allow for my Lambda to receive inbound traffic from SQS? I have already implemented the SQS in Lambda in CDK, such as events, and so forth so that when I recieve an event it triggers a lambda function.However, I'm not certain if I need to allow anything in my security group in order to receive traffic from SQS.FollowComment"

Answer: "0Lambda functions do not accept inbound connections. When you configure a VPC and security group for a Lambda function, this is for the purposes of allowing the Lambda function to execute within your VPC, allowing the function to access other services within the same VPC (e.g. RDS or Aurora instances, EC2 instances, load balancers, etc).Lambda functions access SQS using the SQS API. You only need to ensure that the security group provides (at a minimum) outbound access on port 443 so that it can connect to SQS.CommentShareEXPERTbwhaleyanswered 8 months agorePost-User-7977828 8 months agoIs there a way to find the SQS service IP address?  Or any way to limit the SG to confirm that it only can send outbond access to port 443 on SQS?Thay way I do not have to allow the access to 0.0.0.0/0?Share0Please take a look at my answer to a similar question recently - https://repost.aws/questions/QUA-ke4GYcQx6-YNvmHxsfUA/can-lambdas-inside-a-private-subnet-still-receive-data-from-sqs#ANzEFlBd5wQ02DlAOAuszeoACommentShareEXPERTIndranil Banerjee AWSanswered 8 months ago"


Question: I get a 'forbidden error' when attempting to upload images.

"These policies are enough for me to upload and download among other things...but only through the aws.amazon.com site.I cannot upload images to the bucket from my app. All help will be greatly appreciated...This is the user policy.{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": "s3:ListBucket",            "Resource": "arn:aws:s3:::bucket-name",            "Condition": {                "StringLike": {                    "s3:prefix": "bucket-name/*"                }            }        },        {            "Sid": "VisualEditor1",            "Effect": "Allow",            "Action": [                "s3:PutObject",                "s3:GetObject"            ],            "Resource": [                "arn:aws:s3:::bucket-name/*"            ]        }    ]}This is the Group policy.{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "AllowGroupToSeeBucketListAndAlsoAllowGetBucketLocationRequiredForListBucket",            "Action": [                "s3:ListAllMyBuckets",                "s3:GetBucketLocation"            ],            "Effect": "Allow",            "Resource": [                "arn:aws:s3:::*"            ]        },        {            "Sid": "AllowRootLevelListingOfCompanyBucket",            "Action": [                "s3:ListBucket"            ],            "Effect": "Allow",            "Resource": [                "arn:aws:s3:::bucket-name"            ],            "Condition": {                "StringEquals": {                    "s3:prefix": [                        ""                    ],                    "s3:delimiter": [                        "/"                    ]                }            }        }    ]}FollowComment"

Answer: "0Figured out the issue, I will mark it as answered.CommentShareGuestProfile0000answered 3 years ago0Figured it out, overlooked access allowances.CommentShareGuestProfile0000answered 3 years ago"


Question: Pinpoint push notification count vs delivery status

"I'm using pinpoint sendMessage API to send push notifications, as per pinpoint documentation first 1M notifications are free and then each 1M notifications costs 1 USD.sometimes when send notifications i got different status :SUCCESSFUL | THROTTLED | TEMPORARY_FAILURE | PERMANENT_FAILURE | UNKNOWN_FAILURE | OPT_OUT | DUPLICATEmy question is : is pinpoint count all notifications (requests) regardless its delivery status , or some of status are counted ?FollowComment"

Answer: "0All attempts are charged. Therefore DUPLICATE, and OPT_OUT are not charged for.CommentShareAnaAtAWSanswered 3 months ago"


Question: How divide Log Group by each Lambda function alias?

"Hello, guys.Thank you for your help in advance.I have a question, how divide Log Group by each Lambda function alias?For example, there is the following Lambda function and aliases.Lambda functiontestFunctionKokiLambda function aliasesdevtestproI would like to create Log Group by each alias using boto3 or AWS CLI when creating Lambda function alias, and to relate each Log Group and each alias.Such as this.When creating dev alias, creating Log Group that is '/aws/lambda/testFunctionKoki:dev'.When testFunctionKoki that alias is dev has executed, outputting any logs to '/aws/lambda/testFunctionKoki:dev'.How can I do this?I am looking for any answers.Thank you.Edited by: koki-n on Jun 14, 2020 6:46 PMFollowComment"

Answer: "0Hello,Lambda does not provide a way to specify a custom log group target. A log group is automatically created on the first invocation of a Lambda and the log group name will contain the name of the Lambda function.When log streams are created however, the function version is prefixed onto the name of the log stream. You can use a log stream filter to view log streams for a specific version.If you want to know which alias invoked a particular version of a Lambda, the alias ARN is included in the Lambda context object as:context.invoked_function_arnYou can use the print method to write the ARN into the log event.Best,KevinCommentShareKevin-AWSanswered 3 years ago"


Question: FlexMatch for team battle royale ruleset

"Hello,We have a Battle Royale game supporting 10 teams of 3 players each for a total of 30 players per match.We want to be able to start matches with less than 10 teams if they have been waiting for a long time.For example, if there are 8 teams who have been matchmaking for 5 minutes, we want to be able to start the game with those 8 teams if 10 minutes have passed and no other team has joined.We have looked into Expansions, but we can't reduce the "Quantity" of teams. This forces us to only start matches with at least 10 teams.This is our current rule set:{    "name": "trios_battle_royale",    "ruleLanguageVersion": "1.0",    "playerAttributes": [{        "name": "skill",        "type": "number",        "default": 10    }],    "teams": [{        "name": "t1",        "minPlayers": 3,        "maxPlayers": 3,        "quantity": 10    }]}How do we start matches with less than 10 teams?FollowComment"

Answer: "0manually create all 10 teams{    "name": "trios_battle_royale",    "ruleLanguageVersion": "1.0",    "playerAttributes": [{        "name": "skill",        "type": "number",        "default": 10    }],    "teams": [{        "name": "t1_0",        "minPlayers": 3,        "maxPlayers": 3,    },    {        "name": "t1_1",        "minPlayers": 3,        "maxPlayers": 3,    },    {        "name": "t1_2",        "minPlayers": 3,        "maxPlayers": 3,    },    {        "name": "t1_3",        "minPlayers": 3,        "maxPlayers": 3,    },    {        "name": "t1_4",        "minPlayers": 3,        "maxPlayers": 3,    },    {        "name": "t1_5",        "minPlayers": 3,        "maxPlayers": 3,    },    {        "name": "t1_6",        "minPlayers": 3,        "maxPlayers": 3,    },    {        "name": "t1_7",        "minPlayers": 3,        "maxPlayers": 3,    },    {        "name": "t1_8",        "minPlayers": 3,        "maxPlayers": 3,    },    {        "name": "t1_9",        "minPlayers": 3,        "maxPlayers": 3,    }]},  "expansions": [      {          "target": "teams[team_9].minPlayers",          "steps": [              {                  "waitTimeSeconds": 300,                  "value": 0              }          ]      },      {          "target": "teams[team_8].minPlayers",          "steps": [              {                  "waitTimeSeconds": 600,                  "value": 0              }          ]      },  ]}CommentShareKirkulesanswered 10 months ago"


Question: Error Loading Security Group Prefix List

"Hi, can anyone help me with this error?  I tried to edit security group and edit on IP. On the bottom  of the list, it said Error Loading Security Group Prefix List. What caused that error? And how I can solve it?error screenshot : Click HereFollowComment"

Answer: 0Is your IAM policy locked down so it doesn't allow necessary PrefixList actions as described here? - https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.htmlCommentShareEXPERTskinsmananswered a year agoYoga a year agoI don't think I'm locking any IAM Policy. Because this happen on 2 users with Administration Role. So how I can check if my IAM Policy is locked down or not?Share


Question: Custom domains with SSL

"Customer wants to provide custom domains for our customers with ssl.Right now, they are able to provide this by creating a one off Cloudfront distribution, which is not great.Now, looks like the the ALB supports multiple SSL certs, but is limited to 25.Is there a way to increase this limit ? ORWould you recommend another solution all together ?Extra context per request:customer creates pages like this for customers:https://shows.example.com/somecustomerbut want to allow them to have custom domains like this:http://somecustomer.example.orgUsers presently do this by setting a CNAME record on their DNS pointing to our distribution domains.example.comHowever, as you can see, the custom domain version is not secure—it does not have a SSL/TLS certificate. We would like to provide these certificates for our customers.One way we considered doing this was using an Application Load Balancer. As we understand it, this would allow our users to point at the domains.example.com distribution, but it could support multiple certificates for that one domain/distribution.This looks very promising to them—do you agree? If so, one concern is the supposed limit of 25 certs per load balancer, and so they wanted to know whether this limit could be lifted, and if there is a better alternativeFollowComment"

Answer: "0Accepted AnswerYour customer wants to have a single CloudFront Distribution with multiple domains/subdomains and be able to serve that content using HTTPS, correct? Would all the content be served from a static set of origins or does the origin change based on the domain name?This configuration is possible, your customer can configure the CloudFront distribution with multiple CNAMEs and use AWS Certificate Manager to generate a public certificate with multiple domain names(SAN).From the example that you've shared, your customer would still have to use Lambda@Edge to change uri of the request, depending on the host header, as it seems that according to the host, the uri can change.Thanks.CommentShareManuel Pataanswered 3 years ago"


Question: Trying to create an DB and it is throwing this error

"Cannot create RDS instanceaws rds create-db-instance --db-instance-identifier odm_instance --engine postgres --db-instance-class db.t3.large --allocated-storage 250 --master-username odmAdmin --master-user-password password --db-name rds_odmAn error occurred (InvalidSubnet) when calling the CreateDBInstance operation: No default subnet detected in VPC. Please contact AWS Support to recreate default Subnets.Running , I can see it is running...:kubectl cluster-infoKubernetes control plane is running at https://623AF17A6BE5700DF747F621E40290BA.gr7.us-east-1.eks.amazonaws.comCoreDNS is running at https://623AF17A6BE5700DF747F621E40290BA.gr7.us-east-1.eks.amazonaws.com/api/v1/namespaces/kube-system/services/kube-dns:dns/proxyFollowComment"

Answer: "0Hi,could you try adding the -vpc-security-group-ids setting? It should help to associate the RDS with the VPC where the datasource should be created.(https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/create-db-instance.html)Hope it helps ;)CommentShareEXPERTalatechanswered 20 days ago0As per the error message, you can recreate your default subnets by following these instructions.CommentShareEXPERTBrettski-AWSanswered 20 days ago"


Question: Lmbda  in CDK v2  project  typescript giving error ->Runtime.ImportModuleError

"The error goes like that :{"errorType":"Runtime.ImportModuleError","errorMessage":"Error: Cannot find module 'hellolambdafnfirst'\nRequire stack:\n- /var/runtime/index.mjs","trace":["Runtime.ImportModuleError: Error: Cannot find module 'hellolambdafnfirst'","Require stack:","- /var/runtime/index.mjs","    at _loadUserApp (file:///var/runtime/index.mjs:726:17)","    at async Object.module.exports.load (file:///var/runtime/index.mjs:741:21)","    at async file:///var/runtime/index.mjs:781:15","    at async file:///var/runtime/index.mjs:4:1"]}Stack goes like that : very basic stack const lmbdafromcode = new lambda.Function(this, 'lmbdafromcodeName', {            runtime: lambda.Runtime.NODEJS_16_X,            handler: 'hellolambdafnfirst.handler',//filenameoflmnda (.) then handlername..export.handlername            **code: lambda.Code.fromAsset(path.join(__dirname, '/../lmdaFun')),**            memorySize: 1024,        });project starucure is simple like thatbinlib|-------------------HelloCdkStack.tslmdaFun|-------------------hellolambdafnfirst.tsnode_modulesFollowComment"

Answer: 0I like to use entry : as seen hereCommentSharejthornes-awsanswered 10 months ago


Question: How can I migrate MySQL DB from on-premise to Aurora MySQL Compatible Serverless

"Hi guys!I am working on a project that requires migrate MySQL DB in physical server to Aurora MySQL Serverless.I try to search but I can't find any documents.If you know, please help me!FollowComment"

Answer: 0I'd look at using the AWS Database Migration Service.What is the AWS DMS?Tutorial for the AWS DMShttps://docs.aws.amazon.com/dms/latest/userguide/CHAP_GettingStarted.htmlAnother approach is to use a 2 steps to migrate from MySQL to Aurora Serverless.Step 1 - Is migrate to Aurora provisioned through a read replica https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Migrating.RDSMySQL.Replica.htmlStep 2 - Is migrate from Aurora provisioned to Aurora Serverless from a snapshot https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.restorefromsnapshot.htmlCommentSharetedtrentanswered 5 months ago


Question: "Error when creating external table in Athena:  "mismatched input 'EXTERNAL'. Expecting: 'MATERIALIZED', 'OR', 'ROLE', 'SCHEMA', 'TABLE', 'VIEW'""

"Hello, I’m new to Athena so I’m not sure if this is the appropriate place to post this.I’m trying to import Azure data into Athena, so that it can be ingested downstream by AWS Quicksight.  I’ve downloaded a usage details .csv file from Azure, placed it in S3, and am trying to create an external table in Athena, based on this .csv file.Here’s the error I receive when trying to create an external table based on .csv file (when clicking on the explain button within Athena):line 1:48: mismatched input 'EXTERNAL'. Expecting: 'MATERIALIZED', 'OR', 'ROLE', 'SCHEMA', 'TABLE', 'VIEW'This query ran against the "<masking my database name>" database, unless qualified by the query.I’ve tried executing this both through a manually written SQL statement and through the “Create table from S3 bucket data” feature. Both leading to the above error.  I even tried converting all data types to string (thinking it could be some kind of data type mismatch), but to no avail.I’d greatly appreciate any help in troubleshooting this, as the error message feels vague.My create table statement (I masked the DB name and S3 location for confidentiality reasons):CREATE EXTERNAL TABLE IF NOT EXISTS <masked for reasons of confidentiality>.azure_usage_apr_2023 (BillingAccountId string,BillingAccountName string,BillingPeriodStartDate date,BillingPeriodEndDate date,BillingProfileId string,BillingProfileName string,AccountOwnerId string,AccountName string,SubscriptionId string,SubscriptionName string,Date date,Product string,PartNumber string,MeterId string,ServiceFamily string,MeterCategory string,MeterSubCategory string,MeterRegion string,MeterName string,Quantity double,EffectivePrice double,Cost double,UnitPrice double,BillingCurrency string,ResourceLocation string,AvailabilityZone string,ConsumedService string,ResourceId string,ResourceName string,ServiceInfo1 string,ServiceInfo2 string,AdditionalInfo string,Tags string,InvoiceSectionId date,InvoiceSection string,CostCenter string,UnitOfMeasure string,ResourceGroup string,ReservationId string,ReservationName string,ProductOrderId string,ProductOrderName string,OfferId string,IsAzureCreditEligible string,Term string,PublisherName string,PlanName string,ChargeType string,Frequency string,PublisherType string,PayGPrice double,PricingModel string,CostAllocationRuleName string,benefitId string,benefitName string)ROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe'WITH SERDEPROPERTIES ('field.delim' = ',')STORED AS INPUTFORMAT 'org.apache.hadoop.mapred.TextInputFormat' OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'LOCATION '<S3 location is masked for reasons of confidentiality>'TBLPROPERTIES ('classification' = 'csv','skip.header.line.count' = '1');Column headers of .csv file (I’m not posting data for reasons of confidentiality – it’s a standard Azure usage details format):BillingAccountId,BillingAccountName,BillingPeriodStartDate,BillingPeriodEndDate,BillingProfileId,BillingProfileName,AccountOwnerId,AccountName,SubscriptionId,SubscriptionName,Date,Product,PartNumber,MeterId,ServiceFamily,MeterCategory,MeterSubCategory,MeterRegion,MeterName,Quantity,EffectivePrice,Cost,UnitPrice,BillingCurrency,ResourceLocation,AvailabilityZone,ConsumedService,ResourceId,ResourceName,ServiceInfo1,ServiceInfo2,AdditionalInfo,Tags,InvoiceSectionId,InvoiceSection,CostCenter,UnitOfMeasure,ResourceGroup,ReservationId,ReservationName,ProductOrderId,ProductOrderName,OfferId,IsAzureCreditEligible,Term,PublisherName,PlanName,ChargeType,Frequency,PublisherType,PayGPrice,PricingModel,CostAllocationRuleName,benefitId,benefitNameFollowComment"


Question: Specific Cloudwatch log groups not responding to queries

"I want to use Cloudwatch Insights to query some log groups for logged (botocore) data from some functions. For two of these functions, no data is returned when querying for resulting logs, no matter how simple the query. However, they have log groups and a log stream with log messages in them that I can see when manually going to look into the log groups. How can this be?FollowComment"


Question: Maintaining Separate Database Connection Sources with Aurora Multi-Master

"Customer with the following question regarding Aurora multi-primary.Will an application still have to maintain separate database connection sources, like with the Aurora read replicas? My hope is that the multi-primary would provide just one endpoint, making it seamless to the application.FollowComment"

Answer: "0Accepted AnswerProviding a single "seamless" endpoint to applications is an anti-pattern that will not be supported with Aurora Multi-Master.Aurora Multi-Master is optimized for workloads where multiple writers can handle non-conflicting workloads - writes on either physically or logically separated data from multiple nodes so they don't produce conflicts, or minimize the risk thereof. This requires application awareness of the cluster topology and individual nodes, so the app can direct traffic to the various writers based on a workload specific non-conflicting segmentation of the data.Aurora Multi-Master is not recommended for customers that desire a drop in replacement for a single master that would give them "seamless" multi-node write scaling by load balancing behind a single endpoint. This is a use case that is expected to have significantly high rates of conflicts, which will detrimentally impact performance.CommentShareEXPERTvladvatawsanswered 4 years ago"


Question: How can I get Tags to be configured on the AWS Batch job started by the Eventbridge?

"Following a tutorial example it is possible to configure an eventbridge rule to trigger an AWS Batch job.It is even possible to set other container override configurations like Environment as a list of Name, Value objects in the request json. After using uppercase to start these attribute names, you can see them in Cloudtrail in the SubmitJob request as lowercase values that match the job definition.The issue I have is that we have is that the jobs started by eventbridge do not contain any tags. How can I get Tags to be configured on the AWS Batch job started by the Eventbridge?Random facts:The submission role has batch:TagResource permissionUsing Tags or tags as an attribute in the transformer next to ContainerOverrides does not workBoth tags have been tried with [{"Name": "tag_name", "Value": "tag value"}] and {"tag_name":"tag value"} valuesIn the Cloudtrail I can see the SubmitJob coming from events.amazon.com and the request parameters include jobName, containerOverrides, jobQueue and jobDefinitionThe Batch Job Definition does have tags configuredFollowComment"

Answer: "1Accepted AnswerHello,Below are the set of parameters that can be passed while submitting a Batch job using AWS EventBridge. Please refer this document for more info.ArrayPropertiesJobDefinitionJobNameRetryStrategyAs you can see, it doesn't have a parameter for specifying tag information.As per the AWS Batch tagging resources documentation, the AWS Batch jobs do not support tag propagation. This means that tags do not propagate from Batch Job definition to the Batch job. They can currently be added through AWS API/CLI/SDK only.If you prefer, you can have the EventBridge trigger a lambda function that can use AWS API/SDK to submit the Batch job by passing the tag information.I hope this helps!CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered 3 months ago"


Question: UserLambdaValidationException : Trying to integrate Passwordless Authentication using AWS Cognito and Amplify library in Android App

I'm getting "userLambdaValidationException" error while calling the sign in method.Error:com.amazonaws.services.cognitoidentityprovider.model.UserLambdaValidationException: DefineAuthChallenge failed with error User does not exist.FollowComment

Answer: "0Based on the error it sounds like there is not a User within Cognito to be referenced or verified rather via the customer challenge. The user needs to register prior to passing a challenge in order to be authenticated. The following exert and additional information can be found in this AWS Blog: https://aws.amazon.com/blogs/security/how-to-implement-password-less-authentication-with-amazon-cognito-and-webauthn/"Amazon Cognito user pools allow you to build a custom authentication flow that uses AWS Lambda functions to authenticates users based on one or more challenge/response cycles. You can use this flow to implement password-less authentication that is based on custom challenges. To use this flow to implement FIDO authentication, you need to create credentials during the registration phase and reference these credentials in the user’s profile. You can then validate these credentials during the authentication phase in a custom challenge."CommentShareJMWareanswered 9 months ago"


Question: Cannot login to a newly created SFTP server and cannot see server logs

"I have created a SFTP server, gave it a logging role and created a user. As a result can neither log into the server with my private key neither see any log messages.Following are the exact steps:Created the xxxxxxxxxx-dev-import S3 bucket and created a test-user folder in it.Created a DevImportSFTPReadWriteAccess RW access policy to access the target bucket.Created a DevImportSFTPRole role and attached the aforementioned ImportSFTPReadWriteAccess policy to it.Created a role called AWSTransferLoggingRole and attached the AWS-managed AWSTransferLoggingAccess policy to it. Checked the trust relationship - transfer.amazonaws.com is trusted.Created a public SFTP server with service managed identity provider and assigned the aforementioned AWSTransferLoggingRole as the logging role. Waited until the server started.NOTE After server was started the logs were not visible in CloudWatch.After the server was started created a test-user user with the public key, assigned the xxxxxxxxxx-dev-import as the bucket and test-user as home folder.Following is the result I'm ending up with:mymacbook:.ssh UXXXXXX$ telnet s-xxxxxxxxxxxxxxxx.server.transfer.eu-central-1.amazonaws.com 22Trying XXX.XXX.XXX.XXX...Connected to s-xxxxxxxxxxxxxxxx.server.transfer.eu-central-1.amazonaws.com.Escape character is '^]'.SSH-2.0-AWS_SFTP_1.0^CConnection closed by foreign host.mymacbook:.ssh UXXXXXX$ ssh -i ~/.ssh/id_rsa_test_user test-user@s-xxxxxxxxxxxxxxxx.server.transfer.eu-central-1.amazonaws.comThe authenticity of host 's-xxxxxxxxxxxxxxxx.server.transfer.eu-central-1.amazonaws.com (XXX.XXX.XXX.XXX)' can't be established.RSA key fingerprint is SHA256:u0HCsILNN4vTm367Wgyeh2ToHLbuZayQzbzt9GbF+v8.Are you sure you want to continue connecting (yes/no)? yesWarning: Permanently added 's-xxxxxxxxxxxxxxxx.server.transfer.eu-central-1.amazonaws.com,XXX.XXX.XXX.XXX' (RSA) to the list of known hosts.Enter passphrase for key '/Users/UXXXXXX/.ssh/id_rsa_test_user': Connection to s-xxxxxxxxxxxxxxxx.server.transfer.eu-central-1.amazonaws.com closed by remote host.Connection to s-xxxxxxxxxxxxxxxx.server.transfer.eu-central-1.amazonaws.com closed.mymacbook:.ssh UXXXXXX$ And again - no logs in CloudWatch.FollowComment"

Answer: 0Accepted AnswerCan you please try the command (instead of ssh):sftp -i ~/.ssh/id_rsa_test_user test-user@s-xxxxxxxxxxxxxxxx.server.transfer.eu-central-1.amazonaws.comCommentShareAWS-User-9826533answered 4 years ago


Question: S3 API Response Error while Applying Bucket Policy

"I have created one Bucket and enabled versioning and Static Website Hosting but to host a static website I will have to  make all the objects public So i applied the below mentioned Policy but while saving changes I am getting error "An Unexpected Error occured" stating thatAction does not apply to any resource(s) in the statement ?Kidnly Help !!!!!{"Id": "Policy1661754296310","Version": "2012-10-17","Statement": [{"Sid": "Stmt1661754292357","Action": ["s3:GetObject","s3:ListBucket"],"Effect": "Allow","Resource": "arn:aws:s3:::akshay-demo-new-2022/","Principal": ""}]}FollowComment"

Answer: "1Accepted AnswerTry this one:{  "Id": "Policy1661758235544",  "Version": "2012-10-17",  "Statement": [    {      "Sid": "Stmt1661758233197",      "Action": [        "s3:GetObject"      ],      "Effect": "Allow",      "Resource": "arn:aws:s3:::akshay-demo-new-2022/*",      "Principal": "*"    }  ]}Added "*" in ARN and Principal.CommentShareEXPERTkentradanswered 9 months agoEXPERTToni_Sreviewed 9 months ago0That Worked !!Thanks @kentrad for your valuable help.CommentShareAkshay Govalkaranswered 9 months ago"


Question: Batch import findings  - max number of AwsSecurityFinding objects

"I noticed BatchImportFindings returns an error if i try to send more than 100 objects.I am trying to find a reference to that value in the AWS SDK and can't find any, is it missing?If not, can anyone point me to documentation about that value?Thank you.FollowComment"

Answer: "0Accepted AnswerHello,Thank you for your question. The maximum number of findings you can send using the BatchImportFindings API is 100 findings.I hope this answers your question.ThanksCommentShareAWS-User-7604352answered 4 years ago0I know the limit is 100, what i am looking for is some kind of documentation for that value, can you point me to that?Also, what are the other limits for the fields? I also encountered an error for a description larger than 1kb, is that documented somewhere?Edited by: mvaitl on Oct 3, 2019 12:33 AMCommentSharemvaitlanswered 4 years ago0The BatchImportFindings documentation doesn't describe the 100 findings limit, thanks for bring this to our attention, we will be updating the documentation.The maximum characters length for the description field is 1,024, where each character is 8bits (1 byte), 1024 characters is equivalent to 1kb that is allowed in the filed.CommentShareAWS-User-7604352answered 4 years ago"


Question: MaxInstanceLifetime value for ECS Fargate

"My team uses AWS ECS Fargate.  We would like to perform a routine recycle for our ECS tasks.  I found the MaxInstanceLifetime value parameter but it seems mostly for EC2 instances.  Is it possible to set this parameter for ECS Fargate?  If so, where in the console can I find this?  If not, are there any suggestions on how we can go about recycling our ECS Fargate tasks?Docs:https://docs.aws.amazon.com/autoscaling/ec2/userguide/asg-max-instance-lifetime.htmlhttps://aws.amazon.com/about-aws/whats-new/2019/11/amazon-ec2-auto-scaling-supports-max-instance-lifetime/FollowComment"

Answer: "1Accepted AnswerOne option is to use update service API call, and --force-new-deployment  flag.MaxInstanceLifetime does not apply for Fragate.CommentShareJason_Sanswered a year ago0Create a sidecar container with sleep XXX and mark it as essentialCommentShareIuri Dinizanswered 8 months ago"


Question: How do I reset Amazon Sagemaker Studio Lab & wipe all data? ([Errno 28] No space left on device: '). All kernels fail & auto-restart fails.

"Sagemaker Studio Lab has stopped working. First, all kernels fail with unknown error and can't restart. OR get stuck in a loop restarting themselves. I am unable to make a new kernel. Second, this error keeps popping up: "Unexpected error while saving file: aws/notebooks/MLA-TAB-DAY3-AUTOML.ipynb [Errno 28] No space left on device: '"And when checking resources it shows that 100% of storage is used at /hom/studio-lab-user but I am unable to delete any of the files in that directory or the directory itself./dev/nvme0n1p1   50G   17G   34G  33% /opt/.sagemakerinternal/dev/nvme1n1     25G   25G   36K 100% /home/studio-lab-userHow can I just reset the entire Sagemaker Studio Lab profile to default, erase all data that's clogging up storage/memory, and start fresh?FollowComment"

Answer: "1Hello,If you get a notification that your disk space is full while you're attempting to create or import a file, you can delete files to increase space.To remove all of your files and reset your project, run the following command from the terminal.rm -rf .The following command deletes a conda environment from your project.conda remove --name <ENVIRONMENT_NAME> --allCommentShareAleksandr_Panswered a year ago0The command below removes all the files from the SageMaker studio lab instance as stated by Aleksandr_Prm -rf /home/studio-lab-user/However, this command is not suitable as it deletes some system packages such as the clear command:(studiolab) studio-lab-user@default:~/sagemaker-studiolab-notebooks$ clearbash: /home/studio-lab-user/.conda/envs/studiolab/bin/clear: No such file or directory(studiolab) studio-lab-user@default:~/sagemaker-studiolab-notebooks$ The clear command cannot be identified.CommentShareAlvin Kimataanswered 4 months agoAlvin Kimata 4 months agoOne can restart the instance in order to restore the lost packages.Share"


Question: Using Lambda Interface Endpoint

"If I were to have a VPC with 2 private subnets where my web servers are hosted, and I want to invoke a lambda function, using a lambda interface endpoint, where should the lambda function itself be created at? I have a security group that allows inbound traffic from private web servers, and should this security group be attached to the endpoint or the lambda itself?  (as in is the connection to the private subnets under the function VPC section is required or not)I had tried attaching the SG to both endpoints and also the function (that is I connected the function to the private subnets in order to attach the SG), but the web servers still gave me 504 gateway time-out, with no logs of the function being run, so I assumed it is the lambda. I also do not see a route created from the endpoints in the private subnets, so I created them manually, not knowing if that matters or not (I removed it after realizing it is supposed to not have a route.).I tested the application hosted on a public subnet, and it should work just fine. There is also no log of invocation of the lambda when it should have, which I assume caused the timeout.any help on this will be appreciated. :))Im a beginner to AWS btwFollowComment"

Answer: "1How are you invoking the Lambda function from your web server?  VPC endpoints are for accessing a service over a private connection from your VPC.  For AWS services like Lambda, that means its for accessing the service API.  If you're calling your function directly via a Lambda API call then that can use the VPC endpoint but if you're using an HTTPS (not API REST) endpoint like a Function URL for example it can't.Calling the function directly via the Lambda API over a VPC Endpoint would work fine whether it's a VPC function or not.  The function's Security Group has no impact on this whatsoever - its ingress rules aren't used because a function doesn't actually listen on any port, it gets invoked by the Lambda service with event data passed to it.Regarding security groups on VPC endpoints, see https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html which says "The security group for the interface endpoint must allow communication between the endpoint network interface and the resources in your VPC that must communicate with the service. By default, the interface endpoint uses the default security group for the VPC. Alternatively, you can create a security group to control the traffic to the endpoint network interfaces from the resources in the VPC. To ensure that tools such as the AWS CLI can make requests over HTTPS from resources in the VPC to the AWS service, the security group must allow inbound HTTPS traffic."CommentShareEXPERTskinsmananswered 19 days agorePost-User-6009864 18 days agoThe function basically gets the bucketName input and specific object from it and create a zip version of it then upload back to the bucket.I had tested the function using the same server deployed in public subnets, which works perfectly fine.SharerePost-User-6009864 18 days agoI would assume that it is not using HTTPS as this is the codes runner in the server to invoke the func:payload = "{"bucketName":"".BUCKET_NAME."","fileName":"".$file_name.""}";$lambda_invoke_result = $lambda->invoke(array(// FunctionName is required'FunctionName' => LAMBDA_FUNC_NAME,'InvocationType' => 'RequestResponse','LogType' => 'Tail','Payload' => $payload));so I just need to set up; lambda interface endpoint to the private subnets where the web servers are running in, with traffic inbound from those private servers only right? IShareskinsman EXPERT18 days agoIt looks like you're on the right track.  That function invocation should be able to use the Lambda VPC Interface Endpoint.  It just needs to be in the same region as your web servers and in the same VPC (or in another VPC with network connectivity and its Private Hosted Zone associated with the web servers' VPC).  The SG for the endpoint needs to allow HTTPS inbound from your web servers, though leaving it fully open temporarily until you get things working isn't a bad idea.Share0Hi,If you create the lambda in the same VPC than the workloads, then you do not need the interface endpoints.If lambda is created in another VPC, the VPCs should be paired via VPC peering or transit gateway and a VPC interface endpoint to be used.If lambda is not in any customer defined VPC, then you still nee sn interface endpoint.Hope it helps ;)CommentShareEXPERTalatechanswered 19 days ago0Hi,I am not sure what is the use case w.r.to lambda in your app. But here are the options ,a. Invoke Lambda functions from EC2 instancesFor this scenario, you would need to do the following,Assuming EC2 instances already has instance profile created, now create an IAM policy (inline/customer managed) to invoke Lambda functionsAdd the IAM policy as mentioned in this link - https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Authorizing.IAM.LambdaCreatePolicy.htmlb. Invoke ec2 hosted apps from LambdaCreate security group for lambdaAdd the ec2 cidr or security group id and appropriate port to access the app from Lambda as outbound rule.Lambda outbound SG rule - app Protocol, app port, ec2 sg id or cidr block, descriptionAdd the lambda security group id to the ec2 instances security group to allow traffic from Lambda as inbound ruleEc2 inbound SG rule - app Protocol, app port, lambda sg id, descriptionNote:Lambda can be configured with or without VPC.In case of lambda without VPC config, ec2 endpoints are required to contact app hosted in ec2 instances (within private subnets)In case of lambda with VPC config, endpoints are not needed. However, lambda should be configured with IAM execution role as per steps mentioned here under section 'Create Execution Role for Lambda' - https://repost.aws/knowledge-center/lambda-dedicated-vpcCommentShareManoj Kumar Sanswered 18 days ago"


Question: data transfer cost between two AZs in the same VPC same account

I read that there is a data transfer cost between two AZs in different accounts.I wonder if there is a data transfer cost between two AZs in the same VPC same account. let's say one EC2 in AZ A is sending data to EC2 in AZ B. What is the charge like?FollowComment

Answer: "2Accepted AnswerYes, there is and cost is the same as between accounts within region.https://aws.amazon.com/ec2/pricing/on-demand/Data transfer within AWS region:"Data transferred "in" to and "out" from Amazon EC2, Amazon RDS, Amazon Redshift , Amazon DynamoDB Accelerator (DAX), and Amazon ElastiCache instances or Elastic Network Interfaces across Availability Zones or VPC Peering connections in the same AWS Region is charged at $0.01/GB in each direction."CommentShareAWS-User-4649907answered 3 years ago"


Question: Lighstail with Ubuntu 20.04 dhcp error

"Hello allI have a Lightsail machine with Ubuntu 20.04 running a small Web Server and, since I created this machine, in randomly times, all the services stop to respond. Even on the Lightsail console, I can't access the machine by SSH and I can't restart the instance. The only way to get access again is stop and start the instance.Looking on the logs, I found that the error was, all the times, with the DHCP requestsystemd-networkd[401]: eth0: Could not set DHCPv4 address: Connection timed outAfter this error, the system doesn't try to get a new address and stop to respond until I stop and start the instance again.I found a lot of people with the same problem on a Google search, but with no solutions.Anyone could help me with thath?FollowComment"


Question: MWAA apache-airflow-providers-amazon DAGS can't import operator

"I'm trying to use newest package for Amazon integration in MWAA.In this particular case I want to use GlueJobOperator which is a part of the latest apache-airflow-providers-amazon package.(Link to the documentation)MWAA Airflow version: 2.2.2I added this to the requirements.txt:apache-airflow-providers-amazon==4.0.0and tried to import it and use it like in the examples:from airflow.providers.amazon.aws.operators.glue import GlueJobOperatorglue_job = GlueJobOperator(        task_id='airflow_id',        job_name='job_name'        wait_for_completion=True,        script_location='bucket_script_prefix',        s3_bucket='bucket_name',        iam_role_name='iam_role'        create_job_kwargs=job_arguments,        script_args=script_arguments    )Unfortunately, whenever DAG is parsed I get this error:...    from airflow.providers.amazon.aws.operators.glue import GlueJobOperatorImportError: cannot import name 'GlueJobOperator' from 'airflow.providers.amazon.aws.operators.glue' (/usr/local/lib/python3.7/site-packages/airflow/providers/amazon/aws/operators/glue.py)It's not my first rodeo with MWAA and some extra packages, plugins etc. but I am lost. In this case, I tried many things, went through docs from cover to cover and I still couldn't find the reason.I verified in MWAA that packages were successfully installed both in the logs and in the UI with the version prompted in requirements.txt.Package NameVersionDescriptionapache-airflow-providers-amazon4.0.0Amazon integration (including Amazon Web Services (AWS)).Fun fact:I'm using S3Hook in some other DAGs and it parses just fine.from airflow.providers.amazon.aws.hooks.s3 import S3Hooks3_hook = S3Hook()...FollowCommentrePost-User-0476895 10 months ago+1 running into the same issueShare"

Answer: "0Hello,By default MWAA version 2.2.2 comes up with few default providers , please check  "Provider packages for Apache Airflow v2.2.2 connections" in below link . In the below link you can see MWAA version 2.2.2 comes up with apache-airflow-providers-amazon==2.4.0https://docs.aws.amazon.com/mwaa/latest/userguide/connections-packages.htmlSince your environment has already installed provider apache-airflow-providers-amazon==2.4.0 and  glue operator is not available  in 2.4.0 version. Please check available operator in for version 2.4.0 in below linkhttps://airflow.apache.org/docs/apache-airflow-providers-amazon/2.4.0/operators/index.htmlI would request to not upgrade the providers version as lt may upgrade Airflow version which lead to unhealthy schedulerIf you still want to use apache-airflow-providers-amazon==4.0.0 in MWAA version 2.2.2 ,please follow below link , it clearly explains how to specify newer package with out causing any version conflicts.https://docs.aws.amazon.com/mwaa/latest/userguide/connections-packages.html#connections-packages-newer-packagesCommentSharepriyathamanswered a month ago"


Question: What authorizer to use: Lambda Custom Authorizer or AWS Cognito?

I have a AWS Lambda (NET 6) working with RDS. What to use: Lambda Custom Authorizer or AWS Cognito? If I understand correctly: to use Lambda Custom Auhorizer need develop my own Lambda function. To use AWS Cognito  I do not need to develop anything but only add users pool and maintain AWS Gateway?FollowComment

Answer: "0Accepted AnswerHi Oleg,Yes correct.If you use Lambda authorizer, you will have to code the lambda handler yourself where you ll have to return an IAM policy to allow/deny the request. A dir net blueprint can be found here: https://github.com/awslabs/aws-apigateway-lambda-authorizer-blueprints/tree/master/blueprints/dotnet/src but you can use any supported languages for it.With authorizers you are in full control.For cognito you will have just to associate it to the api gw after you create an user pool. It provides certain features out of the box, but there are certain limitations (non able to add custom claims to access tokens, very rigid to update user pools after you create them). This will be driven by your requirements and risk appetite.Hope it helps!CommentShareEXPERTalatechanswered 3 months agoOleg 3 months agoThank you. Yet another question: these both types of Authorizers return Allow or Deny. How to implement if I want to  return user role of this user? For example, Unregistered, User, Admin, Superadmin? As I see: I need to develop 2 steps: Authorizer(1 of 2) + my own identity managerSharealatech EXPERT3 months agoMaybe for your case you could use the response context of the policy: https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-lambda-authorizer-output.html which you can fill with above valuesShare"


Question: Error while exporting an instance

HelloI'm trying to export an instance but i got this error : An error occurred (NotExportable) when calling the CreateInstanceExportTask operation: This instance has multiple volumes attached. Please remove additional volumes.i've checked and there is 3 storages attached to the VM. i don't know what are the use of the 2 others.Someone can help me please.FollowComment

Answer: "0Hello,Exporting instances and volumes is subject to the following limitations:You can't export an instance that has more than one virtual diskYou can only export EBS volumes that are specified in the block device mapping, not EBS volumes attached after instance launch.Please refer [Exporting an instance as a VM using VM Import/Export] (https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#vmexport-prerequisites)CommentShareAWS-User-7653869answered 7 months ago"


Question: Rekognition bound boxes

"Hi everyone!Currently, I've accomplished detecting all the faces from a collection and then generating sub-galleries of each individual subject with all their photos associated with the ruby SDK '~> 1.65'In order to do this, I've indexed the faces of all photos within a collection, list all the faces (https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/Rekognition/Client.html#list_faces-instance_method), then grabbing each face_id recognized and search the faces related to that face_id (https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/Rekognition/Client.html#search_faces-instance_method), and delete the face id used to do the API call and all the returned ones to tell when a new detected subject starts and ends.My issue is that some indexed faces are returning a wrong bound box not fitting the face properly with a few images, sometimes not even close to the face (I've seen a brick as a bound box). This is weird because internally those "wrong faces" seem to be associated properly with other faces as if the service were just returning wrong box values but doing all the AI jobs properly.Is there a way to prevent or tweak the call params to prevent this? or is it normal for the API to return sometimes wrong values due to the multiple decimals?Thanks in advance!FollowComment"

Answer: "0Hi, thanks for your reply!Yes, I forgot to mention that I'm using the formula from the docs https://docs.aws.amazon.com/rekognition/latest/dg/images-displaying-bounding-boxes.html to retrieve the exact box and it's still wrong in some scenarios, displaying bricks or an elbow even.CommentShareAWS-User-5694207answered a year agoAWS-User-8651363 a year agoSide note: for further comments to the answer I had sent, you can post as comments, in order not to confuse the voting system and help the community find the most appropriate answers in the futureShareAWS-User-8651363 a year agoNow, regarding what you said about following the documentation, out of curiosity, if you go the Amazon Rekognition page at AWS Console, then the 'Facial analysis' option at the menu at the left and upload a picture, are you still getting odd results ?Share0Hello, each bounding box width/left and height/top returned by the API is a ratio of the overall width and height, respectivelyCommentShareAWS-User-8651363answered a year agoAWS-User-8651363 a year agoNow, regarding what you said about following the documentation, out of curiosity, if you go the Amazon Rekognition page at AWS Console, then the 'Facial analysis' option at the menu at the left and upload a picture, are you still getting odd results ?Share0Hi,we are happy to work with you to investigate this issue. Can you open a case using this link and share the case ID here. We can then engage directly to troubleshoot.CommentShareAWS-litaoanswered a year ago"


Question: iptables inside container doesn't work - NET_ADMIN also didn't help

"Hi Folks,I have a container with fail2ban on it. On my development computer when I add this to docker-compose:Code:    cap_add:     - NET_ADMIN     - NET_RAWI can see rules are added to iptables both inside container and outside it and it works properly. When I try the same configuration on EC2 instance, i can see those rules inside container, but not on the host system. What's wrong?Thanks in advance.FollowComment"

Answer: "0Decided to give up with the idea and as the alternative, mount log files of the container into equivalent place on the host system. So a standard fail2ban installation would read those log files and set the host system IP tables accordingly. This worked well.CommentShareaarioanswered 4 years ago"


Question: "Amplify Storage.put succeeds on iOS, throws axios 403 forbidden error on android (React Native)"

"We have a react-native app that allows users to import images from a network camera and upload them to an S3 bucket.We recently migrated from Expo Kit (SDK37) to Expo Bare (SDK43), RN Version 0.64.2On iOS, both the release build and local debug builds work as expected and images are successfully uploaded to our S3 bucket.However, on Android, we get an error saying that the signature doesn't match, and a 403 error from axios.Here's what my setup looks like:System:    OS: macOS 12.2    CPU: (8) arm64 Apple M1    Memory: 85.48 MB / 16.00 GB    Shell: 5.8 - /bin/zsh  Binaries:    Node: 16.13.1 - /usr/local/bin/node    Yarn: 1.22.17 - /opt/homebrew/bin/yarn    npm: 8.1.4 - /opt/homebrew/bin/npm    Watchman: 2021.11.29.00 - /opt/homebrew/bin/watchman  Browsers:    Chrome: 98.0.4758.102    Firefox: 97.0.1    Safari: 15.3  npmPackages:    @BeeCorp/react-native-volume-control:  1.0.1     @apollo/client: ^3.4.16 => 3.5.9     @babel/core: ^7.12.9 => 7.17.5     @babel/plugin-proposal-class-properties: ^7.14.5 => 7.16.7     @fortawesome/fontawesome-svg-core: ^1.2.36 => 1.3.0     @fortawesome/free-solid-svg-icons: ^5.15.4 => 5.15.4     @fortawesome/react-native-fontawesome: ^0.2.7 => 0.2.7     @react-native-async-storage/async-storage: ~1.15.0 => 1.15.17     @react-native-community/datetimepicker: 3.5.2 => 3.5.2     @react-native-community/masked-view: ^0.1.11 => 0.1.11     @react-native-community/netinfo: ^8.0.0 => 8.0.0     @react-native-community/slider: 4.1.12 => 4.1.12     @react-native-firebase/app: ^14.1.0 => 14.5.0     @react-native-firebase/crashlytics: ^14.1.0 => 14.5.0     @react-native-picker/picker: ^2.2.1 => 2.2.1     @unimodules/core: ~7.2.0 => 7.2.0     amazon-cognito-identity-js: ^5.2.6 => 5.2.6     aws-amplify: ^4.3.14 => 4.3.14     aws-amplify-react-native: ^6.0.2 => 6.0.2     aws-appsync: ^4.1.4 => 4.1.4     aws-sdk: ^2.1013.0 => 2.1077.0     axios: ^0.23.0 => 0.23.0     babel-preset-react-native: ^4.0.1 => 4.0.1     buffer: ^6.0.3 => 6.0.3     expo: ^43.0.0 => 43.0.5     expo-asset: ~8.4.3 => 8.4.6     expo-av: ~10.1.3 => 10.1.3     expo-background-fetch: ~10.0.3 => 10.0.3     expo-barcode-scanner: ~11.1.2 => 11.1.2     expo-constants: ~12.1.3 => 12.1.3     expo-location: ~13.0.4 => 13.0.4     expo-secure-store: ~11.0.3 => 11.0.3     expo-sensors: ~11.0.3 => 11.0.3     expo-splash-screen: ~0.13.5 => 0.13.5     expo-status-bar: ~1.1.0 => 1.1.0     expo-task-manager: ~10.0.3 => 10.0.3     expo-updates: ~0.10.5 => 0.10.15     graphql-tag: ^2.12.5 => 2.12.6     jest-fetch-mock: ^3.0.3 => 3.0.3     jest-mock-axios: ^4.4.1 => 4.5.0     jetifier: ^2.0.0 => 2.0.0     jsdom: ^18.0.0 => 18.1.1     lodash: ^4.17.21 => 4.17.21     moment: ^2.29.1 => 2.29.1     react: 17.0.1 => 17.0.1     react-apollo: ^3.1.5 => 3.1.5     react-dom: 17.0.1 => 17.0.1     react-native: ^0.64.2 => 0.64.3     react-native-animatable: ^1.3.3 => 1.3.3     react-native-background-timer: ^2.4.1 => 2.4.1     react-native-battery: ^0.1.18 => 0.1.18     react-native-collapsible: ^1.6.0 => 1.6.0     react-native-config: ^1.4.5 => 1.4.5     react-native-copilot: ^2.5.1 => 2.5.1     react-native-doc-viewer: https://github.com/mikemeyer30/react-native-doc-viewer => 2.7.8     react-native-flash-message: ^0.2.0 => 0.2.1     react-native-geolocation-service: ^5.3.0-beta.3 => 5.3.0-beta.4     react-native-gesture-handler: ~1.10.2 => 1.10.3     react-native-get-random-values: ^1.7.0 => 1.7.2     react-native-image-picker: ^4.1.2 => 4.7.3     react-native-keyboard-aware-scroll-view: ^0.9.4 => 0.9.5     react-native-keyboard-spacer: git+https://github.com/datso/react-native-keyboard-spacer.git => 0.4.1     react-native-material-design: ^0.3.7 => 0.3.7     react-native-material-dropdown-v2: ^0.11.1 => 0.11.1     react-native-paper: ^4.10.0 => 4.11.2     react-native-queue: https://github.com/mikemeyer30/react-native-queue-asyncstorage => 1.2.1     react-native-reanimated: ~2.2.0 => 2.2.4     react-native-safe-area-context: 3.3.2 => 3.3.2     react-native-screens: ~3.8.0 => 3.8.0     react-native-svg: 12.1.1 => 12.1.1     react-native-torch: ^1.2.0 => 1.2.0     react-native-vector-icons: ^9.0.0 => 9.1.0     react-native-web: 0.17.1 => 0.17.1     rn-swipe-button: ^1.3.6 => 1.3.6     tree-util: ^1.0.6 => 1.0.6     uuid: ^8.3.2 => 8.3.2   npmGlobalPackages:    @aws-amplify/cli: 7.6.20    expo-cli: 5.1.1    n: 8.0.1    npm: 8.1.4    react-native-cli: 2.0.1    yarn: 1.22.17We've been troubleshooting for a little over a week now with no success, so any pointers are greatly appreciated. If there's any additional information I can provide, I'd be happy to do so. Thanks in advanceFollowComment"

Answer: "0Hello,since the requests go through on iOS but fail on Android I recommend to investigate and rule out potential reasons why the "signature doesn't match" error is thrown.One of the more common potential reasons for this error is clock skew / system clock offset.Making requests to AWS services requires that you use a timestamp, which represents the time at which you make the request. For security purposes, AWS requires a valid timestamp in the request in order to mitigate the risk of third-party request interception and unauthorized replay. AWS allows a five minute variance on the timestamp — in other words, the timestamp doesn’t need to be exact. However, on mobile devices, it is possible for the time to be significantly out of sync. In these situations, calls to AWS will fail due to the timestamp being outside the allowable range.Can you please double check the system time on your Android device for potential offset? To fix potential offset you can use the setClockOffset function:import { DateUtils } from "@aws-amplify/core"DateUtils.setClockOffset(CLOCK_OFFSET);see https://aws-amplify.github.io/amplify-js/api/globals.html#dateutilsCommentShareAlexanderanswered a year agomike_meyer a year agoHello Alexander, thanks for the suggestion;So first, I used DateUtils.getDateWithClockOffset() to see what date time it would log, and it seems that it is correct; it logged:2022-02-28T22:29:20.234ZAnd I'm on EST, so on my device it was:2022-02-28 17:29:20at the time of invocation.From the error log that dumps out, I pull the timestamp from the 'StringToSign' attribute, and it reads: 2022-02-28 22:29:21ZAnd when I log DateUtils.getClockOffset(), it shows 0 milli offset, so it would appear the offset isn't the issue, unless I'm missing something...Share"


Question: AWS SNS (Simple Notification Service) not sending transactional messages consistently.

"The SNS service not sending the messages consistently. For the same mobile number, getting "Phone carrier has blocked this message", after 1-2 retries the message is sent to the same number.SNS region: ap-southeast-1 (Singapore)Message had OTP for user confirmation. The user mobile number is from India.FollowComment"

Answer: "0Accepted AnswerHi,Short answer: we now have a Messaging blog that describes possible reasons to SMS failures .Long answer, is described below:Let's first take a step back and understand Amazon SNS/Pinpoint SMS workflow as summarized below :SNS --> Downstream providers --> Mobile Carriers --> DeviceWhen an SMS is sent using AWS services (e.g. SNS or Pinpoint), its forwarded to Downstream providers who route the SMS to mobile carrier. The mobile carriers are responsible for the final delivery of the SMS message to end-user phone device. Different destination country have different local laws and regulations to which SMS sender should comply to. For example, sending unregistered SMS to India using SenderID will fail, sending URLs as a part of SMS might fail for Nordic destinations.In the context of the message - Phone carrier has blocked this message, this means that there a high probable cause of delivery issue between Downstream providers process to mobile devices hence SMS was not delivered successfully.Recommendation:Please strongly encourage our customers to contact AWS Premium Support and provide the following additional details needed for further investigation:AWS Account IDAWS region3 - 4 SNS SMS logs (i.e. not older than 72 hours)Lastly I enlist SMS best practices for further reading and review.CommentSharesyumaKanswered a year agoAWS-User-7807084 a year agoThank you so much for the response.Share"


Question: Any simple s3 bucket Javascript ( browser) examples that work

"Last time I did anything browser-side with s3 buckets was 2017, and it seemed pretty straightforward, and it worked well.What happened? :OAll I want is to be able to view photos, in a bucket, via a web page, like this:https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/s3-example-photos-view.htmlOpen to any recommendations! TIA.FollowComment"

Answer: "0Hi dug,I don’t think things have changed that much. The approaches I see involve:the link you sent is still valid, as it leverages SDK for browser.an alternative to above is to have your own API and then handle s3 calls on your backendAmplify: https://docs.amplify.aws/lib/storage/getting-started/q/platform/js/#storage-with-amplify which is also providing UI components: https://ui.docs.amplify.aws/react/getting-started/introductionHope it helps ;)CommentShareEXPERTalatechanswered 11 days ago"


Question: "Global Accelerator disabled itelf - Can't reenable, can't create new ones"

"Today my global accelerator in one of my accounts disabled itself. It give us access denied when we try to re-enable it, and if we try to create a new one it says we have exceeded the maximum number of them. We only have a single accelerator.We've tried with the root account as well, and still get access denied. I was able to detach my listener in an attempt to create a new accelerator, but i cannot.Is this an AWS bug?? How can i fix this??https://imgur.com/lidRFktFollowComment"

Answer: 0I'm not sure what's happening here; but in this case I would raise a support ticket - they have the ability to look "behind the scenes" and see what is happening in your account with that service.CommentShareEXPERTBrettski-AWSanswered a year ago


Question: macOS instance is stuck shutting down when trying to terminate (Instance ID: i-0f3b3c20de626efc4)

Instance ID: i-0f3b3c20de626efc4I've tried terminating the instance multiple times via both the web interface and aws cli with no luck. Have also tried force stopping the instance via the --force flag in the cli but it didn't work. Has been stuck for roughly half an hour. Please could it be forcibly terminated? As i'd like to release the dedicated host too.Thank you!FollowComment

Answer: "0Hi - Please refer to https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesShuttingDown.html and https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-mac-instances.html#mac-instance-stop to see if this helps.When you stop a Mac instance, the instance remains in the stopping state for about 15 minutes before it enters the stopped state.When you stop or terminate a Mac instance, Amazon EC2 performs a scrubbing workflow on the underlying Dedicated Host to erase the internal SSD, to clear the persistent NVRAM variables, and to update to the latest device firmware. This ensures that Mac instances provide the same security and data privacy as other EC2 Nitro instances. It also enables you to run the latest macOS AMIs. During the scrubbing workflow, the Dedicated Host temporarily enters the pending state. On x86 Mac instances, the scrubbing workflow may take up to 50 minutes to complete. On M1 Mac instances, the scrubbing workflow may take up to 110 minutes to complete. Additionally, on x86 Mac instances, if the device firmware needs to be updated, the scrubbing workflow may take up to 3 hours to complete.CommentShareEXPERTAWS-User-Nitinanswered 2 months ago"


Question: PTR recrod vs 'A' record with remove email sending limitation

"Hi, I purchased a domain from aws and created a hosted zone on route53 and a sub-domain like 'email.mydomain.com' and point to a lightsail instance's static ip as 'A' record. Then my request for reverse dns and removal of email sending limitation was completed as well as other spf, dkim and dmarc. And now I am confusing do I still need to create another hosted zone with a PTR record in it for my mail server instance in lightsail like what I saw here : https://aws.amazon.com/premiumsupport/knowledge-center/route-53-reverse-dns/?Are these two steps (reverse dns and remove email sending limit request from aws support) and (manually create new hosted zone and create PTR record inside) the samething? Like both actually giving the same effect? Or I must complete both steps so my email won't go to email receiver's spam.And is it the same using static ip with instance in lightsail vs elastic ip on aws? I know there are pricing different but what about effect?Thanks.Edited by: twhouz on May 20, 2019 11:20 PMFollowComment"

Answer: "0If you've created the A record pointing to your static IP, and Amazon has created the PTR record that points your IP to the A record's name, you should be all set.CommentShareDavid Ganswered 4 years ago"


Question: Error adding alternate domain to CloudFront distribution

"Hi,I'm stuck adding api-dev.tbd.wwwarcelona.studio as an alternate domain to my new CloudFront distribution. I get this error: One or more of the CNAMEs you provided are already associated with a different resource. I can't see any visible resource using that domain. (API Gateway or Distribution). How can I handle this? Thanks.FollowComment"

Answer: "0HiYou have another CDN somewhere using the CNAME you are trying to add, You can resolve this with this article by AWS premium support CommentShareGKanswered a year agosjonama a year agoThanks for your quick answer, I tried to follow the article but I don't know what is the distribution id. Where could I find it?aws cloudfront list-conflicting-aliases --distribution-id YourDistributiontID --alias YourCNAMEShare"


Question: awssdk.services.appconfig.model.BadRequestException

"hello,in my server,where i use AppConfig sdk ,it's show this error:software.amazon.awssdk.services.appconfig.model.BadRequestException: Feature flag configurations must be accessed via AWS AppConfig Data's GetLatestConfiguration API. (Service: AppConfig, Status Code: 400, Request ID: 412ba838-95d0-4877-a8a6-c3352bb6731c, Extended Request ID: null)I have already setup at the backup of website of aws, and there are:appConfig:application: exampleenvironment: exampleconfiguration: examplecan u help me how to setting my java code or  give the example guide code for me.FollowComment"

Answer: "0Using the Feature Flags configuration type means you need to use the new AppConfigData API instead of the original AppConfig API. The new API works in a slightly different way to the old one:You must call startConfigurationSession before you do anything else with the service. This API call takes the application, environment and profile ids, and returns an initialConfigurationToken, which your application should store.To receive the configuration initially, you call getLatestConfiguration, to which you should pass the stored configuration token. The response to this includes a nextPollConfigurationToken which your application should store. It also includes nextPollIntervalInSeconds, which is the number of seconds your application should wait before requesting the configuration again.You can now call getLatestConfiguration to check for configuration updates. You should supply the most recent nextPollConfigurationToken you received, and store the new one you get in the response to this call. Note that if the configuration has not changed since you last received it, the configuration in the response will be blank. You will also receive a new nextPollIntervalInSeconds (which may be the same value as before), so you should track the new value.I don't have a Java code sample I'm afraid, but the AppConfig docs show the API call flow using the CLI: https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-retrieving-the-configuration.htmlThere's also a sample Python AppConfig helper library which implements this API version, which you may find useful to see how it interacts with it: https://github.com/aws-samples/sample-python-helper-aws-appconfig/blob/main/appconfig_helper/appconfig_helper.pyCommentShareEXPERTJames_Sanswered a year ago"


Question: Using external javascript library gives errors in AMT

"Trying to use javascript libraries like video.js and video_markers.js with jquery to show markers on given time  in the video slider of the video. But after adding the library, AMT gives below error. I am not using any select elements in the crowd form myself, looks like this is for the javascript library added , how can I resolve it, can someone please advise?. ThanksPotential errorsWe found some potential errors with your usage of Crowd HTML Elements.(Element type SELECT): No 'name' attribute specified. This element won't be included in the submitted answer.Below are the external libraries  used: <script src="https://unpkg.com/video.js/dist/video.min.js"></script> <script src='https://cdnjs.cloudflare.com/ajax/libs/videojs-markers/0.7.0/videojs-markers.min.js'></script>FollowComment"


Question: AWS Organization Billing

We have created two Organizational Units and multiple accounts under each OU.Is it possible to keep the billing separate for each of the OUs - so OU1 gets its own consolidated billing and OU 2 gets its own.The two OUs - although in the same company - have separate finance and accounts teams.FollowComment

Answer: 2You will only get one invoice from AWS per Organization.https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/consolidated-billing.htmlHowever there are multiple ways to generate reports and break down cost and usage data.Use Tags and Cost Categories to generate reports in the cost explorer:  https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-cost-categories.html & https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.htmlUse Billing Conductor: https://docs.aws.amazon.com/billingconductor/latest/userguide/what-is-billingconductor.htmlCheck out the Lab that shows how to integrate Organizational data with your cost and usage report data: https://www.wellarchitectedlabs.com/cost/300_labs/300_organization_data_cur_connection/CommentShareEXPERTMatt-Banswered a year ago


Question: Can AWS GLUE handle LOADING tables with foreign key relationships ?

"Trying to load tables from single source.. Source has data for EMP NAME , ADDRESS … target table A has EMP ID(Auto generated PK) and EMP NAME … table B has EMP ID(foreign key) ADDRESS ID ( Auto generated PK) AND ADDRESS…Now how to load these two tables using AWS GLUE ?No proper notes any where for this… can you help clarifyFollowComment"

Answer: "0Accepted AnswerGlue does not have in built functionality that does this.When you generate the ID, you can store it both the EMP NAME and EMP ADDRESS datasets and load the 2 tables with that information.CommentShareAnanth Tirumanuranswered 4 months ago0Thanks for the infoCommentSharerePost-User-3188796answered 4 months ago"


Question: rename window EC2 server and TAG name

"I need to change the name of multiple windows ec2 instances.manual way is:RDP to serverChange name in systemRebootChange TAG Name from NAme: old_Name to  new_nameany idea how I can automate this, script with powershell or SSM?FollowComment"

Answer: "0Hi Drago,You should be able to do this using AWS Systems Manager / SSM Automation. The runbook can have the following basic steps:Describe the Instance. (To get details of the Instance) - Use the aws:executeAwsApi action.Confirm the instance is managed by SSM and its connection status is "Online". - Use the aws:assertAwsResourceProperty actionCall / Invoke the AWS-RunPowerScript Run Command document to run a PowerShell Script that Renames the Computer. You can use the Rename-Computer PowerShell cmdlet - Use the aws:runCommand action.Tag the instance. - Use the aws:executeAwsApi action.Restart the Instance. - Use the aws:changeInstanceState action.Reference:[+] Authoring Automation runbooks - https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-authoring-runbooks.htmlCommentShareCharles Manswered 8 months agodrago 8 months agonot sure how to start on this. I have no SSM experience. I know my ec2 instances are windows servers and have the SSM agent installedShare"


Question: "Certificate Manager, CAA check not passing while it's properly configured"

"Hello,I need a certificate for a domain that I'll keep secret sorry, but let's say*.salon.foobar.frWhen I try to generate the certificate with CM I've got this error:When I check the CAA record for: test.salon.foobar.fr on this website (again remember, fake domain), https://caatest.co.uk/ I have this result:So everything looks good and AWS should be able to validate the domain.What's wrong ?FollowComment"

Answer: "0DNS changes can take some time to propagate. It might take up to 48 hours for the changes to be visible everywhere. If you've recently added or modified your CAA records, you might need to wait a bit before AWS can validate the domain. Use a DNS checking tool to make sure there are no errors with your DNS configuration. There are many free tools available online, such as Google's public DNS checker. Remember that CAA records apply to subdomains as well. If you're trying to issue a certificate for a subdomain and the parent domain has a CAA record, the subdomain will inherit that record unless it has its own CAA record. Make sure your CAA records are correctly configured for both the parent domain and any subdomains.CommentShareEXPERTsdtslmnanswered 7 days agorePost-User-0240761 7 days agoThank you for the answer.The CAA record hasn't changed in several months so AWS should see themShare0I deleted all the CAA records from my DNS and it stills indicate the same problem. No CAA but CAA check failed ....CommentSharerePost-User-0240761answered 6 days ago"


Question: Customise emitted SNS message in state machine

"I have the following state machine step:    "Step Name": {      "Type": "Task",      "Resource": "arn:aws:states:::sns:publish",      "Parameters": {        "TopicArn": "${TopicARN}",        "Message.$": "States.JsonToString($)",        "MessageAttributes": {          "type": {            "DataType": "String",            "StringValue": "$.type"          },          "id": {            "DataType": "String",            "StringValue": "$.id"          }        }      },      "End": true    }which works fine but I'd like to customise the body of the SNS message, somehow like this:    "Step Name": {      "Type": "Task",      "Resource": "arn:aws:states:::sns:publish",      "Parameters": {        "TopicArn": "${TopicARN}",        "Message.$": {          "id": "$.id",          "param1": "$.param1",          "param2": "$.param2",          "metadata": "$"        },        "MessageAttributes": {          "type": {            "DataType": "String",            "StringValue": "$.type"          },          "id": {            "DataType": "String",            "StringValue": "$.id"          }        }      },      "End": true    }However it does not work because Message has to be a String. I was hoping to wrap my object in States.JsonToString but that also doesn't seem to work.Is there a way to achieve this or will I have to resort to using a lambda instead of the SNS integration?FollowComment"

Answer: "1Accepted AnswerTo specify that a parameter use a path to reference a JSON node in the input, end the parameter name with .$ (from doc).In your case:    "Step Name": {      "Type": "Task",      "Resource": "arn:aws:states:::sns:publish",      "Parameters": {        "TopicArn": "${TopicARN}",        "Message": {          "id.$": "$.id",          "param1.$": "$.param1",          "param2.$": "$.param2",          "metadata.$": "$"        },        "MessageAttributes": {          "type": {            "DataType": "String",            "StringValue.$": "$.type"          },          "id": {            "DataType": "String",            "StringValue.$": "$.id"          }        }      },      "End": true    }CommentShareEXPERTUrianswered a year agolaszlobica a year agoThat's exactly what I was looking for, now sure how I missed it. Thanks!Share"


Question: Ec2 instance is not reachable

I have an ec2 instance running for the last 3 years and suddenly its showing in not reachable anymore from its public dns. Also the public domain attached to this instances are showing 502 errors. The instance is showing running statusFollowComment

Answer: "0Perhaps, but isn't that instance EC2 Classic?EC2 Classic is currently deprecated as it will be unsupported in 2022.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-classic-platform.htmlCommentSharetakakunianswered 3 months ago"


Question: Lambda triggered twice by one dynamodb insert event

"I have a lambda function which is triggered by Dynamo stream when a record is inserted into a table. The function takes about 2~3 minutes to process the request and the batch size for the trigger is configured to be 1.For some reason, the lambda function is triggered twice for every record inserted into a table. For instance, I inserted 100 records into the table and found out that the lambda function was triggered 200 times.Below is the screenshot from CloudWatch which shows the lambda function is triggered twice for the same pk inserted into the dynamodb table.FollowCommentjzhunter 6 months agoDid you setup two triggers (look on the console)? Or did you actually somehow insert twice (to check you can look at CW and look at consumed WRUs)?Share"

Answer: "0Are you using global tables? If so, you can see duplicated itens in the streamsCommentShareEXPERTDaniel ABIBanswered 5 months ago"


Question: Cloud Quest build on S3  project

"hello, I am new in the cloud and I started build a project with cloud quest.for the first projet they assign me to creat a S3 bucket.I made it but on the onglet to validate with 4DIY it said: Name can't fin for validation.how to fixe it? please need helpFollowComment"

Answer: "0Hi, I recently completed the AWS Cloud Quest, try these steps:Check the bucket name: Ensure that the S3 bucket name you provided is correctly entered and does not contain any typos or invalid characters. S3 bucket names must be unique globally and follow certain naming rules, such as being DNS-compliant and using lowercase letters, numbers, and hyphens. This happened to me a few times where the instructions on the validate section ask for a new name for the resource, see if it's a requirement for the new S3 bucket.Confirm the bucket's existence: Double-check that the S3 bucket you created actually exists and is accessible. You can go to the AWS Management Console and navigate to the S3 service to see if the bucket is listed there.Verify your permissions: Make sure you have sufficient permissions to validate the bucket name in the 4DIY tab. You may need to check with your team or project administrator to ensure you have the necessary permissions to perform this action.Retry the validation process: If you have verified the above steps and the issue persists, try refreshing the page or closing and reopening the validation tab. Sometimes, temporary glitches can occur, and retrying the process can resolve the problem.CommentShareFS_AWSanswered 7 days ago"


Question: If the problem of high peering intranet latency is solved

"I set up peering in Singapore region to connect two vpc of the same AZ, the ping latency between EC2 of the same vpc is 100ms, but after pinging through peering the ping latency becomes 700ms.i need to reduce the latency of the network between peeringFollowComment"

Answer: "1Accepted AnswerHi, those latency figures are very very high, so I think something else is going on - it's not the VPC and peering infrastructure.  To give you an idea, latency across the whole of Australia, from Perth to the AWS Sydney region, is well under 100ms.Also note that a VPC is not associated with an AZ.  The subnets inside are individually associated with AZs.Also if you're peering VPCs across accounts, the AZs don't necessarily line up by name.  What I mean is that AZ "a" in one account won't necessarily be the same physical AZ as "a" in another account unless you've explicitly aligned them.CommentShareEXPERTskinsmananswered 6 days agoEXPERTTushar_Jreviewed 6 days ago1I would expect the latency to be higher for cross-AZ traffic as compared to intra-AZ traffic because availability zones are separate from each to avoid common points of failure.However, 100ms within the same AZ is extremely high; and 700ms (close to one second) between AZs is not normal. You should see single-digit millisecond latency between availability zones; I just tested this in the Singapore region between all three availability zones and that's what I'm seeing.CommentShareEXPERTBrettski-AWSanswered 6 days agoEXPERTTushar_Jreviewed 6 days ago"


Question: How yarn memory is allocated in emr? How to increase yarn memory?

running emr cluster with r5.8xlarge containing 1 master and 4 core and 2 task nodes want to increase yarn memroy for this cluster to improve performance?FollowComment


Question: gremlin-javascript is not an available GremlinScriptEngine

"I am trying to run a Gremlin query using javascript lambda. When i test my Lambda function, it is throwing me this error  statusMessage: '{"requestId":"b7410c95-5e7e-44ef-aa5d-1ee0349188a4","code":"InternalFailureException","detailedMessage":"gremlin-javascript is not an available GremlinScriptEngine"}'. Below is the query i am trying to run:g.V().as("v").repeat(both().simplePath().as("v")).emit().filter(project("x","y","z").by(select(first, "v")).by(select(last, "v")).by(select(all, "v").count(local)).as("triple").coalesce(select("x","y").as("a").select("triples").unfold().as("t").select("x","y").where(eq("a")).select("t"),aggregate(local,"triples")).select("z").as("length").select("triple").select("z").where(eq("length"))).select(all, "v").unfold().groupCount().next()FollowComment"


Question: Lambda function left an interface behind that cannot be removed

"We are currently in the process of cleaning an old VPC. One subnet could not be deleted because there is still an ENI:The ENI in question seems to have been created and used by a Lambda function given the description:The problem is, there are no Lambda functions anymore on this account and VPC!The respective attachment is managed by AWS and cannot be deleted by us:What can we do to get rid of the whole VPC if there is no service that could be deleted to fix this issue?FollowComment"

Answer: "1Generally the Lambda service will clean up ENIs used by the service in a short period of time. If not, please raise a support case as they can assist here.CommentShareEXPERTBrettski-AWSanswered 8 months ago"


Question: Account Getting Suspended

I am currently using my fifth AWS account and all of the old accounts got suspended after launching large instance with 32 or 64 vcpu just a few hours after launching these instances.There is no problem for using small instances with 4 or 8 vcpus.Do i need to do anything prior to launching large instances ?FollowComment

Answer: "0If you add specific details like instance type, storage, region etc that will help understand the issue better.In the meantime, you can also check - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-troubleshoot.htmlCommentSharemrkdbganswered 10 months ago"


Question: SES 554 Error on verified email

"I have two websites (on lightsail) that use SES. The first is running perfectly, and messages are getting through correctly.With the second website, I get 554 errors that the identity has not been verified.I'm using the same endpoint, the same SMTP username and password, the same connection settings. It's authenticating successfully, so everything to that point is fine.I've checked the identity list, and the email I'm sending from is coming up as verified (in the correct region).The account is not in sandbox mode.I'm slightly at a loss. I've gone through the docs thoroughly, and followed every step. Am I missing something obvious?FollowComment"

Answer: "0I've now changed the verified email to the one that works on the other account (both email addresses are apparently fully verified), and now it works. So everything is correct, except for the verified status of the new address. Which shows up on the system as verified.At. A. Loss.CommentShareDewinanswered a year ago"


Question: CodeBuild build never runs and remains stuck on QUEUED phase

"Today, after the events of 2021/dec/07, our build projects in one of our AWS accounts can't run anymore. Any build that is started remains in the QUEUED phase until a timeout occurs after around 1h.These build projects are all started from different CodePipeline pipelines and all of them are impacted.I've opened a support ticket regarding this issue to check if it is not a billing related problem.Does anyone here knows what could be the cause? There are no other build in the running state while this happens, at least no other build is shown in the CodeBuild console in the running state.Another account we have under the same consolidated billing account has no problems and the builds runs fine.This is making our development team unable to work properly.Thanks,RoneyFollowComment"

Answer: "0I suspect this is relating to Cloud Watch Events delivery delays and/or remediation incident response and/or CodeBuild might have put in place.Your course of action is correct and I recommend you select the right severity levels and the support engineer should be able to look into your account data as well as backed info to identify the issue (we do recommend you have at least a developer support plan to have access to support engineers).If there is other accounts able to start build, it's unlikely it's a billing related problem.That said, if the builds are working before, if you retry the build in the next 24 hours hopefully it should be able to proceed normally,.CommentShareJason_Sanswered a year ago"


Question: AppSync RDS HTTP 500 Errors

"This morning we started getting intermittent "500 Internal Server Error" responses from appsync with message "RDSHttp:{}".We do not seem to get the error on any standard query, but including 1 sub resolver we get the errors 50% of the time, 2 sub resolvers 90 %, and 3 sub resolvers 100% of the time. Using queries that return basically no data is the same issue. This is not query specific, any query that uses a sub resolver schema wide currently has this issue.Is some major issue going on currently? This has brought our stack to its knees. Issuing the exact same queries directly to the data api out of AppSync runs without issue.PLEASE HELPUsing CloudTrail we see the following:{"eventVersion": "1.05","userIdentity": {"type": "AssumedRole","principalId": "xxxxx","arn": "xxxxxx","accountId": "xxxxx","accessKeyId": "xxxxx","sessionContext": {"sessionIssuer": {"type": "Role","principalId": "xxxxxx","arn": "xxxxxx","accountId": "xxxxxxx","userName": "xxxxxx"},"webIdFederationData": {},"attributes": {"mfaAuthenticated": "false","creationDate": "2020-11-18T14:02:44Z"}},"invokedBy": "appsync.amazonaws.com"},"eventTime": "2020-11-18T14:02:44Z","eventSource": "rdsdata.amazonaws.com","eventName": "ExecuteStatement","awsRegion": "us-east-2","sourceIPAddress": "appsync.amazonaws.com","userAgent": "appsync.amazonaws.com","errorCode": "InternalServerErrorException","requestParameters": {"continueAfterTimeout": false,"database": "","includeResultMetadata": true,"parameters": [],"resourceArn": "xxxxxx","schema": "","secretArn": "xxxxxx","sql": "**********"},"responseElements": null,"requestID": "9d4266dc-06b3-4eec-940c-540cdaf1cca4","eventID": "fe8ad37a-db83-4e6d-8793-53f08d29e61f","eventType": "AwsApiCall","recipientAccountId": "xxxxxx"}FollowComment"

Answer: "0I have been told via a support case that the problem is related to a recent internal code update and AWS is working on reverting it. Will mark this as answered for now, but all I can say is UGH!CommentShareJason Kenyonanswered 3 years ago"


Question: How to disable Cost Explorer?

I'm going crazy with this one. I shut down all usage of every service a year ago. Yet I'm still getting billed every month for a few dollars. And all the charges are from cost explorer itself. The only active reports I have there are all locked and undeletable. Somehow the service that is supposed to save money is the only thing charging me.I'm about to nuke my account because there does not seem to be any way to disable the service. Very frustrated. Any help would be great.FollowComment

Answer: "1Do you have Hourly and Resource Level Data turned on in Cost Explorer?  Go to The Cost Explorer console and scroll down on the left to Preferences.  If this is enabled, this might be why you are seeing chargeshttps://aws.amazon.com/about-aws/whats-new/2019/11/aws-cost-explorer-supports-hourly-resource-level-granularity/If you go to Cost Explorer, Filter by Service: "Cost Explorer", and then Group by: "Usage Type", you will see "xxx-CostDataStorage ($)" if you scroll down below the chart which validates this is the  Hourly and Resource Level Data charge.Also, if you have Cost and Usage Reports enabled, you will still be billed for the CUR storage at standard S3 rates.  You can go to the Billing console and remove and Cost and Usage Reports as well, and delete the data in the bucket if you no longer need it.CommentShareEXPERTMatt-Banswered a year agoAWS-User-6582060 a year agoFollowing your instructions, instead, all the charges are for 'USE1-APIRequest'.Share0If you are accessing Cost Explorer via API, then you will be billed for those API requests (Using cost explorer through the console is free).  Seehttps://docs.aws.amazon.com/cost-management/latest/userguide/ce-what-is.html andhttps://aws.amazon.com/aws-cost-management/pricing/So you will need to check and see if something is using the Cost Explorer API.  If you have CloudTrail turned on, you should be able to see where it is coming from. See:https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/logging-using-cloudtrail.htmlAlso see the different API call availablehttps://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_Operations.htmlCommentShareEXPERTMatt-Banswered a year agoAWS-User-6582060 a year agoI do not have cloudtrail enabled. I have also never written code to access the cost explorer by API. And I have no code deployed on AWS now.ShareMatt-B EXPERTa year agoHave you integrated with any third party cost management tools?  If you don't have cloudtrail enabled, you can enable it following the link above to track down where the API calls are coming from and which Access Keys are being used.Share"


Question: This site can’t be reached

"My site's cloudfront distribution was working fine but now it shows this:This site can’t be reachedCheck if there is a typo in www.myteachercircles.com.DNS_PROBE_FINISHED_NXDOMAIN // my site is www.myteachercircles.comI am using only AWS services:The website is hosted in an S3 bucket. The URL given by the S3 bucket works fine: http://myteachercircles.com.s3-website-sa-east-1.amazonaws.com. I am using CloudFront, a custom SSL certificate and Route 53.I am not an expert but everything seems to be properly configured. I followed this checklist given to my by ChatGPT andVerify your domain's DNS settings in Route 53:Make sure your domain is properly registered with Route 53 or another domain registrar.Check the hosted zone for your domain in Route 53 and ensure the correct name servers are configured. //I GOT THE DOMAIN IN ROUTE 53 SO EVERYTHING HERE SHOULD BE FINECheck your domain's DNS records:Ensure you have an "A" record or an "ALIAS" record pointing to the CloudFront distribution. // CHECKEDAlternatively, you can use a "CNAME" record if you have a subdomain pointing to the CloudFront distribution. // CHECKEDCheck the CloudFront distribution settings:Ensure your distribution is enabled and properly configured. // I AM NOT SURE WHAT IS "PROPERLY CONFIGURED" BUT AS I SAID MY WEBPAGE WAS WORKING UNTIL RECENTLYMake sure your distribution's "Alternate Domain Names (CNAMEs)" field includes your domain name (e.g., www.myteachercircles.com). // CHECKEDConfirm the SSL/TLS certificate settings:Ensure the SSL/TLS certificate is valid and associated with your CloudFront distribution. //YESThe certificate should cover your domain name (e.g., *.myteachercircles.com or www.myteachercircles.com). //YESFollowComment"

Answer: "0Hi,Can you try below guide as well? https://repost.aws/knowledge-center/route-53-troubleshoot-nxdomain-responsesHope it helps ;)CommentShareEXPERTalatechanswered 2 months agoSebastian 2 months agoThank you! You pointed me in the right direction. The problem was that I had not verified the email associated with the new url and the aws emails warning me they would pull the site down had gone to spamShare"


Question: a2enmod command not found and Enabling Brotli

"I would like to enable Brotli on my web server on a Linux 2 Apache instance. I refer to this doc at https://bash-prompt.net/guides/apache-brotoli/ to enabled Brotli, but i get the below error: -$ a2enmod brotlibash: a2enmod: command not foundPlease help and advise the fix and how to poperly install and enable Brotli? Thanks@FollowComment"

Answer: 0Answer my own question :)I used this https://github.com/kjdev/apache-mod-brotli and it worksCommentSharebmwtayanswered 2 years ago