Question: ec2 throttling and batch operations

"I'd like to understand how batch operation against ec2 count toward throttle limits. Two requests specifically are of interest to me:LaunchFleet using EC2Fleet configuration -- if I'm attempting to start 2,000 instances with a single LaunchFleet request and also apply a tag to each instance on launch (as part of launch fleet configuration), how does this count against the throttle limits? Will only 1,000 be started and then I should wait until the bucket is refilled? What about the tagging of instances on launch, does this constrain things further?TerminateInstances -- similar question. I know that the max number of instances I can terminate in one call is 1,000 but if I make one such call, does the bucket empty and I should wait 1 minute before terminating another batch?thanksFollowComment"

Answer: "1Hello,I understand you need further clarification on how batch operations against EC2 count toward throttle limit.Amazon EC2 throttles EC2 API requests for each AWS account on a per-Region basis. Throttling is used to ensure that calls do not exceed the maximum allowed API request limit. If you exceed an API throttling limit, you will get the RequestLimitExceeded error code.With that being said, if you start more instances than your limit allows, you will either get the error code above or you will have to create a poll.As for tagging your EC2 instances, that does not affect throttling or LaunchFleet.Additional information provided here:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/fleet-quotas.htmlSo, to answer your question, yes only 1,000 instances will be started and you will have to wait until the bucket is refilled to start the next instances.For example, the resource token bucket size for RunInstances is 1000 tokens, and the refill rate is two tokens per second. Therefore, you can immediately launch 1000 instances, using any number of API requests, such as one request for 1000 instances or four requests for 250 instances. After the resource token bucket is empty, you can launch up to two instances every second, using either one request for two instances or two requests for one instance.Please refer to this documentation for additional information:https://docs.aws.amazon.com/AWSEC2/latest/APIReference/throttling.html#throttling-howPlease be advised that you can always request for an increase for API throttling for your AWS account. To request a limit adjustment, please contact the AWS Support Center: https://support.console.aws.amazon.com/support/home#/You can also use Amazon CloudWatch to monitor and collect metrics around API throttling, or you can set alarms that are triggered when API throttling limits are reached.View this documentation for further guidance on monitoring API requests using Amazon CloudWatch: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/monitor.htmlAs for terminating your instances, the maximum bucket capacity is 1000 and the bucket refill rate is 20. This means after 1000 instances are terminated, you will be able to terminate a maximum of 20 instances every second. That being said, you can terminate 1000 instances in a single request to delete instance fleet, but you can only delete up to 25 instant fleets in a single request. If that number is exceeded, no instant fleets are deleted and an error is returned.Additional information provided here:https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TerminateInstances.htmlhttps://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFleets.htmlPlease contact us if you have any further questions, and feel free to reach out to us via a support case to facilitate a discussion on the specifics of your resources: https://console.aws.amazon.com/support/home#/case/create?issueType=technicalCommentShareMaria_Eanswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: Network Firewall

"Using network firewall, shall we get a centralized ingress & egress traffic filtering management option for VPC level as well as subnet level ?orwe need to create a network firewall for each VPC to manage ?FollowComment"

Answer: "0Firewall Manager support 2 deployment models for Network Firewalls - Centralized and Distributed. Centralized deployment model create one central firewall in a central inspection VPC. All traffic from VPCs will then come to this central VPC for traffic inspection. Distributed deployment model creates one firewall in each of your VPCs and traffic is inspected at VPC level. There is also a hybrid method where, you create a central inspection VPC for baseline protection while some VPCs have additional local inspection.Please refer to https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall/ for detailed explanation of deployment models.CommentShareKaustubhanswered a year ago"


Question: Oracle RDS GRANT ISSUE for java.protocol.handler.pkgs

"Error while when executing exec dbms_java.grant_permission('myschema','SYS:java.util.PropertyPermission','java.protocol.handler.pkgs','write');Error Details :ORA-29532: Java call terminated by uncaught Java exception: java.lang.SecurityException: policy table update SYS:java.util.PropertyPermission, java.protocol.handler.pkgsORA-06512: at "SYS.DBMS_JAVA", line 705ORA-06512: at line 129532. 00000 -  "Java call terminated by uncaught Java exception: %s"*Cause:    A Java exception or error was signaled and could not beresolved by the Java code.FollowComment"

Answer: "1Java implementation in Amazon RDS has a limited set of permissions. The master user is granted the RDS_JAVA_ADMIN role, which grants a subset of the privileges granted by the JAVA_ADMIN role. java.util.PropertyPermission in RDS Oracle is limited to http.* and https.*You can see the permissions it has by looking into the permissions granted to RDS_JAVA_ADMIN role using this querySELECT name FROM dba_java_policyWHERE grantee IN ('RDS_JAVA_ADMIN', 'PUBLIC')AND enabled = 'ENABLED'ORDER BY type_name, name, grantee;If you must use this functionality in Oracle database, you can consider Amazon RDS Custom for Oracle  https://aws.amazon.com/rds/custom/CommentShareAWS-yl-lfcanswered 9 months ago"


Question: Pending verification workmail/ses route53

"Hi I have a domain on Route53  "darwana.com" I want a email address in the format foo@darwana.com so I decided to use workmail to get it. Workmail can autopopulate all the necessary records like the TXT record in Route53 and when I checked it correctly put them there. I tried to set it up 2 days ago and it was stuck on pending verification. It was still stuck on pending verification today so I deleted the domain and tried again with SES this time but its still stuck on pending verification for 5 hours. I watched a youtube video and the guy in the video got past pending verification stage in 5 minutes. I have the correct TXT, MX, and CNAME records in Route 53 with the correct values. I got this domain from Route 53 on May 21I tried the troubleshooting page and it told me to use nslookup but it says nonexistent domain.https://www.nslookup.io/dns-records/darwana.com#cloudflareIf I delete all the records and try to do auto setup again I get this error:Automatic configuration is not available because this domain's publicly-registered name servers do not point to your hosted zone in Route 53.It has been more than 72 hours since I got the domain on Route53Tried to manually add the TXT record as well and wait it still didn't workThis is what nslookup showsnslookup -type=TXT _amazonses.darwana.comServer:  redactedAddress:  redacted*** Redacted can't find _amazonses.darwana.com: Non-existent domainEdited by: jptboy on May 24, 2021 6:03 PMEdit: My colleague changed the DNS provider from Route53 to netlify causing this. I didnt know about itEdited by: jptboy on May 24, 2021 6:26 PMFollowComment"

Answer: 0Colleague did something without me knowingCommentSharejptboyanswered 2 years ago


Question: Debugging FAILED status in Fleet

"Greetings!I am having difficulty determining the cause of the FAILED status in my fleet.I am currently attempting to deploy a new fleet via a build. After activating, the fleet moves to a FLEET_STATE_ERROR status - specifically:FLEET_STATE_VALIDATING (1m 34s)FLEET_STATE_BUILDING (1s)FLEET_STATE_ACTIVATING (59m 53s)FLEET_STATE_ERRORI suspect that the problem could be either the amount of time the ACTIVATING part takes (it seems long to me), or that I'm using AWS-SDK within my build.However, the Events Log only tells me the status, and does not show me any log files that I can view.I also puttied into the fleet to see what's there. I can see the game scripts, but I could not find any indication of logs files (they may be there - I am not a Linux expert so I may have missed them).Is there a way to view the logs on the building of the fleet so I can determine the cause of the failure?Thanks.FollowComment"

Answer: "0ACTIVATING -> ERROR means your server didn't complete the InitSDK, ProcessReady hooksSo to debug:Firstly, look at the Fleet events and check the log from your install.sh fileNow look to see if there are other fleet events, that may indicate that your server process couldn't be started/crashed/failed to health check etcYour build is run out of /local/game so your logs should be there thought it could be that your server build is trying to log to a location outside of this area and so won't produce logs.Potential Next steps:Ensure your server produces logs when hosted on GameliftTry manually running your server on the GameLift instance to see if it starts up as expected (a lot of fleet activation issues are to do with missing dependencies such as dlls, bad executable launch paths etc)If you are building locally on Linux ensure you are correctly testing your packaged builds as closely as they are run on GameLiftDouble check your GameLift integration with GameLift local which covers some of this stuff.CommentSharerePost-User-5332620answered 3 years ago0If you are a really stuck and this is urgent, you can open an issue with GameLift support and they can probably look at your fleet. Otherwise, I would try getting logs working so you can see where in the process your fleet may be failing.CommentSharerePost-User-5332620answered 3 years ago0Thanks for the reply. Luckily, it's not urgent, and I'm still trying to learn the ins and outs of this Build system.The short answer is that there is not an install.sh file, as the entire package was downloaded. Earlier, I had tried with an install.sh file that had "#!/bin/sh \ npm install" (2 lines), and the Events log returned a 127 error. I took that to mean that "npm" wasn't found. So the second try I attempted to load the entire package, node_modules and all. I'd rather not do that, but I'm testing different options.The package currently works on my local Ubuntu server.Previously, I created my fleets from uploaded scripts (simple scripts to test communications) with great success. However, now that I'm using aws-sdk so I can access my Dynamodb servers, I needed to add aws-sdk to my package. It's too large to upload as-is via a script (limit of 5m), so the Build process is how I'm attempting to do now.CommentSharerePost-User-4791998answered 3 years ago0Sorry should have asked if you were using GameLift with your own servers or GameLift with realtime scripts.For realtime scripts I would start with a working version and work from there.Adding the AWS SDKs can be tricky and obviously if you have a require only something thats not there, eveything may fail / break before logging is started, which is what you are seeing.See end of this thread for advice: https://forums.awsgametech.com/t/how-do-i-access-dynamodb-or-lambda-from-a-real-time-server/6839/16Let me know if that helps as I would guess its how you are packaging the SDK and referencing that is breaking your fleet (and logging)CommentSharerePost-User-5332620answered 3 years ago0Thanks.I saw that post a few days ago. I decided to first go through the motions to learn what the Build was all about, as I only launched fleets from Scripts before.The only thing I don't understand yet is why the build that had the entire node_modules included with it (so no npm install required) still failed to activate the fleet and why it took almost an hour to run the activation. Fleets without the node_modules took less than a minute before failure (which I expected since AWS would have been undefined).I've got time to continue to look into it. If I find a solution, I'll post.CommentSharerePost-User-4791998answered 3 years ago0Update:I created a build that had the absolute bare minimum - a single install.sh file with a "Hello World" echo in to, piped to a file, and a main.js file with nothing but "logger" statements to append to a log file. Does nothing else - no AWS, no game logic, no nothing.Still, after an hour of Activating, I get a FAILED status with no indication whatsoever what could have gone wrong.The build boots and works in my local GameLift implementation. I also know that, from previous tries, I can launch the fleet from a script file. But the same script will not work when using a Build.So I don't know how to even proceed. Without any logs telling me why it failed, I'm at a loss to debug and fix the problem.Is there any possible way to get a hold of the logs generated during the "Activating" phase?CommentSharerePost-User-4791998answered 3 years ago0Can you provide your fleet id? I can get the GameLift service team to take a quick for you.CommentSharerePost-User-5332620answered 3 years ago0Certainly! Here you go: fleet-******I hope it's just something dumb I've done. :slight_smile:CommentSharerePost-User-4791998answered 3 years ago0Thanks. I opened an issue with the GameLift service team and hope to get an update soon.CommentSharerePost-User-5332620answered 3 years ago0From our logs, I found that the executable is /local/game/main.js. For a fleet created from a build to function correctly, the launch path should point to a valid executable. I don't believe the main.js can be executed directly.You can check locally if a build you want to upload can be successfully executed:sh /path/to/your/executable argumentsAlso, you mentioned that a fleet created from a build with node modules included also went into ERROR state. Can you give me the ID of that fleet?CommentSharerePost-User-3854098answered 3 years ago0Thank you for you reply. I didn't realize that the build worked differently from using scripts to create your fleet. The fleet that used the full node_modules will show the same problem as the bare-bones fleet, so there's no need for you to investigate - you'll find the same thing.I did just try this for the launch path: /local/game/startup.sh...with startup.sh being the following:#!/bin/bashnode main.jsThis produced the same results. I'm going to try again and specify the path to the node executable directly, and see if that makes a difference. I'll let you know.It may be since I'm using only Node, that I'll just stick to uploading scripts and building fleets from that.CommentSharerePost-User-4791998answered 3 years ago0An update:The last thing I tried was having the launch path execute the following:#!/bin/bash/local/NodeJS/bin/node /local/game/main.jsAnd I get the same results.Since my realtime server is nothing more than JS files, I don't believe that going the Build path is correct for me, as it appears to need an entire server. The whole purpose of me even thinking about using Builds was so that I could, somehow, run npm install from my application and install aws-sdk. That appears not to be possible, at least within my current knowledge of Builds.But that takes me back to Square 1. I can't load aws-sdk  with my server as there is a 5m limit on scripts (mine would be about 6.8). And I can't load in aws-sdk manually after fleet creation because the init() call creates a GameSession, which imports aws-sdk, therefore it must be available upon server boot-up.At least I know why the fleets are failing. :slight_smile:CommentSharerePost-User-4791998answered 3 years ago"


Question: HTTPS Front End on a different host connecting to AWS Elastic Beanstalk Backend

"I have an Angular app I developed hosted on a separate web host (Hostinger, so not AWS). It is using the HTTPS protocol. The backend for this is a Node.JS/Express app hosted on AWS Elastic Beanstalk.I am trying to communicate from the app to the backend using GET/POST/DELETE etc via API calls. however because the Front End is hosted on HTTPS and the AWS EB is HTTP the two are not communicating with each other. Whenever I set my app to HTTP it works perfectly, so it does seem to be the SSL that is the issue.My webhost says it is nothing on their end that is preventing it functioning correctly, and to ask whether it might be something on this end. I have asked on stackoverflow but in the 24 hours since asking the question hasn't gained much traction so thought I would try here.Is there something I can do in AWS, some setting, that prevents requests from a HTTPS connection? Looking at my log files the requests are not being processed, so its not a problem out of AWS (yet) but a problem with the AWS service receiving the data. I think I could perhaps use load balancing and modify the domain to HTTPS but I'm not looking to pay for the backend right now (which I appreciate does limit my options!).Thanks for any help,BogoFollowComment"

Answer: "0Make sure your Security Groups are allowing port 443 traffic to your instance/load balancer. For additional security, if your front-end has a static IP, consider restricting traffic from just that IP address.CommentShareJohn Voldanswered a year agoBogomip a year agoHi,Thanks! That sounds exactly like what I need, except it didn't seem to work... I added an inbound security rule and added it to the instance.... I dont have a load balancer.The settings were:Type - HTTPSProtocol - TCPPort Range - 443Source - 0.0.0.0/0 (just until it works!)But also once it was added and reloaded it was the same thing, connection refused. I think its still refusing the connection because nothing is happening in the node logs, when it should have output of a login.BogoShare0If you are using single Instance environment and trying to use HTTPS , you need to make sure that SSL termination is happening on the back end EC2 instance.  This link may help:   https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-singleinstance-nodejs.htmlIf configuring SSL on the instance is challenging for some reason, you may  switch to using a Load Balanced environment and terminate HTTPS on the Load Balancer instead of the back end.  https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https-elb.htmlCommentShareAWS-User-4371428answered a year agoBogomip a year agoThanks for the help, but reading these, and trying to go down the route makes me think aws isnt for me. I dont know half the jargon being discussed in these things, trying to make a load balancer asks me to make targets and other things - I get 750 hours of load balance free but it forces me to select two instances so I would always have to pay?This is more than I want to learn right now so im gonna go pay for an easier, more straightforward server.Thanks for the help though.Share"


Question: Athena DocumentDB with GeoJSON data not working

"We have connected Athena to a DocumentDB cluster with GeoJSON data stored inside.When trying to query these data we're getting following error:GENERIC_USER_ERROR: Encountered an exception[java.lang.RuntimeException] from your LambdaFunction[arn:aws:lambda:eu-west-1:<>:<>] executed in context[S3SpillLocation{bucket='<>', key='<>', directory=true}] with message[Error while processing field geoPoint]Is there any way to query GeoJSON data in DocumentDB from Athena?Query id: 138f4f39-a8d0-4cff-b0a3-357d2d310196FollowComment"

Answer: "0Hello,The error - [Error while processing field geoPoint]seems to hint at syntax issue in processing the field geoPoint.However, to be able to troubleshoot this further, our team would require information on the version of the connector, CloudWatch Logs of the Lambda Function, and metadata definition to be able to troubleshoot this issue.Hence, could you please create a support case with our Athena team instead so that we may discuss details on your resource configurations?Please do not post any sensitive information over re:Post since this is a public platform.Additionally I would also recommend checking the following AWS Docs and Github space to reach out to the developers directly for Amazon Athena DocumentDB Connector issues -https://github.com/awslabs/aws-athena-query-federation/tree/master/athena-docdbhttps://aws.amazon.com/blogs/big-data/query-any-data-source-with-amazon-athenas-new-federated-query/https://docs.aws.amazon.com/athena/latest/ug/connectors-docdb.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/athena-generic-internal-error/As always, feel free to reach back with any further questions or concerns in the meantime!CommentShareSUPPORT ENGINEERYash_Canswered 8 months ago"


Question: AWS Glue RDS to single file CSV

"I have a very basic AWS Glue ETL job that I created to perform a SQL select transformation and export the results in CSV format. This works, however; the output generates around 20 unique files and since the dataset only has two rows in it right now this is problematic. My requirement is to have a single CSV file that contains all of the data selected from the dataset. I have tried both repartition and coalesce function unsuccessfully. I am able to generate the single file, but my data is missing. Most likely because it is in a different partition. I am new to AWS Glue and have been unable to figure this out so any suggestions will be much appreciated.import sysfrom awsglue.transforms import *from awsglue.utils import getResolvedOptionsfrom pyspark.context import SparkContextfrom awsglue.context import GlueContextfrom awsglue.job import Jobfrom awsglue import DynamicFramedef sparkSqlQuery(glueContext, query, mapping, transformation_ctx) -> DynamicFrame:    for alias, frame in mapping.items():        frame.toDF().createOrReplaceTempView(alias)    result = spark.sql(query)    return DynamicFrame.fromDF(result, glueContext, transformation_ctx)args = getResolvedOptions(sys.argv, ["JOB_NAME"])sc = SparkContext()glueContext = GlueContext(sc)spark = glueContext.spark_sessionjob = Job(glueContext)job.init(args["JOB_NAME"], args)# Script generated for node PostgreSQLPostgreSQL_node1644981751584 = glueContext.create_dynamic_frame.from_catalog(    database="newApp",    table_name="database_schema_staging_hdr",    transformation_ctx="PostgreSQL_node1644981751584",)# Script generated for node SQLSqlQuery0 = """select * from myDataSource"""SQL_node1644981807578 = sparkSqlQuery(    glueContext,    query=SqlQuery0,    mapping={"myDataSource": PostgreSQL_node1644981751584},    transformation_ctx="SQL_node1644981807578",)# Script generated for node Amazon S3AmazonS3_node1644981816657 = glueContext.write_dynamic_frame.from_options(    frame=SQL_node1644981807578,    connection_type="s3",    format="csv",    connection_options={"path": "s3://awsglueetloutput/", "partitionKeys": []},    transformation_ctx="AmazonS3_node1644981816657",)job.commit()FollowComment"

Answer: "1Two rows? Spark is overkill. Use the glues other job type pythonshell with aws-data-wrangler and export a single CSV file to s3 location.https://docs.aws.amazon.com/glue/latest/dg/add-job-python.htmlyou will need to add awswrangler as a package but this is how to do that.https://aws-data-wrangler.readthedocs.io/en/2.14.0/install.html#aws-glue-python-shell-jobsimport awswrangler as wrimport pandas as pdcon_postgresql = wr.postgresql.connect("aws-data-wrangler-postgresql")df = wr.postgresql.read_sql_query("SELECT * FROM public.tutorial", con=con_postgresql)con_postgresql.close()bucket='your-bucket'path = f"s3://{bucket}/csv/file.csv"wr.s3.to_csv(df, path, index=True)CommentSharejb-poanswered a year ago"


Question: Public IP(s) or range for ELB

"Is it possible to acquire the public IPs or IP range assigned to an Elastic Load Balancer? If so, are these IPs static or dynamic to scaling and underlying hardware?FollowComment"

Answer: "0The Public IPs assigned to an NLB are static and do not change during the life of the load balancer.When you create an internet-facing load balancer, you can optionally specify one Elastic IP address per subnet. If you do not choose one of your own Elastic IP addresses, Elastic Load Balancing provides one Elastic IP address per subnet for you. These Elastic IP addresses provide your load balancer with static IP addresses that will not change during the life of the load balancer. You can't change these Elastic IP addresses after you create the load balancer.Reference: https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.htmlAs for ALB, see this Knowledge center article: https://repost.aws/knowledge-center/alb-static-ipCommentShareEXPERTTushar_Janswered 22 days agoBrettski-AWS EXPERT22 days agoThis is true for NLB but not for Classic or Application Load Balancers - for ELB (as the question mentions) the public IP addresses can change.ShareTushar_J EXPERT22 days agoThanks Brett, I missed that part; editing my answer.Share"


Question: Aurora Serverless MySQL - Supported Options

"A customer would like to use Aurora Serverless for MySQL with the below features, looks like Aurora does not support these features yet. Kindly confirm and suggest if there is any alternative ways to achieve these.Aurora Mysql ReplicasRestoring a snapshot (For Recovery or Point in time restore , e.g someone delete the database or table accidentally)Performance InsightThank You,FollowComment"

Answer: 0Accepted AnswerAurora MySQL serverless does not support features like Aurora MySQL replicas since binlog formatting is not configurable.It does not support performance insights at the moment.However you can take a snapshot and also perform Point In Time Restore [PITR] on a Aurora MySQL serverless cluster.https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.html#aurora-serverless.limitationsCommentShareAWS-User-0982004answered 3 years ago


Question: "How can we create thousands of Lambdas, beyond quota limits?"

"Hi everyone,For our requirement we need to create thousands of Lambdas for our customers. Currently AWS Lambda quota limits allow only 300 (max 600) Routes and 600 API's per region. I wonder how Vercel (which is deploying millions of Lambdas for their customers) is doing it on AWS ?Any suggestions or information would be highly appreciated.Thank youFollowComment"

Answer: "0I can't speak for the example you give but in general the answer is: Use multiple accounts.While we can increase the limits for some services well beyond what the defaults are, there will be side-effects. For example, having so many Lambda functions in a single account means that the concurrency limits will affect how many of those can be run at once and that (in turn) affects how you scale. Note that this is true of any account running many workloads - they can potentially get in each other's way as the limits are reached.Again, limits can be increased but at some point it's better to be running those workloads in separate accounts so that they can scale independently of each other.Account separation also means that you can delegate administration duties much easier, rather than trying to scope IAM policies to individual Lambda functions.Is there overhead in running multiple accounts? Absolutely. But at the scale you're talking (thousands of functions) I would assume that you have a level of automation for those functions; and therefore you can automate the cross-account activities as well.CommentShareEXPERTBrettski-AWSanswered a year agoTealpod a year agoHi,Thank you for such detailed comment. First thing I already spoke and requested for quota increase, but customer support said 600 is the max.The main issue with multilple accounts is automation and managment. I want to make it fully automatic. And it is very difficult to have hundreds of accounts(assuming separate account for each user). That will difficultly in resource managment and billing aswell.ShareBrettski-AWS EXPERTa year agoI agree: there is a level of complexity when running multiple accounts. In the long term that complexity is far less than the challenges faced by running everything in one account. It's worth going down that path - a little hard work now means a lot less pain later. In my opinion, billing becomes easier: If you split the accounts across various subsystems it's now simple to allocate costs based on how much each account is consuming.Share0There is facility to request for increase in quotas under account in the console. See if you can request for what you want. If not, reach out to support and get their guidance.CommentShareSandeepVudataanswered a year agoTealpod a year agoHi, I requested for quota increase and spoke with customer support aswell, they said they cant increase beyond 600. Thank you.Share"


Question: Writing to a String Set from Lambda

"I want to write a string set into a DynamoDB table from a Lambda function using table.Put. The best I've come up with so far is: def WriteToDB(self):                        table.put_item(Item={'RecordingID':self.recordingID,                            'ANI':self.ani,                            'DNS':self.dns,                            'StartTime':self.startTime,                            'EndTime':self.endTime,                            'Duration':self.duration,                            'FilePath':self.filePath,                            'Direction': self.Direction,                            'AgentIDs': "'SS': ['test','test4']",                            'QueueIds': self.QueueIds,                            'CreatedTime': str(datetime.datetime.now())                            })It's the AgentIDs field I'm concerned with. It's surely just a matter of formatting, and I'm working from here; https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/dynamodb.html#DynamoDB.Client.put_item, but I just can't get it. Can someone tell me what the correct formatting is?FollowComment"

Answer: "0The documentation you've linked to is for the DynamoDB Client put_item rather than the Table resource put_item - they are a bit different and you can see that in the documentation.I also think that the "string set" as described in the documentation is actually a Python list. Try doing this: 'AgentIDs': ['test','test4']CommentShareEXPERTBrettski-AWSanswered 5 months agoNick 5 months agothanks, that worked after I'd got myself untangled from all the quotation marksShare"


Question: x86 based ubuntu migration to graviton (t3a.xlarge t0 t4g.xlarge)

"Hello there,i have currently** t3a.xlarge** instance running Ubuntu and would like to migrate to a **t4g.xlarge **to take advantage of performance of Graviton.I am running Java and MySQL db.How can I migrate it with minimal change?ThanksFollowComment"

Answer: "0Minimal change to system will be hard to achieve here: different instructions set at h/w level means different binaries for the whole stack. But, your Java jars will remain identical. On data side, you may want to use DMS to migrate quasi transparently (DMS can run will application is running). You may also consider RDS / Aurora serverless (which is pay as you use) to be able to use a smaller graviton instance.CommentShareDidier_AWSanswered 2 months ago"


Question: Database restore feature is BROKEN - currently awaiting support

"Warning to users, point in time recovery might be broken!I've just had a MySQL instance run out of space with connection not available. I'm trying to restore using point in time onto a larger instance but I'm getting the following error:CreateRelationalDatabaseFromSnapshot [eu-west-2]The sourceRelationalDatabaseName must be specified together with restoreTime or useLatestRestorableTime.InvalidParamsI have checked DevTools and the sourceRelationalDatabaseName is correct and is being sent in the request payload.I'm awaiting technical support - as an aside, if you upgrade it might take up to 24 hours for it to take effect, which needless to say, is the one time you don't want to wait!If anyone can look into case 6174685581 it would be much appreciated. Of all the features to fail, restore shouldn't be one of them!HopefullyFollowComment"

Answer: "0As a follow-up, this has been escalated - regardless of using the web or cli I am getting this error.An error occurred (InvalidInputException) when calling the CreateRelationalDatabaseFromSnapshot operation: The sourceRelationalDatabaseName must be specified together with restoreTime or useLatestRestorableTime.(All parameters double-checked)At this moment it appears that point in time recovery is broken entirely unless the API is throwing the wrong error when the disk is full??? Seems very unlikely...CommentShareGregRobsonanswered 4 years ago0Thanks for reporting the issue. We are looking into the issue and will work toward a fix as soon as possible.Thanks,SteveCommentShareAWS-User-2776000answered 4 years ago0Just wanted to say thanks to AWS Support, once we were on the Business plan and I could demonstrate over a web chat that it was definitely nothing on my end that was wrong they very quickly amended my Lightsail RDS instance so that it could accept connections again.CommentShareGregRobsonanswered 4 years ago0The fix for the issue you mentioned was released. It's great to hear that your issue is resolved. Thanks for reporting the issue to us.CommentShareAWS-User-2776000answered 4 years ago"


Question: How do you emit trace spans from OpenSearch

How do you configure AWS OpenSearch to emit trace spans for e.g. Datadog APM or AWS X-Ray?(Note this question is NOT about getting traces into OpenSearch.)FollowComment

Answer: "0Hi,Thanks for reaching out to us. Amazon OpenSearch does export its metrics to Cloudwatch, and  3rd party services (like Datadog) can read from Cloudwatch metrics. So you can configure the datadog to read those metrics. You have to check which metrics they are interested in monitoring. Heres the list of available ones: https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-cloudwatchmetrics.htmlPlease note that CloudWatch will charge for extra API calls (like metrics reads, dashboards, alarms, etc) so if the 3rd party tool keeps polling CloudWatch API constantly for Opensearch metrics, you will be charged accordingly.Thank you!CommentSharerePost-User-0932732answered 6 months agoFlorian 6 months agoThanks for your answer.However, I was not asking about metrics.I was asking if AWS OpenSearch can emit distributed trace data, e.g. for AWS X-Ray.I want to be able to see how much OpenSearch contributes to the latency of individual requests.Can AWS OpenSearch emit the necessary span data to import and display in a distributed trace like in AWS X-Ray?Share0Hi,Thanks for reaching back. Please note that AWS OpenSearch unfortunately does not have the feature to emit trace data directly. However you can view the latency by the cloudwatch metrics like SearchLatency [1]. This can be visualized using Datadog but not AWS X-ray.Thank you!Referenceshttps://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-cloudwatchmetrics.html#managedomains-cloudwatchmetrics-instance-metricsCommentSharerePost-User-0932732answered 6 months ago"


Question: Issue in Unpivot of JSON column in Glue Databrew

"Unpivoting the JSON column in Databrew removes JSON keys in the result. This was working a 10 days back.FollowCommentChiranjeevi_N SUPPORT ENGINEER3 months agoHello, would you be able to share some sample dataset and steps to reproduce the issue ?Share"


Question: On Bitnami's Jenkins Run Docker Commands in Jenkins shell ubuntu

I was trying to run docker during jenkins build rather then using docker plugin i was searching to run docker's command in shell.bitnami jenkins use tomcat user and for ssh login it use bitnami default username.I have purchased jenkins from bitnami on aws ec2. I was facing User permission issue and tried lots of solution & searched for 2 days.I did changes in sudoers file using sudo Visudomade new user with jenkins name try to change default user in jenkin shellRemoved Tomcat user name form ubuntuI was knowing it is only permission issue but i was stuck on user permission of shellFollowComment

Answer: 0Accepted AnswerJust simple Do ssh login to instanceopen terminalchange to jenkin shell default usersudo chmod 777 /var/run/docker.sockCommentShareharshmanvaranswered 4 years ago


Question: AWS S3 bucket with limited access

"I want to have an S3 bucket that has limited access from users in our account. The contents of the files shouldn't be accessible to all users. We have the admins in a user group. I want to add a policy to a specific bucket that only allows users in that admin group to have access. How would one achieve this?I have looked at all the examples I can find online & I've read through posts here in re:Post, but I haven't found anything that fits what we're looking to do.FollowComment"

Answer: "0I would use tags on the principals instead of group membership with a bucket policy like this:{  "Id": "Policy1670278952233",  "Version": "2012-10-17",  "Statement": [    {      "Sid": "Stmt1670278950745",      "Action": "s3:*",      "Effect": "Allow",      "Resource": "arn:aws:s3:::bucket-name",      "Condition": {        "StringEquals": {          "aws:PrincipalTag/role": "admin"        }      },      "Principal": "*"    }  ]}CommentShareEXPERTkentradanswered 6 months agoacrookes-fe 6 months agoThank you for the response. This was helpful. This didn't work exactly as is, but a few small changes got it working.Changes:Having just allow didn't restrict access to people without the correct role tag. Changing this to a "Deny" and the condition to "StringNotEquals" blocks people without the tag.I was hoping to have this cover both access to the bucket and objects in that bucket. To do that I needed to add a 2nd resource for the items in the bucket.Shareacrookes-fe 6 months agoResulting policy:{    "Version": "2012-10-17",    "Id": "Policy1670282433764",    "Statement": [        {            "Sid": "Stmt1670282432513",            "Effect": "Deny",            "Principal": "*",            "Action": "s3:*",            "Resource": [                "arn:aws:s3:::bucket-name",                "arn:aws:s3:::bucket-name/*"            ],            "Condition": {                "StringNotEquals": {                    "aws:PrincipalTag/role": "admin"                }            }        }    ]}Shareacrookes-fe 6 months agoOne question about this approach I have. Since the principle is set to "*" will users in other accounts who have the correct tag be allowed to access the bucket?Sharekentrad EXPERT6 months agoThat's a good point. Add the ARN to the Principal to limit to users with your account.Share"


Question: what’s the current max number of 10G for a LAG

"What is the Current max number of 10G for a LAG, are there any document that you can help me out, any pros and cons on the same.FollowComment"

Answer: "0Accepted AnswerYou can have a max of 4 connections in a LAG, as outlined here:https://docs.aws.amazon.com/directconnect/latest/UserGuide/lags.html"You can have a maximum of two 100G connections, or four connections with a port speed less than 100G in a LAG. Each connection in the LAG counts towards your overall connection limit for the Region."CommentShareDaniel_Yanswered 3 years ago"


Question: Export user table in CSV

"Hello, I have a problem exporting the user table in CSV once I created an user with IAD (see the image in the attachments) I don't have the possibility to export the table in CSV.Furthemore I need information like Access Key ID (that is present as column but blank) and also I need Secret Access Key, in this case I don't have the column (I saw also in the hidden columns)My Test:Video From AWS:Access Key ID and Secret Access Key imported from CSVCan you please help me in this?Thanks in advance,RoccoFollowComment"

Answer: "0Hi Rocco,The option to download the CSV with the user information in the updated UI is on Step 4, prior to returning to the user list (see image below).  Once you have moved past that screen there is no option to download the CSV or retrieve the credentials.  However, access and secret jeys are not granted by default when creating a user but you can go into the user and set them under the Security Credentials tab and create a new access and secret.  Once you create them, or if you reset them at a later date, you will be given the option to download the CSV.Regards,ConorCommentShareconor_canswered 2 months ago"


Question: How to connect Codebuild to RDS database?

"Hi,My codebuild project should have access to my database. However, it fails to connect.I have tried following this tutorial: https://ctoasaservice.org/2019/01/23/aws-codebuild-and-access-to-rds/However it still didn't work. In the security group of my RDS instance I added a TCP inbound rule with: 35.157.127.248/29 using port range 0-65535.which should be the IP address of Codebuild in eu-central-1. What am I doing wrong?FollowComment"

Answer: "0The blog post you are following assumes your rds is accessible from the internetA better practise is to configure your codebuild project to use your VPC - See here.Basically a network interface for your codebuild job will be provisioned in your vpc and all communication will occur within your vpc (not over internet). The security group assigned to your codebuild project should allow outbound access to rds security group and the security group assigned to rds should allow inbound from the security group you assigned to codebuild projectCommentShareEXPERTPeter_Ganswered a year agoAWS-User-8611552 a year agoThank you for your help! I followed your instructions and configured my codebuild project to use my VPC. In addition, I added the security group of my backend to the codebuild project and allowed outbound access to rds the rds security group (TCP). I also added inbound connection to the security group of RDS to allow the security group of the backend (and code build).Now the building of codebuild actually stops in a phase earlier. In the DOWNLOAD_SOURCE phase it complains about timing out when fetching the source code from S3. I am thinking it is no longer allowed access?Share"


Question: Create a subdomain pointing to RedShit (Route53)

"Hello I currently have a Redshift Cluster and I need to my apps point to a subdomain instead of the Redshift cluster HOST. This redshift cluster is inside a VPC with gateway endpoint type. How do I create a route53 record inside my already existing hosted zone to do this?Already tried adding a CNAME record and poiting directly to the Redshift host,a but since its inside a VPC does not work.FollowComment"

Answer: "0HelloWhen you are accessing the Private entries from public DNS you can't so You can create a Private DNS in VPC, and Use this DNS inside the VPC it should work Please check the link to create the Private DNS https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.htmlThanksCommentShareGKanswered a year ago"


Question: Can Data Lifecycle Manager have precision in the schedule? What causes delay?

"I'm not sure if this is a bug or this is some other delay, but my intention is to take the snapshot at precisely 03:00 UTC and the schedule settings show this in the DLM settings, and I know snapshot completion time should obviously be after 03:00. However, the 'Started' time listed on the snapshot page in the console says it's 03:36 and the completion event is 03:43, for a snapshot taken with DLM's schedule. What is the point of setting the schedule if it's so off in its start?FollowComment"

Answer: 0Even in the sidebar for the DLM configuration page it saysSchedules can run:Schedules can be configured to run:daily at specific timesweekly on specific daysmonthly on specific dates or days of the weekyearly at the end or the start of specific monthsso much for specific?CommentShareh4xnoodleanswered a month ago


Question: Route 53 Name server not propagating ..for long days

"Hello there,I had registered a domain name www.dataflexi.com in aws long months back ago. I have created a static website it went well with out problems.When I tried to add a sub domain and it got failed and then I have leave it the action process.By doing this activities I have changed my assigned DNS server many times..Where as currently I have created new A record and DNS not propagating for long days may be weeks.Kindly do the needful..please clear the cache or troubleshoot my issue. This site can’t be reachedCheck if there is a typo in dataflexi.com.DNS_PROBE_FINISHED_NXDOMAINKindly do the needful.FollowComment"

Answer: 0Accepted AnswerIt looks like your domain name couldn't be properly resolved into IP addresses. One of the common reasons is that the Name Server is not correct.Currently the domain is assigned with the following NS:$ whois dataflexi.com   Domain Name: DATAFLEXI.COM   Name Server: NS-133.AWSDNS-16.COM   Name Server: NS-1505.AWSDNS-60.ORG   Name Server: NS-1638.AWSDNS-12.CO.UK   Name Server: NS-555.AWSDNS-05.NETPlease follow the step 3 in this doc https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-replace-hosted-zone.html and check if name servers are properly replaced (if you have recently moved to a new hosted zone.)CommentShareweidianswered 2 months agoMuthu 2 months agoThanks a lot .I could see the DNS propagating started and working now.Share


Question: Athena query from Lambda Function

Is it recommended practice to invoke Athena (dynamic) query (not saved query) from Lambda function for a custom Dashboard Application?FollowComment

Answer: "0Querying Athena from Lambda either from a saved/unsaved query may not make any difference for Custom Dashboard Application.To improve the performance of querying Athena, refer to the following blog:[+] Top 10 Performance Tuning Tips for Amazon Athena - https://aws.amazon.com/blogs/big-data/top-10-performance-tuning-tips-for-amazon-athena/And will recommend to refer this document for Lambda Best Practices:[+] Best practices for working with AWS Lambda functions - https://docs.aws.amazon.com/lambda/latest/dg/best-practices.htmlCommentShareSUPPORT ENGINEERSanath_Manswered 5 months ago"


Question: Postgres Read Replica (in a different region) Stuck in Deleting State

"Hello,I have a postgres database master (us-east-1) and read replica (us-west-2) created by terraform. During destroy, the master deleted fine but the read replica has been stuck in the "deleting" state for over 2 hours now. The database was practically empty. Is there anything I can do to force the delete? Should the read replica be deleted before the master?Thanks!FollowComment"

Answer: 0The delete has finishedCommentShareSamHoltonanswered 4 years ago


Question: How to connect to AWS IoT Core using AWS Embedded SDK from coreMQTT library using mbedTLS

"I am trying to connect my IoT embedded device to connect to AWS IoT Core MQTT broker by using AWS Embedded C SDK (https://github.com/aws/aws-iot-device-sdk-embedded-C).I can see that the SDK is using coreMQTT library. This library has dependency on the Transport layer which user need to provide. In the sample demo, the transport layer security is using openssl. Unfortunately I don't have it. I am thinking to use alternative, from online research, it seems mbedTLS is a good alternative. But I could not find online a sample using mbedTLS to connect to AWS IoT Core using coreMQTT. Could someone help me please.FollowComment"

Answer: "1Hi misterb.The fleet provisioning demo uses mbedTLS: https://github.com/aws/aws-iot-device-sdk-embedded-C/blob/main/demos/fleet_provisioning/fleet_provisioning_with_csr/mqtt_operations.c#L673lL692Implementation of the transport layer here: https://github.com/aws/aws-iot-device-sdk-embedded-C/blob/main/platform/posix/transport/src/mbedtls_pkcs11_posix.cYou can find more examples in the FreeRTOS and amazon-freertos repos.Please see here: https://www.freertos.org/network-interface.htmlThe transport interface implementations included in the FreeRTOS download are split into two files - a wrapper C file specific to the TCP stack, and a supplemental C file specific to using a TLS stack with the selected TCP stack. For example, to use FreeRTOS+TCP with mbedTLS, build sockets_wrapper.c from the network_transport/freertos_plus_tcp directory in the source code distribution, then build using_mbedtls.c from the using_mbedtls subdirectory.Available transports: https://github.com/FreeRTOS/FreeRTOS/tree/main/FreeRTOS-Plus/Source/Application-Protocols/network_transportmbedtls in particular: https://github.com/FreeRTOS/FreeRTOS/blob/main/FreeRTOS-Plus/Source/Application-Protocols/network_transport/using_mbedtls/using_mbedtls.cAnd part of the demos that use it: https://github.com/FreeRTOS/FreeRTOS/blob/main/FreeRTOS-Plus/Demo/AWS/Mqtt_Demo_Helpers/mqtt_demo_helpers.c#L614-L624The amazon-freertos repo contains embedded reference implementations for many boards. You can find a coreMQTT demo there: https://github.com/aws/amazon-freertos/blob/main/demos/coreMQTT/mqtt_demo_mutual_auth.cAn mbedtls transport implementation here: https://github.com/aws/amazon-freertos/blob/main/libraries/freertos_plus/standard/tls/src/iot_tls.cThe demo calls this through one of the secure sockets implementations:https://github.com/aws/amazon-freertos/blob/main/libraries/abstractions/secure_sockets/freertos_plus_tcp/iot_secure_sockets.chttps://github.com/aws/amazon-freertos/blob/main/libraries/abstractions/secure_sockets/lwip/iot_secure_sockets.cCommentShareEXPERTGreg_Banswered 10 months agomisterb 8 months agoThank you Greg_B for the details guideline. However I struggle to port this over to my embedded linux platform. What I did was using the demo https://github.com/aws/aws-iot-device-sdk-embedded-C/blob/main/demos/fleet_provisioning/fleet_provisioning_with_csr/mqtt_operations.c#L673lL692 as a reference. I include the necessary header file one by one, then try to resolve the compile/linking errors one by one but to no success, it seems quite a hassle. I wonder if there is a more straight forward approach? Any pointer would be appreciated.Share"


Question: AWS GLUE Image certificate related issue

"Hello Team ,I have created Docker compose file mentioned below :version: "2"services: spark:  image: glue/spark:latest  container_name: spark**  build: ./spark**  hostname: spark  ports:   - "8888:8888"   - "4040:4040"  entrypoint : sh   command : -c "/home/glue_user/jupyter/jupyter_start.sh"  volumes:  - ../app/territoryhub-replication:/home/glue_user/workspace/jupyter_workspace  Docker file which is getting called in build section is as follows :FROM amazon/aws-glue-libs:glue_libs_3.0.0_image_01USER rootRUN mkdir -p /root/.awsRUN echo "[default]\nregion=us-east-1" >> /root/.aws/configMy Docker is getting started but failing (sharing logs )Starting Jupyter with SSL/home/glue_user/jupyter/jupyter_start.sh: line 4: livy-server: command not found[I 2022-05-12 15:41:33.032 ServerApp] jupyterlab | extension was successfully linked.[I 2022-05-12 15:41:33.044 ServerApp] nbclassic | extension was successfully linked.[I 2022-05-12 15:41:33.046 ServerApp] Writing Jupyter server cookie secret to /root/.local/share/jupyter/runtime/jupyter_cookie_secret[I 2022-05-12 15:41:33.541 ServerApp] sparkmagic | extension was found and enabled by notebook_shim. Consider moving the extension to Jupyter Server's extension paths.[I 2022-05-12 15:41:33.541 ServerApp] sparkmagic | extension was successfully linked.[I 2022-05-12 15:41:33.541 ServerApp] notebook_shim | extension was successfully linked.[W 2022-05-12 15:41:33.556 ServerApp] All authentication is disabled.  Anyone who can connect to this server will be able to run code.[I 2022-05-12 15:41:33.558 ServerApp] notebook_shim | extension was successfully loaded.[I 2022-05-12 15:41:33.560 LabApp] JupyterLab extension loaded from /usr/local/lib/python3.7/site-packages/jupyterlab[I 2022-05-12 15:41:33.560 LabApp] JupyterLab application directory is /usr/local/share/jupyter/lab[I 2022-05-12 15:41:33.565 ServerApp] jupyterlab | extension was successfully loaded.[I 2022-05-12 15:41:33.569 ServerApp] nbclassic | extension was successfully loaded.[I 2022-05-12 15:41:33.569 ServerApp] sparkmagic extension enabled![I 2022-05-12 15:41:33.569 ServerApp] sparkmagic | extension was successfully loaded.Traceback (most recent call last):File "/usr/local/bin/jupyter-lab", line 8, in <module>sys.exit(main())File "/usr/local/lib/python3.7/site-packages/jupyter_server/extension/application.py", line 584, in launch_instanceserverapp = cls.initialize_server(argv=args)File "/usr/local/lib/python3.7/site-packages/jupyter_server/extension/application.py", line 557, in initialize_serverfind_extensions=find_extensions,File "/usr/local/lib/python3.7/site-packages/traitlets/config/application.py", line 88, in innerreturn method(app, *args, **kwargs)File "/usr/local/lib/python3.7/site-packages/jupyter_server/serverapp.py", line 2421, in initializeself.init_httpserver()File "/usr/local/lib/python3.7/site-packages/jupyter_server/serverapp.py", line 2251, in init_httpservermax_buffer_size=self.max_buffer_size,File "/usr/local/lib64/python3.7/site-packages/tornado/util.py", line 288, in newinstance.initialize(*args, **init_kwargs)File "/usr/local/lib64/python3.7/site-packages/tornado/httpserver.py", line 191, in initializeread_chunk_size=chunk_size,File "/usr/local/lib64/python3.7/site-packages/tornado/tcpserver.py", line 134, in init'certfile "%s" does not exist' % self.ssl_options["certfile"]ValueError: certfile "/home/glue_user/.certs/my_key_store.pem" does not existPlease help in resolving this asapMany ThanksFollowComment"

Answer: "0Hello Team,For now I have added DISABLE_SSL =TRUE as env variable which makes it work . But if there is better way please let me know if there is better way.CommentShareAWS-User-6494745answered a year ago"


Question: C5.4xlarge but AMD?

"I selected a c5.4xlarge instance. I noticed that I keep getting an instance based on an AMD CPU. Considering that my use case works better on Intel CPUs and that I am actually paying more by not selecting a c5a instance, I feel kind of tricked. Or am I overlooking something?FollowComment"

Answer: "0Hello,Amazon EC2 C5 instances are optimized for compute-intensive workloads and deliver cost-effective high performance at a low price per compute ratio.C5 instance sizes will launch on the 2nd generation Intel Xeon Scalable Processors (Cascade Lake 8223CL) or 1st generation Intel Xeon Platinum 8000 series (Skylake 8124M) processor with a sustained all core Turbo frequency of up to 3.4GHz, and single core turbo frequency of up to 3.5 GHz.You can get all detailed information like number of cores, threads per core, clock speed, type of hypervisor and many more from the Instance Types list, once you log in into AWS Console (Services -> EC2 -> Instance Types).CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months ago0Kindly check the reference here: https://aws.amazon.com/ec2/instance-types/c5/. Go to Product Details and you can select different tabs for different variants of C5.Selecting C5 instance family will always get you Intel processors.Selecting C5a instance family will always get you AMD processor and it is more cost conservative than C5.CommentShareapradanaanswered 9 months ago"


Question: Colon and hyphen symbols are classified as pronunciation instead of punctuation in Amazon transcribe

"Hi,When using Amazon Transcribe, we found the Colon and hyphen symbols are recognized as pronunciation instead of punctuation in the type of items from Amazon Transcribe result. Eg:"items": [    {        "start_time": "xxxx.xx",        "end_time": "xxxx.xx",        "alternatives": [            {                "confidence": "1.0",                "content": ":"            }        ],        "type": "pronunciation"    },    ...]or"items": [    {        "start_time": "xxxx.xx",        "end_time": "xxxx.xx",        "alternatives": [            {                "confidence": "1.0",                "content": "-"            }        ],        "type": "pronunciation"    },    ...]My understanding is that colon and hyphen should be classified as punctuation similar to comma and exclamation mark etc. But it's not the case in Amazon Transcribe results and the issue is reproducible on our end. BTW, in our case, the number "2" was mistranscribed as ":". The mistranscribing not our main concern but maybe related to the root cause of misclassification?My question is: are the two symbols (colon and hyphen) expected to be classified as pronunciation? If not, is there a plan of fixing it?FollowComment"

Answer: "0What did the speaker actually say that resulted in the transcriptions you describe? I can think of a few common scenarios where ":" and "-" should properly be considered "pronunciation" and not "punctuation".For example if a speaker said, "the ratio of oil to vinegar in a vinaigrette is three-to-one" a transcription looking like "the ratio [...] is 3:1" is appropriate. This would also explain the case of seeing "two" incorrectly transcribed to ":" in your example above.An example for the hyphen. The "-" symbol is a hyphen (punctuation) in some contexts but a minus sign (pronunciation) in others. So if a speaker said, "the temperature is minus five degrees," then a transcription looking like "the temperature is -5 degrees" could be appropriate.Homophones - words (or symbols) that are pronounced the same but are spelled differently - can be a challenge for speech-to-text transcription, especially if the spoken text uses domain-specific words and phrases. This is where Amazon Transcribe features like Custom Vocabularies and Custom Language Models may be worth looking into.CommentShareKrisanswered a year ago"


Question: how to increase expiration time of cognito identity pool credentials

I am using identity pool credentials to authenticate my requests to the API gateway. the problem is the credentials last for only 1 hour. Is there a way to increase the expiration time? I have searched for this answer but I am getting answers on how to increase the time for id token and access token of Cognito user poolFollowComment

Answer: "0Within the AWS Console, navigate to Cognito then navigate to your user pool, then the App Integration tab, and scroll to the bottom of the page to App Clients and click "edit" for existing App Clients or "Create" for a new App Client. In the top card labeled "App Client Information" click edit and you can change the timeout settings for all of the tokens:You can also do this with the AWS CLI and SDK:https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolClient.html#CognitoUserPools-CreateUserPoolClient-request-TokenValidityUnitsCommentShareMarc Schurichtanswered 8 months agomuramasa 8 months agobut it doesn't increase the expiration for identity pool credentialsShareMaksym 6 months agoI think the question was about the identity pool not user one, is there a way to do the same for identity pool?  In my case, I use identity pool to get temporary credentials for non-authenticated users and would like to control the token expirationShareminlaxz 12 days agoThis configuration is about the user pool's access and id tokens expiration time, not the Cognito identity pool.Share"


Question: [greengrass]cannot deploy greengrass CLI

"FAILED_NO_STATE_CHANGE: PackagingException: The deployment attempts to update the nucleus from aws.greengrass.Nucleus-2.6.0 to aws.greengrass.Nucleus-2.7.0 but no component of type nucleus was included as target component, please add the desired nucleus version as top level component if you wish to update the nucleus to a different minor/major versionFollowCommentrePost-User-5961099 8 months agothe json file msg is:{"targetArn":"***","components": {"aws.greengrass.Cli": {"componentVersion": "2.7.0","configurationUpdate": {"merge": "{"AuthorizedPosixGroups":"","AuthorizedWindowsGroups":""}"}}}}SharerePost-User-5961099 8 months agothere is no greengrass-cli in /greengrass/v2/bin or /greengrass/v2/packages/artifactsShare"

Answer: 0Accepted AnswerHi. Please see here: https://docs.aws.amazon.com/greengrass/v2/developerguide/troubleshooting.html#deployment-error-nucleus-minor-version-updateI think you are trying to install CLI 2.7.0 on a device with Nucleus 2.6.0. CLI and Nucleus version must match.CommentShareEXPERTGreg_Banswered 8 months ago


Question: "API Gateway, Lambda and CORS"

"I am running a few Lambda functions behind a load balancer (i.e. the Load Balancer is the Lambda Function's "source") which I intend to access from a web based SPA. I'm using API Gateway to proxy requests to my load balancer for other services (containers on ECS), and i was hoping to do the same for my Lambda functions.I've spent the past 2 days dealing with CORS issues with my containerized applications, and so, to avoid that when it comes to my lambda functions, I decided to ask here what might be the best path going forward.I cannot use the Lambda Proxy integration on API Gateway. It tells me that I do not have any Lambda Functions in my region (I assume this may be because the Lambda functions are deployed in a VPC, but i am not 100% sure on that).So, is it possible to access Lambda Functions via a Load Balancer through API Gateway proxy+ resources? My intuition says yes, but I'm running into CORS issues. If so, how can I manage CORS in this scenario?FollowComment"

Answer: "0To avoid CORS, i've had to create my own OPTIONS handler for each function.  The cheapest is just to echo the ORIGIN header back as authorized via CORS.  The better way is to have the api gateway on the same domain as the rest of the product. So in order to get rid of CORS errors I've used Cloudfront to forward requests to the API gateway.The explanation of your setup is a little vague, it shouldn't matter if its in a container or not.  CORS is all about browser action and if you are accessing a resource outside of the domain of your main web page.If you are using a program outside of a web browser-like interface then you wouldn't have any CORS issues.CommentShareRahlyanswered 2 years ago-1Don't bother answering.This product is effectively unusable. I will find another solution.CommentSharebradyperryanswered 2 years ago"


Question: How can i track bounce and complain SES email

"Hello,Is there any method to track bounce and complain ses email with less cost or without using any other aws service?AndTell me which methods from lambda, SQS, email, https etc list will be most useful and easy to get details of logs?FollowComment"


Question: When should I use Redshift non-Serverless over Redshift Serverless?

"With Redshift Serverless being announced, seems like this is should almost always be chosen. Are there any cases when Redshift non-serverless should be used?FollowComment"

Answer: "4As per Redshift Serverless documentation:Amazon Redshift Serverless is ideal when it is difficult to predict compute needs such as variable workloads, periodic workloads with idle time, and steady-state workloads with spikes. This approach is also a good fit for ad-hoc analytics needs that need to get started quickly and for test and development environments.Provisioned Redshift on the other hand may be suited for steady predictable loads.CommentShareHoussein_BAanswered a year agoEXPERTFabrizio@AWSreviewed a year agogflores1023 a year agoThank you, does RS Serverless support Spectrum?Share4In general, below two principles can be applied to any serverless vs provisioned deploymentGo for serverless, whenApplications that do not expect steady state and constant traffic, for Example, dev or test or adhoc projectApplication that expects steep spike or unpredictable demandIf application expects to be steady state with predictable demand then go for Redshift Cluster with RI'sCommentShareBhanu_Panswered a year agoEXPERTFabrizio@AWSreviewed a year ago"


Question: Can't delete specific Lambda@Edge version

"I do understand that Lambda@Edge can't be deleted unless they are de-attached from all other services including Cloudfront and when all replicas are deleted automatically.My problem is in my cleanup process I am disabling and deleting the cloudront distribution, removing S3 buckets, removing subdomains, removing logs, and when I check the Lambda@Edge replicas they are all gone, yet some of the functions got versions that can't be deleted so they stop the function from being deleted.For instance, any function that got version 5 and 7 will never be deleted, but all other versions can be normally deleted.Those versions seems somehow shared in some functions but not all, if any function got those versions it will never get deleted and will be stuck.What shall I do? It is been like that for around 5 days so far.An error occurred when deleting this version: Lambda was unable to delete arn:aws:lambda:us-east-1:041532632972:function:app-fix-a11y-issues:5 because it is a replicated function. Please see our documentation for Deleting Lambda@Edge Functions and Replicas.FollowComment"

Answer: "0Since you have deleted the associated CloudFront distribution 5 days ago, it looks like the Lambda@Edge association has not been cleared within the service. Can you open a support case indicating that your Lambda function cannot be deleted due to the lingering Lambda@Edge/CloudFront association? Also make sure to include the Lambda function ARN along with versions.CommentShareTaka_Manswered 9 months agoSameh Hady 9 months agoThanks for your reply, I am sure there is something wrong and I wanted to submit a ticket but the problem is my company's AWS account doesn't have support plan so I am not able to raise one :/Share"


Question: exec format error trying to use 64-bit ARM architecture for Fargate launch type

"I am trying to leverage Amazon ECS 64-bit ARM architecture for https://hub.docker.com/r/arm64v8/nginx and other arm64 images. However, I am getting the error: "exec user process caused: exec format error" during service creation phase. Fargate amd64 tasks with amd64 images run without this issue. According to this article - https://docs.aws.amazon.com/AmazonECS/latest/userguide/ecs-arm64.html my configuration must support 64-bit ARM workloads:Region: Asia Pacific (Tokyo) ap-northeast-1Fargate platform version: 1.4.0Docker composeversion: "3.9"services:  nginx:    image: "arm64v8/nginx"    x-aws-policies:      - "arn:aws:iam::aws:policy/AmazonSSMFullAccess"x-aws-cloudformation:  Resources:    NginxService:      Properties:        EnableExecuteCommand: true    NginxTaskDefinition:      Properties:        RuntimePlatform:          CpuArchitecture: "ARM64"          OperatingSystemFamily: "LINUX"FollowComment"


Question: DescribeDBCluster permission error when adding datasource

I am trying to add a datasource to my new GraphQl API using the "amplify api add-graphql-datasource" command. I am receiving the following error when I do.User: arn:aws:sts::101821158090:assumed-role/us-west-2_2vJlh9y73_Full-access/amplifyadmin is not authorized to perform: rds:DescribeDBClusters on resource: arn:aws:rds:us-west-2:101821158090:cluster:* because no identity-based policy allows the rds:DescribeDBClusters actionI can't seem to find the right role with the DescribeDBClusters action.FollowComment

Answer: "0Hi,Fortunately IAM Error messages are straightforward. We can see in the error message is described as "because no identity-based policy allows the rds:DescribeDBClusters action" - which means that the role you were using did not have rds:DescribeDBClusters as a permission in it's IAM policy, for example:{    "Version": "2012-10-17",    "Statement": [        {            "Action": [                "rds:DescribeDBClusters"            ],            "Effect": "Allow",            "Resource": "*"        }    ]}To solve this issue you can do two things:You can attach an AWS Managed IAM Policy to your role which will grant the permissions needed to perform that action, for example the "AmazonRDSReadOnlyAccess" policy. You can also attach other Managed Policies if you require additional permissions, such as "AmazonRDSFullAccess"From the IAM console, you can create a new policy [https://us-east-1.console.aws.amazon.com/iam/home#/policies$new?step=edit]. Using either the visual editor, or the JSON editor, you can then specify the permissions you need for accessing your RDS resources.If you're not sure what permissions are needed, then please have a look at this document:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_id-based-policy-examples.htmlHope this helps :)CommentShareMichaelanswered 6 months ago"


Question: Failure when adding apache-airflow-providers-opsgenie==3.1.0 in production

"When deploying our new requirements.txt file with "apache-airflow-providers-opsgenie==3.1.0" we see that on our Airflow Acceptance environment, this requirement is added. But in production we see that this is giving some problems, somehow in production this package is not being added to MWAA.Could you help us?Thank youTomasFollowComment"

Answer: 0Couple things to check here:is your production environment the same Airflow version as your acceptance environment?have you updated your production environment to use the appropriate requirements.txt S3 object version?have you checked the environment's scheduler log group for issues with the dependency installation?CommentSharetcsullensanswered 13 days ago


Question: What's the best practice for sharing videos hosted on Amazon S3 using presigned URLs?

"We're considering using presigned URLs to share videos hosted on Amazon S3. What's the best way to do that while still securely managing the endpoints?There are two use cases that present a potential security problem for us:If the user is streaming a video, the video starts off with an incomplete byte-range request of 0- to download the whole file. Then, if the user jumps ahead in the video, and the client hasn't yet received the bytes for that part of the file, another request to the same URL with a byte range starting from the part of the video the user has jumped to.If a download is paused halfway through the download natively in the browser and the user resumes the download after the initial request has expired, another byte-range request for the remainder of the content will be made.To support either of these use cases with a presigned URL, we'd need to keep the signing valid for the duration of the download, which is a concern from a security perspective.Is there a best practice for handling this?FollowComment"

Answer: "0Accepted AnswerConsider using Amazon CloudFront, which has enhanced singed URL features like custom policies. You can use the custom policies to restrict access to only the source IP address or address range, allowing you to more securely set a longer duration before the signed URL expires.For more information, see Creating a signed URL using a custom policy in the Amazon CloudFront developer guide.Note: Creating a signed URL using a custom policy in Amazon CloudFront is also great way to manage formats such as HLS/HDS because you can use wildcard characters.CommentShareEXPERTEvgeny-At-AWSanswered 6 years agoEXPERTsdtslmnreviewed 6 days agoAWS-User-6244055 7 months agoIs there a way to use a custom policy to sign the hls url in CloudFront and only sign the initial cloudfront url and not each individual underlying url in s3?Share"


Question: boto3 - unable to put string to s3 in EMR cluster - "Not a directory" error

"In a workflow where Airflow spins up an EMR cluster to run a PySpark job, in the job I attempt to copy a string to s3 using the boto3 api. I can terminal into the cluster, start pyspark and copy the string manually with no issues. However, when it runs in the job I get this error:botocore.exceptions.SSLError: SSL validation failed for https://my-bucket-name.s3.amazonaws.com/path/to/file.txt [Errno 20] Not a directoryThis exception is spawned from the following two stack traces in the urllib3 package:Traceback (most recent call last):  File "/usr/local/lib/python3.6/site-packages/urllib3/util/ssl_.py", line 322, in ssl_wrap_socket    context.load_verify_locations(ca_certs, ca_cert_dir)NotADirectoryError: [Errno 20] Not a directoryDuring handling of the above exception, another exception occurred:Traceback (most recent call last):  File "/usr/local/lib/python3.6/site-packages/botocore/httpsession.py", line 262, in send    chunked=self._chunked(request.headers),  File "/usr/local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 641, in urlopen    _stacktrace=sys.exc_info()[2])  File "/usr/local/lib/python3.6/site-packages/urllib3/util/retry.py", line 344, in increment    raise six.reraise(type(error), error, _stacktrace)  File "/usr/local/lib/python3.6/site-packages/urllib3/packages/six.py", line 686, in reraise    raise value  File "/usr/local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 603, in urlopen    chunked=chunked)  File "/usr/local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 344, in _make_request    self._validate_conn(conn)  File "/usr/local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 843, in _validate_conn    conn.connect()  File "/usr/local/lib/python3.6/site-packages/urllib3/connection.py", line 370, in connect    ssl_context=context)  File "/usr/local/lib/python3.6/site-packages/urllib3/util/ssl_.py", line 324, in ssl_wrap_socket    raise SSLError(e)urllib3.exceptions.SSLError: [Errno 20] Not a directoryI am at a loss for what is going on here. It appears to be some issue with the certs but I don't understand why it works manually but not through the job. Any insight would be greatly appreciated.FollowComment"

Answer: 0This was resolved by installing the certifi library to the EMR image.CommentSharejfaathanswered 4 years ago


Question: "Lightsail "sudo: no valid sudoers sources found, quitting""

"Hi,I did a mistake on my Lightsail instance running Ubuntu 18.04 and change the sudoers file - now I get this:sudo: parse error in /etc/sudoers near line 21sudo: no valid sudoers sources found, quittingsudo: unable to initialize policy pluginHow can I gain again access to "sudo"?Is there an option to ssh to the instance as root?Is there a way to attach the volume to the working machine and change "sudoers"?Any other option?ThanksAvnerFollowComment"

Answer: "1Accepted AnswerI FIXED IT! You basically build an instance from a snapshot, but add a launch script which runs as root to change the permissions on your sudoers file. Then you can edit sudoers as a non root user. Then you make another snapshot instance with another launch script that sets the permissions back to normal.create a snapshot of your instancecreate a new instance from the snapshot, but click on the +Add Launch Scriptadd the following launch script: chmod 777 /etc/sudoersConnnect to the instance and modify your sudoers file back too normal (you may have to wait a few seconds for the launch script to apply the permission change)rebootcreate a snapshot of the instancecreate another instance from the new snapshot, click on +Add Launch Scriptadd the following launch script: chmod 440 /etc/sudoersConnect to the instance and test sudo -s (you may have to wait again for the launch script to apply the permission change)Detach IP from original instance. Attach to new instanceReset all firewall rulesDelete other instancesCommentSharemcarambanswered 7 months agoAvner 7 months agoWorked perfectly - Thanks!Share0oh man that's a weird coincidence, I just did exactly the same thing tonight! I mangled my sudoers file cause I forgot I was supposed to use visudo not nano. Watching this for answers...CommentSharemcarambanswered 7 months ago"


Question: Service cancellation on EC2

"When terminating the instances, is the service in ec2 automatically cancelled?FollowComment"

Answer: "0If you are taking about ec2 instance only then yes it cancelled as soon as you terminate..But EBS volumes might depends how you terminate instance..CommentShareNitin Goyalanswered 5 months agorePost-User-3264557 5 months agoso should we unbind the ebs from the instance, then terminate the instance and the ebs?Share0When terminating an EC2 instance, you need to also terminate the EBS volume and any associated Elastic IPs if they were purchased.  See this article for more information: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-billing-terminated/CommentShareEXPERTChris_Ganswered 5 months agoEXPERTMatt-Breviewed 5 months ago"


Question: Set up Resque for Rails Production environment on AWS

"We have dockerized Rails application and It is deployed on AWS(using Fargate).Currently, we have Dev and Staging servers running on AWS. We use Resque for scheduling and queuing purpose. We do use foreman to start below processes once deployment is completed.DockerfileDocker CMD bundle exec foreman start -f Procfile.dev-server**Procfile.dev-server **web: bundle exec rails s -p 3000 -b '0.0.0.0' queues: bin/rake environment resque:work QUEUE=responsive_tasks scheduler: bin/rake environment resque:schedulerThis setup is good and working fine till staging environment. Foreman is not recommended for Production setup and might be issue when scaling would require as all 3 processes running on same machine.DoubtHow I can run all 3 different processes(web server, queues and schedulers) without Foreman once code is deployed on AWS for production?Shall I run Resque servers on separate instance with same Rails app code?FollowComment"

Answer: "0You can create separate ECS services for each of your processes i.e. web-server, queue, scheduler and leverage ECS Service Discovery feature for service-to-service communication. By doing this, you can manage the lifecycle of these individual processes separately and also perform application-autoscaling on each of these services separately.Note: Initiate your processes within the Docker ENTRYPOINT to make sure that the processes start during the container creation. By doing this, you will no longer require a process manager daemon like Foreman to manage your processes.For ease of deploying these ECS services, you can use docker-compose as demonstrated in the document: https://docs.docker.com/cloud/ecs-integration/Please add a comment if you need further clarification on the above approach.CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered a year ago"


Question: RDS reporting a lot more disk space than Postgresql

"Hello,My RDS instance (t2.medium running Postgresql) has been reporting a high drop in free disk space and I can't quite grasp why.As you can see from the plot (RDS Free Disk Space over the last 4 weeks) below, it suddenly spiked around the 23rd April.https://imgur.com/6KT6uDn.pngThe spike seen on the 28th is a result of both increased disk allocation for the RDS instance and of purging around 100gb of data.In fact, around the 23rd, we reprocessed a portion of the database (read up to 250GB from one table, and rewrote 24GB on another table, this process went on slowly for around 5 days). The process as since then stopped, but this rate continued.I've confirmed in pg_stat_activity, that there's no additional inserts going on, so there's no application level process still inserting or updating data.In fact, the sum of all database disk usage reported by Postgresql is around 675 GB (querying from pg_database_size and excluding rsadmin database, to which I have no access to by default), which is a bit off from what is being reported in the RDS dashboard (999GB allocated and 180GB free would be around 819GB)What I get from this is that my RDS instance is getting less and less free space, but that space isn't being used by Postgresql? Or is it being used in a VACUUM operation that I can't see?Appreciate any help, thanks in advance.Edited by: jeanlucpicard on Apr 30, 2021 8:33 AMFollowComment"

Answer: "0After following this guide https://aws.amazon.com/premiumsupport/knowledge-center/diskfull-error-rds-postgresql/, I was able to detect an inactive replication slot that was filling up this space that I reported.Following the instructions in the link to list the replication slot and drop it with pg_drop_replication_slot(). The space was instantly released.I'm still not sure why this replication slot popped up, but I figure it should be related to the heavy operations I was performing.CommentSharejeanlucpicardanswered 2 years ago"


Question: AWS X-Ray with Feathersjs api?

"Hi,I have a Feathersjs/eclipse Node.js API running on Elastic Beanstalk. I've just instrumented the app according to the "Getting Started" section on Node.js/eclipse. X-Ray tracing is already enabled for the Elastic Beanstalk app. I then deployed the newly instrumented app... and nothing is traced.Does anyone know if there is some additional instrumentation/configuration for Feathersjs app?FollowComment"

Answer: "1As per this official X-Ray documentation, currently supported middlewares are Express and Restify. Maybe Feathersjs has different handlers which are not instrumented in the current X-Ray NodeJS SDK.CommentShareprashatawsanswered a year ago"


Question: i  want  to launch a  instance  with  user data  but  not able  to  do

"Hi  everyone,I am  trying to launch a  Ec2  to  host a   sample  web app  over  so  i added  the code  in user data  before  launching  but  when i  trying to launch  it is  throwing me  some error  which i am  not  getting  how  to  manage,attaching  the  sample  error  imageRegards,Abhi.bFollowComment"

Answer: "1The error message is specific in stating that the t2.micro instance cannot be requested in AZ ap-south-1c. You need to launch the instance in either of ap-south-1a or ap-south-1b or change the instance type to a supported one in ap-south-1cWhen launching EC2 instance, if you don't make any changes to Network Settings the default for Subnet is "No preference (Default subnet in any availability zone)". Since AWS is trying to launch one in ap-south-1c, you need to override that auto assignment. You can edit that Subnet preference by editing the Network settings.--SydCommentShareSydanswered 5 months agoEXPERTkentradreviewed 5 months ago0Your user data looks fine and as per error you dont have t2.micro availability within the ap-south-1c , either you go for other az without specifying the az within configuration or you can also request to have t2.micro instances available in same az from support.One more option is change t2.micro to other instance type.. You can check the limit section to check what all availability of instances are there within your account.CommentShareShashank Abhishekanswered 5 months ago"


Question: SES issue with M365

We have been using the AWS SES service for username and password information for our customers.But some customers could not receive email and SES show up there is no Rejected email. But our exchange message has an error as attached. what is the problem?FollowComment


Question: NiceDCV connection gateway working example?

"Are there any complete examples of a NiceDCV connection gateway?  I'd like to run the gateway on a bastion host to connect to workstations on a private subnet.  It seems the connection gateway configuration requires a web-resources url, presumably in case of a web client, but the documentation doesn't indicate how to set it up, or what files to put there.FollowComment"

Answer: "1Hi,The web-resources-url  parameter is no longer required since DCV gateway version 2022.0, if you don't want the gateway to serve the DCV webclient you can omit it.We also added a basic configuration example and specific examples for each section in the gateway documentation:https://docs.aws.amazon.com/dcv/latest/gw-admin/setting-up-configuring.htmlBestCommentShareAWS-matteoanswered a year ago"


Question: Amplify build failing to get object from an S3 bucket in another account

"I am trying to get and Amplify build to pull a file from an S3 bucket in another AWS account. Both accounts live under the same organisation. The bucket in account A has the following policy{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "AllowGetObject",            "Effect": "Allow",            "Principal": "*",            "Action": "s3:GetObject",            "Resource": "arn:aws:s3:::bucket-account-a/*",            "Condition": {                "StringEquals": {                    "aws:PrincipalOrgID": "o-xxxxxxxxxx"                }            }        }    ]}Account B has the Amplify application with a service role attached and the following amplify.yml:version: 1frontend:  phases:    preBuild:      commands:        - aws s3api get-object --bucket bucket-account-a --key file.txt ./file.txt        - yarn install    build:      commands:        - yarn run build  artifacts:    baseDirectory: .next    files:      - '**/*'  cache:    paths:      - node_modules/**/*The build fails outputting the following error: An error occurred (AccessDenied) when calling the GetObject operation: Access Denied. I have seen that the service role assigned is being assumed and refers to account B, so I am not sure what I am missing or what is stopping this from working. I have tried removing the condition on the above policy and updating the Principal on the S3 bucket policy to the assumed role (arn:aws:sts::bbbbbbbbbbbb:assumed-role/staging-amplify-service-role/BuildSession), the Amplify service, even just without the account id (arn:aws:iam::bbbbbbbbbbbb:root), all producing the same error.Has anyone tried something similar?FollowComment"

Answer: "0Hello,Access Denied generally occurs because of permission related issues. In you scenario I would suggest to check the following:If the S3 bucket is encrypted with AWS KMS. Check if the KMS key policy allowed the other account to access.Does the IAM role created in account B has permissions for the S3 bucket. You have to add the S3 bucket in the IAM role policy.Check if the organisation does not have any restrictive policies.Please refer the below document[+] https://repost.aws/knowledge-center/s3-cross-account-access-deniedCommentShareSUPPORT ENGINEERUjjawal_Sanswered 2 months agoDanMitchell 2 months agoAlready done. I know the permissions set against the bucket are working as I can use the AWS CLI to get the object assuming a different role with account B. I have used a similar pattern of policies in a few places now and have not encountered any issue, but no matter what I have tried nothing is working within the context of an Amplify build.Share"


Question: Change instance from t2.nano to t4g.nano

"I wanted to change my current instance from t2.nano to t4g.nano. I tried by creating an AMI of t2.nano instance and launching an t4g.nano instance from it but didn't work, probably due to Architecture difference. Is it possible to do so by any other means ?FollowComment"

Answer: "1Difference in architecture may cause issues if you just mirror your application over from x86 to arm architecture. What I can think on the top of my head is to re-create/re-install your apps in the t4g.nano then rsync over the data from t2.nano to t4g.nano. Alternatively, create a snapshot out of the t2.nano and create volume out of that then attach that volume to a t4g.nano.CommentShareapradanaanswered 9 months ago0Hi,This documentation explains how to change the instance type: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-resize.htmlKind regards,MarilynCommentShareMarilynAWSanswered 9 months ago"


Question: OpenSearch _reindex giving null_pointer_exception

"I need to move an index from an ElasticSearch 6.8 domain to an OpenSearch 2.5 domain.  They are both in a VPC.For the ElasticSearch 6.8 domain in my account, I can see that I have an inbound connection under the Connections tab.For the OpenSearch 2.5, I can also see that I have the outbound connection with the aos-######.amazonaws.com link.I run the reindex query:POST /_reindex{  "source": {    "remote": {      "host": "https://aos-#########.us-west-2.es.amazonaws.com:443"    },    "index": "indexName-2023"  },  "dest": {    "index": "indexName-2023"  }}But receive back:{  "error": {    "root_cause": [      {        "type": "null_pointer_exception",        "reason": null      }    ],    "type": "null_pointer_exception",    "reason": null  },  "status": 500}I enabled the domain error logging and this is the stack trace:java.lang.NullPointerExceptionat __PATH__(StringBuilder.java:128)__AMAZON_INTERNAL____AMAZON_INTERNAL____AMAZON_INTERNAL____AMAZON_INTERNAL__at org.apache.http.protocol.ImmutableHttpProcessor.process(ImmutableHttpProcessor.java:133)at org.apache.http.impl.nio.client.MainClientExec.prepareRequest(MainClientExec.java:520)at org.apache.http.impl.nio.client.MainClientExec.prepare(MainClientExec.java:146)at org.apache.http.impl.nio.client.DefaultClientExchangeHandlerImpl.start(DefaultClientExchangeHandlerImpl.java:129)at org.apache.http.impl.nio.client.CloseableHttpAsyncClientBase.execute(CloseableHttpAsyncClientBase.java:116)at org.apache.http.impl.nio.client.InternalHttpAsyncClient.execute(InternalHttpAsyncClient.java:138)at org.opensearch.client.RestClient.lambda$performRequestAsync$1(RestClient.java:421)at org.opensearch.client.Cancellable.runIfNotCancelled(Cancellable.java:93)at org.opensearch.client.RestClient.performRequestAsync(RestClient.java:419)at org.opensearch.client.RestClient.performRequestAsync(RestClient.java:406)at org.opensearch.index.reindex.remote.RemoteScrollableHitSource.execute(RemoteScrollableHitSource.java:190)at org.opensearch.index.reindex.remote.RemoteScrollableHitSource.lookupRemoteVersion(RemoteScrollableHitSource.java:112)at org.opensearch.index.reindex.remote.RemoteScrollableHitSource.doStart(RemoteScrollableHitSource.java:101)at org.opensearch.index.reindex.ScrollableHitSource.start(ScrollableHitSource.java:99)at org.opensearch.index.reindex.AbstractAsyncBulkByScrollAction.start(AbstractAsyncBulkByScrollAction.java:305)at org.opensearch.index.reindex.Reindexer.lambda$execute$0(Reindexer.java:156)at org.opensearch.index.reindex.BulkByScrollParallelizationHelper.executeSlicedAction(BulkByScrollParallelizationHelper.java:120)at org.opensearch.index.reindex.Reindexer.execute(Reindexer.java:136)at org.opensearch.index.reindex.TransportReindexAction$1.onResponse(TransportReindexAction.java:104)at org.opensearch.index.reindex.TransportReindexAction$1.onResponse(TransportReindexAction.java:101)at org.opensearch.index.reindex.BulkByScrollParallelizationHelper.initTaskState(BulkByScrollParallelizationHelper.java:158)at org.opensearch.index.reindex.Reindexer.initTask(Reindexer.java:131)at org.opensearch.index.reindex.TransportReindexAction.doExecute(TransportReindexAction.java:101)at org.opensearch.index.reindex.TransportReindexAction.doExecute(TransportReindexAction.java:58)at org.opensearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:219)at org.opensearch.indexmanagement.rollup.actionfilter.FieldCapsFilter.apply(FieldCapsFilter.kt:118)at org.opensearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:217)at org.opensearch.performanceanalyzer.action.PerformanceAnalyzerActionFilter.apply(PerformanceAnalyzerActionFilter.java:78)at org.opensearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:217)at org.opensearch.action.support.TransportAction.execute(TransportAction.java:189)at org.opensearch.action.support.TransportAction.execute(TransportAction.java:108)at org.opensearch.client.node.NodeClient.executeLocally(NodeClient.java:110)at org.opensearch.index.reindex.AbstractBaseReindexRestHandler.lambda$doPrepareRequest$0(AbstractBaseReindexRestHandler.java:73)at org.opensearch.rest.BaseRestHandler.handleRequest(BaseRestHandler.java:125)at org.opensearch.rest.RestController.dispatchRequest(RestController.java:312)at org.opensearch.rest.RestController.tryAllHandlers(RestController.java:398)at org.opensearch.rest.RestController.dispatchRequest(RestController.java:241)__AMAZON_INTERNAL____AMAZON_INTERNAL____AMAZON_INTERNAL____AMAZON_INTERNAL__Any suggestions, or a way to get a more helpful error message would be very much appreciated.  I am hoping to avoid using a proxy, since the point of the VPC connection thing is to no longer need a proxy.  At the very least, I'd like to find a way to get a meaningful error message from the system.FollowComment"

Answer: "0Hi, as source domain is in VPC you either will have to use a proxy or VPC Endpoint connection.Please see "Reindex data between OpenSearch Service domains when the source is in a VPC" section from the docs.https://docs.aws.amazon.com/opensearch-service/latest/developerguide/remote-reindex.htmlHope it helps!CommentShareAlex_Tanswered a month agoJason-Henriksen-42 a month agoI am using the VPC connection.  Still getting that NPE.Have you seen this problem before, or have any ideas what could be causing it?Share"


Question: DHCP server over VPN instance

"Hi,I just want to know if AWS customers are allowed to install DHCP server (on EC2 instance) over a VPC for private usage needed used outside their AWS VPC area ?If not allowed, where is it written ?This server only amswer to DHCP unicast request. (DHCP relay)Thanks for your assistanceFollowComment"

Answer: "1You can setup DHCP server on aws using cisco ip-helper to issue ip leases on-premise, as broadcast traffic is not allowed on aws.CommentShareEXPERTVaibhav_Sanswered a year agoEXPERTBrettski-AWSreviewed a year ago"


Question: Grafana Server Log access when unable to login to Grafana

"Hi,we are unable to access Grafana through IAM Identity Center and would like to check the Grafana server log. Can anybody please let us know how to reach the Grafana server log without direct access to Grafana?Thank you!ManfredFollowComment"


Question: WorkMail: Undelivered Mail Returned to Sender

"Hi,I am using WorkMail to send mails to my clients. It worked fine since past month. But since 2 days ago, I got error message as below:======================Undelivered Mail Returned to SenderYou have exceeded the sending limit for this account.======================I have already configured the domain and everything is correct, I don't know why it fails.FollowComment"

Answer: "3AWS WorkMail has a daily sending quota, which limits the number of messages you can send in a 24-hour period. If you've reached this limit, you'll need to wait until the quota resets.  In addition to the daily quota, AWS WorkMail also has a maximum sending rate that limits the number of messages you can send per second. If you're sending a large number of emails in a short period of time, you might hit this limit.To resolve this issueplease check your limits, if you require to increase the limits you need to open an AWS support case.CommentShareEXPERTsdtslmnanswered a month ago"


Question: AWS IoT Data Type Error

"Greetings,We are using AWS IoT Core services for collecting data from our telematics device. The data is further stored into the DynamoDb database via a rule engine. On publishing the shadow document to the broker the one value field (uint64_t) gets changed on the . The value retains its original value in the dynamoDb.Device Shadow Expected{  "state": {    "reported": {      "vsr": 70931715605954314       }    }}Device Shadow Actual{  "state": {    "reported": {      "vsr": 70931715605954310       }    }}Is there any chance there is some data conversion issue on AWS IoT Core side. I have a thingsboard client connected to the endpoint as well it is also receiving the manipulated device shadowRegards,AltamashFollowCommentclogwog a year agodo you publish the value{ "state": {    "reported": { "vsr": 70931715605954314 } }}to the shadow update topic:  $aws/things/yourdeviceuniqueid/shadow/name/update on the device towards IoT-Core? or are you writing the shadow from IoT-Core to be received by your devicewhat is received by IoT-Core on that topic in the AWS IoT -> MQTT test client ?could it be there is another device/service publishing to the same topic ?ShareAWS-User-8012342 a year ago@clogwog Along with the said vsr key there are certain other key value pair that are published by me on the said topic via mqtt protocol to the broker.(-) The value received on the AWS IoT -> Test client is similar (corrupted) to the one shown in device shadow. But the when i see the data in dynamo db the data is intact and is equivalent to the one sent from device. For pushing data to dynamoDb im using rule engine.(-) A unique device publishes only to its own topic.Most likely the issue seems to be large data type because i have seen a similar behaviour when publishing data from aws iot mqtt test client to the device shadow. What i dont know is how to fix this issue.Any suggestion is appreciatedRegards,AltamashShare"


Question: Handler error python lambda function

"I am trying to follow this tutorial https://aws.amazon.com/blogs/machine-learning/build-your-own-text-to-speech-applications-with-amazon-polly/ but keep having an error on my lambda functions when I click the 'test' button. My code is the "PostReader_ConvertToAudio" section of the tutorial.My error code is as follow :{  "errorMessage": "'Records'",  "errorType": "KeyError",  "requestId": "9e788dd8-763c-4e85-b5c5-36520aeee1ca",  "stackTrace": [    "  File \"/var/task/lambda_function.py\", line 8, in lambda_handler\n    postId = event[\"Records\"][0][\"Sns\"][\"Message\"]\n"  ]}Thank you for your help!!FollowComment"

Answer: "0The blog post doesn't explicitly provide example test data to test this function, unlike the other two functions in the post.  This is because the function is relying on the data structure provided by the SNS invocation.  SNS will invoke this function when a message is received and provide said message to the function; event["Records"][0]["Sns"]["Message"] is where the message will be found.If you would like to run a test of this function, you will need to emulate the JSON data structure expected by the function:{    "Records": [        {            "Sns": {                "Message": "ENTER RELEVANT DATA HERE"            }        }    ]}CommentShareJustin Ganswered a year ago"


Question: Error: At least one of the pre-conditions you specified did not hold

"I'm having a very strange issue with SES, I keep getting the error "At least one of the pre-conditions you specified did not hold" and I don't know what exactly goes wrong.The message I try to send is here:https://gist.github.com/yellow1912/9a102ae452b6c77a7b8e5d7020f0eb5dI'm following the format specified here:https://docs.aws.amazon.com/ses/latest/DeveloperGuide/send-using-sdk-php.htmlIf anyone has any clue at all, I would really appreciate it.FollowComment"

Answer: 0The issue was that I was using the wrong region for ses client. For some reason due to a configuration mishap a S3 region was used instead ('s3.us-east-1'). The extra s3 caused the issue.CommentShareVu Hoang Nguyenanswered 4 years ago