Question: How to delete Redshift Serverless ?

"I created a serverless redshift to try it out, after 2 hours I am ready to delete it but there is no delete button in any page.Searched for info in all docs, google, this community etc. Where can I delete serverless redshift from my account?FollowComment"

Answer: "1Accepted AnswerHello,currently you can not delete it by yourselves but you can open a support ticket providing the AWS account id and region in which your serverless is , support can delete it for you.If you do not have support you can just send an email to the email address you can find in the Amazon Redshift Serverless documentation page. Ask to delete the endpoint and share the AWS AccountID and region in which the endpoint was created.We plan to provide the delete capability during GA.Before posting a question please search if a similar question was posed in the past.thank you and hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year agobnroths a year agoI don't see an email on the page you linked toShareAJP a year agoas on date (17 March 2022) the email Id isredshift-preview-serverless@amazon.comhttps://docs.aws.amazon.com/redshift/latest/mgmt/serverless-whatis.htmlShare0Hi,AWS CLI would allow more functionality especially with the new functionality, Console would normally get updated in some time.Could you please try the following AWS CLI commandsRun describe-clustersaws redshift describe-clusters{    "Clusters": []}Delete the cluster with the cluster-identifier from Step No 1.Make sure to pass --skip-final-cluster-snapshot | --no-skip-final-cluster-snapshot as you may not want a snapshot lying around.aws redshift delete-cluster --cluster-identifier <value>delete-cluster--cluster-identifier <value>[--skip-final-cluster-snapshot | --no-skip-final-cluster-snapshot][--final-cluster-snapshot-identifier <value>][--final-cluster-snapshot-retention-period <value>][--cli-input-json <value>][--generate-cli-skeleton <value>]https://docs.aws.amazon.com/cli/latest/reference/redshift/delete-cluster.html#delete-clusterCheersCommentShareSrianswered a year agoFabrizio@AWS EXPERTa year agothe answer is relative to the deletion of a provisioned cluster it is not valid for Redshift Serverless.Share0Deleting a workgroup https://docs.aws.amazon.com/redshift/latest/mgmt/serverless_delete-workgroup.htmlYou can delete a workgroup using the console. Before you do this, make sure that you have your data backed up and snapshots in place. Resources deleted as part of the workgroup in many cases can't be retrieved.Complete the following steps:Choose Amazon Redshift Serverless, choose Workgroup configuration and choose Delete Amazon Redshift Serverless instance.A dialogue opens. When you choose to delete the workgroup, all usage limits are removed, all VPC endpoints are removed, and access to VPC endpoints is removed.Type delete and select Delete to confirm.After you complete the steps, the status of the workgroup is Deleting and a banner indicates that the workgroup is being deleted. While the delete process is in progress, some features under the Serverless dashboard are disabled. But you can configure provisioned clusters on the Provisioned clusters dashboard.After you delete the workgroup, it doesn't appear with the namespace. You can choose the Create workgroup button to create a new one.You can delete an existing workgroup and associate a new workgroup with a different configuration to the same namespace. When creating the new workgroup, choose the base capacity that works with the size of the data associated with the namespace.CommentSharerePost-User-1770640answered a month ago"


Question: S3 Access denied on pdf file type only

"Hi All,I have created a S3 bucket to store images, video and pdf.Public access is off.I have applied a bucket policy and CORS to allow access only from a certain website.I can upload all file types.I can download all file types, except PDF files.I receive the general XML access denied error.I can't figure out why I can get and view other file types but not pdf.Any advice / ideas would be great as I've spent hours trying to figure this out.Thanks :)FollowComment"

Answer: "0I did find this stackoverflow link that deals with a REST api issue someone had.  Could this be the issue you're having, too?They didn't use the S3ObjectInputStream.  They used InputStream instead and that caused their problem.https://stackoverflow.com/questions/50043662/s3-download-pdf-rest-apiCommentSharejschwar313answered a year agoKevinS a year agothanks jschwar313, i'm just using a basic HTML embed method <iframe src="[S3 URL of pdf]" height="100%" width="100%"></iframe> but no luck...Share0Hi All, this issue is still unresolved, after many hours of painful research and trying different things.Does anyone have a CORS policy that allows pdf files to be previewed or downloaded from S3 on a web page?ThanksCommentShareKevinSanswered a year ago"


Question: DMS - How to retain non-ASCII values when running DMS task from MySQL source to Redshift target

"Hello,We're facing an issue where when running a DMS task with a MySQL source to a Redshift target, columns containing non-ASCII values are being converted/replaced with UTF-8 hex values. Is there a way to disable this? We would like to keep these values as-is when migrated over to Redshift.*For example, the below source on MySQL is automatically converted to the below target value when DMS'd to Redshift:Source value(MySQL): ' feW®ê EªAÆð  sWÊ' zÒ*%ÿ 5  ß ' 'Target value(Redshift): '92666557AEEA1E45AA41C6F0160A7357CA27027AD22A25FF1135020ADF122706'Edit:Issue is actually with BLOB datatypes in general. BLOB data types from MySQL are automatically converted to hex values when DMSed to Redshift.Thanks!FollowCommentKevin_Z SUPPORT ENGINEERa year agoHi,Based on the description, issue seems related to non-ASCII. I can help investigate the issue if you may share below:Table DDL from MySQL source.Depends on TARGET Prep Mode (If DO_NOTHING and DMS create the target table then no need Redshift DDL). Please share the Redshift DDLLet me know which column contains this valueI will try to test it outNote: If table DDL not able to be shared, you can just let me know the column datatype for the MySQL and Target Redshift.ShareAWS-User-8809738 a year agoThanks for reaching out!I investigated this more and found that the issue is actually with BLOB datatype columns in general.So if we run a DMS full load task from source MySQL to target Redshift, the source values are automatically converted to hex values, regardless if the values are ASCII or not.For example, I created a test table in the MySql source with one column of BLOB data type, and then inserted value 'TEST 3'.Then, I ran a full load DMS task to Redshift. When the task completed, the table was successfully moved to Redshift, but value 'TEST 3' changed to '544553542033', data type character varying(65535).Still unsure why this happens, but I hope this additional info helps.Let me know your thoughts!Share"

Answer: "0Hi AWS-User-8809738Thanks for the additional info. This seems to be the data converting issue.Data converting steps:MySQL (BLOB data) --> DMS data type (BYTES(66535)) --> VARCHAR (Length)https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.MySQL.html#CHAP_Source.MySQL.DataTypeshttps://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Redshift.html#CHAP_Target.Redshift.DataTypesI am thinking we can test using https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TableMapping.SelectionTransformation.Transformations.html#CHAP_Tasks.CustomizingTasks.TableMapping.SelectionTransformation.Transformations.ValuesSo convert the Bytes to String using the mapping change-data-type see if this can help fix the issue.Note: as mentioned this datatype change is regarding to DMS datatype not source or target datatype.If this does not work, feel free to report this to the support team if you have support plan. If not I can help report this internally.CommentShareSUPPORT ENGINEERKevin_Zanswered a year agoKevin_Z SUPPORT ENGINEERa year agoI did a quick test for this issue using s3 as target, Note: Redshift is loading s3 so essentially this can be the same thing.I do notice the same that BLOB column from source MySQL covert to hex value at target s3:mysql> select * from blobtest;+----+------------+| id | blobcolumn |+----+------------+|  1 | 2          ||  2 | -240       |+----+------------+2 rows in set (0.05 sec)mysql> select hex(blobcolumn) from blobtest;+-----------------+| hex(blobcolumn) |+-----------------+| 32              || 2D323430        |+-----------------+2 rows in set (0.05 sec)S3  target:Op,DMS_TIMESTAMP,id,blobcolumnI,2022-05-13 22:30:27.460339,1,32I,2022-05-13 22:30:27.460364,2,2D323430Note: change datatype won't work in this case.I believe Service team is aware of the issue. You may also report this as feature request if needed.ShareAWS-User-8809738 a year agoAppreciate your help in investigating this, Kevin, and thanks for confirming. If possible, can you help report this as a feature request?Thanks again!Share0Hello AWS-User-8809738,Do you still need help? If so, kindly provide the information.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year agoAWS-User-8809738 a year agoYes! Provided additional info above.Share"


Question: Aurora MySQL Cluster - Massive increase in bytes used

"I recently noticed our Aurora MySQL cluster's Bytes Used increased massively from 341 GiB, to 4362 GiB over the course of five days.The backup logs look like this:DateSizeMay 19, 2022, 8:39:13 AM UTC4362 GiBMay 18, 2022, 8:35:52 AM UTC4362 GiBMay 17, 2022, 8:41:40 AM UTC4100 GiBMay 16, 2022, 8:40:30 AM UTC2997 GiBMay 15, 2022, 8:37:08 AM UTC1791 GiBMay 14, 2022, 8:36:58 AM UTC583 GiBMay 13, 2022, 8:39:09 AM UTC341 GiBMay 12, 2022, 8:36:12 AM UTC341 GiBAs you can see it rises sharply for a few days and then levels off.There is no operational reason for this to have happened because our database size is only about ~40 GiB. I upgraded the cluster engine from 2.08.2 to 2.10.2 hoping that the dynamic resizing would take care of the issue, but the bytes used is still showing over ~4000 GiB.I have rebooted the cluster, but that has made no difference.Through some research there are a few other resources, but none of them have any real resolution as to this exact issue:Why Volume Bytes Used become so high on AWS Aurora RDS MySQL cluster?How to stop auto expanding of Aurora's storage (volume)Why is my "volume bytes used" always increasing on my Amazon Aurora cluster?How do I view the total storage used for my Amazon Aurora MySQL DB cluster?Engine version:5.7.mysql_aurora.2.10.2FollowComment"

Answer: "0Accepted AnswerSo it looks like upgrading the cluster to 2.10.2 did indeed fix the issue, it just took some time for the dynamic resizing to finally kick in.Over the course of the last 24 hours, it has gradually resized down to match the actual size of the database.For anyone running into this in the future, upgrading your cluster engine and just... waiting seems to be the most appropriate course of action.CommentSharejwcarrollanswered a year ago"


Question: How can I drop a RedShift AutoMV?

"I'm trying to alter a table definition, but it's dependent on by a materialized view which is managed by RedShift Auto Materialization and not by us. So attemptingALTER TABLE my_table    ALTER COLUMN my_column TYPE VARCHAR(100);Errors with[0A000] ERROR: cannot alter type of a column used by a materialized viewSo I attempt to drop the materialized viewDROP MATERIALIZED VIEW pg_automv.auto_mv_53022635;Which gives a permission error[42501] ERROR: permission denied for schema pg_automvWhat's the solution here?FollowComment"

Answer: "0Accepted AnswerHi, I opened a ticket to AWS and this is their answer :/Dear Customer,From case notes i understand that while trying to alter varchar column of table , you are facing below error due to the Redshift auto_mv feature. Please correct me if I have misunderstood or missed addressing any of your concerns.Error Amazon 500310 Invalid operation: cannot alter type of a column used by a materialized view.In this regards, I would like to provide the information as below :The current workaround is to disable the auto_mv parameter and reboot the cluster. This will drop all existing auto materialized views and will not create any going forward unless you reset the parameter group to its default.According to documentation[1], the AutoMV feature is fully system managed. Therefore, unlike manual materialized views, AutoMVs are not visible to users and can’t be queried directly. They also don’t appear in any system tables like stv_mv_info or svl_mv_refresh_status. Finally, if the AutoMV hasn’t been used for some time by the workload, it’s automatically dropped and the storage released.With that being said, it's unlikely to manually find all of the AutoMV and its dependencies, and eventually to drop them.The Redshift AutoMV feature can be turned off by updating your Redshift cluster parameter group “auto_mv" parameter to "false".[2]I understand that this may cause a slight inconvenience to you and I again sincerely apologies on behalf of AWS for the same.CommentShareAsafSanswered 10 months agoKit - CostCenter 10 months agoOoof. So the only practical way to do schema migrations is to turn off AutoMV, reboot and hope we don't trash the DB load that has been relying on AutoMV. That.. is harsh. Thanks for answering.Share"


Question: LEX support Cantonese

Is there a plan to support Cantonese (zh-HK) Language in the LEX service ?https://docs.aws.amazon.com/lex/latest/dg/how-it-works-language.htmlFollowComment

Answer: "0Thank you for your interest. Lex team continues to work on adding new language supports. Unfortunately, I am not able to comment on if and when this language will be supported. I request you to kindly keep an eye on our Languages Supported in Amazon Lex and What's New Feed pages for an update.CommentShareJunsung-awsanswered a year ago"


Question: Error when using Amazon Lex chatbot with Amazon Kendra on the AWS Cloud Quick Start Reference Deployment

"When using the quick start at the link below, I receive an error message when I use the testing phrase provided in the documentation. What could be causing this error?Quick start: https://aws-quickstart.github.io/quickstart-quantiphi-lex-kendra-backend/Kendra intent testing phrase: "What preventive measures can I take"Error:An error has occurred: Invalid Bot Configuration: Amazon Lex could not access your Amazon Kendra index. There is a problem with your configuration. Check the configuration and try your request again.FollowCommentayoub 21 days agodid you reach out a solution for this problem ?Share"

Answer: "0Hi, thank you for reaching out!This could be a few things. Did you enter your kendra index name correctly? If yes, are you using a custom role, or Service-Linked Role for your bot? Maybe they are missing the permissions necessary for Lex to query your Kendra index.Checkout this section for how to set up permissions:https://docs.aws.amazon.com/lexv2/latest/dg/built-in-intent-kendra-search.html#kendra-search-iamMathildaCommentShareMathildaAWSanswered a year agoayoub 21 days agoI tried your proposal but in vainShare"


Question: Is Cloud9 AWS Resources gone forever?

"I just realized that the tap of AWS Resources in the cloud9 have just gone and I cant get it back. I used to easy test my lambda functions with the "Local debug" option but now I don't know how to do that in the new AWS Toolkit enviorment. Is AWS Resources gone forever? Could anyone help me or explain me how to test in local with AWS Toolkit? I tried it, but without any success.Thank you!FollowCommentBanning 8 months agoWhere you able to get this to work? For the life of my I can't get it going... everything i read says something about the launch.json file but when I run it it just opens another "terminal" type window with output... its not as nice as it use to be... is the old window seriously gone for good?Share"

Answer: "0Hi @Javi90,you can follow "Running and debugging serverless applications" guide here. You can either create a SAM template or directly debug your function directly from the application code.If you have already been following this guide, could you please provide the step you had problems?CommentShareoykuanswered a year ago"


Question: I'm trying to remove closed account from my organization (suspended). The removal fails because the account was not confirmed using a phone and PIN. How to remove it?

I'm trying to remove closed account from my organization (it says suspended). The removal fails because the account was not confirmed using a phone and PIN. How to remove the account ?   I want to delete the organization and I can't because I can not remove the suspended/closed account. The closed account was not verified by phone and pin and that is why the removal of the closed account fails.FollowComment

Answer: "0Hi,I assume you looked at this guide: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_delete.html.If that does not help, then I think your best option is to contact Support so that they can help you out directly: https://support.console.aws.amazon.com/support/home. As long as you can demonstrate you are the owner of the account, I am sure they can figure it out and help.CommentShareEXPERTalatechanswered 3 months ago-1From the time you close the account until 90 days expire:Closed accounts are visible in your organization with the SUSPENDED state.After the 90 day grace period expires:A closed AWS account is no longer visible in your organization.For details, refers to documentation at: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_close.htmlCommentShareronald_lanswered 3 months agorePost-User-5163156 3 months agoThese policies are not only poorly thought through, as they are unnecessary, especially when said account has not provisioned resources, but they are also potentially in violation of GDPR, if the email address of said accounts are personal identifiable information.Share"


Question: SCT connecting to MySQL over SSL

I used keytool to import the client cert and the key as one certificate and the server CA as its own certificate. And created a jks keystore and added that as a trust store in the SCT tool. But I am unable to establish connection to my MySQL database. I can do that using MySQL Workbench so I know my certs/password etc. work. Please let me know what I could be missing.FollowComment


Question: Communication bridge between Amazon x-ray sdk and Hapi

"I've been working as a blockchain company. My manager wants to integrate: Amazon X-Ray. Our solution uses several microservices. Part of them are using: hapi.dev(https://hapi.dev). The others microservices don't have a framework. The system has several microservices with PURE nodejs implementation.My question about: How we can use Amazon X Ray could be used if the technology stack is mix between hapi.dev services and pure nodejs implementation.Why I'm asking my question:The documentation started with the following paraghraph:The X-Ray SDK for Node.js is a library for Express web applications and Node.js Lambda functions that provides classes and methods for generating and sending trace data to the X-Ray daemon. Trace data includes information about incoming HTTP requests served by the application, and calls that the application makes to downstream services using the AWS SDK or HTTP clients.https://docs.aws.amazon.com/xray/latest/devguide/xray-sdk-nodejs.htmlI've found as a package:https://www.npmjs.com/package/aws-xray-sdk-hapiI'd like to ask what's the recommendation by the official contributors ?FollowComment"

Answer: "0Hi!We would recommend using the AWS Distro for OpenTelemetry (ADOT) for instrumenting applications with AWS X-Ray. The OpenTelemetry Javascript SDK contains a wider range of features and supports many library instrumentations (including Hapi) out of the box. To get started, please see the ADOT JS documentation.CommentShareCarol_Aanswered 10 months ago"


Question: Route53 zone hosted on two accounts

"A customer has two AWS accounts A and B. In account A they have a hosted zone in Route53 like www.mycompany.comOn account B they would like to have a hosted zone with the same sub domaine (mycompany.com) but with specific domaines relative to account B, for example dev.info.mycompany.comThey have impemented this however they don't get any answer back from nslookupnslookup dev.info.mycompany.comServer:         10.x.x.xAddress:        10.x.x.x#53** server can't find dev.info.mycompany.com: NXDOMAINIs it possible to do this ?FollowComment"

Answer: "0Accepted AnswerIn this example, "mycompany.com" is a domain whose delegation has been sent to their "A" account hosted zone (the four R53 name servers assigned to that zone have been entered in the domain configuration).  The hosted zone in "B" is not being referenced from anywhere, thus it is just existing out in the aether and not being used.Your customer should decide on a specific subdomain for their "B" records to fall under (e.g. "dev.mycompany.com") and make a new hosted zone with that name.  They would then take the four R53 name servers assigned to that zone and enter a delegation (NS record) in the parent zone on "A" with "dev.mycompany.com" as the name and the "B" name servers as the value.See: "To create a new hosted zone and delegation set for your subdomain"https://aws.amazon.com/premiumsupport/knowledge-center/create-subdomain-route-53/CommentShareJustin Ganswered 5 years ago"


Question: Unable to click on android popup

"Since android ver 6 and higher, my app asks to allow navigation stuff at the very beggining of it. So I open the app and this allow-popup appears. On my usual appium test everything is fine, I can click on it, close, rerun app and continue. But when AWS runing my app it doesn't click on that popup. So here's 2 runs. First where android 5 and next is higher.Successful run: https://us-west-2.console.aws.amazon.com/devicefarm/home?region=us-east-1#/projects/e9705ee5-4015-478f-b9f1-c62f8b73ef49/runs/331a79f6-dabb-4e7d-96ff-483e7b7be706/jobs/00000Unsuccessful run: https://us-west-2.console.aws.amazon.com/devicefarm/home?region=us-east-1#/projects/e9705ee5-4015-478f-b9f1-c62f8b73ef49/runs/12aa1322-646b-41cb-bc90-af6038b7b558FollowComment"

Answer: "0For me the solution was:add in desired capabilities - setCapability("autoGrantPermissions", true);CommentShareSunshineautoanswered 4 years ago"


Question: Re-configuring AWS X-Ray Daemon

"Hi,I am deploying AWS X-Ray daemon on an EC2 Instance (AWS Linux AMI). I am doing this by following the instructions provided in https://docs.aws.amazon.com/xray/latest/devguide/xray-daemon-ec2.html which asks to have the following in UserData script:#!/bin/bashcurl https://s3.dualstack.us-east-2.amazonaws.com/aws-xray-assets.us-east-2/xray-daemon/aws-xray-daemon-3.x.rpm -o /home/ec2-user/xray.rpmyum install -y /home/ec2-user/xray.rpmThe above install launches the X-Ray Daemon and it listens to the default UDP bind address 127.0.0.1:2000 (Loopback address).I require to make the daemon process listen to the public network (0.0.0.0:3000) and also want changes to the region and logging configuration. https://docs.aws.amazon.com/xray/latest/devguide/xray-daemon-configuration.html describes how this can be achieved. But I am facing the following issues:1.) I am facing problems killing the X-Ray daemon on instance start up through the User Data script. pkill is not working for xray.2.) I am unsure of how to start X-Ray daemon in the user data script as it is not as straight forward as executing the X-ray command to run in background mode i.e/usr/bin/xray -c "/home/ec2-user/xray_config/daemon_config.yaml" &will not work.I am wondering if it would be possible to specify a configuration file during X-Ray daemon installation so that the default daemon process that kicks off after install is launched with the configuration parameters (UDP bind address etc) that I specify. Can anyone please help me with this?Regards,Edited by: shricloud on May 27, 2019 12:41 PMEdited by: shricloud on May 27, 2019 12:42 PMFollowComment"

Answer: 0I found a solution for this after digging into the xray rpm.The xray daemon can be stopped / started using the following commands:If sbin is installed:To stop: /sbin/stop xray To Start: /sbin/start xrayIf systemctl is installed:To stop: systemctl stop xraysystemctl daemon-reloadTo start:systemctl start xray systemctl daemon-reloadSo I achieved reconfiguration of X-ray daemon in cloud formation user script as follows:/sbin/stop xraymv /home/ec2-user/xray_config/daemon_config.yaml /etc/amazon/xray/cfg.yaml/sbin/start xrayThanks!CommentShareshricloudanswered 4 years ago


Question: Error connection to the API!

"Error connection to the API!Too many requests, please try again. error Resource limit exceededI have been receiving this error for over 5 days. I contacted support on Monday and it is now Friday and with the exception of support asking me to try again not only does it still not work but now support apparently has stopped responding to the ticket.I am trying to setup and test a end to end live stream using the AWS CloudFormation template and it keeps Rolling back because of this error.Can anyone please tell me how to get this to work?Thank you...FollowComment"

Answer: "0Hi team,I am just going through this forum trying to find a solution to the same issue.I currently do not have any channel created in MediaPackage. When i try to create my first channel, i am getting the error message  - "Error connection to the APIToo many requests, please try again. error Resource limit exceeded"Is there a fix for this issue?thanksCommentShareMergeLabanswered 3 years ago"


Question: Syntax Error when using length function with repeat function in Athena

"After running the below query in Athena I am getting the error:SELECT  REPEAT('*', LENGTH('testing'))  AS "e7cfff0a-f4d3-4fd9-a6cc-c5f7af177074"FROM "default"."all_flights"GROUP BY  REPEAT('*', LENGTH('testing'))LIMIT 500SYNTAX_ERROR: line 2:3: Unexpected parameters (varchar(1), bigint) for function repeat. Expected: repeat(T, integer) TThis query ran against the "amtestdb" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: 0f51f40e-66e1-4512-aa22-ed36b4f7bee6Wondering why this query doesn't run as expected?FollowComment"

Answer: "1From your error seems as the LENGTH('testing') returns a BigInt, while REPEAT expects an Int as second parameter.You can try to CAST(LENGTH('testing') AS INTEGER)https://docs.aws.amazon.com/redshift/latest/dg/r_CAST_function.htmlCommentShareEXPERTalatechanswered 4 months ago"


Question: Notebook Instance Types for SageMaker Studio

"Within SageMaker Studio, you can change instance types (see screenshots here:https://aws.amazon.com/blogs/machine-learning/learn-how-to-select-ml-instances-on-the-fly-in-amazon-sagemaker-studio/). However, this seems to only support changing to: ml.t3.medium, ml.g4dn.xlarge, ml.m5.large, and ml.c5.large.Is there a way to change to other instance types for SageMaker Studio? For SageMaker Notebook Instances, I know you can change to many other types of instances, but I am not sure how to do it for SageMaker Studio.FollowComment"

Answer: "0Accepted AnswerThe instance types you are seeing are Fast Launch Instances ( which are instance types designed to launch in under two minutes).In order to see all the types of instances, click on the switch on top of the instance type list that says "Fast Launch", that should display the rest of available instances.Here is additional info about fast launch instances: https://docs.aws.amazon.com/sagemaker/latest/dg/notebooks.htmlHope it helps!CommentShareMODERATORAWS-User-7480677answered 3 years ago"


Question: Athena error HIVE_BAD_DATA: Not valid Parquet file

"Hello,I created a glue table with parquet serde initially.Details:input format: org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormatoutput format: org.apache.hadoop.hive.ql.io.parquet.MapredParquetOutputFormatserde: org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDeclassification: parquetThen I edited the table manually via console to use json serde.Details:input format: org.apache.hadoop.mapred.TextInputFormatoutput format: org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormatserde: org.openx.data.jsonserde.JsonSerDeclassification: jsonThe underlying s3 data is in json format.Now when I try to query the data via Athena, I get the below error.HIVE_BAD_DATA: Not valid Parquet fileIt seems Athena is not picking up the updated glue details?I tried MSCK repair on the table but it does not work.Is there a way I can fix it without deleting the table?Thanks.FollowComment"

Answer: "0Figured it.If I drop the existing partitions and add it, Athena does not give error anymore.I also tried to add more partitions after this, new partitions are taking json serde now.CommentSharerePost-User-2855373answered a month ago"


Question: Amplify build error - Cannot find module '/codebuild/output/....

"Hi allMy vue app is running fine locally and builds fine locally, however, I'm trying to build my app on Amplify using a link to my github repo. The link and the clone work fine but I'm getting an error during the build.Amplify push also works fine without problems.I've only ever used NPM for all modules along with the vue-cli and Amplify-cli.I have no idea where to start with this.The main error seems to be :Cannot find module '/codebuild/output/src323788196/src/.yarn/releases/yarn-1.23.0-20210726.1745.cjs'I've tried yarn install  but that does not help. I'm not sure what to do next because I've never used yarn at all in this project.My build config is standard -version: 1backend:  phases:    build:      commands:        - '# Execute Amplify CLI with the helper script'        - amplifyPush --simplefrontend:  phases:    preBuild:      commands:        - npm install    build:      commands:        - npm run build  artifacts:    baseDirectory: dist    files:      - '**/*'  cache:    paths:      - node_modules/**/*The error I'm getting is -[WARNING]: ✖ An error occurred when pushing the resources to the cloud2022-01-04T06:47:49.986Z [WARNING]: ✖ There was an error initializing your environment.2022-01-04T06:47:49.993Z [INFO]: Error: Packaging lambda function failed with the error [0mCommand failed with exit code 1: yarn --production[0minternal/modules/cjs/loader.js:818[0m  throw err;[0m  ^[0mError: Cannot find module '/codebuild/output/src323788196/src/.yarn/releases/yarn-1.23.0-20210726.1745.cjs'[0m    at Function.Module._resolveFilename (internal/modules/cjs/loader.js:815:15)                                     at Function.Module._load (internal/modules/cjs/loader.js:667:27)                                     at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:60:12)                                     at internal/main/run_main_module.js:17:47 {                                   code: 'MODULE_NOT_FOUND',                                   requireStack: []                                 }                                     at runPackageManager (/root/.nvm/versions/node/v12.21.0/lib/node_modules/@aws-amplify/cli/node_modules/amplify-nodejs-function-runtime-provider/src/utils/legacyBuild.ts:66:13)                                     at installDependencies (/root/.nvm/versions/node/v12.21.0/lib/node_modules/@aws-amplify/cli/node_modules/amplify-nodejs-function-runtime-provider/src/utils/legacyBuild.ts:40:3)                                     at Object.buildResource [as build] (/root/.nvm/versions/node/v12.21.0/lib/node_modules/@aws-amplify/cli/node_modules/amplify-nodejs-function-runtime-provider/src/utils/legacyBuild.ts:13:5)                                     at buildFunction (/root/.nvm/versions/node/v12.21.0/lib/node_modules/@aws-amplify/cli/node_modules/amplify-category-function/src/provider-utils/awscloudformation/utils/buildFunction.ts:41:36)                                     at prepareResource (/root/.nvm/versions/node/v12.21.0/lib/node_modules/@aws-amplify/cli/node_modules/amplify-provider-awscloudformation/src/push-resources.ts:605:33)                                     at async Promise.all (index 1)                                     at prepareBuildableResources (/root/.nvm/versions/node/v12.21.0/lib/node_modules/@aws-amplify/cli/node_modules/amplify-provider-awscloudformation/src/push-resources.ts:601:10)                                     at Object.run (/root/.nvm/versions/node/v12.21.0/lib/node_modules/@aws-amplify/cli/node_modules/amplify-provider-awscloudformation/src/push-resources.ts:173:5)2022-01-04T06:47:50.024Z [ERROR]: !!! Build failed2022-01-04T06:47:50.024Z [ERROR]: !!! Non-Zero Exit Code detectedFollowComment"


Question: Kineis Video GetMedia result stream parsing in c++

Is there a c++ implementation that can help parse the GetMedia stream. I see there is a Java implementation here: https://github.com/aws/amazon-kinesis-video-streams-parser-library. Is there a c++ equivalent for this?FollowCommentAbilash 7 months agoIf there is a python equivalent will be great.Share


Question: Redshift data API

"Hi,I am using the Golang SDK for querying the data from the Redshift database. The function  GetStatementResultOutput  () returns the response GetStatementResultOutput{} which contains the list of records for the SQL query.  How do i fetch the data from the records, which are of type "Records [][]*Field" . I want the result in JSON format so that i can unmarshal  the data into the result structure. The records will return the value field for the column. It's difficult to determine which type's value field is which. Is there any utility function available to decode the records struct.FollowComment"

Answer: "0Greetings from AWS!Please note that there is no built in way to retrieve the cached result of an SQL statement in a JSON format, please refer to our documentation on GetStatementResult [1].Having that said, one can process the data to format the result if you want to display it in a user-friendly format. By using the Data API with Python you can format the results with the Pandas framework, you can use the Data API with other programming languages supported by the AWS SDK, see example below and a detailed article on Using the Amazon Redshift Data API [2]. Please note that the below code is for example purposes only and you can use python in a similar way to format the records in json format.import pandas as pddef post_process(meta, records):    columns = [k["name"] for k in meta]    rows = []    for r in records:        tmp = []        for c in r:            tmp.append(c[list(c.keys())[0]])        rows.append(tmp)    return pd.DataFrame(rows, columns=columns)def query(sql, cluster="<Cluster Name>", user="<User Name>", database="<Database Name>"):    resp = rsd.execute_statement(        Database=database,        ClusterIdentifier=cluster,        DbUser=user,        Sql=sql    )    qid = resp["Id"]    print(qid)    desc = None    while True:        desc = rsd.describe_statement(Id=qid)        if desc["Status"] == "FINISHED":            break            print(desc["ResultRows"])    if desc and desc["ResultRows"]  > 0:        result = rsd.get_statement_result(Id=qid)        rows, meta = result["Records"], result["ColumnMetadata"]        return post_process(meta, rows)pf=query("select venueid,venuename from venue  limit 100;")print(pf)I hope this would be of value to you, have an AWSome day further.References[1] - https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_GetStatementResult.html[2] - https://aws.amazon.com/blogs/big-data/using-the-amazon-redshift-data-api-to-interact-with-amazon-redshift-clusters/#:~:text=Fetch%[…]ormat%20resultsCommentShareBernard_Vanswered 6 months ago"


Question: IP is blocked.  Reverse DNS issue

"===========================================This is the rDNS found:<ec2-54-113-225-223.compute-1.amazonaws.com> generic EC2.This IP has been flagged because it's a non email server generic EC2.Request a Elastic IP to AWS, with rDNS identification, if you plan to maintain an email server on your EC2.https://matrix.spfbl.net/en/54-113-225-223   (fake ip given here)==============================================I have lightsail with Plesk Ubuntu installed. It has dns settings inside with PTR record (reverse DNS)In front page of lightsail also there is dns recordNot sure which gets applied.Can i send and recieve emails with them ? Why it say no rdns when its there in Plesk dns zone settings. I did click  - apply dns templateCan i fix dns without route 53. Its annoying stuff. I mean i try to import dns zone file from plesk and it failed. i had to manually input. tomorrow if i change ip i need to reinput all. Nuiseance.currently i can send email between local domain emails and also send email to google. But cant recieve emails from google. I do not know whats going on as there is no entry of those incoming email in maillog file.Let me know. Thanks much.FollowComment"

Answer: "0Accepted AnswerIts all working. I went through few websites that check dmarc dkim and mx records to figure out.CommentSharealexkanswered a year ago0https://mxtoolbox.com/SuperTool.aspx?action=mx%3aMyDomain&run=toolpageGave me failThen i  opened port 25 in firewall in lightsailRe -ran , it workedMy outgoing /incoming works local and outside now. pots 25 , 465 and 587 added to firewall.only warning is MX LOOKUPSMTP Banner CheckReverse DNS does not match SMTP BannerCommentSharealexkanswered a year ago0i used these sites to sort out dmarc dkim and mx entries and mx lookuphttps://easydmarc.com/tools/dkim-record-generatorI wonder why lightsail DNZ zone do not have PTR entryCommentSharealexkanswered a year ago0Hello Alexk!I can see that you have resolved the issues with your MX records, DMARC and DKIM since you posted this question.For the question about how to add a PTR record, this is something that you need to request AWS to add.Please see the following documentation regarding how to request this and the prerequisites:https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-configuring-reverse-dnsCommentShareSUPPORT ENGINEERJasper_Ranswered a year ago"


Question: Regarding working in amazon as a software development engineer (SDE)

"I wish to get a full time job offered as a software development engineer (SDE) in amazon.com companyThe hiring process of amazon.com for software development job roles is such that once an application is made to the job in question, if my resume or Curriculum Vitae (CV) gets shortlisted for that job, a technical assessment link will be sent to the email address which I use of to make the job application in amazon.com.While making the application, I will be required to mention whether I have full time work experience or not in the field of software development, for which I will be compelled to indicate 'no' in that particular section of the job application form as I am not having full time work experience in software development in any company.However, I believe I am competent enough to get a job offered in software development in the company amazon.When I visited the website link https://docs.aws.amazon.com/cloud9/latest/user-guide/setup-express.html, I got to know more about setting up the development environment in AWS for building software applications.May I please know without having prior full time work experience in the field of software development in any company, how can I make my resume or Curriculum Vitae (CV) get shortlisted for the software development engineer (SDE) job roles in the company amazon and how can I know more about it?Also, when I visited the website https://codecatalyst.aws/explore/dev-environments, I could get to know that I can use this Integrated Development Environment (IDE) of amazon to work on software development projects.May I please know without having any prior full time work experience in the field of software development to demonstrate, how can I make my resume or Curriculum Vitae (CV) get shortlisted for software development engineer (SDE) job roles in the company amazon?Can you pls let me know about these things?FollowComment"

Answer: "1Accepted AnswerWhen applying for software development engineer (SDE) job roles at Amazon, it's important to showcase your skills, knowledge, and potential, even if you don't have prior full-time work experience in the field. Here are some tips to increase your chances of getting your resume or Curriculum Vitae (CV) shortlisted:Highlight Relevant Projects: Emphasize any personal or academic projects you have worked on that demonstrate your programming skills, problem-solving abilities, and knowledge of software development concepts. Include details about the technologies, programming languages, frameworks, and tools you used.Open Source Contributions: If you have contributed to open-source projects or collaborated on GitHub repositories, mention these experiences in your resume. This demonstrates your ability to work in a team, contribute to real-world projects, and engage with the software development community.Internships and Part-Time Roles: Even if you haven't had full-time work experience in software development, highlight any internships, part-time roles, or freelance projects you have undertaken in the field. Include the responsibilities, tasks, and achievements from these experiences to showcase your practical skills and industry exposure.Technical Skills and Certifications: Create a dedicated section in your resume to list your technical skills, programming languages, frameworks, and tools you are proficient in. If you have any relevant certifications, such as AWS Certified Developer or certifications in specific programming languages or technologies, include them as well.Personal Projects and GitHub Portfolio: Develop personal projects that showcase your technical abilities and passion for software development. Create a portfolio on platforms like GitHub, where you can showcase your projects, contributions, and code samples. This can serve as additional evidence of your skills and dedication.While the resources you mentioned, such as the AWS Cloud9 documentation and CodeCatalyst, provide valuable information about development environments and tools, it's essential to complement your theoretical knowledge with practical experience. Build projects, engage with the software development community, and continuously learn and improve your skills. Focus on demonstrating your passion, problem-solving abilities, and willingness to learn and adapt to new technologies.Good luck with your application to Amazon as a software development engineer!CommentShareStefanoBanswered 15 days ago0Amazing.I wanted to know exactly about this.May I please know by starting as a 'fresher' in software development (without having any prior full time work experience in the field of software development), can I get my resume or Curriculum Vitae (CV) shortlisted for Software Development Engineer (SDE) job role in amazon.com company?If so, may I please know how can I do it?Can you pls let me know about this?Since there is no provision to attach a document in this message box, I am including the screenshot of my resume or Curriculum Vitae (CV) below for your reference.Curriculum Vitae of Vikas R                                                                                Name                : Vikas R                                                                                Mobile number: +91 9513898187                                                                                Email address   : victoryvikas12@gmail.com                                                                                Date of Birth     : 21/10/1985                                                                                Present address : 245, 5th Block, 67th Cross, Rajajinagar,                                                       Bangalore 560010Professional SummaryA tech professional with good computer operating skills and with a enthusiastic and positive frame of  mind for solving customer’s problems.October/November 2018 to January 2019Was working in Cognizant Technology Solutions (CTS) as a data processing associateOctober 2016 – January 2018Had gone to a European country called Poland for studying Master of Science (M Sc) course in Business Information Systems. The modules covered during the course wereSystem modelling and analysisInformation system modelling and analysisAdvanced databases andAdvanced topics in Artificial intelligenceCouldn’t complete the course as I had got lesser ECTS points in the first semester of the course. Dropped the course in between and came back to India in the month of January in the year 2018.June 2016 – September 2016Was working as a customer support executive in Aditya Birla Minacs for Apple itunes chat processQualificationInstitutionYear of PassingPercentageBachelor of ScienceSt. Philomena’s College (University of Mysore)2011/1253Computer skills• Installing and uninstalling of computer operating systems  • Documentation skills in Microsoft word, excel and powerpoint  • Proficient in understanding user requirements and translating to system requirementsSoftware skills• Strong knowledge of Core Java• Strong knowledge of Java frameworks Spring MVC• Good knowledge of Microservices architecture• Good knowledge of implementing web services REST and SOAPSoft skills• Good command over English language• Good written and verbal communication skillsDeclaration:I hereby declare that the above information is true to the best of my knowledge and belief.Date: 21-05-2023                                                                                Place: BangaloreI am indicating a job website link for your reference.https://amazon.jobs/en/jobs/2315695/software-development-engineer-device-osUsually, for all the software development job roles in Amazon.com company, after the resume or Curriculum Vitae (CV) gets shortlisted for the job role, the HR recruiter for that job role sends an online assessment link which contains some Multiple Choice questions for assessing my suitability for the job role that I have applied for.May I please know in order to get my resume or Curriculum Vitae (CV) as indicated above get shortlisted for this job role in Amazon.com company Bangalore location and get that assessment link to my email address indicated in my resume or Curriculum Vitae (CV) i.e victoryvikas12@gmail.com, may I please know what best can I do and how can I know more about it?I am very badly in need of a job for my survival and without getting a job offered to me in the company Amazon.com, I will be practically unable to live a sustained and balanced life.Can you pls let me know about this?CommentShareVikas Ranswered 7 days ago"


Question: Unable to send POST request to Express Application listening in EC2 instance

"My Express application which is listening on port 4000 is not receiving any request based on what I see in the application logs. However, I can send the POST request through postman on my development machine no issueI tried configurations such as opening up 4000 for all ip address or even all port for all ip address. I would always get the problem below"Failed to connect to [website] port 4000: Connection refused"I am using a form application which have limited capabilities to allow me to debug from the form side. The error message is the best I can get.The only way I could get the POST request successfully sent is by using ngrok on EC2 itself which I know would bypass many configurations. I used the HTTP link provided by ngrok, which means SSL is not an issue I think?Hence, I suspect the problem is on AWS side, but I am unfamiliar with AWS and is there a service I can use to identify the problem?FollowComment"

Answer: "0Can you tell us more about your setup? Is your EC2 instance behind an Application Load Balancer? Does your EC2 instance have a public IP address assigned? Is your EC2 instance in a public subnet? If not, do you have a NAT Gateway setup? Does your VPC have an Internet Gateway attached?Here is a tutorial for setting up a web server on an EC2 instance. In your case, just replace the PHP setup with your Node JS setup.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Tutorials.WebServerDB.CreateWebServer.htmlCommentShareAWS-User-3855171answered a year ago"


Question: New EC2 instance launching after Termination.  How to stop/prevent this cycle ?

"I terminated an EC2 instance but a few minutes later a new one launched.  I terminated once again, but another instance launches.  How do I prevent this from happening ?  I checked for auto-scaling and elastic-beanstalk but neither are enabled ?Thanks in advance for any pointers.FollowComment"

Answer: "0Accepted AnswerYou can start by seeing if there is information in the CloudTrail logs that points to who is issuing the ec2:RunInstance API call. See: Viewing events with CloudTrail Event history.CommentShareEXPERTkentradanswered a month agoEXPERTalatechreviewed a month ago0Thank you @kentrad !  There were enough breadcrumbs in the CloudTrail logs you suggested (i was not aware of this ability to track previously) to narrow down my rookie-error :) Somewhat embarrassing, a-hem.... These were spot instances which I'd set as persistent.  First time doing this.  So, basically I had to navigate in the console to "Spot Requests" and then: "actions" --> "cancel request".Thanks again!CommentShareessansanswered a month ago"


Question: Cognito - Dynamic Role

"Hi,i'm implementing an application in the IoT domain. Every user would be able to communicate with his personal provider, so i would like to have temporary credentials, using Identity Pools, that permit the user to publish and subscribe only for the topic associate with his device.There is a way to return temporary credentials based on a particular user? I would like federate Cognito User Pool with Identity Pool and use a way to have dynamic roles. So if the user X can only publish and subscribe the topic Y, i would like to return the temporary credentials linked to a role that permit only to operate with this topic.Have i to use the choose of role based on rule?Thanks in advance.Marco G.Edited by: MarcoG on May 18, 2019 3:45 PMFollowComment"

Answer: "0Hi,we have used the AttachPolicy method with Cognito User Pool and Cognito Identity Pool. In this way we can attach dynamically policy to user session.Thanks.CommentShareMarcoGanswered 4 years ago"


Question: AppSync Websocket - limit number of subscriptions

Does anybody know if in AppSync we can limit the number of subscriptions for each user to two subscriptions?FollowComment


Question: VPN server in VPC

"Just a quick question:Network A <---> DirectConnect <---> VPC1If I set up an OpenVPN server on EC2 in VPC1, I can't use it to access network A because I can't route the traffic from/to the VPN network through the VPC - is that correct or am I missing something?Thanks,MarcFollowComment"

Answer: "0Accepted AnswerHi Marc,Pat K from the Cohesive Networks team here.To the best of my understanding you are correct - but you still have some options.Lets pretend:VPC - 10.20.20.0/22Network Across Direct Connect - 192.168.0.0/16OpenVPN network - 172.16.0.0/24The direct connect will only route traffic to/from the VPC CIDR to the "across the direct connect"  CIDR.If you try to send packets to the on-premise from 172.16.0.0/24 they get dropped.If you try to send packets from 192.168.0.0/16 to 172.16.0.0/24 they get dropped.You will need to run a virtual gateway on the VPC side to some gateway on the other side of the direct connect.  Tis gets you "up and over" the AWS VGW restrictions.You could install strongswan/libreswan IPsec on your OpenVPN instance (if hand rolled and linux) and connect to an IPsec device across the direct connect.  You would define a "tunnel" between the two sides of 192.168.0.0/16 - 172.16.0.0/24.  Then your on-prem can route to your VPN.OR if your OpenVPN server is Linux you can use GRE to make a tunnel (layer 2 tunnel) to a router/gateway across the direct connect and both sides set a static route pointing to the GRE tunnel. (note this tunnel is unencrypted)OR use any of the appliance vendors in the AWS marketplace - depending on how many VPN credentials you need my company's free edition might meet your need.Happy to explain the "roll your own" further if you need.Cheers,Pat KCommentSharecohesivenetworksteamanswered 3 years ago0Hi Pat,yes, I already thought about building a tunnel from the VPN server to an on premise system. I just wanted to make sure I'm not doing something completely stupid because of some oversight :)Thanks a lot for your reply and for your kind offer!Cheers,MarcCommentShareMarcanswered 3 years ago"


Question: How to troubleshoot CloudFront 503 Errors

"My customer is seeing an alarming number of 5xx (503) errors on their most active CloudFront distribution.The distribution's origin is an S3 bucket containing frequently required assets. The S3 bucket metrics do not show the same failures, leading them to assume the CloudFront distribution itself is at fault. Are there other metrics we should be checking to help identify the root cause of this issue?FollowComment"

Answer: "1Accepted AnswerPlease check the CloudFront access logs for more details on the kind of error you are getting, especially the x-edge-detailed-result-type field.https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.htmlCommentShareEXPERTachrafanswered 3 years ago"


Question: Workdocs 'Shared with me' Sync issue. Is there a way to see which files are syncing or some type of troubleshooting for excessively long sync's.

My workdocs has been syncing for nearly 5 days now. I was trying to sync a massive file of 96 gig but it doesn't seem to be working. Normally with my internet that 96gb file would take 24-36 hours. Nothing I copy is now going to the drive. It just seems to be stuck. Is there a way to see waht files are syncing or some type of progress bar so I can figure out what it is is stuck on?FollowComment


Question: PostGres Light Sail DB Storage Full

"I'm unable to connect to my Light Sail Datbase and it say storage full, Unable to take or restore to higher snapshot or reboot or anything.FollowComment"

Answer: "0Dear Customer - Thanks for reaching out - I wanted to give my thoughts on the matter hereThe way to increase this instance's storage is by restoring a snapshot to a larger instance. There are 2 ways to restore the current snapshot into a new, larger instance in LightSail:If you have an existing/recent snapshot of the LightSail database(You cannot create a new snapshot while the instance storage is already full). Refer the below link for complete steps on creating a new lightsail database from snapshot:Creating a database from a snapshot in Amazon Lightsail - https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-creating-a-database-from-snapshotThe other method to achieve this would be through 'Emergency Restore':Creating a database from a point-in-time backup in Amazon Lightsail - https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-creating-a-database-from-point-in-time-backuphope this helps in your projectCommentShareEXPERTNIRUPAM_danswered 10 months ago"


Question: My EC2 Instance is going down

"My EC2 Instance is going down a day 3 to 4 times. I host there front End React and Back end Laravel Project. I need to reboot Instance couple of time, then its work. I failed to figure out what is the issue. could any body guide me please....FollowComment"

Answer: "1What do you mean by My EC2 Instance is going down? If it auto-reboots, can you find if there is any anomaly in CloudWatch metrics for the instance (e.g., CPU usage)? Also, I recommend taking a look at this article for troubleshooting performance issues. The troubleshooting article focuses on Linux so if there is any Windows issues, take a look at this article. Lastly, I recommend taking a look at application level logs on the instance, which is specific to the applications you are running (in this case Laravel).List the available CloudWatch metrics for your instancesI want to troubleshoot performance bottlenecks within my EC2 Linux instances. What advanced tools can I use with EC2Rescue for Linux to do that?CommentShareTaka_Manswered 7 months agoEXPERTIndranil Banerjee AWSreviewed 7 months ago"


Question: SES rejects email (in app and cli) as not being verified when the console shows verified

Literally what it says on the tin. I have added and verified email addresses to test my app. The console shows the green check mark. Regions all match. Yet I keep getting the  Email address is not verified. The following identities failed the check in region US-EAST-1. I assumed it was an issue with my app and tested with awscli and still the same thing.Is this just a matter of waiting till everything syncs or ??Using the cli docs own example.» aws ses send-email --from xxx@yyy.com --destination file://destination.json --message file://message.jsonAn error occurred (MessageRejected) when calling the SendEmail operation: Email address is not verified. The following identities failed the check in region US-EAST-1:  ...FollowComment

Answer: "0Apparently the console doesn't work. awscli did not list any identities. I added them from the cli, reverified and it all works. Time for a bug report I guess.CommentShareuntempered-clavicleanswered 9 months ago"


Question: API with ID {api-id} cannot be found - WebSockets API Gateway

"Hi all, I need help. I'm days into troubleshooting 403 responses from the /$connect endpoint on api gateway. I think that I've narrowed down the issues to IAM policy settings, and I'm pretty sure I either configured or didn't configure something correctly.When assigning permissions to the lambda using the aws-cli I see the following response:https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.htmlaws lambda add-permission --function-name arn:aws:lambda:{region}:{account-id}:function:{function-name} --action lambda:InvokeFunction --statement-id "ws-connect" --principal apigateway.amazonaws.com  --source-arn "arn:aws:execute-api:{aws-region}:{account-id}:{api-id}/*/$connect" --profile {aws-config-profile} --region {aws-region}{    "Statement": "{\"Sid\":\"ws-connect\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"apigateway.amazonaws.com\"},\"Action\":\"lambda:InvokeFunction\",\"Resource\":\"arn:aws:lambda:{region}:{account-id}:function:{function-name}\",\"Condition\":{\"ArnLike\":{\"AWS:SourceArn\":\"arn:aws:execute-api:{region}:{account-id}:{api-id}/*/\"}}}"}However when checking the lambda dashboard shortly afterwards, I see the following when I click on the API Gateway trigger icon:arn:aws:execute-api:{region}:{account-id}:{api-id}/*/The API with ID {api-id} cannot be foundThe Route Request settings for my $connect endpoint has the following settings:Authorization: NoneAPI Key Required: falseThe Integration Request for my $connect endpoint has the following settings:Type: Lambda FunctionUse Proxy Integration: falseLambda Region: {set to my region}Lambda Function: {set to my function}Invoke with caller credentials: {Not accessible, disabled}Execution Role: {set to an IAM role with the bellow policies}  - AmazonAPIGatewayInvokeFullAccess - AWS managed policy  - AWSLambdaRole - AWS managed policy  - AWSLambdaVPCAccessExecutionRole - AWS managed policy  - AWSLambdaBasicExecutionRole-{some-id} - assuming this was auto generatedUse Default Timeout: trueThe Integration response for my $connect route is configured.For simplicity assume my connection lambda returns a simple response.{status: 200, connectionId: event.requestContext.connectionId}In actuality, the lambda is coded to communicate to an ec2 instance over http. When testing the lambda, I see updates in the apache logs receiving the request with whatever data I'm sending, and its returning the response ok. I also see the expected CloudWatch logs.I use signed url's generated by the npm @aws-amplify/core Signer class. With authorization disabled at my $connect endpoint, the extra query params don't effect my request any, and I'd expect the query params to be passed through to the lambda. I can connect perfectly using npm wscat with or without the signed url's when I don't have an Integration Request set. However, after setting the Integration Request to use my Lambda, I can't connect anymore. This leads me to believe that there is something wrong with the roles/policies I have configured.One last quick point, is that within CloudWatch I do see logs from the lambda I have assigned to the /$disconnect route. It has the exact same permission and vpn configuration as the $connect route has.Any help would be appreciated in pointing me to the right direction, or helping me figure out why I'm unable to use a lambda integration with the $connect route.FollowComment"

Answer: "0I figured this out. It's not very clear when reading the documentation, which sections certain policy information should be setup in. I edited the Trust relationships of my $connect lambda role to the following. My application is now connecting and upgrading the web socket connection as expected.{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "Service": [          "lambda.amazonaws.com",          "apigateway.amazonaws.com"        ]      },      "Action": "sts:AssumeRole"    }  ]}CommentShareMyron152848answered 4 years ago"


Question: RDS postgreSQL engine upgrade from 10.21 to 14.4 version

"Before upgrading we need to update certain extensions before major upgrade.So in our case also we have PostGis extension with version '2.5.2' which needs to be altered to '3.1.5'I followed the steps as per the document i.e. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.PostgreSQL.CommonDBATasks.PostGIS.html#Appendix.PostgreSQL.CommonDBATasks.PostGIS.Update:~:text=1%0A(1%20row)-,Step%206%3A%20Upgrade%20the%20PostGIS%20extension,-Each%20new%20release1>PostGis was updated to 3.1.5 but not able to update the 'postgis_raster' extension which is one of the dependency of postgis. But this dependent extension is not showing from the following command output -> SELECT * FROM pg_extension;And to complete the upgrade of extension, run the upgrade command :SELECT postgis_extensions_upgrade();2>But the above command was giving below error:ERROR:  function postgis_extensions_upgrade() does not existLINE 1: SELECT postgis_extensions_upgrade();HINT:  No function matches the given name and argument types. You might need to add explicit type casts.3>And when I modified the engine version in RDS ,the precheck logs sent the below error:**The instance could not be upgraded from 10.21.R1 to 14.4.R1 because of following reasons. Please take appropriate action on databases that have usages incompatible with requested major engine version upgrade and try again.Following usages in database 'DB_NAME' need to be corrected before upgrade:-- The instance could not be upgraded because the PostGIS extension and its dependent extensions (address_standardizer, address_standardizer_data_us, postgis_tiger_geocoder, postgis_topology, postgis_raster) installation in one or more databases is not compatible with your desired upgrade path. Please upgrade postgis and its dependent extensions to version supported in requested version.**4>Then I also tried deleting this extension but still RDS throwing the same error in precheck logs.**Need help in upgrading the postgresql as the version 10 is deprecated and I'm not able to upgrade it because of this extension and  AWS will also automatically upgrad to version 14 but they might also face issue this issue in upgrading our database.FollowComment"

Answer: "1Accepted AnswerHello yanshul,This issue can occur when an old version of postgis_raster (which was not supported on newer versions) exists in the database. These older versions were installed as functions and not extensions hence would not show up when you run "show rds.extensions”.I was able to reproduce the issue, and here are steps to resolve itFirst check if any function or libraries related to version 2 RASTER is still installed in database bypostgres=> select probin from pg_proc where proname = 'postgis_raster_lib_version';probin---------+-------$libdir/rtpostgis-2.5Check number of objects created in version 2postgres=> SELECT probin, count(*) FROM pg_proc WHERE probin LIKE '%postgis%' GROUP BY probin;probin | count-----------------+-------$libdir/rtpostgis-2.5 | 104Now add PostGIS extension (if you don't have installed) to the database where you are having issueCREATE EXTENSION postgis; (this will create extension with 3.1.5 version)To check full PostGIS extension version with "RASTER lib" version and statuspostgres=> SELECT postgis_full_version();postgis_full_version-----------------+-------POSTGIS="3.1.5 c60e4e3" [EXTENSION] PGSQL="100" GEOS="3.7.3-CAPI-1.11.3 b50468f" PROJ="Rel. 4.9.3, 15 August 2016" GDAL="GDAL 2.1.4, released 2017/06/23" LIBXML="2.9.1" LIBJSON="0.12.1" LIBPROTOBUF="1.3.0" WAGYU="0.5.0 (Internal)" RASTER (raster lib from "2.5.5 r0" need upgrade) [UNPACKAGED!] (raster procs from "2.5.5 r0" need upgrade)We have to drop the libraries related to version 2. To do that log in with master user and drop 'postgis_raster_lib_version'postgres=> drop function postgis_raster_lib_version;DROP FUNCTIONpostgres=> select * from pg_proc where proname = 'postgis_raster_lib_version';proname | pronamespace | proowner | prolang | procost | prorows | provariadic | protransform | proisagg | proiswindow | prosecdef | proleakproof | proisstrict | proretset | provolatile | proparallel | pronargs | pronargdefaults | prorettype | proargtypes | proallargtypes | proargmodes | proargnames | proargdefaults | protrftypes | prosrc | probin | proconfig | proacl---------+--------------+----------+---------+---------+---------+-------------+--------------+----------+-(0 rows)Drop PostGIS extension (this will drop PostGIS version 3 but version 2.X will remain installed):DROP EXTENSION postgis CASCADE;Drop all raster related type from database:DROP TYPE raster CASCADE;Review number of objects in raster version 2postgres=> SELECT probin,count(*) FROM pg_catalog.pg_proc WHERE probin LIKE '%postgis%' GROUP BY 1;probin | count-----------------------+-------$libdir/rtpostgis-2.5 | 8we have to drop all functions manually:postgres=> SELECT proname FROM pg_catalog.pg_proc WHERE probin LIKE '%postgis%';proname-----------------------+-------postgis_raster_lib_build_datepostgis_gdal_version_st_summarystats_finalfn_st_histogram_st_quantile_st_valuecountst_gdaldriversst_minpossiblevaluepostgres=> drop function postgis_raster_lib_build_date;DROP FUNCTIONpostgres=> SELECT probin,count(*) FROM pg_catalog.pg_proc WHERE probin LIKE '%postgis%' GROUP BY 1;probin | count--------+-------(0 rows)Now you can go back to AWS Management console and upgrade RDS PostgreSQL instance.CommentSharerePost-User-prkanswered a month agoyanshul a month agoThanks for the detailed explanation.Share"


Question: Rekognition Collection Limit

"Hi everyone,Looking at the Rekognition Guidelines and quotas I don't see any mention of how many Collections you can have in an account. Would there be any problem in having millions of collections?Thanks for your help.FollowComment"

Answer: "1HI,The Maximum number of faces you can store in a single face collection is 20 million.The maximum matching faces the search API returns is 4096.DetectText can detect up to 100 words in an image.DetectProtectiveEquipment can detect Personal Protective Equipment on up to 15 people.refer-https://docs.aws.amazon.com/rekognition/latest/dg/limits.htmlIf the Answer is helpful, please click  Accept Answer & UPVOTE, this can be beneficial to other community members.CommentSharelearn2skillsanswered 9 months agorePost-User-4786410 9 months agoThank-you; however this does not answer my question. I'm interested in the maximum number of Collections, not the other limits listed.Share"


Question: How to estimate size and number of DMS instances for a given number of ongoing replications

"A customer is looking to use DMS to replicate 20 SQL Server 2016 Databases, ongoing to S3 for their Datalake. I am looking for advice/guidance onwhat replication instance size I should recommendHow many replication instances they should use to replicate 20 databases ongoingThe customer estimates that each databases only has a few thousand transactions per day (they're not hugely high throughput databases).If anyone has any guidance beyond the very general guidance offered in the DMS User Guide, I would be very grateful!FollowComment"

Answer: "0Accepted AnswerGeneral guidance starts with suggesting customer not to use t2 instance type. Because t2 instance types are designed for light workloads with occasional bursts in performance. We recommend using this instance class to learn about DMS and do test migrations of small, intermittent workloads.There is no such formula based on which someone can identify the size of replication instance. Because it is entirely dependent on few points like below:-Amount of tables to be loaded in parallel (during full load). By default DMS migrates 8 tables in parallel per task, you can either increase or decrease the number of tables to be migrated as per the size of replication instance. Or alternatively you can set the maximum number of tables to be loaded in parallel based on the resources (memory, CPU) on replication instance.-Important point to note here is, even if customer starts with a lower size replication instance. And later plans to upgrade the replication instance to a higher instance type, it can be done seamlessly. Replication tasks running on the replication instance will be stopped and resumed automatically (without manual intervention) once the scale compute is complete.-Once the full load is complete, then resources will be utilized by the amount of data being pushed on source database. DMS reads data from source database by running queries (in case of sql server) on transaction logs and push the filtered changes to target database.-DMS will only store those changes on replication instance in case if DMS is unable to push changes to target in the same speed as they are being applied on source database.It is always recommended to monitor the replication instance resources and scale them as per the resource utilization. There are some guidelines in choosing the right replication instance type in https://aws.amazon.com/blogs/database/aws-dms-now-supports-r4-type-instances-and-learn-to-choose-the-right-instance-class-for-migrations-using-aws-dms/ which should be your starting point.Lastly, there is a blog about monitor DMS instance metrics and scale it dynamically. https://aws.amazon.com/cn/blogs/database/how-to-scale-aws-database-migration-service-dms-replication-instances/Please let me know if you have any questions on this.CommentShareEXPERTViqashanswered 3 years ago"


Question: CodePipeline Source Action Fails with "[GitHub] InternalError"

"Recently, one of my CodePipelines has stopped working due to the source action failing with "[GitHub] InternalError". I can't seem to find any further details regarding this error, so I'm hoping for some insight. This is using the GitHub (Version 2) action provider.It seems to be specific to this one repo, as I've tested using other repos in our GitHub organization, and the Source action then succeeded.FollowCommentciarand a year agoWe are experiencing the same issue. Pipeline ran successfully previously but recently fails with generic Git message.FYI we use Git LFS and can confirm that removing large LFS file "fixes" the issue in that the pipeline builds.Share"

Answer: "0The error appears to be coming from GitHub as per this similar issue here.To troubleshoot this issue, we require information that is not public. Please open a support case with AWS Support using the following link.CommentShareUgochukwu_Ianswered a year ago"


Question: botocore.errorfactory.InvalidImageFormatException: An error occurred (InvalidImageFormatException) when calling the DetectCustomLabels operation: Request has invalid image format

"I want to use python to connect with the AWS Rekognition to get the detect label results, but I have been trying this for a long time, and whenever I want to use python to connect to my project which I chose the "bounding box" one in Rekognition, and it shows "botocore.errorfactory.InvalidImageFormatException: An error occurred (InvalidImageFormatException) when calling the DetectCustomLabels operation: Request has invalid image format".I have read the developer guide and I know I use the right format which is "PNG".I would wonder if there are something that I miss?Thank you very much.FollowComment"

Answer: "0Hi,Thanks for using Rekognition Custom Labels.This could be a case the image has certain metadata that's corrupted thus preventing it from being properly processed. Sometimes even when an image viewer is able to display the image, the metadata can still be in a corrupted state.A quick way to check is using Python Pillow library to open the image and inspect. Here is a reference to the examples.If it does pass the Pillow library image opening test, feel free to create a support ticket which we can help you better.Thanks!CommentShareaws-renjunanswered 9 months ago"


Question: S3 files disappearing

"We are using a WordPress plugin to manage our Media Library files to be stored and served by AWS S3, and notice one folder for an entire website had most (but not all) files removed from it; we are checking with the plugin developer to see if they have any input on what happened to cause this, but we are wondering if there is any "backup" to these files or ways to restore/recover the missing files? Our web host company does nightly backups of the websites, but as these files are not stored on the server, they are not included in their backups. Is there any way to recover these files or any additional advice on next steps to see what we can do in this case? Thank you for your help!FollowComment"

Answer: 0There could be if you have versioning enabled on the bucket.CommentShareEXPERTkentradanswered 3 months ago


Question: CloudFormation StackSet deployment not working properly

"Hi AWS, I was trying to create a CloudFormation StackSet using Service-Managed permission model. I have selected the right OU and region but when I am submitting it for deployment it shows zero stack instances. I have tried it with several AWS OUs present but everytime it is showing zero stack instance.This is the first time I have experienced such an issue. Please help.FollowCommentDidier_AWS a month agoCan you share the Cloudformation stack events on console that you see when submitting your stackset for creation by CFN?Share"

Answer: "0Which kinds of resources do you deploy with this stackset?Did you try to deploy the corresponding unitary stack (i.e outside of stackset) in one single region to see how long it takes?CommentShareDidier_AWSanswered 18 days agoArjun Goel 17 days agoI have deployed an IAM role along with a policy attached to the role. It was deployed at the Organization Unit (OU) with a difference filter to exculde the deployments in couple of AWS accounts.ShareDidier_AWS 16 days agoHi, can you try to install this role (or another less risky one) into all accounts of the org with no filter to see if it is any faster?Share0Do you see any errorsCommentSharemyronix88answered 18 days agoArjun Goel 18 days agoNo error, but the stack instances is showing after an hour or so, why is that?Share"


Question: Amazon Cognito | Verify format of SAMLRequest sent to IDP

"We are integrating with a partner who uses Amazon Cognito and we are the IDP. They have loaded our IDP metadata file and when I send a request to their authorization endpoint to initiate the SAML session, we receive a request containing SAMLRequest and RelayState values.Amazon Cognito documentation does not state how the SAMLRequest and RelayState are generated/formatted.Are these values encrypted and then Base64 encoded? Are there any samples or examples available of what an unencrypted SAMLRequest contains?FollowComment"

Answer: "0Hi,Cognito SAML Request are following SAML 2.0 standard are are not encrypted only signed.You can find more information in https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-saml-idp.htmlCognito SAML Metadata can be constructed based on https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-integrating-3rd-party-saml-providers.htmlJeffCommentShareJeff Lombardo-AWSanswered 2 months agorePost-User-3169185 2 months agoThank you, Jeff. Where can we configure signing of the SAMLRequest? We were able to decode and decompress the SAMLRequest, however there is no signature element included with the AuthNRequest XML received from Cognito.Share"


Question: Increasing EBS Volume disk size created a 3rd drive on Windows Disk Management

"I have 2 EBS storage volumes attached to a Windows EC2 instance.  The volumes were 40gb and 100gb.  I increased the 100gb disk to 300 gb, and RDP'ed to the EC2 Windows box ran disk management to allocate the new space to the D drive, but this is what I found instead:https://pasteboard.co/swhXG4lEqQDA.pngIt shows a new drive W that isn't formatted, but has 200gb unallocated to it.  Now if I look at the total amount of space available I'd have 40gb (C:/) + 100gb (D:/) + 300gb (W:/)= 440gb!?  But in the AWS console I show only 340gb total between 2 EBS volumes.  Which brings up the issue that if I format the disk I might be overwriting data because there isn't 440gb allocated.  I've tried rebooting the box without success it still shows this extra drive.  And I can't find any information about this situation or how to fix it.FollowComment"

Answer: "1Hello,Thanks for your post. If the instance type supports instance store volume then it is possible that 3rd drive is "Instance store" [1] volume. You can verify instance type information here [2].[1] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html[2] https://aws.amazon.com/ec2/instance-types/To verify the exact issue, I will request you to open a support case with the resource detail.https://docs.aws.amazon.com/awssupport/latest/user/case-management.htmlCommentShareSUPPORT ENGINEERNeha_Ranswered a year ago"


Question: How to test Route 53 Resolver Inbound and Outbound Endpoint in Hybrid DNS

"Hi guys!I'm looking for an instruction to test Route 53 Resolver Inbound and Outbound Endpoint in Hybrid DNS.I found the workshop link, but this link just only tests the outbound endpoint, not inbound.The architecture should be like thisIf you know any documents or tutorials, please help me!FollowComment"

Answer: 1Accepted AnswerHi StevenThe below Knowledge center article has the steps to configure and test R53 inbound resolver endpoint.https://aws.amazon.com/premiumsupport/knowledge-center/route53-resolve-with-inbound-endpoint/CommentShareEXPERTTushar_Janswered 7 months ago


Question: How to set up / access the Spark UI for AWS Glue jobs and notebooks

"The checkbox in a Glue job is select to enable the Spark UI, and an s3 path is specified as the location for those logs.  How can I access the Spark UI URL?FollowComment"

Answer: "1Accepted AnswerYou need to deploy you own history server to visualize those longs, you can use a CloudFormation template, a docker container (you can also run locally a history server from a Spark distribution but adding s3 support requires a bit of work).See steps here: https://docs.aws.amazon.com/glue/latest/dg/monitor-spark-ui-history.htmlCommentShareGonzalo Herrerosanswered a month agoEXPERTalatechreviewed a month ago"


Question: Amplify CLI/Studio with existing MySQL DB

"Is there a way to use Amplify CLI/Studio to create a GraphQL/AppSync API without using DynamoDB or any datastore for that matter?  I would assume it would just add a comment section to the VQL files where one would have to add the datastore specifics.  This would allow me to use the Amplify CLI/Studio toolchain for creating backends that aren't necessarily hooked up to DynamoDB.Apparently you can only use amplify add api if you want to use a new DynamoDB database.  There's a way to make it inspect an existing DB and create GraphQL models from the schema, but that's not what I want.  I want to be able to create an api, add my VQL, then push it.It seems like overkill to have to use raw CloudFormation for something so simple.FollowComment"

Answer: "0Thank you for reaching out us regarding the above query. I would like to share that, AWS Amplify CLI currently supports importing serverless Amazon Aurora MySQL 5.6 databases. The detailed approach of integrating the same with Amplify is mentioned in the below article:[+] https://docs.amplify.aws/cli-legacy/graphql-transformer/relational/It is also worth noting that AWS AppSync is completely GraphQL based and supports the data sources mentioned in the below article :[+] https://docs.aws.amazon.com/appsync/latest/APIReference/API_DataSource.htmlHence if you are manually able to configure AppSync to use the VQL datasource by writing custom resolvers, in that scenario you would be able to use the same API in amplify as :[+] https://docs.amplify.aws/lib/graphqlapi/existing-resources/q/platform/js/#re-use-existing-appsync-graphql-apiHowever I assume the VQL datasource is hosted outside of AWS (or not), the best approach to retrieve data from the VQL source with Amplify using AppSync API would be to use AWS Lambda as a datasource. Kindly refer to below diagram :Amplify generated AppSync API ===> AWS Lambda Function as datasource ===> Lambda retrieves data from VQL source .Please refer to the below articles to setup the above architecture :Creating AWS Lambda datasource with AppSync in Amplify    :https://docs.amplify.aws/cli/graphql/custom-business-logic/#lambda-function-resolverUsing Lambda with Appsync to get data from RDS datasource :https://aws.amazon.com/blogs/mobile/connect-amplify-datastore-with-existing-sql-datasources-adding-offline-and-sync-features-in-your-application/Connecting Lambda to VQL source:https://community.denodo.com/kb/en/view/document/How%20to%20connect%20from%20an%20AWS%20Lambda%20Function%20to%20Denodo%20using%20the%20JDBC%20Driver?tag=ConsumersThe third article describes creating Lambda functions to access VQL sources. Please note that, the article is a third party knowledge item and AWS does not endorse any solutions mentioned in the article, the same has been recommended on best effort basis for reference purposes only.Having said that, in case you face further challenges, please feel free to open a support case with AWS using the following link.CommentShareSUPPORT ENGINEERSubhayu_Manswered 7 months ago"


Question: Mining cryptocurrency with AWS

"Hi,I recently looked at creating my own VM using:P4d.24xlarge instance typex8 Tesla A100’s96 CPU’s to help increase my hash rate of mining Ethereum with AWS.I was met with an issue to advise I would not be able to secure this apparently due to the following reason:“EC2 service team has informed, they will not be able to approve this limit increase as per this moment. The reason why the quota increase was denied is related to a rapid increase in the customer's demand for our high-performance GPU instances, over the last few months, that is surpassing our availability.”I was pretty sure Amazon does have this available but due to maybe being a new customer they wouldn’t allow me to use this set up? Maybe I have to build a track record with them or something but it’s really frustrating trying to get any decent GPU along with CPU set up with AWS that’s cost effective to mine crypto with them.Any help or advise on this knowledge would be really appreciated.ThanksMikeyFollowComment"

Answer: "0Can you please tell how much old is your Amazon AWS Account from which you are doing mining,I am pretty sure I can help you.CommentShareAhmanswered 10 months ago"


Question: EC2 pricing document question

"https://docs.aws.amazon.com/whitepapers/latest/how-aws-pricing-works/estimating-amazon-ec2-costs.htmlAbout Elastic IPs, we read (emphasis mine):"Clock hours of server time: Resources incur charges when they are running—for example, from the time Amazon EC2 instances are launched until they are terminated, or from the time Elastic IPs are allocated until the time they are de-allocated. "(I read this to mean EIPs are not free - charges are incurred for allocated EIPs whether the EC2 exists or not.)And later in the page we read:"Elastic IP addresses: You can have one Elastic IP (EIP) address associated with a running instance at no charge."So the way it's written, it can be confusing.  At face value, these two quotes appear to contradict each other.  IIRC, the first associated IP is free, but if it's not associated or not first, then there are charges - which isn't so clearly stated at the web page, imho.HTH?FollowComment"

Answer: 0Changing this post to "answered" - it wasn't much of a question in the first place.  ;)CommentShareWorkingDaddyanswered 3 years ago


Question: RBAC for API Gateway endpoints using Cognito user groups

"A customer would like to create user groups in cognito (for example admin, customers etc) with specific roles attached to each group.They would like to use these roles policy to determine if user has access to api gateway endpoints like /admin or /home etc. The api gateway uses cognito authorizer and they want to avoid writing a custom lambda authorizer. The application uses Cognito user pool and SAML.  Currently the id_token contains cognito:roles attribute in its claims but customer would like to understand how to use this attribute to allow/deny acccess to api.From what I understand this is possible to do with IAM Authorization - here but I dont see this possible with Cognito user pool and groups.What is the correct way to allow or deny access to the api gateway endpoint before it is even processed by the lambda function for the api.Is there an alternate/better way to achieve this using REST API?FollowComment"

Answer: "2Accepted AnswerHi,You will not be able to implement RBAC using the default Cognito authorizer, to implement RBAC with API Gateway using Cognito token you have two options:Using lambda authorizer that validate and decode the token then inspect claims in the token to determine if the call should be allowed or denied. You can use AWS-JWT library to implement this authorizer. The library supports verification of cognito:groups natively, here is an example.The other option is to use the ID-Token generated from Cognito user pool to get temporary credentials using Cognito Identity Pool using Role-based access control approach. This allows you to assume the role defined in the token and get temp credentials based on the permissions this role has. then you need to use IAM Authorizer on API Gateway side and use AWS SDK or Amplify to invoke APIs using the temp credentials returned from cognito identity pool.I believe #1 is easier to implement since API Gateway supports lambda authorizer, #2 could be helpful if you need to implement RBAC to access services other than API Gateway. This recording could be helpful to expand on the options available with approach #2.CommentShareEXPERTMahmoud Matoukanswered a year agoEXPERTParnabreviewed a year ago1There is info on this process in the blogpost "Building fine-grained authorization using Amazon Cognito User Pools groups"Your customer will need to create a Cognito identity pool, and configure the Cognito user pool as an authentication provider.By default, Cognito identity pools have just an Authenticated and Unauthenticated role - but when setting up the user pool as the Cognito identity pool's authentication provider, you can specify "Choose role from token" under "Authenticated role selection". This will override the default authenticated role for the identity pool, and instead use the IAM role associated with the user's Cognito user pool group.You can attach a policy to this role to control access to particular API - here are some examples of setting up this policyCommentSharejoepanswered a year ago0I believe this is the documentation you need.This is a fairly advanced configuration of API Gateway that relies on the templating feature for Integration requests.  These templates are written in Apache VTL and are, in my experience, difficult to troubleshoot.  That being said, once it works, it works quite well.CommentShareDan_Fanswered a year ago"


Question: How to use AWS EventBridge with Python Lambda and Boto?

"I played around with AWS a little bit and ended up at AWS EventBridge. I tried to write a Lambda for testing and understanding, but got an error just at the beginning.import json, boto3def lambda_handler(event, context):    client = boto3.client('events')    response = client.create_event_bus(    Name='TestEventBus',    EventSourceName='SomeSoucreEvent')    return {        'statusCode': 200,        'body': json.dumps(response)    }I get the following error message:Response: { "errorMessage": "'CloudWatchEvents' object has no attribute 'create_event_bus'", "errorType": "AttributeError", "stackTrace": [ " File \"/var/task/lambda_function.py\", line 5, in lambda_handler\n response = client.create_event_bus(\n", " File \"/var/runtime/botocore/client.py\", line 563, in getattr\n self.class.name, item)\n" ] }The version of Boto running in the Lambda is 1.9.42FollowComment"

Answer: "1First of all, with your codeclient = boto3.client('events')response = client.create_event_bus(you are accessing the CloudWatchEvents, not AWS EventBridge (as the error message states - reason why is stated below)."CloudWatchEvents' object has no attribute 'create_event_bus'"Moreover, EventBridge isn't available in the Python and JS lambda environment yet (via default packages). I assume AWS has not the latest version of their SDK running in lambda, you could upload your own code as a bundle bundle or work with lambda layers and install your custom NPM dependencies (assuming you will run it as JS). That way you could install the latest SDK version of AWS (NPM) and use EventBridge (EventBridge was announced one month ago).Furthermore if you take a look a the boto3 documentation https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/events.html#eventbridge, it states that it is (as of now) version 1.9.205 (see also the /api/latest/ in the URL).If you open up the documentation for 1.9.42, the version you added to your report (I assume you got this out of the lambda), via this URL, https://boto3.amazonaws.com/v1/documentation/api/1.9.42/reference/services/events.html#eventbridge , you will see that the version 1.9.42 does not have EventBridge implemented.It only features CloudWatchEvents and that's why you can only access EventBridge with boto3 (as of now). You have to wait until AWS updates the boto3 version on lambda's or you have to manually deploy your bundle and run it.Edited by: MartinJK on Aug 12, 2019 10:06 AMCommentShareMartinJKanswered 4 years ago"


Question: The Payload parameter for Lambda must be valid JSON

I have a Maintenance Window which runs a Lambda as one of the Tasks.Within the Task i have specified the Payload as "{{RESOURCE_ID}}".This is so that the Lambda can execute against the instance list within a defined Resource Group.This Resource Group is defined within the Maintenance Window Targets page.This all works fine....I'm now trying to build this using a cloudformation template with the Lambda task details within "AWS::SSM::MaintenanceWindowTask".The problem i'm having is that i've tried various formats of entering the Payload information under..."TaskInvocationParameters:"MaintenanceWindowLambdaParameters:"... but i'm not able to successfully load the template. It keeps failing with "The Payload parameter for Lambda must be valid JSON"The AWS docs specify that the Payload data needs to be converetd to Base64. I've tried the following formats which have all failed with the same message....Payload: !Base64 '{"instanceId": ["{{RESOURCE_ID}}"]}'Payload: !Base64 {"instanceId": ["{{RESOURCE_ID}}"]}Payload: !Base64 '{{RESOURCE_ID}}'Payload: {"Fn::Base64" : "{{RESOURCE_ID}}"}Payload: "{{RESOURCE_ID}}"Payload: !Base64 '{"instanceId": "{{RESOURCE_ID}}"}'Any ideas where i'm going wrong?FollowComment


Question: EC2 Instance will not start

"EC2 Instance: i-08ef46aa29363d569 was not responding. I stopped it. It took many minutes to stop. Now it is trying to start and has been in a "Pending" state for about 15 minutes.Can anyone help?Thanks,WillFollowComment"

Answer: "0It eventually, maybe one half hour, completed stopping.Then starting took another hour, but now it is running again.CommentShareWillPrescottanswered 4 years ago"


Question: ERR_CONNECTION_REFUSED when building employee directory app

"I'm a beginner going through the tutorial to create the "Employee Directory App" from the AWS Technical Essentials program. I've gone through each step in detail, successfully launching my instance on EC2. When copying the public IP in a new browser tab as shown in the video, I get an ERR_CONNECTION_REFUSED error.I've double checked everything (Security Groups, Permissions, etc...) and everything matches what was done in the video. Any idea what may be causing the error?Thanks!FollowComment"

Answer: "0Please refer to the following document to confirm that the problem is not on the browser side.https://support.google.com/chromebook/answer/1085581?hl=enAlso, see if you can connect to the EC2 IP address from your computer with the following command.If you are able to access the site with the following commands without any problems, the problem may not be on the EC2 side, but on your computer.curl http://EC2 IPaddressCommentShareEXPERTRiku_Kobayashianswered 20 days agorePost-User-6756397 20 days agoThanks for the suggestion. Unfortunately, still no luck. I checked what was recommended by Google support and that didn't work. I also ran the curl command and got this error: "curl: (7) Failed to connect to [EC2 IPaddress] port 80 after 94 ms: Couldn't connect to server"ShareRiku_Kobayashi EXPERT19 days agoI thought that the web server was not running on EC2.How is the web server installed?Also, can you share the operating system you use for EC2?Share0you might want to check the user data script that should install the application on the ec2 instance, and whether it is compatible with the AMI you are using, you can connect to the ec2 using instance connect and then try to run the script manually with sudo permissions and see if it gives any errorsCommentShareMahmoud Salaheldinanswered 20 days ago"


Question: Central ECR for ECS in multiple accounts

"A customer would like to have a central ECR. Is there a reference architecture, best practice to share?FollowComment"

Answer: "0Accepted AnswerBelow are a couple articles you can reference.https://aws.amazon.com/blogs/devops/how-to-use-cross-account-ecr-images-in-aws-codebuild-for-your-build-environment/https://aws.amazon.com/premiumsupport/knowledge-center/secondary-account-access-ecr/For your information, ECR now supports cross account image replication.https://docs.aws.amazon.com/AmazonECR/latest/userguide/replication.htmlIf the customer would like to distribute container images to the individual AWS account instead of using central ECR repository, this feature would be helpful for them.CommentShareAWS-User-0246418answered 3 years agoEXPERTmreferrereviewed a year ago0Another alternative -- especially helpful if the ECR Policy get too big --  is to use the AWS:PrincipalOrgID condition to allow every account in the Organization to access the ECR Repository: check out this blog post showing how.Beware: this allows all accounts in an Organization to access the ECR repository! Double check with your security team if this is allowed!CommentSharevlaaaaaaadanswered 2 years ago"


Question: Nameserver Not Working

"The Nameserver given by AWS isn't working as it is supposed to be, how can this be fix with new nameservers?FollowCommentAWS-Everett 4 months agoDo you mean the AmazonProvidedDNS in your VPC? Could you be more specific about how you feel it is not working? Can you query www.example.com?Share"


Question: RDS Reserved Instances

"According to FAQ (RDS) there is no need to chose a specific AZ when purchasing reserved instances for RDS.Is this true?https://aws.amazon.com/rds/faqs/"Q: Will there always be reservations available for purchase?Yes. Reserved Instances are purchased for the Region rather than for the Availability Zone. This means that even if capacity is limited in one Availability Zone, reservations can still be purchased in that Region and used in a different Availability Zone within that Region".FollowComment"

Answer: 0Accepted AnswerYes that is correct.For example to purchase a reserved DB instance the customer goes through the steps  described in the docs. As you will see there the customer needs to select whether they want to reserve a MultiAZ option or not but not a specific AZ.CommentShareAWS-User-7011152answered 7 years agoEXPERTsdtslmnreviewed 8 days ago


Question: Concern regarding enbling cluster relocation on an existing Redshift cluster with port 8192

"Hi all,I turned on cluster relocation for one of my redshift cluster which was created in past with accessibility on port 8192. And in doing so I was successful.The Redshift page on console also shows that the cluster relocation is enabled.I am going through the Redshift doc - https://docs.aws.amazon.com/redshift/latest/mgmt/managing-cluster-recovery.html and the limitations section says that I can't turn on relocation for a cluster running on port other than 5439. Where as I was able to successfully do so.Can you please help? Am I missing something here?FollowCommentAWS-User-2942052 4 months agoOpened a ticket with AWS support, the restriction stated in the doc is incorrect and AWS team is updating it.Share"


Question: Cognito Federated user logout

"For cognito user - Using Amplify I was able to login usingawait Auth.signIn(this.email, this.password);And logout using:Auth.signOut();For federated user - Using Amplify I was able to login usingawait Auth.federatedSignIn({ customProvider: 'customProviderName' });But logout doesnt support using:Auth.signOut();How can I signout federated user, so that when I try to login again, it ask my permission to login ?FollowComment"

Answer: "0According to the documentation (here), you need to either redirect the user to the Cognito endpoint:GET https://mydomain.auth.us-east-1.amazoncognito.com/logout or perform the GET yourself and then redirect to the correct sign-in location. The former is going to be easier.CommentShareMarc Schurichtanswered a year ago"