Question: Is there any advantage of using an Interface VPC Endpoint in this scenario?

I have a Fargate container running in a private subnet using the KPL to write to my Kinesis Data Stream.  I don't have any latency issues but my NAT gateway bill is pretty high.  What would I gain by using an interface VPC Endpoint here over just continuing using my current way.  I'm thinking based on this(https://docs.aws.amazon.com/streams/latest/dev/vpc.html) that this might be a way for me to cut my NAT costs but would love some feedback.FollowComment

Answer: "3Accepted AnswerIts definitely recommended to use VPC endpoints (Interface or Gateway) where applicable. Not only will it reduce your NAT gateway bill but it is also good option from Security posture perspective. When your applications use VPC endpoints traffic stays on AWS backbone network and does not travel public Internet. When a workload architecture uses VPC endpoints, the application benefits from the scalability, resilience, security, and access controls native to AWS services.CommentShareEXPERTTushar_Janswered 4 months agoBrettski-AWS EXPERT4 months agoNote that traffic using public IP addresses between AWS endpoints (so, AWS services or EC2 to AWS services - anything that uses AWS public IP addresses) stays on the Amazon network. It does not traverse the public internet. This is mentioned in the VPC FAQ. Yes, public IP addresses mean you can connect to the public internet but it doesn't mean that you have to.Share0Thanks.  That's what I was thinking but I just wanted re-assurance.CommentSharesmithatlantaanswered 4 months ago"


Question: Generated policy failing during proccess

"Hi,Actually we try to  generate a policy based on CloudTrail events, but we have Control Tower and a centralized bucket for all cloudtrails to all our accounts.We follow this blog: https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation.html#access-analyzer-policy-generation-cross-accountbut still give the error: "Incorrect permissions assigned to access CloudTrail S3 bucket. Please fix before trying again."We already  update the bucket policy, bucket ownership and we dont use KMS on it.Any advise or glue about what we miss ?Thanks in advance,FollowCommentKarlos 8 months agobtw, we just append the policy mentioned on blog to the existing one created by Control TowerShare"

Answer: "0Accepted AnswerHi ThereIn the policy, it mentions AccessAnalyzerMonitorServiceRole* arn as a condition."StringLike": {  "aws:PrincipalArn": "arn:aws:iam::${aws:PrincipalAccount}:role/service-role/AccessAnalyzerMonitorServiceRole*"It allows access if the role accessing the bucket belongs to an account in your organization and has a name that starts with AccessAnalyzerMonitorServiceRole. Using aws:PrincipalArn as a Condition in the Resource element ensures that the role can only access activity for the account if it belongs to account A.Can you verify the name of the role that you are using (See Step 1) ?CommentShareEXPERTMatt-Banswered 8 months agoKarlos 8 months agoindeed the role was created for the proccess and call: AccessAnalyzerMonitorServiceRole_W99N7OHOS6Share0Indeed, we actually use this service-role:CommentShareKarlosanswered 8 months ago"


Question: Can I specify GET URL path parameter in step function?

"I have a lambda exposing a GET /path/:parameter endpoint and I want to invoke it as part of a Step Function state machine, taking the value of the :parameter from one of the input fields. Is this even possible? All I've been able to find in the documentation is how to specify JSON paths for input and output, and they always seems to be for POST calls.FollowComment"

Answer: "0From the information that you have provided, it seems to me that you are trying to create a step function state machine that uses lambda.Refer to this documentation it could be what you are looking for: https://docs.aws.amazon.com/step-functions/latest/dg/tutorial-creating-lambda-state-machine.htmlIf you cannot find what you are looking for in this documentation, please share more about how you are designing your step function, and how you are taking the :parameter value from the input field.CommentSharecindy_wanswered a year agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: TargetNotConnected when opening a SSM session on EC2

"Hi all,I'm a beginner and I apologize for the silly question. I have two EC2 instances on the same availability zone, to which I attached the same IAM role containing the policy AmazonSSMManagedInstanceCore. This policy should allow working with SSM.While I can start and open a session for tunnel forwarding via AWS CLI with the first instance, I cannot do the same for the second one, and I don't understand why.When I start the first instance, I see it under the target instances in the session manager. If I do it for the second one, this isn't the case.I went through this -> https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-troubleshooting.html#ssh-target-not-connected, but I couldn't solve the issue.It might be a simple solution, but I cannot see it without help.RegardsAP.FollowComment"

Answer: "0could you please check if SSM agent is installed. I am not sure which OS you are using. Hence here is the link that might help https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.htmlCommentShareSrianswered a year ago0Hi!If one instance works and the other doesn't, could you check the following:Are both instances started from the same OS (and from the same Amazon Machine Image)?Do they both have similar configuration, specifically the instance profile (IAM) for the ec2 instances?Is the SSM Agent installed on the troublesome EC2 instance?Do the instances have the proper outbound connectivity?  (Outbound to some AWS services including ec2messages.region.amazonaws.com, ssm.region.amazonaws.com, ssmmessages.region.amazonaws.com)Check out the prerequisites here: https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-prerequisites.htmlCommentSharejsoncanswered a year ago"


Question: Inbound NATs on FTDv Cisco Firewall (Pool of EIP) for Inbound Traffic

"Hey re:Post communityI got a question regarding how its supposed to be a setup.Recently I configure an FTDv Cisco firewall in AWS, which is working for any Outbound traffic from my VPC, but heres something Im not sure exactly how its done.I got an SFTP Server in my VPC which I need to send files too from the internet, but instead of assigning a Public Address like AWS does already, I want that Inbound traffic to go through my FTDv Firewall.However as far as Im reading you can only have 1 EIP per Interface, so I have no way to do the NAT on the FTDv if I only have the EIP of the outside interface.Is there a way to do this like have a pool of addresses assigned to the FTDv so I can use IPs from that pool to configure NATs for my SFTP Servers Inbound traffic?Thanks in Advance!FollowComment"


Question: How to share AWS resources between members of an organization?

My goal would be to create an EC2 instance and have all the members of my organization be able to see and edit it.FollowCommentBrettski-AWS EXPERT5 months agoCould you explain a little further about "see and edit it". Do you mean that you want them to see it in the console and change attributes about it? Or do you want other people to be able to login to it (via SSH or RDP)?Share

Answer: "0You can share an AMI. Sharing an EC2 instance does not really make sense. You can however network multiple accounts up using CloudWan or TGW and allow network access from other accounts to the EC2. In the interest of shared resources, there is an AWS service called RAM (Resource Access Manager) that allows you to share things like TGW, Route53 forwarders, and prefix lists (Does a lot more but here is a few). But it does not allow you to share an EC2 instance nor should it. Your account would be your boundary for that kind of thingCommentShareEvananswered 5 months agorePost-User-7693333 5 months agoI don't really understand how sharing EC2 instances doesn't make sense. I'm trying to set up AWS for my startup, but for my full time job this is done easily. I can see EC2 instances that others have created and ssh to them and even edit them.Share"


Question: List of resources inside VPC

"A customer would like to collect list of all resources deployed inside the VPC, based on the VPC ID. Know that Tag Editor would help to list all the resources inside the account, but not grouped by VPC. Appreciate for some advise on this, thanks.FollowComment"

Answer: 1Accepted AnswerPerhaps you can try AWS Perspective. I'm saying "Perhaps" because I don't think it's exhaustive yet.CommentShareEXPERTOlivier_Canswered 3 years ago


Question: API Gateway Resource Policy Not Working - IP Address Allow List

"API Gateway Experts, I want to invoke an API that triggers a lambda function to create a SageMaker instance pre-signed URL. They would like to deny access to the API to only a particular user’s source IP address. I have provide the YAML used to deploy this, but it is still allowing all other IP addresses to interact with the API even with the resource policy. What am I missing?  ApiGatewayRestApi:    Type: AWS::ApiGateway::RestApi    Properties:      ApiKeySourceType: HEADER      Description: An API Gateway with a Lambda Integration      EndpointConfiguration:        Types:          - EDGE      Name: lambda-sagemaker-presigned-url-api      Policy: !Sub |        {          "Version": "2012-10-17",          "Statement": [            {              "Effect": "Deny",              "Principal": "*",              "Action": "execute-api:Invoke",              "Resource": "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/${APIGatewayStageName}/*/*",              "Condition": {                "NotIpAddress": {                  "aws:SourceIp": "${YourIPAddress}"                }              }            },            {              "Effect": "Allow",              "Principal": "*",              "Action": "execute-api:Invoke",              "Resource": "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/${APIGatewayStageName}/*/*"            }          ]        }FollowComment"

Answer: "0Hey Derek, It looks like the resource you're limiting has a Stage in it. Can you please try the policy with a * in place of ${APIGatewayStageName}?CommentShareChris Pollardanswered a year ago"


Question: Quicksight legend order

"Hi,Good day.Why are my quicksight pie chart legend not ordered alphabetically?This link says it should be https://docs.aws.amazon.com/quicksight/latest/user/customizing-visual-legend.html.To be honest I see no pattern in the ordering when looking at my other charts. Wish I could attach an image but I see no option to upload.Regards,JarrettFollowComment"

Answer: "0Hello,As you are already aware, the default behaviour of legends is to have labels sorted in alphabetical order. However, I suspect that the discrepancy being observed at your end might be due to data involved or other factors that need to be investigated further.Therefore, if feasible, could you please open a support case with us by providing us with screenshot of the concerned visual and sample data being used at your end. Please remember to mask any confidential or sensitive information in the data you would share.You may open a support case with AWS using the following linkCommentShareSUPPORT ENGINEERPujitha_N2376933answered 7 months ago"


Question: EC2 m5n.2xlarge limited bandwidth?

"When a user is uploading a file to my m5n.2xlarge, the server become quite slow (network). The user is uploading at 100Mbps, I am not sure why the server is not able to handle this bandwidth. From the specs:Network: Up to 25 GbpsEBS: Up to 4,750 MbspI am limited because of EBS, or credit balance (I don't understand this notion of credit balance)? Should I use another instance?Thank you in advance!FollowComment"

Answer: "1Did you validate the ENA drive is enabled on the instance? https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/enhanced-networking-ena.htmlYou can also leverage CloudWatch metrics to see the NetworkIn to the instance to see how much throughput is being used. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-network-performance-ena.htmlCommentShareEXPERTRob_Hanswered a year agoeeight a year agoENA enabled yes.I configured alarms, is that boolean: ethtool_bw_in_allowance_exceeded > 0 for 1 datapoints within 5 minutes (did the same for the 5 of them). Does it makes sense?Share0Network performance from a client to a server depends on a lot of things including the network in between. Could it be an issue on the server? Sure. But I would first look at the path between the client and server. Run tests on different clients connected to different networks and isolate where the performance issue is coming from.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: Updating the Elastic IP address of a Network Load Balancer

"Hello,I would like to replace the current Elastic IP address associated to my Network Load Balancer by an another Elastic IP address which is associated to an EC2 Instance (which will be terminated after the migration).So I went to the Edit Subnet option, but it seems that I can't change the IPv4 address (Availability Zones is greyout). I have only one zone filled. But I can choose a new availability zone, and then select the Elastic IP Adress. But it means that I will two IP addresses attached to the NLB ?I tried to disassociate the IP through the network interface page but I got the following error : "Failed to disassociate public IP address xx.xx.xxx.xxx  from network interface eni-xxxxxxxxxxxxxx. API error: "You do not have permission to access the specified resource."This error is probabily due to the fact the IP is currently in use. Is the only way to re create a netword load balancer ?Any help would be appreciated :)FollowComment"

Answer: "0https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.htmlCommentShareMrJibusanswered 3 years ago0You can reference this link on how to update the Elastic IP of a NLB: https://aws.amazon.com/premiumsupport/knowledge-center/elb-attach-elastic-ip-to-public-nlb/CommentShareVManswered 5 months ago0Hello MrJibus,I want to directly address your question about replacing the ElasticIP that you configured for the NLB.  Once an NLB is created with an ElasticIP you can always add another node with an additional EIP for the purpose of resilience across zones.  As mentioned before, this is covered here: https://aws.amazon.com/premiumsupport/knowledge-center/elb-attach-elastic-ip-to-public-nlb/.This does not cover the use case that you are describing which is to replace the IP of the an existing NLB node(s).  Unfortunately, once an NLB node is created, you cannot alter the ElasticIP associated with it.  This is documented here:As quoted from the documentation here: https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html:"...When you create an internet-facing load balancer, you can optionally specify one Elastic IP address per subnet. If you do not choose one of your own Elastic IP addresses, Elastic Load Balancing provides one Elastic IP address per subnet for you. These Elastic IP addresses provide your load balancer with static IP addresses that will not change during the life of the load balancer. You can't change these Elastic IP addresses after you create the load balancer..."As such, you are correct. You will have to create the NLB again, if you want to alter ANY existing Elastic IP assignment to ANY existing NLB nodes.CommentShareMstein-AWSanswered 3 months ago"


Question: How do i connect AWS codepipeline to github repository using terraform

I tried to use the aws_codestarconnections_connection to connect it using the arn in the aws_codepipeline but i have no idea how to authenticate them this is the error i get from terraform'creating CodePipeline (CI-comaprism-pipeline): InvalidActionDeclarationException: Action configuration for action 'Source' contains unknown configuration 'connectionArn'Is there any steps or documentations useful? Because i can't see concise usage steps in hashicorp documentationFollowComment

Answer: "0Accepted AnswerHi,I haven’t done this in terraform, but I recall that in CDK, you were forced to manually generated the connection ARN through the UI first. Once you have connected GitHub with CodePipeline/CodeStar in the AWS console (not in the IaC), then the connection ARN is available and you can reference it in your  IaC code.I mentioned the above as a similar setup may be needed in console (one time action) and then you would get the connection ARN.Not fully automated but I am not aware of similar path in terraform.CommentShareEXPERTalatechanswered 13 days ago"


Question: Should I use Compass or SCT for a Babelfish assessment?

Both SCT and Compass can report assessments for SQL Server migrations to Babelfish. Which should I use?FollowComment

Answer: "0Accepted AnswerCompass is recommended. See this answer for Compass download information.Compass is recommended because:Compass is designed specifically for Babelfish and to detect nuances in the DDL.Compass reports contain additional instructions for Babelfish.Keep in mind, SCT is only used for assessment for Babelfish (although Compass is recommended). Do not use SCT's conversion feature: Babelfish understands the SQL Server dialect and DDLs directly, after adjusting the DDL for any unsupported features in the assessment report.CommentSharelightanswered 10 months ago0Quoted from this post.You have two options for assessment tools for Babelfish. One option is the Babelfish Compass tool, which is part of the Babelfish product. When a new release of Babelfish becomes available, an up-to-date version of Compass will also be available. In contrast, AWS SCT will support newer Babelfish version after some time. Compass also provides a feature to automatically rewrite certain unsupported T-SQL constructs in such a way that Babelfish can support them after all. The other option is the assessment report built into AWS SCT. Both tools use the same underlying Babelfish feature definitions for evaluation, but Compass generally provides more accurate results.CommentSharerePost-User-7335320answered 7 months ago"


Question: Aurora upgrade 2 to 3 / MySql 5.7 to 8.0: schemaInconsistencyCheck

"In our attempts to upgrade our Aurora 2 MySql 5.7 DB to Aurora 3 MySql 8.0, we are running into a pre-check that we are unable to resolve. The error is:{      "id": "schemaInconsistencyCheck",      "title": "Schema inconsistencies resulting from file removal or corruption",      "status": "OK",      "description": "Error: Following tables show signs that either table datadir directory or frm file was removed/corrupted. Please check server logs, examine datadir to detect the issue and fix it before upgrade",      "detectedProblems": [        {          "level": "Error",          "dbObject": "trax",          "description": "present in INFORMATION_SCHEMA's INNODB_SYS_TABLES table but missing from TABLES table"        }      ]    }Simple searches for this error yield this promising serverFault post. I followed the steps there:Running (Query1)select * from information_schema.innodb_sys_tables where name like '%#%';yeilds two tables: trax/#sql-ib2245-1278264407-0 & trax/#sql-ib2248-918043578-0Working with the latter and following the answer in the post yields some queries I attempted to no avail:drop table trax.`#sql-ib2248-918043578-0`;drop table trax.`#mysql50##sql-ib2248-918043578-0`;use trax;drop table `#sql-ib2248-918043578-0`;drop table `#mysql50##sql-ib2248-918043578-0`;All of which fail with a variation of the same error:Error Code: 1051. Unknown table 'trax.#mysql50##sql-ib2248-918043578-0'orError Code: 1051. Unknown table 'trax.#sql-ib2248-918043578-0'There's one comment towards the end that seems like it could be helpful but doesn't seem to lead anywhere:Note that the existence of an #sql-ib* table indicates that some of your data may be corrupt. Match the numeric ID in the #sql-ib table name to the TABLE_ID column of INNODB_SYS_TABLES to determine which table was affected. Be sure to inspect your data for integrity before proceeding.For the two tables returned by Query1 above, both the TABLE_ID and the "numeric ID in the #sql-ib table name" match already, and I'm not sure where else that TABLE_ID might point:TABLE_ID, NAME2245, trax/#sql-ib2245-1278264407-02248, trax/#sql-ib2248-918043578-0for more context:select * from INFORMATION_SCHEMA.TABLES where table_schema = 'trax' and table_type = 'BASE TABLE'; -- returns 309 entriesselect * from INFORMATION_SCHEMA.innodb_sys_tables where name like 'trax/%'; -- returns 311 entriesThe difference is just those two tables, trax/#sql-ib2245-1278264407-0 & trax/#sql-ib2248-918043578-0, so I think that implies they don't correspond to real tables (unlike the resolution found in this MySql bug) and thus can just be removed; but I'm not sure how to do that since DROP TABLE is failing.This is the last error holding up our upgrade process, so any help/suggestions would be appreciated.FollowCommentAWS-User-4944333 a year agoWas there a solution for this or did you just have to create a support ticket? I'm running into this exact issue while upgrading to Aurora 3Share"

Answer: "0I suggest creating a support ticket for this issue, they will be able to take a look at what was happening and help with the remediation.CommentShareYUTAKA_Hanswered a year ago"


Question: AWS IoT Sitewise - Device Name Management

"I am interested in managing a group of Raspberry Pi devices through IoT Sitewise and alerting on sensor data processed by the devices.    What is not clear to me is how to report the device names into Sitewise through IoT Core.   Right now, my devices are given unique names through the IoT ClientID (ex. RaspberryPi001, RaspberryPi002, etc.) and I am routing the ClientID and sensor payload data to Sitewise through a rule in IoT Core.   However, there does not appear to be a way to add the ClientId as a measurement to the Sitewise model.   The examples I see in the Sitewise documentation all have the device name added as a hardcoded attribute.  But how does that approach work when you have potentially a fleet of devices reporting into Sitewise?   Also, I would like to add the device name to the Alarm message so the recipient can know which device is the active alarm state.I am trying to use /ClientID/ as the property alias in the IoT Core Sitewise rule with the following query, and then add ClientId as a measurement in the Sitewise Asset Model.  But I am not receiving any values on the ClientID measurement in Sitewise.SELECT clientId() as ClientId, state.reported.payload.temperature as reported.temperature, state.reported.payload.humidity as reported.humidity, state.reported.payload.VOC as reported.VOC, state.reported.payload.CO2 as reported.CO2 FROM '$aws/things/+/shadow/update'In summary, I am looking for a way to add the IoT device name to the Sitewise model or asset and alarm message.  Thanks!FollowComment"

Answer: "0You can add the device name as a custom attribute to the Sitewise asset by including it in the payload that is sent from the device to Sitewise.You can use the IoT ClientID as the device name in the payload and include it in the SELECT statement in the IoT rule.Here's an updated SELECT statement that you can use in your IoT rule:SELECT clientId() as deviceName, state.reported.payload.temperature as temperature, state.reported.payload.humidity as humidity, state.reported.payload.VOC as VOC, state.reported.payload.CO2 as CO2 FROM '$aws/things/+/shadow/update'In the Sitewise asset model, you can create a custom attribute for the device name and select "deviceName" as the measurement to map to that attribute. In the alarm message, you can include the custom attribute to display the device name.Keep in mind that it may take some time for the data to be processed and appear in Sitewise after the SELECT statement is added to the IoT rule.CommentShareGabriel Olaleyeanswered 4 months ago1960pghpirates 4 months agoGabriel, I updated my SQL query as suggested and added a new measurement to the asset model in Sitewise for DeviceName. Then I used the IoT Sitewise rule to map the DeviceName to the Property Alias for the measurement. The key to getting the ClientId to populate the new measurement was to provide this Property Value in the IoT Rule: ${clientId()}So the DeviceName is now populating the new measurement in the Sitewise Asset Model. You mentioned that a custom attribute should be created to include the DeviceName in the Alarm notification. I have created a custom attribute for the alarm but have not figured out how to map the DeviceName measurement to be the default value of the custom attribute.   Can you give some clarification on this part?Share"


Question: Overwriting ECS Fargate volumesFrom Mounts

"Is it possible to overwrite a mount that was created via volumesFrom?We have an nginx container that imports all of the volumes from a php container using volumeFrom. This process auto-mounts all of the volumes defined in the php container to their same paths within the nginx container. For the nginx container, I would like some of those paths to be readonly mounts. I believe I should be able to specify a new mountPoint with the same sourceVolume and containerPath, but set it to read only.This is not working, so I would appreciate the help.FollowComment"

Answer: "0I was able to resolve this by not using volumesFrom. I was unaware that the volumes introduced via the VOLUMES instruction within a Dockerfile could be made available to other containers in the same task just by mounting it in the initial container and using the same sourceVolume value in another container. By doing this, it allowed for us to mount some volumes readOnly and/or change the containerPath to any value we needed.CommentSharesolesonanswered 2 years ago"


Question: Azure Deploy to AWS via role

"Hi team,my org relies on Azure devops Pipelinewe want to deploy from Azure to our ECS fargate clusterbut we have some considerationwe cannot create long-lived credentials in AWSwe don't have outbound internet connectivity in AWS from within our VPChow can we deploy the built artifact from Azure to ECS without using AWS long-lived credentials?i saw the solution of using a build agent build agentscan Azure assume a role in AWS without using build agents?how can Azure Assume a role in AWSbut still, need AWS credentialsFollowComment"

Answer: "0Accepted AnswerTake a looks at Extend AWS IAM roles to workloads outside of AWS with IAM Roles Anywhere.CommentShareEXPERTkentradanswered 2 months agoJess 2 months agothank you for your answer!!I tried to follow the given article I have this error :AccessDeniedException: Unable to assume role for arn:aws:iam::1234566:role/myRole. Some RDNs failed STS validation for session tags. Issuer: [  ]; Subject: [ CN ]even I added these conditions to the trusted policy:"Condition": {"StringEquals": {"aws:PrincipalTag/x509Subject/CN": "xxxx","aws:PrincipalTag/x509Subject/OU": "zzzzz"}}used an ACM PCA of type : SubordinateSharekentrad EXPERT2 months agoI think your certificate is missing some fields. According to the docs, "Certificates with empty subjects are NOT yet supported, since IAM Roles Anywhere uses the certificate subject as the key of the Subject resource to visualize and audit activities for certificates that are authenticated with IAM Roles Anywhere."  https://docs.aws.amazon.com/rolesanywhere/latest/userguide/trust-model.htmlSharekentrad EXPERT2 months agoCan you do this command on your certificate? 'openssl x509 -text -noout -in foo.crt' and report what the Subject and Issuer are?Sharekentrad EXPERT2 months agoI suspect that the '*' is causing the issue. From the docs: "In general, the allowed characters are letters, numbers, spaces representable in UTF-8, and the following characters: _ . : / = + - @." https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_tagging.html#tag-conventionsShareJess 2 months agoissued new cert without * (from ACM) now I don't have anymore the previous error messageI have this exception without more details :ccessDeniedException: Unable to assume role for arn:aws:iam::123456789:role/myroleShareShow 4 more comments"


Question: runtime error as of this morning

As of this morning I'm seeing a runtime error from xocc and vivado that I've never seen before. I created a fresh F1 instance and still see this running the helloworld_ocl example.Is this a known issue?/opt/Xilinx/SDx/2018.3.op2405991/bin/xocc -t sw_emu --platform /home/centos/src/project_data/aws-fpga/SDAccel/aws_platform/xilinx_aws-vu9p-f1-04261818_dynamic_5_0/xilinx_aws-vu9p-f1-04261818_dynamic_5_0.xpfm --save-temps  -c -k vector_add -I'src' -o'xclbin/vector_add.sw_emu.xilinx_aws-vu9p-f1-04261818_dynamic_5_0.xo' 'src/vector_addition.cl'terminate called after throwing an instance of 'std::runtime_error'what():  locale::facet::_S_create_c_locale name not valid/opt/Xilinx/SDx/2018.3.op2405991/bin/loader: line 213:  6550 Aborted                 "$RDI_PROG" "$@"make: *** [xclbin/vector_add.sw_emu.xilinx_aws-vu9p-f1-04261818_dynamic_5_0.xo] Error 134FollowComment

Answer: "0I found that if I launch vnc and run it in an X-windows environment then it seems to work.Do I need to do anything special for a batch (plain ssh) environment?ThanksCommentSharesimonSNanswered 4 years ago0Hello,I just tried this on a fresh instance (using ssh), and it works for me.My Kernel version is:> uname -r 3.10.0-957.5.1.el7.x86_64Please check you are using the same Kernel version.There have been a couple of forum posts earlier with a similar error message :https://forums.aws.amazon.com/thread.jspa?messageID=849944&#849944https://forums.aws.amazon.com/thread.jspa?threadID=297517-ThanksCommentShareawsSiddharthanswered 4 years ago0Looks like it: 3.10.0-957.5.1.el7.x86_64I seem to have found a workaround to the issue on google:export LC_ALL=C; unset LANGUAGECommentSharesimonSNanswered 4 years ago"


Question: Overriding Hostname on ECS Fargate

"Hello,I am setting up a Yellowfin deployment using their stock app-only image on ECS Fargate. I was able to set up a test cluster for my team to experiment with.Yellowfin requires a license to use their software. To issue a license, Yellowfin needs to know the hostname of the underlying platform it runs on. Yellowfin can provide wildcard licenses that match on a standard prefix or suffix. Currently, we are using a development license that matches on the default hostname that our test environment's Fargate task is assigned.The default hostname seems to be of the form <32-character alphanumeric string>-<10-digit number> where the former is the running task's ID and the latter is an ID of some other related AWS resource (the task definition? the cluster?) that I could not identify. Although this 10-digit number stays constant if new tasks are run, it does not seem like a good strategy to base the real Yellowfin license off of it.I would like to override the hostname of a Fargate task when launching the container to include a common prefix (e.g., "myorg-yfbi-") to make it simple to request a wildcard license for actual use. If possible, I would like to avoid building my own image or migrating to use another AWS service.Is there a standard way to override the hostname for a Fargate service by solely updating the task definition? Would overriding the entrypoint be a viable option? Is there another way to set hostname in Fargate that I am not aware of?Thank you for any guidance you can provide. Happy to provide more information if it helps.FollowComment"

Answer: "2Accepted AnswerFor ECS tasks running on Fargate or with AWS VPC networking, you cannot currently customize the hostname of the container. I would recommend reaching out to Yellowfin to see if they can offer an AWS Marketplace-based offering for AWS containers. AWS Marketplace supports licensing and metered usage for container services.CommentShareEXPERTMichael_Fanswered a year ago"


Question: How to Modify AWSELBAuthSessionCookie to Log Off User

"I have developed a containerized web server in ECS behind a Cognito authenticated Application Load Balancer. I am in the final stages of development and working on implementing a log off button. The documentation below states to log off a user, the application should modify the authentication session cookies and set the expiry to -1. On the client side, I can see the session cookies, but they are marked as HTTPOnly and can not be modified. I do not see the cookies on the server side and based on the documentation, it does not sound like the cookies are sent to the server. How do I modify the cookies to log out a user or is there another way to log out a user?https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.htmlFollowComment"

Answer: "0From the information you provided, I understand you need more information related to authentication logout and session timeout for ALB.When a user that has been authenticated needs to log out, the application should invalidate the session cookie by setting expiry to -1 but also redirect the client to the IdP logout endpoint. This needs to be done by your application.Make sure the code consists of:Invalidate the AWSELBAuthSessionCookie-0 and AWSELBAuthSessionCookie-1 cookie by setting expiration time to -1, or just clear both of them.Redirect the user to idp logout endpointYou should be able to set the expiry to -1 with set-cookie.I hope you find this helpful.Reference:https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html#authentication-logout-timeouthttps://www.exampleloadbalancer.com/auth_detail.htmlhttps://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.htmlCommentSharecindy_wanswered 10 months ago0Thank you for the answer, Cindy. I don't understand how to set the expiry to -1 if the HTTPOnly flag is set though. That flag prevents the cookie from being modified through JavaScript. Am I missing something? Thanks!CommentShareAustinanswered 9 months ago0You need to invalidate the ALB cookies in your server-side code which resides behind the ALB, not in JavaScript.Request goes into your application through the ALB, to your logout code.Your backend code uses the set-cookie header to return cookies with the same name that the ALB uses (AWSELBAuthSessionCookie-0 up to AWSELBAuthSessionCookie-3) and expiry and max-age with values -1.The same response that sets those cookie headers also needs to send a 302 redirect to the idp logout endpoint.The browser receives the response, removes the ALB cookies from its local cookies storage, and goes to the idp logout endpoint.CommentShareyonianswered 7 months ago0Thanks you both for the answers. I am using Streamlit to deploy a small/medium application in AWS and I do not think this approach works with that framework since most of the server-side code is not directly accessible. I ended up having to move user authentication from the ALB into the application itself to get it working.CommentShareAustinanswered 7 months ago"


Question: Access Ec2 instance

How can I access ec2 instance by using private ipFollowComment

Answer: "1Where are you trying to access it from? If you are trying to access from your corporate network, you need to create either an IPSec VPN connection or a DirectConnect connection to your AWS VPC. Then you will be able to connect to the EC2 machine, provided you have configured your networking correctly.If you don't already have a DirectConnect, it may take some time to set-up.You can set up VPN. Take a look at this - https://docs.aws.amazon.com/vpc/latest/userguide/vpn-connections.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 10 months agoIndranil Banerjee AWS EXPERT10 months ago@rePost-User-2442094 - If my answer helped you, can I request you to Accept my answer? ThanksShare0It depends there is multiple solutionsdirect connect/ VPN (site-to-site/client).bastion host.connect through SSM session managerCommentShareYasserAlhawaryanswered 10 months ago"


Question: Avoiding retries with SQS and Lambda

"I have a lambda function with an SQS trigger, configured to process a batch of up to 100 records per invoke. I do not want AWS Lambda to invoke my function more than once for the same batch of records. I'm trying to handle this in several ways:Inside function handler codeHere  I'm catching all exceptions. If processing of one record fails, I will continue to process the remaining records. I am not interested in retrying the failing records at a later time.Using DLQ for the SQS queue with maxReceiveCount=1Potentially my lambda function could time out or be throttled. Also in these cases I do not want any retries. I'm trying to accomplish this using a configuration similar as shown below.AWSTemplateFormatVersion: '2010-09-09'Transform: AWS::Serverless-2016-10-31Description: Example of processing messages on an SQS queue with LambdaResources:  MySQSQueueFunction:    Type: AWS::Serverless::Function    Properties:      Handler: index.handler      Runtime: nodejs12.x      Timeout: 300      Events:        MySQSEvent:          Type: SQS          Properties:            Queue: !GetAtt MySqsQueue.Arn            BatchSize: 100            MaximumBatchingWindowInSeconds: 1  MySqsQueue:    Type: AWS::SQS::Queue    Properties:      MessageRetentionPeriod: 14400      VisibilityTimeout: 1800      RedrivePolicy:        deadLetterTargetArn:          Fn::GetAtt:            - "MyDLQ"            - "Arn"        maxReceiveCount: 1 # No retries  MyDLQ:    Type: AWS::SQS::QueueI tried to force throttling by setting reserved concurrency on the lambda function to 0. I noticed that even if the function was throttled, the records did not go immediately to the DLQ. I'm not sure, but I'm suspecting that AWS Lambda retried the failed batches before moving them to the DLQ, even though I have set maxReceiveCount to 1. Is this expected? Is my setup the right way to avoid retries when using SQS and Lambda?FollowComment"

Answer: "0Your setup is correct for avoiding retries when using SQS and Lambda. The maxReceiveCount property set to 1 on the RedrivePolicy of the SQS queue ensures that the failed records are moved to the Dead Letter Queue (DLQ) immediately after the first failed attempt. This behavior is independent of whether AWS Lambda retries the batch before moving it to the DLQ.Regarding your observation that records did not go immediately to the DLQ even if the function was throttled, this behavior may occur if the throttling occurred after the records had been dequeued from the SQS queue but before they could be processed by the Lambda function. In this case, Lambda will retry the function invocation for up to six hours with an exponential backoff. However, if the maximum number of retries (which is one, in your case) is reached, the failed records will be moved to the DLQ.Note that setting the reserved concurrency for a Lambda function to 0 can be used for testing purposes to ensure that the function is throttled. However, in a production environment, this may not be the best way to ensure throttling, as it could result in a complete halt of your processing. Instead, you can consider setting an appropriate concurrency limit that matches the capacity of your downstream resources, such as your database or other AWS services.CommentShareStefanoBanswered 25 days ago"


Question: Amazon API Gateway Proxy - VPC Endpoint - NLB - Private DNS - Self-signed SSL

"I'm trying to set up an API Gateway as a simple proxy, using the Proxy option. The back-end is a REST API endpoint hosted by an NLB with a self-signed SSL certificated generated by ACM.API Gateway -> Proxy Integration -> VPC Endpoint -> (HTTPS) NLB -> Internal APIs hosted by EC2s.SSL certificate was created by ACM using Private CA with self-signed Certificate, with common name as:api.example.local (intended to be local and private DNS).Route 53 has a Private Hosted Zone record:example.local with an ALIAS Record: api.example.local -> NLB URLWhen I create the API Gateway Proxy Configuration:Integration Type: VPC_PROXYUse Proxy Integration = enabled (checked)VPC endpoint = selected the NLB VPC endpointEndpoint URL: WHEN PUT IN: https://api.example.local/{proxy}It gives error: Invalid HTTP endpoint specified for URILooks like the API Gateway is NOT able to resolve the R53 Private DNS name (api.example.local).Is this expected? What is the right way to setup a Private NLB SSL Certs and a Private DNS name for the NLB for API gateway to passthrough? Is it possible or the NLB has to have a Public DNS name to work?FollowComment"

Answer: "0Accepted AnswerYou don't mention you're using VPC Link for API Gateway HTTP APIs, or API Gateway REST APIs (it's not essential to know but it would narrow down the responses somewhat).But for both of those you don't need to resolve the NLB DNS name - you configure API Gateway to point directly to the NLB you have already configured. For REST APIs you create a VPC Link per NLB; for HTTP APIs you create a VPC Link per VPC and then in each integration you select the appropriate NLB.I'm not sure if this is the question you're asking - I would test this first without private certificates (to see if the private certificates are the problem or there is another issue) and then once you have it working, add additional layers.CommentShareEXPERTBrettski-AWSanswered 3 years ago0Maybe something related to this. Can I have DNS alias A record for created NLB in such scenario and use that alias in private API Gateway Integration as endpoint URL instead of the default NLB domain name? If I do so I have error "Invalid HTTP endpoint specified for URI". Is it supported?To give more context: behind NLB I have target group with ALB with a private certificate from on-premise self hosted CA. But I configured tlsConfig with insecureSkipVerification set to true in x-amazon-apigateway-integration for that endpoint. So I guess such private cert should be accepted then?CommentSharerePost-User-0354322answered 6 months agoAWS-User-7123169 6 months agoIs this a repeat of the question or an answer? If you try to answer whether with the tlsConfig using insecureSkipVerification = T can work, what is your verification result? Does it work? I felt the first step of Private DNS resolution in this scenario seems not working, not even get to the https tls handshaking state. Also, insecureSkipVerification is usually not recommended, although the integration endpoint is private and possibly owned by API owner.Share0I got the same error. It seems that API Gateway only accept existing TLDs even if you defined private zones in Route53. You can hit .dev, .qa  but not .local or .prodCommentShareCristian Vantianswered 7 days ago"


Question: Email notifications with re:Post

Can we get email notifications when a question is asked on one of the topic we follow ?FollowComment

Answer: "6Yes.  Choose notification settings, you'll see which tags, topics, etc. you've followed and be able to toggle notifications on and off there.CommentSharethat_mikeanswered 2 years agoSUPPORT ENGINEERSrikanth_Nreviewed 2 years ago1Arthur,We are happy to announce Enhanced Notifications in re:Post. With this new functionality you can choose the frequency of emails. Now, you can get emails delivered immediately, daily, or weekly, and choose the day and time they want to receive their re:Post email digests.To do this, go to the notifications settings, https://repost.aws/dashboard/settings/notifications, and select the frequency for each of the items in the list. You can also set the day/time when you want to received your email digests.MonicaCommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago"


Question: Using Session Manager to connect RDS without having EC2 instance

"When I go through the documents, using session manager we can connect instance in private subnet without having bastion host itself [direct port forwarding from local to private ec2].But in RDS case, even though we are making connection using session manager we need a EC2 instance in between local and private RDS.Could you anyone explain me why it is like that? please share some document that explains that as well.FollowComment"

Answer: "1Accepted AnswerHi Vignesh,though we sometimes do document what is not possible, I'm not aware of a document that would explain why you cannot connect directly to RDS using SSM. So let me resort to a more generic answer:SSM allows many more functions - and changes! - to an instance than just connecting to it. Having full SSM functionality on an RDS instance thus would undermine the Shared Responsibility Model we use for RDS (you could also say: it would violate the "Black Box" principle of RDS).Therefore, you need an intermediary instance that forwards the TCP Port exposed by RDS to your local machine.Further reading:The RDS-specific Shared Responsibility Model is explaine in "Security in Amazon RDS"Our general overview of the Shared Responsibility ModelIn case you don't know already, the EC2 instance can be in a private subnet, too, as explained here: Securely connect to an Amazon RDS or Amazon EC2 database instance remotely with your preferred GUIIf this helped you, kindly mark my answer as "accepted".Kind regards, UweCommentShareUwe  Kanswered 9 months agovignesh 9 months agoThank you for your response.Could you please briefly tell me about the "Black Box" principle of RDS? @UweShareUwe  K 9 months agoThough "Black Box" is not official AWS wording, I used it to describe the fact that RDS as a managed system isn't as open to connect to or apply changes (e.g. OS Kernel settings) as a custom install on EC2 would be.It's because of the responsibility AWS takes for RDS's availability and security that some functionality you'd have on a self-managed database server isn't available to you on RDS.Or, in other words: you get a certain service, but the way this service is configured and managed isn't published in detail (and may be changing over time).HTH, UweSharevignesh 9 months agoThanks, @Uwe. That's a great explanation. Much appreciatedSharevignesh 9 months ago@Uwe I have another question related to this connecting from the docker container. Please share if you have any docs any ideas https://repost.aws/questions/QUGuUewImyTiabU7R946zD9w/from-docker-container-need-to-connect-rds-using-session-managerShare"


Question: First person camera rotation with physx

"So im having a very weird issues.I am using physx.With my parent entity having the physx ccontroller.The first child entity has a script canvas event for mouse delta x movement to.The Child of that entity is a reverse facing entity with mouse delta y movement.Then child of that entity being reverse to forward direction to have forward facing  fps camera.In the delta y movement i am limiting the camera so that it does not rotate more then the expected degrees for fps cameras.My values are 2 min and 4 max on the x axis.In the delta x movement its a very simple rotation of the mesh object so that everything is moving in its forward directs.The rotation is set on its local rotation.Was having issues with the rotate script canvas node and using physx.Ok so now that my setup is explained heres my issue.When my camera y angle becomes lower then 3, my camera x delta becomes very difficult to move.Any ideas what could be wrong?If i need to share my script canvas stuff i can.Edit: I have enabled the console in the editor and now the cam rotation works fine.This is a very weird issue and not sure what to say about it.Follow"

Answer: "0connect it to on press AND on hold not just on hold.SharerePost-User-9359627answered 3 years ago0very odd but this does workSharerePost-User-4856894answered 3 years ago0Yeah. The devs don't care enough to let people know this is how you solve this issue so they haven't updated the documentation about it at all. This is pretty common. Amazon Lumberyard team doesn't actually care about their users.SharerePost-User-9359627answered 3 years ago0@REDACTEDUSERI'm with the Lumberyard team and would like to follow up on this issue with you. Do I understand correctly that you are having to attach both an On Pressed  and on On Held script events to ensure you get an On Held input response? I want to try to replicate this. Also, for the documentation, is this the type of issue you would expect to see called out as a note in the script canvas reference for the script event nodes, or were you following a tutorial?SharerePost-User-6034607answered 3 years ago0I was following the tutorial on YouTube.Everything worked but then for some odd reason the camera rotate right and left was being very weird.In the end attaching it to on press and on held worked.The tutorial stated just on held.Sorry for late response I forgot all about this post.I hope this has helped others.SharerePost-User-4856894answered 3 years ago0I was told by a Lumberyard dev directly to use this hack. I can't recall who it was, but someone on your team is already replicating it.And yes, especially if someone the team already knows about this issue and what can solve it then it should be a note in the documentation.SharerePost-User-9359627answered 3 years ago0[quote="alexescamilla, post:1, topic:7835, full:true"]So im having a very weird issues.I am using physx.With my parent entity having the physx ccontroller.The first child entity has a script canvas event for mouse delta x movement to.The Child of that entity is a reverse facing entity with mouse delta y movement.Then child of that entity being reverse to forward direction to have forward facing fps camera.In the delta y movement i am limiting the camera so that it does not rotate more then the expected degrees for fps cameras.My values are 2 min and 4 max on the x axis.In the delta x movement its a very simple rotation of the mesh object so that everything is moving in its forward directs.The rotation is set on its local rotation.Was having issues with the rotate script canvas node and using physx.Ok so now that my setup is explained heres my issue.When my camera y angle becomes lower then 3, my camera x delta becomes very difficult to move.Any ideas what could be wrong?If i need to share my script canvas stuff i can.Edit: I have enabled the console in the editor and now the cam rotation works fine.This is a very weird issue and not sure what to say about it.[/quote]Hi @REDACTEDUSERSharerePost-User-7328120answered 3 years ago0Sorry but you need to stop posting links to documentation when you don't even understand what's going in the post. No, it doesn't help with anything, actually.SharerePost-User-9359627answered 3 years ago0Is it correct to assume you were following Basics of Motion 05? I have followed this tutorial in a couple of versions of Lumberyard and am unable to reproduce the result you are getting. Is it possible to host your scripts somewhere so I can take a closer look? One thing I did notice in the tutorial is that it might not go into enough detail about handling the camera rotation and if the raw input value is used to set the rotation, you can get some wild results.SharerePost-User-6034607answered 3 years ago"


Question: Glue glue.driver.aggregate.numFailedTasks not reporting correctly

"we are using something similar to the following lambda function and collecting glue customer metrics as per the article :https://medium.com/@ettefette/metrics-for-aws-glue-jobs-as-you-know-them-from-lambda-functions-e5e1873c615cBut we see different number of failed tasks in Glue console comparing to what Cloudwatch metrics reporting when trying to find Cound ('Glue glue.driver.aggregate.numFailedTasks')def handler(event, context):job_name = event["detail"]["jobName"]job_run_id = event["detail"]["jobRunId"]cloudwatch = boto3.client("cloudwatch", region_name="eu-central-1")if event["detail-type"] == "Glue Job State Change":    job_status = event["detail"]["state"]    if job_status not in ["SUCCEEDED", "FAILED", "TIMEOUT", "STOPPED"]:        raise AttributeError("Job state is not supported.")    if job_status == "SUCCEEDED":        metric_value = 1.0    else:        metric_value = 0.0    cloudwatch.put_metric_data(        MetricData=[            {                "MetricName": "JobStatus",                "Dimensions": [                    {"Name": "JobName", "Value": job_name},                    {"Name": "JobRunId", "Value": job_run_id},                    {"Name": "JobStatus", "Value": job_status},                ],                "Unit": "None",                "Value": metric_value,            }        ],        Namespace="Glue",    )=======================Any ideas ?FollowComment"


Question: How to connect AWS Lambda to MariaDB SkySQL with IPv4 address

"What I'm doing is using AWS Lambda with Serverless-Express to host my Express API via AWS. I've done that for the most part, but my endpoints that attempt to query my MariaDB SkySQL database are not working, and from the CloudWatch logs it looks like the database connection is timing out.I think the issue is that SkySQL isn't recognizing AWS Lambda as having proper permissions to access the database. In my SkySQL database I have to manually add IPv4 addresses that are allowed to query the database. My question is, how do I get the IPv4 address(es), and/or is there a better way to do this?FollowComment"

Answer: "1Hi, @Ronkillo123MariaDB SkySQL assumes you are on the internet.Your Lambda function can be integrated into your VPC.Lambda integrated into the VPC enables outbound communication to the Internet via a NAT gateway / NAT instance.Since you can attach an Elastic IP address to NAT, the IP address will be fixed.https://aws.amazon.com/premiumsupport/knowledge-center/internet-access-lambda-function/?nc1=h_lsCommentShareEXPERTiwasaanswered a year ago"


Question: Deploy FSx under Landing Zone pattern

"Hi,I can't deploy FSx in my application account because it doesn't like AD Connector.I've tried deploying FSx in my shared services account but, although DNS resolves, mapping a drive results in "resource ... is not responding".The default security group limits outgoing traffic to itself. Should I add another rule for my application account's VPC?Thanks,TLFollowComment"

Answer: 0Yes.CommentShareTL241answered 3 years ago


Question: Build error due to devtoolset 6 for XRT installation

"Hi everyone!I am trying to build XRT for Xilinx SDX 2018.2 and using Xilinx community AMI or AWS FPGA AMI v1.5.1. I am having problem with installing devtoolset 6. I have tried some workarounds such as changing repo, etc. Yet, it still cannot install it. I also cannot build with devtoolset 7 8.What am I missing to configure?Thanks a lot!Edited by: yonselyuksel on Mar 13, 2021 4:03 PMEdited by: yonselyuksel on Mar 14, 2021 8:01 AMFollowComment"

Answer: 0I could build with devtoolset-9.CommentShareyonselyukselanswered 2 years ago


Question: Disable auto vacuum

Is it possible to disable auto vacuum on RedShift Cluster?FollowComment

Answer: "0Although it is not recommended, you can open a Support Ticket and service team can disable it for your specific cluster.CommentShareMilindOkeanswered 2 months ago"


Question: "Hi guys, Datasync was working just perfectly fine and now it doesn't works, Network connectivity test fails with the following answer "SSL Test failed: no certificate issuer found""

"Hi Guys,We were transferring TB with datasync, everything was working just fine but one day I wanted to start a new task and the Agent was offline. This is the first time the agent was in that state. We logged into the agents console and tried the "network connectivity test" and everything went wrong. All the tests failed with the same answer "SSL Test Failed". I am including a picture of that. I would be grateful if you could help meFollowComment"

Answer: "0Hi, as this agent was working previously can you look into any network changes that may have occurred that could have affected communication from this agent. Some areas to look into.Hypervisor networking health where the VM is hosted.Verify with the networking team that port 443 is still allowed.Verify that if using a new or existing private DataSync endpoint within the same VPC, that Private DNS names is disabled for the VPC endpoint.https://docs.aws.amazon.com/datasync/latest/userguide/datasync-in-vpc.htmlCreate a VPC endpoint for the DataSync service.To do this, open the Amazon VPC console at https://console.aws.amazon.com/vpc/, and choose Endpoints from the navigation pane at left. Choose Create endpoint.For Service category, choose AWS services. For Service Name, choose DataSync in your AWS Region (for example, com.amazonaws.us-east-1.datasync). Then choose the VPC and security group that you chose in steps 1 and 3. Make sure that you clear the Enable Private DNS Name check box.CommentShareDarryl_Dioanswered 6 months ago"


Question: Using the default Amazon Linux AMI for Amazon EMR long lived cluster

"I am working on enabling automatic patching for one of the EMR cluster. I understand that with Amazon EMR release 6.6 and later, when you launch new Amazon EMR clusters with the default Amazon Linux (AL) AMI option, Amazon EMR automatically uses the latest Amazon Linux AMI. So when I update/create a cluster with EMR release 6.8, it will use the latest Amazon Linux AMI at the time of boot but what is the solution if we have long lived cluster.FollowComment"

Answer: "0Hello there,Thank you for raising this question in re:Post.I understand that you are asking about how to patch the instances running on a long living cluster to keep them up to date.EMR does not have any provisions to apply patches on running instances, it can however run a bootstrap action where you can run an "yum update" or install required patch and as you may already know bootstrap is only executed at the instance launch time.Regardless, EMR does run "yum update" for Critical and Security patches at the time of instance launch, whether that is at the time of cluster creation or on the new instances during a cluster Resize.While, technically if you had selected the option Update all installed packages on reboot (recommended) a restart of the instances would trigger 'yum update' for Critical and Security patches pushed by Amazon Linux, it is not recommended you do a restart as it introduces risk of applications failures and data loss.You can use automated patching using SSM to push patches to EC2 instances in your account, provided it does not involve instance restarts in which case there is a risk of application failures and data loss.In both cases the AMI selected at the time of cluster launch will not be updated to the latest available AMI, for that you would have to relaunch the EMR cluster. Hence, the recommendation would be to architect towards short lived EMR Clusters wherever feasible.Hope this answers your query, please feel free to reply to us if you have follow up questions. Have a great day!CommentShareSUPPORT ENGINEERKrishnadas Manswered 6 months ago"


Question: GLIBC_2.25 not found on AmazonLinux

"I compiled "php-cgi" binaries using php 7.3  on latest amazonlinux AMI to be able to run wordpress in lambda environment. Amazon Linux is showing GLIBC 2.26 version and the binaries that I built says that it requires GLIBC_2.25. I am confused why there even is a conflict when the program is compiled against Glibc version 2.26. Tried to downgrade glibc to 2.25 and a lot of things broke. How do I resolve this?From cloudwatch logs:./bin/php-cgi: /lib64/libc.so.6: version `GLIBC_2.25' not found (required by ./bin/php-cgi)#yum info glibcLoaded plugins: extras_suggestions, langpacks, priorities, update-motd255 packages excluded due to repository priority protectionsInstalled PackagesName        : glibcArch        : x86_64Version     : 2.26Release     : 32.amzn2.0.1Size        : 13 MRepo        : installedSummary     : The GNU libc librariesURL         : http://www.gnu.org/software/glibc/#strings /usr/lib64/libc.so.6 | grep ^GLIBC_GLIBC_2.2.5GLIBC_2.2.6GLIBC_2.3GLIBC_2.3.2GLIBC_2.3.3GLIBC_2.3.4GLIBC_2.4GLIBC_2.5GLIBC_2.6GLIBC_2.7GLIBC_2.8GLIBC_2.9GLIBC_2.10GLIBC_2.11GLIBC_2.12GLIBC_2.13GLIBC_2.14GLIBC_2.15GLIBC_2.16GLIBC_2.17GLIBC_2.18GLIBC_2.22GLIBC_2.23GLIBC_2.24GLIBC_2.25GLIBC_2.26GLIBC_PRIVATEGLIBC_2.26GLIBC_2.25GLIBC_2.23GLIBC_2.8GLIBC_2.5GLIBC_2.9GLIBC_2.7GLIBC_2.6GLIBC_2.18GLIBC_2.11GLIBC_2.16GLIBC_2.17GLIBC_2.13GLIBC_2.2.6/lib64/libc.so.6: version `GLIBC_2.25' not foundFollowComment"

Answer: "0Same issue here but am trying out new AWS IoT Device SDK V2Getting below error when attempting to start device-example.js to test a new device connection option we need for custom dns iot endpointsError: /lib64/libc.so.6: version `GLIBC_2.25' not found (required by /home/ec2-user/aws/node_modules/aws-crt/dist/bin/linux-x64/aws-crt-nodejs.node)[ec2-user@ip-172-31-26-224 examples]$ yum info glibcLoaded plugins: priorities, update-motd, upgrade-helperInstalled PackagesName        : glibcArch        : x86_64Version     : 2.17Release     : 292.180.amzn1Size        : 14 MRepo        : installedFrom repo   : amzn-updatesSummary     : The GNU libc librariesURL         : http://www.gnu.org/software/glibc/License     : LGPLv2_ and LGPLv2_ with exceptions and GPLv2+Description : The glibc package contains standard libraries which are used by: multiple programs on the system. In order to save disk space and: memory, as well as to make upgrading easier, common system code is: kept in one place and shared between programs. This particular package: contains the most important sets of shared libraries: the standard C: library and the standard math library. Without these two libraries, a: Linux system will not function.Available PackagesName        : glibcArch        : i686Version     : 2.17Release     : 292.180.amzn1Size        : 6.3 MRepo        : amzn-updates/latestSummary     : The GNU libc librariesURL         : http://www.gnu.org/software/glibc/License     : LGPLv2_ and LGPLv2_ with exceptions and GPLv2+Description : The glibc package contains standard libraries which are used by: multiple programs on the system. In order to save disk space and: memory, as well as to make upgrading easier, common system code is: kept in one place and shared between programs. This particular package: contains the most important sets of shared libraries: the standard C: library and the standard math library. Without these two libraries, a: Linux system will not function.CommentShareMark Lloydanswered 3 years ago"


Question: Account & Billing - what is the time frame AWS available for chat&calls in business plan?

"For example, in On-Ramp and Enterprise support plan the concierge team is available 24X7. what is the time availability for account&billing question in business plan?FollowComment"

Answer: "0The documentation here seems unlimited.https://aws.amazon.com/premiumsupport/plans/?nc1=h_lsCommentShareEXPERTRiku_Kobayashianswered 23 days agoRavid Glam 23 days agoi checked that, i dont see a time frame for account & billing supportShareRiku_Kobayashi EXPERT23 days agoYou can make inquiries 24 hours a day as follows.This can be confirmed by opening a support case for both technical inquiries and Account and billing.24/7 phone, web, and chat access to Cloud Support EngineersUnlimited cases and unlimited contacts (IAM supported)Prioritized responses on AWS re:PostAccess to AWS Support App in SlackShare"


Question: How can we increase the speed of the container running in AWS ECS ?

How can we increase the internet speed of the container running in AWS ECS and later how can we verify that container internet speed is increased or not while downloading any dependencies on container or posting some data into S3 while working with JAR execution from the container etc. ?FollowComment

Answer: "0Hi, the answer to this depends a lot on what type of capacity you are using underneath of Elastic Container Service. For example if you are using EC2 capacity then the network bandwidth available to your container is going to depend entirely on the networking performance of the EC2 instance that you selected. The AWS docs has a section on networking bandwidth for various EC2 instances: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-network-bandwidth.htmlIf you are using AWS Fargate as the capacity for running your containers then the networking performance will depend on the size of the task you are running. Larger tasks with more CPU and memory get higher networking performance.You can test networking performance by running a standard Unix tool like iperf inside of your container. You could either use Amazon ECS exec to open a shell to one of your running containers, or create your own custom task definition that runs the iperf tool inside of a container.CommentShareNathan Peckanswered a year ago"


Question: "aws textract human review flow, failed to load image"

"Hi,I`m using aws textract to extract key-value pairs from an pdf. Because sometimes the accucary is low i use augmented AI (human review worflows) to involve a human worker.That works fine with png files, but when I use pdf files (which textract supports), I get an "Failed to load image".How do I get around this? I tried using a custom template, but can't find a way to insert the file type.Best regards,PaulFollowComment"

Answer: "1Accepted AnswerThe underlying challenge here is that, while modern browsers can natively render PDFs, they require different embedding methods for PDFs vs images. To my knowledge there's no built-in SageMaker Crowd HTML Element that's capable of handling both types interchangeably - and your experience with the pre-built UI seems to confirm this.Displaying PDFs in A2I/SMGTThis simple sample suggests to use an <iframe type="application/pdf"> to display PDFs via the browser's native renderer. You could try this approach... but as of ~March 2022, I found support was patchy because some browsers' default security policies didn't like loading a cross-origin iframe with interactive content.If relying on the browser native renderer won't work for your users, you can use the open-source PDF.js renderer instead. Here is a more complex sample template that does that. PDF.js is powerful, but can be pretty tricky to get started with from my experience... Note that the basic process in this sample is:Tag the <script>s and stylesheets for PDF.js in from a CDNInclude a PDF viewer structure in your HTMLPass your A2I object URL in through JavaScript and set up your viewer there - including any interactivity you need(The second inline script tag there you can probably ignore: It's specific to what that data that template collects)Scaling template complexityAlthough the situation has improved a lot in recent years, writing direct-to-browser inline JavaScript in HTML can be tricky due to browser diversity and developer tooling limitations. If you want to build more advanced, interactive task templates, you might want to explore using front-end frameworks like React/Angular/Vue within A2I/Ground Truth.The above-mentioned PDF.js template is actually a legacy that's since been replaced by this VueJS app in the sample that uses it. In that case, the switch was made because we wanted to customize the PDF viewer (rendering detection boxes over the document), and the complexity of the app justified setting up a proper toolchain. You can find discussion there about using frameworks in general and VueJS in particular with A2I, and could use the app as a starting point for building your own complex template in advance. Note if I was re-building that from scratch, I'd probably use much less liquid templating, and implement more within the JS framework itself as discussed here.You can see the complex template being built/deployed from (SageMaker) Python notebook here, and a screenshot of it in action here. This end-to-end sample is discussed further in an AWS ML blog post.Handling mixed PDF/Image contentIf you need your template to handle both PDFs and images, this will add extra complexity. Could your JavaScript infer from the object URL (filename) which category the input object falls into, and dynamically set up either an <img> tag or a PDF viewer? Could you fetch the object from JS and check the Content-Type response header? Might it be simpler to add the file type as an input to your A2I loop, and pass it in that way? (e.g. using conditional liquid template to either render an <img> or not?)Depending on what points in the flow you know the file type, there are multiple different ways you might tackle this. Ultimately though, you'll probably be switching between either generating an img or a PDF viewer: Whether those HTML elements are created by static Liquid templating or by dynamic JS.CommentShareEXPERTAlex_Tanswered 8 months agogoodvirus 8 months agoHi Alex_T,thank you for your long and comprehensive answer!I also found the AnalyzeDocument  type="application/pdf"></iframe> and tried to integrate it, but get an error ""grant_read_access" input is not a valid S3 URI: "". Also I think there might be a a problem if it would work, because I have to render the bountig boxes for the key´s.I will try to convert all my pdf´s to images and than work with it, maybe this will help.Thank you very much!Share0Hi Paul, have you tried this pdf using normal AnalyzeDocument API? And also could you check if the IAM role for your human review workflow has sufficient permission to access your s3 bucket?CommentShareWenzhuanswered 8 months agogoodvirus 8 months agoHi Wenzhu, yes I´m using the AnalyzeDocument API and the IAM-Role has sufficient permission.Share"


Question: Getting emaisl saying I have almosr reached my free tier monthly usage?

"I signed up for AWS awhile ago. Never have used any services, that I know of. I have never received a message until last month. It's the first time I have ever got any mail from AWS. I am not using anything. I don't have any VM's or containers. So I am trying to figure out what the message is about? I have looked through my account and I can not find anything at all that is showing me what this free usage is, when it expires or what it's for? Can anyone point me in the right direction?FollowComment"

Answer: "0Hello,This article will with identifying any services using resources to prevent exceeding the free tier: https://aws.amazon.com/premiumsupport/knowledge-center/stop-future-free-tier-charges/.If you need further assistance you can raise a billing case through Support Center, this doc will walk you through the process: https://docs.aws.amazon.com/awssupport/latest/user/case-management.html.— Brian D.CommentShareEXPERTAWS Support - Briananswered a year ago"


Question: How to distinguish Shared Device & Personal Device

"Hi,I wonder what is the fastest/easiest way to find out if a Shared Device is accessing the skill or a Personal Device.Thanks.FollowComment"

Answer: "0You could call from your skill the resolveRoom API https://docs.aws.amazon.com/a4b/latest/APIReference/API_ResolveRoom.htmlWhen you get room name back, it will be a shared device. When no room is returned, the request is coming from a personal device.CommentShareMilo Oostergoanswered 3 years ago0Thanks for the prompt feedback, milo@aws.CommentShareuseranswered 3 years ago0When calling ResolveRoom for Personal Device, are we supposed to get a response but without any RoomArn?  or we should get an Error?   Because I am getting this:"errorMessage": "An error occurred (ValidationException) when calling the ResolveRoom operation: User ID is invalid, for a different skill or does not currently have room information associated with it"Just want to ensure that this is the expected behavior. Thanks.CommentShareuseranswered 3 years ago0The error message is correct.CommentShareMilo Oostergoanswered 3 years ago"


Question: Has something changed with API Gateway? Now get 401 Unauthorised...

"HI,All API gateway called either through Postman or Unity are now giving 401 unauthorised to endpoints which were working fine. Nothing has been changed on my side which leads me to think AWS has changed something, For example, using an POST method API with a Cognito User Pool Authorizer worked fine with a username and password through Unity and Postman. Now they don't.Thanks!BhavFollowComment"

Answer: "0Hello,As you said you changed anything., this means using the same HTTP method, the same structure of the url, payload, etc? And not changed anything in the user pool?You have some further logs from CloudWatch to check?This documentation page also is a great way to start to understand.CommentShareIbrahim Cesaranswered 4 months ago"


Question: Is is possible to alter the email notifications sent via SNS from Cloudwatch alarms?

"Customer has used the prescriptive CIS benchmarks document to set up some Cloudwatch alarms:https://www.cisecurity.org/benchmark/amazon_web_services/The issue they are having is that the alarm emails that are sent out via SNS are not particuarly useful. They'd like to include more context about the event so they don't have to go hunting for details manually. Here's an example alert (truncated):    Alarm Details:    - Name:                       IAM Policy Changes    - Description:                Amazon CloudWatch alarm that is triggered when an API call is made to change an IAM policy.    - State Change:               INSUFFICIENT_DATA -> ALARM    - Reason for State Change:    Threshold Crossed: 1 out of the last 1 datapoints [2.0 (17/12/19 03:24:00)] was greater than or equal to the threshold (1.0) (minimum 1 datapoint for OK -> ALARM transition).    - Timestamp:                  Tuesday 17 December, 2019 03:29:42 UTC    - AWS Account:                XXXXXXXXXXXXThe alert shows that an IAM policy changed, but doesn't show:which policy changed, orwhat the change was.Is there a way to change the alert or notification to include more data?FollowComment"

Answer: "1Accepted AnswerCan you confirm the customer is taking the approach outline here? Essentially the solution to the question you're posing is alarm enrichment and typically that happens by additional plumbing that queries the resource(s) in question. As a  CloudWatch alarm is just that (an alarm) based off a predefined metric, getting enrichment data directly would be challenging. The metric is simply counting how many times specific eventNames occur in your log group.To get more detail (without doing enrichment), it seems like a Config rule sending data via a Event Bridge/CloudWatch Event Rule that triggers a Lambda function and/or SNS topic may yield the information the customer wants? There is a slightly dated by still useful walk-through here.CommentShareEXPERTFrank_Panswered 3 years agoSlowLearner a year agoAdding a host of links to read defeats the whole purpose of the Q&A forum. Adding an example will surely help.Share"


Question: Number messageAttribute delivered as String in Lambda subscriber to SNS Topic

"I have 2 listeners on a SNS Topic, a JSON-email and Lambda.When i send a message with MessageAttributes of type Number, I do get them als Numbers in my JSON-email, but as strings in my Lambda event.The same message, with the same messageId looks like this:  "MessageAttributes" : {    "Active" : {"Type":"Number","Value":"0"}  }and  "MessageAttributes" : {    "Active" : {"Type":"String","Value":"0"}  }Is this a bug, or am I doing something wrong?FollowComment"

Answer: "1Accepted AnswerSNS messageAttributes of type Number is sent to lambda event as type String. But this is a not a bug as per AWS documentation.https://docs.aws.amazon.com/sns/latest/dg/sns-message-attributes.htmlNumber data type isn't supported for AWS Lambda subscriptions. If you specify this data type for Lambda endpoints, it's passed as the String data type in the JSON payload that Amazon SNS delivers to Lambda.CommentShareprabuanswered a year ago0Right, I missed that. I can't really understand why that would not be support on Lamda's though. It would still be the same StringValue, only the Type would be differently named.CommentShareCP_2022answered a year ago"


Question: SES IP in spam db

Is there anyway to get Amazon to retire an SES IP that's on a spam blocking list? This one is causing issues 54.240.27.190FollowComment

Answer: "0In my case, the IP coming up is  54.240.11.75 as 0SPAM and SORBS SPAM. How can this be fixed?https://drive.google.com/file/d/1Je1FMgSpKv1Flg_z7EbCnnkln91903sv/view?usp=sharingCommentShareTechWriterLorianswered a year agoJosh L 2 months ago@omare from AWS indicated that they won't attempt to take action with SORBS because of the way that SORBS handles listing/delisting.Share"


Question: Using tags with spaces with cloudformation deploy

"Due to an unfortunate choice of tags for billing we are stuck with trying to tag all resources with a tag with a space in it. "OTAP Environment".From documentation:--tags (list) A list of tags to associate with the stack that is created or updated. AWS CloudFormation also propagates these tags to resources in the stack if the resource supports it. Syntax: TagKey1=TagValue1 TagKey2=TagValue2 ...From my development laptop (Windows) it seems to work:sam deploy --template-file serverless-output.yml --capabilities CAPABILITY_IAM --parameter-overrides Environment=t --tags "OTAP Environment=T" --stack-name myStack(sam deploy = aws cloudformation deploy)However, when running this in a linux docker (Alpine) via Gitlab it does not work. Of course I tried other quotes. ' and `. With the latter I expected it to work, were it not the tags seems to disappear because of the GitLab Runner.This may be more a gitlab issue than an AWS CLI issue, but if tagging were possible without the space seperation (in json maybe?) I could automate it.FollowComment"

Answer: "0spaces aren't supportedThis is the regex for key names:^([\p{L}\p{Z}\p{N}_.:/=+-@]*)$]CommentSharecloudbuttonanswered 4 years ago0It has worked on a windows machine, with the proper quotes, hence I know it is possible via AWS CLI. Still not sure about the GitLab + AWS CLI combination.And it is possible from the console.I found this in documentation:The key name of the tag. You can specify a value that is 1 to 127 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.CommentSharervdbrandanswered 4 years ago0My bad..I was referencing the incorrect regex.The SAM cli is just a wrapper on top of the cloudformation cli..have you tried using the cf cli directly?e.g.aws cloudformation deployhttps://docs.aws.amazon.com/cli/latest/reference/cloudformation/deploy/index.htmlCommentSharecloudbuttonanswered 4 years ago0Yes, I have tried that as well. From a Windows laptop it is possible with the right quotes.--tags "OTAP Environment=T"Would work in that case. But haven't got it to run on a Gitlab runner. But the solution is no longer needed as the required tag has changed to a tag without a space :-DCommentSharervdbrandanswered 4 years ago0Answer is no longer needed as the required tag name changed.CommentSharervdbrandanswered 2 years ago"


Question: S3 batch job error Task target couldn't be URL decoded

"I need to restore a lot of object from aws s3 glacier deep archive. So i try to use a s3 batch jobs. For that i use a python code to create a manifest as a csv with to columns Bucket,Key. But my first issue : some Key contain a comma so the job failed.To solve (partialy) this issue i just cut the csv file to keep only the first two columns hoping that there are not many files involved.But now i have another issue:ErrorMessage: Task target couldn't be URL decodedAny Idea ?FollowComment"

Answer: "0This error messaage can appear when you have objects that contain special characters. To account for these special characters, you must URL encode the manfiest file.For more information about creating and using a custom manifest file, please refer to the following link:https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-create-job.html#specify-batchjob-manifestWhen using Python, you can use the "urllib.parse" library to easily URL-encode the manifest file. For more information about this library, please refer to the following link:https://docs.python.org/3/library/urllib.parse.htmlCommentShareAWS SA Neilanswered 4 months agoQuentin67 4 months agoThank you. In fact I was already on the track of using urlIb3 but I didn't know that you could put directly the URL encode in the manifest. But we agree that you have to use "+" instead of spaces (so use urllib.parse.quote_plus() )Share"


Question: "Initiate Restore from Deep Glacier, but file doesn't become available"

"I am trying to do a test restore of a file which was uploaded to S3 and moved to Deep Glacier through a LifeCycle Rule.I go into the S3 bucket, find my file (which is in Deep Glacier), and select "Initiate Restore".  I then get the message that the restore has been initiated.But after that, nothing seems to happen.  I've waited for over a week and I see no indication in the S3 Management page that the restore is in process or has been completed.  And when I use the Read-S3Object Powershell command I get a message "The operation is not valid for the object's storage class".  It seems like the object didn't get restored from Deep Glacier back into S3 for me to download.One note: These files are encrypted so I need to do the actual restore from this Powershell command using the ServerSideEncryptionCustomerMethod of AES256 and the ServerSideEncryptionCustomerProvidedKey parameters.What am I doing wrong?  I've followed this process in the past and while I never saw any indication of when the file was ready to be download from S3, it would always eventually work.Thanks!FollowComment"

Answer: "0After talking with AWS Support, here is what I found:Because the object is encrypted with a customer provided key, I can't see the status of the restore from Deep Glacier to S3 in the AWS Management Webpage.  So I was told to use the following powershell command:Get-S3ObjectMetadata -BucketName <bucket> -key '<S3 folder/S3 filename>' -ServerSideEncryptionCustomerMethod AES256 -ServerSideEncryptionCustomerProvidedKey "123456"Or, I could have used the AWS command (adding the argument for providing the encryption key):aws s3api head-object --bucket awsexamplebucket --key dir1/example.objWith either command, you can see that RestoreInProgress is set to true while the object is being restored to S3, and then it changes to false and the RestoreExpiration is set to a date when the object is ready to be downloaded out of S3:Get-S3ObjectMetadata -BucketName <bucket> -key '<S3 folder/S3 filename>' -ServerSideEncryptionCustomerMethod AES256 -ServerSideEncryptionCustomerProvidedKey "123456"-or-aws s3 cp s3://awsexamplebucket/dir1/ s3://awsexamplebucket/dir1/ --storage-class STANDARD --recursive --force-glacier-transfer [with encryption key specified]CommentShare1288333answered 2 years ago0After talking with AWS Support, here is what I found:Because the object is encrypted with a customer provided key, I can't see the status of the restore from Deep Glacier to S3 in the AWS Management Webpage.  So I was told to use the following powershell command:Get-S3ObjectMetadata -BucketName <bucket> -key '<S3 folder/S3 filename>' -ServerSideEncryptionCustomerMethod AES256 -ServerSideEncryptionCustomerProvidedKey "123456"Or, I could have used the AWS command (adding the argument for providing the encryption key):aws s3api head-object --bucket awsexamplebucket --key dir1/example.objWith either command, you can see that RestoreInProgress is set to true while the object is being restored to S3, and then it changes to false and the RestoreExpiration is set to a date when the object is ready to be downloaded out of S3:Get-S3ObjectMetadata -BucketName <bucket> -key '<S3 folder/S3 filename>' -ServerSideEncryptionCustomerMethod AES256 -ServerSideEncryptionCustomerProvidedKey "123456"-or-aws s3 cp s3://awsexamplebucket/dir1/ s3://awsexamplebucket/dir1/ --storage-class STANDARD --recursive --force-glacier-transfer [with encryption key specified]CommentShare1288333answered 2 years ago"


Question: RDS UI missing Jakarta for read replica

"I have an RDS in N. Virginia, and I want the read replica in Jakarta.  I noticed the RDS UI does not list Jakarta as a possible destination.FollowComment"

Answer: "1Screen shots, Jakarta is not listed:CommentShareelbigbadmoanswered 9 months ago0Have you enabled the AWS Jakarta region ? Looks like, it needs to be enabled by following the steps in the link below - [1]As is the case with all of the newer AWS Regions, you need to explicitly enable this one in order to be able to create and manage resources within it.Refer-Steps to follow to enable the new region- https://aws.amazon.com/blogs/aws/now-open-aws-asia-pacific-hong-kong-region/ -- [1]Jakarta- https://aws.amazon.com/blogs/aws/now-open-aws-asia-pacific-jakarta-region/ -- [2]CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months agoelbigbadmo 9 months agoThe region has been enabled for a couple of months now.Sharebertonys 4 months agohad a same problem, but i dont think those issue relate with region. I already enabled it and nothing changesShare0Cross-Region read replicas are available for all Regions and RDS DB engine versions for the following engines:RDS for MariaDBRDS for MySQLRDS for PostgreSQLLink- https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RDSFeaturesRegionsDBEngines.grids.html#Concepts.RDS_Fea_Regions_DB-eng.Feature.CrossRegionReadReplicasWhat engine are you using ? Can you post your screenshot of the console ?CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months agoelbigbadmo 9 months agoI added screenshots below.  Its for MySQL.Share"


Question: inventory-retrieval by date range

"Totally confused. Rest API documentation indicates that a date range can be used in the params, but it doesn't work.var params = {accountId: 'STRING_VALUE', /** required /vaultName: 'STRING_VALUE', / required **/jobParameters: {ArchiveId: 'STRING_VALUE',Description: 'STRING_VALUE',Format: 'STRING_VALUE',InventoryRetrievalParameters: {EndDate: 'STRING_VALUE',Limit: 'STRING_VALUE',Marker: 'STRING_VALUE',StartDate: 'STRING_VALUE'} ...};glacier.initiateJob(params, function(err, data) {if (err) console.log(err, err.stack); // an error occurredelse     console.log(data);           // successful response});https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Glacier.htmlIs an inventory-retrieval by date range available?I don't want to return everything, only the inventory of a specific date range.Edited by: gregbolog on Apr 14, 2020 10:31 AMFollowComment"

Answer: 0doesn't like fractional secondsCommentShareGregory-7596671answered 3 years ago


Question: How to require CloudFront URL signing based on S3 object permission

"I am serving images from S3 and want to migrate to CloudFront.The S3 bucket is ACL-enabled. Some files are made public (ACL: public-read) and some are private, so they can be accessed like (where public files don't require signature):public -> https://xxx.s3.ap-northeast-1.amazonaws.com/public.jpgprivate -> https://xxx.s3.ap-northeast-1.amazonaws.com/private.jpg?AWSAccessKeyId=…&Signature=…&Expires=…But when I set up CloudFront for this S3 bucket:If I don't restrict viewer access (in Behavior setting), both public and private files can be accessed without signature.If I restrict viewer access using the key pair, then both types require signature in the URLs.Is it possible to set up this as S3 does, which means, requires signature based on the ACL of the objects in S3?FollowComment"

Answer: "0Yes, it is possible to configure CloudFront to require signatures based on the ACL of the objects in S3.To achieve this, you can use CloudFront's Origin Access Identity (OAI) feature. This feature allows you to create a special CloudFront user that can access your S3 bucket, while denying access to all other users.setup instruction:Create a new CloudFront distribution and set your S3 bucket as the origin.In the "Origin Access Identity" section of the distribution settings, create a new identity and grant it read access to your S3 bucket.In the S3 bucket permissions, update the bucket policy to grant read access to the CloudFront OAI.Configure your CloudFront distribution to require signed URLs or cookies, depending on your requirements.With this setup, CloudFront will only allow access to objects in your S3 bucket if the request is made through the CloudFront distribution and includes the required signature. Public objects in your S3 bucket will still be accessible without a signature, while private objects will only be accessible through the CloudFront distribution with the required signature.CommentSharemishdaneanswered 2 months ago0Thank you for answering!I have a question about this: "Configure your CloudFront distribution to require signed URLs or cookies"At this point, all URLs with the CloudFront URL will require signature, is that right?What I would like:public -> https://123.cloudfront.net/public.jpgprivate -> https://123.cloudfront.net/private.jpg?[Signature_of_CloudFront]But requiring signed URLs would affect both public/private URLs. I cannot just replace the hostname of S3 with CloudFront.Is there a solution? Thanks!CommentSharerePost-User-6077707answered 2 months ago"


Question: Error "Connection reset by peer" with ssh

"I am currently experiencing an issue with SSH connections to my EC2 instance. Whenever I attempt to connect using SSH, I receive the following error message: "kex_exchange_identification: read: Connection reset by peer."I have verified that my SSH key pair is correctly configured and the security groups allow inbound SSH traffic on port 22. However, I am still unable to establish a successful SSH connection.I would greatly appreciate any guidance or suggestions to regain SSH access to my EC2 instances. Thanks in advance!FollowComment"

Answer: "0Is it being rejected by the TCPWrapper?You may need to review the settings in "/etc/hosts.allow" and "/etc/hosts.deny" of your EC2 instance.In particular, you should check the file "/etc/hosts.deny".If your IP address is listed in this file, your connection will be denied.If SSM Agent is installed on EC2, try using Session Manager instead of SSH to connect.https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started.htmlCommentShareEXPERTRiku_Kobayashianswered 14 days ago"


Question: Remove any CodePipeline Trigger that autostart the execution

"Is possible to remove any kind of autostart feature on CodePipeline? I have 2 action in source stage, one from Codecommit and one from S3 and both generate automatically 2 different CloudWatch rules that trigger my pipeline. I also need to remove the autostart at resource creation, actually i'm using terraform to build the pipeline but in the documentation i didn't find anything related. Thanks for help!FollowComment"

Answer: "1Accepted AnswerFor CodeCommit and Amazon S3 Source actions, you are not able to disable change detection through the CodePipeline APIs, SDK, or Terraform. You could manually modify/remove the CloudWatch Events Rule that is created in the EventBridge Console, please only take this course of action if you understand the implications and take a backup.For GitHub (Version 2) Source actions, you are able to disable change detection by editing the Source configurationProperties and setting DetectChanges to false.As an alternative, you could add a Manual Approval action to a new Stage following your Source stage. See: AWS documentation on adding a manual approval step.For Terraform, here is some sample HCL code:stage {  name = "Approve"  action {    name     = "Approval"    category = "Approval"    owner    = "AWS"    provider = "Manual"    version  = "1"    configuration {    }  }}CommentShareawstyleranswered 3 months ago0Can you explain what your intended outcome is? CodePipeline is meant to orchestrate events between source repositories/location and CodeBuild. If you do not want that trigger in place, what exactly do you want as the intended outcome?CommentShareawstyleranswered 3 months ago0I want a pipeline to be started manually in any case, i need it for development purposes. There is a way to remove this automatic creation of cloudwatch rules that trigger it?CommentSharerePost-User-1693629answered 3 months ago0Thanks, it's good as workaround.CommentSharerePost-User-1693629answered 3 months ago"


Question: How to connect AWS VPC from ARM CPU?

"I want to connect to AWS VPC using AWS Client VPN on Linux.But it seems that AWS Client VPN  is only supported on AMD64 machines.For ARM CPU, how can I connect?FollowComment"

Answer: "0Hi fumii,Unfortunately, at this time to use the AWS provided client for Linux, the following is required:Ubuntu 18.04 LTS or Ubuntu 20.04 LTS (AMD64 only)CommentShareAWS-User-0357409answered 4 months ago"


Question: Sagemaker Canvas Lifecycle Config

For our Sagemaker Notebook/studio deployments we have used lifecycle configs to turn off the app when inactive. Is this possible to apply to Canvas? Is this a supported function? is there an alternative?FollowComment

Answer: "0Hello, according to the service FAQ the approach to stop the session is by clicking on the Log Out button on the Canvas appCommentShareAWS-User-8651363answered a year agoEXPERTChris_Greviewed 9 months ago"


Question: AWS Backup service deduplication and compression.

Does the AWS Backup service support deduplication and compression of data backups in a backup vault?FollowComment

Answer: "0No, AWS Backup service is used to centrally manage and automate backups across AWS services, does not support de-duplication and compression - AWS Backup FeaturesCommentShareAshish_Panswered 10 months ago"


Question: Control Tower RDS Connection error

I am trying to connect to an RDS db in a Control Tower created account. When I use PGAdmin or other tools to connect I get an 'internal server error' could not connect error. I opened the security group to 0.0.0.0 and no luck. When I use my management account I have no issues. Is there something about a control tower VPC that is different from the management account default vpc that is blocking an external connection?FollowComment

Answer: "0Where are you connecting to RDS from?For access from outside the VPC, public access must be configured in RDS.For access from a VPC other than the RDS, configure VPC peering and configure the route table.https://docs.aws.amazon.com/vpc/latest/peering/create-vpc-peering-connection.htmlCommentShareEXPERTRiku_Kobayashianswered a month agoKhandoor a month agoI have public access on the rds instance and am trying to connect from pgadmin on my local machine. Nothing fancy with the my set up. Tried several times with no luck. Would love the help to figure this out. I can connect with no issues from my main account, I compared the default vpc and security group in main account to the control tower account vpc and sec grp. I didn't see any difference can't really see what it could be thats causing the issue.ShareRiku_Kobayashi EXPERTa month agoWhat IP address do you see when you name resolve the RDS DNS name from your PC?For example, you can view it with the following command.nslookup RDS EndpointAlso, could you please share the full error text of your attempt to connect?Share0I do not believe control tower is playing any part.The the issue will be related to networking.Be that routing, NACLs and or security groups.Without knowing your network connectivity I would start looking there.CommentShareGary Mcleananswered a month ago"


Question: AWS CodePipeline throwing error "Missing required parameter in pipeline.stages[0]: "name""

"I am trying to create a CICD of my application that is available on Bitbucket. For this, I have created AWS CodePipeline that will deploy this app to ECS Cluster. I am trying to do this via AWS CLI. Here is my JSON file:{    "pipeline": {        "roleArn": "arn:aws:iam::xxxxxxxxxxxx:role/service-role/AWSCodePipelineServiceRole-us-east-1-HubspotConnector",        "stages": [{                "Name": "Source",                "Actions": [{                    "InputArtifacts": [],                    "ActionTypeId": {                        "Version": "1",                        "Owner": "AWS",                        "Category": "Source",                        "Provider": " "                    },                    "OutputArtifacts": [{                        "Name": "SourceArtifact"                    }],                    "RunOrder": 1,                    "Configuration": {                        "ConnectionArn": "arn:aws:codestar-connections:us-east-1:7xxxxxxxx3930:connection/5bxxxx2-257f-4xxxxx0-xxx3-edfdsfsdf7d672f",                        "FullRepositoryId": "rxxxxxh/hubspotcctorpipeline",                        "BranchName": "main",                        "OutputArtifactFormat": "CODE_ZIP"                    },                    "Name": "ApplicationSource"                }]            },            {                "name": "Build",                "actions": [{                    "inputArtifacts": [{                        "name": "SourceArtifact"                    }],                    "name": "Build",                    "actionTypeId": {                        "category": "Build",                        "owner": "AWS",                        "version": "1",                        "provider": "CodeBuild"                    },                    "outputArtifacts": [{                        "name": "default"                    }],                    "Configuration": {                        "ProjectName": "cicdCli"                    },                    "runOrder": 1                }]            },            {                "Name": "DeployECS",                "ActionTypeId": {                    "Category": "Deploy",                    "Owner": "AWS",                    "Provider": "ECS",                    "Version": "1"                },                "RunOrder": 2,                "Configuration": {                    "ClusterName": "my-ecs-cluster",                    "ServiceName": "sample-app-service",                    "FileName": "imagedefinitions.json",                    "DeploymentTimeout": "15"                },                "OutputArtifacts": [],                "InputArtifacts": [{                    "Name": "my-image"                }]            }        ],        "artifactStore": {            "type": "S3",            "location": "codepipeline-us-east-1-1xxx5xxxx29"        },        "name": "newPipelineCicd",        "version": 1    }}Here is the error I am facing:Can Someone describe me what I am doing wrong? I have searched for these errors but didn't get any help from anywhere. Also no one have written any tutorial or proper guide for this. I have found AWS documentation, one of the complexest documentations. Please guide me here.I would really appreciate that.FollowComment"

Answer: 1Accepted AnswerThe parameter names are case sensitive for the AWS CLI input files.We recommend that you use the --generate-cli-skeleton option to generate the template with the "correct" parameter names to avoid errors.aws codepipeline create-pipeline --generate-cli-skeletonPlease refer to the CLI Skeleton Templates documentation.CommentShareDmitry Balabanovanswered 9 months ago