Question: "Traversing through complete path (Graph DB, Gremlin, Neptune Cluster)"

"Hi Team,I am working on a complex graph data that has central node and multiple nodes connected to it and further connected to multiple nodes and so on.I would like to traverse through a complete path from central node to end.I am using the query:%%gremling.V('12345').repeat(bothE().otherV()).simplePath().path()and it throws below error:{"code": "MemoryLimitExceededException","requestId": "c83563f5-821b-45a3-8503-694617e4bec7","detailedMessage": "Query cannot be completed due to memory limitations."}The problem I have got is, I don’t know how many times to repeat the traversal. From manual observation, the query works when repeated 6 times (i.e, when I mention times(6)) for this specific ID.I can’t specify any ‘until’ condition as I don’t know where the starting node traverses through.I have got millions of IDs and I want to traverse the path through each of the IDs (see where the path ends) and work on centrality calculations of the nodes associated within the graphs of individual IDs.Is there a way, I can implement this?Any help is greatly appreciated.Thanks.FollowCommentTaylor-AWS a year agoThis sounds like you're attempting to find the Connected Components for a single vertex? If so, you may want to try the OLTP approach noted here: https://tinkerpop.apache.org/docs/current/recipes/#connected-components.  If the graph is large and highly-connected, the OLTP approach may not work (and Neptune does not support withComputer() today).  In those cases, you may need to fall back on using the Connected Components algorithms built into Apache Spark GraphFrames (https://stackoverflow.com/questions/65480804/how-to-get-connected-component-with-graphframes-in-pyspark-and-raw-data-in-spark).Share"

Answer: "0I have simillar problem. My graph is very small, only 6 000 nodes and 30 000 edges, but when I try just to find one shortest path between two nodes I end with MemoryLimitExceededException.If I run this query, that shoud find shortes path between node lru99309 and lru306193:g.V('lru99309').repeat(outE().inV().simplePath()).until(hasId('lru306193')).path().limit(1).group().by(count(local)).next()I got the response:==>15=[path[v[lru99309], e[lru99309_lru168327][lru99309-dansecon->lru168327], v[lru168327], e[lru168327_lru140198][lru168327-dansecon->lru140198], v[lru140198], e[lru140198_lru170399][lru140198-dansecon->lru170399], v[lru170399], e[lru170399_lru69973][lru170399-dansecon->lru69973], v[lru69973], e[lru69973_lru316679][lru69973-dansecon->lru316679], v[lru316679], e[lru316679_lru316652][lru316679-dansecon->lru316652], v[lru316652], e[lru316652_lru306193][lru316652-dansecon->lru306193], v[lru306193]]]But if I try only node that is next to lru306193, but a little far away from starting node I obtain MemoryLimitExceededException.I do not understand if I am doing something wrong or if the Neptune is not possible to use for searching for shortest path.Normally I use OSRM engine to search for shortest paths in the road network, but I was interested if I can use Neptune to solve basic road network questions.My graph is:neptunegraphtraversalsource[neptunegraph[], standard]Maybe I need some other type of graph, such as graphtraversalsource[tinkergraph[], graphcomputer], but I think that Neptune does not support graphcomputer version of the graph.CommentSharerePost-User-7726175answered 10 months ago0It is likely going to come down to how big of a fan-out you see at each hop in the graph.  Neptune performs queries, by default, using a BFS pattern.  So when doing shortest-path traversals, it comes down to traversing all vertices at each level in the graph to return the shortest path.  When using a limit(x) step, the query will stop once it has found the first x results.  At present, Gremlin queries are natively run on a single execution thread.   There are a few things that you may want to try....Each Neptune instance has a finite number of execution threads equal to 2 x the number of vCPUs on the instance.  About 2/3rds of the instance memory is reserved for buffer pool cache.  The remaining memory is allocated (some what) evenly across the worker threads.  Smaller instances (such as a t3/t4g.medium) will have very little memory per execution thread.   Memory per thread will increase slightly until you get to the 4xlarge sized instances.   The 4xlarge or larger instances will have the largest amount of thread memory allocated.  So increasing the instance up to a 4xlarge can improve OOM related queries.Neptune has two different query execution engines - a native engine and a newer engine called the DFE engine.  Starting in version 1.1.1.0, DFE is enabled by default but it only used by default for openCypher or SPARQL queries.  To use this with Gremlin queries, you'll need to leverage a query hint [1].  DFE can improve certain parts of a query, so it is worth a try.[1] https://docs.aws.amazon.com/neptune/latest/userguide/neptune-dfe-engine.htmlIf you're trying to get a sense for how many objects a query is having to access to perform a query, you can use the Neptune Gremlin Profile API (not the TinkerPop profile() step, this is different):  https://docs.aws.amazon.com/neptune/latest/userguide/gremlin-profile-api.htmlCommentShareTaylor-AWSanswered 10 months ago0Moving to a larger cluster instance really helps for these kind of issues.Slightly modifying the query to exclude duplicates and moving to a larger cluster instance resolved memory limitation error.Modified query:g.V('12345').as('sourceID').repeat(both().as('destID').simplePath().dedup('sourceID', 'destID')).emit().path()This query tries to find the shortest path between source node and destination nodes and outputs path excluding duplicates.Thanks.CommentShareNeelimaanswered 10 months ago"


Question: Can we enable mutual TLS with RDS mysql.8 database instance.

"We have RDS instance with mysql 8. I have eneabled SSL-mode as REQUIRED and using default AWS provided root certificate 2019. But, we would like to improve the security in such a way that we need to enable mutual TLS by creating client certificate signed from root CA.Is it possible in current RDS mysql 8.0 version. Since, I don't see uploading custom root certificate in RDS instance.FollowComment"

Answer: "0No, there is no workaround. You can only do this on an EC2 instance if you install MySQL there.CommentSharejbgorskianswered 3 months agovivekk 3 months agoSo, Mutual TLS is not possible for RDS instances in any way?Share"


Question: DMS - Is it possible to write an expression to get a row as JSON?

"I am using DMS and adding a column with a transformation rule. I want the value of that column to be the source row's contents as JSON.Unfortunately, in the documentation it isn't clear to me what we can use from SQLite. (For example, SELECT statements throw a syntax error, but I can use some functions that are not listed in the documentation, so I don't know what I can and can't use. Also, $ must be used to access columns which is not SQLite syntax, but is not explained so I don't know if there are other syntax differences I'm not aware of.)I managed to get close to my goal with the following expression. It outputs what I want, but I can only get this by specifying each column name. My data is dynamic, so I need a way to generate this without knowing the column names."expression": "json_object('id', $id, 'name', $name, 'next_column', $next_column)"If I could use all SQLite commands I could just do .mode json and ask for the row, but it seems this is not supported. How can I accomplish this?FollowComment"

Answer: "1Accepted AnswerHello JohnThank you for reaching us. I understand that you will like to know of a possible way via which you can make use of the following expression in DMS transformation rules:"expression": "json_object('id', $id, 'name', $name, 'next_column', $next_column)"And I understand that the fields are dynamic in nature and there isn't a way to know the names beforehand. I did check more on these and unfortunately as you have correctly pointed out, at this point there is no mechanism to loop through the row contents to grab the field names.If you have an active AWS Support plan I will highly encourage you to reach out to our Premium Support Team along with the use case and they will be more than happy to submit a feature request on your behalf.CommentShareSUPPORT ENGINEERMano_Sanswered a year agoJohn a year agoToo bad it's not possible, but thanks for looking into it!Share"


Question: DataBrew: Can you define "Invalid value?"

"In the above screenshot, DataBrew has decided that every value in the "state" column was invalid. That's a specific problem, but I'd like the more general answer here; how can I define the rule for a "valid" value? I can do a similar task in the Data Quality rulesets, but I'm not looking to describe how good my data is; I'm trying to replace those invalid values with null.FollowComment"

Answer: "0I understand that you will like to know the definition of valid and invalid in the context of Databrew.The validity of a column in Databrew is based on the column type. For instance , if we have a column called HIRE_DATE with column type date:Valid in this context refers to the percentage of values with a valid date valueInvalid refers to the percentage of values with an invalid date valueTo replace the invalid values with select 'Invalid' and transformation and replace with desired options presentedCommentShareSahil_Sanswered 23 days agorePost-User-3727182 23 days agoThis does not explain why DataBrew decided my entire column should be null, nor does it really answer the question in any way.Share"


Question: How to upgrade a convertible RI instance?

"I purchased a convertible RI r6a.32xlarge. What do I need to purchase or do to upgrade it to r6a.48xlarge? According to the documentation, I need to pay a normalization factor of 128 to equal the NF for the r6a.48xlarge (384). Do I just purchase the r6a.48xlarge instance and upgrade like that?  Or r6a.16xlarge and then merge it with my instance? Documentation is uclear.FollowComment"

Answer: "1Accepted AnswerHere are the steps I would follow in order to meet your requirements to exchange your r6a.32xlarge to a r6a.48xlarge instance:Log into your AWS Account and navigate to the EC2 ConsoleUnder the Instances section on the left, choose Reserved InstancesThere you should have a list of reserved instance to choose from. Select the r6a.32xlarge  of interestOpen Actions and choose Exchange Reserved Instances. Since r6a.48xlarge is of a higher value than an r6a.32xlarge instance, you should be able to exchange it thereHere is some more documentation on the subject if you are interested in learning more: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ri-convertible-exchange.htmlCommentShareKarl_Canswered 3 months agoapprovingdodo 3 months agoDo I have to stop my current r6a.32xlarge instance remove any mounts etc before I upgrade?ShareKarl_C 3 months agoIf you have already upgraded your instance itself, exchanging the convertible RI will not impact your instance as it is simply a pricing plan.However, if you are talking about upgrading the EC2 instance itself, you will want to follow the instructions presented in this documentation: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-resize.htmlThe nature of your EC2 instance (EBS Compatible, EBS Non compatible, or Instance store) will determine the best steps for upgrading the size.Share"


Question: rDNS for mailserver on EC2

"I am trying to set up a mail server on EC2 instance. I have requested an elastic IP and have asked AWS to lift email /rDNS restrictions which they replied they have done so (after I sent them my detailed use scenario).My elastic IP is 1.2.3.4.The next step would be to update the rDNS on my elastic IP. However, when I write (and confirm) the rDNS on the dialog, the "update" button remains disabled.  (Actions -->Update reverse DNS on the Elastic IP config)I have a domain mydomain.com who is managed on another DNS provider (Cloudfare). I have made a  2 NS records pointing to  2 different AWS NS servers for** mail.mydomain.com** (nsxx.awdns-xx.org)I have made a zone on Route53 for mail.mydomain.com, where** aws.mail.mydomain.com** has an A record to 1.2.3.4.I have made a zone on Route53 for 4.3.2.-in-addr.arpa with a PTR record  named 4.3.2.1-in.addr.arpa associated with aws.mail.mydomain.com.Forward DNS seems to be working fine.  **aws.mail.mydomain.com **resolves to my elastic IP and I can communicate with my EC2 instanceReverse DNS still resolves to ec2-1.2.3.4.compute-x.amazonaws.comWhat am I doing wrong?FollowComment"

Answer: "0Accepted AnswerI could not use the web interface but when using the aws CLI, everything worked seamlessly.created a key for accessing the clilog in through cli by aws configure. Entered access key ID and secretaws reset-address-attribute --allocation-id <value from the elastic ip properties> --attribute aws.mail.mydomain.comwaited for about 15 minutes for it to get accepted, and a few minutes later it had propagated.CommentSharerob81answered a year ago"


Question: EC2 instance disappeared

"Hey there,my instance ec2-3-251-68-252 seems to be vanished. I receive billings and I could login per ssh. But I don't see it in EC2-Dashboard.Kind regards - SvenFollowComment"

Answer: "0Hello Sven,I have checked your account and I can see that the EC2 instance is up and running healthy. To see the EC2 details, please make sure that you have selected the correct Region (Ireland) when using the AWS console.You can also use this direct link which it will show you all your EC2 instances in the Ireland Region: https://eu-west-1.console.aws.amazon.com/ec2/v2/home?region=eu-west-1#Instances:Furthermore, for security reasons I would suggest you to edit your post and remove the EC2 IP.Thank you,VasosAWSCommentShareAWS-User-5546426answered 2 years ago"


Question: Amazon Athena SHOW CREATE TABLE is failing

"When database contains - in the name, the Show Create Table for the table in that DB is failing.For example:For test_table.db1SHOW CREATE TABLE db1 or SHOW CREATE TABLE test_table.db1 both returnFAILED: ParseException line 1:11 missing EOF at '-' near 'test'FollowComment"

Answer: "0You are right that you get this error when the database name specified in the DDL statement contains a hyphen ("-"). AWS Glue allows database names with hyphens. However, underscores (_) are the only special characters that Athena supports in database, table, view, and column names.To resolve this issue, recreate the database with a name that doesn't contain any special characters other than underscore (_).Reference - https://aws.amazon.com/premiumsupport/knowledge-center/parse-exception-missing-eof-athena/CommentShareEXPERTAWS-User-Nitinanswered 9 months ago"


Question: NoSQL Workbench support for Local Secondary Indexes in Dynamodb

Is there a way to add a local secondary index to a new Dynamodb table definition in NoSQL Workbench (v3.3.0 on macos)?I am able to configure global secondary indexes but nothing for local.FollowComment

Answer: -1I don't know please change this job for  me and give me anotherCommentShareGummianswered 9 months ago


Question: Why doesn't react's BrowserRouter work on cloudfront when s3 oai settings are applied?

"BrowserRouter was used to implement the react webpage spa in s3.When I set it to public, it worked fine. However, when accessing from cloudfront after applying public access deny and oai, it did not work.So I used HashRouter and it worked.My guess is that s3 only supports static webpages, so browserRouter doesn't work, only HashRouter works. However, when set to public, BrowserRouter worked.If I apply the oai setting to s3, why doesn't react's BrowserRouter work on cloudfront?FollowComment"

Answer: "0This Stackoverflow link might be addressing this issue https://stackoverflow.com/questions/51218979/react-router-doesnt-work-in-aws-s3-bucketFor steps about how to use BrowserRouter with S3 and CloudFront, refer to this external link https://aws.plainenglish.io/how-to-deploy-react-app-with-s3-and-cloudfront-6d170172cd58CommentShareMo Salahanswered a year agojoker a year agoThis is a temporary measure to fix the error, so I don't think it's a fundamental solution.And I asked why the browser router is not working.Share"


Question: How to make Lambda connect to DocumentDB

"I made a lambda function that needs to connect to my DocumentDB Cluster.I  created a security group for lambda to allow outbound 0.0.0.0/0. Then, I edited the VPC settings selecting my default VPC, 2 subnets, and the above security group. Note that the subnets are both public.Then I modified the DocumentDB security group to allow inbound on 27017 from the lambda security group.Still I am getting a timeout.I read somewhere that the subnets need to be private but I only have public subnets, should I create 2 new private ones for this purpose only?Any other useful suggestion?thanksMFollowComment"

Answer: "0Hello,Is the DocumentDB in the same default VPC?I assume you didn't touch the NACLs or the default route tables?Normally you should have connectivity between all subnets of a VPC by default. So it doesn't matter if the subnets are public or not (for prod, it is highly recommended to use private subnets for obvious security reasons).If you don't find the issue, maybe you could try to connect with an EC2 instance by following this guide: https://docs.aws.amazon.com/documentdb/latest/developerguide/connect-ec2.htmlCommentShareVincentanswered 4 months agorePost-User-3116220 4 months agoHello Vincent,DocumentDB is in the same VPC as lambda and my EC2s.I didn't touch NACLs or route tables, note that EC2s and ELB and ASG were made using Elastic Beanstalk.I am already able to connect to DocumentDB from my EC2s.DocumentDB is in a public subnet, should I move it to a private one? I don't remember I saw this option when I created the cluster.Thanks for your help.ShareVincent 4 months agoIs your Lambda launched in the same subnet as your EC2 and using the same security groups? Does your Lambda have the right IAM permissions?SharerePost-User-3116220 3 months agoUpdate: I just find out that I can connect to DocumentDB if my lambda is both in a public or private subnet. It just need to be in a subnet. Does that means that Doc umentDB is in a public subnet too? Do you think this configuration is secure?thanksShare"


Question: "When Lambda functions are warm or provisioned, what is the expected latency between the Lambda Service and the Lambda Execution environment?"

"From my understanding, when Lambda functions are invoked the Lambda Service dispatches a network request to the Lambda execution environment. This of course adds some latency between when the function is invoked from the client and the function actually receives the event payload. When I invoke an empty "hello world" function, processing the request takes less than 1ms. However, invoking the function from the same AWS region typically takes 15-30 ms for the full request/response cycle.Is there any official documentation on what type of latency we should expect?I've also heard of this overhead getting better. Is there any plan to continue reducing or removing this overhead?https://twitter.com/chrismunns/status/1124369763273256960My use case: within a web request I need to send many  (100+)  synchronous requests to Lambda to source data and make calculations. I would like to keep this process below 1 second, but at 30ms per invocation it would take 3 seconds to process 100. Ideally I would need Lambda invocations to respond in 10ms or less.Thanks!FollowComment"

Answer: "0We don't document the latency for invoking a Lambda function because there are many variables that can affect that time. Size of function. How the code initialises. The various runtimes start and operate differently so that also has an effect.The Lambda team (like every other AWS team) is always looking for ways to make improvements to the service and those will arrive when they are ready.To your use case: Latency comes in many forms - code, network, back-end systems, etc. While it's good to focus on the Lambda function latency there are other places where performance gains can be found. In particular, I would look at whether you can send at least some of those requests in parallel to reduce the overall time required. I'd also look at combining the requests into a single call to Lambda as that reduces the number of round-trips to between the front and back ends.Finally: Please engage with your local AWS Solutions Architect. They can give you much more detailed advice than is available here on the forum because you can talk privately about your code, the architecture and what you're trying to achieve.CommentShareEXPERTBrettski-AWSanswered a year agoAWS-User-6060748 a year agoThanks for the response. Is using a managed runtime and the out of the box "hello world" code example not the smallest in function size? If so I don't think there is anything else I can do in that respect to decreasing latency. The code executes in 1ms or less no not sure what to optimize. It seems like the only area to optimize now is what is out of my control, such as the networking in the Lambda Service.In this scenario, I'm not able to send parallel requests as each invocation reveals information that is necessary for a subsequent request. Is this a problem the Lambda team is working on?ShareBrettski-AWS EXPERTa year agoYes, the "Hello, World" function is going to execute the fastest; which means that any other code you add to that is going to increase latency (in this case, code execution time).I'm not sure I'd describe this as "a problem". There are always going to be overheads and (as we've proven in the last few years) we are always going to improve the service. But I don't think you can bank on that happening in a timeframe that you require nor will it necessarily give you the time savings you require.Again, I strongly recommend you  have conversation with your local SA. Or consider and architecture where the back end can do some of the subsequent work for you without having to have the client side send multiple requests.Share"


Question: "Unable to compile model to Neuron: no error message, no output"

"Hi. We are trying to convert all our in-house pytorch models to aws-neuron on inferentia. We successfully converted one, but the second model we tried did not compile. Unfortunately, compilation did not generate any error message nor log of any kind, so we are stuck.The model is rather simple, but large, U-Net, with partial convolutions instead of regular ones, but otherwise no fancy operators.Conversion of this model to torchscript is ok on the same instance.Could it be a memory problem ?FollowComment"

Answer: "2Accepted AnswerHi, in order to see more information about the error, you can enable debugging during tracing by passing 'verbose' to the tracing command like this:import torchimport torch.neurontorch.neuron.trace(    model,    example_inputs=inp,    verbose="debug",    compiler_workdir="logs" # dir where debugging logs will be saved)You'll see the error messages in the console and they will also be saved to the "logs" dir.It is always good to run the NeuronSDK analyzer first to make sure the model is: 1/ torch.jit traceable; 2/ supported by the compilerimport torchimport torch.neurontorch.neuron.analyze_model(model, example_inputs=inp)You can also see a sample that shows how to compile an U-net Pytorch (3rd party implementation) to Inf1 instances here:https://github.com/samir-souza/laboratory/blob/master/05_Inferentia/03_UnetPytorch/03_UnetPytorch.ipynbRef: https://awsdocs-neuron.readthedocs-hosted.com/en/latest/neuron-guide/neuron-frameworks/pytorch-neuron/api-compilation-python-api.htmlIf everything fails, try to look for something like this in the logs:INFO:Neuron:Compile command returned: -11WARNING:Neuron:torch.neuron.trace failed on _NeuronGraph$647; falling back to native python function callERROR:Neuron:neuron-cc failed with the following command line call:And paste here, please. With the "Compile command returned:" code it is possible to identify the error. You are suspecting that there is some issue related to memory, maybe Out of Memory. Normally when that is the case, you'll find the code: -9 in this part of the error.CommentShareSamir Araujoanswered 9 months agorePost-User-9403273 9 months agoThanks for the detailed answer, will tryShare0Following your answer we were able to check the log and gotINFO:Neuron:Compile command returned: -9which is apparently an out of memory error. Switching to a 6x instance solved the problemCommentSharerePost-User-9403273answered 8 months ago"


Question: Why did I loose my usage stats?

"Hi,I use CloudWatch to monitor the stats of a simple EC2 instance and an RDS instance.About two hours ago I have a whole in the graph for the RDS instance. There is no CPUCreditBalance no CPUUtilization and no CPUCreditUsage for 14 minutes. During this time the service was working and I've had no down time. After that time I have stats for CPUUtilization but CPUCreditBalance and CPUCreditUsage are still missing from the graph.FollowComment"

Answer: "0CloudWatch metrics are a best efforts service so there will be gaps in your monitoring on occasion. It doesn’t happen very often but there isn’t anything you can do to get the missing datapoints back.CommentShareSiTheAWSGuyanswered a year agorePost-User-9105976 a year agoThat I get, and I've has small gaps in the data before and it's OK. But I've had no data for those two data points for the last 12 hours and I am still getting nothing. At some point this should be considered and issue shouldn't it?Share0Hello,Reading through the case notes, I understand that used CloudWatch to monitor the stats of a s simple EC2 instance and an RDS instance, however after a while you only had stats for CPUUtilization but CPUCreditBalance and CPUCreditUsage are still missing from the graph. Correct me if misunderstood you.looking at AWS re:Post [1] this is a known issue regarding the t3 instance families, can you confirm if you are using the t3 instance family?From my end I would like to point out that CloudWatch works as push service, and not a poll service. What this means is that in most scenarios, such as metrics delivery, CloudWatch only acts as a storage facility for metrics and is highly dependent of other services to send metrics to CloudWatch Logs [2].With that being said you might need to reach put to AWS Premium Support regarding this as it is an issue that can be solved by Technical Support.I hope you find the above information helpful.Have a great day ahead!References[1]AWS re-Post-https://repost.aws/questions/QURRD6D64tQ1S_fGWfvbZndA/cpu-credit-usage-and-cpu-credit-balance-metrics-missing-in-t-3-a[2] How Amazon CloudWatch works - https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_architecture.htmCommentSharestevenanswered a year ago"


Question: Behavior of Dependent Jobs when Jobs they Depend on need Automated Retry

"I have a Lambda that submits batch jobs for 2 categories of jobs (setup jobs, and data jobs).The data jobs are dependent on the success of setup jobs, so I get the job ids of the setup jobs and set them as a dependency for the data files.  Currently, there is no auto-retry so the data jobs fail immediately once any setup job fails.I want to have auto-retry on the setup jobs but first want to know about the expected behavior of the dependent data jobs -- If I put the data jobs in queue with a dependency on the setup jobs, will the data jobs fail at the FIRST failure?  Or will the dependent data jobs stay in 'PENDING' state until all retry attempts are made on the setup jobs?Thank you.FollowComment"

Answer: "0From the official documentation[1] we can see that:PENDING: A job that resides in the queue and isn't yet able to run due to a dependency on another job or resource. After the dependencies are satisfied, the job is moved to RUNNABLE.I have also replicated your scenario for your better understanding:→ lets assume B is dependent on A, where A is the failing job→ I created a job "A" which will fail on purpose by giving the a invalid command (slee 10 in this case), I have set the 'Job attempts' to 10→ At the very same time, I have submitted another job "B" with the dependency "A"→ I could see that the job "B" was in 'PENDING' status till all the retries were completed→ Once all the retries had failed for job "A", job "B" goes into 'FAILED' status as well.So Answering your query:Q. I want to have auto-retry on the setup jobs but first want to know about the expected behaviour of the dependent data jobs -- If I put the data jobs in queue with a dependency on the setup jobs, will the data jobs fail at the FIRST failure? Or will the dependent data jobs stay in 'PENDING' state until all retry attempts are made on the setup jobs?➢ The dependent data jobs stay in 'PENDING' state until all retry attempts are made on the setup jobs!Reference links:[1] Job states - https://docs.aws.amazon.com/batch/latest/userguide/job_states.html[2] Submitting a job - https://docs.aws.amazon.com/batch/latest/userguide/submit_job.html[3] Job dependencies - https://docs.aws.amazon.com/batch/latest/userguide/job_dependencies.html?icmpid=docs_console_unmappedCommentShareVeronica4036answered 3 months ago"


Question: Finding source of expensive ListBuckets operations

I've got a relatively high expense line item in my monthly costs for S3. When I look at the "operation" it is dominated by the "ListBuckets" call.I'm trying to figure out where that is coming from. The default CloudTrail history shows some calls but not enough to create a high cost.Any suggestions on how to dive the next level deeper to investigate this?FollowComment


Question: SAM deploy does not deploy Layer dependencies to S3

"In my SAM template I've got 2 Lambda functions that share dependencies via a Layer.Here's my directory structure. As you can see, individual functions have no requirements.txt file, but it's shared within deps/ directory:├── deps│   └── requirements.txt├── src│   ├── function1│   │       └── getArticlesById.py │   └── function2│           └── getArticlesById.py└── my-sam-template.ymlAWSTemplateFormatVersion: '2010-09-09'Transform: AWS::Serverless-2016-10-31Description: Sample SAM Template for testing API Gateway, Lambda, DynamoDB integrationGlobals:  Api:    OpenApiVersion: 3.0.1  Function:    Timeout: 5Parameters:    Environment:      Type: String      Default: devResources:  DepsLayer:    Type: AWS::Serverless::LayerVersion    Properties:      Description: !Sub Dependencies for ${AWS::StackId}-${Environment}      ContentUri: deps/      CompatibleRuntimes:        - python3.9      RetentionPolicy: Retain    Metadata:      BuildMethod: python3.9  GetRecommendationsByIdFunctionDynamo:    Type: AWS::Serverless::Function    Properties:      CodeUri: src/function1      Handler: getArticlesById.lambda_handler      Runtime: python3.9      MemorySize: 3008      Tracing: Active      Policies:        - AWSLambdaVPCAccessExecutionRole        - DynamoDBReadPolicy:            TableName:              !Ref MyDatabase      Layers:        - !Ref DepsLayer      Events:        HelloWorld:          Type: Api          Properties:            Path: /getArticlesByIdDynamo            Method: get            RestApiId: !Ref API      Environment:        Variables:          STAGE: !Sub ${Environment}  GetRecommendationsByIdFunctionS3:    Type: AWS::Serverless::Function    Properties:      CodeUri: src/function2      Handler: getArticlesById.lambda_handler      Runtime: python3.9      MemorySize: 3008      Tracing: Active      Policies:        - AWSLambdaVPCAccessExecutionRole        - S3ReadPolicy:            BucketName:              !Ref MyBucket      Layers:        - !Ref DepsLayer      Events:        HelloWorld:          Type: Api          Properties:            Path: /getArticlesByIdS3            Method: get            RestApiId: !Ref API      Environment:        Variables:          STAGE: !Sub ${Environment}sam build --template-file my-sam-template.yml fetches all dependencies and puts them into .aws-sam/build/DepsLayer/python:.aws-sam├── build│   ├── DepsLayer│   │   └── python│   ├── GetRecommendationsByIdFunctionDynamo│   │   └── getArticlesById.py│   ├── GetRecommendationsByIdFunctionS3│   │   └── getArticlesById.py│   └── template.yaml└── build.tomlHowever when I run sam deploy --template-file my-sam-template.yml, DepsLayer dependencies are not copied over to S3, and Lambda functions fail at runtime, since they can't find these dependencies.$ aws --versionaws-cli/2.3.2 Python/3.9.7 Darwin/20.6.0 source/x86_64 prompt/off$ sam --versionSAM CLI, version 1.36.0FollowComment"

Answer: "1It turns out sam has a bug. When I execute:sam buildsam deployEverything works as expected. The Layer with Python dependencies is pushed to S3.But when I use a yml with a non-standard name (other than template.yml or template.yaml):sam build --template-file my-sam-template.ymlsam deploy --template-file my-sam-template.ymlthen the Layer is generated locally (dependencies are fetched from Pypi), but are not pushed to S3.CommentSharemaslickanswered a year agosaw-mhs a year agoNice find .. thanks a lot -- have been poundering my head on this for hoursShare"


Question: Healthcheck failing on healthy service?

"I'm getting "Server process exceeded 3 minutes without reporting healthy" fairly regularly from my gamelift event log, but as far as I can tell it is responding "true" in a timely fashion to every healthcheck request received.I'm running 20 processes on a single c4.large, and the server has plenty of free memory and cpu (generally only a few of the processes actually processing game data at any given time). Load on the server is very low. Yet processes are getting killed by gamelift as unhealthy at a pretty steady clip...I'm not entirely sure how long each process lives or what causes it to suddenly start failing health checks. The Longest lived of my processes is about 4 hours while some are only a few minutes old.FollowComment"

Answer: "0I added some logging to the healthcheck, and it's pretty clear that the process is getting a healthcheck every minute, and returning "true" for all of them, but 30s after the last healthy healthcheck the process is flagged as unhealthy and terimanted:[INFO] [2019-04-29 19:06:22,198] [Thread Pool Worker] [:0] - Healthcheck![INFO] [2019-04-29 19:07:22,198] [Thread Pool Worker] [:0] - Healthcheck![INFO] [2019-04-29 19:08:22,199] [Thread Pool Worker] [:0] - Healthcheck![DEBUG] [2019-04-29 19:08:52,195] [Thread Pool Worker] [:0] - Socket.io event triggered: EVENT_DISCONNECT[DEBUG] [2019-04-29 19:08:52,229] [Thread Pool Worker] [:0] - ServerState got the terminateProcess signal.  rawTerminationTime : {  "terminationTime": "1556565202"}[WARN] [2019-04-29 19:08:52,317] [Thread Pool Worker] [:0] - 39469 received an onProcessTerminate[INFO] [2019-04-29 19:08:52,317] [Thread Pool Worker] [:0] - 39469 received an onProcessTerminate[DEBUG] [2019-04-29 19:08:52,371] [1] [:0] - Socket.io event triggered: EVENT_DISCONNECT[INFO] [2019-04-29 19:08:52,391] [4] [:0] - 4/29/2019 7:08:52 PM|Warn |WebSocketServer.receiveRequest|Receiving has been stopped.                             reason: interruptedIn the gamelift event log there was this line for the same time:2019-04-29 13:08:52 UTC-0600  SERVER_PROCESS_TERMINATED_UNHEALTHY  Server process exceeded 3 minutes without reporting healthyCommentShareranderson37answered 4 years ago0After working with AWS GameLift support, It turns out that the problem here was caused by using the 02_15_2018 GameLift Server SDK. Upgrading to the 12_14_2018 Server SDK has fixed the issue.CommentShareranderson37answered 4 years ago"


Question: RPM request: newer coreutils RPM

"I found coreutils RPM is too old on Amazon Linux 2.sha256sum (GNU coreutils) 8.22Copyright (C) 2013 Free Software Foundation, Inc.License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.This is free software: you are free to change and redistribute it.There is NO WARRANTY, to the extent permitted by law.Written by Ulrich Drepper, Scott Miller, and David Madore.I tried to use goreleaser bash tool but failed, since old sha256sum command does not have --ignore-missing option.I checked the coreutils changelogs and understood --ignore-missing option is introduced to sha256sum 7 years ago, coreutils version 8.25.Could AL2 provide the newer version of coreutils RPM?FollowComment"


Question: oauth2 token endpoint invalid_request error.

"I am using Authorization code grant to create a new cognito user object, but got invalid_request as response. I have got code and state from redirected url but cannot get id,access and refresh tokens to create a cognito user.   const AUTH_DOMAIN = 'https://xxx.auth.us-east-1.amazoncognito.com';    const grantType = 'authorization_code';    const clientId = 'xxx';  const clientSecret = 'xxxx',    const redirectUri = `${window.location.origin}/login-google`; with axios    axios      .post(        `${AUTH_DOMAIN}/oauth2/token`,        new URLSearchParams({          grant_type: grantType,          code: code,          state: state,          client_id: clientId,          redirect_uri: redirectUri        }),        {          headers: {            Authorization: getBase64EncodedCredential(clientId, clientSecret)          }        }      )      .then((response) => {        // handle success        console.log(response.data);      })      .catch((error) => {        // handle error        console.error(error);      });with fetch:    const getToken = async (code) => {      const url = `https://diplomade.auth.us-east-1.amazoncognito.com/oauth2/token`;      const options = {        method: 'POST',        headers: {          'Content-Type': 'application/x-www-form-urlencoded',          Authorization: getBase64EncodedCredential(clientId, clientSecret)        },        body: `grant_type=authorization_code&client_id=${clientId}&redirect_uri=${redirectUri}&code=${code}`      };      const response = await fetch(url, options);      const data = await response.json();      return data.access_token;    };  function getBase64EncodedCredential(cognitoAppId, cognitoAppSecret) {    return 'Basic ' + btoaImplementation(cognitoAppId + ':' + cognitoAppSecret);  }  function btoaImplementation(str) {    try {      return btoa(str);    } catch (err) {      return Buffer.from(str).toString('base64'); //btoa is not implemented in node.js.    }  }I am getting error: "invalid_grant" for the same code. I do not understand where i am doing wrong.I have also applied this answer but still getting the same error.FollowCommentirfan a month agoplease help!Share"


Question: How to remove/disable moon for space level

"I am trying to create a space level with no terrain or anything except for the sun and skybox, but I cannot find any way to remove or disable the moon. Can anyone help me?Follow"

Answer: "0Accepted Answer@REDACTEDUSERYou can also remove the moon texture or replace it with one that you want to use by going to RollupBar (Legacy) / Terrain Editing Tab / Environment and scrolling down to the parameter Moon. Delete the path to the moon texture:REMOVEDUPLOADYou will still have a light in the sky but this can be removed in the Time of Day settings by setting the highlighted parameters to 0,0,0:REMOVEDUPLOADSharerePost-User-1190460answered 5 years ago0Yeah I was trying to remove the moon object, but I got it to do what I needed under Night Sky Multiplier --> Moon Color and Moon corona color. I believe the Moon object is still there, just black in color with no corona now, but I am almost sure the object is still there.SharerePost-User-2072306answered 5 years ago0here's a good tutorial on how to set a custom sky box.link: https://www.youtube.com/watch?v=YUhj2UDSv44SharerePost-User-7620461answered 5 years ago0Thank you @REDACTEDUSERSharerePost-User-2072306answered 5 years ago0Awesome, glad it worked for you!SharerePost-User-1190460answered 5 years ago"


Question: Multiple Cloudtrail logs into centralized Cloudwatch log account

How do I go about getting multiple cloudtrails into a single logging account in cloudwatch? I was thinking maybe kinesis with CW subscription filter? Or is there another way.FollowComment

Answer: "0While there are many ways to achieve this, one approach is well documented here -https://aws.amazon.com/solutions/implementations/centralized-logging/.CommentSharerpathangianswered 3 months agoEXPERTkentradreviewed 3 months ago0Are you interested in combining multiple CloudTrail trails with CloudWatch logs in a single logging account? If yes, then the above post is a solution. Otherwise, if you just want to consolidate all your CloudTrail trails in a single location (single account), then I'd recommend looking at CloudTrail Lake , a managed data lake that lets organizations aggregate, immutably store, and query events recorded by CloudTrail. It does not require you to create any other CloudTrail trails, S3 buckets, use Athena to log and query events or create data pipelines to move your CloudTrail events to a central location.The key component of a CloudTrail Lake is an event data store. Once set up, you may immediately query CloudTrail events in the event data store (or multiple event data stores) using SQL-based queries with the built-in Query editor. Also, as with CloudTrail trails, you may choose to log management and/or data events in an event data store with further selection of sources for data events (so that you may log only desired data and optimize costs). You may also copy existing CloudTrail trails into an event data store.With CloudTrail Lake and AWS Organizations, you may enable CloudTrail event logging across all member accounts in one or more regions to a single account (management account or delegated account like a Security account).CommentSharegsaturanswered 3 months ago0Yes, it would be all the cloudtrails from sub-accounts into one account cloudwatch. So looking at the link, looks like the subscription filter would be the way to go?The environment is for a landing zone accelerator deployment.CommentSharerePost-User-4136916answered 3 months ago0If the sub-accounts are under the same ORG; I could configure a ORG cloudtrail, but then would I be able to send all those logs into cloudwatch in another account?CommentSharerePost-User-4136916answered 3 months ago0Delegated administration of CloudTrail to the destination member account in the AWS Organization should help. Refer https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-delegated-administrator.htmlCommentSharegsaturanswered 3 months ago"


Question: external vendor trying to reset the password

external vendor who has access to the workdocs folders in- sitename= fashionbrand is now unable to access it. how do they reset the password as that option (to reset password) is not available in the sign-in page.FollowComment


Question: NICE DCV Resolution request bug

"I am currently using the NICE DCV Webclient SDK to embed the stream into a website. The layout of this website can change, so for that I want to change the resolution of the session with the connection.requestResolution(width, height) function. For some reason, however, the display layout (as returned by the displayLayoutCallback) then is sometimes slightly smaller than the requested resolution, for example:resolutionRequest: 1106 | 824Layout Callback: 1104 | 824This then leads to a visible empty bar in the site-layout, as the view pixels are missing. The amount of pixels missing is inconsistent as well, ranging between 0-10 for width and height each.The server is an Amazon Linux 2 Instance and the session is a simple virtual-session with GPU enabled. I am using the SDK version 1.2.1-358.Where does this offset come from?Thanks in advance!FollowComment"

Answer: "0Accepted AnswerHI,that's the intended behaviour, not a bug.Client can request any resolution using requestDisplayLayout or  requestResolution APIs.However, the request is not fulfilled by default. The DCV Server replies to the request with the closer available resolution (the one you see via the displayLayoutCallback). The resolution sent back from the server might depend on different factors like OS or if there are any blocked resolution on the remote system (e.g. in the X.conf file).CommentShareRobertoAtAWSanswered 8 months ago0Thanks for your quick reply!That makes sense. After some research I found that XServer limits resolutions to multiples of 8. Now at least I can research how to do a workaround or get a custom XServer resolution limit.Would it be possible to document the callback limitation in the official documentation?CommentSharerePost-User-3581426answered 7 months ago"


Question: TFN registration

I am not able to find a link to register our organization TFN number on pinpoint page.Please provide the link.FollowComment

Answer: 0https://us-east-2.console.aws.amazon.com/pinpoint/home?region=us-east-2#/sms-account-settings/phoneNumbersCommentShareAnaAtAWSanswered 6 months ago


Question: "Codebuild - How to trigger a build from an outbound webhook from external system not (bitbucket, github, gitlab)"

"We just started to replace our bitbucket pipelines for AWS Codebuild.   One feature common to Bitbucket Pipeline and GitHub Actions, is there's an API to trigger a build.This is quite useful when outbound webhooks fire from external system events not coming from the source control provider.As an example, we are using pact.io for contract testing.   The pact broker will fire a webhook to trigger a build when a certain event occurs.   Pact.io has lots of documentation for CI build tools and this is easily replicated when using bitbucket pipelines or github actions.  However, I cannot seem to locate any documentation on how to trigger a Codebuild from an API Request.   See pact webhook templates for trigger_build examples of many CI tools, https://docs.pact.io/pact_broker/webhooks/template_library.How can triggering a build be easily done with AWS Codebuild?FollowComment"

Answer: "0You can use StartBuild API in CodeBuild to start a build programmatically. Other API actions can be found in the same documentation. If a client has IAM credentials to make the API call, you can use CLI/SDK to make that API call. If not, you can consider building an API in API Gateway as a proxy for that CodeBuild API. See this article for reference.CommentShareTaka_Manswered a year agorePost-User-8885966 a year agoStartBuild API is not quite useful for this case without an example HTTP POST.The other option of building an API in API Gateway as a proxy seems overly complicated for the parity with other build tools.Share"


Question: DynamoDB "explore items" showed me an error "Key not found in KeySchema."

"DynamoDB "explore items" showed me an error "Key not found in KeySchema" and items didn't show up.Actually, we have a key in this table and 30+ items.We had no problem when we checked the items by using the old dashboard.This problem only occurs in the new dashboard.FollowComment"

Answer: "1This sounds like a bug in the DynamoDB Dashboard UI. Can you please use the "Feedback" button located on the bottom of the page, this will cut a ticket to the team which maintain the Dashboard.CommentShareEXPERTLeeroy Hannigananswered a year agoFintechee a year agoThank you for your fast response.Have submitted a feedback.ShareFintechee a year agoThank you for your fast response.Have submitted a feedback.ShareFintechee 10 months agoHi, this issue occurred again. I can't find "Feedback" this time. Where can I create a ticket?Share0I'm getting similar problem.I have:DynamoDB APIs working fine, allowing me to create/update/remove entries;DynamoDB DescribeTable API is also working fine;Although I can't visualize my DDB table via UI.CommentShareFelipeWanderleyanswered a year agoFintechee a year agoThank you for your help.Share0This issue happened again!And, I can't find "Feedback" button.CommentShareFintecheeanswered 10 months ago"


Question: Lambda alias as input for ApiGatewayToLambda construct

"Background:We are using CDK to create a infrastructure. We use rest api gateway and lambda and integrate them together.  We use "software.amazon.awsconstructs.services.apigatewaylambda.ApiGatewayToLambda" construct for this integration. The sample code below.apiGatewayToLambda = ApiGatewayToLambda.Builder            .create(this, stageId + names.componentName + "RestApi")            .existingLambdaObj(lambdaFunction)            .apiGatewayProps(                mapOf(                    "proxy" to false,                    "restApiName" to "${waveId}${stageId}${names.componentName}RestApi",                    "deployOptions" to deployOptions                )            ).build()    }Problem:We want to provision the lambda since the we are getting "504 - gateway timeout" from API gateway. On investigation we found that the lambda is getting timeout due to cold start.Blocker:The lambda provisioning can be done only to lambda alias.When we analyze the ApiGatewayToLambda , it does n't accept the lambda alias as input.How do we go about it ? Are there any workaround ?Can some one from support help me with the path forward ?Some java cdk code samples will be helpful.FollowCommentG V Navin 2 months agoLooks like there is an issue open in the github with the similar feature request - https://github.com/awslabs/aws-solutions-constructs/issues/208Share"

Answer: "0Accepted AnswerFunction function = (Function) lambdaStack.getAlias().getLambda()ApiGatewayToLambda integrationSolution = ApiGatewayToLambda.Builder            .create(this, "ApiGatewayToLambdaPattern")            .existingLambdaObj(function)            .build();Kindly notice how the IFunction interface is extracted from the Alias using the getLambda() method, which I then need to cast into a Function object.[1] - existingLambdaObj source codehttps://github.com/awslabs/aws-solutions-constructs/blob/main/source/patterns/%40aws-solutions-constructs/aws-apigateway-lambda/lib/index.ts#L32[2] - Allow Lambda Aliases To Be Used With Constructs #208https://github.com/awslabs/aws-solutions-constructs/issues/208[3] - getLambda()https://docs.aws.amazon.com/cdk/api/v2/java/software/amazon/awscdk/services/lambda/Alias.html#getLambdaSolved this issue with the help of AWS Support, sharing here to make the solution available in this public forum, I hope it helps others.CommentShareG V Navinanswered 2 months agoEXPERTalatechreviewed 2 months ago"


Question: Automatic startup of stopped databases

"Hi all,I created a free (for one year) AWS account and used it in order to work with relational databases (MariaDB and PostgreSQL).In April, I had to pay because my two databases were running and exceeded quota associated with free account; so I decided to stop these two databases.But for May, I also have to pay because these two databases were running all the month.Does it mean databases are restarted and running without noticing me?Thank'sDanFollowComment"

Answer: "0Hi Dan82,To answer your question, yes, your databases were restarted and running. You can stop a DB instance for up to seven days. If you don't manually start your DB instance after seven days, your DB instance is automatically started so that it doesn't fall behind any required maintenance updates. Also it is important to note that even if the database is stopped, you are charged for provisioned storage, manual snapshots and automated backup storage within your specified retention window, but not for database instance hours. You can find out more information here: https://aws.amazon.com/about-aws/whats-new/2017/06/amazon-rds-supports-stopping-and-starting-of-database-instances/If you want your databases gone, instead of stopping it, I would advise deleting it - and any snapshots or back-ups (unless you intend to keep them for future use, but be aware it costs money). https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DeleteInstance.html#USER_DeleteInstance.DeletingYou can find pricing information for MariaDB here: https://aws.amazon.com/rds/mariadb/pricing/?pg=pr&loc=4You can find pricing information for PostgreSQL here: https://aws.amazon.com/rds/postgresql/pricing/?pg=pr&loc=3I hope this helps. Please let me know if you have any questions.CommentShareamz99answered 2 years ago0Hi,You can also use instance scheduler to just start the database one hour per week.CommentShareAWS-User-3868019answered 2 years ago"


Question: AWS Parameters and Secrets Lambda Extension throwing BadRequestException

"I have been trying to use the AWS Parameters and Secrets Lambda Extension to access parameters from the parameter store using this guide https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-integration-lambda-extensions.htmlThe problem is that if I try to access the parameter store(which runs on http://localhost:2773) as soon as the lambda starts up then I get a 400 BadRequestException error from the parameter store with the message not ready to serve traffic, please waitIf I add a delay of 100ms before accessing the parameter store then it works fine and successfully fetches the parameters. The 100ms delay is a blocker for using it in any production environment.Is there a way to use the extension without introducing any wait times for initialization?ThanksFollowCommentrePost-User-1248307 6 months agoI am also facing the same issue. I am trying to cache the database connection inside init method (using Java for Lambda function development. Trying to load DB connection in handler's constructor). DB credentials are stored in Secret manager. The 'Secret Manager Lambda Layer' is used to access Secret manager.Share"


Question: Adding custom cidr to ingress security group using Lambda without default vpc

"Hello all!I have been searching the internet for this but I didn't exactly find a solution.Basically I am trying to add custom cidr ips to a security group via lambda function. I have given all the appropriate permissions (as far as i can tell) . I even tried attaching the vpc (which is non-default) to the lambda function to access the security group but the error was the same so i removed it from lambda function.But I am getting "An error occurred (VPCIdNotSpecified) when calling the AuthorizeSecurityGroupIngress operation: No default VPC for this user"Below is the Policy:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "ec2:RevokeSecurityGroupIngress",                "ec2:CreateNetworkInterface",                "ec2:AuthorizeSecurityGroupIngress",                "ec2:DescribeNetworkInterfaces",                "ec2:DescribeVpcs",                "ec2:DeleteNetworkInterface",                "ec2:DescribeSubnets",                "ec2:DescribeSecurityGroups"            ],            "Resource": "*"        },        {            "Sid": "VisualEditor1",            "Effect": "Allow",            "Action": [                "logs:CreateLogStream",                "logs:CreateLogGroup"            ],            "Resource":  "arn:aws:logs:us-west-2:xxxx:log-group:xxx:log-stream:*"        }    ]}Lambda function:#!/usr/bin/python3.9import boto3ec2 = boto3.client('ec2')def lambda_handler(event, context):    response = ec2.authorize_security_group_ingress(    GroupId='sg-xxxxxxx'    IpPermissions=[        {             'FromPort': 443,            'IpProtocol': 'tcp',            'IpRanges': [                {                    'CidrIp': '1x.1x.x.1x/32',                    'Description': 'adding test cidr using lambda'                },            ],            'ToPort': 443        }        ],        DryRun=True    )    return responseCould someone point me to the right direction? VPC is non-defaul. All I need is to add ingress rule to an existing security group within a non-default vpc.The error log:Test Event NamesnstestResponse{  "errorMessage": "An error occurred (VPCIdNotSpecified) when calling the AuthorizeSecurityGroupIngress operation: No default VPC for this user",  "errorType": "ClientError",  "requestId": "7de9dce1-f2f9-4609-897e-b75ef751544e",  "stackTrace": [    "  File \"/var/task/lambda_function.py\", line 21, in lambda_handler\n    response = ec2.authorize_security_group_ingress(\n",    "  File \"/var/runtime/botocore/client.py\", line 391, in _api_call\n    return self._make_api_call(operation_name, kwargs)\n",    "  File \"/var/runtime/botocore/client.py\", line 719, in _make_api_call\n    raise error_class(parsed_response, operation_name)\n"  ]}Function LogsSTART RequestId: 7de9dce1-f2f9-4609-897e-b75ef751544e Version: $LATEST[ERROR] ClientError: An error occurred (VPCIdNotSpecified) when calling the AuthorizeSecurityGroupIngress operation: No default VPC for this userTraceback (most recent call last):  File "/var/task/lambda_function.py", line 21, in lambda_handler    response = ec2.authorize_security_group_ingress(  File "/var/runtime/botocore/client.py", line 391, in _api_call    return self._make_api_call(operation_name, kwargs)  File "/var/runtime/botocore/client.py", line 719, in _make_api_call    raise error_class(parsed_response, operation_name)END RequestId: 7de9dce1-f2f9-4609-897e-b75ef751544eREPORT RequestId: 7de9dce1-f2f9-4609-897e-b75ef751544eDuration: 213.81 msBilled Duration: 214 msMemory Size: 128 MBMax Memory Used: 77 MBRequest ID7de9dce1-f2f9-4609-897e-b75ef751544eFollowComment"

Answer: "0Accepted AnswerIt was syntax error, plus I added VPC to the configuration which was not required for this purpose. For anyone having the same issue (only want to update security group with the cidr): below is the correct function and permissions (function isnt complete as u may want to delete old rules too):Lambda function:#!/usr/bin/python3.9import boto3ec2 = boto3.client('ec2')def lambda_handler(event, context):    response = ec2.authorize_security_group_ingress(        DryRun=False,        GroupId='sg-0123456789',        IpPermissions=[            {                 'FromPort': 443,                'IpProtocol': 'tcp',                'IpRanges': [                    {                        'CidrIp': '1x.2x.3x.4x/32',                        'Description': 'Security group updated via lambda'                    }                ],                'ToPort': 443            }        ]    )    return responseIAM Policy on lambda execution role:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "ec2:AuthorizeSecurityGroupIngress",                "ec2:ModifySecurityGroupRules",                "ec2:UpdateSecurityGroupRuleDescriptionsIngress"            ],            "Resource": "arn or all"        }    ]}CommentSharecitrocityanswered a year ago0That code is fine. The error message is giving you the information that you need: There is no default VPC in the region that you're using. Yes, you're probably not using a default VPC but there are a few API calls that rely on having one even if you're not using it.Try recreating your default VPC and see how you go: https://aws.amazon.com/premiumsupport/knowledge-center/deleted-default-vpc/CommentShareEXPERTBrettski-AWSanswered a year agoskinsman EXPERTa year agoWow Brettski I had no idea there are API calls relying on the default VPC.  We delete default VPCs as a standard new account preparation process!  Is that actually bad practice?  Thanks.ShareBrettski-AWS EXPERTa year ago"Bad practice" is probably going a bit far but as you've experienced there are a few sharp edges where not having a default VPC (and default subnets in that VPC) can be an issue. The VPC doesn't have to have an Internet Gateway (as it is created by default) so even if someone deploys something to it connectivity will be limited. And you could create a Config Rule that detects when things are deploy into the default VPC.Sharecitrocity a year agoThank you Brettski! Echoing skinsman, I didn't know there are API call relying on the default VPC. Is there no way to specify which VPC to use? Issue is we delete the default VPC to keep network private. I am not even sure if creating default VPC would pass the security team.If there is no way of doing it via lambda without the default VPC, will restricting the default VPC to not have anything public be an issue for Lambda to update the security groups? Also, the security groups will not be under default vpc. I appreciate your helpSharecitrocity a year agoJust to update: I manage to get it working. It was indentation between response and (. I guess whilst trying and adding vpc to lambda configuration, the error was misleading. Thanks for your help. Default VPC is not needed in this caseShareBrettski-AWS EXPERTa year agoI gotta admit - I didn't copy/paste your code; I wrote something fresh which worked; but also didn't test it in an account/region with no default VPC. Glad to see that it isn't required in this particular situation; bear in mind you may trip across other places where it is required.Share0HelloI copied your Script and tested it works pretty good without DryRun flag , I think you need to check permissions of Lambda,Policy Used for the Lambda Function:Basic Lambda Execution Policy andCustom Policy below{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "ec2:AuthorizeSecurityGroupIngress",                "ec2:ModifySecurityGroupRules",                "ec2:UpdateSecurityGroupRuleDescriptionsIngress"            ],            "Resource": "*"        }    ]}Please check the Role and attach the permission, Thank YouCommentShareGKanswered a year agocitrocity a year agoThank you GK. I tried it but i am getting the same error. Could it be because we have a non-default VPC? were you able to test it with the default VPC or custom VPC?ShareGK a year agoI have tested with Custom Vpc however the VPC can be anything, Can you please share the full logs ?Sharecitrocity a year agoI have added the error log to the questioons as it was more than 600 char.Share"


Question: Cannot reach salesforce Marketing cloud Rest API from AWS App Runner instance

"I am running a spring boot application on AWS App Runner. The application failed to connect to salesforce Marketing cloud Rest API. Here an example of sample code I am trying (which works perfectly in my machine and in another normal EC2).   String query = "https://xxxxxxxx.auth.marketingcloudapis.com/v2/token";   String json = "{\n"            + "\"grant_type\": \"client_credentials\",\n"            + "\"client_id\": \"xxxxxx\",\n"            + "\"client_secret\": \"xxxxxx\""            + "}\n";    URL url = new URL(query);    HttpURLConnection conn = (HttpURLConnection) url.openConnection();    conn.setConnectTimeout(10000);    conn.setReadTimeout(10000);    conn.setRequestProperty("Content-Type", "application/json; charset=UTF-8");    conn.setDoOutput(true);    conn.setDoInput(true);    conn.setRequestMethod("POST");    OutputStream os = conn.getOutputStream();    os.write(json.getBytes("UTF-8"));    os.close();    // read the response    InputStream in = new BufferedInputStream(conn.getInputStream());    String text = new BufferedReader(            new InputStreamReader(in, StandardCharsets.UTF_8))              .lines()              .collect(Collectors.joining("\n"));    System.out.println(text);FollowComment"

Answer: "0My assumption is that you utilized "Custom VPC" in Networking configurations.In that case, please make sure the VPC and subnet you selected have routes to the internet, such as NAT GW. Also the NACL and Security Group(s) in the configuration allow the outgoing traffic.CommentShareJason_Sanswered a year agoAWS-User-4694868 a year agoThank you for your quick feedback. I checked VPC and subnets configuration, everything looks OK. I checked also outgoing traffic for ACL and Security Groups, there are no traffic restrictions: allow all traffic, all protocol, all range and source 0.0.0.0/0.Share"


Question: Concurrent executions of Lambda functions

"I would like to understand how many calls of a Lambda function, through AWS-SDK, I can perform simultaneously. Now I am a free tier and it seems that I can't performe more than 10 concurrently executions. In my project, each client is going to make running a function and so the number of concurrently executions that my aws account can performe would be equal to the number of clients that my web app can serve simultaneously. I will be fine with 1000 at the beginning. Is it possible? How many concurrently executions my aws account (if not anymore free tier) could manage of a single function and overall through all functions by default? I will use Europe (Milano) region. With my account, right now, I can performe 10 concurrent executions of my function. I attached my concurrency data in the image:And my code:;import AWS from 'aws-sdk';AWS.config.update({accessKeyId: 'idKey',secretAccessKey: 'SecretKey',region: 'eu-west-3',});const lambda = new AWS.Lambda();var Utente = {feature: "feature"};const params = {FunctionName: 'Lambda',Payload: JSON.stringify(Utente)};˙lambda.updateFunctionConfiguration({FunctionName: 'Lambda',Environment: {Variables: {}}}).promise();function Invokation(params){lambda.invoke(params, (error, data) => {if (error) {console.log(error)} else {console.log("OK")}})};for (let index = 0; index < 20; index++) {console.log(index);Invokation(params);}FollowComment"

Answer: "2As you noted, you can have concurrent executions up to the account limit per region. It's likely that you have a lower limit due to the account age or service usage. You can request a service quota increase to have a higher limit as needed. Also from your code, as you mentioned, you can make SDK calls simultaneously or in sequence to invoke multiple concurrent executions. Your concurrent executions can be consumed by a single or multiple Lambda functions. Those Lambda functions without reserved concurrency share the account level concurrency limit. If you want to avoid a situation where a single function consumes all the account level limit, you can allocate some reserved concurrency to a particular function.New AWS accounts have reduced concurrency and memory quotas. AWS raises these quotas automatically based on your usage. You can also request a quota increase.Lambda quotasConfiguring reserved concurrencyCommentShareTaka_Manswered 6 months agoEXPERTBrettski-AWSreviewed 6 months agorePost-User-8659680 6 months agoI understood, but I'm still asking myself why I have only 10 concurrent executions available? I read everywhere that the default concurrent executions are 1000 and I would be ok with that. Do I have only 10 due to the fact that I am a free tier? Why otherwise?ShareTaka_M 6 months agoAs mentioned in my answer, it can be due to the account age. You can always open a service limit increase request as needed.Share"


Question: Auto scaling group not publishing notification to a encrypted sns topic

"I have tested the integration between asg and my sns topic working without encryption.However when I encrypted the sns topic with customer managed kms key, I'm no longer receiving notification from asg (confirmed from sns cloudwatch metrics), I have granted asg service permission to generate*, encrypt*, decrypt* permission on the key but still not working. Can you advice anything else I should check?Reply to first comment:The account already has full access to the key as admin. I also don't see any relevant cloudtrail event to that key except creation. ASG might not be the service trying to publish to the topic the reason I think it should be asg is before I add encryption I only grant asg permission to publish to the sns topic.FollowComment"

Answer: "0Try this ststement on the key policy:"Statement": [{"Sid": "Allow Key utilization","Effect": "Allow","Principal": {"AWS": ["arn:aws:iam::ACCOUNT_ID:root"]},"Action": ["kms:Decrypt","kms:GenerateDataKey*"],"Resource": "*"},That would allow all the services in the account to use encrypt/decrypt using the key, ASG might not be the service trying to publish to the topic.Another thing that helps a lot is to check CloudTrail Event History around the time the message should have sent, including the "Error code" fieldCommentShareGerman Rizoanswered a month ago"


Question: 535 Authentication Credentials Invalid - Help Please!

"Hi,I deleted the existing IAM User for SES SMTP from my account to create a new one.After creating the new, I've retrieved the SMTP Username and SMTP Password (important: not the access key/secret, as some may ask) and configured my application. After that, I am only receiving "535 Authentication Credentials Invalid" message.What I have already done:-I've already seen the documentation.-I've already searched on forums.-I've already tried to delete/creating new SMTP credentials (about 5 times).-I've borrowed another account's SMTP credentials that I manage to test in this application and this other account credentials worked fined on the installation that I am having issues (so it is not a software issue at my side)-I've tried to manually talk SMTP to amazon's servers to put aside any application issues and still fails (see transcript bellow):$ telnet email-smtp.us-east-1.amazonaws.com 2465220 email-smtp.amazonaws.com ESMTP SimpleEmailService-d-HTY7JINI1 lWd7UFpRFGnP8gGTMYouEHLO myservername.domain250-email-smtp.amazonaws.com250-8BITMIME250-SIZE 10485760250-AUTH PLAIN LOGIN250 OkAUTH LOGIN334 VXNlcm5hbWU6base64_smtp_username334 UGFzc3dvcmQ6base64_smtp_password535 Authentication Credentials InvalidQUIT221 ByeConnection closed by foreign host.My account is currently active and healthly and I am quite sure that there is something wrong at amazon's side.Can somebody please help me?FollowComment"

Answer: "1For those that run into this thread via Google search, make sure you create the credentials via the SES console, and not the IAM console.  I was attempted to rotate existing credentials for an individual user, and they continued to return authentication errors until I did it via SES instead.  I could then see them via the IAM console as well, however I believe this method has additional back end calls that create the corresponding credentials in SES.CommentSharesandwormusmc1answered 2 years ago0Hi pontomarket,There are a few things to check.First, how did you generate your credentials? SMTP credentials are region-specific, so if you used the console in another region (say us-west-1) to generate them, then they won't work in us-east-1.Also, when you had the SMTP conversation via telnet, did you convert the credentials to base64 encoding first?Thanks,Brent @ AWSCommentShareAWS-User-4207280answered 3 years ago0Hi Brent, thanks for your help!Today I've found the following note on the documentation, which was exactly the first point you've mentioned. As I am a long time user for AWS SES in other accounts, I was using the same credentials for all regions and didn't know the specs had changed.Here is the note transcription for anyone else who's facing the same issue:NoteIf you created SMTP credentials before January 10, 2019, your SMTP credentials might work in all AWS Regions where Amazon SES is available. However, credentials created after this date are created using the AWS Signature Version 4, and are unique to each Region.For additional security, we recommend that you delete credentials that were created before this date, and replace them with newer, Region-specific credentials. You can delete older credentials by using the IAM console.Edited by: pontomarket on Jan 6, 2020 6:34 PMCommentSharepontomarketanswered 3 years ago0I also "suffered" this issue and guess it was also related to the region. Just wondering if anyone can explain me how the h*** to find out or change the region a user or credentials are created for. I mean, looking at the IAM user lists how can I find out where it is registered to.CommentShareluisonanswered a year ago"


Question: Python code stops automatically on Ec2

"Hi,I am running a python code which uses API from a broker platform for a trading strategy. The code runs for hours on personal machine but when I run from an EC2 instance it stops automatically in 2-4 hours without any error. this has happened 3 times now.i saw some 54 updates to be applied on the ubuntu instance, have upgraded all and rebooted the system. Even then issue remains. pls helpFollowComment"

Answer: "0I don't think it's possible to answer the question given the information available. if the code is running fine and stops without error then it is exiting normally. You'll need to add some debugging and logging to determine what is happening.CommentShareEXPERTBrettski-AWSanswered a year agoAWS-User-9836463 a year agoHi Brettski, thanks for the response.the code is in while True as it keeps on running till the markets are closed which will 12 midnight India. I do have the complete logs and it keeps on writing to a log file. The log shows the code output but doesnt show any error. abruptly the code and screen stops on AWS. If i see cloudWatch metrics theres highs on NetworkIn. can it be cause of I am writing continuously on a file and AWS doesn't give me that space. i am on t2.large instance.i checked syslog and kernel log etc but there are no errorsShareBrettski-AWS EXPERTa year agoI'm not a career software developer but it sounds iike there is some component that you're using which is exiting without error. If it were me, I'd be enabling more logging and debug output to try and determine where the interruption is happening.Share"


Question: CodeCommit merge-pull-request-by-three-way merges by commit-id rather than branch

"We are trying to use CodeCommit and CodeBuild to implement a process by which when a developer creates a pull request to merge changes from his/her branch, rather than merging into master, he/she requests the changes be merged into an integration branch. Before the merge, the integration and master branches reference the same commit id. After the merge of the developer's changes into the integration branch, integration is now ahead of master and the corresponding CodeBuild job builds the integration branch. Once all the unit and integration tests have been verified, the integration branch is then merged into master branch and integration and master will once again reference the same commit id.What I have observed is that when I execute a merge-pull-request-by-three-way (cli) specifying the pull request that was created to merge from the developer branch into integration, the end result is that the code is merged into both the integration and master branches. Unlike merge-branches-by-three-way, merge-pull-request-by-three-way does not give you an option to specify the target branch, but it shouldn't since the pull request already specifies the target branch into which changes are to be merged. It is unclear to me if this is happening because the commit id's are the same and the merge is doing it based on that, or if CodeCommit thinks master is the "current" branch (referring to the git-merge behavior), but regardless, the result was not what I was expecting.Is this behavior of ignoring the pull requests target branch when merging using merge-branches-by-three-way, a bug or is this expected behavior/"feature" of merge-pull-request-by-three-way (and possibly the other merge-pull-request-* commands) and I should instead use merge-branches-by-three-way.FollowComment"

Answer: "0Hello,Upon replication I was not able to observe the same behavior when using merge-pull-request-by-three-way (via console and cli)  specifying the pull request that was created to merge from the dev branch into integration, the end result is that the code is merged only into integration and not in master branches.You can try this once via console and check if you are still observing the same behavior.If you are still observing the same you can open a support case with the CodeCommit team to further investigate the issue as we would need to check your environment to find the root causeCommentShareAditya_Tanswered 10 months ago"


Question: AWS Identity Center + Multi account access connector

"Hey Support,We are going to be integration Identity Center with Multi account access connector for different environments like Dev, Prod, and Management account.What I want to understand is. we currently already have this setup but we do not have SSO enabled. We want to start using Identity Center for SSO. Before we transition into using it. There are some questions I want to ask.Is there any potential issues if we integrate Identity Center, we will also be using SCIM as well.? Like how will it affect the current users, permissions, roles, policys when transferring ovewr? Will anything break from our current setup? Would the transition be smooth? Do we have to recreate groups/roles/permissions or it will be populated over? Do we have to reassign licenses?Our current setup is by accessing a link/URL in which we type in the account ID and username to login. We want to Setup AWS Identity Center with Multi Account access connector on Okta. We have 3 environments, which is Dev, Prod, and Management.Thanks alot and appreciate it!AaronFollowComment"

Answer: "0If you're using multiple accounts and want to leverage IAM Identity Center, then I would recommend at the very least enrolling all of those environments within the same AWS Organization so that you can leverage the same IAM IC for all of your identity and access needs.From the IAM IC documentation:IAM Identity Center provides support for the System for Cross-domain Identity Management (SCIM) v2.0 standard. SCIM keeps your IAM Identity Center identities in sync with identities from your IdP. This includes any provisioning, updates, and deprovisioning of users between your IdP and IAM Identity Center.In terms of your existing users/permissions/roles -- your existing permission sets/roles/permissions will remain in tact, but you will be provisioning users from your IdP and mapping them to permissions once authenticated.  If you're using IAM Users exclusively right now, you can roll out IAM IC and establish your user/permission set mappings without affecting that access.  That being said, once you have your SSO tuned the way you want it, I would recommend using that method exclusively for managing access to your environment.CommentSharetparrottanswered 2 months ago"


Question: Question on OpenSearch Serverless scale and pricing

"The serverless-overview states:Customers will be billed for a minimum of 4 OCUs (2x indexing includes primary and standby, and 2x search that includes one replica for HA) for the first collection in an account.andEach OCU is a combination of 6 GiB of memory and corresponding virtual CPU (vCPU), as well as data transfer to Amazon S3. Each OCU includes enough hot ephemeral storage for 120 GiB of index data.Have a few questions for the full-text search use case:The 120GiB of index data is the size of documents? or the actual OpenSearch index segment file size?Assume one application has 2 collections and each collection has 120GiB of index data. When both collections are accessed, how many OCUs will run? 8 OCUs?Assume OpenSearch Serverless can automatically scale down to 4 OCUs when one collection is not accessed. How will data be cached for the collections? Later when the load arrives for both collections around the same time, OpenSearch Serverless will scale up to 8 OCUs? What would be the latency for the query? Assume the minimal 4 OCUs will keep 120GiB of index data in OCU's local storage. But the new 4 OCUs will need to download the rest 120GiB of index data before the query is served? If so, the query could be very slow?FollowCommentrePost-User-1543166 a month agoCould someone from OpenSearch Serverless team help to answer it? Need to know whether OpenSearch Serverless is suitable for the workload. Thanks!Share"

Answer: "1Accepted AnswerThe 120GiB of index data is the size of documents? or the actual OpenSearch index segment file size?120GB is the storage available for that OCU. This will store the data in the shards for the index (primaries and replicas), so it's index size, not source size.Assume one application has 2 collections and each collection has 120GiB of index data. When both collections are accessed, how many OCUs will run? 8 OCUs?Collections with the same KMS key share compute resources. So if they are the same key, it will be 4 OCUs (minimum) then scale based on the index sizeAssume OpenSearch Serverless can automatically scale down to 4 OCUs when one collection is not accessed. How will data be cached for the collections? Later when the load arrives for both collections around the same time, OpenSearch Serverless will scale up to 8 OCUs? What would be the latency for the query? Assume the minimal 4 OCUs will keep 120GiB of index data in OCU's local storage. But the new 4 OCUs will need to download the rest 120GiB of index data before the query is served? If so, the query could be very slow?All data is moved from indexing to S3 and retrieved from there by the search OCUs. Data stored in hot depends on the collection type (search, or time series). Search collections keep all data hot to provide best latency. Time series collections keep the latest day of each index in hot. At present we do not provide controls for the retention strategy.Whether the OCUs scale depends on how much data they contain. If you have more than 240GB of index total in the 2 collections, then yes, the OCUs will scale to accommodate the indices. Load time will very much depend on many factors, so, I can't really predict the latency for the first query.CommentShareJon Handleranswered a month agorePost-User-1543166 a month agoThanks Jon for the answer! Bad to hear that it is hard to predict the latency for the first query. One follow-up question.Whether the OCUs scale depends on how much data they contain. If you have more than 240GB of index total in the 2 collections, then yes, the OCUs will scale to accommodate the indices.Let's say all data are ingested and indexed. So the OCUs do not need to scale for the index. For search, when the OCUs scale for 240GB of index in the 2 collections, how many OCUs will be added to serve the second 120GB of index? 2 more OCUs?So when the search requests come for the 2 collections with 240GB of index, the total charge will be 2 OCUs for index, and 4 OCUs for search. Once the search requests stop, the search OCUs will scale back from 4 to 2. Is this understanding correct? Thanks!Share1Let's say all data are ingested and indexed. So the OCUs do not need to scale for the index. For search, when the OCUs scale for 240GB of index in the 2 collections, how many OCUs will be added to serve the second 120GB of index? 2 more OCUs?2 OCUs can handle the whole 240GB. Let's take a case that's not on the line: say 2 collections that use 150GB of storage each. When you create the first collection and index data, Serverless will use 2 OCUs to handle that for both search and indexing (each). Now when you create and populate the second collection, you need 300GB of storage. OpenSearch Serverless will add 1 more OCU each for search and indexing, 6 total, to bring total storage to 360GB, storage used to 300GB.So when the search requests come for the 2 collections with 240GB of index, the total charge will be 2 OCUs for indexActually, we keep the source data for indexing as well as search. Keeping the data in the indexing tier enables us to handle updates. In the 300GB example, you will have 3 indexing OCUs and 3 search OCUs for a total of 6.and 4 OCUs for search. Once the search requests stop, the search OCUs will scale back from 4 to 2. Is this understanding correct?We scale for search by spreading the data across more OCUs. In the 300GB example, If you bring the traffic from X qps to 2X qps, you would likely see search OCUs double to 6. They would scale back to 3 when the qps drops back to X qps.As a sidebar, I wanted to mention that storage used is a good way to think about this problem. But storage used is not 1:1 with source data you send to the service to index. You need 150 GB of storage for something like 70-75 GB of source data. When OpenSearch Serverless creates an index from the source, it roughly doubles in size. Indexes are different data structures and layouts than the source data. Depending on mapping, we typically see a 10% inflation. Then we add a replica, which doubles the storage used.JonCommentShareJon Handleranswered a month agorePost-User-1543166 a month agoThanks a lot for the detail answers! This is very helpful! Looks I misunderstand that the search OCUs will scale with active and standby, while serverless actually spreads the data across OCUs. For the 300GB example, we only need 3 search OCUs. If 1 OCU is down for some reason (node crash, etc), a new OCU will automatically join. The query latency may be impacted as the new OCU needs time to load data.Thanks for the details about the storage usage!Share"


Question: Cannot validate SSO authentication workflows

"Please help on jumpcloud SSO with AWS IAM Identity Center, I followed below link:Single Sign-On (SSO) with AWS IAM Identity CenterIt was failed on validation of SSO.The error message is like below after MFA approve the login:It's not you, it's usWe couldn't complete your request right now. Please try again later.FollowCommentAndrea Cavagna a month agoUsually, this error is to a misconfiguration of the SAML metadata while you were creating the SAML app for Identity Center into jumocloud.Check metadata and redirect URL, and let me knowShare"


Question: DynamoDB Functionality Queries

"I had been running the load test on dynamodb with  provisioned throughput to identify the exact break point at different loads but I ran into several problems during the test , can you please clarify the same?    1)While creating DynamoDB tabled I can see that some cloud watch alarms are also created with it by default, Is it fine if we delete those alarms? Is it having any relevance in OnDemand or when autoscaling is enabled?2) What time will it take the change in rcu (eg: from 1 to 2) will take to reflect in db calls?3)How often can we change the RCU/WCU values in provisioned mode and between provisioned and ondemand modes, if there is a limit what happens if I try to change more that the threshold? (Asking since i saw mode demand/provisioned can be changed only once in 24 hrs)4) Why same number of concurrent request failing after hitting table consecutively? I tried setting the RCU at 1 with autoscaling off and then using Jmeter I made concurrent request by calling 200  read operation simultaneously the first two times it succeeded but the third time it failed why is that so?5) Also once we get the ProvisionedThroughputExceededException then even on smaller loads dynamodb throws ProvisionedThroughputExceededException, why is that so? For Example  I tried setting the RCU at 1 with autoscaling off and then using Jmeter I made concurrent request by calling 300  read operation simultaneously around 30% of total request got throttled, then there after for some time even if I make 30 concurrent request(which have succeeded earlier) will throw some part of the request to being throttled why is that so ?FollowComment"

Answer: "0You are not going to find a "break point" in DynamoDB. You are going to find a "you ran out of configured capacity" point, and you can always raise the capacity (or go to On Demand).The key concept you should research here to understand your seemingly odd results is "burst capacity" whereby a table may provide you with up to 5 minutes worth of unused provisioned capacity. If you provision a table to just 1 RCU and don't use it then after 5 minutes your table will have accumulated 300 RCUs worth of burst capacity, which the table may let you consume before throttling you. Will it let you consume all 300 the first second? Maybe, maybe not. Once you're above your provisioned capacity the table might throttle you, but if you've got burst capacity it probably won't always throttle you.Burst capacity is a great feature for temporary spikes above a provisioned capacity limit, but it isn't a guarantee. If you want to handle a certain workload, provision at or above that workload.I suggest you put the table in On Demand mode (so you don't have to think about capacity and can trust the table to handle what you throw at it), proceed with writing your app using good design practices, then if the cost is non-trivial you can look to CloudWatch to see how you might switch to Provisioned mode with auto-scaling as a cost savings mechanism.CommentSharejzhunteranswered a year ago"


Question: Stop Sending Health Checks Traces to XRay

"Hi,I need to stop Health Checks Traces on XRay, I am using OTEL Collector with AWSXrayExporter.How do I achieve it, I don't see anything in the docs.Thanks in advance.FollowComment"

Answer: "0Hello,You can do this by setting up sampling rules.Go to the X-Ray service at console.aws.amazon.com, click sampling, then click Create Sampling Rule.Here you can configure 0 for the reservoir size and fixed rate. This ensures that it never samples.Then set the URL path under matching criteria to the health check URL path. This sets up your filter.You can read more about it here.https://docs.aws.amazon.com/xray/latest/devguide/xray-console-sampling.html?icmpid=docs_xray_console#xray-console-sampling-optionsCommentShareatshawanswered 6 months agoManoj_S 3 months agoIf the sampling rule is set 0 , does that mean no cost is incurred ?Share"


Question: AWS Lambda invocation of internal ALB getting timed out

I have to call ALB using its DNS from a Lambda function. Both of them are under the same VPC and have the same set of private subnets associated with them. All the private subnets have a Route table with the route to nat-gateway configured.The target of the ALB is service running in the EC2 instances.The call from the Lambda function to ALB is getting timed out. What could be the reason for the same ?FollowComment

Answer: "1Hello,For the ALB, was it set up as Internal or Public Facing?  If it's public facing, you will need to add a NAT Gateway to the VPC to allow the Lambda to access it even though both are in the same VPC.If the ALB is set up as Internal, ensure that the Lambda is able to access the ALB's security group.  The security group assigned to the ALB may not allow the Lambda access and it will need to be added to the SG.CommentShareEXPERTChris_Ganswered a year agoShashank a year agoIn my scenario, the ALB is set up as internal. I had added Lambda's SG as the source to the ALB's SG but still was getting time out while trying to reach ALB from Lambda.Share0I did a mistake on my end, under terraform for LB the internal was set as false. Which made it internet-facing instead of internal and under private subnets.CommentShareShashankanswered a year ago"


Question: How do I consolidate billing emails for my Organization's accounts?

"Every month, I receive about 20 invoice emails from AWS - several pertaining to each account in our AWS Organization. I would prefer to receive a smaller number of emails - or, preferably, a single consolidated email from the root account.Is there a way to configure this in AWS?FollowComment"

Answer: "1If you have individual accounts purchasing items like Market Place subscriptions, these will be individual invoices as they are subscribed from those accounts, but they should be invoices at the payer level in an Organization. You should only get one single invoices for your AWS Services charges though to your AWS Organizations main payer account.Are you seeing something different than this?   If you have Enterprise Support I would suggest reaching out to your AWS Technical Account Manager for assistance.CommentShareEXPERTRob_Hanswered 2 years agoEXPERTHernitoreviewed 2 years ago1Make sure you have set up the right tax settings for each of your accounts: https://aws.amazon.com/premiumsupport/knowledge-center/update-tax-registration-number/You can update this information for all accounts from the Management Payer's console.Check out another answer from Rob_H, as what they said might be one reason. But also, if you have many linked accounts that are set up with different tax/legal address and different seller of reccord in the tax settings, then you will be getting multiple invoices for each of the coutry / seller of record. If you'd like to streamline this process and you want all accounts be registered with the same tax/legal addres, you can update it in the Tax Settings.For more information about this topic, I suggest you could contact AWS Support (Account & Billing), because the setup you have with your accounts may be different from other customers and this needs to be reviewed on case-by-case basis.Also, note, if you are purchasing Reserved Instances or Savings Plans with All Upfront or Partial Upfront payment option from invididual linked accounts, then you will typically be receiving these invoices at the time of purchase, as this is a one time subscription charge (similar to Marketplace purchases).CommentShareEXPERTNataliya_Ganswered 2 years ago0One reason is if you received a PDF invoice by email and your alternate filling contact is the same email then you will receive two emails per account -(see: Billing - When your monthly invoice is available, or your payment method needs to be updated. If your Receive PDF Invoice By Email is turned on in your Billing preferences, your alternate billing contact will receive the PDF invoices as well.  See: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-account-payment.html#manage-account-payment-change-currency ).Also, check the tax settings inheritance.  Once activated then your usage from member accounts will consolidate to a single tax invoice.  The steps are:Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/In the navigation pane, choose Tax Settings.Under Manage Tax Registration Numbers, select Enable Tax Settings Inheritance.Choose Continue.Finally, (I think this is known, but adding to levelset) the management account is billed for all charges of the member accounts. However, unless the organization is changed to support all features in the organization (not consolidated billing features only) and member accounts are explicitly restricted by policies, each member account is otherwise independent from the other member accounts. For example, the owner of a member account can sign up for AWS services, access resources, and use AWS Premium Support unless the management account restricts those actions. Each account owner continues to use their own IAM user name and password, with account permissions assigned independently of other accounts in the organization.  See: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/useconsolidatedbilling-procedure.htmlCommentShareGreg_Banswered 2 years ago"


Question: aws lightsail traffic problems

"Hello, is it possible to implement aws cli to automatically split the ip of all my aws lightsail instances when the traffic pack runs out?FollowComment"


Question: How do I hide the info window in a prebuilt assembly?

"How do I hide the info window in a prebuilt assembly (Export to Engine)?REMOVEDUPLOADI don't need it to be visible to an ordinary player, because there is no point in that. And also, is it possible to leave only the FPS visibility and how to regulate it? I want to make sure that by pressing some keyboard key, you can show and hide the FPS valuemaybe there is some kind of console variable ...Follow"

Answer: "0Accepted AnswerThank you for your help! I found information in the documentation.There are many console variables, but the one that disables the window isr_DisplayInfo 0https://docs.aws.amazon.com/lumberyard/latest/userguide/debugging-intro.htmlSharerePost-User-0396919answered 2 years ago0REMOVEDUPLOAD  I'm thinking if u toggle the ! button to clear the screen of the output it should not show up in the build. and as far as fps go if the game is going to be on steam, steam has the option to turn on fps.SharerePost-User-6701439answered 2 years ago0this does not workREMOVEDUPLOADREMOVEDUPLOADSharerePost-User-0396919answered 2 years ago0I read on here a long time ago that the solution was to do what I posted. Maybe if u go digging into your .cfg files u can change a variable to turn it off. I'm at work so can't look. Maybe it's something silly like you needed to save project before exporting to commit the change.SharerePost-User-6701439answered 2 years ago"