Question: EC2 Not Responding

"HiOne of my EC2 servers running on Ubuntu 18 LTS, went down for 15 minutes yesterday and there was no anomaly regarding alarms and metrics. CPU utilization and other metrics were normal but EC2 server was completely not responding at all. Eventually I had to STOP and START it again and after that it was working fine. All of my applications were using less than 60% of RAM and using less than 40% of CPU.And after 6 hours of that incident it went down again for 5 minutes but this time it went up automatically after 5 minutes without my involvement.Can you guys suggest anything in order to solve this issue in future? Thanks.FollowComment"

Answer: "0Accepted AnswerCheck the system logs produced by the OS in EC2.It is possible that there is a message that can help resolve the problem in some way.CommentShareEXPERTRiku_Kobayashianswered 10 days agomomermushtaq 9 days agoI have checked logs in EC2 console and in Ubuntu's syslog file. But couldn't find any failed message.Sharemomermushtaq 9 days agoAll of my applications running in good health from many weeks. I didn't experience this kind of issue before.ShareRiku_Kobayashi EXPERT7 days agoIt could be a problem with an application hosted on EC2, for example.Sharemomermushtaq 7 days agoI have checked everything and finally figured out the actual problem. The problem was with EBS throughput. Now I am changing SSD generation along with throughput and IOPS values.Share"


Question: IAM role not clear for connecting API Gateway and DynamoDB

"Doing this tutorial, https://aws.amazon.com/blogs/compute/using-amazon-api-gateway-as-a-proxy-for-dynamodb/.Statement from tutorial:Before you proceed, create an AWS Identity and Access Management (IAM) role that has permission to call the DynamoDB API PutItem for the Comments table; this role must have a service trust relationship to API Gateway. For more information on IAM policies and roles, see the Overview of IAM Policies topic.Question: What specific role should one create in order to allow API gateway test requests to write to DynamoDB?  My tests aren't currently writing.   The role I placed in API Gateway setup looks like this: arn:aws:iam::MYACCOUNTID:role/aws-service-role/replication.dynamodb.amazonaws.com/AWSServiceRoleForDynamoDBReplicationFollowComment"

Answer: "0Accepted AnswerThe trust relationship for this role is for replication.dynamodb.amazonaws.com and not for apigateway.amazonaws.com.You should go to the IAM console, create a new role, choose API Gateway and later add the appropriate policy to write to DydnamoDB.Eventually your role should include the following policies:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": "dynamodb:PutItem",            "Resource": "arn:aws:dynamodb:eu-west-1:xxxxxxxx:table/Comments"        }    ]}and{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "",      "Effect": "Allow",      "Principal": {        "Service": "apigateway.amazonaws.com"      },      "Action": "sts:AssumeRole"    }  ]}CommentShareEXPERTUrianswered 3 years ago"


Question: How to stop billing for "Route 53 Resolver Network Interface"?

"Hi, I have been running EC2 instances with web servers on them for months now. I have never been billed anything by Route53 other than for the domain name (and requests, within free tier).Recently, I was following an AWS docs tutorial on Route53 Resolvers. I have created some Resolver rules and endpoints. However, now I have deleted all Resolver endpoints and rules (except the default rule, which I cannot possibly delete, via console or CLI), and in my billing, I am getting billed $0.125/hour for:$0.125 per hour per Resolver Network InterfaceMy question: how do I stop this billing from happening? I was purely trying out the Route53 Resolvers, and now I am getting billed quite a lot of money for something I am not using and do not know how to turn off.Things I have tried / found out:I am aware that the billing corresponds to the amount of ENIs (also $0.125/hour), are these the same thing? I have an ENI running in my EC2 console, but I wouldn't understand why this all the sudden would be a problem, because (as I stated before): I have never paid for Resolver Network Interfaces before.This list will be updated as I try more thingsFollowComment"

Answer: "0please confirm that the AWS CLI command below doesn't return any outputs:aws route53resolver list-resolver-endpointsNote: Please specify the region '--region [region]' where you supposed to have the ENIs.if there is an output, then the R53 Resolver Endpoints still exists and you need to delete them. If not and upon checking in the EC2 Console in the 'Network Interfaces' and there are still R53 resolver endpoint ENIs, then you need to reach out to AWS Support for further assistance.CommentShareTimothy_Manswered 10 months agoKoen 10 months agoTried these, no endpoints were shown (for any region). I have been in contact with AWS technical staff and they have resolved it. I think it was an issue with Billing.Share"


Question: How to specify instance type when training models using SageMaker AutoML Python SDK

"Hi,Is there a way to specify the instance type when training models using the SageMaker AutoML Python SDK? The AutoML.deploy method takes an instance_type argument, but the AutoML.fit method does not take an instance_type argument.Thanks,StefanFollowComment"

Answer: "0Accepted AnswerAs I understand it's not currently possible to customize this instance type selection - the underlying CreateAutoMLJob API doesn't offer any instance type controls so there's no way for the Python SDK AutoML class to expose them.Although it might be nice to have some more user control over this in future, it's worth mentioning that the options might be non-trivial: For example different stages of the autoML process encapsulated within fit() (like pre-processing, training, explainability analysis) might have different infrastructure needs, and different tested algorithms running in parallel might also have different optimal choices for a given dataset.CommentShareEXPERTAlex_Tanswered a year agoAWS-User-9933965 a year agoThanks for getting back to me. Ok that's good to know there isn't a way to do that. I thought maybe I missed something in the documentation.Regards,StefanShare"


Question: Does Mediatailor has Android and iOS SDK?I can see this - https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/services/mediatailor/package-summary.htmlbut not sure if I can use this

Does Mediatailor has Android and iOS SDK?FollowComment

Answer: "0Hi,MediaTailor does not have an SDK for iOS or Android. You can use our existing SDKs to interact with the APIs offered by MediaTailor.https://docs.aws.amazon.com/mediatailor/latest/apireference/resources.htmlFeel free to reach out for further queries.CommentShareSUPPORT ENGINEERajita-awsanswered 6 months agoShriprasad-AWS-User-0357084 6 months agoThanks for an update ..  Does this refers to same ?  - https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/services/mediatailor/package-summary.htmlShare"


Question: How long for the Domain registration to complete?

"We registered a new domain via AWS, and it still says that the "Domain registration in progress". How long will it take for the registration to complete? Will there be any other steps such as DNS config be needed post this?FollowComment"

Answer: "1Depending on the TLD you’ve selected, registration can take from a few minutes to several hours. Once the domain is successfully registered, it will show up in your account.Please refer domain registrationCommentShareAWS-User-7653869answered 7 months ago"


Question: AssumeRoleWithWebIdentity uses azp instead of aud as audience

"I have setup an Auth0 OpenID Connect identity provider for AWS Identity and Access Management. The identity provider has the endpoint dev-0lv18ee7j6vvczam.eu.auth0.com/, audience https://sts.amazonaws.com, and ARN arn:aws:iam::012345678901:oidc-provider/example.eu.auth0.com/ (some dummy values).I then created an IAM role with the attached policy AmazonS3FullAccess and the following trust policy:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "Federated": "arn:aws:iam::012345678901:oidc-provider/example.eu.auth0.com/"      },      "Action": "sts:AssumeRoleWithWebIdentity",      "Condition": {        "ForAnyValue:StringEquals": {          "example.eu.auth0.com/:aud": "https://sts.amazonaws.com"        }      }    }  ]}As far as I understand, this policy should allow holders of tokens from the configured identity provider to call AssumeRoleWithWebIdentity and then call the S3 API with the returned credentials. My application now tries to call AssumeRoleWithWebIdentity with the following JWT issues by the identity provider (again, some dummy values):{  "alg": "RS256",  "typ": "JWT",  "kid": "<kid>"}.{  "iss": "https://example.eu.auth0.com/",  "sub": "<user-id>",  "aud": [    "https://sts.amazonaws.com",    "https://example.eu.auth0.com/userinfo"  ],  "iat": 1678123413,  "exp": 1678209813,  "azp": "<client-id>",  "scope": "openid"}.[Signature]However, the following error is returned:<ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">  <Error>    <Type>Sender</Type>    InvalidIdentityToken    <Message>Incorrect token audience</Message>  </Error>  <RequestId>...</RequestId></ErrorResponse>Apparently, the audience in the JWT is incorrect, even though https://sts.amazonaws.com is contained in the JWT and configured in the trust policy and the identity provider. The same error occurs when removing the audience condition from the trust policy.When changing the audience of the identity provider to the client ID of the application requesting the token, the AssumeRoleWithWebIdentity call works. If adding back the audience check in the trust policy, it only works if checking against the client ID of the application there as well (azp in the token). Why is the aud claim in the token ignored completely? Is there anything I can do about this?FollowComment"

Answer: "0Have observed issue with specifying multiple token audiences.... it gets parsed incorrectly at times.  "aud": [    "https://sts.amazonaws.com",    "https://example.eu.auth0.com/userinfo"  ],Test using just the sts.amazonaws.com as the aud and check?CommentShareabeowluanswered a month ago"


Question: How to configure an ALB to target an internal application using ec2 instances randomly within a IP range?

"There is an internal application (Databricks) which is using a cluster of EC2 instances as Master/worker node. We have deployed an ALB within the same region/vpc/AZ where the application is. The external traffic will hit ALB and then will be forwarded to the Databricks application.The Challenge: The ALB targets can be an instance I'd, an IP or a lambda function. As Databricks is not running on a permanent instance, means whenever it restarts, the host might be different EC2. So how to forward the request to the Databricks application from ALB?FollowComment"

Answer: "0How are you managing your Databricks instances?  If you can use an EC2 Auto Scaling group for the instances you want to be ALB targets then you can point the ALB at the Auto Scaling group.CommentShareEXPERTskinsmananswered 4 months agoRavinder 4 months agoCan we use ASG as a target for ALB? I saw only three options in the AWS documentation for the target types, 1) Instance id, 2) IP & 3) LambdaFor ref, https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.htmlShareskinsman EXPERT4 months agoI find that documentation page misleading too.  You definitely can attach an ALB to an ASG - see https://docs.aws.amazon.com/autoscaling/ec2/userguide/attach-load-balancer-asg.html for example.ShareRavinder 4 months agoHello Skinsman,Thanks for the quick response.Even when I attach the ASG to the ALB by following the link you shared, we need the Target Group and within that Target Group we need to select the instances. However, the instances are not fixed for Databricks cluster. There is a high possibility that when the cluster is idle for a specific time the instances might get terminated and once the cluster is active again then we might not have the same instances. i.e. the cluster instances are dynamic, which is a challenge here. Please let me know if you find some workaround for this.Apart from this, there is one more issue I am facing. The health checks (in Target Group) for the databricks instances are failing. I believe the reason behind that is the attribute "path" (default value "/"). I am not sure what path I have to mention for the databrick application. Although I know the port.  I tested by creating a demo webpage (index.html) at "/var/www/html" and mentioned "path" as "/index.html" and port as 80 for the health check, this worked.Share0I suggested an EC2 Auto Scaling Group thinking that Databricks might use these for its node scaling, but I see now that it handles it internally.Looks to me the best option is to leverage the "Init Script" support Databricks has - https://docs.databricks.com/clusters/init-scripts.html.  You could write a script that queries the instance's metadata to get the instance ID or IP address and use that to register with the load balancer.CommentShareEXPERTskinsmananswered 4 months ago"


Question: EC2 instance - Server refused our key

"EC2 instance not logging in - Instance ID: e-0a00bb8ecb503d4ea - Ubuntu 16Since yesterday I can't log into the instance with the key. Message: Server refused our key.I made an image of the instance and ran it to generate a new key, even with a new key not logging into the instance created from the image.It looks like the instance is corrupted.Does anyone know how to solve?FollowComment"

Answer: 1There could be multiple reasons why an SSH server (sshd) refuses a private SSH key. So I would suggest to have a look at this article which explains common reasons and resolutions for which you might receive this error. https://aws.amazon.com/premiumsupport/knowledge-center/ec2-server-refused-our-key/CommentShareSUPPORT ENGINEERNirmal_Kariaanswered a year ago


Question: Is IdP PCI DSS and PCI 3DS complaint in AWS?

"Hello, we need to know, if using IdP is PCI DSS and PCI 3DS complaint, is there any special requirements? where we can read about implementing IdP to be PCI complaint?FollowComment"

Answer: "0Accepted AnswerYou need to chose an identity provider that adheres to the proper security protocols to meet your PCI compliance. If you want to look at AWS services that can help maintain PCI compliance, take a look at https://aws.amazon.com/compliance/services-in-scope/CommentShareEXPERTRob_Hanswered a year agoJoann Babak a year agoOkay, thanks for your time and the answer, do the AWS have a list of PCI DSS + PCI 3DS complaint IdP?Share"


Question: Bug: Cannot change Lambda architecture without providing a new zip file (in the management console)

"AWS Lambda currently offers a choice of two CPU architectures: x86_64 and arm64. In some cases, the deployment package may not need to be changed in order to work with one architecture instead of another (it may work with either one). Also, the package might be specifically for the other architecture, and switching the architecture may not require a new package to be uploaded.However, in the management console, the new settings for a Lambda function cannot be saved after the architecture is switched if a new zip file is not also uploaded or an S3 location is provided (this occurs only if the Lambda code was previously uploaded as a zip file).Steps to reproduceFirst, either upload a zip file by clicking "Upload" under "Source code"  in the management console or using the AWS CLI:aws lambda update-function-code --function-name <function-name> --zip-file fileb://<path-to-zip-file>Then:View the Lambda function in the management consoleUnder "Runtime settings", click "Edit"Change "Architecture"New fields appear: "Source code location" and "Code source"Click "Save"The field "Code source" is highlighted in red: "This field is required."Click "Upload" under "Code source" and select a zip file on the local file system or select "S3 location" and provide an S3 URL to the source code package under "Amazon S3 link URL"Click "Save"The file will be uploaded and the new architecture setting with take effect.(If an S3 URL was provided, then the architecture can simply be switched on the next attempt.)Expected behaviorThe "Save" button should always work when simply selecting a different CPU architecture.FollowComment"

Answer: "0The challenge here is that while selecting a new architecture may not require a new package it also might require a new package and there's no way for Lambda to determine which way to go. By forcing a new package to upload it highlights that there might be a breaking change. The alternative is to let the code break (if a new package for the architecture is required) which isn't a great experience either.CommentShareEXPERTBrettski-AWSanswered 7 months agospecious 7 months agoI completely understand this angle. I would like to observe, however:If the code was previously provided through an S3 URL, the architecture can just be switched (current behavior)The behavior I'm proposing would give the user more controlShare"


Question: RDS MS SQL dbmail - limited to AWS SES only???

"Hello, can I use my own SMTP server to send emails? I configured DB mail and created profile and account per https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/SQLServer.DBMail.html, but using my SMTP server (Amazon Linux instance, same VPC as RDS instance), but when I try sending an email I get 'profile name is not valid'. So am I forced to use Amazon Simple Email Service only?ThanksFollowComment"

Answer: 0I managed to resolve this by associating the new dbmail profile with the user - msdb.dbo.sysmail_add_principalprofile_spCommentShareAWS-User-3766817answered a year ago


Question: Unable to perform patch scan on Ubuntu instances

I am attempting to setup Patch Manager for all my AWS instances but all my Ubuntu servers are failing on scan.I've checked the servers to ensure the SSM agent is installed and the service is running.Servers are running Ubuntu 22.04.2.When I run a scan I receive the below output error:/var/log/amazon/ssm/patch-baseline-operations/jmespath/visitor.py:32: SyntaxWarning: "is" with a literal. Did you mean "=="?if x is 0 or x is 1:/var/log/amazon/ssm/patch-baseline-operations/jmespath/visitor.py:32: SyntaxWarning: "is" with a literal. Did you mean "=="?if x is 0 or x is 1:/var/log/amazon/ssm/patch-baseline-operations/jmespath/visitor.py:34: SyntaxWarning: "is" with a literal. Did you mean "=="?elif y is 0 or y is 1:/var/log/amazon/ssm/patch-baseline-operations/jmespath/visitor.py:34: SyntaxWarning: "is" with a literal. Did you mean "=="?elif y is 0 or y is 1:/var/log/amazon/ssm/patch-baseline-operations/jmespath/visitor.py:260: SyntaxWarning: "is" with a literal. Did you mean "=="?if original_result is 0:No IMDS credentials found on instance.failed to run commands: exit status 156FollowComment

Answer: "2Patch Manager now supports Ubuntu Server 22.04 LTSYou can now use Patch Manager to patch Ubuntu Server 22.04 LTS nodes. Like other supported versions of Ubuntu Server, version 22.04 LTS, uses the AWS managed AWS-UbuntuDefaultPatchBaseline patch baseline.CommentShareSUPPORT ENGINEERVinay_Sanswered 14 days ago1Hello,As of 30th March 2023, Ubuntu 22 is not yet supported by patch manger, but it is support for Amazon Linux 2023.Please follow this link  for news on update regarding thisHope this helps.CommentShareSUPPORT ENGINEERVinay_Sanswered 2 months agomac_at_rwy 2 months agoI there a roadmap for when Ubuntu 22.04 will be supported?ShareSkyrail 2 months agoThanks for the info VinayShare0I'm also seeing this error, on AL3 and Ubuntu 22 :(CommentSharerePost-User-1690766answered 3 months ago"


Question: Salesforce Documents App Flow

"Hi ,looking for solution where we need move documents uploaded into Salesforce (.) into AWS S3 buckets and how to retrieve it on Demand.FollowComment"

Answer: "0This workshop has a module that covers the use case for moving data from Salesforce to Amazon S3. For retrieving it on demand, it depends on your use case and requirements. From a server side, you can use AWS SDK, for example, to retrieve files.Salesforce to Amazon S3Get an object from an Amazon S3 bucket using an AWS SDKCommentShareTaka_Manswered 5 months ago"


Question: Greengrass v2: Where can I find documentation for what "component" "status" field means? Specifically "new" status.

"I encountered the "new" status but I'm unsure what it means: Screenshot hereAs far as I can see the component is functioning normally and is in state RUNNING locally and has been installed for a long time, but in Greengrass cloud displayed a "new".FollowComment"

Answer: "1Hi,You can find the meaning of the status in the component lifecycle section of our documentation. Hope this helps.Thanks,Vidish NaikCommentSharevidishatawsanswered a year ago"


Question: Connect to internet EC2 instance

I cannot connect my EC2 instance to the internet. More specifically i have added the inbound traffic rules to http and https but still my public IPv4 address on opening in the browser shows error PR_CONNECT_RESET_ERROR to be precise.I am new to aws and would like some help in the matter.FollowComment

Answer: "0Please check the following things should be properly setup on your AWS account and server.Make sure that your instance is associated with a public IP address. You can do this by going to the EC2 console, selecting your instance, and checking the "IPv4 Public IP" field. If there is no public IP address associated with your instance, you will need to allocate one and associate it with your instance.Check that your security group rules are correct. In addition to adding inbound traffic rules for HTTP and HTTPS, you should also make sure that your instance's security group allows outbound traffic to the internet. You can do this by adding an outbound rule with a destination of 0.0.0.0/0 and a protocol of TCP, with ports 80 and 443 allowed.Verify that your instance has a properly configured network interface. Check that your instance is attached to a VPC, and that the VPC has an internet gateway attached. You should also make sure that your subnet's route table directs traffic to the internet gateway.Confirm that your instance has the necessary software and configurations to serve web traffic. Check that your web server software (e.g. Apache, Nginx) is installed and running and that your instance's firewall allows traffic on ports 80 and 443.CommentShareUsman Ahmadanswered a month ago0Stateful Firewall use implicit deny.  When you Allow an inbound you by default Allow outbound.  Troubleshoot using telnet to verify.  Verity that you have a IPv4 by identifying the IGW.  If you created a custom VPC verity the subnet association and public IPv4 is enabled.CommentShareWyCliffeanswered a month ago"


Question: Storage Gateway VTL developer manual?

Is there a SCSI developer manual for the VTL with the command timeout information?I haven't been able to find this. Any help is appreciated.FollowComment

Answer: "0Accepted AnswerWith Tape Gateway, the customer does not need to worry about setting SCSI timeouts for retrieving tapes from Glacier. Tapes go from S3 to S3 Glacier or S3 Glacier Deep Archive when the customer ejects/exports the tape from backup application.Retrieving a tape is a 2-step process. A customer needs to use SGW API or console to retrieve the file from Glacier or Deep Archive to gateway's virtual tape library first (which is S3). Once the tape is in S3, they can present the tape through the gateway to the backup application.I have included a link below that goes through the retrieval process. The relevant section is "Retrieving Archived Tapes".https://docs.aws.amazon.com/storagegateway/latest/userguide/managing-gateway-vtl.html#retrieving-archived-tapes-vtlHope this helps. Please let me know if there are any other questions.CommentShareAWS-User-4940880answered 4 years ago"


Question: xrt build and install error on aws F1.4

"Hello please halpe to check below issue:I am now upgrading the AWS and XRT on my AWS F1 machine, but afterwards I can not find the fpga devices any more. lspci I can find the device, which I can load afi (hellowrold afi)$ lspci...00:1b.0 Memory controller: Amazon.com, Inc. Device f00000:1c.0 Memory controller: Amazon.com, Inc. Device 104100:1d.0 Memory controller: Amazon.com, Inc. Device f00000:1e.0 Memory controller: Amazon.com, Inc. Device 1041$ xbutil scanINFO: Found total 0 card(s), 0 are usableSystem Configuration  OS name:Linux  Release:5.4.0-1025-aws  Version:#25~18.04.1-Ubuntu SMP Fri Sep 11 12:03:04 UTC 2020  Machine:x86_64  Model:HVM domU  CPU cores:16  Memory:245642 MB  Glibc:2.27  Distribution:Ubuntu 18.04.4 LTS  Now:Tue Sep 29 04:46:36 2020 GMT  XRT InformationVersion:2.8.0Git Hash:5d0ccb4f90d39202644f07de9648743d986a7e68Git Branch:masterBuild Date:2020-09-29 04:26:24XOCL:unknownXCLMGMT:unknownThe problem looks like XOCL is not installed.So I redo all the installation again and check each steps, I find that when I am soing this step:sudo apt install --reinstall ./xrt_202020.2.8.0_18.04-amd64-xrt.debThere are error as below:Unregistering old XRT Linux kernel module sources 2.8.0 from dkms on Ubuntu/DebianDeleting module version: 2.8.0completely from the DKMS tree.Done.Cleanup is skipped for package upgrade/downgrade/re-install on Ubuntu/DebianUnpacking xrt (2.8.0) over (2.8.0) ...Setting up xrt (2.8.0) ...Unloading old XRT Linux kernel modulesrmmod: ERROR: Module xocl is not currently loadedrmmod: ERROR: Module xclmgmt is not currently loadedInvoking DKMS common.postinst for xrtLoading new xrt-2.8.0 DKMS files...Building for 5.4.0-1025-awsBuilding initial module for 5.4.0-1025-awsERROR: Cannot create report: [Errno 17] File exists: '/var/crash/xrt.0.crash'Error!  Build of xclmgmt.ko failed for: 5.4.0-1025-aws (x86_64)Consult the make.log in the build directory/var/lib/dkms/xrt/2.8.0/build/ for more information.Finished DKMS common.postinstLoading new XRT Linux kernel modulesmodprobe: FATAL: Module xclmgmt not found in directory /lib/modules/5.4.0-1025-awsmodprobe: FATAL: Module xocl not found in directory /lib/modules/5.4.0-1025-awsDKMS failed to install XRT drivers.Please check if kernel development headers are installed for OS variant used.Check build logs in /var/lib/dkms/xrt/2.8.0Installing MSD / MPD daemonsThe aws-fpga branch I am using is 1.4.15;The xrt version: I have been used xrt2.6.0 and 2.8.0 (xrt master).FollowComment"

Answer: "0Accepted AnswerHello,It seems like the Ubuntu AWS optimized kernel and module extras do not have the fpga-mgr module that is required by this XRT.Can you try using a different kernel?For eg:sudo apt updatesudo apt install linux-virtualsudo apt install linux-modules-extra-$(uname -r)sudo apt purge linux*awssudo rebootThis should get the XRT to work. Let me know if it doesn't work for you.-DeepCommentShareDeep_Panswered 3 years ago0Hi Deep,My current aws kernel version is: 5.4.0-1025-awsDo you mean this kernel is not supported by XRT?for your suggested step: sudo apt purge linux*awsit actually removes the current kernel -- there will be warning that remove kernel may cause system problem so I would need your confirm.CommentSharemacleonshanswered 3 years ago0Thanks, after removing the old kernel which is 5.4.0-1025-aws, reboot, the kernel version now is 4.15.0-118-generic.XRT need to be rebuild and reinstalled then.Afterwards the xbutil scan will get the correct result.CommentSharemacleonshanswered 3 years ago"


Question: Where is FMOD Studio support?

"After two years of development i would have hoped something more than Wwise support would be available. FMOD Studio being the next logical choice.As i have no interest in using Wwise, where on your roadmap is FMOD support?Follow"

Answer: "0Bumping this topic. Has anything changed in the audio middleware? Will the upcoming 1.18 support FMOD Studio or ADX2 etc?SharerePost-User-6097692answered 4 years ago0Not to my knowledge, not saying it wont come but not sure about 1.18 - 1.20 ive come to like wwise but other solutions is always niceSharerePost-User-9018410answered 4 years ago0yes i would also be pretty interested in probably a roadmap form the amazon lumberyard crew? it would be great to have a FMOD integration like for unity etc. in the (near?) future.thanks!SharerePost-User-3942348answered 4 years ago0It will be nice to have FMOD instead WWISE because first one cheaper and doesn't have limitation in count of sounds. Please add support FMOD.SharerePost-User-0401227answered 3 years ago0wwise isn't so bad but it would be nice to have realtime editor representations of the falloff of positional sounds and such (I'm not sure if that's already doable or not).SharerePost-User-9359627answered 3 years ago0wwise has limitations in count of sounds? I didn't read that in the differences on the wwise website between the pro and ltx licenses.SharerePost-User-9359627answered 3 years ago0I mean count of sounds for full Starter version WWISE. I think it is not right do comparison between Full version FMOD and cut version of WWISE.LTX have limitations https://github.com/awsdocs/amazon-lumberyard-user-guide/blob/master/doc_source/audio-wwise-ltx-full-comparison.mdSharerePost-User-0401227answered 3 years ago"


Question: Monthly billing statement + invoice

Every start of the month we get 2 emails:AWS Billing Statement Available andAWS Invoice AvailableThe invoice has attached the pdf with the cost of the previous month.But the "Billing Statement" seems to have the spending from the beginning of the current month in the body of the email. This has us a bit baffled as we not quite sure why we get that email too. We are more than happy of just the invoice of the previous month and done.Why do we get a "Billing Statement"? and what is it?FollowComment

Answer: "0Accepted AnswerHi Aaron,I'm sorry for the misunderstanding, and can see it might be misleading in having different emails sent regarding your AWS bills.The AWS invoice is a summary of finalized charges for the previous month's activity. Your AWS bill is finalized around at the beginning of each new month. This is usually between the third and the fifth day of the month. The charges shown on the .PDF do not include any additional usage charges accrued during the statement period. One-time fees and subscription charges are assessed separately, on the date that they occur.The monthly billing statement may include subscriptions which get processed at the beginning of the month, items like AWS Marketplace fees or Reserved Instances.I hope this makes sense, but if you any have more questions or concerns create a case in the Support Center, so we can take a closer look at your account:http://amzn.to/aws-support-centerThanks,-Mickey N.CommentShareMickey-AWSanswered 4 years ago"


Question: Restrict creating PermissionSets without attaching Permission Boundary

"I have a use case from a bigger enterprise, they are currently adopting AWS SSO with AzureAD integration. In the setup, currently account users or roles are able to create permission sets with administrator access without adding a Permission boundary. Is there any way to restrict creating the permission sets without adding a Permission boundaryFollowComment"


Question: AWS Connect - Contact Search API

"Hi,Is there available API (AWS SDK) for getting all the contacts details use in Contact Search page in AWS Connect url - https://example-ste.my.connect.aws/contact-search or i could use this api endpoint (https://example-ste.my.connect.aws/contact-search/api/search/contacts) in my server?FollowComment"

Answer: "0there is no API to do a search like Contact Search.  But if you have a specific Contact ID that you want to get more detail information.You can use these two API to get most of the details:https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeContact.htmlhttps://docs.aws.amazon.com/connect/latest/APIReference/API_GetContactAttributes.htmlAnd make sure to enable Kinesis to get your Contact Records to your S3, as well as other related items like Contact Lens and Agent evaluations to get the full details as you see in the Contact Search UI.CommentShareClarenceChoianswered 5 months agorePost-User-2464443 5 months agoHi, Thank you for answering my question.I am using these endpoint, these endpoint has detail limitations. Do you have any idea for me to get the other details of a specific contact? I need to get the 'Customer phone number'.Share"


Question: Accessing worker identity in Human Loop template

"Hello. I'm using AWS Augmented AI to create Human review workflows, I do have custom templates set up and workflows configured, do have AWS worker portal configured and can authenticate there with Cognito identity. Now, whenever I start working on a Human Loop task with my custom template I'd like to know the identity of the worker currently working on a task. Is there a way I can get a cookie or auth code or the full JWT token from the task page? I explored both the page and the nested iframe but couldn't find any useful cookies or any other related information there.Long story short what I'm trying to make is to create a lambda behind the secured API Gateway endpoint that will return the information specific to a worker that is currently working on a Human Loop task and to render this information in my template. I thought I can get a JWT token from the cookies and use it to access the API Gateway.Can you please clarify whether I can do this or if any other options are available. Thanks.FollowComment"


Question: Why ECS services should not have public IP addresses assigned to them automatically?

SecurityHub generates   following warning:"ECS.2 ECS services should not have public IP addresses assigned to them automatically".But why? Our deamon that run on ECS must have access to internet and without public IP address and AssignPublicIp='ENABLED'. it is not possible access Internet.  Am I right?FollowComment

Answer: "0Ok, but what about ECS task like REST API server that should be visible to Internet?  For such tasks I also got  "you should not have public IP addresses" warning. In my opinion there we have to suppress  "ECS.2 ECS services should not have public IP addresses assigned to them automatically" warning.CommentShareMichal Szymanskianswered 2 months agoalatech EXPERT2 months agoIn that case I think you should then front the api with an ALB or an public api gateway (protected with WAF, inspection of its the case, shield), which then is linked with a private backend in private subnetShare0Hi,this is due to security reasons as a public IP is exploitable by anyone on the internet.To mitigate this can follow "Use private subnet with Internet Access" section on this article: https://repost.aws/knowledge-center/ecs-fargate-tasks-private-subnet.It is a pretty standard practice to place workloads on private subnets, and then use NAT Gateway to allow outbound internet.Hope it clarifies ;)CommentShareEXPERTalatechanswered 2 months ago0ECS tasks can reside in private subnets that have a route to the internet via a NAT Gateway. This would allow outbound internet traffic without a direct inbound path. This would be the best practices method to reduce security risks associated with tasks having direct public IP addresses.Here is a link that discussed VPCs with private subnets and NAT Gatewayhttps://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.htmlHope that helps.CommentShareRyan_Sanswered 2 months ago"


Question: Calculating the time difference between current record and one immediately preceding it by user in Quicksight

"For each record, I would like to calculate the time difference between that record date and the most recent previous record for that user. The goal is to calculate the number of days between user logins.I was able to identify the last action date using the lag function:Date of Previous Action (Tenant) = lag({action date [master]}, [{action date [master]} ASC], 1,[{tenant [master]}])I think calculated the number of days between the current action and the previous one:dateDiff({Date of Previous Action (Tenant)},max({action date [master]}),"DD")I then obtained the following results:I am looking for a way to assign the number of days between actions for that user to each record, but I cannot figure out a way to do this. Does anyone have any suggestions?Thank you so much in advance!!FollowCommentSeanSi 6 months agoYou can try the formula  timediff = LAG([timestamp], 1) - [timestamp]This formula calculates the time difference by subtracting the value of the timestamp column in the current row from the value of the timestamp column in the previous row.Add the calculated field to your QuickSight visualization.Use the calculated field to show the time difference between the current record and the one immediately preceding it.Share"


Question: Gamelift Realtime (Unity C# SDK) - DTLS Crashing | Reproduction Case

"Hello, I've decided to come to the community to see if anyone can make sense of why DTLS isn't working on the Unity SDK of Gamelift Realtime. Instead of trying to explain the code in my project or possibly third party libraries in the project being the cause, I've created a very basic reproduction case that anyone can run and see the problem.https://github.com/SkyTech6/AWSRealTimeTLSTesterIt's a very simple project. On the Manager object there is a toggle for "Using TLS". Then there are two different ways running this project will go:Not Using TLS:Click "Create Game Session" Button. That will launch the create game session code as well connect to game session, etc. This will create a fast connection to a NON-cert session.Two messages will display on screen that this worked and the server will begin to send "KeepAlive" heart beats (counted in the upper right).Click "Join Group" Button. This will join Group 10, and begin to send you "GroupAlive" heart beats counted above KeepAlive.Type in the Input Field and then click "Send Message". Obviously this will send the message to the server and it will be echoed back to the client and displayed with the other messages.This for the most part works fine.Using TLS:This is where things occur differently.Create Game Session will work and connect.Messages will display and heart beats will begin to count.Clicking "Join Group" will CRASH Unity and give the stack trace attached in error.log.Send Message however will work.When using TLS, _client.JoinGroup(int) will cause Unity to fail.Interestingly, if you switch SendMessagePayload(string) to use _client.SendEvent instead of a _client.SendMessage().WithDeliveryIntent(DeliveryIntent.Reliable), then Send Message will also crash. Or if you change DeliveryIntent to be Fast, it will crash.My guess is that the base RTMessage Send function is not correctly identifying the connection type for the messages, nor is it correctly falling back to fast when reliable cannot be made. As well there isn't error handling in place in the SDK to account for this.Editor.log|attachment (120.6 KB) error.log|attachment (130.3 KB)FollowComment"

Answer: "0Thanks for the detailed post and the sample project, which will be helpful.I've passed this on to the GameLift service team and they should respond asap.CommentSharerePost-User-5332620answered 3 years ago0Thanks Pip! I appreciate that a lot.CommentSharerePost-User-6168330answered 3 years ago0Good morning!I've followed the process detailed below and taken a look at the logs provided. What I saw in the error log that stood out was:ERROR: SymGetModuleInfo64, GetLastError: 'A dynamic link library (DLL) initialization routine failed.' (Address: 00000252C78EAEF0)I did two things:A. Follow the below exactly within the Unity editor. I saw the same thing - with no TLS everything went as expected. With TLS I could create the game session, send messages / get 200 responses without clicking "Join Group" and get a crash immediately upon clicking "Join Group". My error log also included a similar error to the above:ERROR: SymGetModuleInfo64, GetLastError: 'A dynamic link library (DLL) initialization routine failed.' (Address: 00000208264361E0)B. Build the project in Windows and execute it outside of the Unity editor. Re-confirmed that all works as expected for the non-TLS case. Then, with my TLS fleet and NOT being within the Unity editor, I walked through all the steps again. I was able to create the game session, send messages and get 200 responses, click "Join Group" with success and then send messages again, still receiving a 200 response.The current issue, at least with the latest information and sample project provided in the repository, seems to be an issue with linking the libraries specifically within the Unity editor. Please give the above another try with a built project outside of the Unity editor to see if you see similar success.CommentSharerePost-User-8556151answered 3 years ago0Hey Michael,Thanks for giving the reproduction a try. These are interesting findings, I had assumed that if they failed within Unity that a build would likely fail as well (in my experience it's more likely to fail in builds than editor haha).So I've created builds to test to see if I would get the same results and interestingly enough an x64 Windows standalone application works perfectly with TLS and non-TLS.However, I also tried to do an x86 build and there the non-TLS worked fine. But, with the TLS it failed to even make connection to the server, but no errors.I then build for Android and got the same results as the x86 build. (I tested it on a Pixel 3 XL, which uses a x64 architecture, so not sure the actual cause there is being 32bit or not).Then I had a coworker compile an xcode project to test on iOS. There when trying to make connection to the created game session it gets an app freezing error from "Com.Gamelift.Rt.Proto.PacketReflection" with both TLS and non-TLS. I'll attach that log below since it's the only clear error among these tests.iOS_AWSRealTimeTLSTester_Xcode_Log.txt|attachment (13.3 KB)I've also updated the Github Repo with a README.md that displays all the test results in a more readable manner.Thanks for helping out on this Michael. I have a lot of faith in the Gamelift Realtime product and I'm happy to help trying to make secure connections among different platforms as well-working as possibleCommentSharerePost-User-6168330answered 3 years ago0@REDACTEDUSERHey guys, just thought I'd give you an update of my findings for today. My focus today was trying to get iOS working. I'm happy to report that I've now got iOS working with a non certification / non-tls connection.To do this I had to create a link.xml, switch the architecture to arm64, and make sure it was using Net 4.X instead of 3.5 (because Proto.Reflection doesn't support 3.5).However, that does expose what the actual problem is on iOS getting secured connection to work.The GameLiftRealtimeNative dll isn't found in ios builds. That's because the PINVOKE script in the SDK is using dynamic linking as shown below.[global::System.Runtime.InteropServices.DllImport("GameLiftRealtimeNative", EntryPoint="CSharp_GameLiftRealtimeNative_new_NativeByteArray")]  public static extern global::System.IntPtr new_NativeByteArray(int jarg1);iOS (and Xbox) however don't support dynamic linking and instead only work with static linking like below.[global::System.Runtime.InteropServices.DllImport("__Internal", EntryPoint="CSharp_GameLiftRealtimeNative_new_NativeByteArray")]  public static extern global::System.IntPtr new_NativeByteArray(int jarg1);I've attempted to perform this change myself and simply have two versions of the native plugin, one for iOS and one for other devices, but I've run into problems that aren't really within my wheelhouse and would probably be easier for the team that actually created the system and have access to the SWIG project.DllNotFoundException: Unable to load DLL 'GameLiftRealtimeNative': The specified module could not be found.  at GameLiftRealtimeNative.GameLiftRealtimeNativePINVOKE+SWIGExceptionHelper.SWIGRegisterExceptionCallbacks_GameLiftRealtimeNative (GameLiftRealtimeNative.GameLiftRealtimeNativePINVOKE+SWIGExceptionHelper+ExceptionDelegate applicationDelegate, GameLiftRealtimeNative.GameLiftRealtimeNativePINVOKE+SWIGExceptionHelper+ExceptionDelegate arithmeticDelegate, GameLiftRealtimeNative.GameLiftRealtimeNativePINVOKE+SWIGExceptionHelper+ExceptionDelegate divideByZeroDelegate, GameLiftRealtimeNative.GameLiftRealtimeNativePINVOKE+SWIGExceptionHelper+ExceptionDelegate indexOutOfRangeDelegate, GameLiftRealtimeNative.GameLiftRealtimeNativePINVOKE+SWIGExceptionHelper+ExceptionDelegate invalidCastDelegate, GameLiftRealtimeNative.GameLiftRealtimeNativePINVOKE+SWIGExceptionHelper+ExceptionDelegate invalidOperationDelegate, GameLiftRealtimeNative.GameLiftRealtimeNativePINVOKE+SWIGExceptionHelper+ExceptionDelegate ioDelegate, GameLiftRealtimeNative.GameLiftRealtimeNativePINVOKE+SWIGExceptionHelper+ExceptionDelegate nullReferenceDelegate, GameLiftRealtimeNative.GameLiftRealtimeNativePINVOKE+SWIGExceptionHelper+ExceptionDelegate outOfMemoryDelegate, GameLiftRealtimeNative.GameLiftRealtimeNativePINVOKE+SWIGExceptionHelper+ExceptionDelegate overflowDelegate, GameLiftRealtimeNative.GameLiftRealtimeNativePINVOKE+SWIGExceptionHelper+ExceptionDelegate systemExceptionDelegate) [0x00000] in <00000000000000000000000000000000>:0 iOS_TLS_Connection_ErrorLog.txt|attachment (140.2 KB)The SDK should check to see which type of linking is required and then apply it.string dll = isStatic ? "__Interval" : "GameLiftRealtimeNative";[global::System.Runtime.InteropServices.DllImport(dll, EntryPoint="CSharp_GameLiftRealtimeNative_new_NativeByteArray")]  public static extern global::System.IntPtr new_NativeByteArray(int jarg1);Then the Unity Compiler could be checked with Assembly Symbols#if Unity_IOS & !Unity_EditorAws.GameliftLiftRealtimeNative.SetStaticLinking(true);#elseAws.GameliftLiftRealtimeNative.SetStaticLinking(false);#endifI've also updated the GitHub Repo with my fixes & new test results.CommentSharerePost-User-6168330answered 3 years ago0Hi @REDACTEDUSERIf possible, can you give the following steps for linking the dynamic library on IOS a try:Build the Native DYLIB library targetting IOS specifically using XCODE instead of make.a. cd into Native Directory of the Client SDK.b. cmake -G Xcode ..c. Open XCode Project and Modify Build Settings as necessary to build for IOS.Project -> Build Settings -> Change Supported Platforms: IOSProduct -> Scheme -> Edit Scheme -> Build Configuration -> ReleaseSelect Device / Simulator to build for and build.Result should be a libGameLiftRealtimeNative.dylib file in a release folder that is built for IOS.Import the library to the IOS Project.a. After creating the ios xcode project through unity, open it up and drag and drop the .dylib file created in the previous step into the "Frameworks" folder.b. Navigate to Unity Iphone Target -> Build Phase and Verify library is present in "Link Binary With Libraries" step.c. Add step to "Copy Files" Build Phase to copy the .dylib file during build. Make sure the Destination is also "FrameWorks".Build / Run the application.After completing the steps above, the iPhone Binary successfully links with the library on my end, and I stop getting a DllNotFoundException , however another issue related to SWIG usage pops up during runtime in the form of a NotSupportedException which we are still investigating.Please let us know if  the steps above to link the Native library work for you.CommentSharerePost-User-3818694answered 3 years ago0I followed these instructions and still ended up getting the same DLLNotFoundException.DllNotFoundException: Unable to load DLL 'GameLiftRealtimeNative': The specified module could not be found.Did you do this with my repo? Did you change anything else to make that work?Just to isolate potentials, has your Native been changed since the last public update from September 2019?CommentSharerePost-User-6168330answered 3 years ago0Hi @REDACTEDUSERI did this with your repo and the RTS Client SDK from the last public update.One thing that could be different in our setups is I built for IOS Simulator since I don’t have a device to test on currently. This includes changing the Target SDK in unity to “Simulator SDK”.I'll provide some screenshots of my build setup below to help narrow down the issue:xcode project for building Native library:REMOVEDUPLOADxcode project for building the test application:REMOVEDUPLOADClient Log file: iosLogs.txt|attachment (157.0 KB)(Note the NotSupportedException instead of the DllNotFoundException)CommentSharerePost-User-3818694answered 3 years ago0Hey @REDACTEDUSERI'm unsure how big the differences between Simulator SDK and Device SDK are, but I was unable to get it working on Simulator SDK. I'll probably spend some more time on trying to get that to work tomorrow, but in general I'd like to see this working on-device over anything else.REMOVEDUPLOADdyld: Library not loaded: @REDACTEDUSER  Referenced from: /Users/andres/Library/Developer/CoreSimulator/Devices/91DD50DC-643A-474F-8078-FC9D4AE6BF59/data/Containers/Bundle/Application/4FFC17FF-5C81-4743-B197-D00F9A3354D1/TLSReproductionCase.app/TLSReproductionCase  Reason: no suitable image found.  Did find:    /Users/andres/Library/Developer/CoreSimulator/Devices/91DD50DC-643A-474F-8078-FC9D4AE6BF59/data/Containers/Bundle/Application/4FFC17FF-5C81-4743-B197-D00F9A3354D1/TLSReproductionCase.app/Frameworks/libGameLiftRealtimeNative.dylib: mach-o, but not built for iOS simulatorI looked at the iosLogs you've providedNotSupportedException: To marshal a managed method, please add an attribute named 'MonoPInvokeCallback' to the method definition. The method we're attempting to marshal is: GameLiftRealtimeNative.GameLiftRealtimeNativePINVOKE+SWIGExceptionHelper::SetPendingApplicationExceptionI checked in the PInvoke file for that method and it is indeed not setup for marshalingstatic void SetPendingApplicationException(string message) {      SWIGPendingException.Set(new global::System.ApplicationException(message, SWIGPendingException.Retrieve()));    }I looked into it, this is specifically a problem unique to IL2CPP and Unity compiling. I've found a GitHub Issue from DiscordRP where an actual Unity IL2CPP developer and community chimed in on the problem and gave a solution that worked for both IL2CPP and Mono JIT (Unity's main option for other platforms).https://github.com/discord/discord-rpc/issues/186Something like this does seem to be the fix[MonoPInvokeCallback(typeof(GameLiftRealtimeNativePINVOKE.SetPendingApplicationException))]    static void SetPendingApplicationException(string message) {      SWIGPendingException.Set(new global::System.ApplicationException(message, SWIGPendingException.Retrieve()));    }Although I'm unsure how much of the code you'll end up having to convert to support this to make it all work smoothly for IL2CPP, but according to that Unity developer in the issue discussion, it shouldn't have any affect on non-IL2CPP compiling.CommentSharerePost-User-6168330answered 3 years ago0[quote="Sky_Copeland, post:10, topic:9386"]    /Users/andres/Library/Developer/CoreSimulator/Devices/91DD50DC-643A-474F-8078-FC9D4AE6BF59/data/Containers/Bundle/Application/4FFC17FF-5C81-4743-B197-D00F9A3354D1/TLSReproductionCase.app/Frameworks/libGameLiftRealtimeNative.dylib: mach-o, but not built for iOS simulator[/quote]This error message looks to be indicating that the library is found now, but can't be used because it isn't built for IOS Simulator.  Can you make sure the build target for the native library build is the same as the build target for the unity-iphone project build. In the case of the screenshots in my post above this is the iphone 11 Prox Max simulator.Regarding the NotSupportedException issue, it does look to be an issue with il2cpp / AOT compilation. More specifially, I believe it is related to SWIG not supporting AOT (il2cpp).See issue: https://github.com/swig/swig/issues/1165Still investigating possible solutions on GameLift end.CommentSharerePost-User-3818694answered 3 years ago0This error message looks to be indicating that the library is found now, but can’t be used because it isn’t built for IOS Simulator. Can you make sure the build target for the native library build is the same as the build target for the unity-iphone project build. In the case of the screenshots in my post above this is the iphone 11 Prox Max simulator.REMOVEDUPLOADREMOVEDUPLOADI'm pretty sure I've built them as you have, although I could totally be missing something here on the xcode side... it's really not my area haha.Regarding the  NotSupportedException  issue, it does look to be an issue with il2cpp / AOT compilation. More specifially, I believe it is related to SWIG not supporting AOT (il2cpp).See issue: https://github.com/swig/swig/issues/1165https://github.com/swig/swig/pull/1262It does seem like this pull request would fix the problem of SWIG not supporting AOT? Although it also looks like swig is blocking it's request for not meeting their standards of documentation...Perhaps simply building that pull request could be a potential solution? If it's not already on the list haha.CommentSharerePost-User-6168330answered 3 years ago0Hey it's been about a week, has there been any progress or updates? Just checking in.CommentSharerePost-User-6168330answered 3 years ago0Has there been any further progress with iOS IL2CPP support?CommentSharerePost-User-8657977answered 2 years ago0I'm also facing the DllNotFoundException: Unable to load DLL issue, trying to get DTLS to work on iOS. I've followed to steps in the Readme to create GameLiftRealtimeNative.framework and have embedded it into my Unity game's xcode project. Also if somebody has a link to a built binary that works for them on iOS that they can share, it could help reduce some possible points of failure.@REDACTEDUSERCommentSharerePost-User-7390418answered a year ago0Interestingly, you could just use my built libraries from the github linked at the top (we keep that up to date in-studio as our test harness for GameLift builds). I'd also recommend copying the meta files if you would like their compilation targets to be setup for you as well.As for your second question, it's not really a discrepancy. iOS and macOS don't use identical systems and these two different types of libraries are required for their respective platforms. However, I've never been able to get a dylib file built that works for macOS unfortunately.CommentSharerePost-User-6168330answered a year ago0@REDACTEDUSERAccording to your repo you managed to get iOS working with TLS, did you manage to get past that somehow? If not, is my understanding correct that unsecured TCP communication aren't allowed on iOS AppStore apps, making GameLift Realtime currently not usable for iOS?CommentSharerePost-User-7390418answered a year ago0Oh and regarding the dylib that works for macOS, the instructions on the Readme file (the straightforward cmake calls) did the trick for me when I built them from my M1 Macbook. According to the warning that gets thrown from Unity, looks like your macOS libs are built for 'MacCatalyst' instead of for 'macOS' for some reason. If you want I can share my library binary or give any info on the process I've used if you want.CommentSharerePost-User-7390418answered a year ago0Hm yea that's one I've seen before... but I forgot what fixes it... maybe it was the link.xml file having all the required assemblies listed? IL2CPP might be stripping Google.Protobuf.As for TLS, yea on iOS (and Android) our studio app will ship with Secured connections only to satisfy the Apple iOS requirement.CommentSharerePost-User-6168330answered a year ago"


Question: How to access URL params in the redirected URL

"Hi guys,I've a question/s. Imagine we launch the Cognito Hosted UI and we login ourselves, then Cognito redirect us to a redirect URL with the tokens (or code if we use Authorization Code Grant Flow), and here, how can we recover these params (for example the id and access token) from the redirected URL?, maybe through the response headers (as I see when I debug in Chrome) through the location object ? or directly through Javascript ?I've interested in recover these params from the redirected URL through Javascript and through React, can you help me ?, thanks in advance !!Have a nice day ahead.FollowComment"

Answer: "1Hello,I use a very Javascript line, but this is just for testing.const code window.location.href.split("=").pop()To find a good implementation, I think checking the Amplify JS repository help HERE. More specifically, clone the code and read this two files Auth.ts and OAuth.tsprivate async _handleCodeFlow(currentUrl: string) {/* Convert URL into an object with parameters as keys    { redirect_uri: 'http://localhost:3000/', response_type: 'code', ...} */const { code } = (parse(currentUrl).query || '').split('&').map(pairings => pairings.split('=')).reduce((accum, [k, v]) => ({ ...accum, [k]: v }), { code: undefined });const currentUrlPathname = parse(currentUrl).pathname || '/';const redirectSignInPathname =parse(this._config.redirectSignIn).pathname || '/';if (!code || currentUrlPathname !== redirectSignInPathname) {return;}const oAuthTokenEndpoint ='https://' + this._config.domain + '/oauth2/token';dispatchAuthEvent('codeFlow',{},`Retrieving tokens from ${oAuthTokenEndpoint}`);const client_id = isCognitoHostedOpts(this._config)? this._cognitoClientId: this._config.clientID;const redirect_uri = isCognitoHostedOpts(this._config)? this._config.redirectSignIn: this._config.redirectUri;const code_verifier = oAuthStorage.getPKCE();const oAuthTokenBody = {grant_type: 'authorization_code',code,client_id,redirect_uri,...(code_verifier ? { code_verifier } : {}),};logger.debug(`Calling token endpoint: ${oAuthTokenEndpoint} with`,oAuthTokenBody);const body = Object.entries(oAuthTokenBody).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join('&');const { access_token, refresh_token, id_token, error } = await ((await fetch(oAuthTokenEndpoint, {method: 'POST',headers: {'Content-Type': 'application/x-www-form-urlencoded',},body,})) as any).json();if (error) {throw new Error(error);}return {accessToken: access_token,refreshToken: refresh_token,idToken: id_token,};}CommentSharehaianswered 5 months ago1Hi guys,I just found this code at Internet that maybe has a possible solution:const getIdToken = () => {const modifiedUrl = window.location.href.replace("#", "?")const url = new URL(modifiedUrl)return url.searchParams.get("id_token")}const idToken = getIdToken()How do you think about, at least it's possible approach with Javascript !CommentShareAWS-User-3108276answered 5 months ago1Hello,Thank you for reaching out to AWS Support. I am Arpit from Deployment Team, and I have taken the ownership of the case forward.I understand that you would like to access parameters from the redirected URL.Looking into this, I found one stack overflow article regarding accessing the URL parameters.https://stackoverflow.com/questions/63650885/how-to-get-query-data-from-redirected-urlCan you please look into this, and check if the above fulfills your use-case.Further, since code support is out of AWS Premium Support, and due to limited expertise with Javascript, we can assist you on best effort basis.Hoping that the above helps.CommentShareSUPPORT ENGINEERAWS-User-arpitanswered 5 months ago0Hi hai,Thanks for your reply. The code above it's interesting, but as I see, we need to pass the URL to the _handleCodeFlow method, but what I mean is how to recover the URL from the redirection, as you told with a inline example with Javascript, maybe this would be a soluction for my problem, anyway I've searching a few solutions, and I found some examples, but I'm not sure. One example would be recover the URL from the fetch petition to the Hosted UI in the response object, I've seen that this request obtain a response and in the response there is an object called "location" with the complet URL inside, but I'll not check yet. Any other sugestion will be welcome. Have your more ideas ? thanks in advance !Have a nice day ahead.CommentShareAWS-User-3108276answered 5 months ago0Hi guys,Thanks a lot for your help. I've checked the stackoverflow URL and it's more interesting. Now I'm wondering if when the hoster UI of Cognito redirects to the URL configured as redirect URL, maybe can we access to the response object of the corresponding request ? although of the redirection ?, I suppose when the redirect occurs we should have access to this object. What do you think about !Thanks and have a nice day ahead.CommentShareAWS-User-3108276answered 5 months ago"


Question: About the flow restriction of multiple APIs associated with an usage plan

"Please tell me about the behavior of the request flow restriction set in the usage plan.When multiple APIs are associated with one usage plan, which of the following behaviors does the flow restriction set in the usage plan have?①: The flow rate is restricted for each API. (When requesting multiple APIs, even if one API causes an excessive request error, the other API does not cause an excessive request error.)②: The flow rate is restricted for the total number of requests to each API. (When requesting multiple APIs, if one API causes an excessive request error, the other API will also cause an excessive request error.)FollowComment"

Answer: "0Accepted AnswerHello:The usage plan limit is applied per API key and is global to all APIs that have that plan associated, so #2 in your posted scenarios. If you want to assert different limits per API, you would associate different usage plans per API and/or set method level throttling inside the plan. Though note that if you set method level throttling inside the plan, that doesn't change the fact that the overall usage plan limit is still global to that key.Regards,BobCommentShareEXPERTAWS-User-0395676answered 3 years ago"


Question: opensearch _explain output blank (ElasticSearch)

"I'm trying to work with cloudwatch log data in opensearch. While building some dashboards, I'm querying by "@log_stream". My log streams vary slightly, like "productName_filterlog" and "productName_messagelog". However, my query for one "@log_stream" yields results with many different log streams mixed in. I'm doing a term search with explain enabled in hopes of getting some reasoning for this:RequestPOST myindex/_search?explain=true{   "query":{    "term": {      "@log_stream": "productName_filterlog"    }  }}Response..."hits": [   {      ...,       "_explanation" : {          "value" : 1.0,          "description" : "*:*",          "details" : [ ]        }   }]My question : what does this _explanation object mean? Why is it so useless? Is there a better way to determine why some unwanted results are showing up? I'm assuming the reason is due to some analyzer shenanigans, but how would one determine this?thanks!FollowComment"


Question: Failure to Grant Permissions to Create & Manage Access Keys on AWS console

"I wanted to allow a general user to create and manage access key on AWS console. To grant those permissions to that user, I created 2 IAM  policies below referring to https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html .{"Version": "2012-10-17","Statement": [{"Sid": "CreateOwnAccessKeys","Effect": "Allow","Action": ["iam:CreateAccessKey","iam:GetUser","iam:ListAccessKeys"],"Resource": "arn:aws:iam::*:user/${aws:username}"}]}{"Version": "2012-10-17","Statement": [{"Sid": "ManageOwnAccessKeys","Effect": "Allow","Action": ["iam:CreateAccessKey","iam:DeleteAccessKey","iam:GetAccessKeyLastUsed","iam:GetUser","iam:ListAccessKeys","iam:UpdateAccessKey"],"Resource": "arn:aws:iam::*:user/${aws:username}"}]}With the 2 IAM policies, still, that user could not create and manage access key on AWS console and found error messages as follows.User: arn:aws:iam::711268734740:user/testuser is not authorized to perform: iam:ListAccessKeys on resource: user testuser with an explicit deny in an identity-based policyHow do I grant permissions to that user to create and manage own access keys?FollowComment"

Answer: "0Accepted AnswerExplicitly created deny statements take precedence over any allow rules for same action. Are you creating a statement such as "Action: iam:*, Effect: Deny" other than the two policies? The error message indicates that there is an explicit deny rule for "iam:ListAccessKeys".CommentShareimikyanswered 4 months agoAWS-User-5497833 4 months agoYou are right. Those two policies have conflict with the policy allowing IAM users to self-manage their multi-factor authentication device(https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam_mfa-selfmanage.html). Thanks for your help!Share"


Question: Cloudformation - DMS Replication task

"Cloudformation DMS replication task, TableMappings: , doesn't take json. Error Invalid JSON but I have checked in JSON checker, JSON is valid.Please let me know if there is any way to provided JSON file has input.sample JSON File.{    "rules": [        {            "rule-type": "selection",            "rule-id": "528656830",            "rule-name": "528624433",            "object-locator": {                "schema-name": "APPLSYS",                "table-name": "FND_CURRENCIES"            },            "rule-action": "include",            "filters": []        }    ]}FollowComment"

Answer: "1Hi,The property TableMappings of the resource AWS::DMS::ReplicationTask accepts a single String:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dms-replicationtask.html#aws-resource-dms-replicationtask-propertiesAs the double quote (") is a String delimiter in the CloudFormation YAML Syntax you need to escape the double quotes of your JSON string, as shown in the example:AWSTemplateFormatVersion: 2010-09-09Resources:   myReplicationTask:     Properties:       MigrationType: full-load      ReplicationInstanceArn: ReplicationInstance      SourceEndpointArn: SourceEndpoint      TableMappings: "{ \"rules\": [ { \"rule-type\": \"selection\", \"rule-id\": \"1\", \"rule-name\": \"1\", \"object-locator\": { \"schema-name\": \"%\", \"table-name\": \"%\" }, \"rule-action\": \"include\" } ] }"      TargetEndpointArn: TargetEndpoint    Type: "AWS::DMS::ReplicationTask"source: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dms-replicationtask.html#aws-resource-dms-replicationtask--examplesCommentShareEXPERTAndreas Seemuelleranswered a year agoSumitJaiswal a year agoThanks, actually I got the solution before your reply. JSON was correctly formatted, it wasn't taking it as string, hence JSON had to be within single quote.TableMappings: '{"rules": [{"rule-type": "selection","rule-id": "528656830","rule-name": "528624433","object-locator": {"schema-name": "APPLSYS","table-name": "FND_CURRENCIES"},"rule-action": "include","filters": []}}]}'Share"


Question: NVMe/TCP modules in Amazon linux 2

"Hi, do we have any reasons for not enabling the NVMe/TCP modules as part of amazon linux 2? As NVMe over TCP is already available in the latest linux kernels,  i have explored on one the amz linux instance which had 5.15 kernel. but i dont see the modules enabled. Am i missing any here or there is a way to get this enabled?kernel => 5.15.29-16.111.amzn2022.x86_64CONFIG_NVME_MULTIPATH is not setCONFIG_NVME_RDMA is not setCONFIG_NVME_FC is not setCONFIG_NVME_TCP is not setCONFIG_NVME_TARGET is not setend of NVME SupportFollowComment"

Answer: "0Hi Inbaraj , I understand that you have explored on one of amazon linux instance which had a 5.15 kernel but you are not able to see the modules that are enabled.Please correct me if I misunderstood.Amazon Linux 2 does not have NVMe_TCP modules yet.I would recommend you submit a ticket with amazon Premium Support on this link[1] concerning enabling these modules as well as submitting a feature request for the modules to be included and enabled by default in the future releases of Amazon Linux 2I would also advise you to keep an eye on what’s new for future releases on this link [2]Reference[1]https://us-east-1.console.aws.amazon.com/support/home/?nc2=h_ql_cu&region=us-east-1#/[2]https://aws.amazon.com/new/?whats-new-content-all.sort-by=item.additionalFields.post[…]ll&awsf.whats-new-serverless=*all&awsf.whats-new-storage=*allCommentShareKaraboanswered a year ago"


Question: Creating Amplify App with domain in private zone

"I'm trying to create an Amplify App using a Route53 private zone which is a subdomain of a public zone, example:Public Zone: example.comPrivate Zone: test.example.comWhen I'm creating the domain association via the Amplify Console GUI it gives me both options "example.com" and "test.example.com" in the "Root Domain" selection. When I select "test.example.com" however, Amplify Console creates the Route53 entries in the public zone rather than in the private zone.Is there anyway I can force Amplify Console to create the Route53 entries in my private zone?Let me know if I need to provide any additional information to help troubleshoot,ThanksFollowComment"

Answer: "0We don't differentiate public zone and private zone. But if you want, you can manually move the record from public zone to private zone.CommentShareAWS-User-0568200answered 4 years ago0Thanks for the response Gary,I'm noticing that this doesn't seem to be an issue of public vs private but rather the Amplify Console is not setting up my domain in the correct zone at all.I've setup a new scenario similar to the following:Public Zone 1: example.comPublic Zone 2: test.example.comWhen I set up the "Root Domain" for my application I choose the "test.example.com" zone but whenever I setup new domains via the "Domain Management" screen Amplify Console creates them in the example.com zone.This seems like a bug to me and your it being private vs public doesn't seem relevant.Can you confirm whether this is expected behaviour or if it's a bug that can be addressed?ThanksEdited by: nlaffey on Feb 25, 2019 2:28 PMEdited by: nlaffey on Feb 26, 2019 6:34 AMCommentSharenlaffeyanswered 4 years ago0Hi nlaffey,Thanks for the question.Currently, this is expected behaviour, you can always manual move the DNS records that displayed in the Amplify Console to the desired hostedzone. But I agree with you, this is inconvenient, the team will take look into this issue and find a solution for it.Best,ShufanawsCommentShareAWS-User-4109112answered 4 years ago0Got it, thanks for the follow up.CommentSharenlaffeyanswered 4 years ago"


Question: AWS Config Resource Not Found Viewing Details

"Hello,I've created a AWS Config Rule via serverless to manage IAM roles.  The rule fires correctly, but when I go to view the rule details, I get a message that the resource was not found.  A possible reason given is that it doesn't have permissions.  Is there a way to add permissions to the config rule to view the details?  I tried attaching a managed policy that has all of the aws config permissions to the lambda role created in the stack, but that doesn't work either.  Any help would be appreciated.FollowComment"

Answer: 0Issue was I was using the RoleName in the PutEvaluations instead of the RoleIdCommentShareronbernaanswered 3 years ago


Question: AWS Transfer Family -SFTP Gateway : Is SSE-C for S3 supported?

"Hi,Is SFTP gateway supports SSE-C (server-side encryption with customer key)?Thanks,Srikar.FollowComment"

Answer: "0Hello,Yes, SFTP will choose whatever the default encryption is for the bucket. It can be used for SFTP with S3 as the backend storage.You need to add the usual KMS permissions to the Transfer IAM role used to access the S3 bucket with KMS-CMK.https://docs.aws.amazon.com/transfer/latest/userguide/encryption-at-rest.htmlhttps://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.htmlCommentShareSUPPORT ENGINEERAjinkya B-AWSanswered a year ago"


Question: How to change the greengrass v2 config on a core device

"Hi there I have a problem with the iot  permision on my device which already have gg installed and runningso when i run the gg installer I put GGTokenAccessRole for "iotRoleAlias" instead of the actual name2022-03-18T05:43:45.295Z [ERROR] (pool-2-thread-5) com.aws.greengrass.tes.CredentialRequestHandler: TES responded with status code: 403. Caching response. {"message":"Access Denied"}. {iotCredentialsPath=/role-aliases/GGTokenAccessRole/credentials}2022-03-18T05:43:45.296Z [ERROR] (pool-2-thread-5) com.aws.greengrass.tes.CredentialRequestHandler: Error in retrieving AwsCredentials from TES. {iotCredentialsPath=/role-aliases/GGTokenAccessRole/credentials, credentialData=TES responded with status code: 403. Caching response. {"message":"Access Denied"}}2022-03-18T05:44:27.897Z [ERROR] (pool-2-thread-5) com.aws.greengrass.tes.CredentialRequestHandler: Error in retrieving AwsCredentials from TES. {iotCredentialsPath=/role-aliases/GGTokenAccessRole/credentials, credentialData=TES responded with status code: 403. Caching response. {"message":"Access Denied"}}2022-03-18T05:45:22.119Z [ERROR] (pool-2-thread-5) com.aws.greengrass.tes.CredentialRequestHandler: Error in retrieving AwsCredentials from TES. {iotCredentialsPath=/role-aliases/GGTokenAccessRole/credentials, credentialData=TES responded with status code: 403. Caching response. {"message":"Access Denied"}}Also i did not create iot aliase so i wonder if that is a problem? can it use a IAMF role directly ?Thanks for your helpFollowComment"

Answer: "1Accepted AnswerYou can not use an IAM role directly.  You can either create a role alias with the name you’ve already given to greengrass, or you can do a deployment that specifies the nucleus component and deploys configuration to merge an update for iotRoleAlias with a new name.Here is some documentation that might be useful:https://docs.aws.amazon.com/greengrass/v2/developerguide/update-component-configurations.html#:~:text=%22reset%22%3A%20%5B%22%22%5D-,Merge%20updates,-Merge%20updates%20definehttps://docs.aws.amazon.com/greengrass/v2/developerguide/greengrass-nucleus-component.html#:~:text=Greengrass%20Core%20software.-,iotRoleAlias,-The%20AWS%20IoTCheers,JaniceCommentShareJanice-AWSanswered a year ago"


Question: YAML_FILE_ERROR: mapping values are not allowed in this context at line 1

"DOWNLOAD_SOURCE - YAML_FILE_ERROR: mapping values are not allowed in this context at line 1Reference YAML file:buildspec.yamlversion: 0.2phases:  pre_build:    commands:      - echo Logging in to Amazon ECR...      - $(aws ecr get-login --no-include-email --region $AWS_DEFAULT_REGION)  build:    commands:      - echo Build started on date     - echo Building the Docker image...      - docker build -t  web:1 .      - docker tag web:1 020861552741.dkr.ecr.ap-southeast-1.amazonaws.com/hasib_cloud  post_build:    commands:      - echo Build completed ondate`- echo Pushing the Docker image...- docker push 020861552741.dkr.ecr.ap-southeast-1.amazonaws.com/hasib_cloud~FollowCommentChris Pollard 9 months agoWould you re-sharing your YAML and use ``` for the code block instead of `? There's an issue with your YAML, but it's hard to provide guidance with the current formatting.Share"


Question: Android tests won't start. No error message

"hi,I created a new valid test with the and android app. It took almost half an hour and the tests didn't start https://us-west-2.console.aws.amazon.com/devicefarm/home?#/projects/5ce87200-3348-43cd-bcc5-98aa249d23ac/runs/2d5c71cc-98b6-450f-ab31-e3abc4bb0319 or https://us-west-2.console.aws.amazon.com/devicefarm/home?#/projects/5ce87200-3348-43cd-bcc5-98aa249d23ac/runs/cc72a4b1-29d0-499c-ba08-28d87adf3ddcThere is no error message, can you have a look?Thank you,AnastasiaFollowComment"

Answer: "0Hi:Thank you for reaching out; sorry for the inconvenience you are having. I was able to look into the logs. From the console, you can download your test run artifacts to take a closer look at the errors. From the logs, the error I am observing is:org.openqa.selenium.NoSuchElementException: Can't locate an element by this strategy: By.id: <ID>The Appium server is starting successfully on the device, which implies that the search method for UI elements on the Android screen is not executing as expected in the test. I suggest reading this post (https://sqa.stackexchange.com/questions/20186/unable-to-locate-element-throwing-a-org-openqa-selenium-nosuchelementexception-i) to mitigate. Some key highlights:Assert with text or element to ensure you are on expected page/screenI will suggest to use wait.untill(element.isVisible()) before Click() /Assert()Have I provided a wrong value for searching the element?Please let me know if you have any further questions; thanks.AndyCommentShareAWS-User-2897699answered 3 years ago"


Question: How to avoid multiple “Completed” events from SageMaker batch transform job

"I’m launching a SageMaker batch transform job from the AWS Batch service on a set of images that have been extracted from a video file as input to the Batch job. I have a CloudWatch Event rule that listens to SageMaker “TransformJobStatus” events for the “Completed” state and will trigger a lambda function that will call another AWS Batch job.The problem is that I’m getting two “Completed” events from the same SageMaker transform job. To investigate this issue, I created a lambda function which listens to all "SageMaker Transform Job State Change” events and I’m seeing a bunch of “In Progress” events followed by two “Completed” events.My questions are:Are two “Completed” events expected behavior for SageMaker Batch Transform jobs?Is there a possibility that I may have inadvertently registered two TransformJobStatus “listeners” on the same job?Is there a way to consume the first event (mark as handled) thereby to suppress the second “Completed” transform job event?Is there a better way to post process the S3 results of the transform job than listening to a CloudWatch event and invoking a lambda?This is my code in the script called from the AWS Batch pre-processing jobresponse = sagemaker_client.create_transform_job(            TransformJobName=transform_name,            ModelName=model_name,            TransformInput={                "CompressionType": "None",                "ContentType": "image/jpeg",                "DataSource": {                    "S3DataSource": {                        "S3DataType": "S3Prefix",                        "S3Uri": s3_frame_directory_path                    }                },                "SplitType": "None"            },            TransformOutput={                "AssembleWith": "None",                "KmsKeyId": "",                "S3OutputPath": s3_predictions_directory_path            },            TransformResources={                "InstanceCount": 1,                "InstanceType": "ml.p2.xlarge"            },            Tags=[                {                    "Key": "tnc_transform",                    "Value": "yes"                },                {                    "Key": "extra_commands",                    "Value": extra_commands                },                {                    "Key": "training_job_name",                    "Value": self.training_job_name                },                {                    "Key": "s3_video_path",                    "Value": self.s3_video_path                },                {                    "Key": "s3_output_directory",                    "Value": self.s3_output_directory                },                {                    "Key": "label_base64_json",                    "Value": self.label_base64_json                }            ]This is my rule for the CloudWatch event pattern that will trigger the lambda function.{  "detail-type": [    "SageMaker Transform Job State Change"  ],  "source": [    "aws.sagemaker"  ],  "detail": {    "TransformJobStatus": [      "Completed"    ]  }}I’m a senior developer but new to AWS and SageMaker. I’ve inherited the code from another team and from what I understand it was written correctly and it (mostly) works. I just want to prevent the second post processing job from occurring. I’ve been investigating this issue for a couple of days and I’m not sure how to proceed at this point. Any help would be appreciated.Thanks!FollowComment"

Answer: "1I just want to follow up on this issue since it’s been resolved and others could benefit from my knowledge. I filed a support case with AWS with our Developer account and had a productive dialog with an AWS support engineer which led to a resolution to this issue.First of all, AWS support verified that two “Completed” events are delivered at the completion of a batch transform job. Support mentioned that most of the fields in the two payloads are identical but he identified that one of the events have an empty (“”) value for the “ModelName” field. The other event has the correct name of the model used for inference. With this information he suggested that I change the event matching pattern to filter out one of the events.I used the "anything-but" rule matching statement as described in the EventBridge user guide to exclude the ModelName field with an empty value: https://docs.aws.amazon.com/eventbridge/latest/userguide/content-filtering-with-event-patterns.htmlThe following event pattern will match only the "Completed" SageMaker batch transform event that has a non-empty value for “ModelName”. In other words, it would exclude the "Completed" event that has an empty value for the ModelName field so only one event would trigger the lambda function:{  "detail-type": [    "SageMaker Transform Job State Change"  ],  "source": [    "aws.sagemaker"  ],  "detail": {    "TransformJobStatus": [      "Completed"    ],    "ModelName": [      {        "anything-but": ""      }    ]  }}As a result of this change, only one post processing job would be invoked - which was the intention.The support engineer recognized that there wasn't a rational justification for sending two "Completed" events for a SageMaker Batch Transform job. He is engaging the SageMaker team for further investigation.CommentSharemrtoadscanswered 3 years ago"


Question: upload jpeg to lambda

"Help!I am uploading an image to lambda and in the body it appears like so (and isBase64 is false):2022-01-27T08:11:41.076Za3fefd6b-fbbd-4d1a-afe1-2459ae090b45INFO------WebKitFormBoundarygRtIycxMFrNqXD9CContent-Disposition: form-data; name="files"; filename="playing.jpg"Content-Type: image/jpeg����JFIF��C $.' ",#(7),01444'9=82<.342��CNow, the documentation is really not too clear to me when it says:"To handle binary payloads for AWS Lambda proxy integrations, you must base64-encode your function's response. " (https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-payload-encodings.html). I've tried converting the image below to  base64 to no avail. I am not even sure what is this encoding...???This is what i tried (nodejs 14):Buffer.from(file.buffer, 'binary').toString('base64'),The image won't turn up though. Any thoughts?the first 3 bytes are00000000: 11101111 10111111 10111101 11101111 10111111 10111101 or  0xef 0xbf 0xbd...Any thoughts?FollowComment"

Answer: "0I had a similar problem, you may need to set BinaryMediaTypesIf you are using SAM, add the following settings to your template file :Globals:  Api:    BinaryMediaTypes:      - image/png      - image/jpg      - image/jpeg``Or try adding the same in  API Gateway > Settings > Binary Media TypesCommentShareAWS-User-7048989answered a year agoLordVee a year agohi thanks for your answer. I have set it already and i can see data coming in, problem is i don't know what format is data coming as, therefore cannot parse it properlyShare-1You can not use Lambda code to upload the photo.You need to use different integration for this.  Please see https://www.youtube.com/watch?v=Q_2CIivxVVsYou probably need to create the REST API with PUT method with 2 dynamic parameter.1- Bucket parameter2- Image parameterJust call that API with these 2 parameter and it will then upload your image to that S3 bucket.  This video will show all the steps with demo.CommentShareMaulik_Makadiyaanswered a year agoLordVee a year agos3 is not an option. the lambda function mounts an efs filesystem where data should be loaded. the file gets saved onto the fs but in the wrong format. I don't see why i cannot do this.Share"


Question: "adding a schedule to your auto scaling group to run Monday-Friday, 8am to 5pm"

"hi Guys,So, I was tasked with adding a schedule to the auto scaling group to run Monday-Friday, 8am to 5pm only.  So my schedule look like this:Apparently, the schedule is not working as it should and I can't find what is wrong.  Can anyone identify what is wrong with this configuration.  So the EC2 should only run between hours of 8am to 5pm MON-FRI.Thank you.FollowCommentBrettski-AWS EXPERT7 months agoCould you expand on "not working as it should" - is there an error message? Is it running at the wrong times?Share"

Answer: "2The schedule as shown in the screenshot would ensure that the min, max and desired is 1 whenever the scheduled action is run but does not mean it's set to 0 for the non-scheduled time. If you want the EC2 instance to run only between 8-5 on weekdays, you need to schedule two jobsOne to run at 8 am with the min, max and desired to 1 (cron - 0 8 * * 1-5).Another one at 5 pm with min, max and desired to 0 (cron - 0 17 * * 1-5)Since min & max are 1 you don't need to run it hourlyCommentShareSydanswered 7 months ago0Thank you for the answer, makes sense, just thought you could do it with one schedule but I'm still learning.  Now, when I went to create the shutdown schedule, it complains of the following: Provide at least one value for Desired, Min, or Max Capacity Do you know why?Thanks again.CommentSharexender2022answered 7 months agoShahad_C 7 months agoThat's an info bubble that's always there (you can see it in your first screenshot as well).  It should allow you to create the scheduled action as-is.  One thing though, "Start Time" is the "next time" the action will invoke.  So as is it'll trigger at midnight the first time (every time it runs, it adjusts the 'start time' to be the next occurrence of the Cron).  So you want to make sure the "Star Time" value matches with your Cron scheduleShare"


Question: The Instance inability to reach the internet

Why is my website www.somafour.com still down?I just got a message that SSL/TLS certificate has been renewed and that includes the primary domain www.somafour.com.ThanksFollowComment

Answer: "0I was able to visit your website, but it is not secure.  I had used the curl command and the reply is at below:$ curl -L -i http://www.somafour.comHTTP/1.1 302 FoundDate: Sun, 30 Apr 2023 22:40:00 GMTServer: ApacheLocation: https://www.somafour.com/Content-Length: 209Content-Type: text/html; charset=iso-8859-1curl: (60) SSL certificate problem: certificate has expiredMore details here: https://curl.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentioned above.CommentSharerePost-User-7136343answered a month agorePost-User-7118255 a month agoThe issue is that we are unable to renew the cert as it keeps failing.A simple curl to Google.com even fails on the light sail instance.Kindly assist on how we can connect to the internet from the instance.Please see images of error below-SharerePost-User-7136343 a month agoYou have two versions of problems. First your message which indicated that your SSL/TLS got renewed. Second "The issue is that we are unable to renew the cert as it keeps failing.Honestly I got bugs after I had visited your site which was alerted by my gmail.com in relation to repost of AWS. Please check your firewall, stop the instance and restart as well as check your security groups.Share0As can be seen from the attached screenshots, the website deployed (WordPress) is up and running.It uses the free let's encrypt tool.However, in our attempt to renew the certificate, we get the error message (see attached).It is deployed on LightSailKindly assist.CommentSharerePost-User-7118255answered a month ago0The current certificate used by your web site expired on Feb 18, 2023.# openssl s_client -connect www.somafour.com:443 -prexit                                          CONNECTED(00000003)depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1verify return:1depth=1 C = US, O = Let's Encrypt, CN = R3verify return:1depth=0 CN = somafour.comverify error:num=10:certificate has expirednotAfter=Feb 18 09:42:50 2023 GMTverify return:1depth=0 CN = somafour.comnotAfter=Feb 18 09:42:50 2023 GMTverify return:1---Certificate chain 0 s:/CN=somafour.com   i:/C=US/O=Let's Encrypt/CN=R3 1 s:/C=US/O=Let's Encrypt/CN=R3   i:/C=US/O=Internet Security Research Group/CN=ISRG Root X1 2 s:/C=US/O=Internet Security Research Group/CN=ISRG Root X1   i:/O=Digital Signature Trust Co./CN=DST Root CA X3If you have renew the certificate, you will need to install this new certificate on your web server.CommentShareEXPERTkentradanswered a month ago"


Question: The instance family 'mac2' is not supported.

"region: us-east-2I'm following this blog: https://aws.amazon.com/cn/blogs/aws/use-amazon-ec2-m1-mac-instances-to-build-test-macos-ios-ipados-tvos-and-watchos-apps/but got such an error: The instance family 'mac2' is not supported.Any suggestions are welcome, thanks!FollowComment"

Answer: "0Mac instances can run one of the following operating systems:-macOS Mojave (version 10.14) (x86 Mac Instances only)macOS Catalina (version 10.15) (x86 Mac Instances only)macOS Big Sur (version 11)macOS Monterey (version 12)The mac2.metal instances are powered by M1 Apple Silicon processors.8 vCPU, 16 GiB RAM, 16 core Apple Neural Engine | 10 Gbps Network and 8 Gbps EBS bandwidthThe Instance must be placed onto a Dedicated Host because these are physical Apple Mac minis.mac2.metal is not supported by Host Resource Groups. Therefore you cannot use mac2.metal Instances in Auto Scaling Groups.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-mac-instances.htmlPLease check the above considerations to find the cause of your issue.CommentShareShashankanswered 3 months ago"


Question: Access GGv2 config files with lambda function

"Hi all,I have a lambda function that is running in no container mode deployed as a component to the core device. I am trying to utilise the config file located at /greengrass/v2/config to be able to know configuration details such as iot endpoint, cert files and thing name. However, this config file is restricted to a permission set of 700, and thus my lambda function cannot access it. I have tried manually changing the config folder to a permission set of 777 which works, but on reboot it resets the permission. Utilising a start up script does not work due to timing of the services. I would like to automate this process. Is there any way to access these config files given the permission issue?FollowComment"

Answer: "0Accepted AnswerHi nachoman,Config files like /greengrass/v2/config are not intended to be read or modified by any components. There are ways in which information from those that makes sense to be accessed securely by components is exposed.You can utilize IPC in your component to read configuration of other components. In this case, you can get the endpoint information from the aws.greengrass.Nucleus component.Documentation for reading configuration using IPC - https://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-component-configuration.html#ipc-operation-getconfigurationDocumentation for the Nucleus component - https://docs.aws.amazon.com/greengrass/v2/developerguide/greengrass-nucleus-component.html#greengrass-nucleus-component-configurationYou can access the thing name in your component in the form of an environment variable called AWS_IOT_THING_NAME which is always set for all component processesCertificate paths - This is not available for components to read based on security considerations, can you explain your use case for accessing it in your component so we can think about if you really require that information and alternate ways to solve for your use caseCommentShareshagupta-awsanswered 2 years ago0Thanks,That has helped me a lot thanks. In regards to the cert paths, these can be hard coded to /greengrass/v2/... as they should be consistent across installations, I was just trying to make a solution that was future proofed if certs paths were to change.CommentSharenachomananswered 2 years ago"


Question: Can't receive OTP SMS in Saudi Arabia

"I have set up the SMS service to send OTP for users to verify their phone numbers while signing up for my website which is Saudi Arabia based, the problem is I can't receive SMS in Saudi Arabia but other countries work fine, here is the service description I am usingService: SNS Text MessagingRegion: No region specifiedResource Type: Dedicated SMS Short CodesLimit name: TransactionalSMS format : Your OTP for "Name" is 1234FollowComment"


Question: Is there a way to extend VoiceMail recordings expiration date?

"Together with my team we implemented VoiceMail feature with Amazon Connect, it works perfectly. The one thing is that client has requested VoiceMail recording to be available in the Salesforce org for two weeks before it expired. I couldn't find the solution neather in Salesforce nor in AWS documentations. Is it possible? Thanks for the answer!FollowCommentdmacias 5 months agoWhat is triggering the expiration? I'm not familiar with a VM solution with SFDC, so maybe start with talking about how you've accomplished this. I assume that the file is stored in S3 which would give you a lot of freedom or maybe the reference is stored in Dynamo and that is being overwritten.davidShare"

Answer: "0The way Amazon Connect voicemail works in its expiration is the S3 presign URL which has a maximum of 7 days.  The code has been fix to let you configure this, please read through the issue in githubhttps://github.com/amazon-connect/voicemail-for-amazon-connect/issues/10But your need is 2 weeks, the wav is there but the URL is invalid.  So to do this, you will need to custom build some logic to immediately pull the wav file (S3 trigger), into SF.  And have an expiration set using SF logic to remove the file.  But please check if this will be compliant as the content is now being copied.Other ways could be add additional code to generate another presign URL after 7 days for another 7 days, update the record in SF.  You can potentially add this using a wait in Step FunctionCommentShareClarenceChoianswered 5 months ago0If you need to be able to get access to the recording past the 7 days (which is a max for the presigned URL itself, not the recording), you will have to change the way you access the recording.Instead of using the code provided with the voicemail solution, you can create a web proxy layer that creates the pre-signed URL on demand. So your email/SMS will have a link to this web proxy (that contains some identifier allowing the code to retrieve the right S3 object for the recording). When invoked, this proxy (web app) generates a pre-signed URL and allows you to access the recording this way. Because the presigned URL will be accessed within seconds, you can set a very short expiration time (30 sec) on it, and you will always have access to the recording, because the presigned URL is generated every time you click on that proxy link. You can then set the retention period for your voicemail recordings to expire as part of your S3 lifecycle.The proxy will also allow you to implement permission based access to recordings, so not everyone that has a link can listen to the recording.I hope this helps.CommentShareMagdaanswered 5 months ago"


Question: "Container image support for Lambda" pricing with ECR

"Team,I have a question on  "Container image support for Lambda" pricing with ECRAccording to the ECR pricing page, it said:"Data transferred between Amazon Elastic Container Registry and Amazon EC2 within a single region is free of charge (i.e., $0.00 per GB)."So does this also applies to Lambda function pulling from ECR?FollowComment"

Answer: "0Accepted AnswerReferring to the Lambda pricing page (section: Data Transfer & Other Charges) "Data transferred between Amazon S3, Amazon Glacier, Amazon DynamoDB, Amazon SES, Amazon SQS, Amazon Kinesis, Amazon ECR, Amazon SNS, Amazon EFS, or Amazon SimpleDB and AWS Lambda functions in the same AWS Region is free."Refer: https://aws.amazon.com/lambda/pricing/CommentShareEXPERTParnabanswered 2 years ago"


Question: Amazon connect chat API session starts without the use of AWS credentials

"Currently, our approach updating the AWS configuration and initiating the amazon connect session with nodejs as follows:const AWS = require("aws-sdk");AWS.config.update({  accessKeyId: "accessKeyId",  secretAccessKey: "secretAccessKey",  region: "region"});new AWS.connect() and initiate a new AWS.connectParticipant()Our objective is to avoid using the AWS SDK for initiating the customer side chat session to send and receive messages. Instead, we are interested in utilizing the REST API directly, using the InstanceId and ContactFlowId.Is there any way to achieve this goal?FollowCommentzafar_khan 14 days agoWhat is the benefit of not using the aws-sdk?Share"

Answer: 0You can follow the practice of using temporary credentials using this linkhttps://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html#RequestWithSTSSo you can request these temporary token/keys instead of a putting a permanent accessKey and secretAccessKeyYou will still need to use AWS SDK to generate them to establish ConnectParticipant to establish a chat.CommentShareClarenceChoianswered 11 days ago


Question: S3 Select Metadata query

"Can I use S3 Select to query object metadata?Use case: Would like to only return objects sized <5k (for Comprehend training).Could do with a Python script, but S3 Select would be faster potentially...FollowComment"

Answer: 0Accepted AnswerS3 select only works in a single object and works on the contents of that object.I would use Head object to get just the objects metadata.CommentShareAWS-User-1552455answered 4 years ago