Question: security viewpoint: AWS lambda Vs EKS

Hi All - My customer is planning to to take AWS lambda for internal board approval and he is asking me to share security viewpoint: eks vs lambda. Do we have any documentation/references in this topic? I did shared some pointers but they are looking for more.Serverless·      Control what service/api can invoke Lambda using resource policy.·      Control what service can Lambda invoke using IAM Role.·      Multiple AuthN/Z methods with API Gateway.·      Same security group:subnet combo reuse same ENI (IP).·      FedRAMP (high) compliance.FollowComment

Answer: "0I would start with Lambda Security Resources in general:https://docs.aws.amazon.com/lambda/latest/dg/security-iam.htmlAWS Services with IAM (There is a comparison table)(https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html)Lambda runs in its own VPC and connect to your VPC via an ENI.  You can have an EKS cluster in that VPC.https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.htmlVPC endpoints with Lambda (https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc-endpoints.html).Lambda and Permissions (https://docs.aws.amazon.com/lambda/latest/dg/lambda-permissions.html)What specifically are you looking for from EKS perspective in comparison ?CommentShareRolyanswered 4 months agorePost-User-7848550 4 months agoHere some of the differences I gatheredIsolated Environment.Lambda run time uses micro-VMS and not containers. So the run time environments is sandboxed into its own VM and security around that. Even Lambda w/ containers creates a runtime by converting containers to Lambda run time.  (Lambda previously used EC2 instance. Now uses micro-VMs, (Firecracker). light weight VMs, but similar to EC2 segregation env.)ComplianceNot only FedRAMP : SOC2, all checked. https://aws.amazon.com/compliance/services-in-scope/ for LambdaSame security group: subnet combo reuse same ENI (IP).This is a good thing, otherwise VPC will run out IP addresses, It is just a network path and actual security of lambda should be in Invoke API (resource policy).Lambda doesn’t allow incoming connection.Lambda does not accept incoming internet connections as you set how its triggered - much less work in securing from internet threats!Share0This is a tough question since they are both compute resources but have very different target cases.From the Lambda product page:AWS Lambda is a serverless, event-driven compute service that lets you run code for virtually any type of application or backend service without provisioning or managing servers.This is simply stating that you don't need to worry about any of the OS or security patching in the background, though if you have code with security vulnerabilities or bad practices, then it is still likely to be exploited.And the EKS Product Page explains that the service is a managed Kubernetes platform. This is to say it's only as secure as you make it since it's easy to leave significant security gaps in your cluster or the app code running in the cluster.I would take a look at the following resources:AWS Shared Responsibility ModelAWS Lambda Security DocumentationAWS EKS Security DocumentationFinally, the answer to this really depends on your use case. Focus on what problem you are trying to solve and then secure that solution.CommentShareCarlo Mencarellianswered 4 months ago"


Question: FPGA HW linker Error

"Hello,One issue happen in Vivado synthesize earlier stage, need your suggestion:The error log is as below:The same project I have been using and test on my local FPGA machine no such error happens. Also, it can be built in two weeks ago on this aws machine--just don't understand why it is failed now..I find some notes mentioned this might be the AWS and Vivado version mismatch and some IP lib may need to be checked or  upgrade..but don't know how to do that ( there is no GUI for this machine, any command line command available?)The Vivado version is：2019.2_AR73068SW Build 2708876 on Wed Nov  6 21:39:14 MST 2019IP Build 2700528 on Thu Nov  7 00:09:20 MST 2019AWS version  1.4.15XRT version  2.5.0****** vpl v2019.2_AR73068 (64-bit)**** SW Build 2708876 on Wed Nov  6 21:39:14 MST 2019** Copyright 1986-2019 Xilinx, Inc. All Rights Reserved.WARNING: [VPL 60-642] Deprecated parameter name: compiler.lockFlowCritSlackThresholdINFO: [VPL 60-423]   Target device: xilinx_aws-vu9p-f1_shell-v04261818_201920_2INFO: [VPL 60-1032] Extracting hardware platform to /home/ubuntu/prj/build_dir.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/link/vivado/vpl/.local/hw_platform[07:02:33] Run vpl: Step create_project: StartedCreating Vivado project.[07:02:36] Run vpl: Step create_project: Completed[07:02:36] Run vpl: Step create_bd: Started[07:03:08] Run vpl: Step create_bd: Failed[07:03:08] Run vpl: FINISHED. Run Status: create_bd ERROR===>The following messages were generated while  creating FPGA bitstream. Log file: /home/ubuntu/prj/build_dir.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/link/vivado/vpl/vpl.vdi :ERROR: [VPL 41-145] Parameter S00_AXI.ADDR_WIDTH not found on block HIPERROR: [VPL 41-145] Parameter S00_AXI.ADDR_WIDTH not found on block HIPERROR: [VPL 60-1328] Vpl run 'vpl' failedERROR: [VPL 60-806] Failed to finish platform linkerINFO: [v++ 60-1442] [07:03:08] Run run_link: Step vpl: FailedTime (s): cpu = 00:00:48 ; elapsed = 00:00:53 . Memory (MB): peak = 674.137 ; gain = 0.000 ; free physical = 241072 ; free virtual = 244740ERROR: [v++ 60-661] v++ link run 'run_link' failedERROR: [v++ 60-626] Kernel link failed to completeERROR: [v++ 60-703] Failed to finish linkingMakefile:128: recipe for target 'build_dir.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/ecdsa.xclbin' failedmake: *** [build_dir.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/ecdsa.xclbin] Error 1Edited by: macleonsh on Oct 9, 2020 4:43 AMFollowComment"

Answer: "0Hi,Looks like the "markdown format" corrupted the logs you pasted into the post. Could you please attach and send the full log file? This will help us to better understand the issue.Just FYI --You can setup a GUI environment on your F1 instance using NICE DCV:https://github.com/aws/aws-fpga/blob/master/developer_resources/DCV.mdIt is possible to launch vivado in "-mode tcl" and use the TCL commands to upgrade IP and generate output products. Please see descriptions for "upgrade_ip" and "generate_target" in :https://www.xilinx.com/support/documentation/sw_manuals/xilinx2019_2/ug835-vivado-tcl-commands.pdfthanks!ChakraEdited by: awschakra on Oct 9, 2020 7:54 AMCommentShareawschakraanswered 3 years ago0Thanks a lot for the quick reply..attachment is the vivado log--can you check and give some suggestion, please?CommentSharemacleonshanswered 3 years ago0Looking at the log, the mismatch and IP locking messaging is due to version, the IP was used with 2019.2, however AWS applies the AR73068 patch to its build. This is done automatically when using the appropriate setup script on the Github page. The two specific IP that are locked are:WARNING: [BD 41-1661] One or more IPs have been locked in the design 'cl.bd'. Please run report_ip_status for more details and recommendations on how to fix this issue.List of locked IPs:cl_HIP_0cl_aws_0_0The HIP IP core is the one giving the error messaging. Could you make sure that your original design is being built with the appropriate version of 2019.2 that AWS uses (2019.2_AR73068)? I would suggest using the setup scripts to make sure the AWS environment is setup on your local machine.CommentSharekmorrisXilinxanswered 3 years ago0I log into Vivado project by using -mode tcl, and run report_ip_status as suggested,from the report, I did not see issues (both two IPs are Up-to-date).Could you make sure that your original design is being built with the appropriate version of 2019.2 that AWS uses (2019.2_AR73068)? I would suggest using the setup scripts to make sure the AWS environment is setup on your local machine.--> my project is originally built  by using Vitis 2019.2.1 on my local computer -- do you mean I shall revert my vitis back to 2019.2?Project IP Instances------------------------------------------------------------------------------------------------------------------------------------------------------------| Instance Name                    | Status     | Recommendation      | Change    | IP Name            | IP      | New Version   | New        | Original Part        ||                                  |            |                     | Log       |                    | Version |               | License    |                      |------------------------------------------------------------------------------------------------------------------------------------------------------------| cl_HIP_0                         | Up-to-date | No changes required | Change    | SDx Memory         | 1.0     | 1.0 (Rev. 5)  | Included   | xcvu9p-flgb2104-2-i  ||                                  |            |                     | Log not   | Subsystem          | (Rev.   |               |            |                      ||                                  |            |                     | available |                    | 5)      |               |            |                      |------------------------------------------------------------------------------------------------------------------------------------------------------------| cl_aws_0_0                       | Up-to-date | No changes required |  *(1)     | AWS                | 1.0     | 1.0 (Rev. 3)  | Included   | xcvu9p-flgb2104-2-i  ||                                  |            |                     |           |                    | (Rev.   |               |            |                      ||                                  |            |                     |           |                    | 3)      |               |            |                      |CommentSharemacleonshanswered 3 years ago0Finally, I revert back the AWS from 1.4.15 to 1.4.14, redo all the setup, then I can run my build..This is much faster then make another Vitis version etc..CommentSharemacleonshanswered 3 years ago"


Question: How to see S3 backup size?

"Hello.How can I see the size of a specific S3 backup?I have looked, in the AWS console Backup Dashboard at the Recovery Point under "Protected Resources", In the Backup Vault (in each Recovery Point), and in the Jobs history. This information (size and transferred bytes) is not shown in any of them.I have set up EventBridge and sending the logs to CloudWatch but the log events of both the "Recovery Point State Change", and the "Backup Job State Change", always show: "backupSizeInBytes": "0", "bytesTransferred": "0". I know for sure that the S3 bucket has changed since the last backup, new large objects (GBs) were added.So, I can't find a proof that the backups are actually doing anything and what is the size they occupy.I can't even see what is the size of the first, complete, backup.I have tried using the CLI to describe the recovery points and backup jobs the backupSizeInBytes is always 0.Thanks.FollowComment"

Answer: 0Here is a link to the answer I got from AWS:https://github.com/aws/aws-sdk/issues/330#issuecomment-1222783831TL;DRShowing the size of the S3 backup recovery point is not possible and will not be supported.Showing the number of transferred bytes (bytesTransferred) will be supported in a future release.CommentSharerePost-User-3926622answered 9 months ago


Question: Workspace stuck in unhealthy state even after multiple restarts

"Hello,It looks like my Workspace is stuck on the unhealthy state and I'm unable go connect to it via any of the clients. I've also tried rebooting multiple times with no luck.I would prefer not to rebuild my Workspace as I've spent alot of time installing / configuring my applications.Please help :)ThanksEdited by: Fahmad91 on Jul 17, 2019 5:17 AMFollowComment"

Answer: "0I was able to resolve this by creating a new workspace within the same vpc and RDPing into the problem workspace. (Note: I had to open the RDP ports first).Once in, I was able to fix the application that was preventing the connection issue. Rebooted, and everything seems to be fixed :)CommentShareFahmad91answered 4 years ago"


Question: Cognito user pool batch import failure "Cloudwatch Logs Role is missing permissions or has an invalid trust policy"

"I'm following the official docs to import users into cognito user pool, but got error in the "aws cognito-idp start-user-import-job" step, error is  "An error occurred (PreconditionNotMetException) when calling the StartUserImportJob operation: The configured Cloudwatch Logs Role is missing permissions or has an invalid trust policy." All the role configuration are following the docs here https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-using-import-tool.html FollowComment"


Question: ECS Fargate container running ASP.NET image not garbage collecting

"I have an ECS Fargate task running an ASP.NET image and I have noticed that it keeps failing due to OOM exception. I can look in CloudWatch and the memory keeps increasing. When I run in a local docker container, I can see that the garbage collector is running correctly and there is no memory problem. I have seen people suggest to set Server GC to false, but I'm not sure if that is the problem. From what I have read this should have been fixed in previous versions (I am using asp.net 5). Is this expected and is the correct approach to set this to false?FollowComment"

Answer: "0I will suggest to consider fine tuning web.confighttps://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/iis/web-config?view=aspnetcore-5.0You may want considering hands-on help  by partners to dig into issue.CommentSharek8syanswered a year agoAWS-User-0742604 a year agoThat is where I have seen the ability to turn off server garbage collection. Do you know if this is a known issue?Sharek8sy a year agono, there is no known issue. However, if there are dangling references, GC has no way to cleanup. I'll suggest to look into code. Profiling may helpShareAWS-User-0742604 a year agoI mentioned that this is not been in a local docker container. GC works just fine, which is what is leading me to think it's an ECS issue or at least differenceShare"


Question: DynamoDB modeling

"HeyWe are ad tech software to track impressions, clicks, and conversions. We are currently using Postgres but plan on moving to dynamoDb. The most common query is by source and clickId (UUID), so we're considering using the source as a partition key and the clickId as the secondary key.For the DW pipeline, we might need to query by date - that will be the secondary global index, and another Id that we use will be the 2nd GSIWe'll reach the 10GB partition limit for a few sources in less than a year as they drive millions of events daily. I've done some reading and understand that this is a soft limit, meaning that dynamoDB will split the partition into two or more partitions. What are the performance side effects of the split, both in the short and long term?Also, some sources drive more traffic than others, which leads me to the Hot Key problem. Is there a way to avoid that?FollowComment"

Answer: "1First I want to start by clearing up that DynamoDB does not have any data size limit, the 10GB limit per partition is only applicable when you use a Local Secondary Index, which I would always recommend not using unless you first consult with a specialist. Otherwise, DynamoDB automatically splits partitions as needed based on your storage and throughput needs.If you are using source as the partition key, we aware that you are limited to 1000WCU/3000RCU per source. If your use-case allows you should combine both source and uuid to give you  more even distribution across the keyspace:pkskothersource001#uuid0022023-04-10T00:00:000ZDatasource001#uuid9252023-04-11T00:00:000ZDatasource002#uuid0342023-04-02T00:00:000ZDataLikewise, for your GSI you need to ensure you are not exceeding 1000WCU/3000RCU per partition. If your use-case is to read by data, I assume you mean you want all the clicks in the last 24hrs for example. Take care to enable Write Sharding to ensure you don't create a hot partition on your index.CommentShareEXPERTLeeroy Hannigananswered a month agoHaimB a month agoThank you Leeroy,If I'll use UUID or source+UUID as PK that will lead to a row per partition, millions of partitions, and a single item in a partition. is that valid use of DynamoDb?if so, it actually might solve my other problem of another unique attribute we use as a short identifier, I can add it as a SGI and all my problems are goneShareLeeroy Hannigan EXPERTa month agoYou don't need to think about partitions when you work with DynamoDB. You can have as many unique partition keys as you like, in-fact the more the better. Just be aware that using a combination of source+uuid as partition key will prevent you from reading SELECT * FROM table WHERE source = 'abc' unless you create a GSI on source also.Share0You need the partition key to be as well-distributed as possible so some partitions don't get overloaded; this might require some creativity.  You can for example avoid unbalanced hot keys by sharding/aliasing popular keys; e.g. create hash.1, hash.2, hash.3 just to get the storage to distribute. Then you can use a batch query to pull it all in at the same time.Given that a good Partition Key is essential to get full performance by distributing requests evenly across partitions, what makes a good key?Attribute should have as many distinct values as possible.Should be uniformity of access across all key values, not just in total but at any point in time.If no attributes fit the above criteria, consider a synthetic/created/hybrid value.Do not mix Hot and Cold key values in a table.CommentShareEXPERTskinsmananswered a month ago0Thank you for your answer, but I'm not sure I follow.The only way to match an event is by the ID (UUID). Using the ID as a partition key will lead to a partition per row.I should use a partition key in my queries to avoid a table scan. so the second common field is the source, as the UUID will always be attached to a source.The user flow is :User clicks on an ad -> UUID is generated, and the user is redirected using this UUIDa server-to-server event, with source and UUID, is sent any time after the click. It can be 5 seconds or 5 months.If I understand correctly, you suggest creating alias groups, kind of group1, group2, etc.. and splitting the source across groups. is that right?In such a case, I'll need to attach a source to an alias before he even started, which makes no sense as I have no idea what his volume is at this stage.I had an idea of using a **date **(day/week/month) key as a partition key and a **source **as a sort key. and using the global secondary index with the source and the UUID. This way, the partition will be split evenly, but I have no idea If the global index can be a composite on attributes that are not one of the original partition keyThanks,HaimCommentShareHaimBanswered a month ago"


Question: Is OTP invalid after verify ?

Is the OTP invalid after it is verified by VerifyOTP sending or it still available until attempts time ?FollowComment


Question: Instance is stuck in stop/shutdown

"Hello,One of my instances is stuck in stopping state. I tried Forcefully Stop several times without success,ID Instance i-0386fbaa0218f250aus-east-1dThanks in advance!!FollowComment"

Answer: "0Hello,We are sorry about the issue that you had been experiencing with your instance. We have now assisted the instance to stop.Have a nice day!Regards,awstomasCommentShareAWS-User-3892169answered 4 years ago"


Question: How to delete Amplify app using Console in French

"Hi,when I try to delete an Amplify app using console in French, I am asked to confirm by typing "Supprimer" but that throws an error. Yet it works with console in English.RegardsFollowComment"

Answer: "0Hi, if you have a solution with English console, you should use it for now and open a Support ticket for your problem. It will not be solved here but by the service team managing Amplify who will fix the issue. So, please open a ticket via the AWS console in your account.CommentShareDidier_AWSanswered 14 days ago"


Question: Ratio-based or Active/passive load distribution with NLB

"Hi,Is it possible to configure AWS NLB for ratio-based or Active/passive load sharing between two or more targets?ThanksFollowComment"

Answer: 0This is possible with an ALB via the listener rules and target group weights but not with NLBs....it could be achieved with an additional NLB and Route53 weighted records but you would have to consider the additional NLB cost in this design and ensure appropriate route53 healthchecks were in place for both NLBsCommentShareEXPERTPeter_Ganswered a year ago


Question: Is there a limitation on the number of topics in IoT Core?

Is there any limit or performance issue with the increasing number of topics?Let's say I have 100 million devices and I want to be able to send messages specific to a device. First thing that comes to mind is to create a topic for each device and send to that topic. It is similar to a push message on a mobile device.Does creating 100 million topics cause performance or governance problems?FollowComment

Answer: "0Accepted AnswerIoT Core topics are not like SNS topics that are created resources. MQTT topics in IoT Core are not created or destroyed. They are an addressing scheme instead of a resource. There is an overview of this in an MQTT whitepaper here: https://d1.awsstatic.com/whitepapers/Designing_MQTT_Topics_for_AWS_IoT_Core.pdf"An MQTT topic acts as a matching mechanism between publishers and subscribers. Conceptually, an MQTT topic behaves like an ephemeral notification channel."At a high level there's not a limit on the number of topics and it is recommended to use a topic per device when possible. When it comes to management, I'd recommend following some of our best practices to make this easier:We support features such as policy variables (so you can reduce the number of of total policies you manage).We support thing groups so you can further group devices.I also recommend using a common naming structure such that topics match with thing names in the registry 1) for policy variables 2) for management. The IoT Lens within the Security and Operational Excellence Well Architected Framework pillars discuss these topics in more depth: https://d1.awsstatic.com/whitepapers/architecture/AWS-IoT-Lens.pdfCommentShareAWS-User-4984434answered 3 years ago"


Question: How can we add NLB's EIP for shield advanced protection for AWS auto-assigned IPs

"Hello,Internet facing NLB IPs doesn't come up under resources to protect even if we choose EIPs in Shield UI.Is it true that in order to enable shield advanced for NLBs, it had to be assigned to customer created EIPs as opposed to Amazon created IPs?Thanks,FollowComment"

Answer: "0Accepted AnswerIs it true that in order to enable shield advanced for NLBs, it had to be assigned to customer created EIPs as opposed to Amazon created IPs?Correct - Shield Advanced will only list the rsources if the NLB has been setup via a static EIP (instead of just subnets - which will assign a random public IP). So the correct way would be to Allocate a new address, then spin-up an ELB with EIP instead of subnets. Once done, it'll show up in Shield Advance to configure resource protection.CommentShareEXPERTShakeel_Aanswered 4 years ago"


Question: ECS Environment Variables "Value from"

"Hi all,We were checking the new UI for ECS and notice that the option "Value from" on environment variables inside Task definition is missing.the options available are import from S3 and individual value that refers to Value as a literal String. also options like entry point or command are missing too.will this old features be added again? "value from" option is critical as this is the only way to add the values that will call parameter store or secret via ARN from console.thank you in advance for your timebest regardsFollowComment"

Answer: "0Hello Shaggy,Thanks for reaching out to us! I've relayed your feedback regarding the new console to the ECS team. I've notified the team about the inability to specify options such as entryPoint, command or reference environment variables from Secrets Manager or Systems Manager Parameter Store using valueFrom.While the team is working on improving the experience with the new console, I would recommend reverting to the old-console to register new task-definitions. Please feel free to leave a comment if you have any additional questions.CommentShareDeepakanswered a year ago"


Question: MP4 input sources

"I'm wondering what is the recommended way to set sources for a MP4 input? Currently I've been putting the .mp4 file in a bucket in the same region as the MediaLive input and then just setting the second source to the same file as the first. Is this preferred or does it make sense to make a copy of the same file and put it in the same bucket, put a copy in another bucket in the same region or a bucket in a completely different region?FollowComment"

Answer: "0Hi RESScott,It's usually fine with static file inputs to use the same URL for both MediaLive pipelines. It's certainly possible to specify an s3 bucket from a different region for one or both input URLs, but it's not required at all.Regards,SteveCommentShareSteve_Wanswered 3 years ago"


Question: AWS Glue Datatype Numeric giving issue

I've glue catalog and use s3 as DB. Datatype of columns are numeric in Redshift which i'm casting as decimal in Glue. But getting issue while querying the data in Athena. Column in redshift looks like (-12.887686) with data type Number. we cannot change the data type in source tableFollowCommentFabrizio@AWS EXPERTa year agocould you please describe more the issue you have with the query in Athena?an example would be great. Thank youShare

Answer: 1Did you create the table in Glue data catalog by crawling redshift?Can you also provide the Athena error message?CommentShareSUPPORT ENGINEERManu_Ganswered a year ago


Question: S3 Notification event name through CloudFormation

"In the AWS Console, a user can create multiple S3 event notifications.  It is possible to set the "event name" for each one that is created. In CloudFormation, however, there is no option to set the name.  Some old documentation appears to reference an Id field, but this is no longer supported.I am looking specifically at the QueueConfigurations section of NotificationConfiguration within AWS::S3::Bucket. Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-notificationconfiguration.htmlThe S3 API reference has an Id field for this purpose (https://docs.aws.amazon.com/AmazonS3/latest/API/API_QueueConfiguration.html) but does not appear to be supported in CloudFormation.Am I missing something?  This would be useful for our use case.FollowComment"

Answer: "0Hello,Currently, CloudFormation does not support the EventName/Id property for S3 NotificationConfiguration. There is an existing feature request with the service team for this functionality. While I am unable to comment on if/when this feature may get released, I request you to keep an eye on our What's New, Blog and Release History pages for any new feature announcements.As a workaround using CloudFormation, consider using a CloudFormation Lambda custom resource. With this custom resource, you provision a Lambda logic to make the PutBucketNotificationConfiguration  API call. This way you can still manage all your related resources in a single stack.CommentShareUgochukwu_Ianswered a year agoMonica_Lluis SUPPORT ENGINEERa year agoThank you for the answer,Ugochukwu_I.DonLammey,Thank you for using re:Post. Let us know if this answers your question. If this solved your issue, please remember to click on the "Accept" button to let the community know that your question is resolved. This helps everyone. Thank you in advance.Share"


Question: Route 53 domain not showing up in account

"Hi,I purchased/registered a domain through Route 53 and it never showed up in my Route 53.  I got the charge and it is in my billing, but I never got an email stating the progress of the purchase or even a receipt about the purchase.  There is no other indications that I purchased this domain except through billing.I have purchased 3 other domains and had no issues.  I also only have 1 member account and my root account, I have checked both and there is no sign of the domain.How can I resolve this issue?  This domain should be in my account somewhere, but I'm not sure how to get to it.  Support hasn't been useful on this front and have since stopped responding (more than 24 hours since my last response).Thanks for any help.FollowComment"

Answer: 0Did you check your spam folder for validation?CommentSharerePost-User-7136343answered 3 months ago


Question: EC2 Instance error

"Hello,While trying to create an EC2 instance, I'm getting an error as below-Instance launch failedThis account is currently blocked and not recognized as a valid account. Please contact aws-verification@amazon.com if you have any questions.We did reach out to the above email address but haven't heard back from them yet."Launch Log" shows "Initializing requests", "Creating security groups" and "Creating security group rules" as Successful, but "Launch initiation" a FailedPlease let us know the solution to this problem.FollowCommentkentrad EXPERT5 months agoHow new is the account and what region are you in?Share"

Answer: "1I had similar experience before, to confirm that this is the same issue about new accounts, try to switch to any US region for example US East N.Virginia / US East Ohio then launch new EC2 instance, I would recontact aws-verification@amazon.com  to enable other regions but also will need to explain why as well.Good Luck!CommentShareBill Hegazyanswered 5 months ago"


Question: Security Hub - Ensure hardware MFA is enabled for the 'root' user account

"I ordered the free Yubico Key from AWS and have successfully set it up with the root user account from my computer.  The root account also uses a virtual key for someone else in the company to access since they live in a different city.  However, in Security Hub -> Security standards -> CIS AWS Foundations Benchmark v1.4.0 the compliance status is still marked as FAILED even though it has been weeks since this has been done.  AWS Foundational Security Best Practices v1.0.0 also shows Failed, but shows No Data under CIS AWS Foundations Benchmark v1.2.0.  Also show Failed under Findings.  Is there something that I am missing to allow the check to be successful?FollowComment"

Answer: "0Hello,Kindly check the compliance result of the underlying Config rulehttps://docs.aws.amazon.com/config/latest/developerguide/root-account-hardware-mfa-enabled.htmlCommentShareAdeyinianswered 3 months ago0Security Hub -> Security standards -> CIS AWS Foundations Benchmark v1.4.0:Check this remediation guide and ensure all steps are followed here- https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html#iam-6AWS Foundational Security Best Practices v1.0.0 also shows FailedSame remediation guide as aboveNo Data under CIS AWS Foundations Benchmark v1.2.0It means the control have been suppressed. You can change the status from "Supressed" using the "Workflow Status" to address the No DataNote: Security Hub updates the calculated security score every 24 hours.Future update on Consolidated Control Findings and a Consolidated Controls View for AWS Security Hub:https://aws.amazon.com/about-aws/whats-new/2023/02/aws-security-hub-consolidated-control-findings-view/CommentSharerePost-User-5076019answered 3 months ago0I think there must be no virtual MFA devices associated with the root account...The rule is NON_COMPLIANT if any virtual MFA devices are permitted for signing in with root credentials.https://docs.aws.amazon.com/config/latest/developerguide/root-account-hardware-mfa-enabled.htmlDoes that other person really need the "root" account?  I doubt it.  I believe root is really only necessary for seismic tasks, like deleting or transferring the account, maybe playing with domain ownership. Root account access is not genuinely necessary for every day tasks.  Best practice is give them their own IAM account and grant them Administrator access to everything, or less as appropriate.   As the account owner its best if you save those very few "root-only" tasks for yourself-or whoever has the hardware key.CommentShareScreenNameanswered a month ago"


Question: How do I create multiple environments for IoT services?

"I've built an IoT services application that is ready to be deployed to customers. I want to create a new IoT services instance so that my development environment is isolated from my production environment, but I'm not seeing a clear way to do that. With other AWS resources like databases or EC2 servers, you start by creating an instance, and you can create other separate instances later. With IoT, it seems like there is only one IoT environment tied to my whole AWS account. I don't want to commingle my test devices with real customer devices. What's the recommended way to go about this? Do I need to open an entirely new AWS account?I thought that the solution might be to create a new "Tenant" for my production environment but I'm not really following how that works. I suspect it's not as simple as going somewhere in the UI and saying "create new tenant".Thanks,FrankFollowComment"

Answer: "0Hi Frank. Generally speaking, multi-account approaches are recommended. Not just for IoT workloads incidentally. High level guidance here: https://docs.aws.amazon.com/pdfs/whitepapers/latest/organizing-your-aws-environment/organizing-your-aws-environment.pdfIdeally your whole solution is IaaC that you can deploy into any account. Promoting changes to the production account after testing in dev/test/staging/non-prod. In the case of your IoT devices, you would have your test devices in a test account.CommentShareEXPERTGreg_Banswered 6 months ago"


Question: Exception in User Class: org.postgresql.util.PSQLException : ERROR: column "id" does not exist

"I'm doing ETL from Postgres to Redshift with AWS Glue. I have imported a table with a Crawler and created a Job to just transfer the data and create a new table in Redshift. I get:Exception in User Class: org.postgresql.util.PSQLException : ERROR: column "id" does not existIn the original table, the column is "Id", case sensitive. Is there a way to make Glue case sensitive? (I don't have permission to change the Postgres schema). Also, I tried to create a job with Spark 3.1, Scala 2 (Glue version 3.0) and set  caseSensitive = false, still not working and getting the same errorFollowComment"

Answer: "0Hi ,I think that the issue is when you are reading the data from Postgres, because the query built by Glue uses the lower case column name. PostgreSQL is a case-sensitive database by default.if you are using from_catalog to read the data, you could use the following code to avoid glue automatic query building, and force the query you need:dyf_query_orddt = glueContext.create_dynamic_frame.from_catalog(    database="mysqltest",    table_name="classicmodels_orders",    additional_options={"query":"SELECT * from classicmodels.orders WHERE orderDate > '2005-01-01';"},    transformation_ctx = "dyf_query_orddt",)hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: Can someone explain the grading of certificates with re:Post

I am curious why Specialty certs are graded more than the Pro certs when setting up your profile?Any documentation to explain the grading process?ThanksFollowComment

Answer: "1Certifications add the following scoresCertificationScoreAWS Cloud Practitioner certification+10AWS Associate Level certification+20AWS DevOps Professional certification+60AWS Professional Solutions Architect certification+80AWS Specialty certification+100In the section "Who should take this exam?" in professional certifications it says: two or more years of experience, in specialties says: five or more years of experience. Specialty certifications may be more difficult than professional certifications, but at the end of the day this will depend on each person's area of expertise.CommentShareMaxCloudanswered a year ago0To partly answer my own question I did find a basic explanation of how the points system works within the re:Post FAQ.CommentShareRoBanswered a year ago"


Question: domain/ip blacklist affecting email dispatch

I uses dnschecker.org to find out my ip & domain is blacklisted by dnsbl.spfbl.net which is likely to affect my email send to spam folder.Any solution for it? Or can I ask AWS to assign a "clean" ip# to my EC2 server?THANKS FOR YOUR GUIDANCE/HELPFollowComment

Answer: "0Have you considered using Amazon Simple Email Service? You will need to pass the requirements for going live, as well as maintain the unsubscribe and spam report notifications to stay active with the service.CommentShareRodney Lesteranswered a year ago"


Question: Best way to re-stream data to Neptune Stream

"We have a Neptune with Stream enabled and we listen to that to add data to other type of databases. We had issue in one of our listeners that we have missed some data and it already expired in the stream.So what is the best way to add data again to that stream ( we only need specific vertex properties ), Only think I can think of is updating property in gremlin and then set it back to what it was like this :g.V().hasLabel('user').property(single, "username", "testUserName_randomCode").iterate();g.V().hasLabel('user').property(single, "username", "testUserName").iterate();I don't like this method but I am struggling to find a better solution to re add properties values to Neptune stream.FollowComment"

Answer: "1Accepted AnswerThere's currently no other method to add data to the stream - other than updating or deleting/re-inserting the data into the database.  The stream log is modified as part of a transaction.If you need to make these modifications on a regular basis, you may want to look at pushing the stream to an intermediary Kinesis Stream that would allow you to replay the stream from a particular point-in-time.As of Neptune engine version 1.2.0.0, we now support changing the stream expiry [1] from 1 to 90 days (whereas before it was statically set to 7 days).  There's likely some tradeoffs to be determined on your end on whether it makes sense to have a longer stream expiry and maintain the stream in Neptune (consuming more capacity within Neptune's cluster volume), or pushing the stream to a Kinesis Stream and maintaining the logs there.[1] https://docs.aws.amazon.com/neptune/latest/userguide/parameters.html#parameters-db-cluster-parameters-neptune_streams_expiry_daysCommentShareTaylor-AWSanswered 4 months ago"


Question: Using Secret Manager for password bug?

"I'm trying to use secrets manager to generate the password for DocumentDB and I'm stuck. I've managed to simplify to the below. It doesn't seem to matter if I generate it or not actually, when hard coded to a short password I still get the error.      MasterUserPassword:         '{{resolve:secretsmanager:ab:SecretString}}'Property validation failure: [Length of value {{{resolve:secretsmanager:ab:SecretString}}} for property {/MasterUserPassword} is greater than maximum allowed length {41}]However the below works:      MasterUserPassword:         '{{resolve:secretsmanager:a:SecretString}}'Anyone else tried this or hit this issue or managed to get it working?Looks like it's doing the 41 digit check on the pre-resolved string, not the actual passwordFollowComment"

Answer: "0There was a bug in Cloudformation passing dynamic references,  however it was fixed 3 years ago.CommentShareMihai Aanswered 7 months ago"


Question: Sap Launch Wizard fail

Embedded stack arn:aws:cloudformation:eu-west-1:470813849733:stack/LaunchWizard-Minitzsaptest2-HANAStack-1D2V6OSL8ZXND/cbca5b70-c607-11ec-94b6-02d45f750e25 was not successfully created: The following resource(s) failed to create: [HANAMasterInstance].FollowComment

Answer: "1When you find error in Launch Wizard, you can check the details of the errors as follows:Go to the "CloudFormation Console" to see under Event Tab to nail down the root cause.When the failure is happening within EC2 instance (during HANA installation), then you can do SSH into the EC2 instance to look at the logs and find the root cause.In order to do this, ensure that you do not tick "Enable rollback on failed deployment" when you kick off the Launch Wizard.CommentShareferrymulanswered a year ago0As the above advises, please check where the stack is failing under the CloudFormation -> Event Tab -> Failed events.To check why the HANAMasterInstance deployment may be failing you will need to check the logs contained on the instance.After unchecking "Enable rollback on failed deployment" you can find instance level script ouput in  */root/install/scripts/log * during the deployment process, when the instances are being launched and configured. The name of the log file is install.log. To check the progress of the deployment, you can log in to an instance as soon its instance state is listed as running.When the deployment is finished, the log files are moved to /tmp. In addition to the install.log file, the install.dbg file includes additional error information in case of failure scenarios.See LaunchWizard for SAP Troubleshooting for more information.CommentShareEnekoanswered a year ago"


Question: "Amazon WorkDocs: Is there a way to have one doc (with version control) but saved in two folders, under two different users, at the same time?"

"My colleagues and I often work on the same doc. For organisation and storage when the doc completed one of us has to download the doc and save in our own files. Is there a way to both have the same doc, stored in our own personal files, with version control? This will help us automate organisation!FollowComment"

Answer: "0Versioning is available and there are a few options how to collaboratively edit a shared document.  I recommend you check out Amazon WorkDocs Companion if you would like to use the web client to make updates and automatically save changes with a new version.  https://docs.aws.amazon.com/workdocs/latest/userguide/companion.htmlThere is also Hancom ThinkFree for experiencing a live collaborative editing session.There is also the option to download the file and lock it to prevent others from overwriting your work: https://docs.aws.amazon.com/workdocs/latest/userguide/client_lock_files.htmlTo view a specific version to download, https://docs.aws.amazon.com/workdocs/latest/userguide/client_file_versions.htmlCommentShareKathy_Hanswered 10 months ago"


Question: glueContext.extract_jdbc_conf() behaves inconsistently between Notebook and Script execution

"Sample code (minus boilerplate):conn = glueContext.extract_jdbc_conf(connection_name="My-Glue-Connection")for i in conn.items:    print(i)Output from notebook:('enforceSSL', 'false')('skipCustomJDBCCertValidation', 'false')('url', 'jdbc:sqlserver://0.0.0.0:1433')('customJDBCCertString', '')('user', 'test')('customJDBCCert', '')('password', 'xxx')('vendor', 'sqlserver')Output from running job:**('fullUrl', 'jdbc:sqlserver://0.0.0.0:1433/mydb')**('enforceSSL', 'false')('skipCustomJDBCCertValidation', 'false')('url', 'jdbc:sqlserver://0.0.0.0:1433')('customJDBCCertString', '')('user', 'test')('customJDBCCert', '')('password', 'xxx')('vendor', 'sqlserver')fullUrl (and thus the name of the database to connect to) is not available when using this method in a notebook.FollowComment"

Answer: "0Hello,I understand that glueContext.extract_jdbc_conf() is behaving inconsistently between Notebook and Script execution.From the document  https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-pyspark-extensions-glue-context.html#aws-glue-api-crawler-pyspark-extensions-glue-context-extract_jdbc_confI could see that extract_jdbc_conf()  should return the fullUrl for JDBC.Therefore, I also tested at my end and found that when executing the Glue Job script the extract_jdbc_conf() is returning the 'fullUrl' details but when I tested this in Notebook interactive session it did not return the 'fullUrl' details.Hence this was leading to inconsistent behaviour and by not getting the fullUrl you could not get the database which needs to be connected.Thank you for bringing this to our noticed. I have informed this issue to our internal team, but please note that I do not have a ETA on the fix for the same as we do not have visibility on the internal team's roadmap. If I hear any update on this from the internal team will update you on the same.Having said that I would also like to  apologize for any inconvenience this issue must have caused you.CommentShareSUPPORT ENGINEERrePost-User-6739329answered 3 months ago0Hello,I would like to update you that the issue has been resolved and extract_jdbc_conf() is returning the 'fullUrl' details in Notebook interactive session for Glue 3.0 as well.CommentShareSUPPORT ENGINEERrePost-User-6739329answered 3 months ago"


Question: Instance Status check failed after change from t2.2xlarge to t3.2xlarge

"I am trying to switch from a t2.2xlarge instance to a e3.xlarge.System Status check is green, Instance status check is red "instance reachability check failed"OS is Server 2021R2I used this command to enable ENAaws ec2 modify-instance-attribute --instance-id i-0db6e8abe7fa61536 --ena-supportVerified ENA and it shows TRUE, with this commandaws ec2 describe-instances --instance-ids i-0db6e8abe7fa61536 --query "Reservations[].Instances[].EnaSupport"I updated the PV drivers on the Windows instance with https://s3.amazonaws.com/ec2-windows-drivers-downloads/AWSPV/Latest/AWSPVDriver.zipAnyone know what else I can try?FollowComment"

Answer: "0Accepted AnswerHi there,Thank you for reaching out with your issue.Before you migrate to our new generation instance types(T3's) there are number of prerequisites that must be met on the instance.You would need to ensure that the NVMe and ENA drivers are installed before changing the ENA flag and the instance type.This process only works for EBS backed instances and before following the steps in this procedure, I recommend that you create a backup of the instance in the form of an AMI.To install the drivers, please see the AWS documentation[1].You must also ensure that part 1 to part 4 are completed :Part 1: Installing and upgrading AWS PV driversPart 2: Installing and upgrading ENAPart 3: Upgrading AWS NVMe driversPart 4: Updating EC2Config and EC2LaunchNoteWhen migrating to the latest generation instances, the static IP or custom DNS network settings on the existing ENI may be lost as the instance will default to a new Enhanced Networking Adapter device.I hope the provided information helps.Please review the provided documentation for more information.Have a great day!References:[1] https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/migrating-latest-types.htmlCommentShareNeoSeemaanswered 3 years ago"


Question: How to set custom Block response for managed rule sets in AWS WAF?

I need to set custom response header and response body for WAF WEB ACL that uses managed rule sets. How to override action to customized block instead of count?FollowComment

Answer: "0You can customize web requests and responses in the following ways:With allow, count, and CAPTCHA actions, you can insert custom headers into the web request. With block actions, you can define a complete custom response, with response code, headers, and body. https://docs.aws.amazon.com/waf/latest/developerguide/customizing-the-incoming-request.htmlis  the link with more details and examples.CommentShareRanjith Rayaprolu - AWSanswered 8 months ago"


Question: TLS1.2 cipher suites -  Amazon Corretto 8

"Hello,We need to check if the following TLS1.2 cipher suites are used or not in Amazon Corretto 8 JDK:TLS_DHE_RSA_WITH_AES_256_GCM_SHA384/ DHE-RSA-AES256-GCM-SHA384TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 / DHE-RSA-AES128-GCM-SHA256TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 / DHE-RSA-AES256-SHA256TLS_DHE_RSA_WITH_AES_256_CBC_SHA / DHE-RSA-AES256-SHATLS_DHE_RSA_WITH_AES_128_CBC_SHA256 / DHE-RSA-AES128-SHA256TLS_DHE_RSA_WITH_AES_128_CBC_SHA / DHE-RSA-AES128-SHATLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA / EDH-RSA-DES-CBC3-SHATLS_RSA_WITH_AES_256_GCM_SHA384 / AES256-GCM-SHA384TLS_RSA_WITH_AES_128_GCM_SHA256 / AES128-GCM-SHA256TLS_RSA_WITH_AES_256_CBC_SHA256 / AES256-SHA256TLS_RSA_WITH_AES_256_CBC_SHA / AES256-SHATLS_RSA_WITH_AES_128_CBC_SHA256 / AES128-SHA256TLS_RSA_WITH_AES_128_CBC_SHA / AES128-SHATLS_RSA_WITH_3DES_EDE_CBC_SHA / DES-CBC3-SHATLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 / ECDHE-RSA-AES256-SHA384TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA / ECDHE-RSA-AES256-SHATLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 / ECDHE-RSA-AES128-SHA256TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA / ECDHE-RSA-AES128-SHATLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA / ECDHE-RSA-DES-CBC3-SHAPlease advise?Thanks.FollowComment"


Question: "Outbound Email Ports Blocked, AWS refuses to unblock"

"I am running the Plesk stack on a Lightsail instance, which was pretty simple to get started and easy to configure sites with.  I have gotten my primary domain all set up and began to test the email when I noticed that the outbound mail was stuck in queue.  I have so little email that I didn't see the need to run it through SES.  After a little research, I see that AWS globally blocks the outbound ports by default and requires users to request them to be opened.  I reviewed all of the prerequisite steps and have submitted the form to request they unblock the ports.  By all of the articles and directions I read, this seemed like a mere formality.  My problem now is that they have denied my request.  They have replied to my questions with unhelpful feedback and now just the same response to my last two attempts to get  this resolved.  The message says:"Hello,Thank you for submitting your request to have the email sending limit removed from your account and/or for an rDNS update.This account, or those linked to it, have been identified as having at least one of the following:* A history of violations of the AWS Acceptable Use Policy* A history of being not consistently in good standing with billing* Not provided a valid/clear use case to warrant sending mail from EC2Unfortunately, we are unable to process your request at this time, please consider looking into the Simple Email Service. https://aws.amazon.com/ses/Regards,AWS Trust & SafetyAmazon Web Services, LLC"I should note that the first two reasons listed do not apply at all.  The account is a couple months old, and on autopay, and I am only just beginning to get the sites migrated over.  Additionally, none of my domains have ever been blacklisted for SPAM or any reason.  I am moving my hosting from GoDaddy for a few reasons, primarily cost and what I thought would be more freedom to manage my server.While I don't necessarily mind running my small amount of email through SES, it will not solve all of my issues.  Most notably is the fact that I have a few sites that have contact forms which are processed using the email service. And I also found that I cannot get messages from Plesk.  This added a few unnecessary challenges when getting the Let'sEncrypt SSL cert set up.I am not trying to set up a SPAM machine.  I don't even do any email marketing from my email address.  That is what I have ConstantContact for, and even that mailing list was all "Opt In" users.  I follow all of the proper guidelines.  I have DMARC and SPF records in place for my domain.So finally, here is my question.  What is my next step to get AWS to open up my email ports so the server can send messages out?  How can I escalate the request to someone who is more Customer Support friendly?  Has anyone ever gotten an approval after being denied?  What can I do?Thanks.Edited by: AZMike on Nov 19, 2021 7:40 AMEdited by: AZMike on Nov 19, 2021 7:54 AMEdited by: AZMike on Nov 20, 2021 10:42 AMFollowComment"

Answer: "0Hi AZMike,In order for port 25 to be opened, your request will have to be approved. Make sure you mention in your request that you want to open up port 25 on a Lightsail instance.The other option is to send email with SES (https://aws.amazon.com/ses/). If you search online, you'll find a number of resources to help setup SES with Plesk.CommentShareAlexanswered 2 years ago0Thank you, Alex.  I am not sure if you had anything to do with the change of heart, but after several frustrating days of them refusing to open the port (and sending me no help information as to why), they opened it up.  Whew.  What a relief.  They said, "After peer review I have decided to maturate your account for port 25 for us-west-2."  I am glad they did have a change of heart.  I could not understand why my small account was being denied.  I am just glad it was reviewed again and approved.CommentShareAWS-User-1242566answered 2 years ago"


Question: How do I set up an AWS Amplify project to query an existing AWS AppSync API?

"Hi,I am new to AWS Amplify and would like guidance on how to send a query to an existing GraphQL API on AWS AppSync. I am unsure how to start as a lot of Amplify coverage creates a new AppSync API using the Amplify CLI.ObjectivesSet up a Node.js project to work with an existing AWS AppSync API, using AWS Amplify as the GraphQL client.Send a single query to an existing AWS AppSync API. The query lists game results from a DynamoDB table and is called listGames in my GraphQL schema.I need to repeat the query in order to fetch all available database records that satisfy the query. This would mean adding results to an array/object until the nextToken is null (i.e. no more records can be found for the query).ContextThis application is deployed in an Amazon ECS container using AWS Fargate.The ECS service is fronted by an Application Load Balancer (ALB).A leader board web page fetches game results through a POST request to the ALB's DNS name / URL and adds them to a HTML table.NotesFor now, API key is my authentication method. I would soon like to switch to a task IAM role in ECS.The ECS deployment described in 'Context' is working but it sends POST requests without AWS libraries. It is my understanding that I would need to use an AWS library in order to use an IAM role for AppSync authentication (used as a task IAM role in ECS). Please correct me if I am mistaken.I would greatly appreciate any help you can give me. Thank you for your time!FollowComment"

Answer: "0Once you have  your AppSync API defined you should see on the overview page (when you click on the name of the API) the command to add the API to an Amplify app:amplify add codegen --apiId <YOUR_API_ID>Please note that AppSync is a managed service that will remove the need for you to host your GraphQL on ECS or anything like that. The mapping of the GraphQL queries to the resolvers (such as the ones for DynamoDB) will do the fetching of the records for you. See for example the template mapping for DynamoDB resolvers here.CommentShareMLGuyanswered a year agoToby a year agoHi, there. Thank you for your reply.Great - I will look into the add codegen command.The reason I created a proxy to call AppSync is because my DynamoDB table has more than 1,000 items which cannot all be retrieved in a single scan operation [1]. As such, the proxy gets results until nextToken becomes null and then returns the data to the client.Clarifications:My GraphQL API remains on AppSync, but I plan to turn it into an Amplify project so it can be updated in code outside of the AppSync console.The client (a web page) sends an AppSync query to the proxy (running on AWS Fargate). The proxy then forwards the request to the API on AppSync, builds up the scan results and returns the data to the client.I believe I still require the proxy I have described. Please inform me if there is something I am missing from my understanding.References:[1] DynamoDB Pagination with AppSync: https://advancedweb.hu/how-to-use-dynamodb-with-appsync/#paginationShareMLGuy a year ago@Toby, your reference link explains how to use the pagination without any proxy. The pagination is done on the client-side.In most cases, you can't display more than a few results (10, 20, 50, 100...) on the client anyway, and you don't want to wait for the end of fetching thousands of items from the server. You can implement the logic of limit or nextToken on the client app using any graphQL client or Amplify in this case.ShareToby a year agoYou're right about calling everything on the client. I overthought that aspect.However, given my data is for a leader board, I do not see how I can display the N highest scores without considering all items.ShareMLGuy a year agoGraphQL and AppSync support sortDirection: DESC on a query. For example, https://docs.amplify.aws/guides/api-graphql/query-with-sorting/q/platform/js/ShareToby a year agoHi, that's a great suggestion. Unfortunately, I'm going to struggle to make a GSI in DynamoDB because the field I want to sort by is nested like so: Teams --> Team --> FinalScore. Each database record contains the results of each team in a class at school.I believe I would have to create and maintain a second Dynamo table where each record is for one team's scores. (They can be linked back to their class record in the original table using the same partition key and sort key.) FinalScore could then have a GSI made for it (i.e. the field wouldn't be nested inside anything).Share"


Question: How to create a lake or pond?

"Hello,I'm very new to Lumberyard. I've followed the tutorials and understand the basics. However, I can't figure out how to create a lake or pond. From what I have read, it seems like I need to create a lowered area in my terrain, then use a WaterVolume. Without much else to go on, I gave it a shot, but I'm obviously missing something.REMOVEDUPLOADI applied the materials/water_temp to the WaterVolume:REMOVEDUPLOADI'm really just guessing at this point, so it won't be a surprise if I'm completely wrong. Any help would be much appreciated.I'm using Version 1.11.1.0 - Build 498520.BretFollow"

Answer: "0Accepted Answer@REDACTEDUSERYou are on the right track, but it looks like you're using the wrong shader. You are using the water shader; but for the water volumes that you are using, you should use the Watervolume shader. Give that a try and let me know your results.SharerePost-User-1190460answered 6 years ago0Hi @REDACTEDUSERYep, that worked perfectly! Thanks!SharerePost-User-9893155answered 6 years ago0@REDACTEDUSERI'm glad that worked, when you get an answer that works for you, please hit the accept answer button, so we know it was a useful answer!SharerePost-User-1190460answered 6 years ago0Here's my pond so far, just in case anyone is interested. I've only been using Lumberyard for a few days, so please excuse my sloppy level design.REMOVEDUPLOADREMOVEDUPLOADSharerePost-User-9893155answered 6 years ago0Very nice!SharerePost-User-8353690answered 6 years ago0Keep up the work, that's starting to look interesting!SharerePost-User-1190460answered 6 years ago"


Question: Elastic Beanstalk to deploy a microservices-based application with multiple components

"How would you configure Elastic Beanstalk to deploy a microservices-based application with multiple components, each with their own build and deployment pipelines, and ensure that they can communicate with each other securely and efficiently?FollowComment"

Answer: "1Accepted AnswerTo deploy a microservices-based application with multiple components in Elastic Beanstalk, you can create a separate environment for each microservice, each with its own deployment pipeline. To ensure that the microservices can communicate with each other securely and efficiently, you can use the following techniques:Service discovery: Use Elastic Beanstalk's service discovery feature or an external service registry such as AWS Cloud Map to register and discover the endpoints of your microservices. This will allow your microservices to discover each other's endpoints dynamically and efficiently.Load balancing: Use Elastic Load Balancing to distribute traffic across multiple instances of your microservices. You can use Application Load Balancers to route traffic based on the content of the requests, or Network Load Balancers to handle high-throughput traffic.Containerization: Use Docker or other container technologies to package your microservices into containers and deploy them to Elastic Beanstalk. This will ensure that your microservices are portable and can be deployed consistently across different environments.4 Security: Use AWS Identity and Access Management (IAM) to manage access to your microservices. You can use IAM roles and policies to control which users or applications can access your microservices. You can also use Amazon Virtual Private Cloud (VPC) to isolate your microservices and control network traffic between them.Monitoring: Use Amazon CloudWatch to monitor your microservices and collect metrics such as CPU utilization, memory usage, and network traffic. You can also use AWS X-Ray to trace requests and diagnose issues across multiple microservices.By using these techniques, you can deploy a microservices-based application to Elastic Beanstalk with multiple components, each with their own build and deployment pipelines, and ensure that they can communicate with each other securely and efficiently.CommentShareGovind Kumaranswered a month ago"


Question: How Instances in Private subnet can connect to Internet with NAT Instance

"Hi All,I planned to deploy a website in instance in private subnet which will be connected to Internet through NAT instance. Once I try to install httpd package in private instance, it throws an error https: 443 is not opened- timed out. Both instances are Amazon Linux.FollowComment"

Answer: "1Hello,Few check points to be noted when working with  NAT instance:-> NAT instance needs to be in the public subnet.->  At least allow port 80/443 on the security group of the NAT instance.->  Associate outbound route of private subnet to NAT instance in route table.If the SG and Iptabels , routing are correct then I would suggest to check this part "Disable source/destination checks"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheckCommentShareChethan SEanswered 10 months ago0Accepted AnswerHere are the steps -https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/vpc-nat-instance/I would suggest you to consider using NAT Gateway instead.https://aws.amazon.com/premiumsupport/knowledge-center/nat-gateway-vpc-private-subnet/https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateway-scenarios.htmlCommentShareRajesh Sanswered 10 months agoAWS-User-8358489 10 months agoThanks for your comment. Yes I would think about NAT gateway, but it's totally for personal hands-on, so from cost optimization perspective, I thought NAT instanceShare0Hi.Here are the steps to deploy a basic HTTPS application:Network DefinitionSet a new VPC CIDR 10.0.0.0/16Create at least 2 subnets per layer (Public & Private) CIDR Example 10.0.1.0/24Create 2 route tables (One for the public subnets and One for the private Ones:Create 1 Internet GatewayCreate 1 NatGateway (You also will need a Elastic IP)Associate the Internet Gateway to the Public routing table  | This will make public the subnets that you associateAssociate the Nat Gateway to the Private routing table | This will make private the subnets that you associateCreate a EC2 instance in the public subnet. This will be used as bastion to jump to the EC2 in the private subnet.The security group must contain the rule that allows your local IP and the protocol should be SSH 22 if it's linux.Create a EC2 instance in the private subnet. In this instance Deploy your application. if you are gona deploy your app using HTTPS you will need to install a certificateThe security group should allow your bastion's security group with the por 22 SSH.Deploy an Amazon Application Load Balancer with a 443 HTTPS listener configured.The security group should allow traffic from 0.0.0.0/0 to the port 443 HTTPS.Deploy a TargetGroup with a 443 HTTPS listener configured.Register your private EC2 instance.You must see that the Health Check of your ALB it's all green, that means that it's ok.The ALB has a DNS, so you can copy and paste it in your web broser.That's IT!If you are gonna use HTTP use the correct ports in the ALB and Target Group configuration.For a productive environment i will advice to use, Amazon CloudFront and Amazon WAF for a better performance and Security.Also, check your Apache or Nginx configuration, just to see if your 443 port is enabled.IF yes.Double Check your Security Groups configuration.Double Check your VPC's NACL configurationDouble Check your Routing tables configuration.Hope i helped you.Best regardsHECommentShareHernandez Edgaranswered 10 months ago"


Question: Why is the GPU not working out of the box for Deep learning AMI EC2 instance?

"I'm having trouble using the GPU for a Deep learning GPU EC2 instance.The specs of the instance are:Deep Learning AMI GPU PyTorch 1.11.0 (Amazon Linux 2) 20220328amazon/Deep Learning AMI GPU PyTorch 1.11.0 (Amazon Linux 2) 20220328When I log into the instance and I run nvidia smi, I get the error:NVIDIA-SMI has failed because it couldn't communicate with the NVIDIA driver. Make sure that the latest NVIDIA driver is installed and running.Similarly, when I run a pytorch (pre-installed) command to check whether it can see a GPU, it returns False:(pytorch) [ec2-user@ip-172-31-86-58 ~]$ python3Python 3.9.12 | packaged by conda-forge | (main, Mar 24 2022, 23:25:59)[GCC 10.3.0] on linuxType "help", "copyright", "credits" or "license" for more information.>>> import torch>>> torch.cuda.is_available()FalseThe GPU set up should have worked out of the box but how do I fix this?FollowComment"

Answer: "1Hello,Thank you for contacting us and for using AWS Deep learning AMI.Please note that such issues in the nvidia-smi command can generally occur when an unsupported instance type for the Deep Learning AMI GPU PyTorch 1.11.0 (Amazon Linux 2) 20220328 is used.As per https://aws.amazon.com/releasenotes/aws-deep-learning-ami-gpu-pytorch-1-11-amazon-linux-2/ , the supported instance types for this AMI are -> G3, P3, P3dn, P4d, G5, G4dnI was getting same issues which you mentioned when I tried using an unsupported ec2 instance type. Switching to the supported instances resolved the issue for me. Can you try the same at your end ?If required further help, I would recommend you to provide more information about your Deep learning AMI EC2 instance by opening a support case as we cannot discuss account specific issue in the public posts. You can open a support case with AWS using the link:https://console.aws.amazon.com/support/home?#/case/createThanks :)CommentShareSUPPORT ENGINEERShubham_Sanswered a year ago"


Question: Phone carrier has blocked this message

"Unable sent SMS through COGNITO Getting this IssueSNS LOgs:{"notification": {"messageId": "1100eb5d-a26e-543e-9233-b2ee031bdee0","timestamp": "2021-09-09 05:44:21.442"},"delivery": {"phoneCarrier": "Aircel - Andhra Pradesh","mnc": 801,"numberOfMessageParts": 1,"destination": "+919700266140","priceInUSD": 0.00278,"smsType": "Transactional","mcc": 405,"providerResponse": "Phone carrier has blocked this message","dwellTimeMs": 118,"dwellTimeMsUntilDeviceAck": 3239},"status": "FAILURE"}FollowComment"

Answer: "0When sending messages to India you should follow the required regulations. If you are sending on behalf of a company that is registered outside India, you can use international routes. To do so, you cannot use Sender IDs.To learn more, visit " https://docs.aws.amazon.com/pinpoint/latest/userguide/channels-sms-senderid-india.html " in the Amazon SNS User Guide.CommentShareAWS-User-2245945answered 2 years ago"


Question: How to delete AWS member account if there is no access to email used to create that account?

"Hello , I have used dummy emails to create few member accounts as part of my IAC code testing and since they are dummy emails i do not have root email credentials to login and delete those member accounts , what do i need to do in this case ? i have access to the management account though.Thank you and appreciate your help !FollowComment"

Answer: "1Accepted AnswerHello,You can't delete an account without the root account, and you can't remove it from your organization without first adding new payment details to the account and confirming it using the root account. This does not work for you  (which you already know).Best option is to "create" the dummy email you used to set up the accounts. This might be impossible if you don't own the domain you used. But if you have the email, you can use the normal "restore password" process and get access to the root account.If that does not work, contact AWS Support and see if they can help. If not make a feature request to them to fix this catch 22. Then put the accounts in their own "Zombie OU" and wait for them to fix it.Good luck!Account management can be painful. Please let us know how you managed to resolve this! :)Regards,Carl ÖstrandCommentShareCarl Ostrandanswered a year agoAWS-User-9933343 a year agoThank you, Is there a way i can share this with AWS support directly from here as in from repost?ShareCarl Ostrand a year agoI'm not sure, otherwise that's another  a great feature request!Share0If the dummy emails can be considered to be typos, you may try to contact AWS Customer Service using your Organization Management Account (Accounts and Billing Support case) to request for the email address to be changed for the member accounts you created under AWS Organization. These email typo change requests can take time and are NOT guaranteed to be approved.AWS accounts will always need correct owner information.Additional note: Providing incorrect email addresses for accounts created under organizations is likely to not be complying with section 1.5 here - https://aws.amazon.com/service-terms/CommentShareChan_Nanswered a year agoChan_N a year agoAWS Organizations now provides central AWS account closure to enable easier end-to-end account lifecycle managementhttps://aws.amazon.com/about-aws/whats-new/2022/03/aws-organizations-central-account-closure-lifecycle-management/https://aws.amazon.com/blogs/mt/aws-organizations-now-provides-a-simple-scalable-and-more-secure-way-to-close-your-member-accounts/Share"


Question: EC2 status check fail and connected fail

"I can't connect to my ec2 instance by ssh, and I notice its health check failed yesterday. At the same time, monitor can't get any data from instance.I try to get some info from "Actions -> Monitor and troubleshoot -> Get system log " but there is no latest log.I try to restart my instance, error still exist and I still can't connect to my instance by ssh.Plesae tell me what else could I do to fix my instance.FollowComment"

Answer: "0Hello @rePost-User-1957268This issue occurs due to operating system-level errors such as the following:Failure to boot the operating systemFailure to mount the volumes correctlyExhausted CPU and memoryKernel panicNetwork failed to come upRefer to the below resolution link:if the instance status check or system status check failed by viewing the instancehttps://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-status-check-failure/If the Answer is helpful, please click  Accept Answer & UPVOTE, this can be beneficial to other community members.CommentSharelearn2skillsanswered 2 months ago"


Question: Unable to access new instance

"I'm new to EC2 and have created an Ubuntu instance and assigned an elastic ip.However, I can't ssh to it (just sits there), ping the same. Trying to acces from the control panel eventually gives 'xxxx took too long to respond.'The instance is reported as running and healthy. I haven't changed the default 'open to all' firewall rules.I have rebooted the instance.What have I missed ? :)FollowComment"

Answer: "0OK, fixed. Needed to add rules to security launch-wizard-1.Still can't access via browser, but that seems to be a browser security issueCommentShareMartinJmanswered 3 years ago"


Question: Serverless Image Handler extraction for cropping an image

"Hey,I am using AWS Serverless Image Handler for resizing the image along with extracting a certain cropped area. However the extraction is not working properly. I believe AWS uses Sharp Pixel for performing the image processing operations and sharp has an operation called extract however I do not see any implementation of it in the code.I am passing the following requestconst request = {        bucket: // S3 bucket name        key, // path to your file on the S3 bucket (ex. public/larger-photo.jpg)        edits: {            webp: true, // if android, android loves webp            jpeg: true, // if iOS, iOS doesnt display webp so lets convert it            resize: { //see https://sharp.pixelplumbing.com/api-resize for docs/settings                width: 1000,                height: 750,                fit: "cover",            },        },        extract: {            left: area.x,            top: area.y,            width: area.width,            height: area.height        }    }Out here area is the cropped area that I need. I am not sure if I am following the right syntax as there is no documentation around it. Kindly let me know if AWS does any sort of extraction or cropping of a specific region for an image.FollowComment"


Question: timout when updating/reading crds

"Cluster information:Kubernetes version: 1.18AWS EKSWe have a small (3-node) AWS cluster that we’ve been working on for a few months.It’s been running ArgoCD 1.7.10, and we recently tried to upgrade that to 1.8.7.That upgrade failed - the command didn’t return, it just hung.Since then attempting to apply CRDs has just caused a timeout.To try to work this out We’ve extracted the application CRD from https://raw.githubusercontent.com/argoproj/argo-cd/v1.8.7/manifests/install.yamland trying to apply that goes like this:$ kubectl -n argocd apply -f application-crd.yamlError from server (Timeout): error when creating "application-crd.yaml": the server was unable to return a response in the time allotted, but may still be processing the request (post customresourcedefinitions.apiextensions.k8s.io)We can’t find anything in any logs and we suspect that the problem lies in etcd which is invisible to us but cannot be sure.We have tried applying other CRD's, some more basic to prove the point and some just as complex.  We have trimmed down the argoo CRD yaml and removed the schema and other parts to see which parts are failing but there appears to be no rhyme or reason to what is causing the problem. Sometimes it fails and sometimes it succeeeds.We have also tried the sample CRD from here:https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/And seen it both work and fail.In short, our kube is behaving erratically and we suspect a bug or a fundamental problem that we cannot diagnose.We are stuck and this is going to be used in production but we are losing confidence in our AWS EKS kube. Where do we go from here?Edited by: kophones77 on Mar 25, 2021 2:31 AMFollowComment"

Answer: 0It turns out that there were some validating webhooks that did not have backends and causing timeouts to API and strange behaviour.A lack of errors and no real debugging options made this a tough one to fix.CommentSharekophones77answered 2 years ago


Question: Detecting VPC to VPC Traffic Flow via DX Gateway

Is there any way of detecting VPC to VPC traffic flows via the DX Gateway?FollowComment

Answer: "0Accepted AnswerPer the FAQ:Q: Can I send traffic from a VPC that is associated with an AWS Direct Connect gateway to another VPC associated to the same AWS Direct Connect gateway?No, AWS Direct Connect gateway's only support routing traffic from AWS Direct Connect VIFs to VGW (associated with VPC). In order to send traffic between two VPCs, you must configure a VPC peering connection.CommentShareEXPERTTushar_Janswered 9 months ago"


Question: Load on MySQL RDS Aurora 3.X Database caused by wait/io/table/sql/handler

"Since we upgraded our DB cluster from Aurora 2.X to 3.x (MySQL 8), our DB has been slow on some read ops (on read replicas). When we check AWS performance insights, we see many waits related to wait/io/table/sql/handler, which we never had on Aurora 2.X. Does anyone know how to resolve this? Is it related to a configuration?The query issues issue seems to be intermittent since we can run the same query reasonably quickly under a second) but sometimes, the same query takes forever and reaches MAX_EXECUTION_TIME.** I've already read almost any article related to this but couldn't find anything useful.FollowComment"


Question: How can I get MAU's for a Cognito user pool?

"I am wanting to be able to get MAU's for a user pool for a specific month. For example, I want to be able to get the number of MAU's for user pool xxxxx for July 2022. I dont see anything in the UI or the API reference to get this data.FollowComment"

Answer: "0Using Amazon Pinpoint Analytics, you can track Amazon Cognito user pools sign-ups, sign-ins, failed authentications, daily active users (DAUs), and monthly active users (MAUs). You can also set up user attributes specific to your app using the AWS Mobile SDK for Android or AWS Mobile SDK for iOS. Those can then be used to segment your users in Amazon Pinpoint and send them targeted push notifications.Link- https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-analytics.htmlCommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months ago"


Question: One phone number for Amazon Connect AND Pinpoint

"Is it possible to have just one phone number and use it to receive both calls (handle by Amazon Connect) and SMS (handle by Pinpoint) ? That way, I will only have one phone number out there to be use by my customers. ThanksFollowComment"

Answer: "1One more here waiting for this feature.CommentShareVicente Guerraanswered a year ago0Why would there even be two separate numbers? Any normal phone should be able to handle calls and texting from the same number. People switch to twilio for this...They need to fix it.CommentSharerePost-User-9437226answered 4 months ago-1Accepted AnswerHello Luc, unfortunately at this time, we don't support using Pinpoint long codes to be used as Amazon Connect numbers (or vice versa). We have heard this request from customers as a feature request, but, as with all feature requests, we can't provide an ETA as to if or when this functionality would be available. In the meantime, you can make use of the Pinpoint SMS APIs from Connect contact flows with Lambda.Hope that helps.CommentShareAWS-MattDNanswered a year agoJeremy a year agoWe also are really looking for this capability @AWS-MattDN. We used Twilio before in the exact same fashion -- same phone number for voice and SMS calls. It's a feature that's really needed.Share-1Still not possible after all these years. :(CommentSharedmaciasanswered a year ago"


Question: Unable to use South Indian Bank when making a Net Banking Payment on AWS.

When the customer tries to pay an invoice using their Bank Account South Indian bank is not on the list. Is this Bank supported for AWS payments?FollowComment

Answer: "0Please contact AWS Support by visiting the AWS Support Center and create a case by clicking 'Create case'. AWS Support will be able to to check the current status of South Indian Bank's support for payments on AWS.Also, assuming you have already referred AWS Billing documentation, specifically Add a net banking account, to ensure all the steps to set a net banking account are taken per this document.CommentShareAWS-User-2870192answered 5 months ago"


Question: Finding AWS keys across regions and accounts at the org level.

"Suppose a customer has multiple AWS accounts, and their keys are sprawling across multiple regions and he wants to provide an org level service account credentials which has access to AWS KMS for all regions and accounts.Can we discover all AWS keys across regions and accounts at the org level using the single parent credential?FollowComment"

Answer: 0UPDATE - specifically regarding KMS Keys - there is no ability to use the kms:ListKeys action from another AWS Account. I'm not aware of anything similar to the IAM credential report for KMS.The following helps with IAM credentials:You can generate a credential report for a single AWS account which will list out all credentials in a specific account: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.htmlTo do this at scale we have a blog post with corresponding templates to generate this across all your accounts: https://aws.amazon.com/blogs/infrastructure-and-automation/automate-iam-credential-reports-at-scale-across-aws/This will also include details of when a key was last used – you’re likely also interested in where it was last used. Querying CloudTrail with Athena is a good next step for digging deeper: https://aws.amazon.com/premiumsupport/knowledge-center/athena-tables-search-cloudtrail-logs/CommentSharesimonanswered 4 months agorePost-User-0163415 4 months agoIs it possible to have a single master level credential through which we can query the resources of all the child accounts in an AWS Organization account?Share


Question: How to handle network load balancer health checks when using dynamic ports with UDP traffic?

"My setup:1 NLB (UDP traffic) using dynamic port mapping to ECS tasks.Question:The NLB only sends health checks on the mapped port and only as TCP, HTTP, HTTPS. My ECS task definition maps my container's port to the host port using UPD. This works fine, however, I'm unable to add an additional mapping, on the same port, for TCP. I'm also unable to use a custom health check port because dynamic port mapping is enable.That said, how should NLB health checks be handled when using dynamic port mapping and UDP traffic?FollowComment"

Answer: "0Hello,Have you looked at this Knowledge Center article: How do I set up dynamic port mapping for Amazon ECS?CommentShareEXPERTTushar_Janswered a year ago"


Question: Extend the root (ext4) partition adjacent to 2nd SWAP partition that is adjacent third LVM2 partition that has 2 volume groups in ext4 format inside of it

"We need to extend the root (nvme0n1p1) partition that is adjacent to the 2nd SWAP (nvme0n1p2) partition that is adjacent to the third (nvme0n1p3) LVM2 partition that has 2 volume groups in ext4 format inside the LVM2. One of the volume groups is mounted at /home/abc and that is where the server hosts the web (django framework) application from (inside a virtual environment | miniconda ).I am able to (as verified on a staging instance) increase the size of the volume on Amazon and extend the filesystem but only on the 3rd LVM2 partition (tail end) of the (nvme0n1) hard drive.The first (nvme0n1p1) partition is almost out of space.After increasing the size of the volume on Amazon EBS, the instructions tell you how to grow the partition (the one i want to grow is ext4)(https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/recognize-expanded-volume-linux.html) tell you to:sudo growpart /dev/nvme0n1 1but the response is:NOCHANGE: partition 1 could only be grown by 33 [fudge=2048]After you're supposed to:sudo resize2fs /dev/nvme0n1p1but without growing it, you cant resize the first (nvme0n1p1) ext4 partitionI was not able to growpart (or resize2fs) the first partition because it is sandwiched in-between the 2nd and 3rd. How do I accomplish this? - I have to shift the 2nd SWAP and 3rd LVM2 partitions over to allow for sectors to be free for the first partition to be able to be resized, correct?So since I wasnt able to grow p1, i applied the same commands to p3 and it worked.sudo growpart /dev/nvme0n1 3I am able to use Logical Volume Manager using things like:lvextend -L +5G /dev/mapper/vg_abc-appto resize the volume groups inside the 3rd partition (nvme0n1p3) of the device.The information below is from the actual instance i need to work on, it does not reflect an increase in EBS volume size yet.Here is the lsblk -fm output:NAME                 FSTYPE      LABEL           UUID                                   MOUNTPOINT                  NAME                   SIZE OWNER GROUP MODEloop0                squashfs                                                           /snap/core/00000            loop0                114.9M root  disk  brw-rw----loop2                squashfs                                                           /snap/amazon-ssm-agent/0000 loop2                 26.7M root  disk  brw-rw----loop3                squashfs                                                           /snap/core/00000            loop3                  114M root  disk  brw-rw----loop4                squashfs                                                           /snap/core18/0000           loop4                 55.6M root  disk  brw-rw----loop5                squashfs                                                           /snap/amazon-ssm-agent/0000 loop5                 25.1M root  disk  brw-rw----loop6                squashfs                                                           /snap/core18/0000           loop6                 55.6M root  disk  brw-rw----nvme0n1                                                                                nvme0n1                 50G root  disk  brw-rw----├─nvme0n1p1          ext4        cloudimg-rootfs 00000000-0000-0000-0000-000000000000   /                           ├─nvme0n1p1             20G root  disk  brw-rw----├─nvme0n1p2          swap                        00000000-0000-0000-0000-000000000000   [SWAP]                      ├─nvme0n1p2              2G root  disk  brw-rw----└─nvme0n1p3          LVM2_member                 00000000-0000-0000-0000-000000000000                             └─nvme0n1p3             28G root  disk  brw-rw----  ├─vg_abc-logs      xfs                         00000000-0000-0000-0000-000000000000   /var/log                      ├─vg_abc-logs          8G root  disk  brw-rw----  └─vg_abc-app       xfs                         00000000-0000-0000-0000-000000000000   /home/abc                     └─vg_abc-app          19G root  disk  brw-rw----nvme1n1              LVM2_member                 00000000-0000-0000-0000-000000000000                             nvme1n1                 50G root  disk  brw-rw----└─vg_backups-backups xfs                         00000000-0000-0000-0000-000000000000   /home/abc/Backups-Disk      └─vg_backups-backups    49G root  disk  brw-rw----Here is the output of: df -hTFilesystem                     Type      Size  Used Avail Use% Mounted onudev                           devtmpfs   16G     0   16G   0% /devtmpfs                          tmpfs     3.1G  306M  2.8G  10% /run/dev/nvme0n1p1                 ext4       20G   15G  4.5G  77% /tmpfs                          tmpfs      16G   40K   16G   1% /dev/shmtmpfs                          tmpfs     5.0M     0  5.0M   0% /run/locktmpfs                          tmpfs      16G     0   16G   0% /sys/fs/cgroup/dev/mapper/vg_abc-logs        xfs       8.0G  1.6G  6.5G  20% /var/log/dev/loop2                     squashfs   27M   27M     0 100% /snap/amazon-ssm-agent/0000/dev/loop5                     squashfs   26M   26M     0 100% /snap/amazon-ssm-agent/0001/dev/mapper/vg_abc-app         xfs        19G  2.0G   18G  11% /home/abc/dev/mapper/vg_backups-backups xfs        49G  312M   49G   1% /home/abc/Backups-Disk/dev/loop3                     squashfs  114M  114M     0 100% /snap/core/00000/dev/loop4                     squashfs   56M   56M     0 100% /snap/core18/0000/dev/loop0                     squashfs  115M  115M     0 100% /snap/core/00001/dev/loop6                     squashfs   56M   56M     0 100% /snap/core18/0001tmpfs                          tmpfs     3.1G     0  3.1G   0% /run/user/1000Here is the output of:parted -a optimal /dev/nvme0n1 print freeModel: NVMe Device (nvme)Disk /dev/nvme0n1: 53.7GBSector size (logical/physical): 512B/512BPartition Table: msdosDisk Flags:Number  Start   End     Size    Type     File system     Flags        32.3kB  1049kB  1016kB           Free Space 1      1049kB  21.5GB  21.5GB  primary  ext4            boot        21.5GB  21.5GB  16.9kB           Free Space 2      21.5GB  23.6GB  2147MB  primary  linux-swap(v1) 3      23.6GB  53.7GB  30.1GB  primary                  lvmHow do I increase the root size of nvme0n1p1 without stopping the EC2?  The solutions found indicate that the entire drive needs to be formatted and a new partition table made. That would obviously entail stopping the EC2. Please help.The AWS docs direct you to https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/5/html/deployment_guide/s1-lvm-diskdruid-auto if you have LVM on Nitro based instances. However, that link doesn't help me much wit what I'm trying to do here.Also, there is a second device, nvme1n1 that is entirely LVM2/xfs mounted at /home/abc/Backups-Disks (Filesystem: /dev/mapper/vg_backups-backups).Not sure if it makes a difference, as you can see above:nvme1n1              LVM2_member                 00000000-0000-0000-0000-000000000000                             nvme1n1                 50G root  disk  brw-rw----└─vg_backups-backups xfs                         00000000-0000-0000-0000-000000000000   /home/abc/Backups-Disk      └─vg_backups-backups    49G root  disk  brw-rw----I don't believe this other device needs to be changed in any way, however, please advise if so.Any help is appreciated, Thank you.FollowComment"

Answer: "0Hi ThereIt does not look like you increased the size of the EBS volume.   In your lsblk output, i see a 50g nvme0n1 volume and 3 partitions adding up to 50GB (20G + 2G + 28G)Increase the size of the EBS volume first and then extend the filesystem.  See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/requesting-ebs-volume-modifications.htmlnvme0n1                 50G root  disk  brw-rw----├─nvme0n1p1          ext4        cloudimg-rootfs 00000000-0000-0000-0000-000000000000   /                           ├─nvme0n1p1             20G root  disk  brw-rw----├─nvme0n1p2          swap                        00000000-0000-0000-0000-000000000000   [SWAP]                      ├─nvme0n1p2              2G root  disk  brw-rw----└─nvme0n1p3          LVM2_member                 00000000-0000-0000-0000-000000000000                             └─nvme0n1p3             28G root  disk  brw-rw----Also, which OS are you using?  I came across these articles with a similar error showing that you might need to install/update cloud-guest-utilshttps://access.redhat.com/solutions/4350511https://devopstechy.online/how-to-fix-nochange-partition-1-could-only-be-grown-by-6190792671-fudge2048-issue-in-linux/CommentShareEXPERTMatt-Banswered 8 months agocdoscdosrunrundosrun 8 months agoYou are correct, I will edit the question. I was able to increase nvme0n1p3 lvm2 partition in another EC2 staging environment. So what I mean to say is that I can get to the point where I can increase the size of the EBS and at least extend the filesystem on the third partition and then change the sizes of the EXT4 volume groups inside the nvme0n1p3 LVM2 partition. I just didn't do that here on this particular instance . OS is Ubuntu 16.04. Looking into the updates for cloud-guest-utils. Thanks.Sharecdoscdosrunrundosrun 8 months agoI have the cloud-guest-utils already. it still does not work when trying to grow the first / root partitionShare0This is a common partition management issue and is not unique to AWS, and happens on all OSes (win/mac/linux)To understand the issue better, do a web search for the term 'How to extend C drive to a non adjacent partition' , to get more info on this.Or see - https://www.reddit.com/r/sysadmin/comments/10rl05w/how_to_extend_c_drive_to_a_non_adjacent_partition/You will need to use a rescue instance along with proper partition management software such as:GParted  (Needs GUI via X11) - see https://www.pcquest.com/pcqlinux-gparted-aws-appliance/Minitool Partition Manager -PaidAOMEI Partition Assistant - PaidTo shuffle partitions down to the new unused space on the right. Then there should be free space to the right of the partition you want to extend and you regular partition expansion cli or above software can expand the 'sanwiched' partition.Please take a snapshot before you start.Also its AWS best practice to keep one partition on one EBS volume, that way you would never run into this issue.CommentShareJatinanswered 2 months ago"


Question: S3 Multipart upload request charges

"Does initiating, completing or aborting multipart uploads get charged the same as other PUT/POST requests? So if I performed a 1000 multipart uploads, would that cost $.005 not counting object uploads or storage costs?FollowComment"

Answer: "0Upload of each part is considered a PUT request."After you initiate a multipart upload, Amazon S3 retains all the parts until you either complete or stop the upload. Throughout its lifetime, you are billed for all storage, bandwidth, and requests for this multipart upload and its associated parts. If you stop the multipart upload, Amazon S3 deletes upload artifacts and any parts that you have uploaded, and you are no longer billed for them. For more information about pricing, see Amazon S3 pricing."https://docs.aws.amazon.com/AmazonS3/latest/userguide//mpuoverview.htmlCommentShareSandeepVudataanswered a year ago"