Question: About Tunnels in Session Manager

"Hi,I am actually able to make the connection, but I could not explain it well when explaining it to others, so I would like to know more.Related equipment：(1) Client terminals (e.g., laptops)(2) EC2 (SSM Managed Instance) on a private subnet as a relay device(3) servers that are networked to the EC2 (these are in an on-premise environment and are NOT AWS resources).(2) does not open inbound, but allows outbound connections any port to (3), and (3) allows connections to any port from only (2).I won't post the detailed commands, but I used AWS-StartPortForwardingSession to connect from (1) to (2) ("portNumber=22, localPortNumber=22"),The ssh command with the NL option is used to set up port forwarding (from any local port in (1) to any port in (3)), and localhost is specified from (1) to allow access to any port in(3).I have confirmed the information that (1) accesses the Session Manager endpoint via HTTPS, and (2) polls there, creating a TLS tunnel between the two.I am not able to understand this in detail (I cannot draw how and where the tunnel will be created),I am not able to draw a detailed image of this area, but I wonder if the communication described above, "accessing any port at (1) and going to any port at (3)", is encapsulated and passes through the TLS tunnel.Best Regards,FollowComment"

Answer: "1Accepted AnswerWhen using Session Manager with AWS Systems Manager, the communication between the client terminal (1), the EC2 instance acting as a relay (2), and the on-premise servers (3) is established using a secure TLS tunnel.Here's a high-level overview of how the communication works:The client terminal (1) initiates a connection to the Session Manager endpoint via HTTPS. This connection is established securely using SSL/TLS.The EC2 instance (2) polls the Session Manager endpoint to check for any active sessions. Once a session is requested, the EC2 instance opens a bidirectional TLS tunnel with the Session Manager service.After the TLS tunnel is established, the client terminal (1) sends commands or requests through the tunnel to the EC2 instance (2). These commands could include starting a port forwarding session.The EC2 instance (2) receives the commands and establishes a port forwarding session using the SSH protocol. This creates a secure connection between the client terminal (1) and the EC2 instance (2).The EC2 instance (2) acts as a relay and forwards the network traffic between the client terminal (1) and the on-premise servers (3). The traffic is encapsulated within the TLS tunnel, ensuring secure communication.In summary, the communication between the client terminal (1) and the on-premise servers (3) is encapsulated within a TLS tunnel that is established between the client terminal (1) and the EC2 instance acting as a relay (2). This ensures secure and encrypted communication between the client and the on-premise servers.CommentShareEXPERTsdtslmnanswered 9 days ago"


Question: How long does it take for new domain to propagate?

"Hi,dig @ns-657.awsdns-18.net jitsi.ab-env.co.uk A returns an answer.dig jitsi.ab-env.co.uk A does not.I created the Route53 hosted zone and added the given A record over 12 hours ago. (I registered ab-env.co.uk a day or so earlier.)Thanks,TLFollowComment"

Answer: "0Hi,Name servers appear in three places, and typically they should all be in synch:~ The name servers that Route 53 assigns to a hosted zone when you create it. These are the "master" name servers and cannot be changed. Name servers in the other locations usually match these.~ The name servers in the NS record in the hosted zone.~ The name servers that are associated with the domain registration. These are the name servers that control which DNS configuration is in use.For ab-env.co.uk, the name servers in the NS record match the "master" name servers, but they don't match the name servers for the domain registration. This typically means that someone did the following:~ Deleted the hosted zone that Route 53 created during domain registration.~ Created a new hosted zone. When you create a new hosted zone, Route 53 assigns a new set of four name servers to the hosted zone, so the name servers in the new hosted zone and the name servers in the domain registration no longer match.Here is how to fix that:Get the name servers that Route 53 assigned to the hosted zone when you created it. See "Getting the Name Servers for a Public Hosted Zone" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlUpdate the domain registration to use the four name servers that you got in step 1. See "Adding or Changing Name Servers and Glue Records for a Domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.htmlAfter you finish, it will take a couple of days for you to be able to see your website again because DNS resolvers typically cache the names of name servers for two days. (Folks who use different DNS resolvers will be able to see your website as soon as you make the change. You might also be able to see your website from your phone.) For an overview of how DNS works, including the part about resolver caching, see "How Amazon Route 53 routes traffic for your domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/welcome-dns-service.html#welcome-dns-service-how-route-53-routes-trafficScottCommentShareEXPERTAWS-User-6179575answered 3 years ago"


Question: AWS Lambda UI Error

I'm experiencing the following error when trying to create Lambda functions in the UI. There are no details and I haven't found any similar issue. I've tried different browsers and see the issue across all accounts. Any idea on what could be wrong?FollowComment

Answer: "0Does this happen on non-Lambda screens?Try signing in and signing out of your AWS account.CommentShareEXPERTRiku_Kobayashianswered 2 months agorePost-User-1875716 2 months agoNo, it only happens with Lambda. I tried logging into a different AWS account and it works fine.ShareRiku_Kobayashi EXPERT2 months agoAre there any logs in CloudTrail?Also, are you accessing with the same privileges as you had in the account that did not have the problem?Otherwise, try deleting the browser cache, etc.Share0Hi,You need to reach out to support. The problem (https://repost.aws/questions/QUuByTZvfZR66Vre0AWyYbuQ/lambda-functions-are-not-displayed) is about the account being considered “blocked” so you need to get in touch with support to prove that the account is legit and not compromised.Hope it helps ;)CommentShareEXPERTalatechanswered 2 months agoEXPERTskinsmanreviewed 2 months ago"


Question: Test Step Function with CDK - Best Practice

"I created a simple test function with a task that invokes lambda.    Function weatherToday = Function.Builder.create(this, "WeatherToday")        .code(Code.fromAsset(getClass().getClassLoader().getResource("lambda/weather_today").getPath()))        .runtime(Runtime.NODEJS_14_X)        .architecture(Architecture.ARM_64)        .handler("WeatherToday.handler")        .timeout(Duration.seconds(25))        .build();    IChainable getCurrentWeather = LambdaInvoke.Builder.create(this, "Get Current Weather")        .lambdaFunction(weatherToday)        .retryOnServiceExceptions(true)        .build();    Pass hotState = new Pass(this, "It is HOT!");    Pass coldState = new Pass(this, "It is COLD!!");    Choice isItHot = new Choice(this, "Is it Hot?")        .when(Condition.numberGreaterThanEquals("$.Payload.temp_f", 90), hotState)        .otherwise(coldState);    IChainable chain = Chain.start(getCurrentWeather).next(isItHot);    StateMachine.Builder.create(this, "IsItHotNow").definition(chain).timeout(Duration.seconds(60))// best practice        .build();  }Assuming this is the best practice, I wanted to write a test that checks whether the states transition or are chained as intended.When pulling in the DefinitionString for the given state function "DefinitionString": {          "Fn::Join": [            "",            [              "{\"StartAt\":\"Get Current Weather\",\"States\":{\"Get Current Weather\":{\"Next\":\"Is it Hot?\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2}],\"Type\":\"Task\",\"Resource\":\"arn:",              {                "Ref": "AWS::Partition"              },              ":states:::lambda:invoke\",\"Parameters\":{\"FunctionName\":\"",              {                "Fn::GetAtt": [                  "WeatherToday53196B63",                  "Arn"                ]              },              "\",\"Payload.$\":\"$\"}},\"Is it Hot?\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.Payload.temp_f\",\"NumericGreaterThanEquals\":90,\"Next\":\"It is HOT!\"}],\"Default\":\"It is COLD!!\"},\"It is COLD!!\":{\"Type\":\"Pass\",\"End\":true},\"It is HOT!\":{\"Type\":\"Pass\",\"End\":true}},\"TimeoutSeconds\":60}"            ]          ]        }The above is an array of strings with inlined intrinsic ASL functions.There does not seem to be a good way to get the state definitions to resemble the typical state function definition file as json without the intrinsic functions.My thoughts are if I can get the appropriate state machine definition as a json format of ASL it will be easier to test for the expected states.Please let me know if there is a way to do this or what may be the best practice approach?FollowComment"


Question: Instance reachability check failed

My EC2 is not reachable anymore. The status checks return - "Instance reachability check failed". I am running a t3.micro Ubunto instance.FollowComment

Answer: "0Hi,Based on the notes the instance in question was failing status checks error stating "Instance reachability check failed".The issue could be caused by several reasons, failure to boot the operating system[1],Failure to mount the volumes correctly[2],Exhausted CPU and memory[3],Kernel panic[4]. However I could be wrong and there could be more causes to the issue.In order to solve this issue, the solution will be based on your particular use case to further help you in that regard I have added a links below:https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-status-check-failure/https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-resource-over-utilization/I hope you find this information useful.CommentShareWinnieanswered a year ago"


Question: where is old forum? How do I check my questions I have posted in the last several years?

I really need to check some of my old posts on forum.FollowComment

Answer: "1Hi there! What you said above is correct; some (most viewed/popular) Forums content has been migrated to re:Post. Additionally, you can still access AWS Forums until December 9th, here: https://forums.aws.amazon.com. After December 9th, AWS Forums will become read-only and on April 1st, 2022, will redirect to re:Post. Hope this helps!CommentShareLisi_AWSanswered a year agoShantanu Oak a year agoonly "some" posts are migrated. A lot of posts are not. They will be probably lost after March!Share0The good news is that the old forum posts are imported in re:post under "My Dashboard" tab. The bad news is that I will have to learn the new UI (User Interface) that is different than the old one.CommentShareShantanu Oakanswered a year ago"


Question: AWS Cognito External User Pool Identity Provider(OIDC)

"Hey, I'm using Cognito App Client integration with external provider(Twitch)User authentication works fine, but as code from auth server is consumed by Cognito, I'm not sure how should I send Twitch requests with token, which I'd normally get from twitch I Cognito wouldn't consume this code. I only have Cognito code, which I can use in https://{my-domain}/oauth2/token requests in exchange for Cognito tokens. request returns id_token, access_token and refresh_token, which decoded look likeid token{  "at_hash": "yTNkeTAqzqcXCYi3yLL2Pw",  "sub": "3cfba641-4058-475f-9818-17291175fd31",  "cognito:groups": [    "us-east-1_xxxxxxxxxxxx"  ],  "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_xxxxxxxxxxxx",  "cognito:username": "xxxxxxxxxxxx",  "preferred_username": "xxxxxxxxxxxx",  "nonce": "SxxlipCDVbXbcXa1H7Uf9_nM0uOurAAObUVCyreBDDux99QoAngUoiGdE0me-0Zon6fEVLLTSqD4EN1Y6_lFm48MaoBaxyywZCQKOT70gfQEfkuhlsjImJd1ko3qH3QKdlmvWSPCUZoACPYNSgR364VPELyQTVMkRTCt9eYROag",  "aud": "35l1cn53cnj9sv1ndu8u01amk0",  "identities": [    {      "userId": "xxxxxxxxxxxx",      "providerName": "xxxxxxxxxxxx",      "providerType": "OIDC",      "issuer": null,      "primary": "true",      "dateCreated": "1588191000072"    }  ],  "token_use": "id",  "auth_time": 1588191003,  "exp": 1588194603,  "iat": 1588191003}access token{  "sub": "3cfba641-4058-475f-9818-17291175fd31",  "cognito:groups": [    "us-east-1_xxxxxxxxxxxx"  ],  "token_use": "access",  "scope": "aws.cognito.signin.user.admin phone openid profile email",  "auth_time": 1588191003,  "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_xxxxxxxxxxxx",  "exp": 1588194603,  "iat": 1588191003,  "version": 2,  "jti": "55863213-c764-4b07-a386-a9c93d14e4b2",  "client_id": "xxxxxxxxxxxx",  "username": "xxxxxxxxxxxx"}How can I get user token to call Twitch API (for example GET https://api.twitch.tv/helix/users endpoint with authorized user's token)?FollowComment"

Answer: "0All cognito does is "authentication" with identity provider you configured. After authentication successed, all authorization process is handled by cognito which mean access_token, id_token and refresh_token are used only within cognito boundary (endpoints), cannot be used to call identity provider endpoints, in your case twitch.If you wish to call twitch's APIs, you have to obtain tokens by calling twitch's authorization server with appropriate grant_type (like client_credentials) and client_id and client_secret generated at twitch. Once you got tokens from twitch, you can call any twitch's APIs depended on scopes of your client_id.However, if you just want only some basic info of user, such as email, name, user_id, you can configure cognito to map attributes from twitch's id_token to cognito user attributes during the authentication. You may have to put specificed twitch's oauth scopes, something like 'email', 'profile', in cognito identity provider configuration, and you may also ask for user permission/consent (So, keep in mind that this particular info you may or may not got from user). After attribute mapping was configured correctly and user authenticated succuess, you can retreive the mapping values from decoding jwt of cognito's id_token, or using cognito's access_token to call cognito's userinfo enpoint.Cognito event triggers are interesting to look into. I'm not sure can it be used to intercept ID provider's access_token and store somewhere, like in database , for further use, or not.CommentSharerexfranswered 3 years ago0I've already checked triggers, and none of them contain any useful dataPreSignUp_ExternalProvider{    "version": "1",    "region": "us-east-1",    "userPoolId": "us-east-1_xxxxx",    "userName": "xxxxxxxx",    "callerContext": {        "awsSdkVersion": "aws-sdk-unknown-unknown",        "clientId": "xxxxxxxxxxx"    },    "triggerSource": "PreSignUp_ExternalProvider",    "request": {        "userAttributes": {            "cognito:email_alias": "",            "cognito:phone_number_alias": "",            "preferred_username": "xxxxxxxxxxx"        },        "validationData": {}    },    "response": {        "autoConfirmUser": false,        "autoVerifyEmail": false,        "autoVerifyPhone": false    }}PostConfirmation_ConfirmSignUp{    "version": "1",    "region": "us-east-1",    "userPoolId": "us-east-1_xxxxxxx",    "userName": "xxxxxxxxxxx",    "callerContext": {        "awsSdkVersion": "aws-sdk-unknown-unknown",        "clientId": "xxxxxxxxxxxxx"    },    "triggerSource": "PostConfirmation_ConfirmSignUp",    "request": {        "userAttributes": {            "sub": "703e51b8-a471-4233-8637-f51feb0414b1",            "identities": "[{\"userId\":\"xxxxxxxxxxxxx\",\"providerName\":\"xxxxxxxxxxx\",\"providerType\":\"OIDC\",\"issuer\":null,\"primary\":true,\"dateCreated\":1588257310792}]",            "cognito:user_status": "EXTERNAL_PROVIDER",            "preferred_username": "xxxxxxxxxxx"        }    },    "response": {}}TokenGeneration_HostedAuth{    "version": "1",    "triggerSource": "TokenGeneration_HostedAuth",    "region": "us-east-1",    "userPoolId": "us-east-xxxxxxxxxxx",    "userName": "xxxxxxxxxxxxx",    "callerContext": {        "awsSdkVersion": "aws-sdk-unknown-unknown",        "clientId": "xxxxxxxxx"    },    "request": {        "userAttributes": {            "sub": "ed1fca3c-8084-4ae5-a128-ac37e38c7ffd",            "cognito:user_status": "EXTERNAL_PROVIDER",            "identities": "[{\"userId\":\"xxxxxxxxx\",\"providerName\":\"xxxxxxxxxx\",\"providerType\":\"OIDC\",\"issuer\":null,\"primary\":true,\"dateCreated\":1588255540224}]",            "preferred_username": "xxxxxxxxxxx"        },        "groupConfiguration": {            "groupsToOverride": [                "us-east-xxxxxxxxxx"            ],            "iamRolesToOverride": [],            "preferredRole": null        }    },    "response": {        "claimsOverrideDetails": null    }}This idea with mapping attributes sounds interesting, but Cognito doesn't says anything about mapping anything else than user claims, so I'm not sure how do I do itI've already specified these twitch auth scopes and I see these on consent screen, but I don't see any of these right after thatAlso I think you may get me wrong - I want to use users token to perform actions on his behalf (like get banned users etc)Edited by: piekarski on Apr 30, 2020 7:45 AMCommentSharepiekarskianswered 3 years ago0I don't think you can do that with cognito. I don't know much about twitch, but I guess it's a kind of social network, right?IMO, the best you can do is using OAuth implicit grant type to let users do something on his/her behalf on your application. It's like having a Facebook's share button and comment section on websites that's not the Facebook website itself. You don't deal with user's access token on the backend, let's your app client, Facebook's APIs, and Facebook's OAuth server done for you.However, in your case, it depends on the twitch's APIs you need allow you to call through implicit grant type, or not?CommentSharerexfranswered 3 years ago0CAUTION - Doing it incorrectly, you expose sensitive attributes to client.You need to create 2 versions of attributes - custom and dev:custom, map oidc provider attributes to custom ones (looks like dev:custom aren't mappable), then in TokenGeneration_HostedAuth trigger you need to get these custom attributes, set dev:custom ones, then delete customs.Seems like a tweak, but I don't see another way of doing it and keeping tokens safe.Solution for that is to create custom attributes in your user pool, then map these attributes for identity provider. Looks something like:'custom:refresh_token': refresh_token'custom:id_token': id_token'custom:access_token': access_tokenCloudformation template for that:user pool....Schema: [    {        AttributeDataType: 'String',        DeveloperOnlyAttribute: true,        Mutable: true,        Name: 'refresh_token',        Required: false,    },    {        AttributeDataType: 'String',        DeveloperOnlyAttribute: true,        Mutable: true,        Name: 'access_token',        Required: false,    },    {        AttributeDataType: 'String',        DeveloperOnlyAttribute: true,        Mutable: true,        Name: 'id_token',        Required: false,    },    {        AttributeDataType: 'String',        Mutable: true,        Name: 'refresh_token',        Required: false,    },    {        AttributeDataType: 'String',        Mutable: true,        Name: 'access_token',        Required: false,    },    {        AttributeDataType: 'String',        Mutable: true,        Name: 'id_token',        Required: false,    },],....user pool identity provider....AttributeMapping: {    'custom:refresh_token': 'refresh_token',    'custom:access_token': 'access_token',    'custom:id_token': 'id_token',},....CommentSharepiekarskianswered 3 years ago0Congrat. and thank you for sharing your solution :)CommentSharerexfranswered 3 years ago"


Question: Cannot connect to Lightsail instances

"I'm running 5 Lightsail instances.  When I try to connect to any of them, the instance hangs after 30 seconds with a message "Connecting to your instance..." .  Is there anything wrong with ca-central-1A?  There's no way to troubleshoot if I can't make the connection to the instance.FollowCommentiwasa EXPERTa year agoHi.Are you connecting remotely from a web console? Do you have the same problem with your local terminal?https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-ssh-using-terminalhttps://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-connecting-to-windows-instance-using-rdcShare"

Answer: "0Hello rickles688,Was he suggestion from iwasa helpful? Is your problem resolved? Please let us know.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago"


Question: First time using EFS--missing something-detailed steps shown

"Hello, I did these steps:##2) Spin up 2 Linux instances#Login console#Launch, Select Amazon Linux 2 AMI,#select t2,micro#Number of instances 2#Accept VPC default#Configure new Security Group with rules opening (SSH, NFS, all TCP)#Launch, download pemFile#chmod 400 pemFilessh -i pemFile ec2-user@IPv4PublicIPsudo yum update##3) Set up password-less SSH between the two instancesssh-keygen -N ""copy ~/.ssh/id_rsa.pub to ~/.ssh/authorized_keys of lead and slave nodes#Note: ssh-copy-id $dest does not work as on Debian for previous stepMy two instances are:ec2-18-223-136-147.us-east-2.compute.amazonaws.comip-172-31-44-117.us-east-2.compute.internalvpc-b5b91adesubnet-4e066e02andec2-18-218-243-42.us-east-2.compute.amazonaws.comip-172-31-44-239.us-east-2.compute.internalvpc-b5b91adesubnet-4e066e02#Note: Package 1:nfs-utils-1.3.0-0.54.amzn2.0.2.x86_64 already installed and latest versionsudo yum install -y amazon-efs-utilsI can see maybe a problem here because when I setup EFS with Network, I only see:us-east-1a,b,c,d,e, no us-east-2 entriesand vpc-74b84809Availability zone us-east-1aThen, the Attach page gives me:[ec2-user@ip-172-31-29-158 ~]$ sudo mount -t efs -o tls fs-03a16a81:/ efsFailed to resolve "fs-03a16a81.efs.us-east-2.amazonaws.com" - check that your file system ID is correct.See https://docs.aws.amazon.com/console/efs/mount-dns-name for more detail.[ec2-user@ip-172-31-29-158 ~]$ sudo mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport fs-03a16a81.efs.us-east-1.amazonaws.com:/ efsmount.nfs4: Failed to resolve server fs-03a16a81.efs.us-east-1.amazonaws.com: Name or service not knownmount.nfs4: Operation already in progress[ec2-user@ip-172-31-29-158 ~]$ sudo mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport 172.31.45.108:/ efsmount.nfs4: Connection timed out[ec2-user@ip-172-31-29-158 ~]$What am I missing or doing wrong?Thanks!Edited by: oschreiber on Aug 18, 2020 1:16 PMFollowComment"

Answer: "0Sounds like your EFS is in a different region than your EC2 instances...which would make for a more difficult connection from your EC2 instances.I would create the EFS in the same region as EC2.  Then make sure that security group access between the EFS security group and the EC2 security group there (usually that part is my problem area when I can not mount).Some details here on security groups...https://docs.aws.amazon.com/efs/latest/ug/network-access.htmlCommentShareForums-User-4126278answered 3 years ago0Thanks, I did find eventually the way to get the same region for EFS as instance.So now I am studying your suggestions on security group.Thanks!CommentShareoschreiberanswered 3 years ago0Thank you so very much. That page was evoking how to set the security groups of instances and EFS and another page showed how to edit that into the VPC's.Not evident to me but I am glad EFS mounted on the two nodes, now.Thanks!CommentShareoschreiberanswered 3 years ago"


Question: Device Pool - MODEL NOT_IN Rule not working

"I'm creating a device pool with AWS CLI and want to exclude 2 models, but they keep showing in the created pool, any advice?  ThanksNote: I've also tried excluding with MANUFACTURER, but it does not work either.These are the rules I'm using:[    {        "attribute": "AVAILABILITY",        "operator": "EQUALS",        "value": "\"HIGHLY_AVAILABLE\""    },    {        "attribute": "PLATFORM",        "operator": "EQUALS",        "value": "\"ANDROID\""    },    {        "attribute": "FORM_FACTOR",        "operator": "EQUALS",        "value": "\"PHONE\""    },    {        "attribute": "OS_VERSION",        "operator": "GREATER_THAN_OR_EQUALS",        "value": "\"8.0.0\""    },    {        "attribute": "OS_VERSION",        "operator": "LESS_THAN_OR_EQUALS",        "value": "\"11\""    },    {        "attribute": "MODEL",        "operator": "NOT_IN",        "value": "[\"OnePlus One\",\"LG Stylo 5\"]"    }]FollowComment"

Answer: "0Accepted AnswerHi,It seems that I am unable to replicate this behavior and we may need some additional details. That is, the NOT_IN operator works for both MODEL and MANUFACTURER in the tests which I have done.First, I use the AWS CLI to create a device pool:aws devicefarm create-device-pool --name testpool --rules file://device-pool-rules.json --project-arn [MY_PROJECT_ARN] --region us-west-2Here is the contents of my device-pool-rules.json file[    {        "attribute": "MODEL",        "operator": "NOT_IN",        "value": "[\"OnePlus 8T\",\"LG Stylo 5\"]"    },    {        "attribute": "MANUFACTURER",        "operator": "NOT_IN",        "value": "[\"APPLE\",\"SAMSUNG\"]"    }]When I try to create a test run and reach the "Select Devices" stage and then select my Pool "testpool", I can confirm that SAMSUNG, APPLE and 2 specified devices are not included. Here are the devices that I can see for your reference:Sony Xperia XZ3Google Pixel 2 XLGoogle Pixel 4 XL (Unlocked)Google Pixel 2 XLGoogle Pixel 5 (Unlocked)Google Pixel 3Google Pixel 2Google Pixel XLGoogle Pixel 2Motorola Moto G 4Dell Venue 8 7840Google Pixel 3 XLASUS Nexus 7 - 2nd Gen (WiFi)Google Pixel 4aGoogle PixelGoogle Pixel 3 XLMoto G7 PlayGoogle Pixel 4 (Unlocked)Google Pixel 4 (Unlocked)Google Pixel 3aGoogle Pixel 3Google Pixel 3a XLGoogle Pixel 5 (Unlocked)Google Pixel 3a XLGoogle Pixel 6 (Unlocked)Google Pixel 6 Pro (Unlocked)Google Pixel 4a** It seems that we do not actually have OnePlus One in the list of devices. The only Oneplus device I can find is OnePlus 8T. Please let me know if you are seeing differently on your end.Can you kindly test my device-pool-rules.json and see if this works for you in filtering the MODEL and MANUFACTURER? This is to confirm if there may somehow be an issue with these 2 attributes or perhaps if there is some combination of attributes which is leading to unexpected behavior.Can you also share your exact steps in creating the device pool? Is there any difference in how I created mine? Also, how are you checking the devices in the pool?CommentShareSUPPORT ENGINEERRyan_Aanswered a year ago0Thanks for your answer. I see now the problem.Indeed the options IN and NOT_IN are working, but my confusion is that when editing the pool from Device Farm->Mobile Device: Projects->Settings->Device pools, the devices I filtered out still show up in the list. But when I create a test run manually, in the "Select Devices", the created pool shows what I expected ( I also corrected the Model to OnePlus 8T).So I think it looks like a bug/limitation in the Edit the device pool page since I am not able to select IN nor NOT_IN options when creating a dynamic device pool (Model only accepts CONTAINS).And when created manually through the JSON, that page is not filtering out the models accordingly.Thanks again!CommentShareAWS-User-2849284answered a year ago"


Question: Two way trust with on-prem domain fails on AWS side

"I have an on premise domain controller i'm using to test migrating to Managed Microsoft AD.We have a site-to-site VPN up on our Meraki MX68 and it's active to our VPC where the domain controller lives and all traffic is allowed in and out for the on-prem IP subnet. I added the two way trust in the on-prem DC but when I try to add the trust to AWS it says the domain controller is unreachable. YET, I'm able to ping my domain controller, RDP to it and browse the directory from an instance in EC2 on the same subnet (once authenticated). the ONLY think I can't do is ping the secondary IP address of the managed domain because that tunnel is down BUT I can ping and reach the primary one.Subnet of VPC 172.16.0.0/24Subnet of on-prem DC 192.168.128.0/24Neither of these are publicly routed so i'm a bit confused. (Yes these routes are propagated in the routing table).What am I doing wrong here?ACLs and Secruity groups all have the same IP range allowed for the on-prem internal subnets inbound and outbound, Firewall is off on the domain controller that's on-prem, the IP I set for the conditional forwarder matches the on-prem DC.Any assistance would be greatly appreciated.FollowComment"

Answer: 0Here is our public documentation on how to troubleshoot trust creation failures.  It includes some common failure patterns.https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_troubleshooting_trusts.htmlAt the end of the document you will see a reference to this SSM document.  It was written by AWS support to help verify many settings that can block trust creation.https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-troubleshootdirectorytrust.htmlCommentShareJoeD_AWSanswered a year ago


Question: AWS linux forensic

"we have create three AWS linux AMI volumes (Xvda1, xvdf1, xdvf2)from 3 forensic snapshot. now i need to mount to forensic instance(already have xvda1 and xvdf1), should I mount the three volumes from compromised instance to xvda2, xvdf2, xvdf3 in sequence in the forensic EC2 instance?FollowComment"

Answer: "0From this distance it's not possible to say. It depends entirely on how they were mounted and how the original operating system used those volumes. If you intend to use the volumes in the same way as the original instance then they must be mounted in the same way on your forensic instance.CommentShareEXPERTBrettski-AWSanswered a year agoAWS-User-6667474 a year agocompromised instance:xvda1 ---/(mount point)xvdf1----/a (mount point)xvdf2-----/b (mount point)forensic instancexvda1----/(mount point)xvdf1-----/c (mount point)I can't mount xvda1 from compromised instance to forensic instance xvda1, because it will overwrite xvda1 partition, i should mount xvda1 from compromised instance to xvda2 of forensic instance or i should mount into xvdf2? as xvda1 is root partition in compromised instance.Share"


Question: Removed - Solved

"Removed - SolvedEdited by: talentize on Apr 3, 2020 11:14 PMFollowComment"

Answer: 0SolvedCommentShareaaronwhtanswered 3 years ago


Question: Where is my Amazon Workspace Web temporary storage?

"On the Workspaces Web portal config I've enabled file transfer permissions for upload/download and would like to share the attached user storage space wider - can't find the s3 bucket? If it's ephemeral, is there anyway to make it an s3 location?FollowComment"


Question: How to feed seed code to GitHub Repository from Sagemaker Projects Organization Template created with Service Catalog?

"The objective is to replicate "MLOps template for model building, training, and deployment with third-party Git repositories using Jenkins" builtin Sagemaker Project template. I want to feed custom seed code to the Github repository each time a project is created using my organization custom template instead of the default seed code that the builtin template feeds.I am able to create the custom template using service catalog but I could not find a solution for feeding the seed code to github repo. So, I decided to see how the built in project template is doing this and it is using resources from this bucket "s3://sagemaker-servicecatalog-seedcode-us-east-1/bootstrap/GitRepositorySeedCodeCheckinCodeBuildProject-v1.0.zip" but I could not access it. I am not sure how to achieve the objective?FollowComment"

Answer: "0Accepted AnswerYou can download the seed package using awscli s3 cp <s3_uri> <target_path> or by using this URL: https://sagemaker-servicecatalog-seedcode-us-east-1.s3.amazonaws.com/bootstrap/GitRepositorySeedCodeCheckinCodeBuildProject-v1.0.zipThis .zip is used by CodeBuild that is called when the template is deployed (by a lambda mapped to a CFN custom component). If you take a look in the template you'll find a component named "SageMakerModelBuildSeedCodeCheckinProjectTriggerLambdaInvoker". You can find some env vars defined for this component like: SEEDCODE_BUCKET_NAME and SEEDCODE_BUCKET_KEY. These vars point to an S3 uri that has another .zip file with the content of the seed for the git repo. If you get the default values defined there you can re-create the URL and download the .zip file as well:https://sagemaker-servicecatalog-seedcode-us-east-1.s3.amazonaws.com/toolchain/model-building-workflow-jenkins-v1.0.zipSo, in the end, if you want to change the content that is pushed to the git repo, you can redefine these 2 vars and point to an S3 path that contains a .zip file you created.Bonus: If you're a curious person, I recommend you to take a look at the .java file (src/main/java/GitRepositorySeedCodeBootStrapper.java) inside the .zip of the CodeBuild .zip for you to understand what it does to prepare the git repo like: download a .zip, unpack it, commit/push to the git repo.CommentShareSamir Araujoanswered a year agoUsman a year agoThanks a lot !!!Share"


Question: Unable to add Destination number in sandbox

"Completely green here .. I can't add a destination phone number for sandbox use. Yes my console state I am using a sandbox.  When I attempt to add a number I get an error stating that stating not having an origination number. This is the sandbox, am I missing something?I am associating this,lack of, sandbox number to the fact I can't get text message when I run the SDK example but I do get emailsThanks for the helpFollowComment"

Answer: "0Hi, according to this: https://aws.amazon.com/blogs/compute/introducing-the-sms-sandbox-for-amazon-sns/For sending SMS messages to Sandbox destination phone numbers in countries where origination identities are required, you must purchase an origination identity.So even in sandbox you need to set the origination identity. Follow that guide for clarification.Hope it helped and if it did, I d appreciate if answer can be accepted so that community can benefit when searching for similar issues, thanks ;)CommentShareEXPERTalatechanswered 3 months agorePost-User-6611312 2 months agoThanks for clarifying though how do I purchase an origination identity. I did manage to see a page that was allowing me to purchase a number (pinpoint) but not sure that is the correct action. And it was like $2/month.Share"


Question: Explanation for NODATA in VPC Flow Logs if there is no data

"The VPC Flow Logs log status has "NODATA: There was no network traffic to or from the network interface during the aggregation interval. ". But my customer is asking:Does that really mean there was no data, or just no data captured, for example too small, or between two interfaces it does not capture?If there is really no data, then what is the purpose of sending this status which fills up the logs? Should it be treated as a heartbeat?FollowComment"

Answer: 1Accepted AnswerNODATA means no data has been received on that ENI. In case of data missed or skipped in the capture a SKIPPED DATA message is published.The NODATA message allows you to know if an ENI is actively attached to an instance and receiving/not receiving traffic or is just available in a pool of ENI or was an old ENI whose flowlog data is still available but the ENI has been deleted.You can see the info about the type of records here: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.htmlCommentShareEXPERTagardezianswered 3 years ago


Question: Ensure batch_writer flush before read

I write with Python to a DynamoDB. I use batch_writer in a with block. After this block I do a query on the DB. But it seems the batch_writer not yet updated the table and I don't get the results writen by the batch_writer in my query.So how I can ensure that batch_writer written the data to DB before my query is running?FollowComment

Answer: "1Using boto3 batch_writer in a with block is the recommended method since on execution exiting the with block the batch_writer performs a flush of any items that were still in buffer. If you try to read the data that was just written, it is possible that you are making Eventually consistent reads (default for all read operations). Since DynamoDB replicates every item to 3 copies across Availability Zones, writes are deemed successful as soon as 2 out of 3 copies have persisted the write. The 3rd copy persists the data shortly after. If reading immediately after writing an item, your read request may be served from either of the 3 copies when using the default eventually consistent mode.If you have a use-case to immediately read after writing an item, consider using Strongly consistent reads only for those access patterns. That way DynamoDB would always serve your read request from the copy that has persisted all the writes and is most up to date (but also charge double the read units compared to eventually consistent reads).Query API - https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Query.html#DDB-Query-request-ConsistentReadRead Consistency in DynamoDB - https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.ReadConsistency.htmlThis may be the case here. Also, if you are reading from a Global Secondary Index after writing to the table, these only support eventually consistent reads, so you could either wait 10s of millis before reading data just written, or use 2 tables instead of a table + index and make TransactionalWrites to both tables in order to get latest items in a subsequent Strongly consistent read request.Hope this helps!CommentShareAman Dhingraanswered 6 months ago1When reading from a table right after writing to it, it may take a moment before you retrieve all of the desired output as it takes a second (or less) to update across all storage locations due to the fact that the data is eventually consistent [1].I would suggest you to use strongly consistent reads as DynamoDB will return a response with the most up-to-date data, reflecting the updates from all prior write operations that were successful [2].I would also suggest you to use unique names for your items as Batch Writer drops request items in the buffer if their primary keys(composite) values are the same as newly added one, as eventually consistent with streams of individual put/delete operations on the same item [3].Read Consistency:https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.ReadConsistency.htmlAPI Query: https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Query.html#API_Query_RequestSyntaxAmazon DynamoDB Boto3 Document:https://boto3.amazonaws.com/v1/documentation/api/latest/guide/dynamodb.html#creating-a-new-tableCommentShareYestoanswered 6 months ago"


Question: How to make an fps character with script canvas that collides with the terrain when moved not float through it?

"I want to make a character with script canvas, but every time I do it will go through all objects know matter if i add mesh collider or anything else any help? ThxFollow"

Answer: "0Accepted Answerwhat i did was use the starter game project in fact that has become my project home because i can always change all the names when i am ready to release my game. There is a character controller in it, play with it & spend time studying the lua scripts & the animation editor as for the script canvas take it slow, learning & experimenting with it, i don't even use it. Stick with the legacy stuff for starters the new stuff will sometimes not work right, anything legacy have a higher chance of being stable & anything new they come up with requires testing & time. Look at & play with all the game samples & establish a solid pipeline, know your DCC well & prepare all you assets before hand, i did all my characters, animations & other assets for the game before i started that made my game dev flow smoother.SharerePost-User-6748027answered 4 years ago0Thank you for the response it is very helpful.SharerePost-User-5598761answered 4 years ago0Hiplease see two lessons :Lesson09-Make a FPS_TPS-Part 01-ScriptCanvas node base-Amazon Lumberyard 1.18Lesson10-Make a FPS_TPS-Part02-ScriptCanvas node base-Amazon Lumberyard 1.18CheersAhmad Karamia computer teacher / a solo developer/ a gameplay programmer / a debuggerSharerePost-User-8224505answered 4 years ago"


Question: S3 content protection and deletion methods

"Hi there,I'm looking to compile a complete list of ways to protect data in S3 from accidental or malicious deletion.Assuming that Object locking is not in play, and that we can't rely on cross-region replication for a redundant copy, are there any other ways to completely destroy data aside from the following:DeleteObject API Call from an authenticated IAM principal (be that a role or a user)PutObject API Call over an existing object without object versioning in play.A lifecycle policy that deletes objects.The Root user issues a DeleteObject CallNote that in certain infrequent administrative circumstances, I will need to still be able to delete an object (So object locking with compliance mode is not usable here)In short, It appears that data can be protected from Administrators (: permissions on *) by doing the following (please confirm?):Either:Implement Object Locking in governance modeExplicitly Deny s3:BypassGovernanceRetention and s3:GetBucketObjectLockConfigurationEnable detective measures to undo these configurations.Prevent the root account from being usedOR:Explicitly deny s3:DeleteObject, s3:DeleteObjectVersion, and s3:PutLifecycleConfigurationEnable Versioning (to prevent overwrite)Enable detective measures to undo these configurations.Prevent the root account from being usedOR:Store a redundant copy of the object in a backup bucket and protect accordingly.Restrict IAM access completely to backup copyEnable detective measures to undo these configurations.Prevent the root account from being usedFollowComment"

Answer: "0Accepted AnswerThey all look good to me, one more way would be using MFA delete to protect your data.You can lock root out of that as well but as root user, you have permissions to delete bucket policies. So, you delete existing one and put a new one back.CommentShareAWS-User-3779086answered 2 years ago"


Question: AWS Amplify - Field Level GraphQL Auth on Required Fields

"I am trying to set up GraphQL via AWS Amplify so that all users can see part of a Member object (e.g. the name), but only members in certain groups can see other parts (e.g. the e-mail address).I have set up my schema.graphql as follows (note this is a truncated version):type Member @model(subscriptions: { level: off }) @auth(rules: [{allow: groups, groups: ["MANAGER"]}, {allow: private, operations: [read]}]) {  membershipNumber: Int! @primaryKey  firstName: String!  lastName: String!  email: String! @auth(rules: [{allow: groups, groups: ["MANAGER"]}, {allow: groups, groups: ["COMMITTEE"], operations: [read]}])  dietaryRequirements: String @auth(rules: [{allow: groups, groups: ["MANAGER"]}, {allow: groups, groups: ["COMMITTEE"], operations: [read]}])}As I understand it, all logged in users should be able to read membershipNumber, firstName and lastName. Users in the COMMITTEE group should also be able to read email and dietaryRequirements, and users in the MANAGER group should be able to read/write all fields.When I try to run a query as a logged in user with no groups though, I get an unauthorized error on dietaryRequirements (which is good) but I am able to read email without an error (which is bad).The only difference I can see is that email is a required field, whereas dietaryRequirements isn't. What am I doing wrong? Do required fields override the authorization rules?FollowComment"


Question: aws:marketplace:isv not in list of AWS generated cost allocation tags

"I am trying to turn on vendor metered tags, but when I navigate to the cost allocation tags page in Billing, it does not appear in the list for AWS Generated Cost Allocation Tags. How do I get it to appear in list so I can activate it? Thanks,FollowComment"

Answer: "0Hello,Greetings from AWS Premium Support !I would like to inform you that when it comes to the AWS generated cost allocation tags for Marketplace, the Marketplace resource would need to be active in order to see the cost allocation tag available in the billing console.Please check if the resource is in active state or not, In case, resource is active but you are still not able to see tags then I would like to request you please reachout to support team, they would be able help in detail.I hope this information is helpful.CommentShareSUPPORT ENGINEERShivam_Vanswered 2 months ago"


Question: "When exporting a bot in Lex v2 console, Amazon Skills Kit isn't an option in the Platform dropdown"

I'm trying to export a bot in from the Lex v2 console by following the instructions in Exporting to an Alexa Skill but Amazon Skills Kit isn't an option in the Platform dropdown. Is there something I need to do to make it appear?FollowComment


Question: "Creating EventBridge Bus, Lambdas and Security"

"I'm looking for sample C# code to create EventBridge Bus, Rules, a few Lambdas and IM Security Roles to access them. I prefer infrastructure as code versus cloud formation script.FollowComment"

Answer: "1Accepted AnswerConsider AWS Cloud Development Kit (CDK) for this, as it supports the C# programming language. CDK helps you concentrate on your resources by automatically implementing some aspects such as adding IAM permissions and defining the dependencies. AWS CDK synthesizes a CloudFormation template as a final step, so you don't have to write it manually. The CLI tool can also deploy the synthesized CloudFormation stack for you so you don't even have to care about uploading assets used in your stack - this will be done for you.In this GitHub repository, you can find some examples of CDK projects demonstrating the usage and the project structure - for various programming languages, including C#.For example, the RandomWriter project shows you how to configure an EventBridge rule, a Lambda function, and a DynamoDB table, including required IAM permissions.The LambdaCron example is a tiny one but also shows you how to connect a Lambda function to an EventBridge rule.Creating a custom EventBus can also be done very easily. Here's a code snippet to give you an idea how to do that. Note that all the required (basic) IAM permissions will be automatically created and attached by CDK for you.using Amazon.CDK.AWS.Events;using Amazon.CDK.AWS.Lambda;using Targets = Amazon.CDK.AWS.Events.Targets;// adding a Python function as an example here,// but you can also use C# for the Lambda code for surevar myLambda = new Function(this, "MyEventProcessor", new FunctionProps{    Code = new InlineCode("def main(event, context):\n\tprint(event)\n\treturn {'statusCode': 200, 'body': 'Hello, World'}"),    Handler = "index.main",    Runtime = Runtime.PYTHON_3_7});// a custom event busvar eventBus = new EventBus(this, "MyLanguageBus");// an EventBridge rule attached to the custom event busnew Rule(this, "LambdaProcessorRule", new RuleProps{    EventBus = eventBus,    EventPattern = new EventPattern { Source = new[] { "com.amazon.alexa.english" } },    Targets = new[] { new Targets.LambdaFunction(myLambda) }});CommentShareDmitry Balabanovanswered a year ago1Why not use CDK.CommentShareEXPERTUrianswered a year ago"


Question: [RDS] Mandatory OS update but no maintenance in console?

"Hello,I received an email from AWS saying I have an mandatory OS update for my RDS (MariaDB) in N.Virginia.I have checked the Maintenance & backups section in the RDS console but found no OS update. There is only "Auto minor version upgrade".I also have checked AWS Health Dashboard but found nothing on the "Open and recent issues", "Schedulled changes", "Other notification", and "Event log". They are all zero.I also have checked the result of the command "aws rds describe-pending-maintenance-actions" and the result was:{"PendingMaintenenaceActions": []}I also have read the post ( https://repost.aws/questions/QUM7E7C5aaSsWZejFs2ev3zQ/rds-os-update-is-available-don-t-see-it-in-rds-dashboard ) but I'm still not sure what was going on.Is the content of the email wrong or should I check it somewhere else?What should I do?FollowComment"

Answer: "0Accepted AnswerHello,The operating system update is required for your DB instance based on it's DB engine version and DB instance class of your DB instance automatically.If an OS update is required for your DB instance based on it's DB engine version and DB instance class, the required update appears in the AWS Management Console. For further clarification on this, please visit Recommended actions for mandatory operating system updatesPlease refer to this AWS Document  to see instance types and engine versions that are eligible.Follow the instructions in Applying updates for a DB instance.Updates specific to MariaDB, can be found hereI hope the provided information above is helpfulCommentShareLungaanswered a year agoDandySystem a year agoI updated the db version and the OS update has been appeared! Thank you. :DShare"


Question: A query that runs by itself in Athena fails to run when I add CREATE TABLE table_name AS on top of it due to a 'GENERIC_INTERNAL_ERROR: field ended by ';': expected ';' but got 'id' at line 1...'

"When I run the query (I have reduced the column names and airport codes in the query to reduce your scrolling time) below in Amazon Athena it runs and I get no problems or error messages:SELECT "loc id", "runway id", "icao id", "length", "width", "surface type condition", "edge light intensity"FROM  "runway_db_athena"."runway"WHERE  "loc id" IN ('09J','14A','18A','1V6','22S','2I0','2R4');However, whenever I then try to store this result as a temporary session table so I can perform joins on it with other queries and only have to download the results of those joins using this:CREATE TABLE dash_runs_table ASSELECT     "loc id", "runway id", "icao id", "length", "width", "surface type condition", "edge light intensity"    FROM      "runway_db_athena"."runway"    WHERE      "loc id" IN ('09J','14A','18A','1V6','22S','2I0','2R4');I end up with this:GENERIC_INTERNAL_ERROR: field ended by ';': expected ';' but got 'id' at line 1: optional binary loc id. You may need to manually clean the data at location 's3://realagnifuegos3bucket/Athena-output/create%20dash_runs_table/2023/04/16/tables/230fe35a-e3fc-4b4c-aa46-b6c88efbd8f3' before retrying. Athena will not delete data in your account.This query ran against the "runway_db_athena" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: 230fe35a-e3fc-4b4c-aa46-b6c88efbd8f3I have absolutely no idea what's going on there^^, I am still quite new to AWS, BUT, I am fairly decent with SQL, so, I went back and changed that first , after "loc id" to a ; just to see what would happen and this is the Error Message I got back this:Only one sql statement is allowed. Got: CREATE TABLE dash_runs_table AS SELECT "loc id"; "runway id", "icao id", blah blah blahThat^ is exactly what I was expecting to get, but not what I was hoping to get because that means I REALLY don't understand the error message! How is it expecting a semicolon, but then it complains when I give it one?p.s. For the record, I also tried out my second temp table creating query which is extremely similar and the same thing happened! Here it is:CREATE TABLE dash_air_scheds ASSELECT "loc id", "schedule" FROM airport_schedulesWHERE  "loc Id" IN ('09J','14A','18A','1V6','22S','2I0','2R4');And I got the same Error MessageGENERIC_INTERNAL_ERROR: field ended by ';': expected ';' but got 'id' at line 1: optional binary loc id. You may need to manually clean the data at location 's3://realagnifuegos3bucket/Athena-output/Unsaved/2023/04/16/tables/21f94497-b6bf-4755-ba7d-43d03ed9cc17' before retrying. Athena will not delete data in your account.This query ran against the "runway_db_athena" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: 21f94497-b6bf-4755-ba7d-43d03ed9cc17FollowComment"


Question: Accidentally limited permission of my IAM user

"New to AWS, very embarrassing situation.While playing around with IAM to try and set the appropriate permissions from IAM user for lambda, I ended up limiting my permission in a way that now prevents me from doing anything in AWS Management Console, including resetting/deleting/updating my permission or new users. Maybe there is a way and I just don't know, but after scouring around for 30 minutes, I decided to ask the question here if anyone had any suggestions.Requests have been sent to Customer Support.FollowComment"

Answer: "3Accepted AnswerIf you limited IAM user and there is no IAM user/role to change the policy back, you should try to use root account. When you create new AWS Account, you registered email address. You can log in with the email address as root and the root has all permission you need.Once you change the IAM policy using root account, you should logout root account and then try to log in with IAM user.CommentShareEunsu_Shinanswered 6 months agoEXPERTTushar_Jreviewed 6 months ago1Hi,Do you have access to the account root user? If yes, you can adjust the permissions.Best regards,Ricardo MakinoCommentShareRicardo_Manswered 6 months ago"


Question: CIsco AnyConnect and AWS Client VPN

Is Cisco Anyconnect supported as client of our AWS Client VPN service?FollowComment

Answer: 0Accepted AnswerNo. AWS Client VPN only supports OpenVPN based clients only and afaik Cisco Anyconnect isn’t compatible with OpenVPN implementation.CommentShareEXPERTShakeel_Aanswered 4 years ago


Question: cannot fetch s3 data in china by SDK

"Hi support,When we using SDK to achieve s3 fetching document by SDK, it prompt up endpoint= https://s3-ap-southeast-1.amazonaws.com/ is not a safe link and it cause cannot download. It cannot access in china. But it can achieve data in HK.FollowComment"

Answer: "1This could be due to internet connectivity issues or internet censorship from China. What you could potentially do is reroute the endpoints to a region that beijing or ningxia regionBeijing Region: https://s3.cn-north-1.amazonaws.com.cnNingxia Region: https://s3.cn-northwest-1.amazonaws.com.cnIf the problem still persists, i recommend contacting AWS supportCommentShareAWS_Guyanswered a month ago"


Question: how to get folder id by folder full path using WorkDocs API

"I want FolderId by given folderPath, for Example:My Docs\Publish\demo1I have RootId for that User.Is that possible to get the Folder by prefix in Describe folder Content API?If I try to check hierarchically,  I had to Apply to For loops :One for Path,Second, check the name of the correct one.Is That Any way to find the id by a prefix of any simpler and less time-consuming solution?FollowComment"


Question: Cognito Authentication flow session timeout stuck at hosted UI

"Hello,My Cognito user pool has the following configuration:Login with GoogleAuthentication flow session duration: 3 minutesThen, I have a login page (using Amplify) hosted at: https://login.example.com/ . The federated login with Google works fine except in the following case:I wait at the select Google Account screen for 3 minutes (waiting for the authentication flow session to expire)Then, select the Google Account to login.Expected result: the login failed, and the browser should redirect to https://login.example.com/Observed result: the login failed, and the browser redirected to hosted UI with an error message Something went wrong. Please try again. In the URL, I can see the param redirect_uri is https://login.example.com/In this case, how can I make Cognito redirects to https://login.example.com/ instead of the hosted UI?Thank you.FollowComment"


Question: AWS Openseaarch Support for cold_migration and cold_delete

"Hi,The AWS docs at https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ism.html#:~:text=OpenSearch%20Service%20supports%20three%20unique%20ISM%20operations%2C%20warm_migration%2C%20cold_migration%2C%20and%20cold_delete state there are 3 special actions supported by ISM for Amazon OpenSearch Service:OpenSearch Service supports three unique ISM operations, warm_migration, cold_migration, and cold_delete.However, I can only see warm_migration in the OpenSearch Policy Management Visual Editor. See https://imgur.com/a/kzZscksIf I use the API to create a policy including cold_migration and cold_delete, it succeeds, but I can't view it in the UI. So I am unsure if this is really supported, or if the UI hasn't been updated to reflect this.Curious to hear others thoughts on this.FollowComment"

Answer: "1See the sample policies. It gives examples to all 3 actions you mentioned.CommentShareRoianswered a year agocaptainfalcon23 a year agoYes I had already reviewed that. Anyways, I discovered that the cluster did not have cold migration enabled which is probably why it wasn't appearing in the list. Seems like a bug still though that open search let me import the config which it did not support.Share"


Question: Auto-scaling on AWS OpenSearch?

I am looking for documentation on Auto-scaling using AWS OpenSearch?I found the following article on scale up/down but nothing on auto-scaling.Any information on how to perform auto-scaling using OpenSearch for elasticsearch will be helpful. We currently use Elasticsearch 7.8 and planning to migrate to AWS OpenSearch.FollowComment

Answer: 0Does this link that talks about steps to scale up or scale down Opensearch help?https://aws.amazon.com/premiumsupport/knowledge-center/opensearch-scale-up/There is also an youtube supporting this article - video https://www.youtube.com/watch?v=TPe62u4_6IECommentShareAnanth Tirumanuranswered 8 months agoEXPERTFabrizio@AWSreviewed 8 months ago


Question: DeviceFarm Job Errored with all suites in Pending status

"We submit test suites to be run on iOS devices on DeviceFarm. Out of ~60 runs daily, 1-2 fail with no details or logs. The run's status is "Errored", and all suites in the run have status "Pending".What do you recommend we do for debugging this further? There are no files generated for these runs, and Logs never load.FollowComment"


Question: Greengrass v2 Local Shadow Service

"HiI have already running POC with GG1 inside. For my case it's important to have connected devices and local shadow service. In docs I found that GG2 is not supported this features now: https://docs.aws.amazon.com/greengrass/v2/developerguide/move-from-v1.htmlyou won't be able to run them on the v2.0 software yetJust wanted to know if there any plans to migrate this features into GG2, or I should still use GG1 ?FollowComment"

Answer: "0Accepted AnswerIt is our intent to bring the same capability to V2.DavidCommentShareAWS-User-0306200answered 2 years ago0Thanks, DavidCommentSharekulex4answered 2 years ago"


Question: "Given a service name from SDK/API, where could I get the user friendly title and/or description?"

"While working across multiple AWS accounts that leverage different AWS Services, I can pull those services using the SDK/API's but get lists like:acmdaxecrecskmsHowever the consumers of this data are not AWS experts - Is there a consistent way to get the user-friendly title and/or description for any given service using the identifiers from the SDK/API's?(even a website that can pass a param of the value to get the title and/or description would be a possible workaround)Thanks!FollowComment"

Answer: "1Hi,Thank you for contacting AWS re:Post !Going through the issue, I could confirm that retrieving user-friendly title and/or description for any given service using the identifiers from the SDK/API's is not supported yet .I apologize for the service limitation and have forwarded the feedback to the service team.I can't provide you with an ETA for when the feature will be released, however if it's released, it should be announced in the AWS What's New blog below:https://aws.amazon.com/new/CommentShareSUPPORT ENGINEERAnsh_C answered 8 months ago"


Question: aws resource types vs custom resources

"My customer is looking to enable Infra As Code for some 3rd-party resources external to AWS using Cloudformation. It looks like there are 2 ways to do this:https://aws.amazon.com/blogs/mt/managing-resources-using-aws-cloudformation-resource-types/This blog posts appears to heavily favor resource types over custom resources.Using cfn-cli to run through an example using a resource type in Go, but the generator crashes when running “cfn-cli init”.  Seems to be a Windows-specific issue.They looked for an already-generated example of a Go resource type on Github under the aws-cloudformation org, but couldn’t find any. It was also unclear whether interactions with resource types using the CDK is possible. Is this possible using the CfnResource construct?Are resource types really ready for prime-time, or should they fall back to custom resources?Thanks!FollowComment"

Answer: "0Accepted AnswerHello,Basically custom resource timeout is capped to 1 hour.But even though custom resource is capped to 1 hour, lambda can only run for 15 mins. So basically for lambda backed CR its 15 mins. SNS backed CR signal should be sent within 59 minutes and 59 seconds but as Christian suggested, you can make use of CloudFormation registry it can be upto 36 hours.In summary - Lambda backed CR - 15mins SNS backed CR - 1 hour CFN Registry - upto 36 hoursYes, resource types are ready for prime-time. Custom resources have their own use-case.If their use-case requires compute/logic that takes less than 1 hour to execute, then custom resource would be the go-to solution.But in case they want to have a pure resource kind of experience which also does drift detection, etc. then its better to use CloudFormation registry.Hope this helps :)CommentShareAWS-User-2155123answered 3 years ago"


Question: How can I verify my AWS account?

"I tried to create an AWS CloudFront Distribution service but got the message "your account must be verified before you can add new CloudFront resources".I had verified my email during creation of the account and I believe that is what they are asking for.In this type of case, what do I do?FollowComment"

Answer: "0Hi, @rePost-User-kozzii.Try the following CloudFront limit increase requests.https://repost.aws/questions/QULXHEAzC7Sai6_LTLNYn83Q/your-account-must-be-verified-before-you-can-add-new-cloud-front-resourcesCommentShareEXPERTiwasaanswered 5 months ago"


Question: ETL using Aws Data Glue

"I want to extract data from my PostgreSQL on RDS using Aws data glue, transform the data and export the data to s3 bucket. how do i do that.  i need an AWS tutorial on this.FollowComment"

Answer: "0tutorial on how to extract data from PostgreSQL on RDS using AWS Data Glue, transform it, and export it to an S3 bucket. Here are the 50 detailed steps by chatGPT:Log in to your AWS Management Console.Navigate to the AWS Glue service.Click on the "Crawlers" tab in the left sidebar.Click on the "Add crawler" button.Give your crawler a name.Select the "Data stores" option as your data source.Choose "JDBC" as your connection type.Enter the connection details for your PostgreSQL RDS instance.Click "Next."Select "Choose an existing IAM role" and select the role that has permissions to access your RDS instance.Click "Next."Choose "Specified path in my account" as the crawler output.Enter a path in your S3 bucket where you want the crawler output to be stored.Click "Next."Select "Add database" and enter a name for your database.Click "Create an IAM role" and enter a name for your role.Click "Next."Select "No" for the option to add another data store.Click "Next."Select "Run on demand" as the frequency for your crawler.Click "Next."Review the details of your crawler and click "Finish."Wait for the crawler to finish running.Navigate to the "Jobs" tab in the left sidebar.Click "Add job."Give your job a name.Select the IAM role that has permissions to access your S3 bucket.Choose "Spark" as your ETL language.Select the output S3 bucket and folder where you want the transformed data to be stored.Click "Next."Choose "Use for transform" as your data source.Select the database and table that you want to extract data from.Click "Next."Choose "Change schema" as your transform type.Use the schema editor to modify the schema of your data as needed.Click "Next."Select the "Glue generated script" option for your script options.Click "Next."Review your job settings and click "Finish."Wait for your job to finish running.Navigate to the S3 bucket where your transformed data was stored.Verify that the data is in the correct format.Navigate back to the AWS Glue service.Click on the "Triggers" tab in the left sidebar.Click "Add trigger."Choose "On demand" as your trigger type.Give your trigger a name.Choose your job as the action.Click "Create trigger."Run your trigger to extract, transform, and export your data to the S3 bucket.I hope this tutorial helps you extract data from PostgreSQL on RDS using AWS Data Glue, transform it, and export it to an S3 bucket. If you have any questions or need further assistance, please let chatGPT to knowFor a more detailed walkthrough of these steps, including screenshots and code samples, you can follow this AWS tutorial: https://docs.aws.amazon.com/glue/latest/dg/getting-started.htmlCommentShareZVanswered a month ago0Hello, it is not difficult, but need some steps with AWS Glue.Create a Glue Crawler to crawl the RDSCreate a ETL job to transform and write the transformed data to S3Need to setup a RDS connectionNeed to setup a IAM role for the Crawler, and ETL job so it can write data to S3I have a tutorial here but it is written in CDK HERE and GitHub.CommentSharehaianswered a month ago"


Question: Server stuck Stopping

"I have an instance that is stuck in the stopping state:Instance: i-1c0c8798I have forced stopped via EC2 ConsoleWe have attempted to restart via CLI as well.Volumes are stuck as "attaching" and not able to create snapshot of root drive.Tried:{"StoppingInstances": [    {        "InstanceId": "i-1c0c8798",        "CurrentState": {            "Code": 64,            "Name": "stopping"        },        "PreviousState": {            "Code": 64,            "Name": "stopping"        }    }]}Response:aws ec2 stop-instances --instance-ids i-1c0c8798 --forceWe are aware of the power outage situation, however this is only affecting one of our servers and is still continuing after the power issue seems to have been resolved.FollowComment"

Answer: "0Accepted AnswerInstance finally stopped and was able to be started again.CommentShareShopWorksMariaMaddoxanswered a year ago0Hi ,Can I request you to try the following:Filter your EC2 instance in the EC2 dashboard using instance-idSelect your instance, click on Actions => Monitor and troubleshoot => Get system logThe system log will give you leads onto why your instance is still stuck in the stopping statePlease do share the system log as an attachment if possibleRegards,Ramu Mohan Srinivasan RadhakrishnanCommentShareRamu Mohan Srinivasan Radhakrishnananswered a year agoShopWorksMariaMaddox a year agoThe system log shows a blank black box.  Refreshing does not yield any changes or results.  I'm unable to use the connect button.Share0Can you help me with additional information ?In which AWS region is the EC2 instance located ?Are you able to connect to this instance from your local computer using Windows/PuTTY and /or Linux/SSH using a keypair ?Can you check if there are any ongoing issues in the AWS region the instance is located by visiting AWS Service Health dashboard https://status.aws.amazon.com and then navigating to the region specific tab ?CommentShareRamu Mohan Srinivasan Radhakrishnananswered a year ago"


Question: How did you teach yourself lambda functions and documentsdb

"Hey, I'm an intern trying to help my company get their Software ready for AWS.My task is to write Lambda functions that do queries/insert/etc in a DocumentDB.I have the DocumentDB running, also created a few test Databases via mongoshell.But I can't get a single function to fetch anything from this database.I just can't get these lambda functions to run.Do you have any tips what I should read ? How did you approach this? What should I study?For any tip, I would be grateful!GreetingsFollowComment"

Answer: "0Take a look at this: Creating a REST API for Amazon DocumentDB (with MongoDB compatibility) with Amazon API Gateway and AWS Lambda.CommentShareEXPERTkentradanswered a month ago0I would recommend taking the free AWS provided lambda course it will walk you through many of the basics.There also many How To GuidesAlthough not identical there is Example Project of using Lambda to connect DynamoDBAlthough covered in training I like to make sure I have a machine configured correctly for development before I start.There are MANY tools for .NET Development with AWSNote some of this is covered in the above training.I install the following:Install Visual Studio Tool Kit in Visual StudioInstall Visual Studio Tool Kit in Visual Studio Code using Extensions PanelInstall AWS Command Line Interface (AWS CLI) and make sure you can authenticateDotNet Gobal Tool for AWS Lambda dotnet tool install -g Amazon.Lambda.ToolsAlthough .NET 7 is the latest I find it easier to use .NET 6 initially, as it is a built in already supported runtime.   Once you have execution with .NET 6 you can look at a custom runtime image to do .NET 7.I typically test my lambdas locally before moving to AWS.   To do that I use the Mock Lambda Test Tool found in the tool bar of Visual Studio.    It will launch a browser window where you can send whatever you want to your lambda function and be able to step through it.There is much more, I would encourage you to spend some time exploring the .NET on AWS Site to become familiar with the resources available.CommentShareRobert Loveanswered a month ago"


Question: Creating duplicated folders each run

"Every time the ETL job runs, the same folders are created in the S3 buckets, how can I avoid it?FollowComment"


Question: How to delete old files deployed in S3 with CodePipeline

"Hi, we have a CodePipeline that we use to deploy our static website. We have it configured to be triggered whenever a zip file is dropped in a specific S3 location, following this: https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-s3deploy.htmlThe problem we have is that we publish some documents to the website, which after some time will have to be deleted from it. With the current behaviour, we will push a new zip file without those files that have to be deleted, but since the pipeline will not delete those files, they will still be available.e.g.We will deploy our website with a new job post. When the user goes to https://www.my-website.com/careers/senior-developer it will access the file careers/senior-developer.html in our bucket.A few weeks later, redeploy the website removing that job post. Because the pipeline doesn't delete any files, a user could still go to https://www.my-website.com/careers/senior-developer and still access the file.What's the recommended way of dealing with this issue?Thanks in advanceFollowComment"

Answer: "1Yes - files are not deleted automatically from S3 as per tutorial Note: "Even if you delete files from the source repository, the S3 deploy action does not delete S3 objects corresponding to deleted files."Depending on the availability requirements of the website (need more details).Option 1:Assumption: you publish the whole website with all the documents every time.The best way to handle this situation - is to cleanup the bucket before each deploy. You could leverage "build stage" that you skipped in the tutorial - to issue the [AWS CLI S3 command]: (https://docs.aws.amazon.com/cli/latest/reference/s3/) aws s3 ...  to cleanup the bucket.Tip: You could improve the smoothness of the process if you enable CloudFront with caching of the S3 as origin for website content. In this case during "website" cleanup on S3 - CloudFront still have the cached version, and users can access that, but after TTL for cache expires on CF - it'll route to S3 origin and files on S3 won't be available. (that's what you expect).Option 2You don't delete the whole website on s3, but you compare the diffs on current build with previous tag in Git and looking for files/folders being deleted - and via script generate list of files that needs to be deleted correspondingly from S3.CommentShareEXPERTAleksandr Iziumovanswered a year agojcabrera a year agoThanks for the quick response and the options, Aleksandr.The issue we will have with Option 1 is that our pipeline is deploying the site to three different environments, so it will look like this:Source > Build > DeployToDev > DeployToQA > DeployToProdIn this case, we cannot do the cleanup of the three buckets in the Build stage, because it's possible that the transitions to prod have been disabled for QA to do some manual testing. I guess we can have a build stage before each deployment stage, and that can delete the files in the bucket just before the new deployment.We already have cloudfront in place, so that would help us to make the deployment smoother.Option 2 feels a bit hacky in my opinion, so we will probably go for some variation of option 1.Thanks again.Share1I had to create a custom AWS construct to replace S3DeployAction to deploy to S3 and delete old files. The construct diffs the changes using a lambda function to delete old files and upload new files to S3. You can use the Typescript construct from here.CommentShareMunim Munnaanswered 3 months ago0I have been working using AWS Amplify as a contained solution and alternative for a static website. Every commit/PR on the repository starts a pipeline. It is important to understand storage size cost in comparison with S3 and service costs. There is a quick tutorial at > https://aws.amazon.com/getting-started/hands-on/host-static-website/ if you are interested trying it out. Hope that helps!CommentShareAWS-rdrmoanswered 2 months ago"


Question: AWS ECS VPC subnet

"Hi Guys,I am planning to attach my ALB with service in ECS cluster with Fargate configuration,.When I created Cluster it asked me to create VPC with default configuration, during creation I saw that it is also attaching IGW too.Now I don't have any idea if this VPC has public or private subnet when I am on cluster View. Never asked me any option question during creation.Can somebody tell me how can I keep my cluster in private subnet which I already have? Do I have to create VPC during cluster creation or In case I do not create VPC what is happening, I am getting lost in the interface.I mean if I have an VPC already and ALB in it, and cluster is creating new VPC with its own public and private subnet, how am I supposed to bind my ALB in my VPC to the services in newly created VPC that has cluster which holds my task and services?Screen should give me better understanding about the structure.Can I create cluster in my existing private subnet or no, what is the best practice for this?any documentation will be very helpful, thanksThanksFollowComment"

Answer: "0Accepted AnswerHi!So when you create a default vpc its created with the following components, which includes a IGWhttps://docs.aws.amazon.com/vpc/latest/userguide/default-vpc.html#default-vpc-componentsYou will have to check in VPC to see what subnets were created on your behalf by going to the VPC console.If you want to use an existing VPC/Subnet that is private you specify this at cluster creation, by selecting the VPC from the drop down.https://docs.aws.amazon.com/AmazonECS/latest/developerguide/create_cluster.htmlCommentShareAWS-Aaron-Sanswered 3 months agoozy cozy 3 months agoSeems like it is more clear in new the Interface, I was using old interface to follow some of youtube videos. Thank you.Share0For setting up an ALB to your tasks, here is step by step processhttps://docs.aws.amazon.com/AmazonECS/latest/userguide/create-application-load-balancer.htmlYou have two options utilize the existing ECS cluster and spin up an ALB to attach to that task or recreate cluster in VPC where ALB lives and then attach task. Since you want this to private might be best to delete ECS cluster and spin up in correct VPC then attach task as targets for ALB (ensure your ALB properly setup per above documentation).CommentShareAWS-Aaron-Sanswered 3 months agoozy cozy 3 months agoCurrently I don't have any cluster, so I need to create one, just would like to make sure it is in the private subnet. Just trying to apply best practice and where to start. I already have ALB and can create target group(IP address) which I can attach my cluster.Share0There are a few components here that may be in focus.It sounds as though you are using the awsvpc task definition.  In this case you must create a vpc, subnet, and security group for the service.  This is in AWS documentation hereIf you are using task types bridge, host, or none, you can find information about using your configured load balancers hereHope this helps!CommentShareAWS-User-0357409answered 3 months ago"


Question: Amplify Studio - using Data tab to create new model with custom Partition Key

"New to AWS and Amplify.Whenever I try to add a new model to my project, I see id is pre-populated without the option to delete, and is also the Partition Key. How do I change this so that I can set a custom Partition Key for my new model?FollowComment"


Question: Scan entire dynamo db and update records based on a condition

"Hi,We have a business requirement to deprecate certain field values. So we need to scan the entire db and find these deprecated field values and take the last record of that partition key(as there can be duplicate records for the same partition key), then update the row. Right now the table contains around 600k records. What's the best way to do this without bringing down the db service?This is a one time activity. As this will take time, we cannot run this in a lambda since it will exceed 15minutes.FollowComment"

Answer: "0Hello - if I understand correctly, you have a table with composite primary key (partition key and sort key), so the content is a large number of item collections - each in sorted order.  You want to find the last item in each collection, and if it has a particular attribute you want to update that last record to remove the deprecated attribute.You should be able to do this in a controlled manner using Scan - to avoid competing with throughput you use for regular production load, use the Limit parameter to Scan in small pages.  Loop through this and introduce a suitable delay in each iteration of the loop.  In your loop, identify the first item you see for a new item collection - the item right before it is the last in the prior item collection.  Check to see if it has the deprecated attribute, and if it does, issue an UpdateItem call where the update expression applies the REMOVE function for the deprecated attribute - you can condition this on the item still existing (just to make sure some other thread has not already deleted it).Conceptually I think this process should work - I would encourage you to test outside of production first of course.CommentShareAWS-User-9190687answered 3 years ago0Thanks for the inputs PeteNaylor-AWS. Can you also give an idea where we would need to run this? Should we go for Lambdas?CommentSharegeethuunnikrishnananswered 3 years ago0I'm not really an expert on compute choices sorry, but I would imagine this can be solved in an EC2 instance, a container, or perhaps broken out across many Lambda invocations.  Depending on the use case, my go-to would be to construct a tool (perhaps a Python script since that's familiar to me) and run it on an EC2 instance.  There are many options and approaches available - the best choice in tooling might just be what you are most comfortable with.CommentShareAWS-User-9190687answered 3 years ago0Thanks PeteNaylor-AWS, We discussed as a team and thought of EC2 running python script too.Thanks a lot for your inputsCommentSharegeethuunnikrishnananswered 3 years ago"


Question: "Migrating Azure SQL Database, getting error: Failed to get indication whether cdc is enabled."

"I am having trouble getting one specific Azure SQL Database source endpoint working. When I use the Test Connection feature of the Endpoint, I get the following error:Application-Status: 1020912, Application-Message: Failed to get indication whether cdc is enabled. No data returned., Application-Detailed-Message: RetCode: SQL_ERROR SqlState: 42000 NativeError: 40515 Message: [Microsoft][ODBC Driver 17 for SQL Server][SQL Server]Reference to database and/or server name in 'rdsadmin.dbo.rds_show_configuration' is not supported in this version of SQL Server. Line: 1 Column: -1I have successfully migrated about a dozen other Azure SQL Databases, it's just this one in particular that gives the error. Other databases on the same Azure SQL Database server instance work, other database on other servers work, other databases that also have an active Azure SQL replication to another Azure region work. Even a copy (done via the Azure portal) of this database to the same server works. The SQL compatibility version of this database is 140 - again, like all the other ones that work.Migrating the copy of this database I made might be a workaround, but creating the copy in Azure takes about 50 minutes and we can't afford that downtime.I feel like this a very specific bug or incompatibility, is there anyone on the DMS team who can help out?FollowComment"

Answer: "0Hi Paul, could you possibly try disabling and re-enabling CDC on that DB (https://learn.microsoft.com/en-us/sql/relational-databases/track-changes/enable-and-disable-change-data-capture-sql-server?view=sql-server-ver16), and try it from another admin user account, i.e, not your current one.Let us know if this works!CommentShareThiru Aanswered 5 days agoPaul Donovan 4 days agoHi, I don't have CDC enabled on any of the databases, because DMS doesn't currently support using it on Azure SQL. But I tried turning it on, then disabling it. I also tried enabling it again. Neither helped. I tried creating another SQL user with db_owner role and used that in the connection, still the same error unfortunately.Share"


Question: dbus with Greengrass

"Hi,I want to use bus.get("org.freedesktop.ModemManager1", "/org/freedesktop/ModemManager1/Modem/0") to get the gps data.1/ I am just wondering is there a way to use dbus in gg container?.2/ I tried the lambda without container and it works just find. Yet, is there any security difference between using container and non-container?Thank youFollowComment"

Answer: "0Hi nhatnhan,I'm not an expert on dbus. Are you trying connect from inside lambda container to the daemon running on bare host? If you are aware of all the devices and volumes required for the connection, you can try mounting those as local resources inside the lambda container. Please attach the error logs if you run into any issues.In general, you can enforce stricter access control in container mode than in process mode. In container mode, you need to explicitly grant lambda access to host resources, e.g. devices, volumes, while in process mode, access to host resources are protected by posix file permissions. However, I wouldn't be too concerned about security if you own both the lambda and the device, since you have full control of the lambda code logic.Hope this answers your question.Thanks,HuiCommentShareAWS-User-5233880answered 3 years ago0cool thank youCommentShareAWS-User-6797102answered 3 years ago"


Question: Error while deploying Elasticbean stalk with EFS mounting

"Hi,I am trying to deploy Flask based application with Elascticbean with additional config file for mounting EFS. I am getting below error and deployment is failed. Please help.2022-12-30 15:24:57,931 [ERROR] Command 01_mount (/tmp/mount-efs.sh) failed2022-12-30 15:24:57,932 [ERROR] Error encountered during build of prebuild_0_efs4_tutorial: Command 01_mount failedTraceback (most recent call last):File "/usr/lib/python3.7/site-packages/cfnbootstrap/construction.py", line 579, in run_configCloudFormationCarpenter(config, self._auth_config, self.strict_mode).build(worklog)File "/usr/lib/python3.7/site-packages/cfnbootstrap/construction.py", line 278, in buildself._config.commands)File "/usr/lib/python3.7/site-packages/cfnbootstrap/command_tool.py", line 127, in applyraise ToolError(u"Command %s failed" % name)cfnbootstrap.construction_errors.ToolError: Command 01_mount failed2022-12-30 15:24:57,934 [ERROR] -----------------------BUILD FAILED!------------------------I tried to with below changes in mount.config file but still the same error.EFS_MOUNT_DIR='/efs'EFS_FILE_SYSTEM_ID='fs-xxxxxxxx'Regards,DeeptiFollowComment"

Answer: "0Accepted AnswerResolved this issue, the problem was instance and EFS were created in different AZsCommentSharerePost-User-8055548answered 5 months ago"


Question: SES dedicated IP related to specific verified identities.

I have several verified identities in the SES service. I order a dedicated IP and I want this dedicated IP to not be used by all verified identities in my account but I want it to be used by 3 of my verified identities. How to achieve this goal?FollowComment

Answer: 0Accepted AnswerCreate a configuration set in SES and assign the IP pool. Update your verified identifies to use the respective configuration set.CommentShareManikandananswered 10 months ago


Question: Cannot delete network interface?

"I was charged 80 for some services which I was not aware of. When trying to delete anything, I was always get error Network interface is currently in use. How can I delete this?FollowComment"

Answer: "0More information, i.e. what service would be helpful I guess.You can find the ENIs your account uses under the EC2 service page.Apparently a service was created that is using it, maybe a VPC endpoint, that you need to delete first?CommentShareMarcoanswered a year ago0Try this:First go to the EC2 service dashboard, then select the "EC2 Global view" menu -There you'll have two menu options, Region Explorer and Global Search.You'll be able to see what you've currently deployed in AWS and certainly spot your instance or service you're interested by.RegardsCommentShareAWS-ADolganovanswered a year ago0I was able to connect with AWS support chat. Extremely patient and helpful. Ultimately, it was a database I had running in another region. Once I deleted that, I was able to delete VPC no problem. So problem resolved. Is there a screen of all running services that would be helpful in similar situations?CommentShareAWS-User-6146121answered a year ago"


Question: Cannot access the workspace using workspace client or RDP

"HiI have workspace which user cannot access anymore with message 'Unable to connect '  ( with AWS workspace client )We tried to RDP the workspace from another workspace and got following message.The Remote computer that you are trying to connect to requires Network Level Authentication NLA, but your windows domain controller cannot be contacted to perform NLA. If you are an administrator on the remote computer, you can disable NLA by using the options on the Remote tab of the system Properties dialog boxI can RDP other workspaces.We have tried to restore the workspace that did not work.I have checked the AD account for workspace, and it is there.Do not Require Kerberos pre-authentication is unticked on user’ ad accountUser has not changed the password. I wanted to migrate the workspace and did test migrate on working workspace and now cannot access it that is why migration is off the table as non-working workspace has important data.Can someone advice what to do nextthanks in advanceFollowComment"

Answer: "0Is it possible that there is an operating system firewall that has been enabled which is blocking traffic? If so, you will need to rebuild the Workspaces instance.Otherwise, I'd suggest creating a support case as the support team can investigate further within the Workspaces service.CommentShareEXPERTBrettski-AWSanswered a year agorePost-User-0533592 a year agoHi We do not know this as we cannot get in We are small company and do not have support contract with AWSIs there any chance we can access the workspace ourselfI am assuming raising support ticket with AWS support will cost moneyPlease adviceShareBrettski-AWS EXPERTa year agoI would suggest that maintaining a business support contract is worth the money given that you're running multiple Workspaces. However, if that isn't a possibility then you should attempt a rebuild of the Workspaces instance.Share"


Question: Elastic Compute cloud billing

"I was noticed via my emails about an exceeding budget and I instantly went to view the service i was being charged for immediately I stopped my instance from running when I received  an exceeding budget, unfortunately I got another email and I was charged again but my instance isn’t running no more. Please how do I go about this and what do I do to avoid incurring cost.FollowComment"

Answer: "3You shouldn't be charged for a stopped instance.Try using AWS Cost Explorer to see the details of your charges. Cost Explorer is free when you use the console with out of the box settings the only billable features are hourly & resource granularity & direct API requests.Initially Cost Explorer will group the costs by Service, making it easy to see which service is responsible for the cost. You can also switch the Group By dimension to Usage Type, which will show you the next level of detail: the specific units by which your charges are being metered.Some examples of items that you might find:EBS:SnapshotUsage - EBS Snapshots that need to be deletedElasticIP:IdleAddress - unused elastic IPsCommentShareDavid Canswered 6 days agoEXPERTsdtslmnreviewed 5 days ago2Apart from above, could be related to attached EBS volumes may generate costs for you: https://repost.aws/knowledge-center/ebs-volume-chargesCommentShareEXPERTalatechanswered 6 days ago1Check this guide for more info about being charged with no instances running.If you have provisioned other resources some could be causing this extra billing. For a detailed info of your current cost use the AWS Cost Explorer.CommentShareigsalvaranswered 6 days ago"


Question: Cannot deregister AMIs even whithout recovery points

"Hello,I am trying to deregister some AMIs but get the message "Failed to deregister the AMI ami-XXXXXXX. API Error :"This image is managed by AWS Backup and cannot be deleted via EC2 APIs. To delete this image, please use the AWS Backup APIs, CLI or console."".I have already deleted all recovery point in console an managed to delete several AMI, but 6 remain there and cant be deleted.FollowComment"

Answer: "0The AMI's created by AWS Backup service should be deleted in the AWS Backup Console. You cannot delete them in the EC2 console. Please find the Backup vaults with the Recovery points (AMI's) you want to delete and select them and delete them.It is possible that the recovery points were not created due to some issue and If you don't find the corresponding recovery points then please open a support case.CommentShareSSanswered 4 months agoVitor Santana 4 months agoHello, thanks for your help. Unfortunatly, I have already deleted all backup vaults. The only one remaining is Default and with 0 recovery points in it.Share0Ok. Thank you for the clarification.If there are any internal issues, there is a possibility that the AMI's are created, but the corresponding recovery point is not created.Please open a Support case regarding this issue. AWS Backup Service team will create the Expired recovery points in the Default vault and once you delete those Expired recovery points, the AMI's in the EC2 console will be deleted.CommentShareSSanswered 4 months ago"


Question: Can Glue crawler be configured to include only the most recent partition in a table?

"I'm brand new to Athena & Glue.  We have several sets of data in S3 in partitioned format e.g. /year=yyyy/month=mm/day=dd.  Some of these data sets are incremental (as would make sense for partitions) but some are simply complete snapshots of all the data we're interested in.  When creating a Glue crawler things work really nicely out of the box for the naturally incremental/partitioned data sets, and seamless tables are automatically created.  For the data set that are complete snapshots, however, we end up with lots of duplicate/old data in the tables because all the "partitions" are included in the table.  For the latter, is there some way to configure the glue crawler to only include the most recent partition?FollowComment"

Answer: "0Hello,Unfortunately, as of now, Glue crawler does not have such a feature to crawl only the most recent partition. All you can try is to specify an exclusion/inclusion pattern which are simple wild cards like * and not sophisticated enough to get something like current date.However, you can try something like belowCreate a Glue table manually on your path like /year=2022/month=06/day=01Create a Glue crawler with the above table as sourceRun the crawlerOn the next day, when you have a new partition day=02, you can write a simple code like below which updates the path/location of the table and starts the crawler programmaticallyimport boto3client = boto3.client('glue')response = client.update_table(DatabaseName='db',TableInput={'Name':'tbl','StorageDescriptor':{'Location':'<S3_Bucket>/year=2022/month=06/day=02'}})response1=client.start_crawler(Name='mycrawler')CommentShareSUPPORT ENGINEERChiranjeevi_Nanswered a year ago"


Question: Passing file in S3 to function Lambda

"I was wondering if anyone could help me with this issue. Basically, I'm using the library kml2geojson to convert a .KML file to .geoJSON in Python. The kml2geojson library has a function called kml2geojson.main.convert(filepath, directorypath) which takes the .KML file that needs to be converted and the directory it should put the new .geoJSON file.I can do this fine in my machine, but I'm not sure how I'd do that using Lambda and S3. Suppose the name of the file in the S3 bucket is test.kml and the name of the bucket is bucketkmltest. How would I write the file path and the directory path (bucket path) in the function parameters?Many thanks in advance,GabrielEdited by: GabrielP on Dec 12, 2020 12:02 AMEdited by: GabrielP on Dec 12, 2020 12:15 AMFollowComment"

Answer: "0Here’s some example code showing get and put from S3 in Lambda// dependenciesconst AWS = require('aws-sdk');const util = require('util');const sharp = require('sharp');// get reference to S3 clientconst s3 = new AWS.S3();exports.handler = async (event, context, callback) => {// Read options from the event parameter.  console.log("Reading options from event:\n", util.inspect(event, {depth: 5}));  const srcBucket = event.Records\[0].s3.bucket.name;  // Object key may have spaces or unicode non-ASCII characters.  const srcKey    = decodeURIComponent(event.Records\[0].s3.object.key.replace(/\+/g, " "));  const dstBucket = srcBucket + "-resized";  const dstKey    = "resized-" + srcKey;  // Infer the image type from the file suffix.  const typeMatch = srcKey.match(/\.(\[^.]*)$/);  if (!typeMatch) {      console.log("Could not determine the image type.");      return;  }  // Check that the image type is supported    const imageType = typeMatch\[1].toLowerCase();  if (imageType != "jpg" && imageType != "png") {      console.log(`Unsupported image type: ${imageType}`);      return;  }  // Download the image from the S3 source bucket.   try {      const params = {          Bucket: srcBucket,          Key: srcKey      };      var origimage = await s3.getObject(params).promise();  } catch (error) {      console.log(error);      return;  }    // set thumbnail width. Resize will set the height automatically to maintain aspect ratio.  const width  = 200;  // Use the Sharp module to resize the image and save in a buffer.  try {       var buffer = await sharp(origimage.Body).resize(width).toBuffer();            } catch (error) {      console.log(error);      return;  }   // Upload the thumbnail image to the destination bucket  try {      const destparams = {          Bucket: dstBucket,          Key: dstKey,          Body: buffer,          ContentType: "image"      };      const putResult = await s3.putObject(destparams).promise();         } catch (error) {      console.log(error);      return;  }         console.log('Successfully resized ' _ srcBucket _ '/' _ srcKey _      ' and uploaded to ' _ dstBucket _ '/' + dstKey);   };CommentShareSvenPohleanswered 2 years ago"


Question: IoTSampleSwift Not Connecting to MQTT Client

"Background:I am fairly new to exploring the services provided by AWS and am testing out some IoT projects.I have a device that connects to my MQTT Server (AWS IoT) and can publish messages. This device does have a certificate attached to it, and that certificate has two policies attached as well. Both policies have admin rights for development and testing purposes.I have created a federated user pool and allowed authorized and unauthorized clients to connect, and following the guide at https://github.com/awslabs/aws-sdk-ios-samples/tree/master/IoT-Sample/SwiftWithin the constants file of the IoTSampleSwift:I have updated AWSRegion to my correct region,I have updated my IOT_ENDPOINT with the endpoint provided by AWS IOT,I have tried both policies name's for the value of PolicyName.Within the awsconfiguration.json file:I have updated the PoolId to the pool Id provided by my federated pool,I have updated my regions to the correct region "us-east-2"The errors I get are:MQTT Session error, error code 2 and Connection Status = 5I would greatly appreciate any feedback or help anyone can provide[edit] I figured it out. If you have a certificate associated with your thing, you need to load that certificate to your app client as well.Edited by: theYeroc on May 28, 2019 6:28 AMFollowComment"

Answer: "0Hi,I am facing the same problem. Could you please elaborate by loading the certificate to the app client? ThanksCommentShareptanugrahaanswered 3 years ago"