Question: lex latest version not displayed in slack

"I have created a lex bot and integrated with Slack.changed few slots in lex, saved the intent, build it and published it.When i check it from slack, i am still getting the older version of lex.How to solve this?FollowComment"

Answer: "0Hello,Generally speaking, this scenario can occur when sending a postText call, then update botAlias, then sending another postText using the same session (session did not expire yet) as the first postText call. Then, the second postText call will point to the version before making putBotAlias call.This is an expected behavior, because a user can't have two independent conversations with two different versions of the same bot.https://docs.aws.amazon.com/lex/latest/dg/API_runtime_PostText.htmlA user can't have two independent conversations with two different versions of the same bot. For example, a user can't have a conversation with the PROD and BETA versions of the same bot. If you anticipate that a user will need to have conversation with two different versions, for example, while testing, include the bot alias in the user ID to separate the two conversations.Note:- Please note that when we create an alias for the specified version of the bot or replace an alias for the specified bot(even from console), a “PutBotAlias” API call[1] is logged in the CloudTrail event history.The only way session information can be removed is either to wait for the session timeout limit[2] to breach, or by making the DeleteSession API [3] call.Amazon Lex retains context information—slot data and session attributes—until a conversation session ends. To control how long a session lasts for a bot, we set the session timeout. By default, session duration is 5 minutes, but we can specify any duration between 0 and 1,440 minutes (24 hours). Apart from that, DeleteSession API call would remove session information for a specified bot, alias, and user ID.In your specific case, I would request you to please create a support case with our team for investigating the API calls that are being made from your account to confirm the returned version response/behavior.Please do not post any sensitive information over re:Post since this is a public platform.References:[1] PutBotAlias - https://docs.aws.amazon.com/lex/latest/dg/API_PutBotAlias.html[2] Setting the Session Timeout - https://docs.aws.amazon.com/lex/latest/dg/context-mgmt-session-timeout.html[3] DeleteSession - https://docs.aws.amazon.com/lex/latest/dg/API_runtime_DeleteSession.htmlCommentShareSUPPORT ENGINEERYash_Canswered 7 months ago"


Question: RDS DB Engine Version Numbering Reporting via CLI

"Hello RDS SME's,Below is an output of RDS Postgres versions available on AWS. Since Postgres v10.x, the version numbering has changed from major.minor.patch to major.minor.Engine | EngineVersionpostgres | 13.7postgres | 14.1postgres | 14.2postgres | 14.3postgres | 14.4The patch level was dropped and the only way I can get the patch version is by accessing the DB and running :postgres=> select version();However, logging into each DB to get the patch version is not a scalable approach, nor is it secure.My question is - Is there a way to obtain the patch version from the RDS control plane without requiring access to each individual DB?For example, MySQL reports major.minor.patch , as does every other DB available in AWS:Engine | EngineVersionmysql | 5.7.33mysql | 5.7.34mysql | 5.7.37mysql | 5.7.38mysql | 5.7.39mysql | 8.0.23mysql | 8.0.25mysql | 8.0.26mysql | 8.0.27mysql | 8.0.28mysql | 8.0.30FYI, heres the command for getting EngineVersions:aws rds describe-db-engine-versions --region us-east-2 --output table --query 'DBEngineVersions[*].{Engine:Engine,EngineVersion:EngineVersion}'FollowComment"

Answer: "0aws rds describe-db-instances --db-instance-identifier "database1" --query "DBInstances[*].[EngineVersion]"[    [        "5.7.39"    ]]CommentShareMODERATORphilawsanswered 7 months agokav9 7 months agoThanks for this. However, this does not work for Postgres DB's. When I run this command on a PG databases, this is the output:|DescribeDBInstances|+-------------------+|  13.7             |+-------------------+Share"


Question: Cloudformation stuck on UPDATE_COMPLETE_CLEANUP_IN_PROGRESS for a couple of hours.

"Cloudformation is trying to delete the ingress custom resource I have created in my EKS cluster, but it is waiting for a reply from the ALB controller which due to improper permissions and configuration won't return anything. As a result, the stack is unable to continue. I am wondering if there is anyway to force kill cloudformation out of this state or reduce the 3-hour timeout period?FollowComment"

Answer: "0Dear Customer - Thanks for reaching out to us via AWS re:PostA CloudFormation stack gets stuck in the UPDATE_COMPLETE_CLEANUP_IN_PROGRESS state when AWS CloudFormation is still in the process of removing old resources, or cannot remove those resources due to a dependency issue.This has been conveyed in the Knowledge Center article, herehttps://aws.amazon.com/premiumsupport/knowledge-center/cloudformation-stack-cleanup-stuck/I hope the above information was helpfulCommentShareEXPERTNIRUPAM_danswered 10 months ago"


Question: How to expose build time enviromental variables

"I'm building a full stack application with Next.js framework and want to deploy it to App Runner. How ever Next.js needs to have enviromental variables (secrets) on build time, otherwise build fails. This is stated clearly on Next.js documentation. How ever it seems that in App Runner I'm only able to expose environmental variables on runtime. Is there any way to get secrets from secret manager and set env values on build time? I do not wish to have my ens on client side so NEXT_PUBLIC_ prefix is not a solution around this.I'm using apprunner.yml config file and deploy automatically from Github repository.Here is my apprunner.yml config file content:version: 1.0runtime: nodejs16build:commands:build:- yarn --production- yarn buildrun:command: yarn startnetwork:port: 3000env:- name: PRIMARY_DB_NAMEvalue: "primary"secrets:- name: DB_URIvalue-from: "arn:here"FollowCommentuser-1021514 2 months agoHaving the same issue. Is this is a case of having to utilize ECR to have more flexibility over the dockerfile?Share"


Question: I don't get an option to export data to excel

"On my quick sight dashboard ,the only option I see is export to PDF not the excel or CSV, how do I enable it?FollowComment"

Answer: "0Hello,To export data from a visualization, [1]Choose the visualization that you want to export. Make sure that it is selected and highlighted.I) At top right on the visual, open the menu and choose one of the following:To export to CSV, choose Export to CSV.To export to XSLX, choose Export to Excel. This option is available only for pivot tables and table charts.II) Depending on your browser settings, one of the following happens:The file automatically goes to your default Download location.A dialog box appears so you can choose a file name and location.A dialog box appears so you can choose to open the file with the default software or to save to.Also, remember that you can't export data from an insight, because insights consume the data, but don't contain the data.QuickSight doesn't support exporting data from more than a single visualization at a time. To export data from additional visuals in the same analysis or dashboard, repeat this process for each visual. To export all the data from a dashboard or analysis, you need to connect to the original data source using valid credentials and a tool that you can use to extract data.Hope this helps !!Link- https://docs.aws.amazon.com/quicksight/latest/user/exporting-data.html -- [1]CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 8 months agoEXPERTiwasareviewed 3 months agoEXPERTFabrizio@AWSreviewed 8 months ago"


Question: Lambda policy not authorized to call RunTask - policy issue?

"Hi all, I've been tearing my hair out about this, and I have a feeling the answer will be simple, but beyond me at the moment.I have an S3 bucket notification that triggers a Lambda function to run a Fargate task to process the uploaded file. The Lambda function can download the file fine, but when invoking 'RunTask' via the AWS Node SDK, I get:"UnauthorizedOperation: You are not authorized to perform this operation."When I run the Lambda function locally with a user with Administrator permissions, all works fine, so it must be the Lambda's policy, which I've copied below (redacted values shown):{"Version": "2012-10-17","Statement": [{"Sid": "VisualEditor0","Effect": "Allow","Action": ["s3:GetObject","s3:ListBucket","ecs:RunTask"],"Resource": ["arn:aws:s3:::<redacted>/","arn:aws:s3:::<redacted>","arn:aws:ecs:us-east-1:<account_id>:task-definition/<task_def_family_name>:"]}]}I have also tried with no ':' wildcard for the task definition ARN, as well as 'ecs:' broad-stroke permissions and no dice.Am I missing any additonal permissions required for 'RunTask'? Perhaps some read permissions?Thanks in advance.FollowComment"

Answer: 0There I go... Missing an ec2:DescribeSubnets in my Lambda role...CommentSharechrislewisanswered 2 years ago


Question: "x-amz-target' is named as a SignedHeader, but it does not exist in the HTTP request."

"Our website hasn't changed in several years. Now it's generating the following error.x-amz-target' is named as a SignedHeader, but it does not exist in the HTTP request.Any pointers to documentation would be much appreciated.Okay, I've done a bit more digging. I have inherited a nonprofit  Drupal 7 site that uses AWS SES to send the organization's newsletter.SES is dependent on the Drupal 7 AWS SDK library. This library uses the v1 version of Amazon's AWS SDK for PHP. Amazon is now on v3!Unfortunately the Drupal AWS library hasn't been changed in 7 years.FollowCommentrePost-User-3460787 8 months agoWe are facing the same issue since September 22, when calling an SES APISharerePost-User-3736199 8 months agoI'm going to add information here as I discover it. Hopefully this will be helpful to others. Or, better yet, someone can help me! :)This seems to be the process for resolving the issue. I don't understand it (yet).https://docs.aws.amazon.com/general/latest/gr/sigv4-add-signature-to-request.htmlSharestefanfeurstein 8 months agogetting same error in SQS functions started at September 19. No solution yet, already contacted AWS business support.We discovered this error happens just on some ip ranges. Check response header "primary_ip" field for this.SharerePost-User-3736199 8 months agoI think I have a solution.The awssdk sets the key even if the value is null.  Adding an IF_STMT seems to fix the issue. For me at least. This is line 385 of signature_v4query.class.phpif($x_amz_target) {$this->headers['X-Amz-Target'] = $x_amz_target;}Sharestefanfeurstein 8 months ago@rePost-User-3736199 thanks for your suggestion. We implement this now like you described to our services, is working now again.AWS Business Support suggested us same after reading your comment. Nevertheless, updating SDK is a must to be save for future.Share"


Question: dynamic ip address

"Hi,I've a project to finish. My customer wants my docker containers's ip addresses has to change with a click. This is my first time in cloud. Is this possible, a dockerized running app's ip address can be changed. It can destroy and redeploy, but is this possible with a java based automatization. What should i study if it is possible.My app is spring boot micro service.FollowComment"

Answer: "0If you'd like to dynamically change the public IP address of the app, you might find Elastic IP useful.The creation and allocation of these can also be automated using Java: https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/examples-ec2-elastic-ip.htmlCommentShareEdanswered a year ago"


Question: IoT disconnected lifecycle event is not generated on device power/network loss

I've found that the disconnected lifecycle event ($aws/events/presence/disconnected/clientId) is not generated if the IoT device loses power or network access. It seems the disconnected event is only generated if the mqtt client can send a disconnect. If the device loses power/network that obviously isn't possible.What's the best approach to handling this?FollowComment

Answer: "1Accepted AnswerHi james-ld. It will be generated, but only after the keep-alive timeout expires. This is the MQTT_KEEP_ALIVE_TIMEOUT disconnect reason described here: https://docs.aws.amazon.com/iot/latest/developerguide/life-cycle-events.html#connect-disconnect.If there is no client-server communication for 1.5x of the client's keep-alive time, the client is disconnected.The keep-alive timeout can be set from the client side when the MQTT connection is established. For example, with the embedded C SDK: https://github.com/aws/aws-iot-device-sdk-embedded-C/blob/1ef5ffc906fa208752bea1ff02156605a86141c7/demos/mqtt/mqtt_demo_mutual_auth/mqtt_demo_mutual_auth.c#L1131. However, IoT Core will treat any value less than 30 as 30: https://docs.aws.amazon.com/general/latest/gr/iot-core.html#message-broker-limits.You might also be interested in last will and testament: https://aws.amazon.com/blogs/iot/monitor-aws-iot-connections-in-near-real-time-using-mqtt-lwt/.CommentShareEXPERTGreg_Banswered 6 months agoEXPERTAWS-User-Nitinreviewed 6 months ago0I will give that a try. ThanksCommentSharejames-ldanswered 6 months ago"


Question: How can I deny authorization using a custom authorizer lambda when the API key is disabled?

"hello guys,I'm trying to disable an API key to deny all access relative to my APIs, but when I flag it as disabled the API key still works.I expected that the API gateway could refuse access, but it's not happening.As the API gateway didn't refuse the access and I'm using a custom lambda authorizer, I thought I should deny the access by myself right?I'm trying to deny it through the lambda authorizer, but I haven't seen any information on the context of the key that shows me if it is enabled or disabled.As you can see in the image above, there isn't any information about if the key is enabled or disabled.Has someone any solution for this case?thank you.**UpdateSteps that I have tried:I flagged my API key as disabled.at API gateway > Resources > Actions -> Deploy API -> Add stage -> DeployI hit my API, and the key still worksThen I checked if some information came on context of my custom lambda authorizerFollowCommentalatech EXPERT3 months agoHave you tried to make the change and deploy the api stage?ShareBruno Feltrin 3 months agoYeah, at least I think yes.I did it:I flagged my API key as disabled.at Resources > Actions -> Deploy API -> Add stage (DEV) as already was -> DeployI hit my API, and it not works. so, the key still worksdo you have any other tips?Share"


Question: Call Lamda function from AWS iot

"I am trying to call Lamda function from iot. I can see the subscribed message on MQTT Test Client sent from iot device. But not able to call Lamda function. I followed the tutorial https://docs.aws.amazon.com/iot/latest/developerguide/iot-lambda-rule.html#iot-lambda-rule-test-ruleI have also attached cloudwatch logs under error action to the AWS IoT rule. Still, nothing was logged. I am not sure if the connection is being established between AWS IoT and Lamda. However, I am able to call Lamda function successfully from API Gateway.FollowCommentozy cozy 2 months agocan you try put '#' as topic in the rule and SELECT * FROM "#" and see if the lambda will run. '#' covers all topics. This will tell if rule is being executed.Share"

Answer: "1Accepted AnswerHi. I recommend you enable IoT logging and look for the RuleExecution event type: https://docs.aws.amazon.com/iot/latest/developerguide/diagnosing-rules.htmlThis will confirm or deny whether your rule is running, and tell if you if it's suffering any errors when executing the Lambda action.CommentShareEXPERTGreg_Banswered 2 months ago"


Question: I used All ICMP policy in Security Group to make ping work but not sure why. How does ICMP work with network filtering (aka FW)?

"ICMP is at Networking Layer 1 (IP) which does not use port, so Custom ICMP policy with N/A for port range makes sense. But why do we need All ICMP which uses all port ranges in AWS?I found this weird because of an assignment I was doing so far. When I was using Custom ICMP Security Group policy on an instance in a VPC attached to a Transit Gateway. and 'ping'ed from another instance to this instance, it cannot reach. But when changing its SG policy to use All ICMP (meaning all port ranges), ping works. Why is that so?FollowComment"

Answer: "1Accepted AnswerFor ICMP rules, the "protocol" and "port" fields are repurposed to represent the ICMP types and codes. For ping to work, you will need to allow ICMP echo request (in) and echo response (out, if you're filtering outbound traffic).See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules-reference.html#sg-rules-ping for example.CommentShareEXPERTJames_Sanswered 3 years ago"


Question: Unable to have # character in Path for RedirectConfig

"When attempting to add a redirect to my ALB listener rule, having a # character in the Path attribute causes it to view the path as invalid.This is true both on the console and cloudformation. Is this a bug or intended functionality?FollowComment"

Answer: "0Unfortunately, this is the same behavior when using the console. If you try from there, it returns Invalid path message and doesn't let you save the rule.Traditionally, 3xx redirects don't allow this generally, since the anchor is only processed on the client side. More recently, that spec has been updated, however ALB still doesn't support it properly.That said, I was experimenting with this a bit, and I found that it seems to work if you put this into the query attribute. It does add a ? character as well, but the anchor seems to work. For example:Host: en.wikipedia.orgPath: /wiki/FoobarQuery: #See_alsoThis rule causes a redirect to https://en.wikipedia.org:443/wiki/Foobar?#See_also, which does seem to behave as an anchor link should, though the ? should generally be unneeded for this.CommentShareSUPPORT ENGINEERWayne_Ganswered a year ago"


Question: Why I Can't see my lambdas in my aws Console? (403 error)

"Hello Everyone,  I have received a aws email where they notifying me about a probably account compromised,  I have changed my password and  I have activated MFA, however  I can't see  my lambdas in any region in the console (https://us-east-1.console.aws.amazon.com/lambda/home?region=us-east-1#/functions), I was looking the network logs and I  got this response in this endpoint(https://lambda.us-east-1.amazonaws.com/2015-03-31/functions/)   response {"Message":null} with status 403I cannot create another lambda, same response with status 403I am able to see any other service in the consoleFollowComment"

Answer: 0There are a lot of other questions about this issue including this one - the short version (and particularly in this case because of the potential account compromise): Please contact the support team.CommentShareEXPERTBrettski-AWSanswered 2 months ago


Question: How to query or measure packet latency between a Elastic Load Balancer(ELB) and a EC2 instance behind it?

"My supervisor asked this question but I'm not sure how to scientifically measure it, currently I make several requests to a HTTP service and measure the time_starttransfer cURL statistic with the domain name resolving to the IP address of the ELB and the EC2 instance and subtract the numbers to provide an answer but I'm not sure this is the proper way to do so.I also checked the CloudWatch dashboard and unable to found similar metrics, is there any?I would like answers for either the NLB(OSI layer 4) and ALB(OSI layer 7), thanks in advance!FollowComment"

Answer: "2Have a look at the ALB logs, it does provide some latency information which may be benificialhttps://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.htmlCommentShareGary Mcleananswered 2 months agoEXPERTkentradreviewed 2 months agobrlin 2 months agoThanks for the info, is there any ways to reveal the information in the NLB product?Share"


Question: S3 sync command is using 90% of CPU of the server

"Hello There,I have S3 sync script in the server, but when the script is running it is consuming the 80 % -90% of CPU of the server.Below is my script;#!/bin /bash####################################################################LOCALPATH="/var/www/html"DATE=$(date +%d-%m-%Y)echo $DATES3=backupS3LOCATION="folder-backup"###################################################################cd $LOCALPATH/usr/local/bin/aws s3 sync . s3://$S3/$S3LOCATION/$DATE/My server is having 2 vCPU and 8Gib Ram and the HDD size is 50the utilization of HDD is 13GBCan yo please suggest why CPU is reaching so high at the time of s3 sync in the serverFollowComment"

Answer: "0HelloHere is a link that talks about CLI configuration.  See if playing with some of the values for max concurrent request, multipart-threshold or multipart-chunksize helpshttps://docs.aws.amazon.com/cli/latest/topic/s3-config.htmlRTCommentSharerttanswered 4 years ago"


Question: Do the AWS supports HOTP?

"Hello, the question is in the title - "do the aws supports HOTP"? (hmac based one time password), for now i tried to setup my yubikey as MFA in AWS SSO as "otp generator" , for TOTP it worked perfectly , but HOTP didn't worked, now im thinking if AWS is even supporting it.FollowComment"

Answer: "0Accepted AnswerAWS SSO requires that authentication apps be RFC6238, TOTP. So no HOTPCommentShareMichael_Kanswered a year agoJoann Babak a year agothank you!Share"


Question: Logging Network Firewall Stateful rule logs

"maybe i already got an answer in my mind but still ill left this question here.My team try to deploy AWS native network firewall insted of 3rd party firewall like Fortinet, Paloalto to our customer.So we currently working on various case scenario with rules. and what make us bugging  is standard rules like rules inside 5-tuple-rule groups seem to not have ability to left their rule id or something like that on log regardless of its alert or just flow.Im sure this could be a huge pain in the a@# to the infra/security administrator when they dealing with trouble shooting some traffic flow related issues.So what i want to know is is there any CLI hidden options to enable rule id or again Suricata custom rule is the answer?FollowComment"

Answer: "0Accepted AnswerTo log custom messages, you can use the "msg" keyword in Suricata rules, see here.CommentShareVincentanswered 3 months agoV 3 months agothanks for the answer, another 'V'.i was expect suricata is only option in this scenario too :)Share"


Question: Misconfigured PodExecutionRole

"I'm attempting to startup an EKS pod following the getting started guide.When on the step add a Fargate Profile I'm getting the following error."Misconfigured PodExecutionRole Trust Policy; Please add the eks-fargate-pods.amazonaws.com Service Principal"However it's already added to my trust policy.  So not sure what to do{     "Version": "2012-10-17",     "Statement": [         {             "Effect": "Allow",             "Principal": {                 "Service": "eks-fargate-pods.amazonaws.com"             },             "Action": "sts:AssumeRole",             "Condition": {                 "ArnLike": {                     "aws:SourceArn": "arn:aws:<region>:111122223333:fargateprofile/<pod name>/*"                 }             }         }     ] }I'm currently following this step.https://docs.aws.amazon.com/eks/latest/userguide/getting-started-console.htmlFollowComment"

Answer: 0Accepted AnswerThe issue was my account number was typed incorrectly.  It's fixed now.CommentShareAWS-User-8560533answered a year ago


Question: EBS no tags presistent

"Hello good day from Colombia. I try to tag my EBS volumes, but these tags are not persistent. I have a shutdown of EC2 instances (the EBS are associated with them) every day at 7:00 p.m. and turned on again at 8:00 a.m. When the machines are restarted every day these tags disappear. Tagging is done manually from each EBS volume or also from the Resource Groups Management service. Can anyone know what is happening with these tags?To emphasize, some of the EC2 instances have been created with Terraform, some have tags directly from Terraform that persist, but there are volumes to which tags have been placed and saved along with the terraform ones, but others have not.I tried doing research with Cloudtrail but it didn't go well.FollowComment"

Answer: "0The only thing I can think of is that the instances are part of a Auto Scaling Group where the Launch Template does not have the tags defined. So, when new instances are started each day, the tags are missing.CommentShareEXPERTkentradanswered 5 months ago"


Question: Which credentials are they asking for? RE: S3 access.

I'm trying to access an S3 bucket and they're asking me for IAM credentials and the ARN. I'm pretty new to AWS so I'm not sure exactly what credentials they want. Is it IAM credentials for a user? A bucket? Please help :)FollowCommentRishi 5 months agoFrom where and how are you trying to access this s3 bucket?Share

Answer: "1To get your IAM user name and ARN, you can follow these steps:Sign in to the AWS Management Console and navigate to the IAM service.In the navigation pane, click on "Users" under the "Identity and Access Management" heading.Find the user that you want to get the ARN for and click on its name to open the details page.The user name is displayed at the top of the details page, and the ARN is displayed in the "User ARN" field.Alternatively, you can use the AWS CLI to retrieve the ARN of your IAM user. To do this, you can use the aws iam get-user command, which returns information about the user, including the user's ARN.  This will return a JSON object containing information about the user, including the user's ARN, which will be in the following format:arn:aws:iam::<ACCOUNT_ID>:user/<USER_NAME>To get the ARN of an S3 bucket using the AWS Management Console:Sign in to the AWS Management Console and navigate to the S3 service.In the bucket list, find the bucket you want to get the ARN for and click on its name to open the details page.The bucket ARN is displayed in the "Overview" section of the details page. It will be in the following format:arn:aws:s3:::<BUCKET_NAME>To get the ARN of an S3 bucket using the AWS CLI:Run the aws s3api list-buckets command to get a list of all the S3 buckets in your account.Find the bucket you want to get the ARN for in the list of buckets returned by the command. The ARN of the bucket will be listed in the "Arn" field.If this helps, please upvote and accept the answer so that others in this forum benefit from the solution! Let me know if you have any questions.CommentShareAnanth Tirumanuranswered 5 months ago"


Question: add access control while developing on the device

"still trying to access the local shadowi've moved away from the lambda and am now just running a python component.still doing some local development of the component until it works.deploying it usingsudo /greengrass/v2/bin/greengrass-cli deployment create --recipeDir /data/prov/GreengrassCore/recipes   --artifactDir /data/prov/GreengrassCore/artifacts   --merge "au.com.mycompany.smartdvr.shadowconfig=1.0.0"when trying to access the local shadow (using ipc_client = awsiot.greengrasscoreipc )  i'm getting aGetThingShadowRequestHandler: handle-get-thing-shadow. Not authorized to get shadowerror.if i do this via the remote greengrass console i have the option to add an access control to the deployment."accessControl": {"aws.greengrass.ShadowManager": {"mtdshadowconfig-dev-shadowconfigpython::1": {"policyDescription": "allow access to config# shadow","operations": ["aws.greengrass#GetThingShadow","aws.greengrass#UpdateThingShadow","aws.greengrass#ListNamedShadowsForThing"],"resources": ["$aws/things/thingName/shadow/name/config1"]}}}how do i add the AccessControl when i'm developing and deploying on the device itself ?clarification Edited by: clogwog on Oct 8, 2021 6:19 PMFollowComment"

Answer: "1Accepted AnswerConfiguration merge (not --merge) accepts a proper JSON document, so simply write out the JSON which you want to be merged such as:{   "<componentName>":{      "MERGE":{         "accessControl":{            "aws.greengrass.ShadowManager":{               "mtdshadowconfig-dev-shadowconfigpython::1":{                  "policyDescription":"allow access to config# shadow",                  "operations":[                     "aws.greengrass#GetThingShadow",                     "aws.greengrass#UpdateThingShadow",                     "aws.greengrass#ListNamedShadowsForThing"                  ],                  "resources":[                     "$aws/things/thingName/shadow/name/config1"                  ]               }            }         }      },      "RESET":[      ]   }}Save as "config.json"then use the deployment create command with --update-config config.json --merge componentName=1.0.0The option --merge is used to tell Greengrass to add the following component and version onto the device. To set the configuration you use the --update-config option, not --merge.CommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Hello,Try greengrass-cli deployment create --help. Our local CLI has builtin help for you.To answer the question you would use the --update-config option and provide a path to a JSON file which contains new configuration to apply. Use the format: {"componentName": {"MERGE": {"<key>": "<value>"}, "RESET": ["</path/to/reset>"]}}In your case, you can merge the accessControl values which you need.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0would I need to use aAccessControl="{ <full json access control document here }"Or do i need to add every value in the{"aws.greengrass.ShadowManager": {"mtdshadowconfig-dev-shadowconfigpython::1": {"policyDescription": "allow access to config# shadow","operations": ["aws.greengrass#GetThingShadow","aws.greengrass#UpdateThingShadow","aws.greengrass#ListNamedShadowsForThing"],"resources": ["$aws/things/thingName/shadow/name/config1"]}}}document ? How does that work with the tree structure that is in that document ?Are there any examples ?The documentation *-m, --merge=Component and version*                  *The name and version of the target component you want to add*                    *or update.*                  *Format: <component-name>=<version>. Example: HelloWorld=1.*                    *0.0. Use a separate argument for each additional component*                    *to specify.*is not very specific about how to merge json document like thisCommentShareclogwoganswered 2 years ago"


Question: How to enroll for MSK Serverless

How to enroll for MSK ServerlessFollowComment

Answer: "0It is available in Ohio (us-east-2) region only at the moment. Just login to the console, switch to us-east-2 region and click create cluster.you should be able to see serverless option in the cluster settings.CommentShareAlex_Tanswered a year agoEXPERTFabrizio@AWSreviewed a year ago0MSK Serverless is available as a public preview in US-East-2 (Ohio).  there is no additional steps required to enroll for the same.Navigate to MSK and create the cluster Select Serverless(preveiw) instead of provisioned.CommentSharePhani_Lanswered a year agoEXPERTFabrizio@AWSreviewed a year ago0Update: MSK Serverless is available in the US East (Ohio), US East (N. Virginia), US West (Oregon), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Frankfurt), Europe (Stockholm) and Europe (Ireland) Regions.Here is the AWS News blog published early this year about this news: https://aws.amazon.com/blogs/aws/amazon-msk-serverless-now-generally-available-no-more-capacity-planning-for-your-managed-kafka-clusters/This is the link to public documentation to learn more about Amazon MSK ServerlessCommentShareChanki_AWSanswered 7 months ago"


Question: Update postgres RDS table with AWS glue script

"I would like to transfer data from postgres RDS database tables to a new reporting database, also created as a postgres RDS. I created data catalogs and created a script that should join two tables together and then save data to a reporting database. It is working as intended only when run for the first time - it saves current data to new database. I need to update the reporting database daily with newly added records to a basic database, but it is not saving new data for me. Is there any way to insert only new data into a db with AWS Glue?FollowComment"

Answer: "0Hi,could you please confirm if I understood well the scenario?You have one AWS Glue job  (Spark job) which:reads 2 tables from an RDS databasejoins the 2 tableswrites to a third table in a different Databaseyou only want to process incremental datayou have enabled Job Bookmarks for the job?AWS Glue when you write to a jdbc database only INSERT Data, if you want to capture the new data you are going to enable the job bookmarks.Job bookmark if enabled will apply to all table read in the job and if you are using a jdbc connection will use by default the primary key to check for new data, unless you specify a different key.If the two tables have different update schedules on the source it may happen that the join results in an empty datasets and no additional data would be inserted in the target DB.If you need to join the incremental data from Table A with the whole of table B, you would need to break the job and create a workflow.Job 1 reads the full of table B (job bookmark disabled) and writes it to a temporary file on S3.Job 2 reads the table A with bookmark enabled and the temporary data set from S3, it makes the join and writes to the target DBjob 2 removes the temporary file if the write to target DB is successful.please notice that his would work if you need to always insert new data. if you need to UPDATE the target table , it would be more complex, and to provide some guidance I would need additional details.hope this helps,CommentShareEXPERTFabrizio@AWSanswered a year agoAWS-User-1252985 a year agoI am using RDS databases added to a Data Catalog as a source and target.I already have Job Bookmarks enabled for the job, but it doesn't help.ShareFabrizio@AWS EXPERTa year ago@AWS-User-125985: hi what I was trying to explain is that actually the Job Bookmarks may be the reason why you are not able to see new data on the target table.Job bookmarks work at a job level, so if you have 2 tables in the job that you are reading from, and these tables have different update schedule, when the job read them it is not said it will read matching record and the result of the join might be empty, hence no new data to write to the target.This is why I was telling you that you might need to split the jobShareAWS-User-1252985 a year agoThank you for your response.What I would like to achieve is to have a job that performs UPDATE. Could you help me with that?Share0As was mentioned, the dataframe/JDBC supports INSERTs or overwriting entire datasets.To do an UPDATE would require some work.  Basically, you would share the JDBC connection properties with the executors using a broadcast variable, then have a DataFrame that contains records requiring an update, perform a foreachPartition call on that DataFrame where you would then make a JDBC connection and then loop through the partition with a foreach call where you would perform the UPDATE.You can find a Scala example here: https://medium.com/@thomaspt748/how-to-upsert-data-into-relational-database-using-spark-7d2d92e05bb9CommentShareDon_Danswered a year ago"


Question: Failed to create Gateway

HelloWe are having difficulty creating the Gateway.Following the AWS Documentation. As the image below.By clicking on Create Gateway. The page is directed to. And it is not possible to create the Gateway.What needs to be done to resolve this error?FollowComment

Answer: "0Hi,you need to run this configuration wizard on a PC that can reach the AWS console as well as the AWS Backup appliance via the IP that you specify. This means the backup appliance needs to be deployed before you register it in AWS Backup.When I created my gateways I proceeded the following way:I downloaded the ova from AWSI deployed the ova on my vSphere environment. Before I turned the appliance on I registered the automatically assigned MAC address in my DHCP serverI turned on the deployed VM and verified that it got the IP address from the DHCP server and responded to pingI ran the configuration dialog (your first screenshot) in the AWS consoleThe settings are basically transmitted from the AWS console to your backup appliance via your browser and a HTTP redirect.Your second screenshot shows a connection refused message, which could be caused by a firewall blocking the request or other network connectivity issues.CommentShareEXPERTAndreas Seemuelleranswered 2 months ago0Confirm if the port 80 (used only for activation) is allowed-listed in your security group/firewall.[] Port Requirements - https://docs.aws.amazon.com/filegateway/latest/files3/Resource_Ports.htmlCommentShareJamesson_Banswered 21 hours ago"


Question: I can't get a callback for a complaint (SES)

"I am in sandbox mode, testing using Amazon SES event publishing to monitor email sending, I have selected all events in the config set events (Hard bounces, Clicks, Complaints, Deliveries, Delivery delays, Opens, Rejects, Rendering failures, Sends, Subscriptions);Currently I can receive Deliveries, Clicks, Opens, Sends events normally;I tried to complain about an email sent by SES, the email was moved to spam, but I didn't get the Complaints eventFollowComment"

Answer: 0To test complaint notifications you would want to use the SES complaint simulatorhttps://docs.aws.amazon.com/ses/latest/dg/send-an-email-from-console.html#send-email-simulator-how-to-useYou would do this by sending a message to complaint@simulator.amazonses.comThis will then trigger a compliant notification to be sent and would trigger the event in your configuration setCommentShareSUPPORT ENGINEERRichard Wanswered a year ago


Question: Multiple vs Single Comprehend Custom Classifiers?

"Let's say I want to extract entities (like address) from invoices from many companies and countries around the world. In many cases, I would want to pass Amazon Textract to Amazon Translate to Amazon Comprehend, storing the intermediate results in Amazon S3 each step of the way for resilience.This is the kind of input and output I would want to have for Comprehend:input keyinput valueoutput labelAddress50 Park AvenueAddressCompanyAcme IncCompanyTotal$5000Total100 Main StreetAddressInstitutionDunder MiffCompany$640TotalInvoice$10000TotalBut let's say it's only 90% accurate at providing labels like that, because the invoices from some countries use different terminology, even after translation to English. I can see a few options to tackle this:Provide a custom entity list with a similar table to the one above, careful to only have a total of 25 different output labels, and train a custom classifier with that in Amazon Comprehend.Include a SageMaker Augmented AI (A2I) step, so that a human can give their annotate the data with the proper label, ensuring that the labelers can only choose from up to 25 different labels. This way has an advantage over option 1, in that the model will continuously improve as it gets more samples from the human review.And with either option 1 or 2 above, I could use either one custom classifier per customer, because they may have different requirements,OR I could have one customer classifier for all customers, and limit myself to 25 labels universally. This seems easier to maintain and makes all use cases better simulataneously.I could include the human review after Transcribe (after Translate, if non-English) gives a low confidence score.OR I could include the human review after Comprehend gives a low confidence score. I like this option better for human review placement, because the Comprehend step will get better over time, as it learns from our data, whereas Textract doesn't have that feature. This way, the need for human review should diminish over time.In conclusion, I would recommend human annotations (2) that happen after (6) a custom Comprehend classifier, which is the same for all customers (4).My question: am I thinking about this right? Are my conclusions logical?FollowComment"

Answer: 0Option-2 will be required only during training hence less manual intervention while option-6 could be required often during inference when there is a low score predicted. You would need to evaluate the trade-offs between human annotation during training or inference for your use-case.I would suggest starting with option-2 and fine-tune it using human annotations and plug-in option-6 if needed.You can use flywheel to iterate on your model - https://docs.aws.amazon.com/comprehend/latest/dg/flywheels-about.htmlCommentShareHimesh-AWSanswered 2 months ago


Question: Reinstated account after suspension can not access existing CloudFront  distributions

My account was reinstanted recently. But I can not make any modifications to the existing cloudfront distributions. I can view them. But when making modifications I get "Access Denied" error. I can not delete distributions either.FollowComment

Answer: 0It seems to be a permissioning issue which needs to be resolved by your admins and cross check if you are still needed to perform those roles and action. You can also contact your security to cross check the permissions as needed.Reference : https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/access-control-managing-permissions.htmlCommentShareEXPERTAWS-User-Nitinanswered 7 months ago


Question: Severe IO performance drop after modifying gp3 volume (state OPTIMIZING)

"We have an ec2 machine with an attached EBS volume of type gp3 (size 750GB, 3000 IOPS, 125 MB/s throughput). After modifying that volume (750 GB -> 760 GB) the read performance of already written data to that volume maxes out at 80 IOPS and 15 MB/s.Newly written files have full IOPS when writing and reading, only data already written to the volume before the modify started is severely affected by degraded read performance.eu-central-1, volume-id: vol-0962cfcd0b28acb95ec2 type makes no difference (testet t3.2xlarge and c5.4xlarge). After 4 hours the state of the volume is still in state OPTIMIZING (35%).We never noticed performance degradation below the source or the target provisioned setting when resizing a volume before.AWS status dash board shows no issues in eu-central-1, right now.Any ideas what might have caused this?Thanks a lot.Edit: I opened a ticket with AWS support. Will report back with findings.Edited by: MarcelSJ on Nov 2, 2021 1:04 PMFollowComment"

Answer: "0AWS did reply to my support ticket after reaching out to the internal EBS team:Your volume vol-0962cfcd0b28acb95 experienced higher than normal latency while modifying. This issue only impacts volumes while modifying where the source volume type is gp3. Once the modification is complete, the impact to latency subsides. Your volume and any snapshots of your volume taken during this period are in a healthy state, and no action is required on your part. We are actively working to deploy a fix and expect completion in Q4 2021.Thanks for coming to my TED talk.CommentShareMarcelSJanswered 2 years ago"


Question: CodeCommit git merge-base

"Hi, how can I find the most recent common ancestor of two branches using CodeCommit API?For example git merge-base <commit> <commit>FollowComment"


Question: A question about the free-tier offers

"Hi,I've read that many AWS services offer free tier deals for certain instances. For instance an EC2 T4.micro instance has a 750 free tier for the first 12 months.I'm not sure what is ment with the first 12 months. Does that mean the first 12 months following the moment that you start your first EC2 instance?Or does it mean the first 12 months following the moment you first created your AWS account?I also have a question thats specifically about the EC2 free tier. Do you get 750 hours of free EC2 micro usage each month or do you get 750 free hours that must be used within the next 12 months? I've read the documentation about this here and i assume you get 750 free hours every month but i want to be sure about this so thats why i'm asking.Thank youFollowComment"

Answer: "2Accepted Answer"In the first 12 months" means from when the account you're operating in was created. Each customer account has a separate "start date" and therefore the 12 month period starts when each account was opened.Note that we have a reference page that lists all of the services available in the free tier.To your EC2 question specifically, it is 750 hour per month.CommentShareEXPERTBrettski-AWSanswered a year agoViridios a year agoSo if your account is more then 1 year old you've automatically lost all of your free tiers, regardless of whether you tried a service out or not?ShareJohn Rotenstein a year ago@Viridios Yes, that is correct. If you account is more than 1 year old, then any Free Tier that mentions "first 12 months" is no longer available. However, some service offer Free Tiers for every month (not just the first 12 months).ShareJohn Rotenstein a year agoAlso, note that the 750 hours for EC2 can be used as 1 instance for an entire month, or 2 instances for half a month, or even 750 instances for one hour.Share"


Question: Active speaker enrollment job limit exceeded when batch enrolling AWS Connect  VoiceID

"I am enrolling speakers into connect & Voice ID using the batch method.  Unless I allow the enrollment to be fully complete before starting another I get a "Active speaker enrollment job limit exceeded." error message returned on the 2nd enrollment.  In service quotas under connect the only quota I see that would appear to be relevant is Rate of CreateUser API requests.  The default says 2 per second, but we are nowhere near that rate and getting the error.   Is this the correct service quota that needs to be modified, could there be another cause for the error message, we are definitely no exceeding the default rate.  TIAFollowComment"

Answer: "0Hi, there is actually a limit of one Active Batch Speaker Enrollment Job per domain per: https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-service-limits.html#voiceid-quotasI'd submit a support case to see if they can raise this limit for you.CommentShareAWS-User-9371299answered 6 months ago"


Question: AWS Snowball will not unlock and cant access.

"I just ordered a AWS snowball edge device and downloaded my manifest file and access code. I am using the following method to connect:snowballEdge unlock-device --endpoint https://x.x.x.x --manifest-file c:\users\administrator\Downloads\xxx_manifest.bin --unlock-code xxxHowever, I keep getting the following error message::SdkClientException - Unable to execute HTTP request: Connect to x.x.x.x.:9091 [/x.x.x.x] failed: Connection refused: connectI have validate network connectivity as well so any help is appreciated.FollowComment"

Answer: "0Make sure you are not blocked by your firewall with http/https request.Please follow the process of unloking using the documents belowhttps://d1.awsstatic.com/whitepapers/snowball-edge-data-migration-guide.pdfCommentShareBasir_Sanswered a year ago0So I was able to solve this by shutting down and waiting 10 mins and then it instantly unlocked. I found another article where it talked about this and that resolution worked.CommentShareAWS-User-4271946answered a year ago0Ran into this same error, turned out to be an IP conflict on the network.CommentShareAWS-User-5784581answered 10 months ago"


Question: Error Deploying Asp.Net Minimal API (with Top level statements) to lambda using .NET CDK

"I have a CDK solution with a stack etc, in the same solution i have created a ASP.NET minimal API Lambda project.When I deploy using the CDK I'm getting the ERROR:Internal Server ErrorWhen I check the logs I can see the Error:Error: executable assembly /var/task/lambdaMinimalApi.dll was not found..I know what this error is, it is trying to find the Lambda function thinking its a library, but mine is an executable.I know this as when I deploy the lambda with:**dotnet lambda deploy-function**through trial an error i found out this:.NET Lambda projects that use C# top level statements like this project must be deployed as an executable assembly instead of a class library. To indicate to Lambda that the .NET function is an executable assembly the Lambda function handler value is set to the .NET Assembly name. This is different then deploying as a class library where the function handler string includes the assembly, type and method name.Following this and just using the assembly name I can deploy using:**dotnet lambda deploy-function**and everything works.When it comes to the CDK I get the internal server error mentioned above.My public repo is here: https://github.com/RollsChris/cdk-twitter-clone-dotnetI think it will be a good example to add to the official examples if I can get it to work?I have tried various forms of Code.From**, and searched the internet far and wide. Most examples are using a lambda function written in javascript but the CDK is using .NET.ThanksFollowCommentKirk_D 3 months agoI've alerted another SA with expertise in this area, so hopefully we'll have an answer for you in the near future.Share"

Answer: "0In your CDK code your're using aws-s3-assets, which is a high level construct that abstracts packaging AWS Lambda functions. The default behavior of this construct is to zip all the content into a folder and upload it to an Amazon Simple Storage Service (Amazon S3) bucket. That works great for Lambda runtimes like Python or Node.js, which do not require code compilation, but for .NET, Java, or Go, which requires code compilation you need to implement BundlingOptions, here's a code sample that show how to implement it, you'll notice that all the 3 Lambda function are Minimal API, just like the one you're trying to buildTo learn more about, please read the blog post: Build, package, and publish .NET C# Lambda functions with the AWS CDKCommentShareUlili Nhagaanswered 3 months ago"


Question: Possible to adjust command status refresh rate? `aws s3 cp` returns too much data.

"Whenever I use the aws s3 cp command, it sends back too much data in the form of constantly updating the transfer rate.  When I'm connected to a remote host, via ssh for example, and running this command, it generate over 100 kiB/s at times.  Sorry but that's ridiculous to me.  We don't need the transfer speed updated every millisecond.  Is there a way to adjust this refresh rate so it's updated whenever we want?  once/second or once/10 s., etc.?ThanksFollowComment"

Answer: "0It's not possible to change the refresh rate. But you can use a few options to reduce the information that is displayed from that command, or also run in silent mode. See the flags --quiet, --only-show-errors and --no-progress in the documentation here: https://docs.aws.amazon.com/cli/latest/reference/s3/cp.htmlCommentSharedspanswered 6 months ago"


Question: "Activating" OTA agent based on AWS IoT's Job creation.

"Hello,I am currently implementing OTA functionality on an ESP32-S3 and I am looking for a way to activate the OTA agent on my device based on a notification. I believe I can subscribe to the /notify or /notify-next topic to but my only concern here is that having a constantly open MQTT subscription on the device. Is it possible to start the OTA agent and have a way for it to check for active jobs to determine whether or not to proceed or stop?FollowComment"

Answer: "0Hi kevinah. The jobs/notify and jobs/notify-next topics are how your device gets notified that there's a job available for it to process. You need to be subscribed to get the notification. The OTA agent subscribes to jobs/notify-next here: https://github.com/aws/ota-for-aws-iot-embedded-sdk/blob/c3bd5840979cadfe1f9505e13e49cccb87333650/source/ota_mqtt.c#L358When the OTA agent first starts up, it subscribes to that topic and publishes a /jobs/$next/get to get any jobs that may have been queued while it was offline.my only concern here is that having a constantly open MQTT subscriptionSubscriptions don't incur cost. Connection time and messaging do. Is there another concern?The OTA agent includes a suspend/resume feature. This is normally used to handle intermittent connectivity. You could also use it suspend under different conditions. For example, a customer might suspend OTA when a device goes onto a cellular network and resume when it goes back on WiFi. Alternatively you might have your own custom topic that allows you to notify your application to suspend OTA (but this would require a subscription of course). More drastically, you could shutdown rather than suspend; this can unsubscribe too.The OTA demos are worth studying if you haven't already: https://github.com/aws/aws-iot-device-sdk-embedded-C/tree/main/demos/otaCommentShareEXPERTGreg_Banswered 4 months ago"


Question: "Failed to deploy application, new alive healthy instance declared dead"

"Since two days, I cannot deploy a new beanstalk application anymore.The error messages on the event page are always the same:Failed to deploy application.Cannot complete command execution on the following instances as they are no longer running: e.g i-0bf4a8XXX.Command execution completed on all instances. Summary: Successful: 0, Died: 1.Deployment failed. Terminating new instances and temporary Auto Scaling group.However, at 1.-3.  i-0bf4a8XXX is up and running just fine. It serves requests. I can log in. I fail to detect any anomalies.Ironically, at 3. and 4. the health dashboard complains about the incorrect application version being found:Incorrect application version found on 1 out of 3 instances. Expected version "XZY" (deployment XXX). The incorrect version being the application version I actually do want to deploy.I would be grateful for any pointers or ideas I am missing to resolve this problem.Thanks.Removed autoformatting Edited by: msmart2 on Jan 8, 2020 2:34 AMGrammar. Edited by: msmart2 on Jan 8, 2020 2:35 AMFollowComment"

Answer: "0The issue disappeared. I can deploy again (actually the same code that previously failed). Possibly, an intermittent issue..  Thanks.CommentSharemsmart2answered 3 years ago0Hello,It seems very unlikely for such an issue to occur, beanstalk should be aware of the instance running in the backend and based on the healthcheck performed, it will set the instance as healthy or unhealthy.As of now, you mentioned that the deployment is working fine without any issue. If you face the issue again, please DM me the environment id and account id. I shall further look into it.CommentShareKaushikM-AWSanswered 3 years ago"


Question: How to transfer dataset (whole dataset at once) from Bigquery to S3 by AWS Glue?

"Hi DearsHope all is great with you.I have tried to migrate data from google big query to AWS S3.I have an issue from source side as below (console).Connection options:Enter additional key-value pairs for your data source connection:**Key: parentProject   value: serene-craft-3363XX**Key: table    value:  bigquery-public-data:austin_bikeshare.bikeshare_stationsThe question that if i want to put dataset instead of table, how that will be??Noting that I tried write ( dataset ) but not working!Can you advise please? Thanks in advanceBasemFollowComment"

Answer: "0Accepted AnswerHi,If I guess correctly you are using AWS Glue Studio and the AWS Glue big Query connector.Currently the Glue Big query connector is working at table level (as the  BigQuery Spark Connector does).If you want to export all the tables in a dataset you may edit the script generated by Glue Studio and customize it.you would first need to add the google.cloud python library using the method mentioned here.then before you read the table, you read  the list of tables in the dataset as described here.Finally you iterate on the tables and you read/write them to S3.This is one possibility the other would be to use an orchestrator as   StepFunctions (an alternative could be Airflow), to run a python script to read the list of tables, and then execute the your job (once parametrized by tablename) in parallel for each table.hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: CloudTrail event too large

"I sending CloudTrail API event for event source ec2 to CW Events. Following is the Event Pattern configured in EventBridge{  "detail": {    "eventName": ["RunInstances"]    "eventSource": ["ec2.amazonaws.com"]  },  "detail-type": ["AWS API Call via CloudTrail"]  "source": ["aws.ec2"]}I am not getting complete event but the following message  {      "omitted": true,       "originalSize": 109435,       "reason": "responseElements too large"  }If I check Quotas in CloudTrail user guide, it is mentioned that events can have a max size of 256 KB. The original size mentioned above is less than that, could anyone help me with understanding why I am not getting the complete event?Thanks!FollowComment"

Answer: 0Accepted AnswerSeems that responseElements has a maximum size of 100 KB - see https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.htmlCommentShareEXPERTskinsmananswered a year agogpnisha a year agoThanks for pointing it out. Is it possible to raise this limit for an account?Share


Question: Service quotas in eu regions

"According to AWS documentation, Textract service quotas for processing in eu region (and others, but mostly interested in eu) is 5x times slower/limited when comparing to US regions. And I believe they are hard limits, can't be increased via request. Is that correct?Also, are there plans to have eu region quotas to bump up to match US quotas limits?Regards,AlbertEdited by: AlbertK on Jun 11, 2021 8:34 AMFollowComment"

Answer: "0Hi Albert, the service quotas for our APIs are not hard limits, https://docs.aws.amazon.com/general/latest/gr/textract.html#limits_textract, if you have use cases that needs higher TPS, you can always reach out to AWS customer service to increase the limit for you.And for increasing the default quotas for EU regions, we do not currently have an ETA for that, but we can always increase the limit for you if reach out to you with your use case.Let me know if you have any questions, thank you.CommentShareAWS-User-0574899answered 2 years ago"


Question: how to check which Amazon OpenSearch Service Domains connected to my dynamoDB tables or vice versa

"I have create Opensearch-service using   @searchable of GraphQLtype Student @model @searchable { name: String dateOfBirth: AWSDate email: AWSEmail examsCompleted: Int}I have created the 3-4 time and now I can see 4 domains in my open search , I got bill of 30$ for this. I want to stop 3 out the 4 doamins. How can I detect which opensearch is for which appsync schema? my open search doamins are looking like amplify-opense-1dcv885ftfznp this.FollowComment"


Question: invalidinputexception "name prefix" not valid terraform while creating an FMS policy

"While creating an FMS WAFv2 policy using Terraform I receive the following error:Firehose name prefix is not valid: arn:aws:firehose:us-east-1:xxxx:deliverystream/test-stream-nameHowever firehose seems a valid arn, so what gives?FollowComment"

Answer: 1Accepted AnswerIn order to fix this you need to ensure that the name of your firehose delivery stream resource in terraform starts with "aws-waf-logs".CommentShareLucasanswered 2 months ago


Question: Dynamodb cost for index writes

"Hey all,I have an on-demand dynamodb table. It contains 5 local secondary indexes and 4 global secondary indexes.Dynamodb charges per kb for writes. My base table attributes mostly deals with Boolean values. Which is about 200 bytes per write.  So each and every index of my mine is less than 200 bytes.My question is, when I write to the base table will I be charged for 10 different writes (10 kb) or based on total size (2 kb) ?Thanks.FollowComment"

Answer: "0A write unit is any write operation up to 1 KB.  If none of your secondary indexes are sparse, then inserting an item into your table (the primary index) will result in an additional write unit consumed for each of your secondary indexes - total of 10.  This is to propagate the record.  Deleting the item from the primary index will also consume 10 write units.One nuance regarding updates to the item in the primary index - if the attribute updated is part of the primary key for an index, then propagating the change to that index will consume 2 write units - one to delete the original propagated item in the index, and another to write a replacement with the new primary key for the index.I would recommend testing some of this by making some writes to the table, and using the "ReturnConsumedCapacity" option - it will tell you how much throughput was consumed.  It's a great way to get a feel for the efficiency of your design.CommentShareAWS-User-9190687answered 3 years ago0Thanks for the ReturnConsumedCapacity option. That's what I was looking for.Have a nice day.CommentShareVir2020answered 3 years ago"


Question: EKS scheduler bin-packing

"Hello,we are executing batch jobs on EKS as pods and we are facing issue with workloads are spread across large number of nodes after scale-up with low requests. Running jobs can't be migrated to other node so autoscaler ignores them and it prevents scale-down.It might be helpful to binpack these job pods across the nodes similar as described https://alibaba-cloud.medium.com/the-burgeoning-kubernetes-scheduling-system-part-3-binpack-scheduling-that-supports-batch-jobs-372b4704722 or https://kubernetes.io/docs/concepts/scheduling-eviction/resource-bin-packing/#enabling-bin-packing-using-requestedtocapacityratioIs it possible to activate bin-pack scheduler on EKS? Or which approach would you recommend for this situation?thanksMartinFollowComment"

Answer: "0You might want to try using https://karpenter.sh/ for autoscaling and see if it improves your utilization.It can also consolidate pods to less nodes, but that might not always be appropriate for running jobsCommentSharedovanswered 3 months ago"


Question: 403 creating java lambda function

"Hi, I am trying to create a Java lambda function. when I select create function I get a network error and looking in the console I can see it is getting a 403 response trying to access a java11.zip from a cloudfromt URL. I'm assuming my account has a permission missing somewhere, I've tried all sorts that look like they may be relevant but all have failed. can anyone pinpoint exactly what policy I needs for this please.for relevance I can create functions in python etcFollowComment"

Answer: "0Hello,Cloufront URL are not valid to deploy your Java based AWS Lambda functions. You can upload your zip artifact with the java function in two ways:Upload the zip artifact from your local computer with the console or CLI.Use a S3 bucket location (where you have access) with your artifact in the console or CLI:aws s3 cp my-function.zip s3://my-bucketAnd later:aws lambda update-function-code --function-name my-function \ --s3-bucket my-bucket --s3-key my-function.zipHope it helps.CommentShareJoan_Banswered a year ago"


Question: what is wrong in this prefix comparator dynamodb stream fillter pattern?

"Hi, I try to filter dynamodb stream events with the following pattern:"MaximumRetryAttempts": 1,        "FilterCriteria": {          "Filters": [            {              "Pattern": "{\"eventName\":[\"INSERT\",\"MODIFY\",\"REMOVE\"],\"dynamodb\":{\"NewImage\":{\"PK\":{\"S\":[{\"prefix\":[\"BOOK\"]}]}}}}"            }          ]However, Cloudformation throws an error saying it is invalid. I can not see the error here? What am I doing wrong?FollowComment"

Answer: "0Answering my own question for someone who stumbles upon this. Apparently, for the prefix comparator, you do not need extra brackets.  The following is correct: "Filters": [            {              "Pattern": "{\"eventName\":[\"INSERT\",\"MODIFY\",\"REMOVE\"],\"dynamodb\":{\"NewImage\":{\"PK\":{\"S\":{\"prefix\":[\"BOOK\"]}}}}}"            }          ]CommentShareHaikoanswered a year ago"


Question: AmazonCloudWatchLogs.DescribeLogGroupsAsync() is not working nor throwing any errors when invoked

"Call to AmazonCloudWatchLogs.DescribeLogGroupsAsync() is not working nor throwing any errors when invoked.1] Can you please share more inputs to resolve this issue / get errors logged for this call [or all AWS .NET API calls]?2] Is there any additional settings / configurations we need to do so that error / catch block is invoked so we get logs about it?We want to send logs to AWS CloudWatch for our internal/on-premise web application [this is actually hosted on internal cloud & .NET + Angular Web application]So we are using AWS .NET API i.e. AmazonCloudWatchLogs.DescribeLogGroupsAsync() & other related classes.We have wrapped call to this function with try catch block along with proper logging at all lines including catch block error logging but we are not getting any logs post call to AmazonCloudWatchLogs.DescribeLogGroupsAsync() & also logs in catch block also not invoked.Below is sample codeFor reference,1] we only get logs till - _consoleLogger.LogInformation("Logger ctor - Calling DescribeLogGroupsAsync Start");2] & also log statement in catch block are not invoked.Sample Code -try            {                _consoleLogger.LogInformation("Logger ctor - Calling DescribeLogGroupsAsync Start");                var existingLogGroups = _client.DescribeLogGroupsAsync();                var result = existingLogGroups.ConfigureAwait(true).GetAwaiter().GetResult();                _consoleLogger.LogInformation($"Logger ctor - NextToken is {result.NextToken}");                _consoleLogger.LogInformation("Logger ctor - Calling DescribeLogGroupsAsync End");                Initialise(_consoleLogger).Wait();            }            catch (AggregateException exception)            {                foreach (var inner in exception.InnerExceptions)                {                    _consoleLogger.LogError(inner, $"Logger ctor - AggregateException occured in Logger ctor");                }            }            catch (Exception exception)            {                _consoleLogger.LogError(exception, $"Logger ctor - Exception occured in Logger Ctor");            }FollowComment"

Answer: "0I would recommend not using GetAwaiter().GetResult() to avoid thread exhaustion and deadlock. Instead, simply write, var result= await _client.DescribeLogGroupsAsync(); You can see an example here -https://github.com/awsdocs/aws-doc-sdk-examples/blob/main/dotnetv3/CloudWatchLogs/DescribeLogGroupsExample/DescribeLogGroups.csCommentSharemaykumsanswered 7 months agorePost-User-9542617 7 months agoThanks. Initially, I had used both await _client.DescribeLogGroupsAsync() & also _client.DescribeLogGroupsAsync().Wait(), but not solution & still its not working.Share"


Question: Closing up a Sagemaker user profile - intended behavior?

"I had a Sagemaker user I wasn't using, so I tried to delete it and initially came across this tutorial:https://docs.aws.amazon.com/sagemaker/latest/dg/gs-studio-delete-domain.html . As part of the larger process for how to delete a domain, it shows how to delete any user profiles within that domain. The steps are:Choose the user.On the User Details page, for each non-failed app in the Apps list, choose Delete app.On the Delete app dialog, choose Yes, delete app, type delete in the confirmation field, and then choose Delete.When the Status for all apps show as Deleted, choose Delete user.The problem comes on the final step: I wasn't able to find a "Delete user" button. This feels like a bug, because without such a button the only way to stop charges on a Sagemaker user is to use the CLI, which I eventually did. You can only delete the domain if you have deleted all users, meaning it only works using the CLI for that as well. For every other AWS service I've used, there is an easy way to delete everything from the GUI.FollowComment"

Answer: "0Accepted AnswerTry clicking on the user, then Edit, and then Delete? I don't remember if that is the exact flow, but I do know that you can do it in the GUI. I've done it a few times.CommentShareVictor Dantasanswered a year agobob a year agoThat worked. I don't know why they would put delete inside of edit, but it was right there.Share"


Question: How to use Step Functions to forward messages to SQS with an unknown number of message attributes

"I need to be able to forward messages from an existing SQS queue to a new SQS queue using an Event Bridge Pipe and Step Functions.  Each message in the new queue must look identical to the message in the original queue, including the attributes.  This is a temporary configuration.  The messages will eventually go to lambdas instead of the new queue.My problem is that the messages don't have consistent attributes.  They may have 0 - 9 attributes, in any combination.The examples I found for including the attributes when sending a message from Step Functions look something like this:     "Parameters": {       "QueueUrl": "https://sqs.<region>.amazonaws.com/<account/<destination-queue>",       "MessageBody.$": "$.body",       "MessageAttributes": {         "someAttribute": {           "DataType.$": "$.messageAttributes.someAttribute.dataType",           "StringValue.$": "$.messageAttributes.someAttribute.stringValue"         },         "someAttribute2": {           "DataType.$": "$.messageAttributes.someAttribute2.dataType",           "StringValue.$": "$.messageAttributes.someAttribute2.stringValue"         }This works, but if I specify all potential attributes and an incoming message is missing some, I get an error like this: The JSONPath... specified for the field... could not be found in the inputIf I try to pass the attributes using the jsonPath like this:"MessageAttributes.$":  "$.messageAttributes"I get: An error occurred while executing the state 'SendMessage'. The Parameters... could not be used to start the Task: [The field "stringValue" is not supported by Step Functions]I considered using Choice, but there are too many possible combinations of attributes.Is there a simple way to include all of the attributes from the original json input when using SQS Send Message in Step Functions without spelling them out one at a time?FollowComment"

Answer: "0Accepted AnswerHi,The way you set the parameters via JSONPath looks fine (I attach an example below), so MessageAttributes should be equals to messageAttributes. Can you verify in the execution logs that this is the case?UPDATED:After reading your response, I think it's because the attributes are case sensitive and you're sending stringValue instead of StringValue. Anyway, I have coded a Step Function that reads from queue A and leaves the messages as is in queue B. Hope this helps you.Step Function definition{  "Comment": "Example",  "StartAt": "Receive Message From Queue A",  "States": {    "Receive Message From Queue A": {      "Type": "Task",      "Parameters": {        "QueueUrl": "REPLACE_WITH_YOUR_SQS_URL",        "MessageAttributeNames": [          "All"        ]      },      "Resource": "arn:aws:states:::aws-sdk:sqs:receiveMessage",      "Next": "Map"    },    "Map": {      "Type": "Map",      "ItemProcessor": {        "ProcessorConfig": {          "Mode": "INLINE"        },        "StartAt": "Send Message To Queue B",        "States": {          "Send Message To Queue B": {            "Type": "Task",            "Resource": "arn:aws:states:::sqs:sendMessage",            "Parameters": {              "QueueUrl": "REPLACE_WITH_YOUR_SQS_URL",                "MessageBody.$": "$.Body",                "MessageAttributes.$": "$.MessageAttributes"            },            "End": true          }        }      },      "ItemsPath": "$.Messages",      "End": true    }  }}CommentShareMikel Del Tioanswered a month agorePost-User-8285794 a month agoAn error occurred while executing the state 'Simple Test' (entered at the event id #2). The Parameters '{"QueueUrl":"https://sqs.us-east-1.amazonaws.com/<acct>/<name>","MessageAttributes":{"my-attribute-no-2":{"stringValue":"attribute2","binaryValue":null,"stringListValues":[],"binaryListValues":[],"dataType":"String"},"my-attribute-no-1":{"stringValue":"attribute1","binaryValue":null,"stringListValues":[],"binaryListValues":[],"dataType":"String"}},"MessageBody":"{"simpleBody":"something"}"}' could not be used to start the Task: [The field "stringValue" is not supported by Step Functions]SharerePost-User-8285794 a month agoI only get the error when using SQS: SendMessage integration.  My best guess is that the integration can't handle the extra values I'm getting from the original messages."messageAttributes": {"my-attribute-no-1": {"stringValue": "attribute1","binaryValue": null,"stringListValues": [],"binaryListValues": [],"dataType": "String"},ShareMikel Del Tio 25 days agoHi,I have updated the previous answer with a working example, take a look.SharerePost-User-8285794 25 days agoThe case on the attributes does seem to be the problem.  If I change "StringValue.$" to "stringValue.$" in the first example from my original post, I get the same error.  There's a mismatch between SQS and Step Functions.  SQS sets the field names to lower camel case, but Step Functions requires upper camel case.  SQS --> EventBridge Pipe --> Step Functions --> SQS probably isn't a common pattern, but this still feels like a bug.SharerePost-User-8285794 25 days agoI solved this by adding a lambda enrichment to the EventBridge Pipe.  The lambda converts the five attribute field names to UpperCamelCase.  Thanks for your help Mikel Del TioShare"


Question: Unable to determine handler from trigger event

"I am deploying back end application using python and fastapi. The application works fine. To warm up Lambda function , I created a rule with schedule of 1 min with JSON text { "hello": "test"} with my Lambda function as target.My fastapi example is as likefastapi 0.71.0mangum 0.12.3from fastapi import FastAPIfrom mangum import Mangumapp = FastAPI()handler = Mangum(app)@app.get("/ping")def ping():    return {'response': 'pong'}Following error generates[ERROR] TypeError: Unable to determine handler from trigger eventTraceback (most recent call last):  File "/var/task/mangum/adapter.py", line 88, in __call__    handler = AbstractHandler.from_trigger(  File "/var/task/mangum/handlers/abstract_handler.py", line 115, in from_trigger    raise TypeError("Unable to determine handler from trigger event")[ERROR] TypeError: Unable to determine handler from trigger event Traceback (most recent call last):   File "/var/task/mangum/adapter.py", line 88, in __call__     handler = AbstractHandler.from_trigger(   File "/var/task/mangum/handlers/abstract_handler.py", line 115, in from_trigger     raise TypeError("Unable to determine handler from trigger event")FollowComment"

Answer: "0I recently faced a similar issue and the solution is provided at https://repost.aws/questions/QU0A9xe6i_T6CfOWLeiWm4XA/api-gateway-with-lambda-unable-to-import-module-server-no-module-named-serverAn example of handler is located at https://github.com/fortejas/example-serverless-python-api/blob/main/lambda-api/server.pyhandler = Mangum(app)You would also need to install the required python dependenciesSample commands  curl -O https://bootstrap.pypa.io/get-pip.py  sudo python3.7 get-pip.py   python -m pip --version   rm get-pip.py   pipenv  cd lambda-api/  virtualenv -p /usr/bin/python3.7 vpy37  source vpy37/bin/activate  pip3 install fastapi  pip3 install boto3  pip3 install Magnum  pip3 install uvicornCommentShareSrianswered a year agoTechxonia a year agoI have installed all dependencies  but error continuesShareSri a year agoWould you be able to post your code to a git repo/pastebin and provide the steps on how to reproduce the issue?Share0By default, the Lambda engine calls your function and is looking for an entry point like:def lambda_handler(event, context):    # your code goes hereYou can see this when you create a new Python function.If you're concerned about keeping your function warm, Lambda provisioned concurrency is normally a better way to go.CommentShareEXPERTBrettski-AWSanswered a year agoTechxonia a year agoI used this approach but got this error Execution failed due to configuration error: Malformed Lambda proxy response. My app works fine with mangum but problem on schedule event.Share"


Question: Adding a new model to RoboMaker

"Hi everyone,How can I add my own gazebo models to RoboMaker? I tried to find local model repository and I added there but when I create a new simulation job I could not see my models on gazebo.Thank you.FollowComment"

Answer: "0Accepted AnswerHi mustafadurmus,You need to bundle the assets in your simulation application. For example, the easiest way to do it would be to follow the House World package in Github https://github.com/aws-robotics/aws-robomaker-small-house-world. Create a package in your simulation workspace, copy assets into the package, then setup the .launch file, CMakeLists.txt, and package.xml accordingly.CommentShareAWS-User-5010218answered 3 years ago"


Question: Redshift nodes: 14 x dc2.large vs 4 x ra3.xlplus - COPY performance drop

"We recently switched our Redshift cluster from 14 x dc2.large to 4 x ra3.xlplus as we really liked the idea to have the storage decoupled from the nodes.I expected some kind of change in performance since we're having now 16vCPU vs 28vCPU and 210GB ram vs 128GB. However, first tests showed an massive decrease in loading times. First of all, the bucket contains still the same amount of files: ~500'000. Resulting in 720'000 records. We are aware that this could be improved, but we want to compare the performance:14 x dc2.large: 15min4 x ra3.xlplus: 42minFor both loads, no other queries were running. Exactly the same COPY statement (STATUPDATE & COMPUPDATE off). CPU utilization shows that all 4 nodes are at max 50%. WLM is set to automatic with the current user executing to priority high.Same performance drop can be measured in bigger join operations etc.Anyone else facing the same experience?  Do those ra3 nodes need some time to make the magic (like distinguish between cold & hot etc) happen?FollowComment"

Answer: "0With the AWS node conversion recommendations, I've mostly read that for DC2 instances the performance kind of remains same with the RA3. But in your case, looks like you almost cut the capacity in half while opting to RA3. Is this AWS recommended config?CommentShareBlackMambaanswered a year ago0The documentation states the following:"Create 3 nodes of ra3.xlplus for every 8 nodes of dc2.large"https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-clusters.htmlSo we would end up with 5.2 ra3.xlplus nodes. But as those nodes arent cheap (10k/y) the decision wasnt easy. The documentation states also that they improved S3 loads in comparison to dc/ds nodes. But considering loading times resulting in 3x more(!) and simple joins taking double amount i'm quite speechless. Thats why i'm looking for other experiences - might be that the performance will increase over time. We started the new cluster yesterday, so its fresh and much loads are running for the first time now on the ra3 cluster.CommentShareAndJCanswered a year ago0Hi, Thank you for your patience.For the load issue, I think that what you are experiencing is normal, considering the specific types of files you are loading (more than 500k files with a few rows each).In this case the better throughput between S3 and Redshift would not help, because the most probable delay would come from the opening of all the files not the time to move few rows.ra3.xlplus instances have the same number of slices of dc2.xlarge, and each slice will load one file at the time, so based on the number of nodes you shared you have, now, almost one third of the slices, so each will have a longer queue of files to load.Also, ra3.xlplus have 2 cores per slice, but only one will be used by the load operation , thus the 50% utilization you see.Definitely, as you already know,  the optimization/consolidation of the input files would be beneficial for both clusters.As for the join slow down , it is not possible to provide any feedback without seeing the explains in both clusters, nor knowing how much data is read during the query, nor having an idea of the table design.could you provide additional information or open a support case (if not already done)?hope this helps.CommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: greengrass v2 - secret manager - throws "not supported" exception

"Hello AWS Team.i am using Greengrass V2 and am struggeling to retrieve a secret from the secret manager.i followed the manual installation: https://docs.aws.amazon.com/greengrass/v2/developerguide/manual-installation.htmland then used this example for the secret retrieval: https://github.com/aws-samples/greengrass-v2-secrets-manager-pythonthe code in question:ipc_client = awsiot.greengrasscoreipc.connect()get_secret_operation = ipc_client.new_get_secret_value()get_secret_operation.activate(request=model.GetSecretValueRequest(secret_id=OPCUA_CERT_AWS_SECRETID))secret_response = get_secret_operation.get_response().result()this: "secret_response = get_secret_operation.get_response().result()" is throwing the exeption below:2021-03-19T15:13:29.477Z [ERROR] (pool-2-thread-137) datashipper-DatashipperFunction-T4JRBU21QPQC: datashipper.py:59,Failed due to: ServiceError(message='Operation aws.greengrass#GetSecretValue is not supported by Greengrass'). {serviceInstance=0, serviceName=datashipper-DatashipperFunction-T4JRBU21QPQC, currentState=RUNNING}could someone please explain why it says that the function is "not supported"?Thank youChrisFollowComment"

Answer: "0Hi Chris,A probable reason is that you have not deployed the secret manager component to your device https://docs.aws.amazon.com/greengrass/v2/developerguide/secret-manager-component.html . If you're seeing this issue despite including this component in your deployment, could you share more details on if you see it started up properly or if there are any errors in greengrass.log / aws.greengrass.SecretManager.log ?Thanks,ShaguptaCommentShareshagupta-awsanswered 2 years ago0Hey Shagupta,the secret manager is included and "running" in version 2.0.5 according to the console.It however does not produce a log in /logs/however in the log of my function i see this:Failed due to: UnauthorizedError(message='Principal datashipper-DatashipperFunction-T4JRBU21QPQC is not authorized to perform aws.greengrass.SecretManager:aws.greengrass#GetSecretValue on resource arn:aws:secretsmanager:eu-west-1:111934086604:secret:greengrass-dil-psn-sc-lev-opcua-client-cert-664OZO').however i have granted that specifically:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": "secretsmanager:GetSecretValue","Resource": "arn:aws:secretsmanager:eu-west-1:111934086604:secret:greengrass-dil-psn-sc-lev-opcua-client-cert-664OZO"}]}what am i missing?-ChrisCommentShareChris-Ranswered 2 years ago0Hi Chris,The IAM policy looks correct, however Greengrass IPC also requires authorization, you would need to configure the appropriate IPC authorization policy for your component.Details on IPC authorization policy - https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html#ipc-authorization-policiesDetails on Secret Manager IPC operation to include in the authorization policy https://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-secret-manager.html#ipc-secret-manager-authorizationIf you've already done this, could you post the auth policy config and the content of your config.tlog/effectiveConfig.yaml file ?Thanks,ShaguptaCommentShareshagupta-awsanswered 2 years ago0Hey shagupta,thanks that was the missing info. It works now.-ChrisCommentShareChris-Ranswered 2 years ago"


Question: Fine grained row level access to Dynamodb via Cognito Authorizer

"Im able to only allow logged in users to access my Api gateway endpoint via Cognito Authorizer. The next step is to allow users to only access their data in Dynamodb. For that Im taking the role ARN (which is defined in my user group) from the lambda request event, and assuming that role before querying Dynamodb. Here's my DynamoDB policy. If I hardcode the cognito user pool sub, which matches the portion key on the table, it works, which means my policy is correct. I just can't figure out how to dynamically get the user pool sub in the policy.    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "dynamodb:DeleteItem",                "dynamodb:GetItem",                "dynamodb:PutItem",                "dynamodb:Query",                "dynamodb:Update*",                "dynamodb:Delete*"            ],            "Resource": [                "arn:aws:dynamodb:*:*:table/table-name-db",                "arn:aws:dynamodb:*:*:table/table-name-db/index/*"            ],            "Condition": {                "ForAllValues:StringEquals": {                    "dynamodb:LeadingKeys": [                        <NOT SURE WHAT TO ADD HERE>                    ]                }            }        }    ]}```FollowComment"

Answer: 0Does this help - https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_dynamodb_items.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 9 months agokevlar 9 months agoThanks for your reply. "${cognito-identity.amazonaws.com:sub}" doesn't work unless you are using the indentity pool id as the partition key. In my case Im suing the user pool sub as partition key.Share0OK. I am not aware of how to accomplish this without using Cognito Identity Pools. This blog explains how you can use Cognito Identity Pools with Cognito User Pools to achieve fine-grained authorization - https://aws.amazon.com/blogs/mobile/building-fine-grained-authorization-using-amazon-cognito-user-pools-groups/CommentShareEXPERTIndranil Banerjee AWSanswered 9 months ago


Question: Cant SSH from my bastion server

"Hello there,i  have 2 instances :My-APPMy-Bastion-ServerMy-APP is where my site is placed, it can be browsed through the internet but, since 06 February 2023, everytime i try to ssh to My-APP through My-Bastion-Server it return error "Connection timed out" any idea how to solve this ? thanks in advance.anyway the command i use to ssh My-APP through My-Bastion-Server is :ssh -i ~/.ssh/[KEY] [IP]FollowComment"

Answer: "0One possible reason for your access issue, is if you have allowed SSH access to your home IP address via the associated security group, it is possible that your IP address has changed and would therefore suddenly no longer be working. Check your security groups and see if your rules are still appropriate for your access.CommentSharebenduttanswered 4 months agoCybermax 4 months agothank you for your answer, but i can assure you IP is not the  problem, the public IP of my office hasn't changed. and even so, if the IP changed we can just adjust the Inbound rule. any other suggestion?Share"


Question: DynamoDB Update API response filter

"Is it possible to somehow filter the API response received after updating an item in DynamoDB?With filter I mean something similar to the ProjectionExpression capability with a query operation, for example.Even though the ReturnValues option does however provide a number of "filtering" options, it does however not permit selective attribute inclusion.Is there perhaps another way to achieve this?FollowComment"

Answer: "0As you saw, you can only express what ReturnValues will accept: NONE, ALL_OLD, UPDATED_OLD, ALL_NEW, UPDATED_NEWFor details: https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateItem.html#API_UpdateItem_RequestSyntaxWhy are you worried about returning too much?CommentSharejzhunteranswered a year ago0Many thanks for the speedy reply.The update is looped to a query that initiates the process.  Once an item is queried, the update functionality updates an attribute that then conditionally prevents future queries.Preferably I would like to limit the client's access to attributes that are of relevance.There are also attributes that I will be using to record activities in the background, which without a ProjectionExpression functionality, I will now be sharing with the client.It does not sound feasible to superficially update all the attributes that I would like to share with the client, by going the ReturnValue: UPDATED_NEW route.  If that is the only option...CommentShareAWS-User-1681459answered a year ago"


Question: S3 sync handling of downloads beyond 36 hours or session token expiry

"When downloading large files (e.g. a few TB of data) via S3 CLI, the session token expires beyond 36 hours. I understand from here that it's not possible to extend or refresh temporary credentials.I would like to know if s3 sync can resume the same downloading job with a new set of temporary credentials.FollowComment"

Answer: 0Yes with new credentials any object that has already been transferred won't be retransferred. However if one object is particularly large and will not complete within 36 hours even though the s3 sync commmand will use multipart upload you cannot resume from failed uploads in this scenario - see docs. You could run a multi part upload on large file which you can resume using the lower level cli commands - see here.You might also want to consider using AWS Datasync if this is a process which you will be running regularly.CommentShareEXPERTPeter_Ganswered a year ago


Question: Error: could not start transaction: dial tcp 35.155.7.221:5439: i/o timeout

"When the Terraform is performing the following actions:redshift_schema.external_from_glue_data_catalog will be createdresource "redshift_schema" "external_from_glue_data_catalog" {id    = (known after apply)name  = "spectrum"owner = "sde_user"quota = 0external_schema {database_name = "spectrum"data_catalog_source {create_external_database_if_not_exists = trueiam_role_arns                          = ["arn:aws:iam::636522636858:role/sde_redshift_iam_role",]region                                 = "us-east-1"}}}there's an Error: could not start transaction: dial tcp 35.155.7.221:5439: i/o timeout││   with redshift_schema.external_from_glue_data_catalog,│   on main.tf line 169, in resource "redshift_schema" "external_from_glue_data_catalog":│  169: resource "redshift_schema" "external_from_glue_data_catalog" {FollowComment"

Answer: "0To answer your question, we require details that are non-public information. Please open a support case with AWS using the following link.CommentShareSUPPORT ENGINEEREvandro_Panswered 4 months ago"


Question: Dynamodb: Deleting all items & Read Write Capacity Query

"Hi,I have a use case where I get about 20 links at a fixed time each day and want to store them in DynamoDb for analysis using AWS Lambda. I want to delete all prior stored links and then store new ones. I could not find a way to delete all items in Dynamodb like SQL so I am dropping the table and then re-creating it. I am not sure if this is the right way to go about it. Also, wanted to get inputs on required provisioned capacity for this exercise. I will have only about 20-30 rows with 5 columns. Below is my code which is currently working but wanted to get inputs if this is how this should be implemented and if there are AWS cost implications for this - I am new to AWS and currently on AWS Free Tier.def getLinks&Store():links = getLinks()dynamodb = boto3.resource('dynamodb', region_name = 'us-east-2')try:    oldTable = dynamodb.Table('Links_Dynamic')    if oldTable is not None:        client = boto3.client('dynamodb')        client.delete_table(TableName='Links_Dynamic')        waiter = client.get_waiter('table_not_exists')        waiter.wait(TableName='Links_Dynamic')except:    print('Old Table is not available')linksDynamicTable = buildNewTable(dynamodb)for link in link: linksDynamicTable.put_item(Item= {'link': link})def buildNewTable(dynamodb):table = dynamodb.create_table(TableName="Livestream_Dynamic",    KeySchema=[        {            'AttributeName': 'LivestreamID',            'KeyType': 'HASH'  #Partition key        }    ],    AttributeDefinitions=[        {            'AttributeName': 'LivestreamID',            'AttributeType': 'S'        },    ],    ProvisionedThroughput=         {             'ReadCapacityUnits': 10,            'WriteCapacityUnits': 10        }        ,    )table.meta.client.get_waiter('table_exists').wait(TableName='Livestream_Dynamic')return tableRegards,DbeingsFollowComment"

Answer: "1A few things here, firstly you are correct, there is no way to delete all the items like you can in SQL I'm afraid. You can continue to drop the table as you have been doing, however it is likely a lot slower than deleting your items using the API. As you are on free tier, you are allowed to use up to 25WCU and 25RCU per region. If you have only a single table, you can allocate that capacity to the single table. I suggest removing Autoscaling should you wish to remain in the free tier.As you only have a relatively small number of items, I so not see you exceeding 25WCU for the delete operations. You can delete the items in 2 ways, you can use delete_item and run a loop to delete each item in your list, or you can add your delete_items to a batch_writer which will allow you to delete batches of items in single requests.To understand you capacity requirements, keep an eye on your ConsumedCapacity metrics in CloudWatch, this will allow you to understand your consumption. Based on your described use-case, I believe consumed capacity will be relatively low.CommentShareEXPERTLeeroy Hannigananswered a year ago0As mentioned in AWS DynamoDB documentation, The **BatchWriteItem **operation puts or deletes multiple items in one or more tables. A single call to BatchWriteItem can write up to 16 MB of data, which can comprise as many as 25 put or delete requests.DynamoDB doesn’t have a command that deletes multiple rows so you can perform a Scan API Operation, looping through the response to feed into a BatchWriteItem call. Here’s how in Python:How to utilize "BatchWriteItem" to delete multiple items (without deleting a table) is shown in the example on Stackoverflow:https://stackoverflow.com/questions/55169952/delete-all-items-dynamodb-using-python#answer-61641766 with table.batch_writer() as batch:        while page["Count"] > 0:            counter += page["Count"]            # Delete items in batches            for itemKeys in page["Items"]:                batch.delete_item(Key=itemKeys)            # Fetch the next page            if 'LastEvaluatedKey' in page:                page = table.scan(                    ProjectionExpression=projectionExpression, ExpressionAttributeNames=expressionAttrNames,                    ExclusiveStartKey=page['LastEvaluatedKey'])            else:                breakAs @Leeroy Hannigan mentioned, As you are on the free tier, you are allowed to use up to 25WCU and 25RCU per region.Check Free Tier Details:https://aws.amazon.com/dynamodb/pricing/provisioned/#DynamoDB_free_tierCommentShareSwwapnilanswered a year ago"


Question: how to upgrade Elasticache Redis clusters from 6.2.6 to 7.0.5

"Hello,We have one application using ElastiCache Redis cluster 6.2.6 and we would like to upgrade to 7.0.5 so that the automatic updates happen after that. What is the process to do the upgrade? How can we make sure the key values do not get lost during the upgrade? Also how to enable encryption at rest and in transit? Please let us know. Thanks in advance.FollowComment"


Question: Cost of Amazon CloudFront additional metrics

"Hi,I want to enable Amazon CloudFront 8 additional metrics for one distribution.When calculating the cost, should I multiply 8 metrics by the number of minutes per month or does it count as 8 metrics only?FollowComment"

Answer: "0Accepted AnswerAmazon CloudWatch custom metric pricing isNumber of distributions you activated this forX8 (up to 8 metrics, depends on the actual events types that occur)X0.30$if they use Amazon CloudWatch API there will be a retrieval fee - 0.01$ per 1000 requestsFrom the documentation:https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/viewing-cloudfront-metrics.html#monitoring-console.distributions-additional-pricingWhen you enable additional metrics for a distribution, Amazon CloudFront sends up to 8 metrics to Amazon CloudWatch in the US East (N. Virginia) Region. Amazon CloudWatch charges a low, fixed rate for each metric. This rate is charged only once per month, per metric (up to 8 metrics per distribution). This is a fixed rate, so your cost remains the same regardless of the number of requests or responses that the Amazon CloudFront distribution receives or sends. For the per-metric rate, see the Amazon CloudWatch pricing page and the Amazon CloudWatch pricing calculator. Additional API charges apply when you retrieve the metrics with the Amazon CloudWatch API.CommentShareAWS-User-8292465answered 3 years ago"