Question: Are there events triggered when GameLift fleets scale?

"Hi -I understand there are specific events fired for certain FlexMatch matchmaking events (https://docs.aws.amazon.com/gamelift/latest/flexmatchguide/match-events.html).Is there anything fired (that we can capture through SNS, for example) when a GameLift fleet triggers a scaling event?Thanks.-SteveFollowComment"

Answer: "0Hi @REDACTEDUSERCurrently, there is no such mechanism in-place today, though it is a requested feature and it is currently in our backlog.Suggested workaround:If you don't need this data in real time, you can setup a scheduled task to [describe fleet events](https://docs.aws.amazon.com/cli/latest/reference/gamelift/describe-fleet-******GLIFT-14510CommentSharerePost-User-7108006answered 2 years ago"


Question: When should Amazon EBS io2 Block Express volumes be considered for SAP HANA workloads?

When should Amazon EBS io2 Block Express volumes be considered for SAP HANA workloads?FollowComment

Answer: "1Accepted AnswerPlease refer to the SAP Lens: Best Practice 14.2 – Select and configure EBS types aligned with performance requirementsio2 Block Express is a good option for SAP HANA workloads when you understand and have validated the performance and reliability requirements of your system or witness performance bottlenecks for the following items:you need more than 16,000 IOPS or 1,000 MB/s of throughput from a single volume for your SAP HANA data or log file systemsyou need sub millisecond latency for your SAP HANA log volumeyou require storage durability exceeding 99.9% for a single volume. io2 offers 99.999% durability for a single volumeyou need to be able to scale a single volume to up to 64TBNOTE: This answer is provided by the SAP on AWS speciality team and is accurate at the time of publish. Please check comments as the answer may have changed/services evolved.CommentShareNicolas_Banswered 4 months ago"


Question: My MWAA Environment stuck in updating

"Hi, I update my MWAA environment through a requirements.txt file , but it remains in the update state.In the scheduler log, requirements_install and scheduler_console continues to repeat.Error in scheduler_console is ERROR: You need to upgrade the database. Please run 'airflow db upgrade'. Make sure the command is run using Airflow version 2.5.1.Is there a timeout for updates? If not, I want to know how to stop.please help me.FollowCommentrePost-User-5203319 4 months agoI just received this error as well starting around 2023-01-26 01:21:02 UT.  Did not update anything in MWAA prior to this.The airflow-MyAirflowEnvironment-Worker log shows this may be related to a python package dependency?/usr/local/airflow/.local/lib/python3.7/site-packages/airflow/models/base.py:27 DeprecationWarning: The sql_alchemy_schema option in [core] has been moved to the sql_alchemy_schema option in [database] - the old setting has been used, but please update your config./usr/local/airflow/.local/lib/python3.7/site-packages/airflow/models/base.py:70 DeprecationWarning: The sql_alchemy_conn option in [core] has been moved to the sql_alchemy_conn option in [database] - the old setting has been used, but please update your config.ERROR: You need to upgrade the database. Please run `airflow db upgrade`. Make sure the command is run using Airflow version 2.5.1.We are running airflow v2.2.2 using MWAA.  Apparently we cannot just upgrade to 2.4.3 via the AWS console (UI gives an error "unable to upgrade").  To resolve this issues, we found we had to specify exact python package versions in a requirements.txt file.  To determine the acceptable package versions, run a worker task that just does pip freeze and look at the logs.  Then update the requirements.txt to reference these versions, before referencing/uploading to MWAA.Long term, I expect we will eventually need to start up a fresh MWAA env with the latest airflow version.Share"

Answer: "1Accepted AnswerHello,When an MWAA environment is stuck in a state that is not "available" it should time out after a few hours and result to an "Update Failed" state. You can see a similar re:Post question at [1]. For configuration or requirements updates it is always recommended to test the environment on the local runner [2] before deploying to MWAA. See our best practices guide at [3].If you are still experiencing this issue I would recommend you open a case with AWS Support at [4] so we can assist you in determining a root cause, as we will require access to information about your environment.Hope this helps![1] https://repost.aws/questions/QUmknyg682SW2kMjFPVQtcJg/amazon-mwaa-environment-stuck-at-updating-status[2] https://github.com/aws/aws-mwaa-local-runner[3] https://docs.aws.amazon.com/mwaa/latest/userguide/best-practices-dependencies.html[4] https://support.console.aws.amazon.com/CommentShareJoel_Panswered 4 months ago0Was there a solution to this issue? We have the same issue. Also, the local runner doesn't run on my machine. I've opened on issue on the repo, but it's hard to test when your local runner doesn't work.CommentSharerePost-User-2800852answered 3 months ago"


Question: "post_install, post_install_args and script output logs ?"

"Hi all,I am trying to setup NIS on the Cluster.Therefore I am writing a script to add the needed packages and run the configuration commands, start services and so on.My questions:What can be used as "post_install_args" ? Is it possible to have there the MASTER_IP? How?How can I differentiate if the script is running on the master or on a compute node?Where is the output of the script? Can I send it to /tmp/script.log or something similar on the node being installed?Many thanks,RichardFollowComment"

Answer: "0Hi,the post_install_args content is passed as argument to the post_install script:https://github.com/aws/aws-parallelcluster-cookbook/blob/v2.3.1/files/default/fetch_and_run#L24It is possible to differentiate between master and compute nodes execution by sourcing the /etc/parallelcluster/cfnconfig file and evaluating the cfn_node_type environment variable, whose possible values are MasterServer and ComputeFleet for the master and compute node respectively.#!/bin/bash. "/etc/parallelcluster/cfnconfig"case "${cfn_node_type}" in    MasterServer)        echo "I am the master" >> /tmp/master.txt    ;;    ComputeFleet)        echo "I am a compute node" >> /tmp/compute.txt    ;;    *)        ;esacIn the /etc/parallelcluster/cfnconfig file of the Compute instances you can also find the master ip, in the cfn_master variable.The output of the pre/post-install scripts can be found in the /var/log/cfn-init.log and /var/log/cfn-init-cmd.log files.Please refer to the official docs:https://aws-parallelcluster.readthedocs.io/en/latest/pre_post_install.htmlhttps://aws-parallelcluster.readthedocs.io/en/latest/configuration.html#pre-installI just created a patch to clarify the documentation and add an example for the post_install_args usage: https://github.com/aws/aws-parallelcluster/commit/02c08c177c1e732010f62439f08a6939858a379eLet us know if it helpsCommentShareenrico-awsanswered 4 years ago0Hi Enrico,yes, your answer helps a lot !And yes, I am following the official docs, but either I am not finding all answers or not understanding it.Now I don't get my post_install script to start, post_install shows as NONE, despite me setting an URL to an s3 bucket script in my config. I'll write a new post on this, if the Forum allows me to send a new one, to many post restrictions here ...Many thanks,RichardCommentShareremsanswered 4 years ago0Can you please post your config? (redact any keys you have in it)Also if the forum post restrictions are bothering you, you can always open a github issue: https://github.com/aws/aws-parallelcluster/issuesCommentShareaws-hpc-seananswered 4 years ago"


Question: Qldb table index size increase

I've tired to increase the size of the qldb tables index size. currently my limit is I can able to create 5 indexes. can't able to create more than five.FollowComment

Answer: "0Per the documentation, "QLDB enforces a limit of five indexes per table, including failed indexes. You must drop an existing index before creating a new one."Best regards,JamesCommentSharejlarnedanswered 6 months ago"


Question: "Elasticsearch ignoring, rejecting requests"

"Hello,Approximately 10 days ago my elasticsearch cluster stopped accepting new documents to some indices.I am writing log data to elasticsearch from an ECS task using  https://github.com/internetitem/logback-elasticsearch-appender, which formats log messages for submission to the Elasticsearch /_bulk REST API. I am using the AWS java SDK version 1.11.632 to access the default credential provider chain and sign requests. The task is assigned a specific task role in the task definition, and this role has been added explicitly to my ES domain's access policy.The ES cluster is managed in a "shared" AWS account while the ECS task is running in a separate "dev" account. The domain name is "logs".The access policy looks like this (account numbers redacted){  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": [          "arn:aws:iam::DEV_ACCT_NUM:role/ecsTaskExecutionRole",          "arn:aws:iam::DEV_ACCT_NUM:role/MyTaskRole"          //Plus some more roles for other tasks        ]      },      "Action": "es:*",      "Resource": "arn:aws:es:ca-central-1:SHARED_ACCT_NUM:domain/logs/*"    },    {      "Effect": "Allow",      "Principal": {        "AWS": "arn:aws:iam::SHARED_ACCT_NUM:role/Cognito_Kibana_IdentitiesAuth_Role"      },      "Action": "*",      "Resource": "arn:aws:es:ca-central-1:SHARED_ACCT_NUM:*"    }  ]}Logs are written to an index named {environment}-{date}, e.g. "dev-2020-04-23". I expect that if the so named index doesn't exist it will be created when I write to it. This has worked so far.THE PROBLEM:When I write to ES, I sometimes receive a 403 response indicating that the request signature is invalid. Nothing has changed about the way I retrieve credentials or sign requests, nor has my access policy changed.More often the response is 200 OK, but the logs do not appear in Kibana and the index does not appear in the AWS management console.I can still write to existing indices which leads me to believe the problem is in creating new indices and not in writing documents. I was not able to find any documented limit to the number of indices.This behaviour was first observed when the cluster was ES version 7.1. Upgrading to 7.4 did not help.Thanks in advance for any assistance.FollowComment"

Answer: 0This has been solved. While there's no limit on the number of indices there is a limit on the number of shards per data node. If creating an index would require more shards than the limit Elasticsearch allegedly fails with an error. AWS swallows this error and returns success when the _bulk API is used.Manually deleting some old indices has resolved the issue.CommentSharejamestwiggmarbleanswered 3 years ago


Question: Upgrade Reserved Instance

"Hi. I have a t2.large RI (convertible) which will expire in December 2024. I now need to add a new server with higher capacity (possibly an m4.xlarge). I'm trying to figure out how best to optimise cost.The new m4 instance will run parallel to the current server for 4-6 months and then the t2 instance will be decommissioned.Is there a way to change my RI from t2 to m4 after 6 months? If yes, how can I minimise the cost for the new m4 for these 6 months? If not, is there a way to avoid paying for the whole year after the t2 is decommissioned?Thanks!FollowComment"

Answer: "2Accepted AnswerYes, if you have convertible RIs you can likely convert them for the new instance types.  The link below details when conversions can be made at the details of the process.  As for when you do it, you will have to do a bit of math and determine whether you convert the RIs now or when you are ready to shutdown the existing instances.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ri-convertible-exchange.htmlExchange Convertible Reserved InstancesYou can exchange one or more Convertible Reserved Instances for another Convertible Reserved Instance with a different configuration, including instance family, operating system, and tenancy. There are no limits to how many times you perform an exchange, as long as the new Convertible Reserved Instance is of an equal or higher value than the Convertible Reserved Instances that you are exchanging.When you exchange your Convertible Reserved Instance, the number of instances for your current reservation is exchanged for a number of instances that cover the equal or higher value of the configuration of the new Convertible Reserved Instance. Amazon EC2 calculates the number of Reserved Instances that you can receive as a result of the exchange.You can't exchange Standard Reserved Instances, but you can modify them. For more information, see Modify Reserved Instances .CommentShareEXPERTiBehranswered 21 days agoNitesh 21 days agoThank you for the explanation. It seems the best option is to move the RI from t2 to m4 and perhaps run the current t2 instance in the spot mode for as long as required. Is my understanding correct?ShareiBehr EXPERT19 days agoThere are some other implications of spot mode.  Using on-demand is the simplest option for the t2, but obviously a bit more costly.  If you want to do spot, you will have to create an image of the t2 instance and then launch a spot instance with that image.  So doing so will take a bit of downtime.  Make sure that you use persistent spot instance so if the instance gets preempted it stops rather than terminates and then restarts when sufficient capacity exists.  Further, make sure that you understand spot capacity and that you can lose the instance for unknown periods of time with 2 minutes notice when spot capacity is low.  Finally, I would highly recommend using Data Lifecycle Manager (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html) to automatically create snapshots of your instance on a daily basis and keep them for several days as a safety net.ShareNitesh 19 days agoT2 on-demand sounds better then. Thanks again.Share0Agreed with exchanging reserved instances. If you need to calculate how much you can save with the new instance type, I recommend trying aws pricing for google sheets. It's helpful to compare on-demand and different reserved instance prices!CommentShareBriananswered 21 days agoNitesh 21 days agoThank you! This is helpful!Share-1Hello Nitesh,Yes, you can change your t2 to a t3 or an m4 easily by stopping your instance (NOT TERMINATING IT), and right click on the instance in the portal and select Instance Settings / Change Instance Type.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-resize.htmlBestCraigCommentShareCraig Simonanswered 21 days agoNitesh 21 days agoThanks, but I want to change my RI, not the instance itself.Share"


Question: Enforce Tags SCP for DynamoDB is not working

"Hi, I followed this official guide from aws in order to implement a tagging strategy for resources in my AWS Organizationhttps://aws.amazon.com/de/blogs/mt/implement-aws-resource-tagging-strategy-using-aws-tag-policies-and-service-control-policies-scps/The example is for EC2 instances, I followed all steps and this worked, however when I wanted to replicate the steps for S3, RDS and DynamoDB it did not work.The following is the SCP I want to use in order to enforce the tag test to be on every created dynamodb table. This is exactly how it is done in the Guide for EC2.{"Version": "2012-10-17","Statement": [{"Sid": "Statement1","Effect": "Deny","Action": ["dynamodb:CreateTable"],"Resource": ["arn:aws:dynamodb:*:*:table/*"],"Condition": {"Null": {"aws:RequestTag/test": "true"}}}]}However when I try to create a DynamoDB Table with the tag test I get the following error message. I am passing the tag test, however I still get a deny.User: arn:aws:sts::<account>:assumed-role/<role>/<email> is not authorized to perform: dynamodb:CreateTable on resource: arn:aws:dynamodb:eu-central-1:<table>:<table> with an explicit deny. I tried creating this SCP for the Services RDS, S3 and DynamoDB, only EC2 seems to work.Do you have an idea what the error could be or is anyone using this tagging strategy in their AWS Organization/AWS Control Tower. Would be interested to hear what your experience is as this seems really complicated to me to implement and does not work so far.Looking forward to hear form you people :)FollowComment"


Question: "AZ_Assert - not break program execution, why?"

"Hi i try understand whyAZ_Assert(false, "Some message") ;Not breaking my program execution. In "Trace.h" i read this "Asserts should be used for critical errors, where the program cannot continue. They print the message together with file and line number, and a call stack if available. They then break program execution." I trying use#define AZ_ENABLE_TRACINGBut the same problem, my game not breaking, or i not correct understand this macros ?Follow"

Answer: "0Accepted AnswerHey @REDACTEDUSERShouldn't it only break when the assertion fails?AZ_Assert(false, "dsfsdf");SharerePost-User-7836246answered 5 years ago0To be honest, I don't know.How are you running your tests? Is it inside the editor? Are you inside a debug environment (running inside visual studio using a debug build or just using the debug directories)?I know it's annoying answering "random" questions, but once we figured it out, it will help others with the same problems.(Can't figure out why you would get a log event instead of a "normal" assert...)SharerePost-User-7836246answered 5 years ago0Change it to debug.I think I got the same response as you do. It only logs a message in "profile" mode. Debug mode is different.(It's compiling to double check this and takes a long while, but wanted to write this :)I think you're not running in debug mode is the main take away.SharerePost-User-7836246answered 5 years ago0Yes you right "false", this is my misspelling. But not breaking :( I see in log message but game not break and continues to work. Why?SharerePost-User-0150549answered 5 years ago0Thanks for trying helping :) I glad answer to ""random" questions"."How are you running your tests? Is it inside the editor?" - no i build in vs2015 ([all] profile_dedicated) and then run *Luncher_Server.exe. Luncher i run from "1.12.0.1\dev\Bin64vc140.Dedicated\GameLauncher_Server.exe"I understand clear ? If AZ_Assert(false, "asdasd") my game must be shutdown ?SharerePost-User-0150549answered 5 years ago0Hi Nocturn. Yes you right !!! All worked excellent when profile set to "[all] *_debug" profile. How i understood AZ_Assert using only for debugging mode not for release. Thank you very much for help :)SharerePost-User-0150549answered 5 years ago"


Question: Quicsight Dataset not connecting to Datasource.

My Quicksight dataset is not able to connect to the data source. Instead I'm getting an error message stating 'Connecting to your data source took too long. Retrying this request may help. Contact technical support for further assistance.' I have been using the dataset for over a year now without issues but started facing this issue starting early this week.FollowCommentFabrizio@AWS EXPERTa year agowhat is the data source?If it is a database how long does it takes the query?is the datasource in a VPC?have the networking setting changed?Share

Answer: 0There is some key setting you need revisit.is there any role and rights change at the db level?check you VPC.In bound or outbound IP'sReset you DB password.database allowing to make connectionCommentShareNaveed Hashmianswered a year ago


Question: SSH timeout AWS EC2

I do have an AWS EC2 and I'm unable to connect by SSH. Port 22 is open in the default AWS firewall (with my IP).I keep getting: Operation timed outI suspect that UFW or fail2ban block me.Is there a console in the AWS Panels can let me connect to this instance? Or an another way to connect to be able to unban me?Thank you.FollowComment

Answer: "2I think your best option here would be to connect using AWS Systems Manager Session Manager.Please see the documentation for details on how to connect using Session Manager: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/session-manager.htmlCommentShareGreg_Hanswered a year agopicarda a year agoHow to install SSM Agent when you cannot connect by ssh?Share1Take a look at EC2 Serial Console for Linux instances.CommentShareEXPERTkentradanswered a year ago0Hello,I try to connect from a different device and IP... Still get a "timeout".I try to connect with "Serial Console", I upload a public key... But I get a "Permission denied" when I try to connect.Please note that I'm on Debian 10 so the "EC2 Instance connect" don't work.Help please.CommentSharepicardaanswered a year ago"


Question: I can't find UpdateApplication/UpdateApplicationVersion event in cloudtrail

We are using elastic beanstalk a lot and we update the version from AWS only.Problem is i can see UpdateDeployment and other events but cannot find UpdateApplication/UpdateApplicationVersion event which supposed to be fired.FollowComment

Answer: "0Hi,As per the documentation [1], all Elastic Beanstalk actions are logged within Cloudtrail therefore the UpdateEnvironment and UpdateApplicationVersion actions should be logged too.[1] Logging Elastic Beanstalk API calls with AWS CloudTrail - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.cloudtrail.htmlI have tested this in my own environment by running the update-environment and update-application-version CLI commands and I was able to see these actions logged in my Cloudtrail console. These commands are:aws elasticbeanstalk update-application --application-name Test --description "New Test"aws elasticbeanstalk update-application-version --application-name Test --version-label "Sample Application" --description "New Version Label"With this being said, please verify that you are in the correct region when reviewing the Cloudtrail logs. This should be the same region where your Elastic Beanstalk environments exist. In addition to this, can you perform a test using the CLI commands as above and monitor if you see these events within Cloudtrail.If you verified that you are in the correct region however you are still experiencing the same behavior, we require details that are non-public information. Please open a support case with AWS using the following link:https://console.aws.amazon.com/support/home#/case/createCommentShareSUPPORT ENGINEERQasim_Danswered 2 months ago0For what it's worth, when I do a beanstalk deploy ( through the console but I assume it would be the same by calling the beanstalk API ) I get the following CloudTrail events ( I'm only looking at events that are NOT readOnly ) :elasticbeanstalk.amazonaws.com:CreateStorageLocationelasticbeanstalk.amazonaws.com:CreateApplicationVersionelasticbeanstalk.amazonaws.com:UpdateEnvironmentI don't see any events with the names you have above in there. I do tend to get notifications with those event names if I subscribe to beanstalk notifications; but I don't see those exact corresponding events in CloudTrail.CommentSharelarryjklanswered a month ago"


Question: Till how long will I be able to launch an instance from Amazon Linux1

"Amazon Linux 1 maintenance support will end on December 31, 2023. As per FAQ we should be able to launch instances using this AMI after the maintenance support window end but question is till how long ?FollowComment"

Answer: "0Hi,I understand you would like to know how long Amazon Linux 1 AMI will be available once the maintenance support ends on December 31, 2023. Please, let me know if my understanding is incorrect.Yes, you are correct that you will be able to launch Amazon Linux AMIs after the maintenance period. As of now, we do not have any official date on exactly when that will end but please be assure that we will update our policy that will allow our customers enough time to make any updates.I would also like to add on that we do recommend that existing Amazon Linux based compute environments to Amazon Linux 2 so that you continue to receive security and other updates and Amazon Linux 2 offers long term support until June 30, 2025. [1]In case you are further interested, to migrate to Amazon Linux 2, you have to launch an instance or create a virtual machine using the current Amazon Linux 2 image and install your applications, plus any required packages. Then you can test your application, and make any changes required for it to run on Amazon Linux 2. [2]There is also preupgrade assistant that makes it easier to migrate to Amazon Linux 2 from Amazon Linux AMI.  [3]I hope this helps. If you need further info, let me know in the comments; otherwise I'd appreciate if you mark my answer as "accepted".Kind regards,Rochak from AWSReferences:[1] Amazon Linux 2 FAQs - https://aws.amazon.com/amazon-linux-2/faqs/[2] Migrate to Amazon Linux 2https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/amazon-linux-ami-basics.html#amazon-linux-availability[3] Amazon Linux 2 Preupgrade Assistant - https://aws.amazon.com/about-aws/whats-new/2019/03/announcing_the_amazon_linux_2_preupgrade_assistant/CommentShareAWS-Rochakanswered 3 months ago"


Question: Is there something happening with API Gateway access logs?

"At about midnight of 13 Dec, 2021, the access logs for our 4 API gateway stages all stopped being added to CloudWatch. The settings for each of the stages indicates that access logs are enabled.FollowComment"

Answer: "0This wasn't a problem with AWS. Someone in our org removed the IAM role set up for API Gateway to send logs to CloudWatch. They thought it should be removed because it's a name used as part of a tutorial. This affected all of the stages deployed simultaneously, since they all use the same role to send log entries.CommentShareJohnanswered a year ago"


Question: Cloudfront with a Lambda@Edge pointing to a private S3

"I'm trying to setup a Cloudfront distribution to a S3 bucket using a OAI policy for access to S3 so that I can require connections via CloudFront. This is so I can use a Lambda@Edge to enforce some basic security to keep bots and the basic scans out. It's for a "staging" environment that shouldn't be 100% public for clients to give their approvals for launch.However, I keep running into "SignatureDoesNotMatch" errors when using the CloudFront URL. It seems when you toggle "Restrict Bucket Access" in CloudFront that it's requiring a Signed URL or a Signed Cookie which I don't want. I just want to be able to access a private S3 bucket with the OAI policy and use a Lambda@Edge to set a "Basic Auth" policy. My code to do the basic auth works, but as soon as I turn on "Restrict Bucket Access" and turn S3 to private it all breaks and I start getting the above "SignatureDoesNotMatch" error.Is there anyway to get a OAI policy to get to a private S3 bucket while still leaving the CloudFront distribution "public" and relying on the Lamba@Edge shim as my gatekeeper? I don't want requests to be able to by-pass CloudFront and use S3 URLs.Edited by: rhavenn on Oct 2, 2020 9:25 AMFollowComment"

Answer: "0Egh. Still don't understand why it's not working and I'm getting errors, but I did find the radio button for the Signed Cookies, etc...and that was off. So, it is possible to do this. OAI access policy, but "public" from the CloudFront side.CommentSharerhavennanswered 3 years ago"


Question: Appstream instance user permissions

I've created an appstream instance for our users to login into and use an application.  I have set the login to "desktop" view as I need the users to be able to complete various tasks within the desktop session.  One of those tasks include copying data from the root of the C:\ drive.  Is there a way I can associate users as being local administrator so that they don't just see a home and temporary folder.  I need them to see the full volume of the C:\ drive.FollowComment

Answer: "0While the user cannot be made a local admin, the user can explore C: by specifying it in Windows Explorer. The local drive is only hidden, not entirely suppressed.CommentShareEXPERTStevieStetsanswered 3 months agorePost-User-3895572 3 months agoWindows explorer (file explorer) doesn't allow you to search, look at or reference anything outside of the Home, Downloads and temporary files folder.  Therefore, it's not possible to see the full C:\ even when you untick "hidden files".Share"


Question: Java IoT connection kit won't build...

"I have successfully created an IoT device and was able to make it work with Windows and Python SDK. I then wanted to see how the Java code worked so I selected Windows and the Java SDK and on this page https://us-east-2.console.aws.amazon.com/iot/home?region=us-east-1#/connectdevice/, clicked next and selected the device which I had already set up and have working in Python. I clicked Next Step and clicked the link to download the Java SDK. I extracted the Java SDK and started a windows Power Shell. I unzipped the downloaded SDK, changed directory to it, ran the change to the execution policy "Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process" and then ran start.ps1. The example fails to build with the error:[INFO] ------------------------------------------------------------------------[INFO] BUILD FAILURE[INFO] ------------------------------------------------------------------------[INFO] Total time:  4.373 s[INFO] Finished at: 2022-04-28T15:29:22-07:00[INFO] ------------------------------------------------------------------------[ERROR] Failed to execute goal on project aws-iot-device-sdk-java-samples: Could not resolve dependencies for project com.amazonaws:aws-iot-device-sdk-java-samples:jar:0.0.1-dev: Could not find artifact com.amazonaws:aws-iot-device-sdk-java:jar:0.0.1-dev in central (https://repo.maven.apache.org/maven2) -> [Help 1][ERROR][ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.[ERROR] Re-run Maven using the -X switch to enable full debug logging.[ERROR][ERROR] For more information about the errors and possible solutions, please read the following articles:[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/DependencyResolutionExceptionAny ideas how to fix this?FollowComment"

Answer: "0Accepted AnswerThe following processes are performed in the PowerShell script.(If root-CA.crt file does not exist) Obtain root CA(If aws-iot-device-sdk-java directory does not exist) Get aws-iot-device-sdk-java from GitHub and build itconnect to AWS IoT CoreIn my environment, the tests performed in step 2 of the build procedure fail, so the required modules were not created.I changed the PowerShell script so that the test is skipped.mvn install --% -Dgpg.skip=true tomvn install --% -Dgpg.skip=true -Dmaven.test.skip=trueAfter removing the aws-iot-device-sdk-java directory, I re-ran the PowerShell script and the module was correctly generated and connected to AWS IoT Core.CommentSharemoritalousanswered a year agoLehrian a year agoThanks for this tip. I saw the test errors but assumed they could safely be ignored. That is not the case. I added -Dmaven.test.skip=true to the mvn install line but it didn't immediately solve the issue. I had to delete the existing directory and rerun the script so it would download everything fresh and then it started working.Share"


Question: Unresponsive EC2 Instance. Status Failed. Missing Graph

My EC2 instance suddenly stopped responding. Both status check failed (2/2) and I was unable to connect with SSH.The monitoring graph is also missing during that downtime.Instance Id: i-0f0a93ed1d9337608FollowComment

Answer: "0Hello,Generally when both of your instance's status checks fail this is a sign that System Status checks are the key cause of the issue resulting from failures such as [1]:Loss of network connectivityLoss of system powerSoftware issues on the physical hostHardware issues on the physical host that impact network reachabilityYou should typically be updated via your AWS Health Dashboard [2] in the case of an underlying failure and you can typically resolve this by stopping and starting your instance (only after taking considerations into account [3]).[1] System Status Check Causes - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-system-instance-status-check.html#types-of-instance-status-checks[2] Health Dashboard - https://health.aws.amazon.com[3] Stopping Your EC2 Instance - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html#what-happens-stopCommentShareKameron_Banswered 3 months ago"


Question: Trying to serve https but getting: 403 the request could not be satisfied

"First of all, I want to mention that I've read all relevant threads and could not find a solution for my problem. This is my last option.I'm trying to server S3 bucket via https (ssl). Created publicly accessible S3 bucket, Cloudfront distribution with following setup :**1. Alternate Domain Names (CNAMEs)**domain.comwww.domain.com2. Domain Named2xyz.cloudfornt.com3. Origin domain(points to S3 bucket) public-s3-bucket.s3.amazonaws.com4. SSL Certificate(created using amazon certificate manager for domain domain.com and additional domain *.domain.com)Route 53's A record is domain.com. A ALIAS d2xyz.cloudfront.net.Also there's CNAME record www.domani.com. CNAME  d2xyz.cloudfront.net.When I open d2xyz.cloudfront.com the page is being served as well as S3 bucket endpoint.If I try to load the page via https:// I'm getting the "Unsupported protocolThe client and server don't support a common SSL protocol version or cipher suite"FollowComment"

Answer: "0Solved.The problem was that cloudfront distribution that was marked as disabled was listed as possible option for A record (this cloudfront distribution had alternative domain set as domain.com and www.domain.com). However, as I removed this distribution and updated the new one with correct data (more precisely correct alternative domains) - everything worked fine!CommentSharevdrananswered 4 years ago"


Question: Problem with creating a new project

I have a problem with creating a new project:REMOVEDUPLOADThe log:"D:\Amazon\Lumberyard\1.25.0.0\dev\lmbr_waf.bat" build_win_x64_vs2019_profile --enabled-game-projects=test -p test[WAF] Engine Root: D:\Amazon\Lumberyard\1.25.0.0\dev[WAF] Executing 'build_win_x64_vs2019_profile' in 'd:\Amazon\Lumberyard\1.25.0.0\dev\BinTemp\win_x64_vs2019_profile'[Error] The build command build_win_x64_vs2019_profile is invalid to the platform being disabled during configuration. Please check the error message when running 'lmbr_waf configure' for more details.Process failed with return code: 1Follow

Answer: "0It looks like your project is configured to build using VS2019 but VS2019 is disabled in Setup Assistant perhaps?Which version of Visual Studio are you using?SharerePost-User-6034607answered 3 years ago0Here's some help if the issue is your VS version:Run Setup Assistant and verify you have the correct version(s) of Visual Studio checked on the bottom of the Get Started page.Verify you have correctly installed the version of Visual Studio and its prerequisites. You can find more info here:https://docs.aws.amazon.com/lumberyard/latest/welcomeguide/wg-requirements.htmlNow reconfigure your project. We'll do this at the command line. First, ensure you have the correct default project set in Project Configurator, and that you have all the Gems you need enabled. Make sure to save the configuration.Now open a command line and navigate to the dev directory of your Lumberyard installation.cd D:\Amazon\Lumberyard\1.25.0.0\dev\Run the configure command. This command will generate your solutions and may take few minutes.lmbr_waf configureNow run the build command for the version of Visual Studio you are using. One of the following:lmbr_waf build_win_x64_vs2017_profile -p all --progressorlmbr_waf build_win_x64_vs2019_profile -p all --progressthe build process can take some time, possibly a couple of hours depending on your machine and what components need to be built.SharerePost-User-6034607answered 3 years ago0I'm using VS2019:REMOVEDUPLOADREMOVEDUPLOADSharerePost-User-8733796answered 3 years ago0An error happened:REMOVEDUPLOADSharerePost-User-8733796answered 3 years ago0There is a warning there saying it can't find a valid WIndows SDK. That's a requirement.From the link I posted above, double check you Visual Studio Installation and make sure you have installed all the required features for Visual Studio particularly Step 4 in Prerequisites.https://docs.aws.amazon.com/lumberyard/latest/welcomeguide/wg-requirements.htmlMake sure you have completed all the steps on this page and run configure and build again.If it still won't build, we'll dig into your logs and figure this out.SharerePost-User-6034607answered 3 years ago0I've done it, but there is another problem:REMOVEDUPLOADIt has not completed yet.SharerePost-User-8733796answered 3 years ago0So i had the same issue with the project configuration. So I just ran the waf build system by the command line. The command that I ran was 'lmbr_waf build_win_x64_vs2019_profile -p all -progress"Note: That if you don't have VS2019 selected then replace the 'vs2019' with 'vs2017'. You can replace 'all"(which builds engine, project, editor, and tools) command with 'game_and_engine'(which only builds the engine and game project.Source:WAF commandsrunning lmbr_waf -helpSharerePost-User-3292008answered 3 years ago0@REDACTEDUSERHope it finished OK.The initial build time is lengthy and a known issue the team is working to address. It can take over 2 hours on a modern CPU. Subsequent builds for minor changes and adding additional gems should be much quicker.SharerePost-User-6034607answered 3 years ago"


Question: "[HELP NEEDED] serious gap in the process, aws support is ignoring the request"

"Hello Guys!I have found a serious gap in the AWS process and the AWS support team doesn't want to help.How I can escalate my problem other than describing it here? I am really tired already.My story:I amrunning a small IT company, that delivers AWS-based projects (among others).Some time ago I decided to create an AWS organization under which I have created accounts for 2 of my team members. I have provided their personal email addresses while creating their accounts (that was my biggest mistake).A few months ago one of my team members got schizophrenia, he lost access to his email account, started behaving aggressively, stopped working and communicating with us.I wanted to remove his account from my organization, but:a) I cannot remove his account from my organization until I will provide valid credit card details for his account to make it fully stand-alone (btw. there is 0 spent on this account).b) The problem is that I cannot provide my credit card details because my colleague can potentially create a lot of expenses on my cost.c) Also when I will provide my credit card details and remove his account from my organization I will have no option to access this account anymore and delete these credit card details.Another thing I explored was to close this account (since I have created it I should be able to do it):a) I cannot close the account if I don't have root access.b) I cannot change the email for the root account to recover the password even if I assume "OrganizationAccountAccessRole" role.c) The account can be closed from the root account only, or by the owner of the email associated with the root account.AWS support doesn't want to help. They "truly apologize" but this decision is out of their scope, leaving their hands tied". Their advice is to provide credit card details, remove the account and pray for that guy not to start using this account on my costs. This is something that I obviously cannot accept.Here is the full response:Hello,I'm following up in behalf of our team.At this point, we want to apologize for any inconvenience this situation may cause. Unfortunately, we're unable to proceed with your request to close member accounts on this account. The initial requirements for accounts to function as standalone accounts can not be bypassed.To complete your account information, you can sign in to the member account with the Management Account Access role. The accounts you created using AWS Organizations have an IAM role called "OrganizationAccountAccessRole". This role has full administrative permissions, and the administrator of the management account can access the member account, complete the sign up requirements and then remove the account from the organization.Note that if you created an account as part of an organization, you might need to delete the delegated administrator role assigned to your account. This IAM role is not deleted automaticallyWe recommend you use the IAM role to maintain the security settings you implemented on the account.For information about the IAM role, see the following documentation: https://aws.amazon.com/premiumsupport/knowledge-center/cannot-remove-member-organization/For information on what happens to member account when you close them, see: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_close.htmlSee the AWS API and AWS CLI documentation here: https://docs.aws.amazon.com/organizations/latest/APIReference/API_DeregisterDelegatedAdministrator.html https://docs.aws.amazon.com/cli/latest/reference/organizations/deregister-delegated-administrator.htmlFrom my end, I understand this outcome is not the desired one but please note that this decision is out of my scope, leaving my hands tied looking to accomplish your request. Please remember that the Billing & Accounts team is a bridge of communication between our customers and other internal teams.Once again, my truest apologies.We value your feedback. Please share your experience by rating this correspondence using the AWS Support Center link at the end of this correspondence. Each correspondence can also be rated by selecting the stars in top right corner of each correspondence within the AWS Support Center.Best regards,XYZAmazon Web ServicesI will appreciate your advice on what else I can do to solve this problem.Thanks a lot!FollowCommentSrDayne a year agoSet the limit on your payment card at 1$, provide this card for confirmation and then make his account fully stand-alone.ShareAWS-User-9279990 a year agoWhat about a prepaid credit card?  That way even if the account gets used, it won't cost you anything.Share"

Answer: 0This won't solve the problem but consider assigning an SCP to that account that denies everything. This will a effectively turn it into a dead account. See: SCP effects on permissions.CommentShareEXPERTkentradanswered a year ago


Question: Is it possible to schedule the number of instances in a fleet?

"Is it possible to schedule the number of instances in a fleet?This is not for a live service. This is for development to save cost.For example, I need 3 instances to run dedicated servers in work hours. The instances are not needed at night until next day. I can manually set it up through GameLift console but it's bothersome.So I'm looking for kind of scheduler that can set up what I mentioned in GameLift.FollowComment"

Answer: "0Have you tried the GameLift scale settings to allow the lowest instance to be zero?CommentSharerePost-User-6332773answered 2 years ago0The way I've solved this in the past is to have a scheduled lambda, runs at fixed time to scale all fleets to zero if any are scaled upFirst developer in then scales the fleets required up (you could also have another scheduled lambda to scale up fleets required).CommentSharerePost-User-5332620answered 2 years ago0Yes, I did but I manually did it. So now I'm looking for something like a scheduler.CommentSharerePost-User-7829175answered 2 years ago0Thanks Pip. I'll look into it.CommentSharerePost-User-7829175answered 2 years ago"


Question: Route messages between devices at the edge

"I would like to know how could a customer route messages from different devices, e.g. life sciences lab or manufacturing instruments, at the edge using AWS IoT services. The idea is to allow a mesh connectivity at the edge and only some messages will need to be routed to the AWS Cloud for storage or further processing.FollowComment"

Answer: "1Accepted AnswerThis sounds like a great use case for AWS IoT Greengrass, which is an open source edge runtime and cloud service that can be used to manage IoT applications on your devices. When using AWS IoT Greengrass, there is a concept of a local (MQTT) message broker, which allows client devices deployed at the edge the ability to communicate with other client devices deployed at the edge, with no requirement to send these MQTT messages to the AWS cloud.There is a good blog post (https://aws.amazon.com/blogs/iot/implementing-local-client-devices-with-aws-iot-greengrass/) and tutorial (https://docs.aws.amazon.com/greengrass/v2/developerguide/client-devices-tutorial.html) that describe this functionality further.Please mark this answer as accepted if helpful!CommentShareDarren Ranswered 3 months agoRa 3 months agoThanks @Darren, that sounds like exactly what I've been looking for. I'll dig into the blog post and documentation.Share"


Question: new Account closed after i got message to welcome me

"I have received this email with different case number and my instance is still working and i can access my console, if my account is closed does it happen instant or below email was not meant for me, I am confused as i can access my server and console.We have closed your Amazon Web Services account.We took this action because our records show that this account is related to previously closed accounts.Due to the proprietary nature of our business, we are unable to discuss other accounts with you.Sincerely,Amazon Web ServicesTo contact us again about this issue, please reply to this email.FollowComment"


Question: Will programmatically changing agent state disconnect a call

"If I run this (https://docs.aws.amazon.com/connect/latest/adminguide/automatic-logout.html) to log off all of our agents at the end of the day, will the change to the agent state disconnect an active call?FollowComment"

Answer: "0You might want to try a couple different things, first of all, the article you mentioned only works for ccpv1 which has been deprecated already.Offline and Logout is sperate.  Setting an agent to OFFLINE does not log them out.  Logging out an agent will set their agent status to OFFLINE in ccpv2.  "Logout" is not an Agent Status.  All of this is important regarding the login/logout report.Agent Next Status api cannot log an agent out since logout is not a status.  So to logout an agent, it has to be done at the browser level executing the URL, https://<instance>.my.connect.aws/logout  Not even the Stream API has a REST API to do this and you cannot remotely do this as well in the real time report for agent.CommentShareClarenceChoianswered a month ago"


Question: Whitelist Senders for Workmail Junk Filter

"Is there a possibility to whitelist senders für the aws junk mail filter? I have a legitimate sender (in my case it's PayPal informing me about activities in my account), that is always send to the junk folder. Workmail also doesn't seem to learn from me repeatedly moving these emails out of the junk into the inbox. What can I do? This is quite an inconvenience.Thanks for your helpFollowComment"

Answer: "1Hi,I'm sorry to hear you're experiencing problems with mail incorrectly being flagged as spam. You can override the spam verdict using Mail flow rules.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 5 months agolschierer a month agoWhile I'm glad to have a work around of sorts,  most spam systems I have worked with have a way to train them so that false positives and false negatives are reduced over time.   Is there anything planned that would help make the spam filtering more accurate?Share"


Question: API + Lambda has #503 error 20% of the time

"Running a step function state machine accessing an AWS HttpApi to run a lambda using a docker container of ~3 GB size.  Fails 20% of the time with #503 error, the rest of the time I get the exact results I expect.  It's not a container warm up I believe.  Logs for API and lambda (non-container and container) don't show any problems.  I have maximized the step functions time out, the retries for the specific lambda, the memory for the lambda (10GB).  I have also tried to ping the container and wait 30 seconds in the step functions to no avail.*** Edit: Should have mentioned concurrency for the API is at max (believe it is automatic for HttpApis)Any advice would be appreciated.  I don't want to use ECS fargate due to cost and relative complexity.  Thanks!FollowComment"

Answer: "0Accepted AnswerAlthough not a direct answer to your question, but have you considered using AppRunner? It runs your docker service and will hibernate if there are no requests saving you money. So very similar to the way lambdas work, but without the complexity if you are using it with docker. I've found it easy to setup and very useful. AWS AppRunnerAWS App Runner is a fully managed service that makes it easy for developers to quickly deploy containerized web applications and APIs, at scale and with no prior infrastructure experience required. Start with your source code or a container image. App Runner builds and deploys the web application automatically, load balances traffic with encryption, scales to meet your traffic needs, and makes it easy for your services to communicate with other AWS services and applications that run in a private Amazon VPC. With App Runner, rather than thinking about servers or scaling, you have more time to focus on your applications.CommentShareRollerblade7answered a year agoVinceFulco-Bighire-io a year agoThanks for the mention!  I will give it a look-see.  I am using caddy in other parts of my workflows (and have used dokku in the past) so this should be a easy setup.ShareRollerblade7 a year agoGlad to help :)Share"


Question: "Can't Modify RDS Postgres "R6i" Stand-Alone instance to Multi-AZ, Fails"

"I am working on some terraform to launch RDS instances. As part of this project I need to import data from another database. The recommended setup from AWS to have a FAST pg_restore is to launch the RDS instance in Standalone mode for the import and then modify to Mutli-AZ there after.I have done this process before in my career and the methodology does work quite well. With this project we have chosen the R6i instance types as the match quite well with where we are migrating from. How ever I feel that we have found a bug in the AWS provisioning system. If you launch an RDS Postgres db.r6i.24xlarge instance type in the Stand-Alone Configuration and the modify it to be Multi-AZ you get the following error in the Web Console RDS -  Log & Events Tab.Instance type db.r6i.24xlarge in availability zone us-east-1c is unsupported; putting database instance into availableWe know that to be false since the Main DB launched just fine.I have tested using the AWS Web Console instead of the Terraform code and I can reproduce this. I have also found via the Web Console that you can get a Multi-AZ DB, but only if you start with that configuration. So the steps to reproduce:Launch a, RDS Postgres db.r6i.24xlarge instance in Stand-Alone.After Completion; Modify the instance to be Multi-AZ. The process with take a little over 30 min, but then you will get the above error.My question: Is this a Bug?, and how can we get past it?Update: I also Attempted the same tests in the Default VPC. In the Default both Starting as a Mutli-AZ AND Starting as a Stand-Alone and Modify failed. :-(FollowComment"

Answer: "0This is not a bug. This error is as a result of not having enough of the chosen instance class in the chosen availability zone at the time of request [1]. When the issue occurs, our internal team works at the backend to increase the capacity so that you will be able to create the instance later on.Having said that, below could be the potential workarounds.Wait a while and then try again after a few minutes; capacity can shift frequently.Create instances in a different availability zone.  (This applies when you creating a new instance)Try to scale up/down to a different instance class.CommentShareD-Raoanswered 8 months ago"


Question: When typing lmbr_waf.bat build_win_x64_vs2015_release -p all i get an error

when typinglmbr_waf.bat build_win_x64_vs2015_release -p allI get the error:[ERROR] - Target platform "win_x64_vs2015" not supported. [on host platform: win32]even though I have a x64 systemFollow

Answer: "0Accepted AnswerFIXED IT I forgot to do the thing it says for visual studio 2015 where you need to enable the c++ on the system requirements page here:http://docs.aws.amazon.com/lumberyard/latest/userguide/setting-up-system-requirements.htmlSharerePost-User-8843326answered 6 years ago0Some Help would be appreciated!SharerePost-User-8843326answered 6 years ago0I believe I found the issue, but not the answer, when running the lmbr_waf configure command I get this outcome:[WAF] Executing 'configure'Running SetupAssistant ...--- Lumberyard Setup Assistant ---Lumberyard Setup Assistant: Reading configuration from: d:/Amazon/Lumberyard/1.7.0.0/dev/SetupAssistantConfig.jsonLumberyard Setup Assistant: Reading configuration from: d:/Amazon/Lumberyard/1.7.0.0/dev/Tools/LmbrSetup/SetupAssistantConfig.jsonSDK location: d:/Amazon/Lumberyard/1.7.0.0/devThird-party location: D:/Amazon/Lumberyard/1.7.0.0/3rdPartyCapabilities available, [x] enabled - [ ] disabled:[X] rungame - Run your game project[X] runeditor - Run the Lumberyard Editor and tools[X] compilegame - Compile the game code[X] compileengine - Compile the engine and asset pipeline[ ] compilesandbox - Compile the Lumberyard Editor and tools[ ] compileandroid - Compile for Android devices[ ] setuplinux - Setup for Linux Dedicated Server[ ] vc120 - Visual Studio 2013[X] vc140 - Visual Studio 2015############# Log of operations ##################################################################Successfully executed.[WARN] Removing the following Android target platforms due to "Compile For Android" not checked in Setup Assistant.-> android_armv7_gcc, android_armv7_clang[INFO] Configure "win_x64_vs2015 - [debug, profile, performance, release, debug_dedicated, profile_dedicated, performance_dedicated, release_dedicated, debug_test, profile_test, debug_test_dedicated, profile_test_dedicated]"Unable to detect find the C++ compiler for Visual Studio 2015, removing build target[INFO] Configure "win_x64_vs2013 - [debug, profile, performance, release, debug_dedicated, profile_dedicated, performance_dedicated, release_dedicated, debug_test, profile_test, debug_test_dedicated, profile_test_dedicated]"Unable to detect find the C++ compiler for Visual Studio 2013, removing build target[WAF] 'configure' finished successfully (27.226s)[WAF] Executing 'generate_uber_files' in 'd:\Amazon\Lumberyard\1.7.0.0\dev\BinTemp'[WAF] 'generate_uber_files' finished successfully (51.154s)[WAF] Executing 'generate_module_def_files' in 'd:\Amazon\Lumberyard\1.7.0.0\dev\BinTemp'Generating a 2048 bit RSA private key.............................+++...+++d:\Amazon\Lumberyard\1.7.0.0\dev\MultiplayerSample\certificates\multiplayersample.key.pem: No such file or directorywriting new private key to 'd:\Amazon\Lumberyard\1.7.0.0\dev\MultiplayerSample\certificates\multiplayersample.key.pem'12916:error:02001003:system library:fopen:No such process:.\crypto\bio\bss_file.c:398:fopen('d:\Amazon\Lumberyard\1.7.0.0\dev\MultiplayerSample\certificates\multiplayersample.key.pem','wb')12916:error:20074002:BIO routines:FILE_CTRL:system lib:.\crypto\bio\bss_file.c:400:[WAF] 'generate_module_def_files' finished successfully (2.216s)[WAF] Executing 'msvs' in 'd:\Amazon\Lumberyard\1.7.0.0\dev\BinTemp'[ERROR] No eligible platforms supported for visual studio solution generation[WAF] 'msvs' finished successfully (0.944s)If you look at the bottom it says [ERROR] no eligible platforms supported for visual studio solution generation. That sounds like a problem. What is the fix? (will be submitting as separate ticket tooSharerePost-User-8843326answered 6 years ago"


Question: AWS Control Tower failed to set up your landing zone completely: AWS Control Tower is not authorized to baseline the VPC in the enrolled account.

"Hi all,I got this issue when setup Control Tower."AWS Control Tower failed to set up your landing zone completely: AWS Control Tower is not authorized to baseline the VPC in the enrolled account."Firstly, I tried to add all required permissions, tried again but still failed.Then, I removed all the relevant settings, and policies and re-try but still failed. When I click retry, it shows more errors messages below:"AWS Control Tower could not update your landing zone at this time.Retry updating your landing zone for access to AWS Control Tower. If the problem persists, contact AWS Support."and"ErrorFailed to assume role arn:aws:iam::3084000xxxxx:role/service-role/AWSControlTowerAdmin"For the assume role error, I've created and manually added all the required permission but still failed.Please share your experienced on this issues. I'm stuck now.FollowComment"

Answer: "0Hello!AWS Control Tower doesn't support the AWS default VPC. Deploying one causes the account to enter a Tainted state. When it is in that state, you cannot update the account through AWS Service Catalog. You must delete the default VPC that you added, and then you will be able to update the account.CommentShareAWS-User-9543277answered 7 months ago"


Question: Finding the right policy in IAM

"While creating a "readonly" user in IAM, I could not find the approriate policy. I was told to click on Policies, search for readonly, then sort the Policy Name column backwards.But when I search for "ReadOnlyAccess" I expect the exact match (if available) to be the first in the results. Please improve the GUI and make it easy to find the policy.https://stackoverflow.com/questions/50998498/create-a-read-only-iam-user-in-aws/50998997#comment128293588_50998997FollowComment"

Answer: "-1Hi Shantanu,It all depends upon what "Actions" are allowed in the attached policy to the tole. Either you can choose the closest role that is readily available AWS Managed Policy (which closely matches your requirement) or you can tailor a Custom Managed Policy with the appropriate Actions allowed (i.e. Read Only) to specific resources.https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.htmlhttps://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_action.htmlCommentShareAWS-User-2036647answered a year ago"


Question: AWS Backup - policy and retention

"Hello.I have questions about policy, lifecycle and retention for AWS Backup. I am configuring backups for EC2.Can I create one full backup for every week?I understand the first backup is full, then all backups are incrementals, but if the retention is reached, this generates a new full backup?Is the retention applied to cold storage or warn storage?Is there any way for backup estimation?What is the purpose for "start within" and "complete within", if I have a backup window start time?Thank you.FollowComment"

Answer: "0You can schedule backups as often as you like.  Cron expressions can have day of week - see https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.htmlEBS looks after this.  When a snapshot is deleted, data is first copied from it so that the next newer snapshot, despite being incremental, has everything it needs.Cold storage is available only for EFS, so for EC2/EBS there's no lifecycle out to cold storage.  When a backup expires, it's deleted.You could have a look at your existing EBS backups to get storage estimates."Start within", along with the start time, defines the window of time where the backup may start.  We typically make this 1 hour to fit around other activities like maintenance windows.  It's not such a big deal with EC2, but it can be tight fitting everything in with RDS as you often need RDS to be doing its own automatic backups as well (e.g. if you have a read replica) and your "AWS Backup" backup won't start if it's less than 4 hours before the automated backup window!CommentShareEXPERTskinsmananswered a year agoOrlando a year agoHello.Thanks for your answers.1.- I understand that first backup will be ful, but all following backups will be incrementals, and there is not way to configure backup full every week, is that correct?2.-I have configured a backup plan and rule for EC2 (disk1: 40GB, disk2: 20GB) with 02 days of retention, but I see that every the backup size is 60GB, so I understand that incremental backups do not work. How can I validate if incremental is working, or this is normal behavior, and I should see the size in another way?3.-About storage estimation, I do not have EBS backups, maybe I have to consider a % of change, but the incremental backup should work, or the backup size for every day will be the sum of disks?Share0EBS snapshots aren't like old-school backups - other than your currently-oldest snapshot of a volume, they give you the storage benefits of being incremental while appearing to you in every way that they are full backups.  So think of them all as full backups except when you look at your bill and see you're being charged for a lot less storage than you'd expect.People have complained about how the console just shows the volume size as "Size" for every snapshot, not the true snapshot storage size.  But maybe it's partly to encourage people to think of every snapshot as "full" because in every way you interact with them, they are.Still, there is a way to get more info since the "EBS Direct" APIs were released in 2019.  You can now get the amount of data blocks that changed from one snapshot to another.  There's a basic script at https://github.com/akirsman/Snapshots/blob/master/snapshotsSize.py which I've used and enhanced.   For example it reported for one of our volumes that the first snapshot is 50GiB (volume size) and the second is 0.859GiB.For storage estimation you can also have a look in the Cost Explorer to see what your current snapshots are using.CommentShareEXPERTskinsmananswered a year agoOrlando a year agoHello.Thank you for your answer.I understand the first backup is full, then every backup will be incremental for ever.?When you say " When a snapshot is deleted, data is first copied from it so that the next newer snapshot, despite being incremental, has everything it needs", it means the first full backup will be deleted, but before, the data is copied to the next newer snapshot, so I will always have a full backup in my backup chain?. Per example if my retention is 30 days, every month I will have something like a full backup?If I configure my backup rule for hourly, the options "start within" and "complete within" will be used?Thank you.Share"


Question: Routing to a prefix from TGW through a primary and secondary datacenter VPN connection path

"A customer who is setting up a TGW which will route to an on-prem prefix.  For resiliency, the plan is to  have a primary route to the prefix through a primary datacenter connected by a VPN tunnel, and a secondary route to the same prefix through a secondary datacenter connected by a VPN tunnel.The thought is that if for some reason both VPN tunnels drop for the connection between the TGW and the primary datacenter, that traffic can still be routed to the prefix through the VPN connection to the secondary datacenter.  I know this behavior can be achieved by using more specific prefixes with BGP or by using static routes when defining the route through the primary datacenter.However, I was wondering if there is something more elegant that can be done similar to using local preference BGP communities if we were working with two direct connects.  I had also considered using AS Path prepending for this, but in the docs this is discouraged so that the MED value is honored when performing maintenance and need to switch primary and secondary tunnels.Suggestions or confirmation that the above options are the best we can do would be appreciatedFollowComment"

Answer: 0Accepted AnswerThe discouragement in the AWS documents against overriding MED with Local_Pref or AS path prepending is for use cases where the IPSec VPN terminates on a VGW. In that case only one of the two tunnels is active and via MED we effectively indicate which of the two that is. With Transit Gateway you are not facing that issue and you can safely consider this guidance out of scope.AWS Site-to-Site VPN terminating on TGW supports ECMP and Multi-Exit-Discriminator across tunnels in the same and different connections. Therefore you have multiple options:MED: Use MED to indicate your preference for traffic from AWS to on-prem over the primary VPN tunnel(s) (lower MED value) vs. the secondary VPN tunnel(s) (higher MED value) towards AWS. This assumes the same prefix is announced over all tunnels. In the opposite traffic direction (On-Prem -> AWS) use Local_Pref.AS Path Prepending: Use AS Path Prepending to artificially lengthen the path over the secondary VPN tunnels for traffic from AWS to on-prem.  In the opposite traffic direction (On-Prem -> AWS) use Local_Pref.CommentShareEXPERTChrisE-AWSanswered 3 years ago


Question: Direct Connect and BYOIP with Private VIF

"Will AWS Advertise BYOIP addresses over a Dx Private VIF? If so, how?FollowComment"

Answer: "1Accepted AnswerNo, it will be advertised on you public VIF. Here you have a similar question and answer: https://repost.aws/questions/QUGUzKxaBGQRaLapRrWmqSeQ/byoip-and-direct-connectCommentShareJuanEn_Ganswered a year agoEXPERTBrettski-AWSreviewed a year ago"


Question: caught Query_abort exception

Created an external table thru spectrum for loading 30 parquet files  into redshift table using insert select but every time getting the below error. **None of the Dictionary tables give proper information about the root cause. **Query 1292641 caught Query_abort exceptionuserid100processquery2_121_1292641recordtime47:03.0pid8644errcode1020file/home/ec2-user/padb/src/sys/xn_query.cpplinenum1189contexterrorQuery 1292641 caught Query_abort exceptionFollowComment


Question: AWS DNS Problem or am I too stupid?

"Hey guys,I just setup a new account and migrated some services over from another account and pretty much 1-1 recreated my old setup.After launching a few instances I noticed that none of them could resolve any DNS names, while connectivity was fine since I could connect to IP-addresses without issues both in my VPC and on the internet.I finally found the that if I added another VPC options set with domain name servers set to google's 8.8.8.8 and after rebooting my instances all can resolve DNS just fine. Why does the default options set with AmazonProvidedDNS not work? Is there something I can do to fix it?Thanks for any insights!FollowComment"

Answer: 0Pls. make sure to set both enableDnsHostnames and enableDnsSupport in the VPC of your new AWS account so DNS would work.CommentShareJccrzaaanswered 2 years ago0Thanks! That actually was not enabled.... So clearly the answer to my question was: yes I was too stupid :PThanks a lot for pointing me in the right direction...CommentShareMoWoanswered 2 years ago


Question: Adjust lex external grammar file size limit

"Hi, this week, I tried to create an amazon Lex chatbot using a custom grammar slot type based on grxml file. After every build try, there is an error coming up. Is there any way to adjust Lex externalGrammar file size limit more than 100 KO?FollowComment"


Question: AWS EC2 instance public ipv4 and DNS address not working

"Hello, I have created an EC2 instance in which I have attached the default VPC and default security group (In the security group, I have added an inbound rule for all traffic also), but I don't know why public ipv4 and DNS are not opening, it shows the site can't be reached! and when I clicked on Actions-> Monitor and troubleshoot -> Get instance screenshot -: In that, it displays my private IP address, and login (check below image). Can someone guide me to where I am doing wrong?FollowComment"

Answer: "2Accepted AnswerFew things to check:The route table that's associated with your instance’s subnet has a default route (0.0.0.0/0) pointing to an IGW (internet gateway)The internet gateway thats associated with the route isn't deleted.The internet gateway is attached to the VPCThe security group that's attached to the instance’s elastic network interface has the required rules to allow accessThe network access control list (network ACL) that is associated with the instance's subnet has rules allowing both outbound and inbound traffic to the internet.On a side note - Is there a reason you want to use the default VPC? I'd highly encourage to move away from default VPC as it's not recommended and is a bad practice to use mainly for security reasons.CommentShareEXPERTTushar_Janswered 7 months agoEXPERTIndranil Banerjee AWSreviewed 7 months agorePost-User-9617035 7 months agoHello, I have created my own VPC with one subnet and created Internet Gateway and attach VPC to it. After creating, Internet Gateway I created Route table and in that, I have added subnet in subnet association, also add 0.0.0.0/0 with internet gateway in edit routes. In Network ACLs, there are two inbound rules and two outbound rules that is default. After that, I created EC2 instance and selected that VPC and created new security group with HTTP, HTTPS, SSH, RDP all ports are opened. But when I copied Public IPv4 address and opened in browser it display's site can't be reached.Share0Is it possible that you added a private subnet to the default VPC and created the EC2 machine in your private subnet?CommentShareEXPERTIndranil Banerjee AWSanswered 7 months ago"


Question: "LBS service, Geolocation API"

"Hello. We need to implement LBS service in the app. Not the whole maps service, just LBS.In the documentation https://docs.aws.amazon.com/location/latest/developerguide/tutorial-maplibre-ios.html  we see how to use Amazon maps. But we don't need to replace the whole maps service, we need only to replace the LBS service. I mean we need the service where we send the information about cell towers and receive the device location. And this function exactly I don’t see in your documentation. Please tell if you have this LBS service and where we can find documentation on it. And also we need to know the prices for LBS requests exactly. Anomg your prices we haven't found pricing for LBS.FollowComment"


Question: Oracle RDS - Applying Patches

Need help identifying the process to apply Oracle patches to RDS instancesFollowComment

Answer: "2If you look at the document page for the traditional RDS https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.CommonDBATasks.Misc.html saysTo deliver a managed service experience, Amazon RDS doesn't provide shell access to Opatchand they provide a way for you to get the list of already applied patches. Also in https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Welcome.html they point out that under RDS database patching is AWS's responsibility and not the customer's - that is why you are using the managed service after all.There is something called RDS Custom that allows you to install custom patches - see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-custom.html - on Oracle RDS databases but there are more limitations than the standard RDS managed service - see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-reqs-limits.html and you wouldn't be getting the full managed service experience.You can apply custom database patches or modify OS packages on your RDS Custom DB instances.CommentShareTerence Whiteanswered a year ago1Hi! Here's some documentation that outlines the process for upgrading the Oracle DB Engine. The process may be either automatic or manual depending on if it is a major or minor version upgrade. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Oracle.html. Let me know if you have any questions!CommentSharebenduttanswered a year agoAWS-User-1567189 a year agoThanks for the information, this is a one off patch that was provided by Oracle so it is not a minor version upgrade. Is there any way to work with AWS to add patches via OPatch?Share"


Question: Workaround to overlapping IP address range

"I have a partner who is providing their services in a VPC of /19 and their customer only provided them with a /24 range. They will need to peer their VPCs. Because of this, they have overlapping address range and will thus not be able to use Transit Gateway, Direct Connect Gateway, VPC Peering, etc. My ask here is has anyone worked with a customer with a similar issue and what is a good practice/design around this? (Other than reallocating the address space to fit). The partner is looking at using a NAT as a workaround for now but is looking for a better alternative.FollowComment"

Answer: 0Accepted AnswerUnfortunately there is no great answer in this case. They could use NAT but once you need traffic to be originated in two directions then you will be required to do NAT in both directions. This will ultimately not scale well and will provide operational challenges.They could possibly use something like Privatelink. But that will only work for traffic flows in one direction.The best possible recommendation is to have them create a new VPC with non overlapping CIDRs and then migrate their resources to the new VPC.CommentShareAWS-User-9211944answered 4 years ago


Question: Lightsail: How set up more than 5 servers with static IP adresses?

"I want to launch 6 instances, each one with a static IP adress.The following error is displayed:AllocateStaticIp[eu-central-1]Sorry, you have reached the maximum number of static IPs for your account.AddressLimitExceededHow can the limit be increased?FollowComment"

Answer: 1Accepted AnswerHi.You can use the service quota increase request.https://aws.amazon.com/premiumsupport/knowledge-center/lightsail-request-static-ip-addresses/?nc1=h_lsCommentShareEXPERTiwasaanswered a year ago


Question: Textract Scandinavian language support

"Could you please add Scandinavian language support to AWS Textract service. Currently the service works quite nicely except for the specific characters å, æ, øFollowCommentBarsk66 a year agoÄä and Öö is working well since Textract recognises German.Swedish is a language which is quite similar to German and adds only ONE character, namely Åå. So, by adding support for ONE single character you would support both Swedish and Finnish.To support Norwegian and Danish you need also æ, ø.Please consider this very small addition which would make usage of Texteract a possibility for the Nordic community too. Especially since you have a Nordic region now it makes no sence not to support it.ShareAnton 9 months agoExperiensing this issue with "å" in Swedish. Also this character its replaced with at least five different characters (a, ä, à, â, ã) which makes it harder to handle.månads --> manadsovanstående --> ovanstäendetvå --> tvàbåda --> bâdasåsom --> sãsomBest if character would be supported and second best if Textextract would replace with only to "a".Share"

Answer: "2Hello, thank you for using Textract. We have passed your request to concerned department and will let you know once it's prioritized. Thank youCommentShareAWS-User-3852616answered a year ago"


Question: AWS Client VPN with SSO doesn't work - suddenly

"Hello,For a specific account (managed by our Control Tower) I have set up two VPNs:Site2Site, so we can connect directly to the servers and services from the office andClient VPN for remote users.I also set up the client VPN with Google SSO. As long as there are users in the AWS AD,those same users can also connect via VPN using Google SSO. THIS worked since I created it more than 6 months ago.Suddenly it doesn't work anymore! There has been no change from my side.According to the log file, the last client VPN SSO connections were in September (07th + 21st).When I try to connect (from home), it always just says:"Re-establishing connection."But one thing is noticeable: in the logfile you can find the entry:RESOLVE: Cannot resolve host address: 9c19xxxxxxx.cvpn-endpoint-xxxxxxxxxx.prod.clientvpn.xxxxxxx.amazonaws.com:443  (No such host is known. )This is probably the reason that no browser tab opens to connect to the Google account.But I have no influence on this name, it comes from AWS.I also re-downloaded the VPN profile from AWS, same result.This did NOT help either: https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/troubleshooting.html  (Endpoint name)Finally, my configuration was not changed (so AWS must have changed something or something is broken). Google SSO everything looks fine. I am at a loss here.The help I got from the Business Support (we don't have premium/technical support) is not helpful becausethey sent me some links which will explain how to configure VPNs or troubleshoot other issues.So, what's wrong here?Thx.FollowComment"

Answer: "0Can you ping a public ip address?Also have you tried this?Check whether you are able to resolve the DNS name.* If you are unable to resolve the DNS name, verify that you have specified the DNS servers for the Client VPN endpoint. * If you manage your own DNS server, specify its IP address. Verify that the DNS server is accessible from the VPC.* If you're unsure about which IP address to specify for the DNS servers, specify the VPC DNS resolver at the .2 IP address in your VPC.CommentSharedunix-awsanswered 7 months ago"


Question: API Gateway custom authorizer's caching configuration

"Hey,I've created a custom authorizer to an API Gateway, and attached it to some relevant endpoints (same authorizer for multiple endpoints).The authorizer verifies a given JWT token against the Auth0 service.The "Authorization Caching" was set to 5 minutes (default value), and the identitySource was set to the be the Authorization header, but while QAing the flow, some strange behavior occurred.The first problem is that for the first time sending a request I get a 200 response, but for any subsequent (identical) request, I get 403 response with this message:User is not authorized to access this resourceThe second problem is that then I've tried to disable the "Authorization Caching", but it took ~24 hours to this configuration modification to take effect.Once the Authorization Caching got disabled, every request got returned with a 200 response.This is the policyDocument gets returned when the user is successfully verified: {    Version: '2012-10-17',    Statement: [{      Action: 'execute-api:Invoke',      Effect: 'Allow',      Resource: <resourceArn>,    }]  }My questions are:Is it possible that the "Authorization Caching" configuration is cached?If so, what's the way to invalidate that?If not, how come that modifying the configuration doesn't affect the behavior?What can be the reason for the first problem where only the first request succeed any subsequent request fails?Is it possible that the value provided to the identitySource (i.e. the cached value) has a maximum characters limit?Thanks in advance :)ps,if more information is needed, I'd be happy to share.FollowComment"


Question: Nested query Cloudwatch Log Insights

I use sturctured logs of which the fields are automatically picked up by Insights.All logs have a field traceId.One log has the field itemId. This logs also has a traceId field.I want to view all logs based on the itemId.So I need to find the traceId related to the itemId.And use this traceId to view all logs with this traceId.This feels like a nested query in SQL.How can I achieve a nested query with Insights?Does something exist in the likes of :fields @message| filter traceId=(fields @traceId | filter itemId="123" | limit 1)FollowComment

Answer: "0Hi TheNxtra,The X-Ray team does not own log insights, I would recommend posting this question to the CloudWatch forum: https://forums.aws.amazon.com/forum.jspa?forumID=138They should be able to help you with this question even though the query involves an X-Ray trace ID. Please follow up if you have any other questions specific to the X-Ray Service!CommentShareAWS-User-2079090answered 4 years ago"


Question: What features of Open Distro is supported by ElasticSearch?

Reading Jeff Barr's blog and it appears we are starting to integrate Open Distro into ElasticSearch service.  What features of Open Distro are currently supported and what ones are not yet supported?https://aws.amazon.com/blogs/aws/new-open-distro-for-elasticsearch/FollowComment

Answer: 0Accepted AnswerAmazon Elasticsearch Service uses many of the Open Distro for Elasticsearch features.The details are documented in the Plugins section:https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/aes-supported-plugins.htmlCommentShareMODERATORAWS-User-4245468answered 4 years ago


Question: Disk Event ID 153 in Windows EC2 Instance

Disk Event ID 153 appears often in Windows Event viewer on the second disk (data disk) and usually crashes the mysql database running on the server.Instance: m3.xlargeOS: Windows Server 2019FollowComment

Answer: "0Have you looked at the IO stats from CloudWatch to see if they are spiking at the time the issues happens?You may need to adjust the number of IOPs allocated to your disk to avoid the issues. If you have IOPs set to an expected level and still getting this issue, make sure you have all the drivers update for your OS.CommentShareEXPERTRob_Hanswered a year ago"


Question: How to deploy lifecicle configuration to Sagemaker Studio via Cloudformation

"Hello,I need to deploy a new lifecicle configuration to Sagemaker Studio. I was searching in the Cloudformation Documentation and found nothing but this service.https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sagemaker-notebookinstancelifecycleconfig.htmlAs the name of the service says, it was deployed as a Lifecicle config for a Notebook Instance.Is there any way to deploy a Lifecicle configuration for Sagemaker studio via Cloudformation ?Thanks.AndersonFollowComment"


Question: Is it possible for Appflow to transfer user's direct messages/attachments from Slack?

"I'm able to transfer public channel messages from Slack with appflow, but not direct messages. Is this possible?FollowComment"


Question: How can I cause a failover on an Aurora Serverless v1 DB Cluster with no instances?

End goal: I'm trying to demonstrate the ability of an application to continue operations after a database failover without manual intervention.Specs:Db family: aurora-mysql5.7Db engine ver: 2.11.1Some Attempts:aws rds failover-db-cluster. This results in "You cannot failover DB Cluster with Aurora Serverless"aws rds stop-db-cluster. States it's "not supported for these configurations"modifying the cluster capacity to 0. Only allows for values between 1 - 256My understanding is I can't use a cluster failover command as with Aurora Serverless the process is automatic. Are there any changes I could make which could guarantee a failover would occur under normal circumstances?FollowComment

Answer: "0When you have 2 instances in an aurora cluster, you can restart the writer and this will automatically promote the reader to a writer and the old writer becomes a reader.That would be your failover demonstration.CommentShareGary Mcleananswered 22 days ago"


Question: hosted public VIF data transfer egress billing scenario clarification

"Hello Networking TFCI noticed this in the FAQ  for Public VIFsFor publicly addressable AWS resources (for example, Amazon S3 buckets, Classic EC2 instances, or EC2 traffic that goes through an internet gateway), if the outbound traffic is destined for public prefixes owned by the same AWS payer account and actively advertised to AWS through an AWS Direct Connect public virtual Interface, the Data Transfer Out (DTO) usage is metered toward the resource owner at AWS Direct Connect data transfer rate.However it leaves the customer wanting to understand some scenarios, is this the same for hosted public VIF, and what if accounts are not in the same AWS organizations (different payer )Example ScenarioAccount A has the DX connection, and its own public VIFAccount B (not in AWS organizations with account A)  was given a hosted public VIF from account AAccount C unrelated to Account A or BScenario billing questions – please just respond with yes or no on the billing items so we can help the customer predict billings.Scenario 1Account B S3 bucket, data transfer out to account B DX on premises.Account A S3 egress yes/noAccount A DX egress yes/noAccount B S3 egress yes/noAccount B DX egress yes/noScenario 2Account B S3 bucket, data transfer out to account A DX on premises.Account A S3 egress yes/noAccount A DX egress yes/noAccount B S3 egress yes/noAccount B DX egress yes/noScenario 3Account A S3 bucket, data transfer out to account B DX on premises.Account A S3 egress yes/noAccount A DX egress yes/noAccount B S3 egress yes/noAccount B DX egress yes/noScenario 4Account C S3 bucket, data transfer out to account B DX on premises.Account A S3 egress yes/noAccount A DX egress yes/noAccount B S3 egress yes/noAccount B DX egress yes/noThanks in advanceFollowComment"

Answer: "0Accepted AnswerShort answer here is Owner of S3 bucket pays the egress charges. Now if the S3 owner is in same account family (means same payer account for both) as the DX VIF owner then the charges are reduced, it appears to be not the case in your scenario. Account A has its own public VIF and Account B has it own public VIF although Account A provided the public VIF to account B. Account C is anyone else.•Scenario 1 (S3 Owner and Public VIF owner are same account)◦Account B S3 bucket, data transfer out to account B DX on premises.◦Account A S3 egress yes/no — NO◦Account A DX egress yes/no — NO◦Account B S3 egress yes/no — NO  ◦Account B DX egress yes/no — YES (reduced rate)•Scenario 2 (S3 Owner and Public VIF owner are in different accounts not in same org as well)◦Account B S3 bucket, data transfer out to account A DX on premises.◦Account A S3 egress yes/no — NO◦Account A DX egress yes/no — NO  ($0 charge)◦Account B S3 egress yes/no — YES (standard internet egress charge)◦Account B DX egress yes/no — NO•Scenario 3 (S3 Owner and Public VIF owner are in different accounts not in same org as well)◦Account A S3 bucket, data transfer out to account B DX on premises.◦Account A S3 egress yes/no — YES (standard internet egress charge)◦Account A DX egress yes/no — NO◦Account B S3 egress yes/no — NO ◦Account B DX egress yes/no — NO ($0 charge)•Scenario 4 (S3 Owner and Public VIF owner are in different accounts)◦Account C S3 bucket, data transfer out to account B DX on premises.◦Account A S3 egress yes/no — NO ◦Account A DX egress yes/no — NO◦Account B S3 egress yes/no — NO◦Account B DX egress yes/no — NO◦Who payers here - it is the Account C! and that too at standard internet egress rateCommentShareEXPERTVKanswered 3 years ago"


Question: AWS API gateway SSL handshake error because of the old system time

"We have a bunch of machines with incorrect system time (currently 2019) and we are doing a cURL to an API gateway endpoint resulting in an empty response. Upon debugging we found that the cURL fails at SSL handshake phase indicating a certificate error.:FYI:+*   Trying 1.2.3.4...:FYI:+* TCP_NODELAY set:FYI:+* Expire in 149969 ms for 3 (transfer 0x2820088):FYI:+* Expire in 200 ms for 4 (transfer 0x2820088):FYI:+* Connected to telemetry.abc.def.com (1.2.3.4) port 443 (#0):FYI:+* ALPN, offering h2:FYI:+* ALPN, offering http/1.1:FYI:+* successfully set certificate verify locations::FYI:+*   CAfile: C:\eDrive\23\11\sw\tools\win32\curl\curl-7.64.0-win32-mingw\bin\curl-ca-bundle.crt:FYI:+  CApath: none:FYI:+} [5 bytes data]:FYI:+* TLSv1.3 (OUT), TLS handshake, Client hello (1)::FYI:+} [512 bytes data]:FYI:+* TLSv1.3 (IN), TLS handshake, Server hello (2)::FYI:+{ [104 bytes data]:FYI:+* TLSv1.2 (IN), TLS handshake, Certificate (11)::FYI:+{ [4959 bytes data]:FYI:+* TLSv1.2 (OUT), TLS alert, bad certificate (554)::FYI:+} [2 bytes data]:FYI:+* SSL certificate problem: certificate is not yet valid:FYI:+* Closing connection 0Is there a way to fix the issue without updating the system time ?FollowComment"

Answer: "0In the TLS handshake process the client system time is used to test the validity of the certificate.  When the client and server device date/time are off significantly it can make the certificate appear to be expired.I don't think there is a workaround for this.Since you are using curl, have you tried the  -k or --insecure syntax to ignore SSL certificate warnings?CommentSharecyrkanswered 14 days ago"


Question: DMS - "Failed to get blob column values for table..."?

"Hi,When running a DMS task from MySQL to Redshift (CDC), I'm seeing an error like the below."Failed to get blob column values for table..."I don't see any specific reasons for this error in the cloud watch logs.Anyone know why BLOB fields are having this problem migrating to Redshift during DMS?For reference, below are the LOB-related task settings I have set:"InlineLobMaxSize": 0,"SupportLobs": true,"LobChunkSize": 0,"LobMaxSize": 63,"FullLobMode": false,"LimitedSizeLobMode": true,Thanks!FollowComment"

Answer: "1It's hard to know for sure without more information, but it probably has something to do with your LOB settings on the task. https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.LOBSupport.htmlCommentShareburdettganswered a year agoEXPERTFabrizio@AWSreviewed a year agoAWS-User-8809738 a year agoYeah, I tried reading up on that and I couldn't find anything revolving this.For reference, I added the LOB-related task settings I'm using.Share"


Question: Daily export jobs for AWS Compute Optimizer

Can the job run on a daily basis or is it a one-time export or manual export job?FollowComment

Answer: "0Hi,You can use a combination of Amazon Cloudwatch and Amazon S3 to automate your daily export from Compute Optimizer.Configure CloudWatch Metrics: Compute Optimizer generates metrics that you can use to track the performance of your resources. You can configure CloudWatch to collect these metrics and publish them to a CloudWatch metric namespace.Create a CloudWatch Event Rule: You can create a CloudWatch event rule that triggers on a daily basis and collects the Compute Optimizer metrics. You can use a cron expression to schedule the rule to run at a specific time each day.Create an S3 Bucket: Create an S3 bucket to store the data exported from Compute Optimizer.Configure S3 Bucket Permissions: Configure the S3 bucket permissions to allow CloudWatch to write data to the bucket.Create a CloudWatch Action: Create a CloudWatch action that sends the Compute Optimizer data to the S3 bucket.Run the export. Test and make sure the Compute Optimizer data is exported to S3Hope this helpsThanksArunCommentShareArunanswered 3 months ago"


Question: 3D Models added to AWS TwinMaker Scene Lost colors

"Hi,I''m new to AWS TwinMaker, I have one scene and multiple 3D models in glb format.On Windows 10's 3D Viewer tool I can see 3D model with its color, but after models uploaded to Resource Library and added to scene, they are totally black, or maybe no color with them.Why is that happend and how can I fix this?Thank!FollowComment"

Answer: "1Hi,By set "Environment Preset" to "Neutral" the issue resolved.Thanks for helping!CommentShareAWS-User-1937734answered a year ago0Accepted AnswerHi, thanks for reaching out, have you tried the following?Changing environment preset: In the scene, under settings, set "Environment Preset" to "Neutral"Adding a light to the scene: "+" icon in the scene viewer > "Add light"CommentSharejohnnyw-awsanswered a year ago"


Question: Error: kafka.common.AdminCommandFailedException: The reassignment failed due to an unexpected error.

We often balance our partitions across brokers when there is an imbalance. We occasionally encounter "NO_REASSIGNMENT_IN_PROGRESS" errors in addition to reassignment directly failing at the beginning. Any insights into what can we do better to avoid these?FollowComment

Answer: "0Hi,The "NO_REASSIGNMENT_IN_PROGRESS" is a result that you may get when there's no reassignment currently in progress for the specified partitions, which might be the case if a previous reassignment completed or failed, or if no reassignment was initiated.The error message "The reassignment failed due to an unexpected error" is a more generic message and it indicates that something went wrong during the reassignment operation, but doesn't provide specific details about the cause. There are several potential reasons for this error, including issues with the broker, replication factor issues, issues with the ZooKeeper, and so on.Here are couple of things you could consider:Ensure healthy cluster state: Before doing reassignment, ensure your MSK cluster is in a healthy state. All brokers should be up and running, and underreplicated partitions should ideally be zero.Validate your reassignment JSON: Make sure the JSON file used for partition reassignment is correct and can be parsed successfully. The tool does not validate if the reassignment maintains the replication factor or not, so ensure this is manually validated.If none of the above helps, it might be useful to provide more details. In that case, please create a support case with us, using the following link:https://console.aws.amazon.com/support/home#/case/createCommentShareSUPPORT ENGINEERLovetesh_Canswered 2 days ago"


Question: Can I use RMAN Backup for RDS restore ?

"Customer is storing Oracle RMAN backup on-prem. As part of DR strategy, they want to build DR environment in AWS. I would like them to use RDS in AWS for their DR instance. Is there way to spin up RDS instance using RMAN backup and then later use RDS snapshot to restore back to on-prem Oracle ?FollowComment"

Answer: "0Accepted AnswerNo, due to managed service nature, you  do not have privilege to restore RMAN backup in RDS. However, you can take backup from RDS using RMAN and restore on-prem or on ec2.[+] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.CommonDBATasks.RMAN.htmlOnly way to use RDS as a DR is using replication tools like goldengate or DMS.CommentShareAWS-User-6344712answered 3 years agoalexhguerra 9 months agoThis is really bad. Theres some cool stuff you can do like merge many logfiles into a backupset, to keep it up to date. This avoids so much network bandwidth , sinceyou dont need to send the whole backup back and forth, spendig a good chunk of $ for networnig billing for data transferShare"


Question: Unable to Add CodeStarNotification to CodePipeline with properly configured SNS access policy

"Currently facing an issue with creating a notification rule for code pipeline using CDK with Pipeline or CodePipeline constructsResource handler returned message: "Invalid request provided: AWS::CodeStarNotifications::NotificationRule" (RequestToken: <GUID>, HandlerErrorCode: InvalidRequest)The topic and chatbot are already defined in a different stack. The topic already has configured an access policy.However when I attempt to create a rule for my pipelines, it fails. Every time.{  "Version": "2008-10-17",  "Statement": [    {      "Sid": "AWSCodeStarNotifications_publish",      "Effect": "Allow",      "Principal": {        "Service": "codestar-notifications.amazonaws.com"      },      "Action": "SNS:Publish",      "Resource": "arn:aws:sns:us-east-1:123456789:PipelineNotifications"    }  ]}Referencing topic: const pipelineNotificationsTopic = sns.Topic.fromTopicArn(            this,            "PipelineNotifications",            `arn:aws:sns:${props?.env.region}:${props?.env.account}:PipelineNotifications        `        );Pipeline code: this.pipeline = new Pipeline(            this,            `${props?.appName}-MyPipeline`,            {                pipelineName: "MyPipeline",                crossAccountKeys: true,                restartExecutionOnUpdate: true,            }        );const rule = this.pipeline.notifyOn(            "CodeStarRule",            pipelineNotificationsTopic,            {                events: [                    PipelineNotificationEvents.PIPELINE_EXECUTION_SUCCEEDED,                    PipelineNotificationEvents.PIPELINE_EXECUTION_FAILED,                    PipelineNotificationEvents.ACTION_EXECUTION_FAILED,                ],                detailType: DetailType.FULL,            }        );or this.pipeline = new Pipeline(            this,            `${props?.appName}-MyPipeline`,            {                pipelineName: "MyPipeline",                crossAccountKeys: true,                restartExecutionOnUpdate: true,            }        );const rule =new NotificationRule(this, "Notification", {            detailType: DetailType.FULL,            events: [                "codepipeline-pipeline-pipeline-execution-failed",                "codepipeline-pipeline-action-execution-failed",                "codepipeline-pipeline-stage-execution-failed",                "codepipeline-pipeline-manual-approval-failed",                "codepipeline-pipeline-manual-approval-needed",            ],            source: pipeline,            targets: [pipelineNotificationsTopic],        });FollowComment"


Question: "Row is not a valid JSON Object - JSONException: Expected a ',' or '}'"

"[Simba]AthenaJDBC An error has been thrown from the AWS Athena client. Row is not a valid JSON Object - JSONException: Expected a ',' or '}' at 149 [character 150 line 1] [Execution ID: fd5f862a-7558-4329-93df-08ba753e7ee1]FollowComment"

Answer: "1Hi ,the error seems to indicate that the JSON data set you are trying to read might be not be formatted correctly for Athena.Athena expect the file to be in the format:{ "id" : 50, "name":"John" }{ "id" : 51, "name":"Jane" }{ "id" : 53, "name":"Jill" }the format below will not work:{  "id" : 50,  "name":"John"},{  "id" : 51,  "name":"Jane"}{  "id" : 53,  "name":"Jill"}for more information please look this knowledge base article.hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year ago"