Question: ExportImageTask: ClientError: Unsupported architecture 183 for <AMI-ID>

"Hello, I'm trying to export one of my AMIs, which is based on Amazon Linux for ARM64. When checking the status of the ExportImageTask I get:{    "ExportImageTasks": [        {            "ExportImageTaskId": "export-ami-XXXX",            "S3ExportLocation": {                "S3Bucket": "XXXX",                "S3Prefix": "export/"            },            "Status": "cancelled",            "StatusMessage": "ClientError: Unsupported architecture 183 for XXXX.aarch64",            "Tags": []        }    ]}FollowComment"

Answer: "1Hello, thank you for your post. Unfortunately, the VM Import/Export service does not support the ARM64/aarch64 architecture. Currently the service only supports x86-based images for import or export. There is an open feature request to support ARM64, however, there is no ETA.CommentShareSUPPORT ENGINEERAWS_SamManswered a year agorePost-User-1345302 a year agoThank you for your answer! I didn't find any public documentation about this limitation. Did I miss it? Also wish the error message was more descriptive to let the user know what you just stated, that "the VM Import/Export service does not support the ARM64/aarch64 architecture."Share0Bit of an oversight on AWS part hereCommentSharejulienanswered 8 months ago"


Question: S3 upload issues through the AWS console

"I have a bucket on account A, and want to provide access to upload files to a user on account B, and retain the ownership of the files uploaded. Bucket owner is enforced and the bucket policy is in place to allow PUTs to the bucket from the account B user. However when using the AWS console, user B gets an error "Access control list (ACL) not supported", but I can still upload files when using the aws cli.  Am I missing something or is it possible at all to upload files through the AWS console when bucket owner is enforced? thank youFollowComment"

Answer: "1I had this same issue.  I found that having "s3:GetBucketOwnershipControls" permissions on the bucket allowed the console upload to work.  I assume that by allowing the console to see that bucket owner ownership is enforced it doesn't try to use an ACL, which previously caused the upload failures.CommentShareAWS-User-5484072answered 10 months agorePost-User-7429402 a month agothis fixed it for me. thank you for posting.Share1The only way I found to fix this was to temporarily enable ACLs on the destination bucket and then turn them off afterwards. Seems like a bug.CommentSharejesse360answered 6 months ago0Wasn't able to reproduce this. ACL disabled + bucket owner enforced bucket is supposed to work in AWS console without any issues.  How are you accessing the AWS console to account A's bucket? Is the URL "https://s3.console.aws.amazon.com/s3/buckets/BUCKET_NAME" ?CommentShareVanswered a year ago0Correct, I use that URL to access it, btw I did some diging in CloudTrail and it shows that the successful API call from aws cli uses this header on the request:x-amz-acl:“bucket-owner-full-control”, but when I do it through the console on the browser that header is missing. Thanks.CommentShareAWS-User-9303041answered a year ago"


Question: Why create and identity pool if you are just going to set the s3 buckets to public?

Hello. I'm reading this aws documentation and I have a question.Why create and identity pool if you are just going to set the s3 buckets to public? Shouldn't the example code in section 'Configuring the SDK' be using an authentication library in order to use a signed url?FollowComment

Answer: "0Yes, I think that would be an improvement to the example. Please consider leaving some feedback for the authors.CommentShareEXPERTkentradanswered 3 months ago"


Question: PROBLEM Cloudformation Stuck

"Hi!We have 5 cfn stacks running of which 3 are currently different "changing" states but without any progress.One is stuck in UPDATE_CLEAN_UP with all resources in state "UPDATED".One is stuck in UPDATE_ROLLBACK_IN_PROGRESS without any event after "the UPDATE ROLLBACK initiated by user"And one is stuck in UPDATE_IN_PROGRESS which needed 15 minutes to update 2 child stacks thathad no changes in them.Anyone else experiencing issues with their cloudformation?RegardsEdited by: thaitzer on Nov 12, 2019 2:20 AMFollowComment"

Answer: "010 mintes after posting this, the issue was raised in the AWS consoleCommentSharethaitzeranswered 4 years ago"


Question: Why aren't code lenses appearing in my Java test files in my Cloud9 environment?

"Hello,I've created a Cloud9 environment which I would like to use for Java development. I have enabled the "Enhanced support for Java" features, and most of them are working.I see that the enhanced support features are supposed to include code lenses, which according to the documentation are intended to "facilitate unit testing by allowing you to run and debug specific methods."The "Run | Debug" popup does appear above my main() function in the src/main/java directory. It does NOT appear above the individual unit tests in my src/main/test directory, however, which means I am unable to use code lenses to run individual unit tests.I assume there's some sort of set up I need to do to get Cloud9 to recognize my functions annotated with @Test as functions to which it should also add code lenses. I recall, for example, that Cloud9 wasn't performing any linting or autocomplete suggestions until after I ran 'mvn compile' for the first time. Please advise.FollowComment"


Question: Zeina stressing specific letters in some words!

Two weeks ago I used Zeina voice to generate the following sentence:ثَلَاَثَةٌ وَعِشْرُوُنَ طِفْلاً مِنَ الصَّفِّ ا انْضَمُّوا إِلَى ثَلَاَثِيِنَ طِفْلاً مِنَ الصَّفِّ ب.and everything went well.Today when I generate Zeina voice for the same sentence I found obvious stress in the first letter in the words "طِفْلاً".I am just mentioning an example but the issue exists in multiple words for sure.Is there any update in the engines or so that caused that? and is there any possibility to use the old engine if so?I the two audio samples for reference but I had an error when I tried to attach them to this message.Thanks in advance.FollowComment

Answer: "0Hi Neweshy,We have implemented the fix for the mispronunciation of طِفْلاً, it will be available soon.Thank you for reaching out to us!TarekCommentShareAWS-User-4110704answered 4 years ago0Hi Tarek,Thanks for your quick response, I have two questions:1- Do you have an estimate when will this fix be implemented?2- Do this fix include similar issues in other words? Or you are talking specifically about the word "طِفْلاً"?Regards,NeweshyCommentShareNeweshyanswered 4 years ago0The issue has been solved.Thanks a lot.CommentShareNeweshyanswered 4 years ago"


Question: How to set an alarm based on a AWS::CloudWatch::AnomalyDetector

"I've created an AnomalyDetector as below, and wish to use it in an Alarm. The documentation doesn't make sense to me: there's nothing in that code snippet to link the AnomalyDetector to the alarm, and there seems to be nothing in the AnomalyDetector spec that provides an id that could be referred to be another resource. Is there an error in this documentation?I can't simply use ANOMALY_DETECTION_BAND(m1, 2) in the Alarm as I need to exclude some data from the detector."ConfigFetchAnomalyDetector": {                "Type": "AWS::CloudWatch::AnomalyDetector",                "Properties": {                    "MetricMathAnomalyDetector": {                        "MetricDataQueries": [                        {                            "Id": "someValueA",                            "Label": "Some Value A",                            "MetricStat": {                                "Metric": {                                    "MetricName": "someMetric",                                    "Dimensions": [                                    {                                        "Name": "os",                                        "Value": "iOS"                                    }                                    ],                                    "Namespace": "SomeNamespace"                                },                                "Period": 900,                                "Stat": "Sum"                            },                            "ReturnData": false                        },                        {                            "Id": "someValueB",                            "Label": "someValueB",                            "MetricStat": {                                "Metric": {                                    "MetricName": "someMetric",                                    "Dimensions": [                                    {                                        "Name": "os",                                        "Value": "iPadOS"                                    }                                    ],                                    "Namespace": "SomeNamespace"                                },                                "Period": 900,                                "Stat": "Sum"                            },                            "ReturnData": false                        },                        {                            "Id": "totalOfValues",                            "Label": "Total of Values",                            "Expression": "someValueA + someValueB",                            "ReturnData": true                        }]                    },                    "Configuration": {                        "MetricTimeZone": "Europe/London",                        "ExcludedTimeRanges": [                        {                            "StartTime": "2022-08-11T00:00:00",                            "EndTime": "2022-08-11T23:59:59"                        }]                    }                }            },FollowComment"

Answer: "1Hello there,Thanks for your question.I do not see any error on the documentation for the AnomalyDetector resource for CloudWatch service on CloudFormation documents. So what happens is that when we want to use Anomaly Detector on CloudWatch Alarm firstly we need define the Anomaly Detector model to be created(whether it is for single Metric or a MetricMath) which is what we are doing with the section of "Type": "AWS::CloudWatch::AnomalyDetector", and then we are referencing the Anomaly detection to be used for the metrics/MetricMath function on the Alarm configuration.With the information you have provided, I have come up with below example CloudFormation Template and tested to create CW Alarm that is using MetricMathAnomalyDetector.{    "AWSTemplateFormatVersion": "2010-09-09",    "Parameters": {        "Instance1": {            "Description": "The EC2 instance ID to associate this alarm with.",            "Type": "AWS::EC2::Instance::Id"        },        "Instance2": {            "Description": "The EC2 instance ID to associate this alarm with.",            "Type": "AWS::EC2::Instance::Id"        }    },    "Resources": {        "ConfigFetchAnomalyDetector": {            "Type": "AWS::CloudWatch::AnomalyDetector",            "Properties": {                "MetricMathAnomalyDetector": {                    "MetricDataQueries": [{                        "Id": "m1",                        "Label": "m1",                        "MetricStat": {                            "Metric": {                                "MetricName": "CPUUtilization",                                "Dimensions": [{                                    "Name": "InstanceId",                                    "Value": {                                        "Ref": "Instance1"                                    }                                }],                                "Namespace": "AWS/EC2"                            },                            "Period": 60,                            "Stat": "Average"                        },                        "ReturnData": false                    }, {                        "Id": "m2",                        "Label": "m2",                        "MetricStat": {                            "Metric": {                                "MetricName": "CPUUtilization",                                "Dimensions": [{                                    "Name": "InstanceId",                                    "Value": {                                        "Ref": "Instance2"                                    }                                }],                                "Namespace": "AWS/EC2"                            },                            "Period": 60,                            "Stat": "Average"                        },                        "ReturnData": false                    }, {                        "Id": "e1",                        "Label": "Total of Values",                        "Expression": "m1 + m2",                        "ReturnData": true                    }]                },                "Configuration": {                    "MetricTimeZone": "Europe/London",                    "ExcludedTimeRanges": [{                        "StartTime": "2022-08-11T00:00:00",                        "EndTime": "2022-08-11T23:59:59"                    }]                }            }        },        "EC2AnomalyDetectionAlarm": {            "Type": "AWS::CloudWatch::Alarm",            "Properties": {                "AlarmDescription": "EC2AnomalyDetectionAlarm",                "AlarmName": "EC2AnomalyDetectionAlarm",                "ComparisonOperator": "LessThanLowerOrGreaterThanUpperThreshold",                "EvaluationPeriods": 1,                "Metrics": [{                    "Expression": "ANOMALY_DETECTION_BAND(e1, 2)",                    "Id": "ad1"                }, {                    "Id": "e1",                    "Label": "Total of Values",                    "Expression": "m1 + m2",                    "ReturnData": true                }, {                    "Id": "m1",                    "Label": "m1",                    "MetricStat": {                        "Metric": {                            "MetricName": "CPUUtilization",                            "Dimensions": [{                                "Name": "InstanceId",                                "Value": {                                    "Ref": "Instance1"                                }                            }],                            "Namespace": "AWS/EC2"                        },                        "Period": 60,                        "Stat": "Average"                    },                    "ReturnData": false                }, {                    "Id": "m2",                    "Label": "m2",                    "MetricStat": {                        "Metric": {                            "MetricName": "CPUUtilization",                            "Dimensions": [{                                "Name": "InstanceId",                                "Value": {                                    "Ref": "Instance2"                                }                            }],                            "Namespace": "AWS/EC2"                        },                        "Period": 60,                        "Stat": "Average"                    },                    "ReturnData": false                }],                "ThresholdMetricId": "ad1",                "TreatMissingData": "breaching"            }        }    }}Once you create the Alarm you can see the Anomaly Detection model with below AWS CLI command and see how the model is configured:# aws cloudwatch describe-anomaly-detectors --anomaly-detector-types METRIC_MATHIf you have any further questions, please post it as a comment and I am happy to help you further.I trust that you find above information helpful. Have an AWSome day ahead!ThanksCommentShareSUPPORT ENGINEERMunkhbat_Tanswered 9 months agoSid 4 months agoI have the same question as OP and I could use some clarification. The link between the "AnomalyDetector" and the "Alarm" is unclear to the point of seeming non-existent.I took the example from the documentation, completely removed the AnomalyDetector, and it appears to have created exactly what I wanted. If I can get what I want without creating the AnomalyDetector, what's the point of the AnomalyDetector? Surely I'm missing some important nuance, but I can't see what it is. Any help would be greatly appreciated.See below for the code that appears to build everything I need.  ProcessorInvocationAnomalyAlarm:    Type: AWS::CloudWatch::Alarm    Properties:      AlarmDescription: "Indicates when the processor has unexpected spike in traffic (up or down)"      AlarmName: !Sub "Processor invocation anomaly - ${AWS::StackName}"      AlarmActions:        - !Ref AlarmTopic      OKActions:        - !Ref AlarmTopic      ComparisonOperator: LessThanLowerOrGreaterThanUpperThreshold      DatapointsToAlarm: 3      EvaluationPeriods: 5      Metrics:      - Expression: ANOMALY_DETECTION_BAND(m1, 1.5)        Id: ad1      - Id: m1        MetricStat:          Metric:            MetricName: Invocations            Namespace: AWS/Lambda            Dimensions:              - Name: FunctionName                Value: !Ref Processor          Period: 60          Stat: Sum              ThresholdMetricId: ad1      TreatMissingData: notBreachingShare"


Question: dynamoDB NoSQL Workbench fails to commit all the items

"I created a table and put 107 items by using NoSQL Workbench, and successfully commited the table with 107 items into my local dynamoDB.However, I half failed to commit the same table into my remote dynamoDB.  Workbench displays an error message saying only 45, 46, or 47 items are put instead of all 107 items.  The number of successful transfers such as 45, 46, and 47 is also different each commit time.Why only less than half items are successfully commited to remote dynamoDB?  Why OK with local dynamoDB?Thanks much in advance for your help in this matter.FollowComment"

Answer: "1Accepted AnswerMy assumption here is that your remote table does not have enough capacity to commit all the items and is failing due to excessive throttling. You do not have this issue when committing to local.To diagnose, check your tables metrics section in the AWS web console and have a look for write throttling events. If you see a spike in throttles at the same time as your commit it indicates you must increase your tables capacity (WCU).CommentShareEXPERTLeeroy Hannigananswered 7 months agorePost-User-0007713 7 months agoThanks for your advice.  I will check the metrics and increase the capacity.Share"


Question: AWS config with Athena - Issue

"Hi,I followed this article - https://aws.amazon.com/blogs/mt/how-to-query-your-aws-resource-configuration-states-using-aws-config-and-amazon-athena/When I check the Lambda logs - It is trying to query "ConfigHistory" too. Not sure why. Seems like it is getting triggered not only when configsnapshot is updated, but the confighistory path is updated as well.Error 1:Ignoring event for non-configuration snapshot object key AWSLogs/<Acct>/Config/us-east-1/2022/3/13/ConfigHistory/*.json.gzError 2:However, it is adding and dropping tables, adding dt=latest as well. But, still I do see these while executing the 1st sample query in the document for - '$.instancetype') = 't3a.large'Row is not a valid JSON Object - JSONException: Duplicate key "name"This query ran against the "sampledb" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: cd87ba3c-018c-49e5-9724-fbd0cf201ab4At a high level, AWS config is sending configsnapshots to the S3 bucket and the Lambda is triggered, but something is missing which I couldn't find it. Any help is greatly appreciated. Thank you.FollowCommentvtjean 2 months agoHave you verified your Cloudtrail Logs?Share"


Question: Point Route 53 Domain to Lightsail Instance

"Hi, I have a Lightsail Instance, 1 Domain, and a new EC2 Instance. Everything works fine. I'm following a book that needs me to change the Hostnames and the Name Servers. I found a page on AWS explaining how to point my Route 53 Domain to my Lightsali Instance.https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-using-route-53-to-point-a-domain-to-an-instanceIt's not the same as the book but I think it's what I need. Here's the instructions from the book..."Log into your GoDaddy (or similar) account after purchasing a domainSelect your domain, click manage, and select Advanced DNSNext, set up Hostnames in the DNS Management to point to your Serverns1 (and put the IP of your VPS server)ns2 (and put the IP of your VPS server)Edit Nameservers to CustomAdd ns1.loca1host.comAdd ns2.loca1host.com"So, where is DNS Management in AWS? I've tried to figure it out on my own. (Including the first link.) Here's what I have...*My AWS Domain has all the default settings. (I didn't erase any.)I added: Hostnames"A – IPv4 address" with my Lightsail Static IP and it's private IP."CNAME" with "www" in front of "mydomain.com"I used the first link to point to my Lightsail (Static) IP. I'm not sure if that works. I don't know how to change my "Hostname." Where do I find that? My Lightsail Terminal says "ip-my-ip-address. Is that my hostname? Secondly, I don't know if I set up the Nameservers right. I know I should have ns1 and ns2. Should I use loca1host.com like in the book? Or my VPS IP? Or what?So, how do I change my hostname and nameservers? To point to my Lightsail Instance? Should I delete old nameservers? I can find those. The AWS link doesn't show any "ns1" and "ns2". So where's my DNS management and hostnames? This is probably an easy question. Please reply. ThanksFollowComment"

Answer: "0Anyone? I will use anyway of pointing to my Lightsail Instance and edit Name Servers. Any links or methods. Please reply. ThanksCommentSharenethunteranswered 3 years ago0Hello, I figured it out. I found a video on YouTube on Route 53 to Lightsail. It's below. I had to click "Home" on Lightsail, add DNS, and copy it's name servers. Then went to Route 53, deleted all Hosted Zones for my Domain, and copied the name servers from Lightsail (DNS above.) Now I'm waiting to propagate and hear back from AWS. I'll report back if I need anything.https://www.youtube.com/watch?v=M4wzhhiv51QCommentSharenethunteranswered 3 years ago"


Question: Caps Lock and Num Lock keys not working in Workspace since 5.2.1.3123 update

"Since the Workspace Client Update to version 5.2.1.3123 my num lock and caps lock keys on the keyboard are not working correctly in the workspace. They are opposite on the workspace and local machine. For example - I log onto my workspace with the num lock off and turn it on once I am on my workspace it will work on my workspace but be off on my local machine. If I enable it while working on an application on my local machine it will not work on an application on the workspace. The same thing with the CAPS Lock This is causing users to enter incorrect passwords and not be able to access their workspaces or applications and get locked out. Anyone else experience this since the most recent Workspace client update?We have clients running the older workspace client who do not have this issue.FollowCommentSimon 9 months agoHaving the exact same issue here, after upgrading to 5.2. Just installed the latest fix version (5.3.0.3163), but the issue is still there.SharerePost-User-8157809 9 months agoThanks for the update @simon. We had to go back to version 5.1.0.SharerePost-User-0447696 7 months agoWe have been going back and forth with AWS Support since June on this issue. Only temporary workarounds have been given but still no fix.Share"

Answer: "1In Workspaces, go to Windows settings, open up On-Screen Keyboard.One of the keys is "Options", push that and in the options turn on the numeric keypad.Go back to On-Screen KeyboardFind the NumLock key, press it, and close the On-Screen Keyboard.This worked on Version 5.4 on all our workspaces.CommentSharerePost-User-2922631answered 8 months agoBrian McQuaig 5 months agoThanks for the work-around...works great. My customers are going to want this to be transparent so I'm currently working out how to do this through a startup script. After testing, your solution does not persist after a restart of the WorkSpace unless the NumLock key is active, so that's where we'll need to concentrate our efforts. What I want to know is what is AWS doing to fix this issue? There has GOT to be a way that the client can determine what keyboard is in play whenever it is launched and make adjustments accordingly.SharerePost-User-5986395 5 months agoNot an option for Linux Workspace users. AWS - please fix this. Find the regression since 4.0.6.Share1We are seeing 10-key characters not working. Going to try to revert to an earlier client version as waiting for a fix might be a while.https://clients.amazonworkspaces.com/Versions.htmlUPDATE: Version 5.1.0 worked for us.CommentSharerePost-User-8157809answered 9 months agorePost-User-5986395 8 months agoI am seeing this same issue and have reverted.Share1I did not find the issue resolved until I fell back to 4.0.6CommentSharerePost-User-0047732answered 8 months agorePost-User-5986395 5 months agoConfirming this as well.Share"


Question: Create Greengrassv2 Core Device With AWS Sdk

How to create Greengrassv2 core device with AWS Sdk.FollowComment

Answer: "0Accepted AnswerThere is no API to create a Greengrass core device. The device will be created automatically when it connects to AWS.Setup the device using automatic provisioning: https://docs.aws.amazon.com/greengrass/v2/developerguide/quick-installation.htmlOr manual provisioning: https://docs.aws.amazon.com/greengrass/v2/developerguide/manual-installation.htmlCheers, MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 months ago"


Question: How to monitor AWS Code Whisperer using CloudWatch?

"Want to monitor the each api calls made by Code Whisperer. According to official documentation, Code Whisperer reports the metric in AWS/CodeWhisperer namespace.But not able to AWS/CodeWhisperer namespace. So please explain how to use CloudWatch to monitor Code Whisperer?Official documentationFollowComment"

Answer: "0I can able to find the "AWS/CodeWhisperer" namespace in the metrics. You can able to check the same using the below URLhttps://us-east-1.console.aws.amazon.com/cloudwatch/home?region=us-east-1#metricsV2?region=us-east-1&forwardXA=no&graph=(view'timeSeriesstackedfalsemetrics(('AWS2fCodeWhisperer~'Invocations~'Dimension~'Count))region'us-east-1start'-PT1Hend'P0D)&query=~'7bAWS2fCodeWhisperer2cDimension*7d[1] Monitoring CodeWhisperer with Amazon CloudWatch - https://docs.aws.amazon.com/codewhisperer/latest/userguide/monitoring-cloudwatch.htmlCommentShareGovind Kumaranswered 6 days agoPatrickC 5 days agoThe link provided above displays invocations, but it still remains impossible to access the metric mentioned in the documentation: "DailyActiveUserTrend".Curious if you were able to.Share"


Question: Unable to Delete a Security Group

"Hi.I've been working on Archiving a webserver and have deleted most of the infrastructure apart from a remaining Security Group which is giving a strange/incorrect error. Not sure how to get around it. The SG is only used by the archived websiteBasically when I try to delete the SG, it gives this error:Failed to change security groups for network interface .You do not have permission to access the specified resourceSo from what i can tell the NIC has the SG associated with it and is preventing me from deleting the SG. So I looked into if I am missing permissions but the role I'm using to delete the SG has AdministratorAccess policy, which in turn has ec2:ModifyNetworkInterfaceAttribute so I think this mean I have sufficient permissions to delete it?I checked the NIC to see what it was used for and if I could delete it. It appears that the NIC has no "Instance ID's" associated with it but it does have an "Instance Owner" of amazon-elasticache. So maybe Elasticache (Memcached specifically) is blocking this somehow?So I looked into the Memcached configuration and I can see it's got a couple of other SGs associated with is and is being used by live servers, so i can't delete the cluster (and possibly it's NIC - not sure)...Not sure what to try next to get rid of this SG!   Any help greatly appreciated :¬)Kind RegardsSunilFollowComment"

Answer: "0Thanks for your reply @Manu :)I took a look at the command you mentioned, looks like it replaces all the currently associated SGs with a list of SGs, as specified like this:aws ec2 modify-network-interface-attribute --network-interface-id <NIC ID> --groups <SG ID 1> <SG ID 2> <SG ID 3>Is that right? i'm not sure how I'd 'replace' the old SG with a new one using the command as I wouldn't be specifying the <old SG ID>.... However, looks like I could use the command to associate all the SGs I want to keep... Question is, would this work better than trying to remove the SG from the NIC via the console!? What do you think?Ideally want to avoid having to stop any live Elasticache instances. Hmm, I'm not sure if that's supported?CommentShareSunilanswered a month agoManu a month agoYes, you are correct. The modify-network-interface-attribute command replaces all the currently associated security groups with a new list of security groups. You won't be specifying the old security group ID directly.If you want to remove a specific security group from the network interface, you can do so by specifying all the other security groups except for the one you want to remove, like this:aws ec2 modify-network-interface-attribute --network-interface-id <NIC ID> --groups <SG ID 1> <SG ID 2> ... <SG ID n>This will replace the current set of security groups on the network interface with the new list you specify, without including the security group that you want to remove.Regarding whether it's better to remove the security group from the network interface via the console or via the command line, both options should work. It ultimately depends on your preference and what you are comfortable with.You can detach the security group without stopping the Elasticache instances. Under the Network and Security tab of Elasticache (Redis), you have the option to add or remove security groups.Share0You can try removing the association between the security group and the network interface by modifying the network interface's attributes.aws ec2 modify-network-interface-attribute --network-interface-id <NIC ID> --groups <new SG ID>This command removes the specified security group from the network interface and replaces it with a new security group. You can create a new temporary security group and use its ID in place of <new SG ID> to replace the original security group.You can try stopping or terminating any Elasticache instances associated with the network interface, which should release the network interface and allow you to delete the security group.Once you have resolved any dependencies on the network interface, you should be able to delete the security group without encountering any errors.CommentShareManuanswered a month ago"


Question: Is it possible to get the test package upload ARN for a run?

Is it possible to get the test package upload ARN for a run?I can't find a way to do this via the command-line interface. Have I overlooked something?FollowComment

Answer: "0Currently this is not a supported use case.Thank you for the request, we will get back to you once this is supported.CommentShareAWS-User-1182145answered 4 years ago0Thank you. I wanted an automated way to find test package uploads that were unused (because associated runs had been deleted).CommentSharepactlqanswered 4 years ago0Hi again,Quick follow up, a colleague pointed out a temporary work around. You could automate AWS Cloudtrail to get the test package ARN given that you have the the run ARN, and jq installed on your computer.Try the following command, just replace YOUR_RUN_ARN_HERE with your run ARNaws cloudtrail lookup-events --lookup-attributes  AttributeKey=EventName,AttributeValue=ScheduleRun --region us-west-2 --query Events[].CloudTrailEvent | jq '.[] | fromjson | select(.responseElements.run.arn == "YOUR_RUN_ARN_HERE" ) | .requestParameters.test.testPackageArn'Hope this helps.==== Edit ====Fixed command typoEdited by: scotttaws on Mar 13, 2019 12:50 PMEdited by: scotttaws on Mar 13, 2019 12:53 PMCommentShareAWS-User-1182145answered 4 years ago0Thanks! This works for me.Also, to follow up, this is the code that got me the list of unused test package uploads:readonly region=us-west-2readonly project=readonly runs=$(aws devicefarm list-runs --arn ${project} --output text --query 'runs[].[arn]')readonly run_test_package=$(aws cloudtrail lookup-events \  --lookup-attributes AttributeKey=EventName,AttributeValue=ScheduleRun \  --region ${region} \  --query Events[].CloudTrailEvent \  | jq -r '.[] | fromjson | select(.requestParameters.projectArn == "'${project}'" ) | "\(.responseElements.run.arn)\t\(.requestParameters.test.testPackageArn)"')grep -vF "${runs}" <<< "${run_test_package}" | cut -f 2Edited by: pactlq on Mar 13, 2019 2:50 PMEdited by: pactlq on Mar 13, 2019 3:07 PMCommentSharepactlqanswered 4 years ago"


Question: How to access Bucket from another account to FSx

I have a FSx lustre filesystem in Account A. The lustre filesytem is configured with two data repository that is two folders from S3 bucket of Account A.How to configure a bucket of Account B to this lustre filesystem and configure the data repository? Is there any documentation that can be referred?FollowComment

Answer: 0Here's the documentation for linking an encrypted S3 bucket in a different account:See 'Accessing server-side encrypted Amazon S3 buckets in a different AWS account' section here: https://docs.aws.amazon.com/fsx/latest/LustreGuide/create-dra-linked-data-repo.html#s3-server-side-encryption-supportCommentSharefilesteranswered 7 months ago0How to add data association in FSx if S3 bucket is from different account?CommentSharerePost-User-6290701answered 7 months ago0Refer the AWS blog https://aws.amazon.com/blogs/storage/protecting-your-high-performance-file-systems-with-amazon-fsx-for-lustre/ to configure your filesystem with cross account s3 bucket.CommentShareAnkushanswered 5 days ago


Question: Beanstalk console cannot pick arm64 options

"Using AWS console to create a new environment of an elastic beanstalk app, I cannot select arm64 instances anymore.When I do so, the console automatically applies as default instance types "t3.micro" which is not a valid arm64 instance type and the call to AWS console backend servers for configuration options fails, making the select not update.{"__type":"com.amazonaws.elasticbeanstalk#ConfigurationValidationException","message":"Configuration validation exception: Invalid option specification (Namespace: 'aws:ec2:instances', OptionName: 'InstanceTypes'): Your selected instance types (t3.micro) aren't available in your selected VPC Subnets. . Please check your VPC Subnets."}I have never created an env using the AWS CLI and I cwould like to avoid, has anyoene a workaround?FollowComment"

Answer: "0Hi,Seems could be related to this bug: https://repost.aws/questions/QU6Fg7aCOuRIuE1JdnQhTgZw/aws-elastic-beanstalk-new-console-2023-bug.As workaround, if not comfortable with CLI, you should give a try to Infrastructure as Code (Terraform, CDK, Cloudformation).As an example , this is a walkthrough to deploy a web app to Elastic Beanstalk (https://aws.amazon.com/getting-started/guides/deploy-webapp-elb/module-two/) using JavaScript.Hope it helps ;)CommentShareEXPERTalatechanswered 2 months ago0Thanks I will have a look, it seems related indeed.Sadly the old app was created without terraform, so it won't be super easy.CommentSharerePost-User-2036977answered 2 months ago"


Question: SetUpAssistant Crashes for Lack of Open GL 2.0 Driver Support

"SetupAssistant fails on start up with the following error:REMOVEDUPLOADThis is an issue in 1.9 and 1.10. However, seems to be related to running on machines with older video cards or drivers.Follow"

Answer: 0Accepted AnswerI was able to resolve this issue in 1.10 by copying the libEGL.dll file from the editor's application directory atC:\Amazon\Lumberyard\1.10.0.0\dev\Bin64vc140to the setup assistant's application directory atC:\Amazon\Lumberyard\1.10.0.0\dev\Tools\LmbrSetup\WinThe two other files; libGLESv2.dll and 3d3compiler_*.dll were already present.SharerePost-User-3725558answered 6 years ago0I found the same issue in case we run Lumberyard using Windows Remote Desktop (the issue is releated to gpu virtualized driver).Thanks for the fix. I will test as soon as possible!SharerePost-User-0381819answered 6 years ago0Copying the Dlls in 1.10 as mentioned @REDACTEDUSERSharerePost-User-7328120answered 6 years ago0Copying the Dlls in 1.10 as mentioned @REDACTEDUSERSharerePost-User-7328120answered 6 years ago0Just tested also on 1.0.9 and it works!SharerePost-User-0381819answered 6 years ago


Question: COPY command ignoring defaults if some values are present in specific fields

"I am trying to load a Redshift table from a .csv file in an S3 bucket.  When I created the table, three columns are set to have default values.,"current_row_ind"                  CHAR(1) DEFAULT 'Y',"EFFECTIVE_DATE"                  DATE DEFAULT TO_DATE(CURRENT_DATE, 'YYYY-MM-DD'),"EXPIRATION_DATE"               DATE DEFAULT TO_DATE('9999-12-31', 'YYYY-MM-DD')Some of the rows in my file have values for these fields.  Some do not.  When I use the COPY command to load the table, Redshift seems to ignore the defaults for those fields that do not have values filled in.  If I don't specify those fields in the list but leave them in my file, I get the following error: "Extra column(s) found".  If I do specify those fields in the list, those fields in my file that do not have values are added with NULL values rather than the defaults.  If I leave those fields off the COPY list and remove them from my file, they load with the defaults.  Obviously this won't work as some of the fields have legitimate values.  I've listed the parameters I'm using in my COPY command below:FORMAT AS CSV DELIMITER ','QUOTE '"'ACCEPTINVCHARS '?'TIMEFORMAT 'auto'IGNOREHEADER 1ACCEPTANYDATEBLANKSASNULLDATEFORMAT 'auto'EMPTYASNULLEXPLICIT_IDSFILLRECORDIGNOREBLANKLINESTRIMBLANKSREGION AS 'us-west-2'My question is how can I use the COPY command to load this table and have it pick up the values for these fields as they are in the file but use the defaults when values are not present?  I have researched this here in re:Post as well as other forums such as StackOverflow but have not found anything that addresses this specific scenario.  Any help would be appreciated.FollowComment"

Answer: "0Accepted AnswerHi PurpleHaze,Usually the DEFAULT expression evaluation for a given column is applied the same for all the loaded rows. If you don't specify these fields in the COPY column list, all the rows in the file should have no value for these fields  in order for the DEFAULT option to work otherwise the command will fail with the "Extra column(s) found". For the moment, in the above case, copying your data to a staging table and then applying the default values on the NULL while copying/moving the data to the target table is an option.Thanks,CommentShareZiadanswered 6 months agoPurpleHaze 4 months agoThanks Ziad. Not the answer I was hoping for but will try this.   I will mark your answer as accepted and close the questions.Share"


Question: Session Manager unable to connect to instance in public subnet

"I can't seem to get an instance in a public subnet to connect via session manager. The subnet that the instance ends up deploying to has 0.0.0.0/0 set to an internet gateway. The security group has no inbound rules and an outbound rule of Allow 0.0.0.0/0.The instance profile has the AmazonSSMManagedInstanceCore managed policy, the instance is on a public subnet with an internet gateway and a security group that allows all outbound requests, and it’s running AmazonLinux 2, so the SSM agent should be installed. I even added a userData command to install the latest again, but that didn’t change anything.From the console, I see the following error message:We weren't able to connect to your instance. Common reasons for this include:SSM Agent isn't installed on the instance. You can install the agent on both Windows instances and Linux instances.The required IAM instance profile isn't attached to the instance. You can attach a profile using AWS Systems Manager  Quick Setup.Session Manager setup is incomplete. For more information, see Session Manager Prerequisites.Here's a sample of CDK code that replicates the problem:const region = 'us-east-2'const myInstanceRole = new Role(this, 'MyRole', {  assumedBy: new ServicePrincipal('ec2.amazonaws.com'),})myInstanceRole.addManagedPolicy(  ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'))const myUserData = UserData.forLinux()myUserData.addCommands(  `sudo yum install -y https://s3.${region}.amazonaws.com/amazon-ssm-${region}/latest/linux_amd64/amazon-ssm-agent.rpm`,  'sudo systemctl restart amazon-ssm-agent',)const myInstance = new Instance(this, 'MyInstance', {  instanceType: InstanceType.of(InstanceClass.C6I, InstanceSize.LARGE),  machineImage: MachineImage.latestAmazonLinux({    generation: AmazonLinuxGeneration.AMAZON_LINUX_2,    cpuType: AmazonLinuxCpuType.X86_64,  }),  vpc: Vpc.fromLookup(this, 'ControlTowerVPC', {    vpcName: 'aws-controltower-VPC',  }),  vpcSubnets: {    subnetType: SubnetType.PUBLIC,  },  blockDevices: [    {      deviceName: '/dev/xvda',      volume: BlockDeviceVolume.ebs(30, {        volumeType: EbsDeviceVolumeType.GP2,        encrypted: true,      }),    },  ],  userData: myUserData,  role: myInstanceRole,  detailedMonitoring: true,})FollowComment"

Answer: 0Accepted AnswerTurns out the issue was that the EC2 instance didn't have a public IP address.CommentSharebilalanswered a year ago


Question: How To automaticaly modify CloudWatch Dashboard when new instance is created.

"Hello friends,for my customers I will be deploying (their) new instances - on demand and automatically. I also have one CW Dashboard with the list of all my server-instances, Metrics and Alarms.Any Idea how to simply react for new generated server instance?Practicaly, when new instance apears, I would like automaticaly spread my Dashboard.I am looking for the simplest way, if exists. e.g. some CLI script, which I will run when new instance apears in my EC2.Erasing of old (and obsoled) instances will be usefull (and nice to have) too :)thanksmartinFollowComment"

Answer: "0You can use Metrics explorer for this https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Metrics-Explorer.html.  Metrics explorer visualizations are dynamic, so if a matching resource is created after you create a metrics explorer widget and add it to a CloudWatch dashboard, the new resource automatically appears in the explorer widget.CommentSharePete_Danswered a year agorePost-User-0851319 a year agoHi Pete, thanks for your reply. It's a good idea to use Metric Explorer with dynamic parameters, but will it be enough?Does this also works for dynamically defined Alarms? Can Metric Explorer define dynamic Alarms for all instances created in the future as well?I think I need to create all the Alarms first before I can use them in the Dashboard (?or not?).I am considering a solution based on CLI commands - e.g. put-metric-alarm, here https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/put-metric-alarm.html.This command would be run (as a shell script) directly on the newly created (Linux) server and creates a new set of Alarms for this new instance. How do you sound this idea?With best regardsmartin.SharerePost-User-0851319 a year agoP.S.Just to add. This is what the Dashboard of all servers should look like.So far I have prepared it manually, but I would like to automate the change of new records.https://cloudwatch.amazonaws.com/dashboard.html?dashboard=Servers_Alarms_STATUS&context=eyJSIjoidXMtZWFzdC0xIiwiRCI6ImN3LWRiLTk0NDg5MDE4MjkxNCIsIlUiOiJ1cy1lYXN0LTFfMFR3eXgzczNwIiwiQyI6IjVpNGxydGFrM25sbGphdWJvYzZ1YTZtazFuIiwiSSI6InVzLWVhc3QtMTpiZjRjYzJhNC0yM2I0LTQyZDgtYjg5NC0wNjgzOTFiNjdjZjMiLCJPIjoiYXJuOmF3czppYW06Ojk0NDg5MDE4MjkxNDpyb2xlL3NlcnZpY2Utcm9sZS9DV0RCU2hhcmluZy1QdWJsaWNSZWFkT25seUFjY2Vzcy1BSUY1QjdUWSIsIk0iOiJQdWJsaWMifQ==Share"


Question: Editing preferences on Amazon Jobs portal

"Hello,This is rather non-tech question.I would like to know if I am bale to change some preferences on amanzon.jobs account. I particularly want to know where I can find the relocate option.Thank youFollowComment"

Answer: 1you can tap on your  profile and change it.CommentSharechaitanyaanswered a year ago


Question: Besides the operational costs and hourly costs - why should i use AWS Timestream instead of OpenSearch? for metrics ingestions and querying

"I have a use case where I ingest metrics into the system, those can be various types of metrics, and eventually tenants in the system will have dashboard to Visualize those metrics, and create reports. Users might be able to also create their own dashboards.I'm debating between Timestream and OpenSearch, both can achieve IAM fine grain permissions (per TS table / elastic index), and i know there are operational costs (storage / scaling) for ES, but I have 2 concerns about TS which i'd love to discuss:Timestream has maximum 128 dimensions, which means to have properties on my metrics, i might need to use generic d1, d2, d3 dimensionsqueries are priced per 10MB minimum - This is the BIGGEST problem:I can't create a dashboard with different queries, because if i'll visualize 20 metrics, i'll have to pay for 200MB of scan - which you multiply by 10,000 customers, every few hours - this will be horribleI will have to to aggregate everything into one SQL call with UNION -(Select ... from table) UNION (Select ... from table) UNION (select ... from table) just to reduce query costs - this sounds super weird, and hard to do if there are different columns and results in each query.I'll need to restrict the dashboard from realtime to every few hours, to reduce querying costsin opensearch i don't have those.Your thoughts?FollowComment"

Answer: "0I already have a request in for AWS to add caching in Grafana for Timestream.  We use Timestream with MultiMetric writes to help with this but the main reason we went with it over OpenSearch was that we have 2 people on our team and managing cross regional OpenSearch wasn't something I wanted to do.  We've been pretty happy with it's scalability so far but I'm concerned over it only being a single region product.CommentSharesmithatlantaanswered 7 months agoArielB 7 months agoThe problem is that i'm going to show dashboards to my customers.. it's not used internally, so mass dashboards means mass queriesShare0Opensearch works well with lower data volumes and simpler queries. at higher data volumes, it’s not as well-suited for processing analytical queries compared to Timestream and it becomes difficult to formulate certain queries in the Opensearch query DSLOne big advantage is that timestream is completely serverless, for Opensearch, although you don’t have servers to manage directly, we do have to monitor the node health (which we can see in CW). they can experience issues and the cluster will be in an unhealthy state until the Opensearch support team is paged (they will not resolve it automatically). Timestream seems to be actually serverless so there’s no actual cluster for us to keep an eye onIf you have lots of real time aggregations and want to write them in SQL (and are expecting high cost), then Timestream will fit in your use case.I found the following for you that lists other benefits of Timestream:https://towardsdatascience.com/amazon-timestream-is-finally-released-is-it-worth-your-time-e6b7eff10867https://k21academy.com/amazon-web-services/amazon-timestream/https://www.projectpro.io/recipes/explain-features-of-amazon-timestreamhttps://sourceforge.net/software/compare/Amazon-Timestream-vs-Elasticsearch-vs-Google-Programmable-Search-Engine/CommentShareSUPPORT ENGINEERsuveshan_panswered 7 months agoArielB 7 months agoThank you for your detailed answer.For my use case, i don't expect high volumes of data, rather I expect large number of queries.How does "If you have lots of real time aggregations and want to write them in SQL (and are expecting high cost), then Timestream will fit in your use case." makes sense?Let's say i expose a dashboard to my customers, while each customer has a table (for tenant isolation purposes).Now, If i'm having 30 widgest, i'm going to pay 30*10MB worth of scan, where let's say the entire 30 queries only scanned few MB.won't i expect an outstanding read costs?how does this makes sense with grafana integration where every panel is a seperate query?how to battle this minimum 10MB query limitation?Share"


Question: Unable to extract fields from Analyze Expense Demo for pdfs. Am I missing anything?

"Unable to extract fields from Analyze Expense Demo for pdfs. However, same file in jpeg or png format is working fine. For pdf, getting "We can’t find any summary fields"FollowComment"

Answer: "0Thank you for trying out our product. To better assist you, we will need to look at the pdf file and gather a few details. Can you create a support ticket, and we will have our support engineer look into this for you, please?CommentShareAWS-User-5423469answered a year ago"


Question: Sap SuccessFactors - Best Way to import data to S3 data via batch job

"Hi,I've try to import some table, from  Saas Instance of Sap SuccessFactors to S3.At the moment I've exposed from SAP SuccessFactors API and I consume it to a custom Lambda (that write the data into S3).There is an alternative way to manage the task more efficiently with some AWS Serverless services? I've noted that APPFLOW doesn't' have a specific connector for Sap SuccessFactors?thanks and regardsFollowComment"

Answer: "0Your current approach is good. You are correct in that AppFlow doesn't currently have a SuccessFactors connector.An alternative, if you're using SAP Business Technology Platform (BTP) - Cloud Integration Suite - is to use the AWS BTP Adapter to push this data to S3 as an endpoint in your integration flow. This can be helpful if you've already integrated SF with SAP ERP through Cloud Integration Suite - you can modify or extend the iFlow.Further details in this blog: Integrating SAP Systems with AWS Services using SAP Business Technology Platform .NOTE: This answer is provided by the SAP on AWS specialty team and is accurate at the time of publish. Please check comments as the answer may have changed/services evolved.CommentShareEnekoanswered a month ago"


Question: Disable AWS Cost Explorer permissions

"I enabled Cost Explorer and my costs have gone way up. Billing shows that 152,000 requests were made in January, which translates to $1.52 but it's 75% of my total charges for that month.Documentation says that "You can't disable Cost Explorer after you enable it.". I contacted AWS support and tried to follow their first suggestion of deleting all Cost Explorer reports, but the user interface does not allow deleting the core Cost Explorer reports.After realizing that, their suggestion was to remove from all users the permission to use Cost Explorer API:It can't be disabled but charges will stop if they stop using Cost Explorer API. Cost Explorer API is not something that can be disabled, in order to stop being charged, you just have to stop using Cost Explorer API to query cost data and block ALL IAM users from using it. Cost Explorer API is only charged if a user (Root/IAM/Role) uses Cost Explorer API to query cost data.The issue is that I don't know how to do that. I believe it's some kind of "hidden"/internal service account that is doing all these requests automatically, as I didn't even open Cost Explorer Dashboard last month. If it's the root account, does IAM allow limiting its permissions? I looked at the Roles listed in IAM and none of them seem to have ce:* permissions. Has anyone tried to somehow disable Cost Explorer?FollowCommentJason_S a year agoCan you please provide an update on whether the question has been resolved? thanks.Share"

Answer: "3First of all I have to point out your statement is very misleading. If you ONLY turned on cost explorer, AWS will NEVER charge you even 1c. It is completely free service by default, if you only used the UI. That said, $1.52 is not a jump that justifies "way up", while I totally understand it's 75% of your current AWS spending.Secondly, if you see 152k requests but are charged only $1.52, it is unlikely to be API charges. Because the API charge is $0.01 per request. That said, if you are sure, it must be either you, someone in your team or a 3rd party application that you authorized, that are making the request. AWS internal services will not making request on your behalf.You can search in CloudTrail for the CostExplorer API call to identify caller.Lastly, based on your pricing it made me suspect you enabled Hourly and Resource Level Data Option. Again, that option is NEVER enabled by default, you must specifically Op-in. It cost $0.01 per 1,000 UsageRecords-month. That matched the bill you received. To disable, you go to Cost Explorer Console, go to Preferences (try this link), and uncheck the "Hourly and Resource Level Data" checkbox, then click the "Save preferences" button.CommentShareJason_Sanswered a year ago0Hi!  Good question.  Keep in mind that for ce permissions, a policy attached that allows{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "*:*"      ],      "Resource": [        "*"      ]    }  ]}such as the AWS Managed AdministratorAccess policy also may allow for roles and users to run CE reports.You can also use the Policy Simulator to check for access to CE: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.htmlThere are 2 possible ways that CE charges:Cost Explorer API (0.01 per request)Cost Explorer Hourly and Resource level granularity ($0.01 per 1,000 UsageRecords month).You can block access to CE by denying CE and applying that policy onto your users/roles such as:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Deny",      "Action": [        "ce:*"      ],      "Resource": [        "*"      ]    }  ]}CommentSharejsoncanswered a year ago0Hi, very good questionI would suggest you to look for any IAM policy with action as "ce:*".Once you find a policy, you could try disabling/remove it and seeFor Example:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "ce:*"      ],      "Resource": [        "*"      ]    }  ]}CommentShareSrianswered a year ago"


Question: AWS user Pool was deleted during Amplify app build

"While testing an AWS amplify App, this app was using an existing backend thats connected to a different app. During the build phase, the associated user pool deleted itself. Is there any way to recover a user pool, or possibly rollback changes?FollowComment"

Answer: "0Unfortunately, there is no feature within Cognito to restore a deleted user pool resource. Do you have any backup, for example, stored in DynamoDB or have a secondary user pool as a backup? If not, you may want to take a look at this AWS solution.CommentShareTaka_Manswered 10 months ago"


Question: AWS Microsoft Active Directory - how to access the domain controllers to define groups and users

"Hi there, just created my AWS Microsoft Active Directory (Standard edition). I know this has created 2 virtual MS Server 2012 in different availability zones, but I can see no way to connect to either to start setting up? I remember reading in the documentation that 2 user connections were allowed to each server for this reasonFollowComment"

Answer: "0Accepted AnswerHello, here are the instructions for how to manage users and groups within AD Managed Microsoft AD.  https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_manage_users_groups.htmlYou will need to have a Windows EC2 instance joined to the domain (https://docs.aws.amazon.com/directoryservice/latest/admin-guide/microsoftadbasestep3.html).  Then you will need to install the Active Directory administration tools (https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_install_ad_tools.html) and finally you will be able to manage your Active Directory Objects.CommentShareEXPERTJeremy_Ganswered a year ago0Thank you, I was really hoping to avoid needing this - I already have an EC2 Windows server attached to another domain. Am I right in thinking that the two Windows 2012 VMs have no graphical interface then? I can't see what security group these DCs have been put into so assume that any other Windows VM that I create in the VPC will be able to join the new domain? Also guessing that I must set the DNS servers on the Windows VM to point to the DCs before trying to join?CommentSharemsutherland25answered a year ago"


Question: how to run the batch file commands in administrator privilege while launching AppStream image in the Fleet.

"Unable to run batch file command(CertUtil.exe) as normal user in fleet image. While running batch file command, we get an access denied error. We also tried to run as "Administrator", but it just prompts Admin password.Any comment/suggestion on running batch file command with Administrator privileges?FollowComment"

Answer: "0Not this way, you're going to have to GPO or Session scripts to automate this with the SYSTEM process.CommentShareEXPERTStevieStetsanswered a year agoAWS-User-8600516 a year agoCould please share some pointer on session script?Share"


Question: Best and performant way of restricting user access to S3?

"We are currently signing the url's for Cloudfront, but are experiencing some noticeable performance concerns when it comes to signing the url's - taking 40ms or so per image with Python using the private key.We want to minimize writes to the database, hence we have come up with caching the 14 day access URL for 7 days with Redis, if any performance gains are retrievable from this.But we are really curious if there exists any better way of doing this, or if we have made the correct design for retrieving the images?The images use user_UUID/image_UUID as their url by default within S3, perhaps the obfuscation + throttling is enough for some use cases?FollowComment"


Question: Does AWS IoT Greengrass support managing Windows core devices with AWS Systems Manager

"I would like to know whether AWS really supports Systems Manager on Greengrass Windows core devices. As per Greengrass Developer Guide, Version 2 it doesn't support."AWS IoT Greengrass doesn't currently support this feature on Windows core devices."But AWS Systems Manager documentation says Windows Server is supported platform.Does it mean that it supports Windows Server OS for other type of instances - EC2, On Premises etc.,?FollowComment"

Answer: "0Hi,As you correctly point out, the AWS IoT Greengrass Systems Manager Agent component only supports Linux operating systems today. Once the agent is installed in this manner, it directly communicates with the System Manager endpoints separately from Greengrass.While the AWS provided component only supports Linux, you can create your own component that would replicate the installation and configuration of the System Manager Agent on Windows. One way to do this would be to determine the PowerShell commands to download, install, then create a configuration file for the agent to register with Systems Manager.I will add your interest in Windows support for this component.CommentShareGavin_Aanswered 2 months ago"


Question: "amazonlinux-2 repository not working with HTTPS for nginx, because mirrorlist returns http url"

"We want to only allow https in our AWS network, and not unencrypted http.So we switched to us https for yum upgrade, by changing:/etc/yum.confsslverify=1/etc/yum/vars/awsprotoFrom http to https/etc/yum/vars/amazonlinuxamazonlinux-2-repos-eu-central-1.s3That works, except for the nginx extras.nginx mirror list: https://amazonlinux-2-repos-eu-central-1.s3.eu-central-1.amazonaws.com/2/extras/nginx1.12/latest/x86_64/mirror.listreturns a http url, instead of a https.And since we only allow https outbound connections, yum check-update and other yum commands fail.http://amazonlinux.eu-central-1.amazonaws.com/2/extras/nginx1.12/1.12.2/x86_64/16cfcd22c8b6d22eb76ebcf21cfac836583e70557ae5c0207effa6065faf2c92/repodata/repomd.xml?instance_id=i-0fff97e7940945d70&region=eu-central-1: [Errno 12] Timeout on http://amazonlinux.eu-central-1.amazonaws.com/2/extras/nginx1.12/1.12.2/x86_64/16cfcd22c8b6d22eb76ebcf21cfac836583e70557ae5c0207effa6065faf2c92/repodata/repomd.xml?instance_id=i-0fff97e7940945d70&region=eu-central-1: (28, 'Failed to connect to amazonlinux.eu-central-1.amazonaws.com port 80: Connection timed out')Trying other mirror.If we disable the extras repo for nginx, it works as expected.Can you please fix that? Thx.FollowComment"


Question: "Environment terminated, but still showing up on dashboard"

"https://eu-west-1.console.aws.amazon.com/elasticbeanstalk/home?region=eu-west-1#/environment/dashboard?applicationName=sbb2&environmentId=e-5p4mrcdkmwSeveral hours passed since i have terminated the environment above, but it is still there in my dashboard. I need to create another one with the same URL but i can't because it is already taken by the (non)terminated environment.It is stuck in a limbo, i cannot even terminate it again.The problem seems to be the attached AMI, from a t2.micro, but the env. is a t3 which is not compatible.FollowComment"

Answer: 0Now it workedCommentSharelbphpanswered 3 years ago


Question: Llifecycle configuration rules conflict

"Where can I read about edge cases where I define a couple of lifecycle rules, where I delete the same object, one rule specifies expiry after 30 days and then other rule specifies expiry after 60 days. Which rule takes precedence?  Same question for a case with one rule for the entire bucket and one rule for a specific object in the bucket. Thanks!FollowComment"

Answer: "0Hi,In a nutshell, S3 lifecycle chooses a path that is least expensiveYou can find some useful information here - https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-configuration-examples.html#lifecycle-config-conceptual-ex5--SydCommentShareSydanswered 8 months ago"


Question: network is not working-lightsail

"The server cannot access the external network, nor can it be accessed from the external network. Shut down the server and restart it. When the process kswapd0 is running at full capacity, you can access the external network, and the external network can also access the server's website. After a period of time, the internal and external networks cannot be accessed.FollowComment"


Question: Does the 1.7 Setup Assistant doesn't seem to be working properly... Is it working for anyone else?

"My team and I have been looking forward to the using 1.7 release for a project. We started to try to install the new release but it doesn't look like the Setup Assistant is actually downloading the majority of the required SDKs. After the first click of the "Install All" button, it appears to become unresponsive. Has anyone else been able to install 1.7 from scratch successfully?Follow"

Answer: "0Accepted AnswerHey @REDACTEDUSER3rd Party - Common https://df0vy3vd107il.cloudfront.net/1.7.0.0/lumberyard-1.7-339714-common-ThirdParty.zip3rd Party - vc120 https://df0vy3vd107il.cloudfront.net/1.7.0.0/lumberyard-1.7-339714-vc120-ThirdParty.zip3rd Party - vc140 https://df0vy3vd107il.cloudfront.net/1.7.0.0/lumberyard-1.7-339714-vc140-ThirdParty.zip3rd Party - Linux https://df0vy3vd107il.cloudfront.net/1.7.0.0/lumberyard-1.7-339714-winlinux-ThirdParty.zipFor these zip downloads you will need to assemble common and either vc120 (VS2013) or vc140 (VS2015). And Winlinux if you are running a linux dedicated server.SharerePost-User-8353690answered 6 years ago0@REDACTEDUSERREMOVEDUPLOADThis it's like this for 75% of the sdks. Lib folder doesn't exist.SharerePost-User-3220036answered 6 years ago0Thanks for reporting. Apparently it just finished replicating and we are keeping an eye on this. Can you try again in a bit and let me know if it is still happening?SharerePost-User-8353690answered 6 years ago0I downloaded 20 or so minutes ago, still not working.I did not try zip file just setup.I do not recall the error , but the install while it finished ok, it wouldn't run, prob. similar errors as to what others are seeing; only occured with this release as I"m sure you are aware of.Eager to try it, and understand growing pains all too well.SharerePost-User-2755327answered 6 years ago0Fantastic! Thank you for letting us know this is working. We are sorry for the issues and frustration this may have caused. We have already created some plans for future deployments to mitigate this sort of issue.SharerePost-User-8353690answered 6 years ago0Hey @REDACTEDUSERSharerePost-User-8353690answered 6 years ago0Hey @REDACTEDUSERSharerePost-User-8353690answered 6 years ago0Looks like the cloudfront distribution has propagated, I am able to download and install all required SDK's for Game Code, Engine and Asset... and Editor and Tools tick boxes.SharerePost-User-4796539answered 6 years ago"


Question: EC2 instance mac2.metal stuck in "shutting-down" state

From the GUI and cli I get the same response.CLI output:aws ec2 stop-instances --instance-ids i-0ba5424afee138ef5 --forceAn error occurred (IncorrectInstanceState) when calling the StopInstances operation: This instance 'i-0ba5424afee138ef5' is not in a state from which it can be stopped.Thanks!FollowComment

Answer: "0Accepted AnswerHi THereWhen you stop a Mac instance, the instance remains in the stopping state for about 15 minutes before it enters the stopped state.When you stop or terminate a Mac instance, Amazon EC2 performs a scrubbing workflow on the underlying Dedicated Host to erase the internal SSD, to clear the persistent NVRAM variables, and to update to the latest device firmware. This ensures that Mac instances provide the same security and data privacy as other EC2 Nitro instances. It also enables you to run the latest macOS AMIs. During the scrubbing workflow, the Dedicated Host temporarily enters the pending state. On x86 Mac instances, the scrubbing workflow may take up to 50 minutes to complete. On M1 Mac instances, the scrubbing workflow may take up to 110 minutes to complete. Additionally, on x86 Mac instances, if the device firmware needs to be updated, the scrubbing workflow may take up to 3 hours to complete.In any of those cases, you are not billed while the instance is in the pending and stopping state.Seehttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-mac-instances.html#mac-instance-stopCommentShareEXPERTMatt-Banswered 9 months agonrosania 9 months agoThank you! New to the mac instances on AWS. This makes sense.Share"


Question: Can't grant execute grant with rdsadmin.rdsadmin_util.grant_sys_object over SYS.VALIDATE_APEX

"I need to execute sys.validate_apex in order to make SPATIAL works on Oracle APEX. I tried the following code:begin    rdsadmin.rdsadmin_util.grant_sys_object(        p_obj_name  => 'VALIDATE_APEX',        p_grantee   => 'SNW_SYSTEM',        p_privilege => 'EXECUTE');end;/With the consequent error:Error report -ORA-20199: Error in rdsadmin_util.grant_sys_object. ORA-20900: You do not have permission to grant: EXECUTE to SYS object: VALIDATE_APEXORA-06512: at "RDSADMIN.RDSADMIN_UTIL", line 255ORA-20900: You do not have permission to grant: EXECUTE to SYS object: VALIDATE_APEXORA-06512: at "SYS.RDS_SYS_UTIL", line 513ORA-06512: at "RDSADMIN.RDSADMIN_UTIL", line 252The root problem is caused by adding SPATIAL option after APEX-DEV option.Any page in my apex applictaion related to SPATIAL datatypes returns error:ORA-06592: No se ha encontrado la opción CASE al ejecutar la sentencia CASEI tried editing the Option parameter group so it could trigger the procedure without success.Any help is welcome. Thanks!FollowComment"

Answer: 0As the error message you dont have permission to granti would suggest opening a case with aws premium support from support center to find out if it is allowed and what is the right way of achieving thisCommentShareAWS-User-8174525-subhashanswered 3 months ago


Question: Serverless Authentication Next.JS/Amplify/Cognito - customization of sign up/sign in dialog

"Im working through this blog post - https://www.xiegerts.com/post/amplify-ui-auth-nextjs/Everything mostly works pretty great. One thing I would like to be able to do is pre-populate the 'username' value that you are asked to enter in the sign in/sign up pages that are thrown by withAuthenticator. I see a lot of articles referencing how to change the fields that are used or the ui, but there doesnt seem to be a clear way to pre-populate a field value in the screens.Is this a possibility?Thank you!FollowComment"


Question: Polly  S3BucketName

"Hi there,I am setting the OutputS3BucketName when using Polly's StartSpeechSynthesisTask according to https://docs.aws.amazon.com/polly/latest/dg/longer-cli.htmlPolly recognises the bucket, and the Polly user is the same one that owns the bucket and has full permissions, Write objects in particular, but nothing shows up in the bucket even though the response seems positive:{'ResponseMetadata': {'RequestId': 'fb956d3e-914c-421e-b009-1e87ec49a4c9', 'HTTPStatusCode': 200, 'HTTPHeaders': {'x-amzn-requestid': 'fb956d3e-914c-421e-b009-1e87ec49a4c9', 'content-type': 'application/json', 'content-length': '461', 'date': 'Fri, 21 Aug 2020 16:17:35 GMT'}, 'RetryAttempts': 0}, 'SynthesisTask': {'TaskId': '9966b973-a0ce-42b2-8270-3aff8c91143f', 'TaskStatus': 'scheduled', 'OutputUri': 'https://s3.eu-west-1.amazonaws.com/my-speech-polly-bucket/9966b973-a0ce-42b2-8270-3aff8c91143f.mp3', 'CreationTime': datetime.datetime(2020, 8, 21, 16, 17, 35, 852000, tzinfo=tzlocal()), 'RequestCharacters': 1666, 'OutputFormat': 'mp3', 'TextType': 'ssml', 'VoiceId': 'Amy'}}Can anyone help?Thanks!Edited by: info_opendemocracy on Aug 21, 2020 10:26 AMFollowComment"

Answer: 0AnsweredCommentShareinfo_opendemocracyanswered 3 years ago


Question: directory domain name

"What I want to do is from the domain name vapeprivate.com make vapeprivate.com/fr, vapeprivate.com/es, vapeprivate.com/it to create several versions of the website at the language level. Can you give me the example of how to do in my case concretely. Currently I have a bucket created in the name of vapeprivate.com connected to the domain name vapeprivate.com with route 53FollowComment"

Answer: 0Accepted Answerwho can help me pls ?CommentShareAWS-User-6438027answered a year ago


Question: Service Control Policy - Availability Zones

"I know we can (and have) locked down access to specific AWS regions.  My question is, is it possible to lockdown AZ's with service control policies?FollowComment"

Answer: "0Yes you can do this, this policy blocked me from launching an ec2 instance in "us-east-1a"{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "Statement1",      "Effect": "Deny",      "Action": [        "ec2:*"      ],      "Resource": [        "*"      ],      "Condition": {        "ForAnyValue:StringEquals": {          "ec2:AvailabilityZone": [            "us-east-1a"          ]        }      }    }  ]}Decoded failure message{  "allowed": false,  "explicitDeny": true,  "matchedStatements": {    "items": [      {        "statementId": "Statement1",        "effect": "DENY",        "principals": {          "items": [            {              "value": "xxxxxxxxxxxxxxxx"            }          ]        },        "principalGroups": {          "items": []        },        "actions": {          "items": [            {              "value": "ec2:RunInstances"            },            {              "value": "ec2:*"            }          ]        },        "resources": {          "items": [            {              "value": "*"            }          ]        },        "conditions": {          "items": [            {              "key": "ec2:AvailabilityZone",              "values": {                "items": [                  {                    "value": "us-east-1a"                  }                ]              }            }          ]        }      }    ]  },CommentShareEXPERTMatt-Banswered 10 months ago0You can add an inline policy and add a condition to to restrict access to availability zone.CommentShareSoumith Avunoorianswered 10 months ago"


Question: Difficulty understanding QuickSight pricing

"I have a public, static website where I want to display embedded QuickSight charts.  My data are in s3.  I estimate the site will display around a dozen or so charts sprinkled across a few pages.  The site is initially a low traffic site, starting at around 50 unique views per day with it hopefully eventually ramping up to 1000 views plus per day.  I am the only developer.I'm confused with the pricing model listed in the official pricing page.  I have the following questions:Do public embedded charts and/or dashboards require me to choose the enterprise edition?Is QuickSight really built for public access?  Does each unique visitor count as a "reader?"If the answer to the second question on #2 is yes, does this mean each visitor initiates a session?Is QuickSight even appropriate for my use case?FollowComment"

Answer: "0Accepted AnswerThe bulk pricing is indeed not appropriate for your use case, however the individual reader session pricing may be, but I suspect it is not.The billing model for the basic embedded use is "Per user session" -- where a 'user' needs to be authenticated in some mannor (may be an anonymous user using cognito or other methods - but needs to be a user-authentication , e.g. using some standard authentication associated with humans logging in.Cognito is a good fit for this.   User sessions are up to 30 minutes.  Max per-user-per month is $5.If your 'visits' are from 'users' then this might work. However your use of the term 'view' and 'visit' suggests a more passive public site where people are not 'logging in' and my in fact be robots ('spiders').  This use case is not a good fit for Quicksight directly -- Quicksight is NOT a 'chart engine',quicksight is a full "Interactive BI Visualization tool" intended for significant user interaction (drill downs, cross-linking, persisting of previous views, per-user customizations etc).    Compared to traditional BI tools ("power BI", "Tableau" ) -- Quicksight has a much better pricing model and embedded experience.But compared to 'charting libraries' like D3, Chart.js, google charts etc -- Quicksight is much 'heavier' and not a good comparison or fit.So if the intent is ' a few charts spread over a public web site'  then the User Session concept and embedded QuickSight is not a good fit.However -- if what you need is static images of charts -- non-interactive, you certainly can use a single author role and generate as many charts as you like then export them to a graphic file to include in your web site.However - once you hit a certian scale -- say 10s of thousands of interactive sessions  -- the "Capacity Pricing" model starts to be a very good fit,as you do NOT have to pre-define users at all.  You can have 1 million 'users' but pay only for the 1,000 that use the dashboards each month without having to know whom or even have any kind of 'login' or 'session'.CommentShareDALDEIanswered a year ago0#1Yes, you need to select the Enterprise Edition.#2, 3If you want to have public access without authentication as a QuickSight user, you need to purchase reader session capacity. For leader session capacity, you will be charged for each session issued, and for each leader plan, you will be charged for each leader.#4There may be situations where QuickSight lacks functionality and selects other BI tools, but I don't really think about whether it is suitable for large-scale or small-scale usage.CommentShareEXPERTiwasaanswered a year agozzzz8888 a year agoThanks iwasa.  Unfortunately, this seems to be cost prohibitive for a small website when considering $150-$200 for 500/sessions a month as I could imagine 100 users logging in multiple times per month.  The costs spiral out of my price range if I get a few hundred more users.SharerePost-User-4826482 4 months agoI still don't understand this actually. If my dashboard is embedded but it is anonymously embedded... then the standard Reader session pricing of $.30 does not apply as these are for registered users in QS. If the dashboard is anonymously embedded, I have no choice but to use the capacity pricing which starts at $.50 per session?Share"


Question: Delete Elastic BeanStalk environment. (Delete environment option disabled)

"I created an application using Elastic BeanStalk and deleted it because of an error,When I tried to delete the Elastic BeanStalk environment, all options except 'Restore the environment' were disabled.How do I delete my environment?FollowComment"

Answer: "1Accepted AnswerIs the environment like the image below and you cannot select anything other than restore?In this case, the environment itself has been terminated, so no particular charges should occur.This is the first time I've seen this state, but I expect that it will disappear completely over time.CommentShareEXPERTRiku_Kobayashianswered 20 days agoRiku_Kobayashi EXPERT20 days ago【Additional Information】The one in my environment in the image disappeared on its own after about an hour of being left alone.Sharekkomysue 20 days agoThank you for your reply. I'll take the time and wait.Share"


Question: cURL error 6: Could not resolve host: email..amazonaws.com - Mailster

"I use the WordPress plugin of Mailster to send emails out to the subscribers through Amazon SES.I've been doing this for 3 years with no problem at all.I've recently moved my hosting company to Hostrator since 4/20/2021 and after a few contacts with Hostgator tech support, this started to work fine until three days ago.All of a sudden whenever I try to send an email I get the below error message (underlined) and of course, I cannot send out email.Couldn't send message. Check your settings!cURL error 6: Could not resolve host: email..amazonaws.comHostgator tech support tells me that all Amazon SES Domain Verification TXT Records and Amazon SES DKIM Record Set have been reflected as per my request and they don't see any odd settings on their side.Any thoughts?TIA.All the best.FollowComment"

Answer: "0Somehow, the restoration from the backup has resolved the issue.CommentSharekosaanswered 2 years ago"


Question: "Want to read 25 Million records of Data (3.656384GB) through DynamoDB which method should i apply on demand or provisioned , can someone  plz help with how much will it cost?"

"Hi,I need help in knowing the pricing for provisioned table as I want to read data from Dynamo DB table having 25 million read with same schema, as i cannot used the sized of the file is 3.656384GB (3656384 kb). I Don't use that table  that much frequently thrice in a month or maybe will read from it for 5 times in a month. I am unsure what table type to use on Demand or Provisioned and what will be the pricing if i go with on demand and if i go with Provisioned? Would appreciate  help in this concern.FollowComment"

Answer: "1On-demandPriceOn-demand pricing for reads is $0.25 per million read request units.1 read unit is defined as one strongly consistent read of an item which is up to 4KB in size.CostRead units required: (3.656384 gigabytes) / (4 kilobytes) = 914 096 read unitsStrongly Consistent:914096 * 0.25 / 1000000 = $0.22Eventually Consistent:914096 * 0.25 / 1000000 / 2 = $0.11ProvisionedPriceProvisioned pricing is $0.00013 per RCU per hour.CostRead units required: Depends how quickly you need to read the data. Lets assume you can consume 250 RCU, that would allow you to read the data in approximately 1 hourStrongly Consistent:250 *0.00013 = $0.03Eventually Consistent:250 *0.00013 / 2 = $0.016AdviceMy advice to you is to make yourself familiar with the Pricing Docs and also with the DynamoDB Capacity Docs, that will help you make the choice based on your specific needs.CommentShareEXPERTLeeroy Hannigananswered 2 months ago0The easiest pricing model to understand is on-demand because it's based only on usage. Also there's no need to move a provisioned amount up or down, which is great when you want to do some rare activity.To scan 3.6 GB in on-demand mode will require approximately 3,600,000,000 bytes / 4,096 per read-request-unit / 2 for eventual consistency = 439,453 read request units. The price in us-east-1 for these is you get a million for 25c. That means it's about 12 cents to do a full table scan of a 3.6 GB table.I'd leave the table as on-demand and with 5 full scans a month you're under $1.CommentSharejzhunteranswered 2 months ago"


Question: Why am I getting SQS messages with different MessageGroupId's in a single boto3 receive_messages call?

"I understand from the docs that if I am setting MessageGroupId when sending messages to a SQS FIFO, any and all messages returned in a single queue.receive_messages()boto3 call should have the same MessageGroupId. But I am getting messages with different MessageGroupId values in a single queue.receive_messages() call.Here is how I am calling send_messages() using the python boto3 lib:            client = boto3.resource(                "sqs",                region_name=utils.AWS_SQS_REGION,                aws_access_key_id=utils.AWS_SQS_ACCESS_KEY,                aws_secret_access_key=utils.AWS_SQS_SECRET_KEY,            )                queue = client.get_queue_by_name(QueueName=aws_queue_name)                for chunk in chunked(queue_bulk_kwargs, 10):  # Amazon SQS batch size limit is 10                    Entries = [                        {                            "Id": str(uuid.uuid4()),                            "MessageBody": json.dumps(args, cls=EnhancedJSONEncoder),                            "MessageGroupId": str(args["calsync_account_id"]),                            "MessageDeduplicationId": str(uuid.uuid4()).replace("-", ""),                        }                        for args in chunk                    ]                    response = queue.send_messages(Entries=Entries)Here is how I am calling receive_messages():        client = boto3.resource(            "sqs",            region_name=utils.AWS_SQS_REGION,            aws_access_key_id=utils.AWS_SQS_ACCESS_KEY,            aws_secret_access_key=utils.AWS_SQS_SECRET_KEY,        )        self._queue = client.Queue(QueueURL)        messages = self._queue.receive_messages(            MaxNumberOfMessages=self.AWS_SQS_QUEUE_CHUNK_SIZE, AttributeNames=["MessageGroupId"]        )Have I misunderstood how MessageGroupId works? Or is there another way to send and/or receive messages to only receive messages from one MessageGroupId at a time? Otherwise I have to manage a local ordered message cache which is the same as implementing a local queue and defeats the purpose of using SQS in the first place.Thanks!FollowComment"

Answer: 0As per the documentation:ReceiveMessage might return messages with multiple MessageGroupId values.CommentShareEXPERTBrettski-AWSanswered a year ago


Question: EC2 instance connect stopped working

"EC2 instance (Ubuntu 20.04) was working fine a few times ago, but stopped working suddenlyhttps://www.screencast.com/t/wgR8QN0jeall network settings is correct I doubleFollowCommentAlberto Fernandes 5 months agoAre you trying to connect with Session Manager?Share"

Answer: 0Could be that the agent crashed. If you can I would just restart the machine and try again. If not you may be able to enable console access and check the status of the agent.CommentShareEvananswered 5 months ago


Question: "Options to aws elbv2 delete-listener by target group name, region"

"Is there a way to delete a listener on an LB via the CLI using the Target Group name, AWS region (and anything else that is needed to uniquely identify the listener)?The current and only option is to identify the listener by the ARN (--listener-arn).FollowComment"

Answer: "0Hello,kindly check this docs : https://docs.aws.amazon.com/cli/latest/reference/elb/delete-load-balancer-listeners.htmlI hope it'll be helpful for you.Regards,CloudHasibCommentSharecloudhasibanswered 4 years ago0Thanks. As per documentation for elb:"This reference covers the 2012-06-01 API, which supports Classic Load Balancers. The 2015-12-01 API supports Application Load Balancers and Network Load Balancers."I'm assuming this (elb command) will work against an ELB of Type:Application ?This option should make it to elbv2, imo.Also it would be good to have an enhancement request to perform a delete using the options I've mentioned in the title of this question. It was very inefficient to obtain the Target Group details and then parse down to retrieving the port/listener-arn in order to issue the delete.CommentSharenareshbalanswered 4 years ago"


Question: Is it possible to get the *receiving* rule limits raised?

"I run an email forwarding service (https://kopi.cloud).I'm investigating the feasibility of building a feature to allow users to "bring their own domain".It seems like this should work fine with SES, except there are limits on total number of rules and total number of recipients (see https://docs.aws.amazon.com/ses/latest/DeveloperGuide/limits.html)With the currently limits on rules and recipients, Kopi could support up to about 10,000 subscriber domains.10K domains will be plenty for a while, I don't expect that many people will actually want to bring their own domain (I reckon most people who'd want this would just go ahead and do their own forwarding), so I'm going to go ahead prototyping the feature.  But I need to check if these limits are "soft limits", like the sending limits that can be raised on request; or "hard limits", where no increase is possible.So my question: "Is it possible to get the SES receiving rule limits raised?"Edited by: Shorn on May 28, 2019 3:13 PMEdited by: Shorn on May 28, 2019 3:14 PMFollowComment"

Answer: "0Hi,I understand you want to know about the possibility of limit increase for the number of incoming rules per receipt rule set and also the number of recipients per receipt rule in Amazon SES service. Please correct me if I misunderstood.With regards to the limit, unfortunately these limits are a hard limit and cannot be increased at the moment. There is currently a feature request in place, however I have no details on the completion. If the SES team decides to add this as a new feature, they might post information on our What's New with AWS Blog, I've provided links below-Latest releases by AWS >> https://aws.amazon.com/new/As a work around for now, you can follow any of the below solutions:As SES is available in 3 regions, you can span up multiple accounts and have the other rules configured for those accounts. Or you could utilise SES for all the available regions effectively giving you 300 rules(100 rules per region).In the meantime, if you are going to receive emails for correspondence on a regular base through Amazon SES, you may consider to use Amazon WorkMail instead which is a secure, managed business email and calendar service with support for existing desktop and mobile email client applications. You can find more information through Amazon WorkMail FAQ and how to start with Amazon WorkMail in the links shared below:Amazon WorkMail FAQshttps://aws.amazon.com/workmail/faqs/What Is Amazon WorkMail?https://docs.aws.amazon.com/workmail/latest/userguide/what_is.htmlThank you!CommentShareAWS-User-4590409answered 4 years ago"


Question: "Oracle Standard Edition 2 v19, License included, non-cdb to 21 CDB?"

"Considering the end of support is 2024, how will the migration process go?I don't see an option to create v21 database for license included versions.FollowComment"

Answer: "0Amazon RDS supports Oracle Database 21c, which includes Oracle Enterprise Edition and Oracle Standard Edition Two and it supports only the multi tenant architecture.you must choose Amazon RDS with Multi tenant architecture while creating database and then you will see Oracle Standard Edition Two, license included option with 21c.RDS for Oracle major versions remain available at least until the end of support date for the corresponding Oracle Database release version.Before we ask that you upgrade to a newer major version and to help you plan, we provide a reminder at least 12 months in advance.We do so to communicate the detailed upgrade process.If Amazon extends support for an RDS for Oracle version for longer than originally stated, we plan to update the table to reflect the later date which can verified at:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Oracle.Overview.htmlCommentSharejaveedwm-awsanswered 4 months ago"


Question: Simple browse/search into CloudTrail events

"Hi,CloudTrail events are often very useful to find issues with IAM permissions and other things but it's impossible browse and search easily using console.I'm an old-style sysadmin and I'd like to look and "grep" into them as text files.I'd liek to search for all "errors" or "all IAM access denied".Is there some simple tool?FollowComment"

Answer: "0I find Athena the best way to query CloudTrail logs. See the AWS Docs for how to set this up from the CloudTrail console: https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html#create-cloudtrail-table-ctCommentSharePeter Graingeranswered 2 months agorePost-User-7835478 2 months agoI will try but I'm more comfortable with CLI tools, like AWS CLI, jq, grep, etcShare0If you are also outputting CloudTrail logs to cloudwatch logs, you can use log insights to search in a similar way to grep.fields @timestamp, @message, @logStream, @log| filter @message like /AccessDenied/| sort @timestamp desc| limit 20CommentShareGary Mcleananswered 2 months ago0Search only errors and output only chosen fields:aws cloudtrail lookup-events --output text --region eu-central-1 --start-time 2023-03-21T09:00Z --end-time 2023-03-21T10:00Z --query 'Events[].CloudTrailEvent' | jq -r ' . | select(.errorCode != null) | [.eventTime,.eventID,.eventName,.errorCode,.errorMessage] | @csv'in a fixed time interval.CommentSharerePost-User-7835478answered 2 months ago"


Question: What is the average AFI load time for an F1 instance?

Can I have an estimated load time when loading an already generated AFI into a FPGA slot on an F1 instance?I see that the load time can be decreased through caching and data retention. I have read the article found below but there is no mention of an average load time. Is it seconds? Minutes?https://github.com/aws/aws-fpga/blob/master/hdk/docs/load_times.md>FollowComment

Answer: "0Hello,Documentation you shared is a generic document discussing the techniques to reduce AFI load times irrespective of any instance type, based on the instance specification load time may differ that's why no exact values/units are mentioned.If you implement those techniques on an specific F1 instance type, AFI load time should comparatively reduce post implementation of mentioned techniques. There are multiple considerations which you need to keep in mind while testing the load time (as mentioned in shared document), so exact values can only be found out by doing a performance benchmark using those techniques.CommentShareSUPPORT ENGINEERrePost-User-2272573answered 7 days ago"


Question: EB-Cli SSH Tunnel to RDS Database

"I am trying to follow this http://medium.com/@michalisantoniou6/connect-to-an-aws-rds-using-an-ssh-tunnel-22f3bd597924  to setup a ssh tunnel to my rds database via a ec2 instance managed by beanstalk.In particular I want to use this command:ssh -N -L localPort:rdsHost:remotePort user@remoteHost -i ~/path/to/keyHowever, I am using aws-elastic-beanstalk with the eb-cli.The eb cli provides eb -ssh to connect via ssh to an instance.So I tried to achive the same with:eb ssh -e '-N -L localPort:rdsHost:remotePort'from the eb documentation:-e CUSTOM, --custom CUSTOMSpecify an SSH command to use instead of 'ssh -ikeyfile'. Do not include the remote user and hostname.However, this only yields the following output and terminates instead of creating a tunnel.INFO: Attempting to open port 22.INFO: SSH port 22 open.INFO: Running -N -L localPort:rdsHost:remotePort ec2-user@ip-of-instanceIs it possible to create a tunnel with the eb-cli?FollowComment"

Answer: "0RDS does not support ssh to a RDS host.-PhilCommentShareMODERATORphilawsanswered 4 years ago0Hello Phil,I'm not talking about direct ssh access but via a tunnel from an ec2 instance managed by beanstalk with the eb-cli.And yes, it is possible:  https://superuser.com/a/1425910/1012383Here the solution is given, maybe you should consider updating the documentation of the eb-cli.Best regardsOskarCommentShareohlranswered 4 years ago0As Phil said, you can’t SSH into an RDS host. You can port forward using  SSH Tunneling via an EC2 host as an alternative to opening up an internet-accessible port to your RDS instance. In that case RDS isn’t participating in SSH at all it just sees a normal connect on its regular port from within the VPC.Although I’ve never tried to follow the instructions, here is another good article on using SSH Tunneling to connect to RDS https://medium.com/@deepspaceprog/how-to-connect-via-ssh-to-an-amazon-rds-instance-running-postgresql-5e7661cdd37eCommentShareHalTempanswered 4 years ago"


Question: SSM agent failing on Fargate with ecs exec

I reported this on the forums before and I don't really have the energy to repost everything again. Please work on your GitHub issue: https://github.com/aws/amazon-ssm-agent/issues/361FollowComment

Answer: "0re:Post is not a replacement of Github.You might have created issues in the wrong repo as it does not seem to be an issue with SSM agent (which works per discussion).While the issue might be for the Fargate Agent, please do create an issue in the ecs agent repo for now.CommentShareJason_Sanswered a year ago"


Question: S-to-S VPN comes up but no connectivity for exactly one hour

We have a Site to Site VPN setup though a Virtual Private Gateway. Everything works great but if we make changes that cause the tunnel to re-negotiate it will take exactly one hour before any of our endpoints can connect. We see traffic going to AWS but not coming back. Then after one hour everything works perfectly. We used all the defaults on the IPSec settings. do you have any idea what settings could be causing this or what diagnostics we should run? We are Using Cisco ASA on our Datacenter side for the connection to AWS.FollowComment

Answer: "1Hi GregL,Thanks for your question.Let me start with some information regarding AWS S2S VPN - AWS VPN is Route-Based solution  [1] and it supports single IPSec Security Associations(SA) for Policy-based implementation. So if you are implementing policy-based VPN on your Customer Gateway(CGW) configuration you will need to limit the SA to be single SA, otherwise there will be connectivity issues. You can also find the related information from AWS VPN FAQs page here [2].Your explanation of the current behaviour is highly likely to be related to multiple SAs for policy-based VPN implementation on your CGW device(Cisco ASA). The policy-based configuration is most likely to be multi-entry extended ACLs for example like below:Allow ip on-prem-subnet-1 VPC-CIDRAllow ip on-prem-subnet-2  VPC-CIDR and etcIn the above configuration each line from the extended ACL generates separate IPSec SA for communication over the Tunnels, hence to avoid this multiple SA scenario try to summarize the on-prem subnets into single or use 0.0.0.0/0 for on-prem network and control the traffic with routing. This way you can ensure to create single IPSec SA and to avoid intermittent connectivity issues from your on-prem subnets.Hope this helps and looking forward to your feedback!ThanksCommentShareSUPPORT ENGINEERMunkhbat_Tanswered a year ago"


Question: Number of views a stored video gets

"HelloWe have a video file stored on AWS, is it possible to know how many views the video had?ThanksFollowComment"

Answer: "1Hello and thanks for using AWS re:Post.If your video is stored in S3, you may enable data events for your S3 bucket to track object-level S3 actions. Once enabled, object-level API calls are logged as CloudTrail events. The primary object level API call you can index would be GetObject. While this action isn't equivalent to views, it does confirm the number of times the object (video) was requested. You can additionally track the time, source IP and User Agent attributed to the video request. When enabled, CloudTrail will place the logged events as JSON objects in your S3 bucket. The most efficient way to query the collected CloudTrail data is to use Amazon Athena to index and query the CloudTrail logs.Additional References:Amazon S3 CloudTrail Events |Enable CloudTrail event logging fo S3 |Logging Data Events |Logging options for S3CommentShareAdriananswered 10 months agorePost-User-6500376 10 months agoThank you very much for the answer, Adrian.Could you give me a bit of guidance on how to do this or where to learn how to do it because I really didn't understand the technical instructions :-(ThanksSamShare"


Question: MSK serverless with connectors

Does MSK Serverless behave/connect same way with connectors as provisioned does?FollowComment

Answer: 0Could you please elaborate your question?A little more context would help address your query better.CommentShareSUPPORT ENGINEERLovetesh_Canswered 2 months ago


Question: Automating data updates on Quicksight

"Hello,I have multiple different CSV files that I receive via email, on a day to day basis.I would like to build a pipeline to ensure that any datasets that I receive through emails, canbe picked up by Quicksight automatically and all the updates are done without much intervention.As a result I thought of the following:Update all the CSVs (from email) I get each day, into S3 Buckets.Point the S3 buckets to AWS Athena.Quicksight will use Athena to do automatic visual updates.For this to work, I will have to ensure that the data manipulation is done outside AWS, and then manually update CSVs inside S3 buckets on my own, each day.Another alternative idea is the following:Place all data into S3 Buckets.Use Glue data brew to manipulate data.Store it back to S3 buckets.Use Quicksight to visualise data (pointing it back to S3 buckets).Can someone please advise of a better method than this ? I am looking for more automation and easier methods of manipulating data for Quicksight to update each day.My data columns don't change, but new date fields and values are added each day.FollowComment"

Answer: "0Hi, @DineshI understand that you want to automate the following three things.Importing data into the lakeProcessing of intermediate dataDrawingis not mentioned in detail, so ignore it.can be realized by using the automatic update function of SPICE.Before doing 1), you need to sort out where all your data comes from and how you can get it. In many cases it can be automated with Glue or Lambda / Step Functions.CommentShareEXPERTiwasaanswered a year ago"