Question: Mute all functionality in aws chime javascript sdk

Hi we want the presenter who is presenting the meeting can mute all the other attendees in aws chime we are using aws chime sdk javascript for the client side we want this feature as is there functionality where we can get all the  attendee's meeting session and we mute every attendees audio.FollowComment

Answer: "0Hi, I have the same question. I tried to find any info in the documentation on how my Admin can mute all other attendees, but no luck. Has someone managed to do that in javascript?CommentSharevzavozovaanswered 3 years ago0Yes I did it by myself you just have to use the function. The way I did it by passing the mute to all except to self and you can only show the mute button to admin basically who is the first joinee. And for the rest you don't show that. The messages that I recieved from AWS are this you can see that I am quoting it below:"I believe Doug was explaining that you could use the data messages channel (https://aws.github.io/amazon-chime-sdk-js/modules/apioverview.html#9-send-and-receive-data-messages-optional) to inform the client (the front-end application) that they are to be muted. Based on the receipt of the message, the front end application would trigger the mute/unmute capability (https://aws.github.io/amazon-chime-sdk-js/modules/apioverview.html#6-mute-and-unmute-microphone-audio-with-the-real-time-api) on the client to control the mute state."The way I did it, I created a topic named 'muteAll' which is like pub sub model working here then I have subsrcibed to it when I recieve the message which is the admin pressing the muteall button then on the basis of that I mute all the attendees basically every attendee is subsribed to this message it is the same way how the messages are working here for the people who are typing. So I am sharing the code below for that but if  you want the full code with this functionality I can definetly share with you feel free to contact me himanshu.bhatt@oodlestechnologies.com.dataMessageMuteAllHandler(dataMessage: DataMessage): void {if (!dataMessage.throttled) {const isSelf = dataMessage.senderAttendeeId === this.meetingSession.configuration.credentials.attendeeId;if(isSelf){console.log("self Not Mute");}else{console.log("Other clients Muted")this.meetingSession.audioVideo.realtimeMuteLocalAudio();}} else {    this.log('Message is throttled. Please resend');  }  }const buttonMuteAll = document.getElementById('button-mute');buttonMuteAll.addEventListener('mousedown', async _e => {if (this.toggleButton('button-mute')) {console.log('buttonMuteAll unmute');this.audioVideo.realtimeSendDataMessage(DemoMeetingApp.DATA_MESSAGE_TOPIC_MUTE, "muteAll", DemoMeetingApp.DATA_MESSAGE_LIFETIME_MS);this.dataMessageMuteAllHandler(new DataMessage(Date.now(),DemoMeetingApp.DATA_MESSAGE_TOPIC_MUTE,new TextEncoder().encode("muteAll"),this.meetingSession.configuration.credentials.attendeeId,this.meetingSession.configuration.credentials.externalUserId));}});CommentSharehimanshubhattanswered 3 years ago0Thanks a lot! You really helped me! I will try to implement this solution.Edited by: vzavozova on Oct 29, 2020 2:23 AMCommentSharevzavozovaanswered 3 years ago"


Question: [EC2 Windows] Move MAC address across AZs

"My (Windows) application relies on license keys linked to MAC addresses. Getting a license key assigned to a new MAC address is a hassle, I need to request the vendor to do this manually. I use ENI to retain the MAC address of the (on-demand) EC2 instance when it's stopped / terminated. Based on the documentation, I understand an ENI is linked to a specific subnet and hence cannot be moved across AZs. This limits my flexibility in moving instances across AZs, e.g. when encountering (last minute) capacity issues in a given AZ.Is there any way to migrate the MAC address across AZs?FollowComment"

Answer: 4There is no way to migrate MAC addresses between Availability Zones for the reason that you've listed: ENIs are tied to the AZ; MAC addresses are assigned to the ENI.CommentShareEXPERTBrettski-AWSanswered a year ago


Question: AWS_Certification - Last name update

"Hi, I have AWS Cloud Practitioner exam on 25th June. I registered with following details:Candidate:Rohit Kumar LnuCandidate ID:AWS02815003Registration ID:424455729Kindly Update my last name to . as blank is not allowed and I don't have a last name on my ID. My name should be "Rohit Kumar ." after correction. ThanksFollowComment"

Answer: 0I was able to update your name. Please log into your AWS Certification account at aws.training/certification to confirm.Best of luck on your exam!KimAWS CertificationCommentShareKimWD-AWSanswered a year ago


Question: Free Trial of Lightsail Instance

"I made a 10-dollar-per-month Lightsail instance on the 13th of December 2022, and this is the only Lightsail instance that I have created ever.As you can see in the image, It says the instance is free for the first 3 months.Will my free trial continue until the 13th of March, or it will end at the end of February?When the 3-month trial of this 10-dollar instance ends, will I again have 3 months free for 3.5-dollar and 5-dollar instances available?FollowComment"

Answer: 0My Free trial ended in 13th of March and I cannot use any instance within any region for free.CommentSharerePost-User-3123013answered 2 months ago


Question: Prices returned via API

"Reading an offer file (JSON format), returned by Price List Bulk API, (for example from this index file https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/eu-south-1/index.json) I noticed that some prices for AmazonEC2 are 0.0 USD. Does it mean that those offers are free of charge?Thanks in advance for any suggestion.FollowComment"

Answer: "0Hello,The 0.0 USD you are seeing are related to Reserved Instances purchases with an All Upfront purchase option:Those are under the "reserved" termType."X.Y" : {          "offerTermCode" : "Y",          "sku" : "X",          "effectiveDate" : "2022-07-01T00:00:00Z",          "priceDimensions" : {            "X.Y.2TG2D8R56U" : {              "rateCode" : "X.Y.Z",              "description" : "Upfront Fee",              "unit" : "Quantity",              "pricePerUnit" : {                "USD" : "1544" <---- The Upfront free              },              "appliesTo" : [ ]            },            "X.Y.W" : {              "rateCode" : "x.y.z",              "description" : "USD 0.0 per Linux/UNIX (Amazon VPC), m6i.large **reserved instance** applied",              "beginRange" : "0",              "endRange" : "Inf",              "unit" : "Hrs",              "pricePerUnit" : {                "USD" : "0.0000000000" <---- $0.0 due to the PurchaseOption              },              "appliesTo" : [ ]            }          },          "termAttributes" : {            "LeaseContractLength" : "3yr",            "OfferingClass" : "convertible",            "PurchaseOption" : "All Upfront"  <---- PurchaseOption is specified here          }        },Generally, you are charged for the reservations and not the instances.Other $0.0 could also be related to dedicated hosts for which you pay for the host and not the instance. For the below, the m6i.12xlarge is paid for by the host purchase instead.$0.00 per RHEL with HA and SQL Standard m6i.12xlarge Dedicated Host Instance hourSome information about the model can be found here:https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/reading-an-offer.html#offer-term-typeRegards,JonCommentShareEXPERTJonathan_Danswered 2 months agoEXPERTalatechreviewed 2 months agoAngelo 2 months agoI understand that for dedicated host the price is $0.00, but how is it possible, via API, to retrieve the "true" price?ThanksShareJonathan_D EXPERT2 months agoCheck the productFamily "productFamily" : "Dedicated Host" or the tenancy you want "tenancy" : "Dedicated". Use that sku or the instancesSku respectively to find the associated terms options "2C9BXFWJ4WH2RZTF" : {      "sku" : "2C9BXFWJ4WH2RZTF",      "productFamily" : "Dedicated Host",Share"


Question: How to Integrate a Kinesis Data Analytics Flink Application with a Self-Managed Kafka Cluster Running on Amazon EC2 (not Amazon MSK)?

"I am interested to build a real time application with data residing on their Kafka cluster. The Kafka is running on AWS, using K8S not using MSK. What are the step required to integrate Kinesis Data Analytics Flink application with their Kafka cluster?FollowComment"

Answer: "0Accepted AnswerIt's fairly similar to reading from Amazon MSK. Consuming data from Kafka (or Amazon MSK) with Kinesis Data Analytics (KDA) basically means establishing network connectivity between brokers and task managers. With KDA you can enable VPC support so that the ENIs of the task managers are exposed in the subnets you have specified. If you then configure security groups of the ENIs correctly, your Flink app should be able to connect to the Kafka brokers. See the following references:https://docs.aws.amazon.com/kinesisanalytics/latest/java/vpc.htmlhttps://docs.aws.amazon.com/kinesisanalytics/latest/java/example-msk.htmlCommentShareSteffen Hausmannanswered 3 years ago"


Question: How to enable automated data labeling for custom labeling job?

"Hi,I need to label large dataset which has around 200000 records and this doesn't fall into any of the prebuilt labeling job categories. So trying to create custom labeling job with automated data labeling enabled. But the configuration to enable the automated data labeling doesn't appear for custom labelling job. Any reference to proceed further asap would be of great help. Thank you.FollowComment"

Answer: "0Hi there. I'm an engineer at AWS.Automatic data labeling is only available for the first-party workflows: Image Classification, Text Classification, and Object Detection. As an alternative, you might consider orchestrating a series of labeling jobs with an intermediate step in which you train a machine learning model and perform inference to carry out an auto labeling step. We have a blog post that describes this "active learning" process to give you some ideas as to how you might accomplish this (https://aws.amazon.com/blogs/machine-learning/annotate-data-for-less-with-amazon-sagemaker-ground-truth-and-automated-data-labeling/).Thank you for being a valued customer and for bringing this feature request to our attention.CommentShareAWS-User-5907386answered 4 years ago"


Question: How to use CloudWatch after Control Tower version 3.0 update

"We have a multi-account setup where we deployed an organizational-level CloudTrail in our root account's Control Tower.For the newest version of the Control Tower (3.0), AWS introduced Organizational-level CloudTrail, this service deploys a baseline CloudTrail in each of our respective accounts and provides them the ability to send logs to a central CloudWatch location in our Root account and to a central S3 location in our logging account.We have concerns regarding providing access to the root account just to be able to view the centralized CloudWatch logs.I have tried setting up Athena in our Logging account so that our team can view the logs in our logging bucket, but that feels like I'm taking an unnecessary detour.What is the best way to still be able to access the root account's CloudWatch logs without having to be in the root account?Any advice would be appreciated!Thanks in advance!FollowComment"

Answer: "0Instead of using the root account (management account), you can add a delegated administrator to manage an organization's CloudTrail resources.For more details, please refers to the documentation at:  https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-add-delegated-administrator.htmlCommentShareronald_lanswered 4 months ago"


Question: Annotations in EKS services for creating network load balancers

"I am trying to expose my kubernetes resources using a LoadBalancer service type. As such I have deployed the AWS Load Balancer Controller beforehand. Now when I create a LoadBalancer service, I see a Network Load Balancer getting created in AWS, which is just fine. But looking at the docs at https://docs.aws.amazon.com/eks/latest/userguide/network-load-balancing.html#network-load-balancer, its talking about adding the following annotations to the service resourceservice.beta.kubernetes.io/aws-load-balancer-type: "external"service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "instance"Now, this kind of seems redundant to me as I already have a Network Load Balancer with instance targets without adding any annotations to the k8s service. Thus, I am confused. Are the above annotations values just defaults? Do I need to provide these annotations mandatorily?EDIT:I can see from https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/service/annotations/#annotations that service.beta.kubernetes.io/aws-load-balancer-nlb-target-type has a default of instance but no defaults for service.beta.kubernetes.io/aws-load-balancer-type. So, that answers 1 part of my question.FollowComment"

Answer: "0Accepted AnswerHi Sayak,To answer your question, let's see the history of why the annotation service.beta.kubernetes.io/aws-load-balancer-type: external came into being.There are essentially two main Kubernetes controllers available to manage AWS Load Balancers instances:The legacy Kubernetes "Cloud Controller Manager",  i.e. AWS cloud provider load balancer controllerThe new recommended "AWS Load Balancer Controller".The legacy controller for aws until recently had it's code in the Kubernetes repository but I can see this commit which seems to have removed it (Looks like it is being packaged in v1.28.0-alpha.0 release).The legacy controller used to create the Classic Load Balancers by default and then later fortified to also support Network Load Balancers. Later to support more customisations, the new recommended "AWS Load Balancer Controller" was introduced.While both legacy cloud controller manager and aws load balancer controller were working together in the cluster, the annotation service.beta.kubernetes.io/aws-load-balancer-type: external was required. If the value of the annotation is set to external, the load balancer will be created by the new "AWS Load Balancer Controller".So while not using the annotation service.beta.kubernetes.io/aws-load-balancer-type: external with other appropriate annotations will still create the Network Load Balancer for you but it will be created using the legacy AWS cloud provider load balancer controller and not the recommended "AWS Load Balancer Controller". The issues you will face is that the legacy provider is in deprecated mode and hence will not receive any new features and also it is due to be removed all together.Hopefully, this answers your question.CommentShareManish Joshianswered 20 days agoSayak 18 days agoAccepting this answer but I it seemed to me like my service was using the recommended "AWS Load Balancer Controller" when a LoadBalancer service was created without the annotation. And I think I have figured it out. There is a MutatingWebhookConfig aws-load-balancer-webhook that can mutate all LoadBalancer services and add loadBalancerClass: service.k8s.aws/nlb to them. And I feel like this is why the new controller is getting used. Do you think this is a correct observation? Here's where I got the info https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/5317c4156c213184c2ba0d6a67cd8ba9206925d9/helm/aws-load-balancer-controller/values.yaml#L352ShareManish Joshi 16 days agoHi Sayak, Yes, you are correct! This webhook seems to be added very recently on 6th April 2023 using this PR https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3139Share"


Question: Seeding of a Elasticache cluster in another account in another region

"Giving an example : Let's say I am in AWS region A , in AWS Account AA & have a Elasticache cluster ECA. And I export the backup of ECA to S3 bucket SBA. Now in another region B, if I have an account AB and Elasticache ECB, would ECB be able to read from SBA (s3 bucket of first account )?FollowComment"

Answer: "0If I understand your question, you want to provide access from account AB into the S3 bucket of account AA, correct?You can follow this guide to set up cross account S3 access: https://aws.amazon.com/premiumsupport/knowledge-center/cross-account-access-s3/ .If you have done this already, and these instructions are not solving your problem, please provide more details, error messages, and such.CommentShareByron_Ganswered a year agoAWS-User-7641481 a year agoThank you Byron. I have exported a ElastiCache cluster backup (backupEC.rdb file) to S3-bucket-in-AccA . I have then added bucket policy for useraccB as principal  for this bucket S3-bucket-in-AccA. Now I login to AccB as useraccB and try to seed a ElastiCache cluster with backupEC.rdb file. But my Elastic cluster is not getting created. I am not seeing any error messages except Create_Failed in ElastiCache console. So more than account access, I am trying to ask if ElastiCache cluster in an account can be seeded from a backup in another Account assuming we have right policies attached for the user to S3 bucket. Hope it clarifies a bit more.Share"


Question: InternalServerError with SageMaker Batch transform job

"We have a few thousand models on SageMaker backed by our own containers on ECR. We have a problem with one of the models that when we start a Batch transform job with it the job is pending, then after ~20 minutes the job is marked as failed with "InternalServerError: We encountered an internal error. Please try again.". Attempting the job again didn't help. Is there any way to debug this?The models execution role, container, security group and subnets are set correctly. The containers are all in the same repo which the execution role has permission to access. The container image is ~3GB, but is definitely not the largest one that we have run, and all our other models run fine with the same job parameters.FollowCommentMarc 10 months agoI suggest reaching out to Support and creating a Support Case.Share"


Question: How do I link my Amazon Connect instance to a Lambda function outside the contact flow with automation

"I'm using terraform to deploy an Amazon Connect instance. I'm able to import a previously made contact flow, which works for everything except the AWS Lambda function that we invoke.Importing the contact flow correctly imports with the full ARN of the lambda function, but it doesn't actually work until I manually select the lambda function on the Instance > Contact Flows page, eg: https://i.imgur.com/Vrcu6x6.pngFollowing this, inside my contact flow I then have to change my full lambda ARN to the one provided in the dropdown list, which will now be just the "function arn" in that screenshot, not the full ARN.Is there a way of automating this at all?ThanksFollowComment"

Answer: "0Hello,Since Terraform is a 3rd party infrastructure as code tool I wouldn’t be able to advise much on its usage in this particular scenario unfortunately.As far as automating it outside of Terraform, a strategy I use is to view all the available APIs for a service using the AWS CLI documentation, searching for the step-by-step APIs that would complete the goal, and if they exist you can then create a script. If the APIs don't exist to complete your goal then you'll have to stick with your current process.CommentShareSUPPORT ENGINEERTim_Panswered a year ago"


Question: How to use an Augmented Manifest File for AWS SageMaker Ground Truth?

"Hey,I'm trying to use Ground Truth to do image classification but with a different set of label options for each image. I have the custom labeling task template and pre-/post-labeling Lambda functions set up and I figured I could pass in the labels through the manifest file.My issue is that the Ground Truth job ignores the attributes in the manifest file that are not "source-ref" (or "source"). This causes the pre-processing Lambda function to fail because the request it is passed only contains the "source-ref" attribute, but the Lambda function also references a different attribute. Are augmented manifest files supported for Ground Truth and if they are, how can I make use of the extra attributes?References:Ground Truth Input Data: https://docs.aws.amazon.com/sagemaker/latest/dg/sms-data-input.htmlSageMaker Augmented Manifest Files: https://docs.aws.amazon.com/sagemaker/latest/dg/augmented-manifest.htmlExample:A normal Ground Truth manifest file:{"source-ref":"s3://some_bucket/images/img1.png"}{"source-ref":"s3://some_bucket/images/img2.png"}...What I want to be able to use:{"source-ref":"s3://some_bucket/images/img1.png","labels":["pen","pencil","stick"]}{"source-ref":"s3://some_bucket/images/img2.png","labels":["tv","laptop","phone"]}...FollowComment"

Answer: "0Accepted AnswerHi sageuser, I'm an engineer at AWS. Augmented manifests are not supported for custom workflows, and so it is not possible to pass through additional parameters, e.g., "labels" in your example. We appreciate that you are using the service and welcome customer feedback. We can always be reached at https://aws.amazon.com/contact-us/.CommentShareAWS-User-5907386answered 4 years agoLorenzo 5 days agoIs there any update on this?Share"


Question: AppRunner + two DB Instances (RDS)

"Hello, I have some question about configuration App Runner Service.I have two DB instances (eg. Oracle and PostgreSQL) and I wonder if I can configure App Runner so that my Web API connects to the specified base by entering environment variables ([Key][Value]) during configuration? Without interfering with the code itself. I would like to apply one universal Docker image to several App Runner services.EG.App Runner (Key: Oracle, Value: Oracle ConnectionStrings) -> My universal Docker Image -> Oracle DBApp Runner (Key: PostgreSQL, Value: PostgreSQL ConnectionStrings) -> My universal Docker Image -> PostgreSQL DBFollowComment"

Answer: "1Hello,Have you considered using environment variables (under Env)?Another pattern, though not specifically relating to App Runner, is to have a configuration service / API that returns endpoints dynamically.CommentShareJason_Sanswered a year ago"


Question: Call Routing agent

"Hi TeamIs it possible to find out which agent the call would be routered ?I would like to perform the customer whisper like, before routing to the agent -> Find the agent -> Play Promt "Thank you for calling ABC, I am Superman How can I assist you?" -> Then agent picks up the call.Would this be possible in anyway?Kind regardsPragashFollowComment"

Answer: "1In your customer whisper flow you can use text-to-speech in your play prompt block, set the text to "Thank you for calling ABC, I am $.Agent.FirstName How can I assist you?" and that will do what you are after.CommentShareledgeanswered a year agoPragash Venugopal a year agoHi LedgeThank you for your reply and time.I created a seperate customer whisperflow in contact flow, then on my main script I called that seperate flow using set whisper flow  but it did not work as expected. Anywhere I am making any mistakeMy Main contact flowPress 1 for English -> set working queue -> set whisper flow (Customer)My customer whisper flow scriptStart -> get queue matrix -> Play promt (Thank you for calling ABC, I am $.Agent.FirstName How can I assist you?)Shareledge 10 months agoI just tested and this works fine for me. Not sure why you have a get Queue Metrics block, but it shouldn't make any difference. You'll need to make sure logging is enabled and check your cloudwatch logs to see what is going on in your instance.Share0Hi dmaciasThe real plan is to record each and every agent voice clip and play the voice prompt according to the agent who answeres the phone, this would reduce the AHT in the contact enter who are SLA concern Contact centers. We can do that on Cisco, I am checking whether we could achive the same on Amazon Connect.CommentSharePragash Venugopalanswered a year agodmacias 10 months agoYeah how Cisco does it is nice. I'm curious if you're building all the infrastructure to maintain this information up to date or are you doing it manually? Agent needs a recording, recording needs to be saved, etc.Share0I personally think this is a terrible customer experience. The greeting should be in the agent's voice and not in an automated voice. This is going to be awkward as most of us are used to hearing a hello from a human in order to prompt us to speak.CommentSharedmaciasanswered a year ago"


Question: Create Lambda proxy integration inside a non-root resource in API Gateway using AWS SDK with C#

"I am trying to create a proxy integration for Lambda invocation from API Gateway for a specific route (example.com/auth/{proxy+}, example.com/user/{proxy+}, etc..).I am creating a script for automated infrastructure initialization and deployment (without using CloudFormation, Terraform, etc.) directly from the .NET script that is planned to be available as an API.The predefined infrastructure contains Route53 config, created API Gateway with custom domain. The dynamic infrastructure contains S3 and Lambda together with API Gateway modifications and deployment.Once the bucket for a new service is created and the built app is pushed to the bucket, a new Lambda function is created, configured and published. The last thing that is left is to create a new resource (route) that will invoke the underlying Lambda function and its underlying routes (e.g. example.com/auth/register).The issue is that when I create an integration on a non-root resource, the Lambda function cannot be found or the Uri is not specified as it should be (this is something I am trying to figure out).Here is the simplified code that I wrote to accomplish this (I will exclude the Lambda function and S3 bucket created and show only API gateway and Lambda resource policy updates as they are relevant here). Important to note is that this code produces the same results as if it were done via the AWS console. Also, this code creates a working solution if the route is not specified (e.g. example.com/register)var functionArn = await Lambda.GetFunctionArn(accessKey, secretKey, region, lambdaFunction);var pathResponse = await c.CreateResourceAsync(new CreateResourceRequest{    ParentId = rootId,    PathPart = path,    RestApiId = apiId});await c.PutMethodAsync(new PutMethodRequest{    AuthorizationType = "NONE",    HttpMethod = "ANY",    ResourceId = pathResponse.Id,    RestApiId = apiId});var proxyResponse = await c.CreateResourceAsync(new CreateResourceRequest{    ParentId = pathResponse.Id,    PathPart = "{proxy+}",    RestApiId = apiId});await c.PutMethodAsync(new PutMethodRequest{    AuthorizationType = "NONE",    HttpMethod = "ANY",    ResourceId = proxyResponse.Id,    RestApiId = apiId});await Lambda.AddPermissions(account, accessKey, secretKey, region, lambdaFunction, apiId, path);await c.PutIntegrationAsync(new PutIntegrationRequest{    HttpMethod = "ANY",    IntegrationHttpMethod = "POST",    ResourceId = pathResponse.Id,    RestApiId = apiId,    PassthroughBehavior = "WHEN_NO_MATCH",    Type = IntegrationType.AWS_PROXY,    Uri = $"arn:aws:apigateway:{region}:lambda:path/2015-03-31/functions/{functionArn}/invocations"});await c.PutIntegrationAsync(new PutIntegrationRequest{    HttpMethod = "ANY",    IntegrationHttpMethod = "POST",    ResourceId = proxyResponse.Id,    RestApiId = apiId,    PassthroughBehavior = "WHEN_NO_MATCH",    Type = IntegrationType.AWS_PROXY,    Uri = $"arn:aws:apigateway:{region}:lambda:path/2015-03-31/functions/{functionArn}/invocations"});var deployment = await c.CreateDeploymentAsync(new CreateDeploymentRequest{    Description = $"API deployment to {environment}",    RestApiId = apiId,    StageName = environment});            return deployment.Id;where Lambda.AddPermissions is as follows:var basePermission = await c.AddPermissionAsync(new AddPermissionRequest{    Action = "lambda:InvokeFunction",    FunctionName = name,    Principal = "apigateway.amazonaws.com",    SourceArn = $"arn:aws:execute-api:{region}:{account}:{apiId}/*/*/{path}/*",    StatementId = Guid.NewGuid().ToString()});var proxyPermission = await c.AddPermissionAsync(new AddPermissionRequest{    Action = "lambda:InvokeFunction",    FunctionName = name,    Principal = "apigateway.amazonaws.com",    SourceArn = $"arn:aws:execute-api:{region}:{account}:{apiId}/*/*/{path}",    StatementId = Guid.NewGuid().ToString()});                return new List<string>{    basePermission.Statement,    proxyPermission.Statement};Is there an issue with SourceArn specifications? I first created them through the AWS console (they are automatically created when the integration is created for Lambda) and they are the same.Again, this all works when there is no path (non-root resource).FollowComment"

Answer: "0Hi, @hcerim.Is your Backend Lambda function also .NET?When integrating .NET Lambda and API Gateway, you may integrate with the "/{proxy+}" path and use Amazon.Lambda.AspNetCoreServer to run ASP.NET Core MVC. what is your function using?https://dev.classmethod.jp/articles/api-gateway-lambda-net-6-minimal-api/ (for Japanese sorry, pls translate.)CommentShareEXPERTiwasaanswered 3 months agohcerim 3 months agoHi, that is exactly what I am doing. Again, there is no issue with the setup on a root resource. It only occurs when I create the integration on a non-root resource (e.g. /somePath/{proxy+})Share"


Question: AWS SDK PHP on S3 can't make a request using the web-browser

"Hi there, I am a newbie and currently learning how to implement AWS SDK PHP for S3.I have already installed composer and php on my EC2.I have a simple php page on my EC2.The workaround is, that when somebody from the Internet, requests my page => example.com/listbucket.phpIt should print out all the buckets configured in the php page.NOTE: If from my terminal execute, php listbucket.php i get the successful result and I can see all the buckets. So the S3Client is working right.Here's the code from listbucket.php---------------------------------------$credentials = new Aws\Credentials\Credentials('123','123');$s3Client = new Aws\S3\S3Client(['version'     => 'latest','region'      => 'eu-west-1','credentials' => $credentials,]);//Listing all S3 Bucket$buckets = $s3Client->listBuckets();foreach ($buckets [ 'Buckets' ] as $bucket) {echo $bucket [ 'Name' ] . "\n";}---------------------------------------The code works right but if I enable on the S3Client the debug => true , when I access listbucket.php from the browser It stops executing at the signin process.-> Entering step sign, name 'signer'------------------------------------request.instance changed from 000000002056d0a7000000002d0e7df3 to 000000002056d0d1000000002d0e7df3request.headers.x-amz-content-sha256 was set to array(1) {[0]=>string(64) "64BIT-STRING"}request.headers.X-Amz-Date was set to array(1) {[0]=>string(16) "20210415T144734Z"}request.headers.Authorization was set to array(1) {[0]=>string(211) "AWS4-HMAC-SHA256 Credential=[KEY]/20210415/eu-west-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=[SIGNATURE]}---------------------------------------It seems like when using the browser, I can't get the signin to work but when done from the terminal/cli from my EC2 instance it works!How strange?NOTE: I tried turning all the buckets accessible from everywhere and NOP!NOTE: What I would like to achieve is printing out all the buckets when someone requests my page listbuckets.php.Many, many thanks If you read everything!!:)Edited by: learner33 on Apr 15, 2021 10:04 AMEdited by: learner33 on Apr 15, 2021 10:05 AMEdited by: learner33 on Apr 15, 2021 10:07 AMFollowComment"

Answer: 0You need to create a pre-signed url.CommentSharelearner33answered 2 years ago


Question: AWS S3 behavior when both transition and expiration is present

"I read multiple documents in case when both expiration and transition is present in same rule.This link says below 2 somewhat different things:Example 4 in link: Transition takes precedence over creation of delete markers.Example 4 in link: If an object has both tags, then Amazon S3 has to decide which rule to follow. In this case, Amazon S3 expires the object 14 days after creation. The object is removed, and therefore the transition action does not apply.Also other docs mention that "Glacier has 90 days minimum storage duration"I configured lifecycle policy on a "versioned bucket". I added single rule with expiration (current version) and transition policy (current version):Transition the latest version of objects to Glacier Flexible Retrieval (formerly Glacier) after 10 days of object creation.Delete (create Delete Marker since bucket is version enabled) the current version of object after 15 days of object creation.I want to understand AWS S3 behavior for above configuration. Will it"change object's storage class to Glacier after 10 days" and later "delete the object (add delete marker) after 15 days" ?or will it "change object's storage class to Glacier after 10 days" and after 90 days "delete the object (add delete marker)" ?or something else ?FollowComment"

Answer: "1As reflected in the screenshot provided, it would "change object's storage class to Glacier after 10 days" and later "delete the object (add delete marker) after 15 days".The part about "Glacier has 90 days minimum storage duration" applies to pricing. Though you are would be able to delete the object from Glacier in 15 days, you would end up paying for the remaining days of minimum storage duration. This info is found in the fine print in the S3 pricing page and the question "How am I charged for deleting objects from Amazon S3 Glacier Flexible Retrieval that are less than 3 months old?" in S3 FAQ.--SydCommentShareSydanswered 9 months ago0Thank you Syd. It turns out "Transition takes precedence over creation of delete markers.Initially it changes storage class to "Glacier". Later it deletes the object (adds DM in case of versioned bucket).CommentShareAWS-User-8108346answered 9 months ago"


Question: How to change dynamically the center of mass

"Seems that the center of mass is linked to mesh pivot and so static.Is there a way to change the center of mass?I'm interested especially on something that also works with no mesh, but using with primitive shapes.Follow"

Answer: "0Accepted Answer@REDACTEDUSERThank you for the question.Although Lumberyard has get mass position Entity.GetCenterofMassPos() in Script binding, we don't currently have set mass position function avialable. That's been said, there is no set function to set center of mass without involving authoring codes. ( in this case is Script binding function, and base line Physic code exploring ) The team is consistently working on improving the Physic system but we don't have ETA for the specific request that you asked.Please let us know your feedback while exploring the solution in your project.Thanks.SharerePost-User-1185412answered 6 years ago0I tryed to change the way shapes calculate inertia tensor, but with no luck as it doesn't really care about what it is set to.SharerePost-User-7621041answered 6 years ago0This will be incredibly important for working on entities with more advanced physics as in most cases the center of mass cannot be coincident with the object origin/pivot, which is critical to certain entities such as vehicles and aircraft. This would seem to be because the object origin/pivot is also the point of rotation and therefore moving the center of mass would necessitate that the point of rotation move as well. I would say this is an absolutely critical feature.Regards,UriahSharerePost-User-2072306answered 6 years ago0Thanks @REDACTEDUSERSharerePost-User-2072306answered 6 years ago0Thanks for this perspective @REDACTEDUSERSharerePost-User-5738838answered 6 years ago"


Question: Trusted Advisor Organizations for multiple organizations

"HiHas anyone had any success deploying the Trusted Advisor Organization (https://catalog.us-east-1.prod.workshops.aws/v2/workshops/b0ebab80-9244-41a7-bcc9-6f9f0ed7fda4/en-US/intro) along with the automated data collection (https://wellarchitectedlabs.com/cost/300_labs/300_optimization_data_collection/3_data_collection_modules/ )?  I've been successful in deploying it to one organization, but I'm curious if anyone has had any success deploying it across multiple organizations and consolidating the results into one QuickSight dashboard.  I'm wondering what approaches folks have taken to deal with multi-orgs.Thanks!FollowComment"

Answer: "0You can drop reports from other payers to the same (central) s3 bucket and TAO dashboard will pick it up. That should be the easiest way.Also check out Cloud Intelligence Dashboards from below link.https://catalog.us-east-1.prod.workshops.aws/v2/workshops/fd889151-38aa-4fe2-a29d-d5fa557197bb/en-US/introCommentShareRK_Sanswered a year agoAWS-User-6816458 a year agoI tried that approach.  When I put all the results in one bucket and rerun my Glue crawler, it creates additional tables.  This prevents QS from displaying the results.  It looks like the schemas are different, which is confusing because I'm deploying the same stack across all my acounts/orgs.ShareFabrizio@AWS EXPERTa year ago@AWS-User-6816458 have you checked the tables schemas? can you confirm they are different?you could try to create a prefix structure by account, and see if the crawler catch it as partitions of the same table.Share0I'm so sorry about that link you have is outdated. Here is the new guide; https://wellarchitectedlabs.com/cost/200_labs/200_cloud_intelligence/trusted-advisor-dashboards/The guide will walk you through how to support multiple payers into the same bucket.CommentShareAaron Edellanswered a year agoAaron Edell a year agoFollow this FAQ on multiple-payer accounts. This is for the CUR but the process is the same. The key is in the Glue crawler setup, making sure to create a single schema for each s3 path. https://wellarchitectedlabs.com/cost/200_labs/200_cloud_intelligence/faq/Share"


Question: Hide x-amzn-errortype in response headers on API Gateway

"Hello,For security purposes, I am trying to make an INVALID_API_KEY response match a 404 response, however I can see that the underlying error type is exposed in the x-amzn-errortype response headerThe reason for doing this is to prevent users without valid authn/authz users from learning which resource routes exist on the API when:they call the API with a missing or invalid API key; orthey are not authorized to access a specific route with their API keyIs this possible? Thanks!FollowComment"

Answer: "0Unfortunately, the header is not customizable in API Gateway. Also, I looked into using CloudFront/Lambda@Edge to modify the header but that header is one of the disallowed headers to modify. Therefore, it is not possible to use Lambda@Edge to modify.For REST API, if a client invokes an API with a non-existing route, they get MissingAuthenticationTokenException. This is returned whether or not a client uses an API key. Also, if a client invokes an API route with an invalid API key, the ForbiddenException error is returned. It does not tell the client that they are using a wrong API key. I don't think either of the above exposes that a client is using a wrong key or wrong route. Also, as you may be doing now, you can customize API error responses with gateway responses so you can use different status code, headers, etc.CommentShareTaka_Manswered 10 months agomattyf 10 months agoUpon further investigation, I find that you don't need to supply a valid API key to expose resource routes for any given API - private or public. This seems to be a security flaw with API Gateway. What is the process to have this addressed ASAP?i.e. if I call the API with an invalid API key (any random generated text) and I hit a Resource Route that exists I get a ForbiddenException error header response. If I hit a Resource Route that does not exist, I get a MissingAuthenticationTokenException error header response.This shows that even with an invalid API key that is garbage text, I am able to discover resource routes on a private API that requires an API Key for all resource routesShare"


Question: AWS EKS supported "container runtimes"

"Hi,Im newbie in container/virtualization technology, but from reading some article i came up with this logic -AWS EKS uses kubernetes, which in its turn, from version 1.24, relies on different "container runtimes" (not only docker), that are "kubernetes compatible", or have CRI implemented.Does it mean, that AWS EKS, does work with different "container runtimes"? have anyone tried using any other "container runtime" with EKS?Thank you.FollowComment"

Answer: "0AWS EKS indeed supports different container runtimes. However, the choice of container runtime depends on the version of Kubernetes in use. For Kubernetes version 1.24 and later clusters, the only container runtime included in the officially published Amazon EKS AMIs is containerd. Earlier versions of Kubernetes use Docker as the default runtime, but they have a bootstrap flag option that you can use to test your workloads on any supported cluster with containerd-11.24and later clusters, officially published Amazon EKS AMIs includecontainerdas the only runtime. Kubernetes versions earlier than1.24use Docker as the default runtime. These versions have a bootstrap flag option that you can use to test out your workloads on any supported cluster withcontainerd. For more information, see Amazon EKS ended support for Dockershim","pub_date":null}}. Starting from Kubernetes version 1.27, Amazon EKS will ignore the --container-runtime argument passed to any bootstrap scripts, and it's recommended not to pass this argument to --kubelet-extra-args in order to prevent errors during the node bootstrap process-1--container-runtimecommand line argument for thekubeletwas removed. The default container runtime for Amazon EKS has been containerd since1.24, which eliminates the need to specify the container runtime. From 1.27onwards, Amazon EKS will ignore the--container-runtimeargument passed to any bootstrap scripts. It is important that you don't pass this argument to--kubelet-extra-argsin order to prevent errors during the node bootstrap process. You must remove the--container-runtime argument from all of your node creation workflows and build scripts","pub_date":null}}.It's important to note that Kubernetes 1.26 no longer supports CRI v1alpha2, which means the kubelet will not register the node if the container runtime doesn't support CRI v1. This effectively means that Kubernetes 1.26 doesn't support containerd minor version 1.5 and earlier. You need to upgrade to containerd version 1.6.0 or later before you upgrade any nodes to Kubernetes 1.26. This also applies to any other container runtimes that only support the v1alpha2-11.26no longer supports CRIv1alpha2. This results in the kubelet no longer registering the node if the container runtime doesn't support CRI v1. This also means that Kubernetes 1.26doesn't support containerd minor version1.5and earlier. If you're using containerd, you need to upgrade to containerd version1.6.0or later before you upgrade any nodes to Kubernetes1.26. You also need to upgrade any other container runtimes that only support the v1alpha2. For more information, defer to the container runtime vendor. By default, Amazon Linux and Bottlerocket AMIs include containerd version 1.6.6","pub_date":null}}`.CommentShareEXPERTsdtslmnanswered 6 days ago"


Question: SES: Most complaints come from Hotmail

"Hello,As daily user of SES, we recently witnessed an increase of complaints.We took actions and implemented mechanisms to reduce this phenomenon, but we keep on looking for ways to avoid complaints as much as possible.And we noticed something strange:95% of complaints come from hotmail.com or outlook.com email addresses.Would there be anything known on your side about this?I found a post on the AWS forum about this trend, confirmed by a few other users:https://forums.aws.amazon.com/message.jspa?messageID=995544We are only looking for ways to improve our sending methods to comply with SES requirements the best we can.Best regards,The Beesbusy Team.FollowComment"

Answer: "1I am having a similar issue, where all my email are going to spam/junk folder for hotmail.com, I will share here in case it can help.I found that my emails sent from SES to outlook/hotmail were always sent to spam/junk folder, the main reason was that I am using configure set tracking open and clicks, where the email body has the awstrack.me link.I did a test removing the configure set tracking open and clicks, then, when the email doesn't have the awstrack.me, the emails were sent to the other tab in hotmail, not send to spam/junk folder.So, it is not a conclusion yet, but seems that emails that are sent with the track (awstrack.me), they are tagged as spam from outlook/hotmail.In my case, I disabled the track open/click config set when the destination is outlook/hotmail.CommentShareRobanswered a year ago0Hello Beesbusy Team!When you create an SES account, emails are sent from IP addresses shared with other SES users.  There are some benefits to leasing dedicated IP addresses exclusively for your use.  This option is good for predictable, continuous, high-volume senders offering full control over sender reputation (https://docs.aws.amazon.com/ses/latest/dg/dedicated-ip.html).  There is an additional monthly cost for dedicated IPs (https://aws.amazon.com/ses/pricing/).Smart Network Data Services, offered through the CloudWatch console is an Outlook program used by IP owners to prevent spam.  This is provided to Amazon SES customers who lease dedicated IPs (https://docs.aws.amazon.com/ses/latest/dg/snds-metrics-dedicated-ips.html) and covers domains such as Hotmail.com, Outlook.com and live.com.Best practice is to monitor your sender reputation, which it sounds like you already do.  There are a host of reputation metrics available in the AWS Console (https://docs.aws.amazon.com/ses/latest/dg/reputationdashboardmessages.html) along with the ability to create monitoring alarms using CloudWatch (https://docs.aws.amazon.com/ses/latest/dg/reputationdashboard-cloudwatch-alarm.html) to keep you on top of your reputation status.Finally, check out this section of AWS documentation for various methods of authentication to prevent email spoofing and spamming (https://docs.aws.amazon.com/ses/latest/dg/email-authentication-methods.html).CommentShareSUPPORT ENGINEERRon_Hanswered a year ago"


Question: Lightsail Port forwarding

"I've written a Windows .exe file which listens using Windows sockets for client connections on port 4897, in order to forward TCP packets between mobile phones to play one of my networked games. It works fine on my Windows laptop, but I have to configure my router to forward the packets on from the router to that specific laptop.I wanted to set the .exe file up on a Windows virtual Lightsail instance instead. I have it up and running, I've set up a static IP address, and I went to to the Networking | Firewall settings and added a rule to allow TCP packets on port 4897. But mobile phones don't seem to be able to connect to the  .exe file still. I'm not sure what I'm doing wrong?FollowComment"

Answer: 0Accepted AnswerAll I needed to do was go into Windows Defender Firewall and select Advanced Settings | Inbound Rules | New Rule | Port and added the port number thereCommentShareSean OConnoranswered 14 days ago


Question: User <dwhuser> is  is not authorized to assume IAM Role while copy from S3

"Hi,I'm trying to grabbing data from S3 and get them into RedshiftDB using COPY command from Python script.I performed the next steps:Created a cluster in us-west-2 region using AWS SDK (Python boto3)Created an IAM role arn:aws:iam::<ID>:role/db_redshift_role with "AmazonS3ReadOnlyAccess" permissions using AWS Management ConsoleAttached the role to the cluster. The role is In-sync StatusIAM -> Accounts Settings -> Region name IS Active%%timeqry = """copy sporting_event_ticket from 's3://udacity-labs/tickets/split/part'     credentials 'aws_iam_role=arn:aws:iam::<ID>:role/db_redshift_role '     gzip delimiter ';' compupdate off region 'us-west-2'"""%sql $qryAnd I got an errorerror:  User arn:aws:redshift:us-west-2:<ID>:dbuser:dwhcluster/dwhuser is not authorized to assume IAM Role arn:aws:iam::<ID>:role/db_redshift_roleI read almost all the topics, but nothing has helped me.Many thanks in advanceEdited by: boobooka on Apr 4, 2020 7:53 AMFollowComment"

Answer: "0Hi!I recreated the cluster, performed all the steps again, waited about ten minutes and than rebooted the cluster. And now it works.It's quite strange, maybe I made a mistake at my first attemptingCommentShareboobookaanswered 3 years ago0Hi boobooka,Are you sure the role you attached to the Redshift cluster is a service role that has the trust relationship with the Redshift cluster?-KurtCommentShareklarsonanswered 3 years ago0Hi boobooka@,Generally below errors come for the following reasons :error: User arn:aws:redshift:us-west-2:<ID>:dbuser:dwhcluster/dwhuser is not authorized to assume IAM Role arn:aws:iam::<ID>:role/db_redshift_roleIf trust relationship gets altered after attaching IAM role to the cluster.IAM Policy has restricted usage to particular db-users only.IAM role is not in-sync with the cluster.Regards,KalyanCommentShareKalyanN-awsanswered 3 years ago"


Question: Does CloudFront support AVIF images?

"Does CloudFront support AVIF images?I have a .avif formatted image, but when I access it via CloudFront, it returns 401, how can I fix this?FollowComment"

Answer: "0Yes, CloudFront supports delivering AVIF images. However, it's important to note that support for AVIF may vary depending on the client's browser and device. Some older browsers may not support AVIF images, while others may not support certain AVIF features.If you're receiving a 401 error when accessing your AVIF image via CloudFront, it's possible that the file is not properly configured for public access. You can check the permissions of the file in your S3 bucket, and make sure that it is set to allow public access. Additionally, you may want to check your CloudFront distribution settings to ensure that it is properly configured to serve files from your S3 bucket.It's also possible that the issue is related to the file format itself. While CloudFront does support delivering AVIF images, it's possible that the file is not correctly formatted, or that it contains errors that are causing it to fail to load. You may want to try opening the file in a different image viewer or editor to confirm that it is properly formatted and can be loaded correctly.My Reproduction:To test this, I have uploaded a Sample AVIF formatted file to my S3 bucket something like this s3://location124/sample.avif then I allowed public access to that file in S3.Then, I went into CloudFront and created a distribution while choosing the Origin domain as the above s3 bucket.Then I tried accessing the file from my browser using the domain name along with the object name and the file was accessible successfully.For example, if the domain name is d111111abcdef8.cloudfront.net and the object is sample.avif, the URL for the link would be: https://d111111abcdef8.cloudfront.net/sample.avifTested using Google Chrome Browser - Version 111.0.5563.146 (Official Build) (arm64)Note: If you find my answer helpful, please reply with your response accepting my answer. Thank you.CommentShareNIHAR-AWSanswered 2 months agoEXPERTalatechreviewed 2 months ago"


Question: OPC UA (Siemens PCS7 OpenOS) data ingestion to Greengrass not working

"Dear AWS Community,We are trying to ingest OPC UA data from Siemens PCS7 OPU UA server to Greengrass v2. With just as / for node id, we aren't auto discovering tags. As we don't see any data on data streams.Further we diagnostic with Matrikon OPC UA explorer, UAExpert OPC UA Client, and Kepware. We were successful to auto-browse data from the same Siemens PCS7 OPC UA server. (attached is picture for reference)Not sure how to setup the node id to browse correct path of the data.The path within Siemens PCS7 OpenOS is as below (Ignore orange highlighted). The tags we need are listed under "List of all tags" folder.Any help or suggestion to fix this issue is welcome.FollowCommentgabemv-AWS 6 months agoDo you only get this behavior when trying to browse from the root? What about specifying a nodeId deeper in your structure / use the nodeid from 'list of all tags'? In UAExpert, if you select that node in the tree, you can see the nodeid in the attributes pane.Share"

Answer: "0Hi, to process data from your OPC UA server into GG you will need to install the IoT SiteWise OPC-UA collector plugin for GG (https://docs.aws.amazon.com/greengrass/v2/developerguide/iotsitewise-opcua-collector-component.html#iotsitewise-opcua-collector-component-requirements). You can also look at the following for more general information: https://docs.aws.amazon.com/iot-sitewise/latest/userguide/industrial-data-ingestion.htmlCommentSharekbrandsenanswered 7 months agorePost-User-5367700 7 months agoForgot to mentioned but our Greengrass is commissioned with all the required components. We have two different OPC UA gateways configured. From which one is working fine. The one in question is still the Siemens OPC UA (PCS7).Share"


Question: Transferring the Amazon connect contact while waiting for the Agent in the Queue

"once the caller is Transferred to Queue, how do i forward him to a phone number if he is more than 30 seconds in the queue. is this possible?FollowComment"

Answer: "0Hi,this can be done in some way but not exactly on the current time in queue.A good way to make this decision is based on the oldest call in the Queue.First you will set which Transfer-to-Queue Contact Flow you want to use.In that Transfer-to-Queue Flow you can use the following blocks:Get queue metricsUse the Check contact attributes block to check the metrics of the queue for oldest call waitingIf the oldest call waiting is above your threshold you can route the call externally by using the transfer to phone number blockThis way you can route that call externally before it have to wait for your threshold at all.You can also loop for the threshold in the Transfer-to-Queue flow and exit there after the threshold has been reached.Another way would be to use a Lambda function to create an item in e.g. DynamoDB linked to your contactId together with a timestamp.This will allow you to use another Lambda function to calculate the current time in Queue and make the routing decision based on the calculation.More generally spoken it's a good practice to make such routing decision before customer being placed in a waiting loop. This will allow you to create a good customer experience by not having your customer waiting to met a specific threshold.CommentSharefaddianswered a year ago"


Question: Sagemaker cross-account deployments

"I am trying to setup an aws code pipeline project that will deploy a sagemaker model from a model registry cross-account from our qa account.The plan is to deploy the latest approval model from the registry .  I followed steps https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-deploy.html#model-registry-deploy-xaccount  but the code below fails when trying to find the latest approved model to deploy.  Is their another API endpoint that allows me to look up by ARN instead of using list_model_package_groups?# try to find the latest approved model package from  model registry from our dev/qa VPC groups = self.sm.list_model_package_groups(NameContains=self.model_package, SortOrder='Descending')most_recent_group = groups['ModelPackageGroupSummaryList'][0]packages = self.sm.list_model_packages(ModelPackageGroupName=most_recent_group['ModelPackageGroupName'],                                       SortOrder='Descending', ModelApprovalStatus='Approved')most_recent_packages = packages['ModelPackageSummaryList']most_recent_package = most_recent_packages[0]model_name = '-'.join(most_recent_package['ModelPackageArn'].split('/')[-2:])model_package_arn = most_recent_package['ModelPackageArn']container_list = [{'ModelPackageName': model_package_arn}]self.sm.create_model(    ModelName=model_name,    ExecutionRoleArn=self.role,    Containers=container_list)return model_nameFollowComment"

Answer: "0Hello,Thank you for using SageMaker Service.I understand that you are facing error while deploying model which happens to be under different account and want to know how to overcome the error while listing down the lates model registered or identify other API call which could lookup the latest Model register using ARN.We would like to know the exact error message that has occurred at your end to narrow down the issue and help you overcome this.To better understanding of the error and your implementation, I'd recommend you to open a case with Premium Support SageMaker team so that you can share complete error message and required logs tp help you overcome this issue.Open a support case with AWS using the link:https://console.aws.amazon.com/support/home?#/case/createCommentShareSUPPORT ENGINEERKartik_Ranswered a year ago"


Question: Linux TCP Not Working On Instances

"Hi,If anyone can help me out with it'd be greatly appreciated! I'm currently creating a Splunk environment and I have all my instances configured to the same security group but when I try to discover my inputted TCP servers the receiving server isn't receiving anything from any server. I've ensured that my Linux instances have disabled firewalls, double-checked the security group rules, and also used telnet to verify but still no luck. Any tips or pointers would be greatly appreciated!Regards,FollowComment"

Answer: "0Hi,To diagnose your issue start by checking whether everything server side is configured correctly, you can use the netstat command to verify that your application (spluk) is listening on the right port, see sample:$ netstat -tulpnOutput(No info could be read for "-p": geteuid()=1000 but you should be root.)Active Internet connections (only servers)Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program nametcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -tcp6       0      0 :::22                   :::*                    LISTEN      -The above outputs should list your application and the port it is listening to for connections, for my example we can see that I have port 22 listening tcp6. Thereafter to confirm if the issue is with my security group I will use telnet or netcat to test connectivity, in my case I prefer netcat, see my samples below:When port 22 is open on security groups$ nc -v 3.95.254.52 22OutputConnection to 3.95.254.52 22 port [tcp/ssh] succeeded!SSH-2.0-OpenSSH_7.4When port 22 is closed on security group$ nc -v 3.95.254.52 22Outputnc: connect to 3.95.254.52 port 22 (tcp) failed: Connection refusedYou might also see a connection timed out on ports closed on security groups, I should further mention that your instance within the same VPC communicate over private IPs it might be beneficial to test and ensure that internal communication works.I am aware that splunk utilizes two network interfaces one for management and the other communication with your environment, however I am not well versed with the application. I have sourced this article which is a good reference for deploying a Splunk environment on AWS, might be beneficial to review.Else I would say let's start by isolating our issue to OS or Network config and work from there, feel free to keep me posted on your progress on this forum should you still require assistance.CommentShareSUPPORT ENGINEERLundianswered 5 months agoogosplunk 5 months agoThank you so much for the response to my question I ran netcat got the following back:splunk@Indexer2:/opt$ nc -v 172.31.1.6 9997nc: connect to 172.31.1.6 port 9997 (tcp) failed: Connection timed outsplunk@Indexer2:/opt$Afterward I double-checked the VPC to make sure all of my instances were configured on the same VPC which they were. Should I create a new VPC and if so is there a way to edit my current instances to be applied to that new VPC if need be?ShareLundi SUPPORT ENGINEER5 months agoThanks for the feedback,Based on the outputs it does appear that your instance is not getting a response from the server, this is due to connection timed out. The error indicates that the server didn't respond to the client and the client program gave up (timed out). This could be due to:-- The security group or network ACL doesn't allow access.-- There's a firewall on the instance's operating system.-- There's a firewall between the client and the server.-- The host doesn't exist.There is two things you need to confirm here:Can you check and ensure that security group assigned to the instance you are reaching allows for inbound traffic on port 9997?As a test you can open the port on 9997 on SG for the IP: 0.0.0./0 [This is just for testing, thereafter proceed to limit it to your VPC CIDR]To further answer your additional questions, unfortunately you won't be able to move the instances between VPCs, what you can do is the following,Once you have a new VPC, create AMIs of your instances.Launch new instances from the AMIs in your desired VPC.You can also check this knowledge article so basically this article covers the "connection timed out" from an SSH perspective but these troubleshooting steps can also be applied to any connectivity issue.Keep me posted :)Share0It would be good to isolate whether the problem is with the AWS network or the EC2 Linux configuration.You can verify the reachability of your AWS network configurations, such as RouteTable, SecurityGroup, NACL, and other else, with the VPC Reachability Analyzer.Troubleshoot VPC connectivity issues with Reachability AnalyzerCommentSharejhashimotoanswered 5 months ago"


Question: Timestamp not taken over when inserting data via IoT Core

"Hi,when writing messages into a Timestream table via IoT Core, the timestamp provided in the mqtt message payload is not is not taken over by Timestream. Instead the Timestream date is inserted into the database. Thats annoying since there is normally some delay between the creation time of some IoT data (which should be inserted into the database) and their arrival time at IoT Core / Timestream.Am I doing missing something or does this happen by Timestream design?msg.payload = {somename: somevalue,time = timestamp in ns}Edited by: asseldonk on Oct 8, 2020 1:05 AMFollowComment"

Answer: "0Hi there,Thanks for reaching out. The timestamp of the record is set by the IoT Core rules engine while inserting data into Timestream. You can https://docs.aws.amazon.com/iot/latest/developerguide/timestream-rule-action.html for more information.Having the ability to overwrite the timestamp is a great feature ask and we're happy to add it to our list of requested features.Thanks for your interest and support in Timestream!CommentSharemanbekanswered 3 years ago0Thats sad, cause it is a no go for us. Overwriting timestamps might be a nice feature in some cases. But we got thousand of machines all over world, each with multiple sensors and we strongly depend on the exact time of each measurement and not any IoT Core insertion time.It would helpful to e.g. only use IoT Core's insertion time, if no timestamp is provided in an mqtt message payload.So for now, Timestream is useless for us and we better migrate to Azure.CommentShareasseldonkanswered 3 years ago0It's the same for us.Being a feature of IoT core, I guess this problem impacts most people doing IoT: you really need the timestamp of the original data, not that of the eventual DB recording. Maybe we'll get around this by triggering a Lambda to do the transformation, but it makes the whole "Direct IoT data ingestion to Timestream" feature unusable for most cases.Hope this will be fixed soon.CommentShareLiviuxanswered 3 years ago0Wow, that is a interesting choice for a TSDB.So moving previously collected data into the database manually would reset their timeindex to insertion time?And data coming from separate devices might deviate from eachother depending on the lag between the sensor and the arrival into timestream?Can you please elaborate the reasoning behind this? I'd like to understand where Timestream would or would not work.CommentSharejv8xanswered 3 years ago0It's implemented - thanks a lot to AWS! Now, a timestamp provided by an MQTT Message is written into Timestream via IoT Core.CommentShareasseldonkanswered 3 years ago0Thanks for your feedback. We've recently updated the Amazon Timestream action in the AWS IoT Core Rules engine to support overwriting timestamps. You can find additional information if you click on the link below and look at the parameter called timestamp. We look forward to your feedback once you get a chance to test this.https://docs.aws.amazon.com/iot/latest/developerguide/timestream-rule-action.htmlThank you!CommentShareAWS-User-0226853answered 3 years ago"


Question: "while configure same  aws private Static IP inside the EC2 instance is leading to machine disconnect from network and gets the APIPA , Kindly assist"

We must configure private static ip inside the EC2 due to our DNS infoblox and this machine will be provisioned as domain controllerFollowComment

Answer: "0If I understand the question correctly: You're changing the private IP address of your EC2 instance to the public IP it has been assigned and that is breaking the network connectivity. If so, yes - that's exactly as expected.Could you explain why you need to do this. "due to our DNS Infoblox" is not enough information. There is documentation available for running Infoblox on AWS but I'm unsure where to point you because of the lack of detail.CommentShareEXPERTBrettski-AWSanswered a month agoLucky a month agoNo We are configuring Static Private ip inside the machine, which is already assigned from aws side. Since this machine would be provision as domain controller and having third party DNS infoblox dynamic ip is not working while registering for SRV record.Share0No We are configuring Static Private ip inside the machine, which is already assigned from aws side. Since this machine would be provision as domain controller and having third party DNS infoblox dynamic ip is not working while registering for SRV record.[]()CommentShareLuckyanswered a month agoRWC a month agoIf you know in advance what it needs to be then the private IP can be set at the time the instance is launched.AWS Console -> Launch instance -> Network settings -> Advanced network configurationIt can also be included in a Launch Template.As well as AWS Console, it can obviously also be done using Cloud Formation, Terraform, etc.Share"


Question: What is the relationship between AWS Config retention period and AWS S3 Lifecycle policy?

"I found here:https://aws.amazon.com/blogs/mt/configuration-history-configuration-snapshot-files-aws-config/" AWS Config delivers three types of configuration files to the S3 bucket:Configuration history (A configuration history is a collection of the configuration items for a given resource over any time period. )Configuration snapshotOversizedChangeNotification"However, in this docs: https://docs.aws.amazon.com/ja_jp/config/latest/developerguide/delete-config-data-with-retention-period.htmlIt only said that retention period delete the "ConfigurationItems" (A configuration item represents a point-in-time view of the various attributes of a supported AWS resource that exists in your account. )In this docs: https://docs.aws.amazon.com/config/latest/developerguide/config-concepts.html#config-history: "The components of a configuration item include metadata, attributes, relationships, current configuration, and related events. AWS Config creates a configuration item whenever it detects a change to a resource type that it is recording. "I wonder that: Is ConfigurationItems a subset of Configuration history?  Is the things that saved to S3 equal to  ConfigurationItems? If not, where is  ConfigurationItems stored? And if things stored in S3, is ConfigurationItems deleted or become damaged?I am setting AWS S3 lifcycle is expire objects in 300 days and  AWS Config retention period is 7 years. Therefore, I am wondering what is the relationship between those 2? Because S3 lifecycle period is 300 days, will  AWS Config data is deleted in 300 days?Thank you so much!FollowComment"

Answer: "1Accepted AnswerI'll attempt to answer your questions:The FAQ section towards the end of the Blog post you have listed has answers to your questions about S3 lifecycle vs Retention period: The configuration history and snapshot files delivered to an S3 bucket are for your auditing and analysis only & the retention period does not apply to the files in the S3 bucket. The files in the AWS Config data store depend on the retention period setting in the Config. So basically AWS Config has it's own datastore which is regulated by retention policy. Deleting something in S3 (via lifecycle policy) would not affect the view in AWS config but any auditing / analytics you do using S3 would be limited to 300 days dataYour question about where ConfigItems is stored - Based on my understanding, the configuration history is periodically saved to S3.  I presume configItems would be saved in internal the data store for use by AWS Config serviceIs ConfigurationItems a subset of Configuration history? - I would say logically yes. Each configurationitem is a record of the change to the AWS resources and Configuration history is a collection of Configuration Items which would tie these together to provide a view of the changes to a resource over a period of time https://docs.aws.amazon.com/config/latest/developerguide/config-concepts.html#config-historyAnd if things stored in S3, is ConfigurationItems deleted or become damaged? - S3 is backed by high availability and durability and hence data deletion / damage would be rare unless due to accidental human intervention. And in the very rare event that it happens, AWS config won't be affected.--SydCommentShareSydanswered a year ago"


Question: Oracle on RDS: TDE encryption with master key storage in KMS or CloudHSM

"From the documentation, it seems that if you want to use TDE on Oracle on RDS, the TDE master key can be stored:In RDS itself (Oracle Wallet) orIn ClassicHSM.Do you have any inputs on the possibility to store the TDE master key in KMS or in the new generation CloudHSM? Is it on the roadmap?Thank you in advanceFollowComment"

Answer: "0Accepted AnswerPlease noteCloudHSM for RDS is deprecated. We don’t support any new instances because old HSM is deprecated, and there are  no plans to build support for the new version of CloudHSMCommentShareEXPERTAWS-User-7019129answered 3 years ago"


Question: Socket.io architecture/configuration to connect to the closest server (GA) when it becomes available after the client has connected

"We have Global Accelerator setup in Amazon to route requests to the closest node (EC2) from some multiple nodes.How does socket.io play out in this case? If let's say a user connected, and the socket client is connected to host A, but then host B which is closer, becomes available, is there some way for the socket requests to be routed through this closest server?The typical scenario would be that if for some reason host B is overloaded and the Accelerator just routes the socket client to use host A at the time, but now the user is stuck on the distant server until he refreshes his page.ThanksFollowComment"


Question: DynamoDB Global Tables

can we add new replica in another region for an already existing DynamoDB global table?FollowComment

Answer: "0Yes this is possible,we can add another replica in different region once the existing DynamoDB global table created.Have a look on the following requirementsThe table must have the same partition key as all of the other replicas.The table must have the same write capacity management settings specified.The table must have the same name as all of the other replicas.The table must have DynamoDB Streams enabled, with the stream containing both the new and the old images of the item.None of the new or existing replica tables in the global table can contain any data.If global secondary indexes are specified, the following conditions must also be met:The global secondary indexes must have the same name.The global secondary indexes must have the same partition key and sort key (if present).https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables_reqs_bestpractices.html?shortFooter=trueRegion support for global tables Version 2017.11.29 is limited to US East (N. Virginia), US East (Ohio), US West (N. California), US West (Oregon), Europe (Ireland), Europe (London), Europe (Frankfurt), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), and Asia Pacific (Seoul).https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/V2globaltables.tutorial.htmlCommentSharewkkamaruanswered 3 months ago"


Question: Cognito groups- allow admin group to remove a user from a Cognito group

"I have a Cognito user pool that has 3 groups(admin, user, engineer) I want to allow admin groups to remove a user from a group. I read about admin-remove-user-from-group but this needs developers' credentials.Do you have any idea how to give access to this function?FollowComment"

Answer: "0"Developer credentials" simply refers to credentials for programmatic access as this is what allows calling actions in the CLI. In order to allow users in the admin group to call the admin-remove-user-from-group action, they need to be provided with these credentials.There is information here on how to provide programmatic access:https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.htmlFor security purposes, you might choose to grant temporary security credentials. This will function the same as long-term security credentials but requires a session token, will expire after a specified interval, and may include principal tags:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.htmlVisit these links for more information about the admin-remove-user-from-group action:https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminRemoveUserFromGroup.htmlhttps://awscli.amazonaws.com/v2/documentation/api/latest/reference/cognito-idp/admin-remove-user-from-group.htmlCommentShareNuzhat_Sanswered 10 months ago"


Question: Greengrass Recipe - Programatically Define ECR Artefact

"We are using terraform and have some components that deploy docker images from ECR.These docker images are defined as artefacts with the hardcoded account id + region, for example:'docker:<account-id>.dkr.ecr.<region>.amazonaws.com/<image-name>:<tag>'How can we have these account ID's/ regions programatically set in the recipe.yaml files ? We are using the gdk tool.FollowComment"

Answer: "0Thanks, i have made some progress with a custom build script based on the examples above.One outstanding question - wheh i run gdk component build with my custom script, it produces the recipe.json file in greengrass-build, with the correct account id's substituted by the custom build. That is good, and it solves the problem above.For the publish step, however, it seems to fail. It seems that the COMPONENT_NAME,COMPONENT_VERSION and BUCKET_NAME placeholders don't get correctly replaced in publish.Can you offer any help with this ? Does using a custom build script mean any changes to the publish command ?After running gdk component build, it generates a greengrass-build directory that looks like:greengrass-build/├── artifacts│   └── <componentName>│       └── <versionNumber>│           └── <componentName>.zip└── recipes└── recipe.jsonWhere recipe.json looks like: (snippet only):{"RecipeFormatVersion": "2020-01-25","ComponentName": "<componentName>","ComponentVersion": "{COMPONENT_VERSION}","ComponentType": "aws.greengrass.generic","ComponentDescription": "Deploys container from AWS ECR","ComponentPublisher": "{COMPONENT_AUTHOR}",And when I run a local deployment with the greengrass-cli:java.io.IOException: Unable to parse /home/<snipped>/greengrass-build/recipes/recipe.json as a recipe due to: Cannot construct instance of com.vdurmont.semver4j.Semver, problem: Invalid version (no major version): {COMPONENT_VERSION}at [Source: (File); line: 4, column: 23] (through reference chain: com.amazon.aws.iot.greengrass.component.common.ComponentRecipe$ComponentRecipeBuilder["ComponentVersion"])at com.aws.greengrass.deployment.DeploymentService.copyRecipeFileToComponentStore(DeploymentService.java:617)at com.aws.greengrass.deployment.DeploymentService.copyRecipesToComponentStore(DeploymentService.java:575)at com.aws.greengrass.deployment.DeploymentService.copyRecipesAndArtifacts(DeploymentService.java:529)at com.aws.greengrass.deployment.DeploymentService.createNewDeployment(DeploymentService.java:489)As far as I can tell I have followed the structure of the example above - am I missing something ?CommentShareAWS-User-9962534answered 8 months agoAWS-User-9962534 8 months agoAs an aside, gdk component build, then a local deployment merge with greengrass cli is documented here: https://docs.aws.amazon.com/greengrass/v2/developerguide/greengrass-development-kit-cli-component.html, so I would assume that it is suported.I have the very same error when I run the publish command, as when i run the local deployment, log attached below:[2022-10-05 13:28:08] ERROR - Failed to create the component using the recipe at '<partially-snipped-fp>/greengrass-components/components/componentName/greengrass-build/recipes/componentName-0.0.1.json'.[2022-10-05 13:28:08] ERROR - Failed to publish new version of the component 'componentName'=============================== ERROR ===============================Could not publish the component due to the following error.Failed to publish new version of component with the given configuration.Creating private version '0.0.1' of the component 'componentName' failed.An error occurred (ValidationException) when calling the CreateComponentVersion operation: Invalid Input: Encountered following errors in Artifacts: {s3://BUCKET_NAME/COMPONENT_NAME/COMPONENT_VERSION/componentName.zip = Specified artifact resource cannot be accessed}ShareGreg_B EXPERT8 months agoEditing my old comment changed the order of the comments. Urgh. So I deleted because the conversation is broken.Summary: if you use custom build type, the GDK build command doesn't replace COMPONENT_NAME, COMPONENT_VERSION and BUCKET_NAME. So you can't immediately proceed to a local deployment using the Greengrass CLI. I didn't know this distinction of the custom build type. The GDK publish command will fill these in.https://github.com/aws-greengrass/aws-greengrass-gdk-cli/blob/d42138af965712729f5d67325399a5c91c1a8c59/gdk/commands/component/BuildCommand.py#L50-L58ShareGreg_B EXPERT8 months agoYour GDK publish should work fine though. Let's figure that one out. Please share your gdk-config.json.This is where the publish command resolves the placeholder in the recipe: https://github.com/aws-greengrass/aws-greengrass-gdk-cli/blob/2e58fb3831a0dbf59ea059ea8b583aa2089d29c8/gdk/commands/component/PublishCommand.py#L291ShareGreg_B EXPERT8 months agoNote that your custom build could open the gdk-config.json file and resolve these recipe placeholders just as it resolves the placeholders for the ECR artifact. Then you can use the Greengrass CLI immediately thereafter.Share0Commenting here because I am now confused with the order of comments now.To clarify: Local deployments are not supported with custom builds , is this correct ? This confuses me, as when I use the default zip build, the contents of the greengrass-build directory look exactly the same as they do for when i do a custom build. The local deployment command also refers to that dir, not the zip-build dir, so I don't understand why build:zip works with local and build:custom doesn't.sudo /greengrass/v2/bin/greengrass-cli deployment create --recipeDir greengrass-build/recipes/ --artifactDir greengrass-build/artifacts --mergeThanks for linking the source code, I will look at that and debug.CommentShareAWS-User-9962534answered 8 months agoGreg_B EXPERT8 months agoSorry. gdk component build won't set COMPONENT_VERSION etc in the recipe when you use a custom build. Your custom build script will have to do it, or it won't be done. The local deployment will not succeed if ComponentVersion in the recipe is is still COMPONENT_VERSION. That is the cause of the error you reported: Cannot construct instance of com.vdurmont.semver4j.Semver, problem: Invalid version (no major version): {COMPONENT_VERSION}.ShareAWS-User-9962534 8 months ago(anonymised) gdk-config file is:{  "component": {    "com.component.Name": {      "author": "anonAuthor",      "version": "7.2.6",      "build": {        "build_system": "custom",        "custom_build_command": [          "python3",          "gdk_build.py"        ]      },      "publish": {        "bucket": "<PLACEHOLDER_BUCKET>",        "region": "eu-west-1"      }    }  },  "gdk_version": "1.1.0"}and recipe.json is:{    "RecipeFormatVersion": "2020-01-25",    "ComponentName": "COMPONENT_NAME",    "ComponentVersion": "COMPONENT_VERSION",    "ComponentType": "aws.greengrass.generic",ShareGreg_B EXPERT8 months agoIf that's really your recipe (and your custom build script doesn't replace COMPONENT_NAME with componentName), then I think you should hit this error first: https://github.com/aws-greengrass/aws-greengrass-gdk-cli/blob/2e58fb3831a0dbf59ea059ea8b583aa2089d29c8/gdk/commands/component/PublishCommand.py#L312ShareGreg_B EXPERT8 months agoYour "Specified artifact resource cannot be accessed" error suggests to me that the artifact URI substitution has not happened: https://github.com/aws-greengrass/aws-greengrass-gdk-cli/blob/2e58fb3831a0dbf59ea059ea8b583aa2089d29c8/gdk/commands/component/PublishCommand.py#L319-L345Recipe syntax problem? Perhaps try gdk component publish --debug to see more.Share0Hi. One approach is to use a custom build type with GDK and replace placeholders in your recipe. Like this:https://github.com/awslabs/aws-greengrass-labs-component-for-home-assistant/blob/main/gdk-config.jsonhttps://github.com/awslabs/aws-greengrass-labs-component-for-home-assistant/blob/main/gdk_build.pyhttps://github.com/awslabs/aws-greengrass-labs-component-for-home-assistant/blob/main/recipe.jsonCommentShareEXPERTGreg_Banswered 8 months ago"


Question: General AWS SNS subscription to GovCloud SQS - ARN Validation Fails

"We have an architecture in which events will be generated from general AWS and consumed by services within GovCloud.The intended architecture was to pipe events into SNS on general AWS side, then from there to SQS on GovCloud side, but through the console on general side, adding SNS subscription to SQS topic fails claiming the GovCloud ARN is invalid.I was hoping to clarify whether this is a console level issue that could be bypassed by performing equivilent operations over CLI?Our workaround is to use lambdas off of the SNS for pushing into GovCloud SQS, but would rather not add this complexity if not necessary.FollowComment"

Answer: 0Turns out cross-partition permissioning is not supported for IAM or resource-based policies.https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_compare-resource-policies.htmlCommentSharedan-swrianswered 3 years ago


Question: Is there a reason why port forwarding isn't working?

I just got a new install for a linux ubuntu free tier vm on EC2 and cant connect or open ports.you may test the ports yourselfsnot sure what is going on.FollowComment

Answer: "0If you are trying to ssh into the machine, you need to allow the ssh port 22 in the Security Group. From the attached diagram I see you have opened only the HTTP and SSH ports on the machine. Do you have a webserver such as Apache running on the machine that is listening on port 80 or 443?CommentShareEXPERTIndranil Banerjee AWSanswered 9 months ago"


Question: EFS volume in Batch job running on Fargate

"Hi,I'm trying to use an EFS volume in a Batch job running on AWS Fargate. The support for EFS volumes was added in Fargate version 1.4.0 (see here). In the linked article, it's also stated that using LATEST is equivalent to specifying version  number 1.4.0. However, when I try to specify the LATEST as a Fargate platform version in the Batch job definition where I also specify EFS volumes, I get this error:Failed to register job definitionError: Error executing request, Exception : EFS is supported for Fargate platform version 1.4.0., RequestId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxSpecifying an explicit version number 1.4.0 works without problems. If this is a bug, how to report the issue?FollowComment"

Answer: "0Same for me. In my Fargate tasks, I have Platform version empty, so it can get the default value, or I set 1.4.0 because  I had issues with LATEST as well.CommentShareMaxanswered 5 months ago"


Question: Migrating RDS not in VPC (EC2 classic platform) to VPC

"We have RDS (mysql) instances which are currently on EC2 classic platform. They are not in VPC and we have received notification from AWS to move them to VPC. We are following this guide for migration. However, this process will take about ~20 minutes for us (creating snapshot and then restoring RDS from snapshot in a VPC). During this time, the updates happening to the current RDS will not be propagated to the new RDS. We'll have to do a data migration post this process to recover the lost data.We wanted to know if there is a better way to do this VPC migration. We don't want to loose the data or cause a huge downtime because one of the RDS is very heavily used. Please advise.Also, AWS is asking to complete this migration by August 15th. Will there be any disruptions caused to our existing RDS if we are not able to migrate the RDS by that date.Thanks!FollowComment"

Answer: "0Hello,As pointed out in your own link provided:Using the following alternatives, you can move a DB instance not in a VPC into a VPC with minimal downtime. These alternatives cause minimum disruption to the source DB instance and allow it to serve user traffic during the migration. However, the time required to migrate to a VPC will vary based on the database size and the live workload characteristics.Alternatives:AWS Database Migration Service (AWS DMS) – AWS DMS enables the live migration of data while keeping the source DB instance fully operational, but it replicates only a limited set of DDL statements. AWS DMS doesn't propagate items such as indexes, users, privileges, stored procedures, and other database changes not directly related to table data. In addition, AWS DMS doesn't automatically use RDS snapshots for the initial DB instance creation, which can increase migration time. For more information, see AWS Database Migration Service.DB snapshot restore or point-in-time recovery – You can move a DB instance to a VPC by restoring a snapshot of the DB instance or by restoring a DB instance to a point in time. For more information, see Restoring from a DB snapshot and Restoring a DB instance to a specified time.I would recommend reaching out to your assigned TAM/SA to plan for the maintenance. They will provide you the necessary resources and also make sure that you get minimal downtime by suggesting you the best way forward.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months ago"


Question: Create Lambda Layer in Dockerfile

"Hi, just wondering, during docker build, if I install node packages in the folder /opt/nodejs and copy the folder node_modules/ plus files package.* to the final image like the following:FROM public.ecr.aws/lambda/nodejs:16 as builderWORKDIR /opt/nodejsRUN npm install pkg1 pkg2 pkg3FROM public.ecr.aws/lambda/nodejs:16COPY --from=builder /opt/nodejs /opt/nodejsCOPY . ${LAMBDA_TASK_ROOT}would this be a valid way to create a lambda layer? Thanks!FollowComment"

Answer: "0Accepted AnswerLambda container images does not support layers. Layers are only a way to add dependencies, so all you have to do is include those dependencies in your docker image. Layers use the /opt. When you use docker, you don't have to use /opt and you can deploy your dependencies in the regular location.I don't think you need to use FROM twice. Just use the second, npm install, and copy the application files.CommentShareEXPERTUrianswered 10 months ago0I don't know in JS, but in Python what I would do is use the docker image provided by lambda to install my packages into a specific folder. Zip that, store it in S3, job done. So yes, I suppose a multi-stages build works as well. But again, I am not familiar with the specific inner workings of NPM to achieve that.CommentShareJohnPrestonanswered 10 months ago"


Question: Rekognition get_text_detection not returning Timestamp with milliseconds precision

"When submitting a video to Rekognition, get_text_detection is always returning Timestamp with seconds precision instead of milliseconds. For example:text_detection: {'Timestamp': 4000, 'TextDetection': {'DetectedText': 'ITV Lunchtime News', 'Type': 'LINE', 'Id': 0, 'Confidence': 99.68327331542969, 'Geometry': {'BoundingBox': {'Width': 0.1505126953125, 'Height': 0.033203125, 'Left': 0.35760498046875, 'Top': 0.0947265625}, 'Polygon': [{'X': 0.35760498046875, 'Y': 0.0947265625}, {'X': 0.50811767578125, 'Y': 0.0947265625}, {'X': 0.50811767578125, 'Y': 0.1279296875}, {'X': 0.35760498046875, 'Y': 0.1279296875}]}}}Code snippets:response = self.rekognition.start_text_detection(            Video=self.param_video,            NotificationChannel=self.param_channel,            JobTag=self.job_tag,            Filters=self.param_filters,        )        self.job_id = response["JobId"]while not finished:            response = self.rekognition.get_text_detection(                JobId=self.job_id, MaxResults=max_results, NextToken=pagination_token            )            for text_detection in response["TextDetections"]:                print(f'text_detection: {text_detection}')            if "NextToken" in response:                pagination_token = response["NextToken"]            else:                finished = TrueLooks like a bug to me. But it's weird that I didn't find anyone reporting it before.So am I doing something wrong?FollowComment"

Answer: "0Hi,Thank you for pointing this out.Rekognition Video StartTextDetection apis do not analyze all the frames in the video and may choose to select frames to analyze based on internal algorithms. As a result, you may not see output for all frames.We have also noticed that in some cases, the output timestamp may not represent a frame with a given PTS. We will work on making this more accurate. As a workaround, to map the output timestamp to a frame in the video, we recommend selecting the frame closest to the output timestamp from the video.Thanks.CommentShareAWS-Ragibanswered a year ago"


Question: Lightsail - Some names are already in use

"Hi, i'm trying to create a Lightsail's GitLab instance called "GitLab", there are absolutely no existing instances or snapshots on this account right now, but i receive the error message: "Some names are already in use: GitLab", why is that? thanks in advance.FollowComment"

Answer: "2Accepted AnswerDid you already have an GitLab instance in your account, in any other region? Could be a case of eventual consistency, and eventually will be available. If not, you can access support in the Account menu in the interface, clocking in Customer support.CommentShareIbrahim Cesaranswered 10 months agoRimuru 10 months agoYou are right logging out and back in solved the problem, thanks!Share"


Question: credentials.iot.amazonaws.com "assuming a Role"

"In order to give an IoT device a simple access to an S3 bucket, one must do all this: https://docs.aws.amazon.com/iot/latest/developerguide/authorizing-direct-aws.html (phew!)I would like this understand what I'm actually doing.   The first thing is to let "credentials.iot.amazonaws.com" service to "assume a role", in more details "role that the credentials provider assumes on behalf of your device".The device has a role which let's it to do pubsub on MQTT messages (among other things).Why the credential services would be interested in "assuming a role on behalf/from the device" ?  I mean, it is going to give out an access key id & secret access key associated to the IoT device certificate.   Such a task is farm from the "roles" that the device does.FollowComment"

Answer: "1The credential provider is a way for an IoT device to access AWS services that cannot be directly accessed using an X.509 certificate and IoT policy.  Here's a really good C-SDK demo that you can build and run on a Linux system. Note that the request that fetches the security token and keys (getTemporaryCredentials()) is HTTPS not MQTT.Typically, IoT devices will be provisioned with an X.509 certificate and private key. Not IAM keys. The X.509 certificate is used to authenticate the device. An IoT policy, attached to the certificate, authorizes the device to perform IoT actions on IoT resources. So it can publish/subscribe to MQTT topics, use Shadows, use Jobs etc, but only perform IoT actions on IoT resources. This is deliberate. To limit blast radius if a device is compromised.If a device needs to perform non IoT actions on non IoT resources, it uses the credential provider to get IAM credentials.Please be aware that IoT Core offers various mechanisms for getting data in and out of an S3 bucket (without always having to resort to credential provider). For example, data can be published on MQTT topics and the IoT Core Rules Engine can be used to land the data in S3 (directly or via other services). An IoT Core Job with presigned URL can be used to retrieve a file from an S3 bucket. Hence there is no need to make your bucket, or bucket object, public.CommentShareEXPERTGreg_Banswered a year ago0Accepted AnswerThanks for the answers.  However, I was looking for a bit more "mechanistic" answer: what are the instances that give out the credentials (iot credentials server) and who gets which role and why: is it the iot credentials server, or the iot device..?   you know - boxes and arrows explanation.  :)Something like this:+--------------------------+  -----> gives creds, according to a role alias|IoT credentials provider  |         "my-role-alias"  ---> creds allows stuff according to |server                    |                                        "my-role-credentials"|                          |+--------------------------+  <----- request creds according to role alias  - can give creds requested         "my-role-alias" --link--> role "my-role-credentials"    with certs because role          creds are requested with certificates    because role alias    "my-role-alias" has    "it:AssumeRoleWithCertificate"    enabled  - can give creds for "my-role-alias"    in the first place, since "my-role-alias"    role alias "inherits" role "my-role-credentials"I also created a "batteries included" example repo to demo this thing in hereSo I'm going (shamelessly) to accept my own answer as the correct one.CommentShareAWS-User-2068037answered a year ago0It is mostly about security.  This workflow allows a device to assume a role temporarily that has a defined set of permissions within your AWS account.  This is done using the devices certificate rather than hard-coded credentials. In the case of S3, if a bucket has all public access blocked, then this allows a device to upload or download files from that bucket using credentials passed over secure MQTT topics.  One use case would be where an IOT Job instructs the device to download a file from bucket X using role Y.On the other hand if the device already has permissions to the bucket (e.g. the bucket is public), there is no need to obtain temporary credentials and the device can call S3 APIs without credentials.  If bucket access is controlled through and ACL, then each device would need AWS credentials.  This would be difficult to manage in the long term and also present security issues.CommentShareDonLammeyanswered a year ago"


Question: Cloudformation support for creating configurations

"Great to see CloudFormation support coming out.I did notice that only AWS::MSK::Cluster is available, but no way to create a configuration resource (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_MSK.html).I'm right now looking into creating clusters programmatically as part of our recovery procedures, and would have liked to use a cloudformation template with minimal "glue scripts" around it, but for that I would also have to create a cluster configuration. Doing that as part of the glue script code works, but then I can also just use the AWS CLI for all steps and skip using CloudFormation.Is support for MSK cluster configurations in CloudFormation "on the horizon"?FollowComment"

Answer: 0You are correct.  We will support Configurations in CloudFormation soon.  Until then you can create a configuration in MSK and then use the configuration ARN in your CloudFormation scripts.CommentShareAWS-User-6643836answered 4 years ago0You can create MSK::Configuration in cloudformation now like:  MskConfiguration:    Type: "AWS::MSK::Configuration"    Properties:      Description: !Sub "${EnvironmentName}-${EnvironmentShard}-msk-cluster-configuration"      Name: !Sub "${EnvironmentName}-${EnvironmentShard}-msk-cluster-configuration"      KafkaVersionsList: [2.8.1]      ServerProperties: |        auto.create.topics.enable=false        default.replication.factor=2and associate to the cluster with  MSKCluster:    Type: 'AWS::MSK::Cluster'    Properties:      ClusterName: !Sub "${EnvironmentName}-${EnvironmentShard}-msk-cluster"      KafkaVersion: 2.8.1      NumberOfBrokerNodes: 1      ConfigurationInfo:        Arn: !Ref MskConfiguration        Revision: 1        ...CommentShareDFreemananswered a year ago


Question: LoRaWan device profiles are getting created in the RF region US915

We are trying to create device profile under RF region IN865. We are able to select it in drop down of RF region. But the profile is created under he RF region US915. We were able to do that 5 days back. Don't know what happened right now?FollowComment

Answer: "0Accepted AnswerHi. I see the same behaviour. It may be an issue at our end. However, the CLI command is working correctly, so please use the CLI instead, for the time being. I will follow-up on this.CommentShareEXPERTGreg_Banswered a month agorePost-User-6189643 a month agothanks for the fast reply. let us check with CLISharerePost-User-6189643 a month agoworking fine with CLIShareGreg_B EXPERT21 days agoThe console is fixed.Share"