Question: EventBridge Scheduler - In which target services configuring flexible time window can be helpful?

Just curious about in what scenarios configuring flexible time window can be useful.Thanks!FollowComment

Answer: "1I do not think it has anything to do with a specific service. It has more with protecting downstream services. Instead of invoking it all at once, distribute the invocations. From the blog:EventBridge Scheduler invokes the task within that timeframe. This setting helps to distribute the invocations across time and manage the downstream service limits.CommentShareEXPERTUrianswered 5 months agoash-ishh 5 months agoMakes sense 👍 Thanks, I missed that part in the documentation 😅This looks good option to eliminate the extra configuration of SQS, if rate limiting without lot of customization is required.Share"


Question: MFA recovery - Call me now gives "Phone verification could not be completed"

I'm trying to log into my root account but don't have the MFA code. If I go through the MFA recovery process it verifies me successfully via email and then prompts me with a "Call me now" button. When I press this it says "Phone verification could not be completed".I haven't changed my phone number since creating the account and I would have successfully used MFA to log in previously so they would have the correct phone number.Anyone know how to resolve this? I'm locked out of my root account :(FollowComment

Answer: 0This was caused by the phone number not having the international code in front of it. Not a very helpful error message and the AWS contact settings don't state that you should do that. Grrr. AWS support were very good though.CommentSharerePost-User-3423164answered 5 months ago


Question: "Can AWS Glue read data from different SQL Server table, generate csv files and zipping it to S3?"

"I need to load data from multiple tables in a SQL server to S3 for some batch processing. Can AWS Glue read data from different SQL Server table, generate csv files and zipping it to S3?And can AWS Glue run R script functions?FollowComment"

Answer: "1Accepted AnswerHi,yes, AWS Glue can read from multiple SQL Server tables,apply transformation with Spark (Pyhotn or Scala) and write to Amazon in S3 in different output format, compressed CSV is one of them.As mentioned, AWS Glue is a Serverless Spark environment and you can build your jobs wit Python and Scala. R is not natively supported.hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: Signing requests with Cognito token to API Gateway necessary?

"I have an application that uses Cognito for authentication. I also use API Gateway. I read here thatThe AWS SDKs, AWS Command Line Interface (AWS CLI), and other AWS tools sign API requests for you using the access key that you specify when you configure the tool. When you use these tools, you don’t need to learn how to sign API requestsSo if I'm making fetch requests to API Gateway, is it still necessary to manually sign these requests with the tokens from Cognito? Or is there a way around that?FollowComment"

Answer: "2No, when using API Gateway with a Cognito authorizer it is not needed.  The token should just be placed in the Authorization header. Signing is used when calling AWS APIs or when using the IAM Authorizer in API Gateway. The signing is done using a mechanism called SigV4.CommentShareEXPERTUrianswered a year agoAWS-User-6117969 a year agoWhich token should be used? I noticed that the access token does not have a "sub" field for identifying the user.ShareUri EXPERTa year agoYou can use an ID token or an Access token.Share"


Question: Is possible to change lambda timeout container?

"Hey, I'm trying to avoid cold start in my lambda functions.Is there any way to control the container timeout?Can I reserve 1 or 10 containers for a longer period of time? Even if this will be an extra charge.I just want to know if is anything I can do to control container timeout, besides keeping it warm with schedule requests.Edited by: jnabais on Mar 20, 2019 3:33 AMFollowComment"

Answer: "0Hello,Unfortunately, as of now, it is not possible to control the container timeout and reserve it for a longer time. I see that you are already following the best practices of keeping lambda functions warm using scheduled requests. Thank you for the feedback. I will forward this feature request to the internal team. However, we will not be able to provide an ETA for when/if this feature will be released.Kindly, check our products announcement page [1] and AWS Blog [2] periodically for updates.[1] https://aws.amazon.com/new/[2] https://aws.amazon.com/blogs/aws/CommentShareAkanksha_Banswered 4 years ago"


Question: Best way to manage access to a VPC Endpoint

"A customer has a need for Cloudwatch Logs in a private VPC, but they want to restrict access to this endpoint for authorized hosts only, to prevent accidental confidential information to leak out of the VPC.  What's the best way to accomplish this?a.Instance role: Control access to the VPCe via an Instance Role IAM policyb. VPC Endpoint policy: Can we add ec2-based restrictions to a VPCe policy?c. VPC Endpoint security group: Selectively allow only authorized IP addressesI would have a preference for an Instance Role solution, because then we can manage access at the logical EC2 level, regardless of assigned IP address.Are there best practices or better ways to accomplish this goal?FollowComment"

Answer: "0Accepted AnswerAs outlined, there can be various ways to control the access to a private VPC. In your specific case, it seems it is a typical access control to a VPC endpoint for CloudWatch Services. What you can do is toSpecify a VPC endpoint policy for your CLoudWatch Services, for example:{"Statement": [{"Sid": "PutOnly","Principal": { "AWS": "arn:aws:iam::AWS-account-ID:role/role-name" },"Action": ["logs:CreateLogStream","logs:PutLogEvents"],"Effect": "Allow","Resource": "*"}]}NOTE: modify further detailed requirements on Action and Resources if necessary.Create  a specific IAM role allowing the permission for access the VPC CLoudWatch logsProvision the Limited (EC2) instances you will allow to access the VPC CloudWatch endpoint service.This is inline with your a. using IAM role approach. You might still need to make sure you have Network layer of rules like Security Group to allow the EC2 instance to flow through besides the endpoint policy.CommentShareAWS-User-7123169answered 3 years ago"


Question: Web Application Firewall (WAF)

"Hi. I've designed an architecture diagram for an application that has 7 EC2 instances. Each of those EC2s has an application load balancer (ALB) sending traffic. At the level of each ALB, I have a WAF.So the question is: should the WAF be put at the level of the EC2 or at the level of the ALB? And does it make any difference whether it's a web server or API server?Thank you.FollowComment"

Answer: "1Accepted AnswerQ. Should the WAF be put at the level of the EC2 or at the level of the ALB?A. See below from FAQ, as you already have, WAF is deployed at the ALB layer not EC2.What services does AWS WAF support?AWS WAF can be deployed on Amazon CloudFront, the Application Load Balancer (ALB), Amazon API Gateway, and AWS AppSync. As part of Amazon CloudFront it can be part of your Content Distribution Network (CDN) protecting your resources and content at the Edge locations. As part of the Application Load Balancer it can protect your origin web servers running behind the ALBs. As part of Amazon API Gateway, it can help secure and protect your REST APIs. As part of AWS AppSync, it can help secure and protect your GraphQL APIs.CommentShareEXPERTTushar_Janswered 6 months ago"


Question: DMS Task Fails with RECOVERABLE_ERROR but no other info

"I have logging enabled but nothing is output to CWL.Full error is:Last Error Task error notification received from subtask 0, thread 0 [reptask/replicationtask.c:2673] [1022502] Stop Reason RECOVERABLE_ERROR Error Level RECOVERABLEso I have no info to go onFollowComment"

Answer: 0Should note that logging is enabled and all log levels are set toLOGGER_SEVERITY_DETAILED_DEBUGand yet no log streams are created. Both endpoints pass connectivity checks. DMS replication instance is almost certainly over provisioned (have run more extensive DMS tasks on other sources with lower tier instance types) and reported instance metrics are very very low.CommentSharenathancarmonaanswered 4 years ago0So logging was failing because when you create DMS resources via Cloudformation thedms-cloudwatch-logs-roledoesn't exist and won't be created.https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.APIRole.htmlWas then bouncing off of errors along the lines of "No suitable plugin found" - i had not yet run the following scripts to support legacy function names:https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.PostgreSQL.html#CHAP_Source.PostgreSQL.v10Hope this info helps someone in the future.CommentSharenathancarmonaanswered 4 years ago


Question: AWS Timestream - Delete/Mutate record

"I'm using boto3/python to try and update a record via 'write_records(...)'.  In response I get 'A record already exists with the same time, dimensions, and measure name. Updating measure value is not supported.'  There is no boto3 api to delete or update a record.Is there anyway to either delete a record or mutate a record? I'm storing user data and would like to delete user data upon a GDPR request.I get the feeling that a record is immutable by design however the documentation doesn't say it is, at least that I could find.Edited by: Whale on Oct 8, 2020 10:36 PMFollowComment"

Answer: "0In this video(Getting started with Amazon Timestream) they say you can only append to the table  https://aws.amazon.com/timestream/getting-started/?nc=sn&loc=4Also, abstract from docs https://docs.aws.amazon.com/timestream/latest/developerguide/API_WriteRecords.html :"RejectedRecordsExceptionWriteRecords would throw this exception in the following cases:Records with duplicate data where there are multiple records with the same dimensions, timestamps, and measure names but different measure values."CommentSharekatooanswered 3 years ago0Thanks for reaching out. Amazon Timestream currently does not support deleting and updating of existing records. We will add this feature asks to our list of feature requests.Thanks for your interest and support for Amazon Timestream.CommentShareAWS-User-0226853answered 3 years ago0As of 11/24 Amazon Timestream supports the ability to upsert records. Please see https://docs.aws.amazon.com/timestream/latest/developerguide/getting-started.java-v1.code-samples.write-to-table.html for details.CommentShareAWS-User-0226853answered 3 years ago"


Question: why I am getting charged for RDS Billing

Why I am getting charged even after deleting RDS Instances and snapshots.Here are the details of my bill:Relational Database Service     USD 0.29US East (N. Virginia)                              USD 0.29Amazon Relational Database Service Backup Storage                                                                                USD 0.29$0.095 per additional GB-month of backup storage exceeding free allocation0.379 GB-Mo                                          USD 0.04$0.095 per additional GB-month of backup storage exceeding free allocation running PostgreSQL2.624 GB-Mo         USD 0.25FollowComment

Answer: 0Are there any snapshots that were taken when the RDS was deleted or automatically taken?The automatically taken snapshots are located on the System tab of the RDS Snapshot screen.It is recommended that all tabs on the snapshot screen be checked.CommentShareEXPERTRiku_Kobayashianswered 22 days ago


Question: Extract and Display First Part of a Field in CloudWatch Query Results

"I am trying to write a CloudWatch Log Insights query which will extract the first part of a string field up to a forward slash '/' character, which is always present in the string. Example input log lines for field named "fruit" follow:blue/berriesred/appleI need to extract the first part of the "fruit" field up to the forward slash '/' character and display it in the query results as follows, using the example input lines above:blueredThe "fruit" field is not a blob field, e.g., JSON--it's just a single string. I tried various iterations using the parse command with no luck. I also tried different ideas for using a regular expression to extract the first part of the string up to the forward slash '/' character with no luck. I searched for hints in StackOverflow too but didn't land on anything successful.I have verified using a regular expression checker that the following will extract the first part of the string up to the forward slash character:/^.*?(?=/)/I haven't been able to figure out how to apply the regular expression in the query correctly so that it is evaluated and displayed. Any ideas? Thank you.FollowComment"

Answer: "0Accepted AnswerHello,If the logs are in pure JSON format, CloudWatch Logs automatically discovers the log fields contained in the logs and you can reference the field directly as in the query below.parse fruit "*/*" as color, product | display colorNote: color, product are variable names here.If the logs are in non-JSON format , we would require a sample log to build the query. Keeping in mind your data privacy, you can open a technical support case with AWS using the link (https://console.aws.amazon.com/support) and then share a sample log on the case. AWS Premium Support engineers will assist you accordingly.CommentShareSUPPORT ENGINEERAakifah_Banswered 3 months ago"


Question: pinpoint.updateEndpoint Giving error "NotFoundException: Resource not found"

"I am trying to create a dynamic segment in amazon pinpoint and then add endpoints. In Postman i am able to create/update the pinpoint endpoint with AWS signature but when I tried to implement the same in the NodeJS project i am getting "Resource Not Found" exception. Where i am missing something? Any solution, please!here is my code:const AWS = require('aws-sdk');accessKeyId = process.env.ACCESS_KEY_ID,secretKey = process.env.SECRET_KEYAWS.config.update({    region: 'ap-southeast-2',    accessKey: accessKeyId,    secretAccessKey: secretKey,});const pinpoint = new AWS.Pinpoint({    accessKey: accessKeyId,    secretAccessKey: secretKey,    region: 'ap-southeast-2',    signatureVersion: 'v4',});const endpointAddress = obj.phone;console.log(">>>Endpoint Address: ", endpointAddress)  //I am getting this valueconst endpointID = obj_id.toString();console.log(">>>EndpointID: ", endpointID)  //I am getting this value as wellconst params = {    ApplicationId: 'a35e50bc1ec54c18a53294c6e610da5d' /* required */,    EndpointId: endpointID /* required */,    EndpointRequest: {        /* required */        Address: endpointAddress,        ChannelType: 'VOICE',        EndpointStatus: 'ACTIVE',        OptOut: 'NONE',        Location: {            Country: obj.country,        },        Demographic: {            Make: 'Apple',            Platform: 'iOS',        },        EffectiveDate: '2022-08-11',        Attributes: {            Interests: ['Technology', 'Music', 'Travel'],            CampaignIdentifier: ['OB'],        },        Metrics: {            technology_interest_level: 9,            music_interest_level: 6,            travel_interest_level: 4,        },        User: {            UserAttributes: {                firstName: [obj.firstname],                lastName: [obj.lastname],                country: [obj.country]            },            UserId: "user-20" //obj_id.toString()        },    },};pinpoint.updateEndpoint(params).promise().catch((er) => {    console.log(er);});return endpointID;      //res.status(200).end();    });FollowComment"

Answer: "2Thank you for sharing the sample code snippet. Please allow me to share my observations :-NotFoundException could occur in case if the resource being referenced could not be found. Therefore, Could you please verify whether the parameters such as Pinpoint Application ID (This identifier is displayed as the Project ID on the Amazon Pinpoint console), Region, Object etc. that are being passed are passed as expected ?Next, I tried using the following snippet in a Lambda function keeping your your code as a reference and I was able to successfully create/update an endpoint associated with the user ID: user-20. I simply added the try-catch block and await in front of the promise. The following is the sample Lambda function code I used at my end :-const AWS = require('aws-sdk');accessKeyId = process.env.ACCESS_KEY_ID,secretKey = process.env.SECRET_KEYAWS.config.update({    region: 'ap-southeast-2',    accessKey: accessKeyId,    secretAccessKey: secretKey,});const pinpoint = new AWS.Pinpoint({    accessKey: accessKeyId,    secretAccessKey: secretKey,    region: 'ap-southeast-2',    signatureVersion: 'v4',});exports.handler = async (event) => {const endpointAddress = '+91123456778'; // TODO: PLEASE ENTER ENDPOINT'S PHONE NUMBERconsole.log(">>>Endpoint Address: ", endpointAddress)  const endpointID = '1234';console.log(">>>EndpointID: ", endpointID)  // TODO: PLEASE ENTER THE ENDPOINT ID const params = {    ApplicationId: 'abcdefghijkl' // PLEASE ENTER YOUR APPLICATION ID,    EndpointId: endpointID ,    EndpointRequest: {        /* required */        Address: endpointAddress,        ChannelType: 'VOICE',        EndpointStatus: 'ACTIVE',        OptOut: 'NONE',        Location: {            Country: "IN"         },        Demographic: {            Make: 'Apple',            Platform: 'iOS'        },        EffectiveDate: '2022-08-11',        Attributes: {            Interests: ['Technology', 'Music', 'Travel'],            CampaignIdentifier: ['OB']        },        Metrics: {            technology_interest_level: 9,            music_interest_level: 6,            travel_interest_level: 4        },         User: {            UserAttributes: {                firstName: ["Dev"],                lastName: ["A"],                country: ["India"]            },            UserId: "user-20"        }        }    }try {   const res= await pinpoint.updateEndpoint(params).promise();   console.log(res);}catch(err){    console.log(err);}return endpointID;};Lastly, I verified that the updateEndpoint is working by using the CLI get-endpoint and get-user-endpoints operations and I could notice the endpoint details as a successful response.Having said that, in case you face further challenges, please feel free to open a support case with AWS using the following link.CommentShareSUPPORT ENGINEERDev_Aanswered 10 months ago0Accepted AnswerI am able to reslove the issue by some modificationsi used:AWS.config.update({    secretAccessKey: process.env.AWS_SECRET_ACCESS,    accessKeyId: process.env.AWS_ACCESS_KEY,    region: 'ap-southeast-2',  });const pinpoint = new AWS.Pinpoint();pinpoint.updateEndpoint(params, function (err, data) {      if (err) {        console.log('An error occurred.\n');        console.log(err, err.stack);      } else {        console.log(          'Endpoint added Successfully with endpoint ID ' + endpointID        );      }    });No need to add credentials in pinpoint object while creation.CommentShareAbdul Qayyumanswered 10 months ago"


Question: S3 Access Denied error when running Greengrass V2 device tester (IDT)

"While running IDT for my gateway device, I got the following error for StreamManager component:com.amazonaws.services.s3.model.AmazonS3Exception: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: XXXXXXXXXXXXXXX S3 Extended Request ID: XXXXXXXXXXXXXXX=; Proxy: null). {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING} IDT script is creating the roles and s3 buckets on the fly. So its not east to debug via aws console. So I checked cloudtrail. But it seems data events (s3 upload) is not logged in cloudtrail. How can I investigate further ?FollowComment"

Answer: "0Hello,CloudTrail Event History feature supports only management events. The data events do not show up in Event History and they are sent to the S3 bucket directly that is configured for logging the CloudTrail events. I would suggest you to configure your cloudtrail to enable S3 data logging. You can enable data logging by following the steps given in the documentation[1].Once the data logging is enabled, you would be able to see the S3 data events being sent in the s3 bucket, that will help to understand which specific S3 API call is getting denied and according to that we can check permission on the role/user calling that API.In case you require resource specific troubleshooting, feel free to raise a case with AWS support team[2].Reference[1]https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html[2]https://us-east-1.console.aws.amazon.com/support/home?region=us-east-1#CommentShareSUPPORT ENGINEERAWS-User-6158549answered a year ago0Is the proper permissions configured for the role you are using when running IDT?You can find what permissions your role needs in Step 2: Configure permissions for IDT there is a permission block called s3Resources which lists all the permissions IDT needs.https://docs.aws.amazon.com/greengrass/v2/developerguide/dev-tst-prereqs.htmlAnother possible cause is the stream manager might be using the wrong credentialsfor more information you can look at Stream manager qualification errors inhttps://docs.aws.amazon.com/greengrass/v2/developerguide/idt-troubleshooting.html#stream-manager-qualification-failureCommentShareAws-Tiancianswered a year ago"


Question: NotifyWorkers privacy

"I'm using the NotifyWorkers API call to send a mass email about an issue in a HIT I posted recently. The HIT was a research study, so the privacy of the participants needs to be preserved -- i.e., it's important that in a mass email, workers can't see each other's IDs. Does anybody know if NotifyWorkers does bcc, or in some other way hides the recipients list from recipients? Thank you!FollowComment"

Answer: "0Hello!The NotifyWorkers operation sends a message directly to a Worker, it doesn't BCC other Workers in the message that you send. However, please note that when you send a message to Workers, your email address will be provided to them as a source of the message. They will be able to reply to that email from their own email address if they choose to.If you have any other questions or concerns, please don't hesitate to contact our support team (https://support.aws.amazon.com/#/contacts/aws-mechanical-turk).-Adam JCommentShareSammieJ-AWSanswered 3 years ago0Thank you so much for the quick and helpful response! To clarify: passing in a list of workers results in an individual email being sent to each one?CommentSharesirandtherobotsanswered 3 years ago0Hey again!passing in a list of workers results in an individual email being sent to each one?That's correct; the message won't be sent as an email blast like you'd expect through an email provider with a bunch of recipients in a single email. You're essentially running a command saying to send a message to an individual Worker, but having that command repeat for each Worker you've listed.-Adam JCommentShareSammieJ-AWSanswered 3 years ago"


Question: RDS Write IOPS quadrupled after database restart

"Hello,our setup:RDS db.m4.large, MySQLTwo weeks ago we had to restart our database (2018-04-07, 19:30 UTC). After the restart our Write IOPS increased drastically without any other changes: we don’t have more traffic, we don’t have more write queries. The only thing we did was exactly this restart.As you can also see in this screenshot from CloudWatch (https://my.hidrive.com/lnk/vPJFq34A, blue is the master, green is the read replica): before the restart, our read replica always had the same levels of Write IOPS. After the restart, the Write IOPS on the master database are 2 - 4 times as high as on the read replica. This makes absolutely no sense to us and we need help urgently.We’ve already looked into all other RDS metrics and nothing else has changed (not Queue Depth, not Read IOPS, not Write Throughput).The only thing we see is, that the Read Latency increased from 0,5 ms to 0,8 ms.Also very interesting (screenshots https://my.hidrive.com/lnk/VpJFKWvM, https://my.hidrive.com/lnk/cEpFKJJ1): when we look at the „Enhanced Monitoring“ metrics, the Write IO/s always correlated with the data in CloudWatch before the restart. And now, after the restart, the metrics in Enhanced Montoring are still on the same level like before the restart and do not correlate with the CloudWatch statistics anymore.We’ve already tried to restart our database once again with no effect.Questions:Why did our Write IOPS explode after the restart?Why are our Write IOPS not at the same level like the read replica like before the restart?Why do the Write IOPS not correlate with the Write IO/s in Enhanced Monitoring.Thank you very much for your help.Edited by: r123 on Apr 20, 2018 7:30 AMFollowComment"

Answer: "0Did the performance change? Or just the iops have increased?The first thing to look at is if the throughput changed or not? If the throughput has not changed, it is also likely that the average io size is smaller.Please send me the instance identifier and the region.thanks,CommentShareMODERATORphilawsanswered 5 years ago0Hello Phil,thank you for your answer.Regarding your questions:_ The Performance did not change._ The throughput also hasn't changed.What do you mean by average IO Size? Why would this change with a database restart and why should the average IO size be different on the master database compared to the read replica database?I've sent you the instance identifier and region in a private message.Best regards.Edited by: r123 on Apr 26, 2018 9:03 AMCommentSharer123answered 5 years ago0Hi r123,I experienced a similar issue after modifying my database instance from db.r3 to db.r4 instance type, including an identical discrepancy between the CloudWatch and the Enhanced Monitoring metric. I followed up with AWS Support and received confirmation that there is a known issue affecting the AWS RDS WriteIOPS metric reported in CloudWatch of db.m4 and db.r4 instance types. No ETA on a fix.CommentSharewillcodeorganswered 5 years ago"


Question: Bitnami bncert-tool failing on trying to enable auto renewal of ssl certificate

"On my lightsail instance I have tried to use the bncert-tool to setup an SSL cert, but it fails on the final part which is enabling auto-renewal. I got it working by manually renewing it https://aws.amazon.com/premiumsupport/knowledge-center/lightsail-bitnami-renew-ssl-certificate/ (It kept renewing successfully but would not show on the website, except for the first time, which I have no idea why?2023/03/16 22:59:39 [INFO] [MYDOMAIN] acme: Trying renewal with 2158 hours remaining2023/03/16 22:59:39 [INFO] [MYDOMAIN] acme: Obtaining bundled SAN certificate2023/03/16 22:59:39 [INFO] [MYDOMAIN] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/2023/03/16 22:59:39 [INFO] [MYDOMAIN] acme: authorization already valid; skipping challenge2023/03/16 22:59:39 [INFO] [MYDOMAIN] acme: Validations succeeded; requesting certificates2023/03/16 22:59:40 [INFO] [MYDOMAIN] Server responded with a certificate.And now I've reached the limit of 5 certs) but then I tried to use bncert again and now no method is working. But regardless I would like to get the automatic method working if possible.Domain MYDOMAIN did not pass HTTP challenge validationhttps://docs.bitnami.com/google/how-to/understand-bncert/#certificates-not-renewed-automaticallyThis page lists a solution but I still can't manage to get it working. I'm not sure if I have set the flags in the correct place?  RewriteCond %{REQUEST_URI} !^/\.well-known  ProxyPass /.well-known !I placed them in my virtual host filesmyapp-https-vhost.conf  <VirtualHost _default_:443>  RewriteCond %{REQUEST_URI} !^/\.well-known    ServerAlias *    SSLEngine on    SSLCertificateFile "/opt/bitnami/apache/conf/MYDOMAIN.crt"    SSLCertificateKeyFile "/opt/bitnami/apache/conf/MYDOMAIN.key"    DocumentRoot "/home/bitnami/htdocs/staging-api"    <Directory "/home/bitnami/htdocs/staging-api">      Require all granted    </Directory>    ProxyPass /.well-known !    ProxyPass / http://localhost:3000/    ProxyPassReverse / http://localhost:3000/  </VirtualHost>myapp-http-vhost.conf  <VirtualHost _default_:80>  RewriteCond %{REQUEST_URI} !^/\.well-known    ServerAlias *    DocumentRoot "/home/bitnami/htdocs/staging-api"    <Directory "/home/bitnami/htdocs/staging-api">      Require all granted    </Directory>    ProxyPass /.well-known !    ProxyPass / http://localhost:3000/    ProxyPassReverse / http://localhost:3000/  </VirtualHost>I also placed it in the public/.htaccess file because someone suggested it should go there.    Options -MultiViews    RewriteEngine On    RewriteCond %{REQUEST_FILENAME} !-f    RewriteRule ^ index.html [QSA,L]    RewriteCond %{REQUEST_URI} !^/\.well-knownNot really sure where these flags are meant to go`FollowComment"


Question: 401 AuthenticationException when trying to call API endpoints of OpenSearch Serverless collection from within a VPC

"I have set up OpenSearch Serverless collections in our two non-production accounts and have verified that our Python app, running in ECS, can call its API using opensearch-py.Today, I tried to replicate the same setup in our production account but cannot successfully connect to its endpoint using opensearch-py. I have double-checked that..Network access policy allows VPC access using the VPC endpoint (created in the app's VPC) against the collection's endpoint and that network reachability analyzer can find a network path from a running container's ENI to the VPC endpointData access policy allows the correct role to perform all operations on the collection and all indicesOne oddity that I noticed is the VPC endpoint that I created is gone from OpenSearch Serverless console's list of VPC endpoints. It's not there in AWS CLI's output either:aws opensearchserverless list-vpc-endpoints {    "vpcEndpointSummaries": []}In our non-production accounts, the VPC endpoint is listed in the command output.I was able to find the VPC endpoint in the production account's VPC console, so I tried re-creating it. I was able to see it in OpenSearch Serverless console right after it was created, but it's gone again.The collection is configured to allow public access to Dashboards and I can log in to it using the link found in OpenSearch Serverless console and run queries using the dev tools.What could be the cause of the 401 error? What can I look into further?Python code I used to try to connect to the collection in production:>>> import os, boto3>>> from opensearchpy import OpenSearch, RequestsHttpConnection, AWSV4SignerAuth>>> host = REDACTED>>> service, region = ('aoss', 'us-west-2')>>> credentials = boto3.Session().get_credentials()>>> auth = AWSV4SignerAuth(credentials, region, service)>>> client = OpenSearch(    hosts=[{'host': host, 'port': 443}],    http_auth=auth,    use_ssl=True,    verify_certs=True,    connection_class=RequestsHttpConnection,    pool_maxsize=20,)>>> q = "miller">>> query = {  'size': 5,  'query': {    'multi_match': {      'query': q,      'fields': ['title^2', 'director']    }  }}>>> client.search(query)Traceback (most recent call last):  File "<stdin>", line 1, in <module>  File "/usr/local/lib/python3.7/site-packages/opensearchpy/client/utils.py", line 178, in _wrapped    return func(*args, params=params, headers=headers, **kwargs)  File "/usr/local/lib/python3.7/site-packages/opensearchpy/client/__init__.py", line 1556, in search    body=body,  File "/usr/local/lib/python3.7/site-packages/opensearchpy/transport.py", line 408, in perform_request    raise e  File "/usr/local/lib/python3.7/site-packages/opensearchpy/transport.py", line 376, in perform_request    timeout=timeout,  File "/usr/local/lib/python3.7/site-packages/opensearchpy/connection/http_requests.py", line 222, in perform_request    response.headers.get("Content-Type"),  File "/usr/local/lib/python3.7/site-packages/opensearchpy/connection/base.py", line 302, in _raise_error    status_code, error_message, additional_infoopensearchpy.exceptions.AuthenticationException: AuthenticationException(401, '')FollowComment"

Answer: "0Accepted AnswerI recalled that the OpenSearch Serverless console gave an error about not having permission to perform route53:AssociateVPCWithHostedZone, so I went to look how Route53 looked in one of the non-production accounts. There was one private hosted zone with the domain name us-west-2.aoss.amazonaws.com, and in the production account, there was none.I gave my user full access to Route53 by attaching the AmazonRoute53FullAccess policy, deleted the existing VPC endpoint through the VPC console, and recreated it in OpenSearch Serverless console. This made the 401 error go away, the hostname of the collection to resolve to a private IP address, and created a similar hosted zone in Route53.CommentSharemaodaganswered 2 months ago0401 is specific to authorization issue, can you double check if you have the data access policy added to the collection and index which you are trying to access from your  python app?Also, I see some issue related to VPC endpoint, so is that working fine or you are still having an issue with it in your prod collection? Also, can you open AWS support ticket so as we can help you better through that channel?CommentSharePrashant Agrawalanswered 2 months agomaodag 2 months agoI found that enabling public access to the collection's endpoint in the network policy allowed the Python code to connect successfully. So I believe the data access policy is configured correctly.The VPC endpoint is still missing from OpenSearch Serverless console. When I tried to traceroute to it from within an ECS container, the IP address resolved to 52.x.x.x. When I tried the same in one of the non-production envs, it resolved to 10.x.x.x. So there definitely seems to be an issue with the VPC endpoint setup. I'll see if I can open a support ticket.Sharemaodag 2 months agoI was not able to open a support ticket as our account is on the basic support plan, but I was able to fix it by giving my user full access to Route53 and re-creating the VPC endpoint. I'll post this as a separate answer.Share"


Question: Read VPC flow logs on S3 bucket with Athena

"I'm trying to use Athena to generate queries from VPC flow logs stored in an S3 bucket. I followed the guideline of "Querying Amazon VPC flow logs"[1], and I tried to access by both folders and files.However, the generated queries were empty, with only title and no contents. I double checked that the files are not empty, and that the path is correct. I also tried to create partitions, but the results were unreadable.Is there a way to access the contents of the S3 bucket? Thank you!FollowComment"

Answer: "1Accepted AnswerThis article has generic info applicable to VPC Flow Logs, especially about partiioning and querying - https://www.linkedin.com/pulse/using-athena-partition-projection-query-cloudtrail-other-kinsman/.It's hard to be sure from the image you pasted, but it looks like you've both set LOCATION to a specific date "2023/03/01/" and partitioned by date?  That doesn't look right.What query did you try?CommentShareEXPERTskinsmananswered 2 months agorePost-User-5456986 2 months agoI tired both "s3://.../2023/" and "s3://.../2023/03/01/". They return the same results. I just did it again and I'll add the screenshot in the original post.I tried the "ALTER TABLE vpc_flow_logsADD PARTITION (date='YYYY-MM-dd')LOCATION ..." query but the results were unreadable.I'm trying out the LinkedIn article right now.Thanks!SharerePost-User-5456986 2 months agoShould have used s3://.../{location}/Share"


Question: Malfunctioning Application LoadBalancer / Doesn't execute the rules

"I have an application load balancer which is an internal-facing load balancer, this load balancer doesn't evaluate rules at all, it only executes one rule (and the default rules) no matter what the Host/rule URL is.setup:Route53:hosted on AWSDomain x.com (public and private) are pointing to myLB, CNAME records not aliasesLoadBalancer:application load balancerschema: an internal-facing load balancer (with 2 public subnets associated with it)multiple rules based on different subdomains (different host URLs)443 and 80 listeners.redirect all 80 to 443rules limit increased to 200The Problem:LoadBalancer only executes the rule for x.x.com, when I try y.x.com it also executes x.x.com, if I removed x.x.com rule it will only execute the default rule, I do not know why it ignores all other rules.what can be the issue?FollowComment"


Question: Instance i-d7013076 was stuck. I thought software problem. Stopped. Now stuck at stopping.

As per this https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-stuck-stopping-state/ it seems this could be an underlying hardware failure.How can I alert AWS team that this hardware might be failing?FollowComment

Answer: "0It stopped alone (I did not have to do anything else other than wait ~1/2h).I started it and seems to work.So, for me there's no problem, now.Nevertheless I still want to raise the alert for the AWS crew to review if there's any HW problem that might affect other AWS clients.CommentShareXavi Monteroanswered 9 months ago"


Question: DocumentDB Elastic Cluster - Change Streams

"I have a DocumentDB Elastic Cluster and I am attempting to enable change streams on it.I followed the steps provided here: https://docs.aws.amazon.com/documentdb/latest/developerguide/change_streams.htmlBut I receive the following error when attempting to execute the adminCommand:Unknown admin command modifyChangeStreamsAre change streams supported on Elastic Clusters? If so, what am I doing wrong?FollowComment"

Answer: "2Amazon DocumentDB clusters with auto-scaling enabled, including DocumentDB Elastic Clusters, do not currently support change streams. This could be why you're getting an error when attempting to run the admin command modifyChangeStreams.You could use a non-elastic Amazon DocumentDB cluster or disable auto scaling on your Elastic Cluster if you want to use change streams. You could also use another database service that supports change streams, such as MongoDB Atlas or self-managed MongoDB.CommentShareEXPERTsdtslmnanswered a month ago"


Question: (CDK) How to change subnets' routetables

"I'm trying to define custom CfnRouteTable for subnets in the VPC to use, because it's redundant and inefficient for each subnet to have its own RouteTable.However, it appears the RouteTable property for ISubnet is read-only. How is it supposed to be done?Edited by: icelava on Jul 27, 2021 12:29 AMFollowComment"

Answer: "0Don't know if this is the proper way or not, but had to go through quite a convoluted way to re-associate the subnets to another routetable.Sample procedure.// Custom route table and routes.var customRtName = "CustomRouteTable";var elbRouteTable = new CfnRouteTable(vpc, customRtName,new CfnRouteTableProps{VpcId = vpc.VpcId,});elbRouteTable.Node.AddDependency(vpc.PublicSubnets);elbRouteTable.Node.AddDependency(vpc.IsolatedSubnets);// Looks like the ultimate name given to the custom RouteTable won't have "CustomRouteTable" in the output template;  // only goes as far as its parent scope "Ec2SetupStack/cdk_ec2_vpc"; it has to be manually revised.  var revisedName = vpc.Stack.StackName _ "/" _ vpc.Node.Id _ "/" _ customRtName;  Amazon.CDK.Tags.Of(elbRouteTable).Add("Name", revisedName);  var internetRoute = new CfnRoute(elbRouteTable, "InternetRoute",  new CfnRouteProps  {      RouteTableId = elbRouteTable.Ref,      DestinationCidrBlock = internetCidr,      GatewayId = vpc.InternetGatewayId  });  internetRoute.Node.AddDependency(elbRouteTable);  this.ReAssociateRouteTable(vpc, vpc.PublicSubnets, elbRouteTable);  this.ReAssociateRouteTable(vpc, vpc.IsolatedSubnets, elbRouteTable);  }private void ReAssociateRouteTable(Construct scope, ISubnet[] subnets, CfnRouteTable routeTable){foreach (var subnet in subnets){var routeTableAssoc = new CfnSubnetRouteTableAssociation(scope, subnet.Node.Id _ "_" _ routeTable.Node.Id,new CfnSubnetRouteTableAssociationProps{SubnetId = subnet.SubnetId,RouteTableId = routeTable.Ref});}}Edited by: icelava on Jul 27, 2021 2:29 AM - add routetable dependency on subnets to avoid association conflict on deploying brand new stack.CommentShareicelavaanswered 2 years ago"


Question: 502 Bad Gateway on EC2

Last week an application hosted on aws ec2 started responding with a 502 bad gateway error. Nothing changed about the files hosted or any of the settings of the instance that should cause this. In fact you can brute force log in to the application if you have the patience to keep reloading the address. I do not know how to begin to address this situation.FollowComment

Answer: "1Two possibilities:If you're running a load balancer then it will return a 502 error to the client if the instance(s) in your target group(s) are not available.If you're running a single instance then a 502 error means that you've connected successfully to the instance but the web server software (Apache, IIS, etc) is not configured correctly. In this case, if it is intermittent then there is some issue on the instance itself. Check the log files and see what is happening.CommentShareEXPERTBrettski-AWSanswered 7 months agoEXPERTIndranil Banerjee AWSreviewed 7 months ago"


Question: How to redirect a local COM serial port to a EC2 Instance via RDP.

"I`m having a problem with the redirect via RDP the COM ports to a EC2 Instance with Windows Server 2019.The permissions have granted, and i have marked the Redirect in RDP.But in the Instance the ports dont appear. I think its possible need one more config to make in EC2 Manager, but i dont found in any place.Someone can help me with this?FollowComment"


Question: DynamoDB: query nested items from a map

"I have this data in our DynamoDB:  "stateHistory": {    "L": [      {        "M": {          "state": {            "S": "confirmed"          },          "timestamp": {            "N": "1628579118359"          }        }      },      {        "M": {          "state": {            "S": "active"          },          "timestamp": {            "N": "1628579118988"          }        }      },      {        "M": {          "state": {            "S": "finished"          },          "timestamp": {            "N": "1628579251554"          }        }      },      {        "M": {          "state": {            "S": "archived"          },          "timestamp": {            "N": "1628583091657"          }        }      }And now we want to put all of those states into a txt output file. We tried it like this:aws --profile odm-ss dynamodb scan --table-name booking.history_booking --query "Items[*].[bookingId.S,(stateHistory.L.0.M.state.S)] " --output text> data.txtBut get this error:Bad value for --query Items[].[(stateHistory.L.0.M.state.S)]: Expecting: ['quoted_identifier', 'unquoted_identifier', 'lbracket', 'lbrace'], got: number: Parse error at column 26, token "0" (NUMBER), for expression:"Items[].[(stateHistory.L.0.M.state.S)]"^Any suggestions on how to fetch the states from this map using AWS CLI?FollowComment"

Answer: "1Hi,The Scan command you are looking for looks like this:aws dynamodb scan --table-name cust --query 'Items[*].stateHistory.L[*].M.state'aws dynamodb scan --table-name cust --query 'Items[*].stateHistory.L[*].M.state'[    [        {            "S": "confirmed"        },        {            "S": "active"        },        {            "S": "finished"        },        {            "S": "archived"        }    ]]Or you can narrow it down further with:aws dynamodb scan --table-name cust --query 'Items[*].stateHistory.L[*].M.state.S' --output textaws dynamodb scan --table-name cust --query 'Items[*].stateHistory.L[*].M.state.S' --output textconfirmed       active  finished        archivedCommentShareEXPERTLeeroy Hannigananswered a year ago0Thank you! Exactly what I needed! 👍I modified it slightly, so that the output in the text is easy to process via Excel:...,(stateHistory.L[0].M.state.S),(stateHistory.L[1].M.state.S),(stateHistory.L[2].M.state.S),(stateHistory.L[3].M.state.S),(stateHistory.L[4].M.state.S)]" --output text> data.txtFollow-up question: How do I add headlines to each data field of the data.txt automatically so that I can use them as column names in Excel afterwards? 🤔CommentShareroxiduraanswered a year ago"


Question: Lightsail instance keep going down again and gain

"This is a repost of: https://forums.aws.amazon.com/thread.jspa?threadID=269360&start=50&tstart=0Basically, Lightsail Instances will go down after a while, this happened to me with multiple WordPress or Prestashop Instances. As soon as there are more than one user in the backend the machine will go down after some time. Monitoring shows that CPU capacity and burst capacity is gone. A soon as this is the case, you can't even reach the machine via SSH, it's basically dead and so is the service you want to provide for maybe your customers ...Now when you realize your 3.5$ plan is not sufficient, there's no way to update the plan afaik, you have to create an image from your machine, create a new instance and import the old image :/And then do that again if 5$ is not enough either ...The problem is, how can I know this beforehand when setting up a machine? It is absolutely not feasible to use the 40$ monthly plan just in case you might run into some problems like this.I have another Provider charging 10$ per month and I'm running 2 Shops and 5 Wordpress Installations and multiple other web apps on that one machine ... no problems everAm I doing anything wrong? Is there any fix to that Problem?FollowComment"

Answer: "1Unfortunately, at least according to the latest documentation, you're running into a limitation of LightSail instance types and functionality.For the CPU - If you can either add WP caching, or DB indexes, or something like that, you may be able to reduce the amount of load on the instance, which would hopefully keep the overall amount of CPU from bursting for too long, and subsequently hamstringing your server to the point that it is unusable.  Newer EC2 instances have a thing called unlimited burst, which, for an extra charge, allows your instance to sustain higher activity even after you run out of credits, but it doesn't look like those have found their way to the LightSail platform yet.For the plan upgrades - Yeah, making you snapshot and upgrade your instance instead of offering sliders or some other automated upgrade version is less than desirable.  Unfortunately, this is another limitation imposed by the tech it's using under the hood.   That's not to say that it can't be done, just that they haven't implemented anything to address it yet.I wish I had a better response, and I hope they address this soon.  The other option is to move away from LightSail and use AWS EC2, and choose an instance type that offers more consistent performance.CommentSharedozenyommeranswered a year agoAWS-User-4990492 a year agoThanks for your response! I came to a more or less similar conclusion.It's just the thing that lightsale as a product offers "click & go" easy to use and setup Software as a Service with pre-configured stacks (WordPress, Prestashop, etc.). However, if it can't even uphold that for a simple use case at a 3.5$ plan, it should not be offered in the first place IMHO. I had a couple of instances set up for my students to play with and create online shops and websites and after 3 weeks almost all machines were not usable anymore, quite a pain in the lower back.It's also a bit strange, that the 3.5$ plan with 512MB and 1 Core is not enough and bringing the machine to a halt so quickly. I've dealt with webservers quite some time and that hardware usually should be sufficient for small 3-tier web applications like WP, etc. ?So my conclusion would be to only use the 3.5$ (and 5$) plan to do some fiddling and just "checking out" with a web stack.ShareAWS-User-7823150 a year agoI have same issue.  My instance keeps going down every two or three days.  I don't see any burst in the metric graph. https://imgur.com/ewaGlJU.  The dips of the remaining burst capacity shown in this chart were caused by rebooting.Share1I am currently facing exactly the same problem. Everything seems to be running fine and all of sudden the url is inaccessible. Only fix is to stop the Wordpress instance and start it again. Looking into the metrics I see it's CPU is around 2-3% and all of sudden bursts tot 20%+. The website has very little traffic. I'm getting pretty frustrated here as after reading this thread, I get the idea its an ongoing issue with Lightsail since 2017... Now looking into options of moving from AWS as I can't keep having this.CommentShareVinceanswered a year ago1I have same issue with the 1G plan (WordPress installed).The CPU usage stays under sustainable zone, and remaining burst capacity stays at 100%.  Every two or three days the instance just downs.  I don't see the burst at all, and memory usage is less 50%.CommentShareAWS-User-7823150answered a year ago0Still an issue. I'm not sure the point of Lightsail. I thought it would be reliable.CommentSharerePost-User-9349554answered 22 days ago"


Question: AWS SCPs With Tags Not Working

"Hello,I tried to follow the example in https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_ec2-start-stop-tags.html.{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "StartStopIfTags",            "Effect": "Allow",            "Action": [                "ec2:StartInstances",                "ec2:StopInstances",                "ec2:DescribeTags"            ],            "Resource": "arn:aws:ec2:region:account-id:instance/*",            "Condition": {                "StringEquals": {                    "ec2:ResourceTag/Project": "DataAnalytics",                    "aws:PrincipalTag/Department": "Data"                }            }        }    ]}But the Policy editor keep complaining with error "The provided policy document does not meet the requirements of the specified policy type.".Please take note that I copied this directly from the documentation.But when the Effect is changed to 'Deny', it accepts it.. Any idea why this is so?FollowComment"

Answer: "0Hello,Currently you can only use resources and conditions in your SCPs with Deny statements. Your policy is an Allow policy, which does not support those policy elements. See the docs here: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_scp-syntax.htmlYou should be able to invert the statements in the policy to create the same effect. For example, you can use NotAction instead of Action and use StringNotEquals instead of StringEquals in your policy condition.Thanks,MikeCommentShareAWS-User-3189880answered 4 years ago0Hi,MikeS-aws gave the correct answer below.. so removing my comment :-)Edited by: RandyTakeshita on Sep 20, 2019 11:03 AMCommentShareRandyTakeshitaanswered 4 years ago0Thanks for the response.. it works nowCommentShareinfinitydonanswered 4 years ago"


Question: Configure log steams from beanstalk using the new format?

"hi.. i've managed to configure cloudwatch logs using the sample config found here https://github.com/awsdocs/elastic-beanstalk-samples/blob/master/configuration-files/aws-provided/instance-configuration/logs-streamtocloudwatch-linux.configbut the reference https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AgentReference.html says that this is an old cloudwatch agent and suggest moving to a unified cloudwatch agent, which makes me somewhat confused.. is it the same rule for beanstalk? the docs don't seem to be that clear for the new agent.do i still need to place it in the .ebextension?FollowComment"

Answer: "0The older CloudWatch Logs agent, supports the collection of logs from only servers running Linux. If you're already using that agent, you can continue to do so. However, the older agent requires Python 2.7, 3.0, and 3.3. Because current EC2 instances do not use those versions of Python and those versions are deprecated and are no longer being patched, AWS strongly recommend that you migrate to the unified CloudWatch agent.Elastic Beanstalk integration with CloudWatch Logs doesn't directly support the streaming of log files that your application generates. So I am assuming that you are trying to log custom files and not the defaults called out per platform within the AWS docs.If your need is specific to custom logs then install the unified agent through use of an ebextension that simply installs the amazon-cloudwatch-agent package. If you are not familiar with customising the agent a quick and easy way is to run the wizard. You can then have an ebextension start the agent using a saved version that the wizard generated or even start the agent and reference the configuration from the SSM Parameter Store which the wizard can upload config files to.CommentShareRoBanswered a year agoElhananAWS a year agodo i need to install the agent the same way i did with the old one? i'm not familiar with ebextension but looking at the sample file it looks a little similar to ansible script where it actually downloads and install via yum, then writes the config file from scratch, would i need to do the same here as well? can i install the wizard on my own workstation just generate the file? (can i install it on windows to generate configs it for linux machines? does a beanstalk role need to include the CloudWatchAgentServerPolicy for it to be usedShare"


Question: Required Advise for Cloud Security Assessment

"HI there, is it good to find out these questions before conducting a IT security assessment on the cloud?What is the type of cloud services that is required to be testeda.Infra as a Service – Amazon, Rackspaceb.Software as a Service – component required to run the app is supplied, tenant will supply the appc.Platform as a Service – Salesforce, mailchimp2.Is there root access provided for the IaaS?3.Are you using an on-premise tools or a cloud based for VA?4.Are you using the CSP provider for other purpose rather than hosting a website? (Containers, Kubernetes, Dockers)5.For the API are you using different cloud service provider?FollowComment"

Answer: "0I am not sure exactly what your question is, but it appears you may be going through a CSA Star assessment. AWS goes through several security/compliance assessments each year (https://aws.amazon.com/compliance/services-in-scope/) including CSA Star (https://aws.amazon.com/compliance/iso-certified/). Have a look at the links and if you can clarify your question I can try to be more specific.CommentShareJeff Montgomeryanswered a year ago"


Question: Cloudfront CLI error when using template to generate Response Header policy (CreateResponseHeadersPolicy)

"Hi,I'm using the official cloudfront provided response yaml to generate a response header policy and it is not working, it gives an error:"An error occurred (InconsistentQuantities) when calling the CreateResponseHeadersPolicy operation: The specified quantity of Allow Origin (0) does not match the actual quantity supplied (1)."I am using the CLI option here https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/creating-response-headers-policies.html and using the commandaws cloudfront create-response-headers-policy --generate-cli-skeleton yaml-input > response-headers-policy.yamlI then edit the .yaml and try to generate (step 3) but i get an error*I have tried with my edited template and the stock provided template (no modifications) but it still gives that error. *Can anyone provide insight?Here is my edited templateResponseHeadersPolicyConfig:  # [REQUIRED] Contains metadata about the response headers policy, and a set of configurations that specify the response headers.  Comment: 'Custom Security Headers Policy'  # A comment to describe the response headers policy.  Name: 'BlockXFrames-SecurityHeadersPolicy' # [REQUIRED] A name to identify the response headers policy.  CorsConfig: # A configuration for a set of HTTP response headers that are used for cross-origin resource sharing (CORS).    AccessControlAllowOrigins:  # [REQUIRED] A list of origins (domain names) that CloudFront can use as the value for the Access-Control-Allow-Origin HTTP response header.      Quantity: 0  # [REQUIRED] The number of origins in the list.      Items: # [REQUIRED] The list of origins (domain names).      - ''    AccessControlAllowHeaders: # [REQUIRED] A list of HTTP header names that CloudFront includes as values for the Access-Control-Allow-Headers HTTP response header.      Quantity: 0  # [REQUIRED] The number of HTTP header names in the list.      Items: # [REQUIRED] The list of HTTP header names.      - ''    AccessControlAllowMethods: # [REQUIRED] A list of HTTP methods that CloudFront includes as values for the Access-Control-Allow-Methods HTTP response header.      Quantity: 0  # [REQUIRED] The number of HTTP methods in the list.      Items: # [REQUIRED] The list of HTTP methods.      - POST    AccessControlAllowCredentials: true # [REQUIRED] A Boolean that CloudFront uses as the value for the Access-Control-Allow-Credentials HTTP response header.    AccessControlExposeHeaders: # A list of HTTP headers that CloudFront includes as values for the Access-Control-Expose-Headers HTTP response header.      Quantity: 0  # [REQUIRED] The number of HTTP headers in the list.      Items: # The list of HTTP headers.      - ''    AccessControlMaxAgeSec: 0 # A number that CloudFront uses as the value for the Access-Control-Max-Age HTTP response header.    OriginOverride: true # [REQUIRED] A Boolean that determines whether CloudFront overrides HTTP response headers received from the origin with the ones specified in this response headers policy.  SecurityHeadersConfig: # A configuration for a set of security-related HTTP response headers.    XSSProtection:  # Determines whether CloudFront includes the X-XSS-Protection HTTP response header and the header’s value.      Override: false  # [REQUIRED] A Boolean that determines whether CloudFront overrides the X-XSS-Protection HTTP response header received from the origin with the one specified in this response headers policy.      Protection: true # [REQUIRED] A Boolean that determines the value of the X-XSS-Protection HTTP response header.      ModeBlock: true # A Boolean that determines whether CloudFront includes the mode=block directive in the X-XSS-Protection header.      ReportUri: '' # A reporting URI, which CloudFront uses as the value of the report directive in the X-XSS-Protection header.    FrameOptions: # Determines whether CloudFront includes the X-Frame-Options HTTP response header and the header’s value.      Override: true  # [REQUIRED] A Boolean that determines whether CloudFront overrides the X-Frame-Options HTTP response header received from the origin with the one specified in this response headers policy.      FrameOption: DENY # [REQUIRED] The value of the X-Frame-Options HTTP response header. Valid values are: DENY, SAMEORIGIN.    ReferrerPolicy: # Determines whether CloudFront includes the Referrer-Policy HTTP response header and the header’s value.      Override: false  # [REQUIRED] A Boolean that determines whether CloudFront overrides the Referrer-Policy HTTP response header received from the origin with the one specified in this response headers policy.      ReferrerPolicy: strict-origin-when-cross-origin # [REQUIRED] The value of the Referrer-Policy HTTP response header. Valid values are: no-referrer, no-referrer-when-downgrade, origin, origin-when-cross-origin, same-origin, strict-origin, strict-origin-when-cross-origin, unsafe-url.    ContentSecurityPolicy: # The policy directives and their values that CloudFront includes as values for the Content-Security-Policy HTTP response header.      Override: true  # [REQUIRED] A Boolean that determines whether CloudFront overrides the Content-Security-Policy HTTP response header received from the origin with the one specified in this response headers policy.      ContentSecurityPolicy: frame-ancestors 'none' # [REQUIRED] The policy directives and their values that CloudFront includes as values for the Content-Security-Policy HTTP response header.    ContentTypeOptions: # Determines whether CloudFront includes the X-Content-Type-Options HTTP response header with its value set to nosniff.      Override: true  # [REQUIRED] A Boolean that determines whether CloudFront overrides the X-Content-Type-Options HTTP response header received from the origin with the one specified in this response headers policy.    StrictTransportSecurity: # Determines whether CloudFront includes the Strict-Transport-Security HTTP response header and the header’s value.      Override: false  # [REQUIRED] A Boolean that determines whether CloudFront overrides the Strict-Transport-Security HTTP response header received from the origin with the one specified in this response headers policy.      IncludeSubdomains: true # A Boolean that determines whether CloudFront includes the includeSubDomains directive in the Strict-Transport-Security HTTP response header.      Preload: true # A Boolean that determines whether CloudFront includes the preload directive in the Strict-Transport-Security HTTP response header.      AccessControlMaxAgeSec: 31536000 # [REQUIRED] A number that CloudFront uses as the value for the max-age directive in the Strict-Transport-Security HTTP response header.  CustomHeadersConfig: # A configuration for a set of custom HTTP response headers.    Quantity: 0  # [REQUIRED] The number of HTTP response headers in the list.    Items: # The list of HTTP response headers and their values.    - Header: ''  # [REQUIRED] The HTTP response header name.      Value: '' # [REQUIRED] The value for the HTTP response header.      Override: true # [REQUIRED] A Boolean that determines whether CloudFront overrides a response header with the same name received from the origin with the header specified here.  ServerTimingHeadersConfig: # A configuration for enabling the Server-Timing header in HTTP responses sent from CloudFront.    Enabled: true  # [REQUIRED] A Boolean that determines whether CloudFront adds the Server-Timing header to HTTP responses that it sends in response to requests that match a cache behavior that's associated with this response headers policy.    SamplingRate: 0.0 # A number 0–100 (inclusive) that specifies the percentage of responses that you want CloudFront to add the Server-Timing header to.FollowComment"


Question: Handler error when connecting lambda function to RDS database

"I am trying to follow the tutorial in https://docs.aws.amazon.com/lambda/latest/dg/services-rds-tutorial.html to connect a lambda function to my database. I did not create a database from the tutorial, as I am trying to connect to an existing database. Whenever I run the codeaws lambda invoke --function-name CreateTableAddRecordsAndRead output.txtI get the following error:{"errorMessage": "Handler 'handler' missing on module 'app'", "errorType": "Runtime.HandlerNotFound", "stackTrace": []}.I don't have any error with creating the lambda function. Does anyone know how I can fix this?FollowComment"

Answer: "1Try renaming handler(event, context) with lambda_handler(event, context) in app.pyCommentShareSandeepVudataanswered a year ago0you need to upload pymysql to your lambda fucntion as layer. Than you need to update your lamda script ....lambda_handler (event, context)CommentShareAWS-User-7537125answered a year ago"


Question: Authentication to AWS issue testing docker containers locally

"I am developing a container image for running on AWS Fargate and have successfully been able to authenticate to AWS from a dev-container using ecs-local-endpoints for authentication.Problem is that when we try to run that compiled image with docker locally it is not able to authenticate nor to connect to http://169.254.170.2/v3 which is the local URL for ecs-local-endpoints. I have checked that that URL is only accessible from dev-container, as it cannot connect from CMD, PowerShell or from the local container testing it with HTTP GET.Can you please provide a suggestion on how to overcome this problem? I understand this is done with docker compose, however, how can I do this when running a compiled version locally?ThanksFollowComment"

Answer: "1Have you followed these instructions? https://aws.amazon.com/blogs/compute/a-guide-to-locally-testing-containers-with-amazon-ecs-local-endpoints-and-docker-compose/Scenario Three: Testing a Container that uses Task Metadata endpointsThe Task Metadata endpoints are useful; they allow a container running on ECS to obtain information about itself at runtime. This enables many use cases; my favorite is that it allows you to obtain container resource usage metrics, as shown by this project.With Amazon ECS Local Container Endpoints, you can locally test applications that use the Task Metadata V2 or V3 endpoints. If you want to use the V2 endpoint, the Docker Compose template shown at the beginning of this post is sufficient. If you want to use V3, simply add another environment variable to each of your application containers:ECS_CONTAINER_METADATA_URI: "http://169.254.170.2/v3"This is the environment variable defined by the V3 metadata spec.Ensure you are also deploying the ecs-local-endpoints Image as well for your container to accessThe Amazon ECS Local Container Endpoints Docker Image    image: amazon/amazon-ecs-local-container-endpointsCommentShareGary Mcleananswered a month ago"


Question: Cannot delete the image version after deletion of the pipeline and all related components

"Hi Team,After deleting the pipeline and all related dependencies, e.g. recipe/components/instances etc. I can't delete the image itself. There is the following error:"aws imagebuilder delete-image --image-build-version-arn arn:aws:imagebuilder:us-east-1:355181800198:image/test/1.0.0/1An error occurred (ResourceDependencyException) when calling the DeleteImage operation: Resource dependency error: The resource ARN 'arn:aws:imagebuilder:us-east-1:355181800198:image/test/1.0.0/1' has a running workflow"From the AWS console, I can see that the version of the created image is still building. Considering the circumstances, it seems that it's an improper state and should be failed.Could you please help me with this?Thanks!FollowComment"

Answer: "0If you started it fairly recently, please wait for the build to fail and then try deleting it.CommentShareShivam_Ganswered a year ago"


Question: how to copy data and run training in sagemaker?

"i need to pull data from different sources and run processing then training jobs, I want to set it up such that , I spin up one or more ec2 instance , collect the data , copy it to some s3 , then use sagemaker api to create processing and training jobs. I want to do this via code, provisioning ec2 instances and the code to download data and running training and processing jobs, all of it. one question, i had was, once i download the data, can i copy the data directly to whatever data storage/volume comes attached with the sagemaker training/processing instance. I'm not sure what's it called . i know there are options to stream data? any thoughts. this would be my first training job , so apologies for basic question hereFollowComment"

Answer: "0Hello,Thank you for using AWS SageMaker.With regards to your question that you would like to know if there is any option to directly copy/download the data to SageMaker training job resource eliminating S3. Unfortunately due to architecture design, it is not possible to directly load/copy data onto underlying instance of SageMaker training job and users need to have training data stored on S3 bucket. To speedup the training process, we recommend using Pipe mode along your algorithm supports[1][2].Hope my above response helps you.Reference:[1] https://docs.aws.amazon.com/sagemaker/latest/dg/cdf-training.html[2] https://aws.amazon.com/blogs/machine-learning/using-pipe-input-mode-for-amazon-sagemaker-algorithms/CommentShareSUPPORT ENGINEERKartik_Ranswered 2 months agoclouduser 2 months ago@kartik_R - i might be wrong on this, but isn't code copied to /opt/... , inside the container where training runs. not sure about the data, but i was assuming similar thing for data as well, where it is copied locallyShare"


Question: S3 Batch Copy : Data Security over Transit

"Hello,Use Case:S3 Transfer data Cross Account: I want to transfer data across two buckets cross two accounts that are not owned by the same organization.ImplementationAs the data is going be residing in the same region, we are going to be using S3 Batch COPY.Why S3 Batch? because the destination user wants to be able to pull data whenever required due to certain restrictions. As S3 Replication will keep copying data as soon as it is uploaded to the S3 Bucket.Using Manifest.csv file located in the Source account. The source user will be updating the manifest.csv when new data is ready to be transferred across accounts.We have also limited the source bucket to Deny any requests that aren't over HTTPS (this was done by adding a deny statement with the condition  "aws:SecureTransport": "false")This solution is working and we are able to transfer data successfully across the buckets located in separate accounts.Queries:I have tried finding the answers for my questions below to no avail, its not mentioned in any document that I have gone through. Any help would be greatly appreciated.When using S3 Batch, is the data in transit secure? What I mean by this is thatIs it over Secure Line (like AWS's own backend private network?)Is the data encrypted over transit?Can S3 Batch COPY work Cross Regions Cross Account?Also the same question w.r.t S3 Replication, is the data in transit secure? What I mean by this is thatIs it over Secure Line (like AWS's own backend private network?)Is the data encrypted over transit?Below is a simple diagram of what I have setup currently,Thank you!!FollowCommentD G 13 days ago@rePost-User-1408429 Let me know if you have any issues with this, or if it helps you then please accept my answer after you've tried it out - it would be much appreciated! Good luck :)Share"

Answer: "0Hey @rePost-User-1408429Let me break this answer down in pieces.When using S3 Batch, is the data in transit secure? What I mean by this is thatIs it over Secure Line (like AWS's own backend private network?)Is the data encrypted over transit?Can S3 Batch COPY work Cross Regions Cross Account?Within this link Capital One and ePlus talk about using batch across regions.S3 Batch is fundamentally powered by S3 replication.Access to s3 can be provided via Privatelink Gateway or Interface. See Access AWS Batch using an interface endpoint for how to perform such over interface endpoint.I also looked to see if Batch supports in transit, my suggestion would be to first:a. apply concept from "Access AWS Batch using an interface endpoint"b. test if encryption in transit can be honored by applying items as discussed in this other re:Post link herePlease do give this a accepted answer if you feel thusly. Best of luck and please do let us know if this worked out!CommentShareD Ganswered 21 days ago"


Question: Table doesn't update.

"I'm creating a table with this query:CREATE TABLE test_1 ASSELECT id, created_at, transaction_type, customer_id, amount, description FROM "db_1"."transactions"WHERE (customer_id != xxxx AND customer_id != yyyy) AND transaction_type = 'type_4' AND description = 'Some Description'UNION ALLSELECT id, created_at, transaction_type, customer_id, amount, description FROM "db_1"."transactions"WHERE customer_id = xxxx AND (transaction_type = 'type_1'OR transaction_type = 'type_2' OR transaction_type = 'type_3')The query gets me what I need correctly, except that it doesn't update itself. The issue could be because I'm building a secondary table from the main table, but since the main table comes directly from an S3 bucket, when the bucket is updated, the main table updates as well. But the secondary table doesn't.So, what should I do differently? Make a reference to the S3 bucket instead of the tables? How would that look like?Thanks in advance for any suggestions.FollowComment"

Answer: "0CREATE TABLE AS does not update the underlying data. https://docs.aws.amazon.com/athena/latest/ug/create-table-as.htmlInstead try CREATE VIEW and the VIEW would be updated as the underlying data in the TABLE is updated. https://docs.aws.amazon.com/athena/latest/ug/create-view.htmlCommentShareAnanth Tirumanuranswered 6 months agoajpaezm_ug 6 months agoThank you ananthtm!For instance, to make my previous query work, I should replace "CREATE TABLE" with "CREATE OR REPLACE VIEW"?ShareAnanth Tirumanur 6 months agoyes, using "CREATE OR REPLACE VIEW" should address your question.Please upvote and/or accept answer so that it helps everyone in this forumShare"


Question: DB instance in AWS LightSail shows "unknown"

"My DB instance in AWS LightSail has gone into "unknown" state out of the blue. If I try choose the DB and click on manage, it says there is some issue with LightSail & you amazon is fixing it. But it has been showing the same thing for the last 4-5 hours.I cant even delete the instance.FollowComment"

Answer: "0Hello @Gkg,Thanks for using Lightsail.Please reach out to customer support and ask them to pass your case to the Lightsail team, we'll help you unblock the database instance.RegardsCommentShareRafael-AT-AWSanswered a year agoGkg a year agoHi,I did but they are asking me to create a snapshot. It is not possible for me create because when I click manage, it gives me an error. I am not able to do anything since the state is "unknown"ThanksSharerePost-User-9397802 9 months agoI am facing the same problem here. I Can not reach the DB can not Delete it or reboot.I raised a support case by No: 10603232891still pending.Can you please Unblock the DB Instance.ThanksShare"


Question: EC2 Instance saving plan

"Hi,  we have procured r5 (EC2 Instance savings plan) can this instance type be converted to r6i at later stage?ThanksFollowComment"

Answer: "0No. Please take a look at this https://aws.amazon.com/savingsplans/faq/ in particular this section -EC2 Instance Savings Plans provide the lowest prices, offering savings up to 72% in exchange for commitment to usage of individual instance families in a region (e.g. M5 usage in N. Virginia). This automatically reduces your cost on the selected instance family in that region regardless of AZ, size, OS or tenancy. EC2 Instance Savings Plans give you the flexibility to change your usage between instances within a family in that region. For example, you can move from c5.xlarge running Windows to c5.2xlarge running Linux and automatically benefit from the Savings Plans prices.So EC2 Instance Savings plans can be used if you want to move from let's say R5.XL to R5.2XL, but not from R5 to R6.You would have been better off purchasing the Compute Savings Plan if your need the additional flexibility, as that is possible with Compute Savings Plans as mentioned in the FAQCompute Savings Plans provide the most flexibility and help to reduce your costs by up to 66%. These plans automatically apply to EC2 instance usage regardless of instance family, size, AZ, region, OS or tenancy, and also apply to Fargate and Lambda usage. For example, with Compute Savings Plans, you can change from C4 to M5 instances, shift a workload from EU (Ireland) to EU (London), or move a workload from EC2 to Fargate or Lambda at any time and automatically continue to pay the Savings Plans price.CommentShareEXPERTIndranil Banerjee AWSanswered 8 months ago"


Question: Limit Increase: EC2 Instances

"Case ID: 6986531161Limit increase request 1Service: EC2 InstancesRegion: EU (Frankfurt)Primary Instance Type: All P instancesLimit name: Instance LimitNew limit value: 1Use case description: FastAI Limit Increase RequestAfter two days case is still unassigned. Please help.I need p2.xlarge instance type, but couldn't find it in limits.Edited by: yankinmk on May 7, 2020 2:43 AMEdited by: yankinmk on May 7, 2020 2:49 AMFollowComment"

Answer: "0Hello,Please raise the request using the limits or service quota's from your AWS console, which will create a case and respective team will take care of it ans revert you back. To refer this link for how to raise the request : https://aws.amazon.com/premiumsupport/knowledge-center/manage-service-limits/AWS service quotas :https://docs.aws.amazon.com/general/latest/gr/aws_service_limits.htmlThank youCommentShareSUPPORT ENGINEERAWS-User-8886526answered 3 years ago0Thank you. I did it. Limit is increased now.CommentShareyankinmkanswered 3 years ago"


Question: RDS Oracle EE options

"A customer is looking to migrate their Oracle EE to RDS Oracle BYOL. They are using Security and Partitioning features, and per our documentation, this is supported under Oracle RDS BYOL. Does the customer need to open a support ticket to actually enable/install these options for their RDS Oracle instance? What are the steps? What is the average time needed to provision the EE options on a Oracle RDS instance?FollowComment"

Answer: "1Accepted AnswerAs Amazon RDS Oracle currently supports BYOL, customers do not need to open support ticket install supported features. but whether customer be able to use it or not depends on their BYOL and additional options, packs they purchased from oracle.Other features like Oracle Application Express, Oracle Enterprise Manager etc. needs to enabled through Options Groups.CommentShareVijayKanswered 4 years ago"


Question: Block polly due to a loop of requests

"Hi, I'm using polly for a low number of SynthesizeSpeech requests. For a possible bug that could somehow send a very high amount of requests in a loop, there is a way to block this service following an out of the ordinary use of resources, maybe with some policies (I can't find a target function that's right for me to work with a cloudwatch alarm), or maybe like other aws services it is supervised and freezes following unusual activities? Thank you in advance.FollowComment"

Answer: "0Hi NickDrake,Thank you for reaching out. Unfortunately there is no mechanisms we can propose other than tweaking some code that will track generated traffic and block it if it exceeds a certain accepted limit on the client side.On the other had you can also request a limit 'decrease' using this page for Amazon Polly using this link: https://docs.aws.amazon.com/general/latest/gr/aws_service_limits.htmlThank you,FatihCommentShareAWS-User-7152847answered 3 years ago0Thank you! However, I admit that it is a feature not easy to find in online searches, I have never found any suggestions related to the settings about limits of the the various services. Very useful advice.Edited by: NickDrake on Aug 19, 2020 5:47 AMCommentShareNickDrakeanswered 3 years ago"


Question: Cache Amplify static images in Cloudfront

"I have a Vue.js application hosted on Amplify. I use vite for building, which creates hashed static files (the hash changes on every push). I would like to configure Amplify to skip it's own Cloudfront cache logic, and simply cache my assets forever (well, 1 year). Is this possible?I've added custome caching headers to Amplify like this:customHeaders:  - pattern: assets/*    headers:      - key: Cache-Control        value: 'public,max-age=31536000,s-maxage=31536000,immutable'And now, I do see that this cache header is returned from Amplify, so my browser is now caching these assets, but I always get the x-cache: Miss from cloudfront response header.Why isn't Cloudfront caching these responses?FollowComment"

Answer: "0Accepted AnswerThis turned out to be user error. I was viewing a response cached in the browser, and the response it cached was the first, at which point Miss from cloudfront was correct. When I cleared the cache, the next response I got had the header x-cache: Hit from cloudfront.CommentShareAWS-User-1252302answered 4 months ago0The reason that CloudFront is not caching the responses is likely because the responses are including a query string, and CloudFront is configured to treat query strings as unique resources. This means that CloudFront will not cache the responses with query strings.To fix this, you will need to configure CloudFront to ignore query strings when caching the resources. You can do this by going to the CloudFront distribution settings in the AWS Management Console, and under the "Behaviors" tab, select the behavior associated with your assets and set "Forward Query Strings" to "yes" and "Query String Cache Keys" to "none". This will tell CloudFront to ignore the query strings when caching the resources and use the headers you specified.CommentShareTasadduq Burneyanswered 4 months agoAWS-User-1252302 4 months agoNo, the URLs do not contain query strings. But what do you mean that I can change this by altering the CloudFront distribution? Amplify creates the distribution itself, and I don't think I have any direct access to it, isn't that right? They certainly do not appear on my CloudFront dashboard.Share"


Question: Elastic beanstalk- Server getting created

"Hello,In the elastic beanstalk I am getting this mail & a new server is getting created- One or more TargetGroups associated with the environment are in a reduced health state:When I checked the log nothing is there.Can you please help in fixing the issueFollowComment"


Question: Cloudfront Malformed Policy Error with AWS Cloudfront-Signer V3

"I'm having an issue with the AWS Cookie-Signer V3 and Custom Policies. I'm currently using @aws-sdk/cloudfront-signer v3.254.0. I have followed the official docs of how to create and handle signed cookies - it works as long as I don't use custom policies.SetupI use a custom lambda via an API Gateway to obtain the Set-Cookie header with my signed cookies. These cookies will be attached to a further file-request via my AWS Cloudfront instance. In order to avoid CORS errors, I have set up custom domains for the API Gateway as well as for the Cloudfront instance.A minified example of the signing and the return value looks as follows:// Expiration timeconst getExpTime = new Date(Date.now() + 5 * (60 * 60 * 1000)).toISOString();// Cookie-Signerconst signedCookie = getSignedCookies({  keyPairId: "MY-KEYPAIR-ID",  privateKey: "MY-PRIVATE-KEY",  url: "https://cloudfront.example.com/path-to-file/file.m3u8",  dateLessThan: getExpTime,});// Responseconst response = {  statusCode: 200,  isBase64Encoded: false,  body: JSON.stringify({ url: url, bucket: bucket, key: key }),  headers: {    "Content-Type": "application/json",    "Access-Control-Allow-Origin": "https://example.com",    "Access-Control-Allow-Credentials": true,    "Access-Control-Allow-Methods": "OPTIONS,POST,GET",  },  multiValueHeaders: {    "Set-Cookie": [      `CloudFront-Expires=${signedCookie["CloudFront-Expires"]}; Domain=example.com; Path=/${path}/`,      `CloudFront-Signature=${signedCookie["CloudFront-Signature"]}; Domain=example.com; Path=/${path}/`,      `CloudFront-Key-Pair-Id=${signedCookie["CloudFront-Key-Pair-Id"]}; Domain=example.com; Path=/${path}/`,    ],  },};This works well if I request a single file from my S3 bucket. However, since I want to stream video files from my S3 via Cloudfront and according to the AWS docs, wildcard characters are only allowed with Custom Policies. I need this wildcard to give access to the entire video folder with my video chunks. Again following the official docs, I have updated my lambda with:// Expiration timeconst getExpTime = new Date(Date.now() + 5 * (60 * 60 * 1000)).getTime();// Custom Policyconst policyString = JSON.stringify({  Statement: [    {      Resource: "https://cloudfront.example.com/path-to-file/*",      Condition: {        DateLessThan: { "AWS:EpochTime": getExpTime },      },    },  ],});// Cookie signingconst signedCookie = getSignedCookies({  keyPairId: "MY-KEYPAIR-ID",  privateKey: "MY-PRIVATE-KEY",  policy: policyString,  url: "https://cloudfront.example.com/path-to-file/*",});which results in a Malformed Policy error.What confuses me is that the getSignedCookies() method requires the url property even though I'm using a custom policy with the Ressource parameter. Since the Resource parameter is optional, I've also tried without which led to the same error.To rule out that something is wrong with the wildcard character, I've also run a test where I've pointed to the exact file but using the custom policy. Although this works without custom policy, it does fail with the Malformed Policy error when using the custom policy.Since there is also no example of how to use the Cloudfront Cookie-Signer V3 with custom policies, I'd be very grateful if someone can tell me how I'm supposed to type this out!Cheers! 🙌FollowComment"

Answer: "0Try changing the "DateLessThan" line to:DateLessThan: { "AWS:EpochTime": Math.floor(getExpTime / 1000) },AWS:EpochTime expects a value in seconds, not milliseconds.CommentShareAaron J Spetneranswered a month ago"


Question: Eventbridge Scheduler

"Hi,I'm trying to create a new eventbridge scheduler with universal target  arn:aws:scheduler:::aws-sdk:eventbridge:PutEvents but I get the following error on deployment:Invalid request provided: Invalid RequestJson provided. Reason The api PutEvents is not valid for the service aws-sdk:eventbridge.My input is:'{"EndpointId":"string","Entries":[{"Detail":"string","DetailType":"string","EventBusName":"string","Resources":["string"],"Source":"string","Time": 0,"TraceHeader":"string"}]}'Does anyone know what I am doing wrong ?Many Thanks in advanceFollowComment"

Answer: "0Hi I might be misreading your question, but it sounds like you're literally passing {"EndpointId":"string","Entries":[{"Detail":"string","DetailType":"string","EventBusName":"string","Resources":["string"],"Source":"string","Time": 0,"TraceHeader":"string"}]}, which is the template format defined at https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutEvents.html.You need to pass real values as defined in the above page.If you are already actually passing real values, what are they?CommentShareEXPERTskinsmananswered a month ago0I've not got the full idea what you are actually trying. But if you are trying to put events on the desired EventBusName using PutEvents [1] api call for the EventBridge service. Then you can follow the below steps:Create a rule in eventbridge. You can use a sample event 'AWS events -> Scheduled Events' or you can provide your own sample message like below [1] (mentioned keys in the below json are the min required fields):{  "version": "0",  "id": "89d1a02d-5ec7-412e-82f5-13505f849b41",  "detail-type": "Scheduled Event",  "source": "com.mycompany.myapp",  "account": "123456789012",  "time": "2023-04-28T00:39:04Z",  "region": "us-east-1"}Then in the event patter you can mention the desired pattern, the bare minimum could be like below:{  "source": ["com.mycompany.myapp"]}I've tested the above and it's working fine on the sandbox also when I put the event using the aws cli. Let me know if you still have any questions.[1] https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutEvents.html#eventbridge-PutEvents-request-EntriesCommentShareRajesh Kumaranswered a month ago"


Question: Upgrading from PostgreSQL 9.4.21 to 9.6.x unavailable in Console

"I'm trying to upgrade my PostgreSQL 9.4.21 to 9.6.x, but there is no available upgrade showing in the console. I can only upgrade to 9.5, 10.7, or 11.2Is this because I need to upgrade to 9.5 first, before upgrading to 9.6?Since 10.7 and 11.2 are showing as available, can I upgrade directly to those versions without an intermediary step?TIA.FollowComment"

Answer: "0Hi bryanus,Yes, if you want to specifically upgrade to PostgreSQL 9.6  from 9.4.x, you will have to first do a major version upgrade to 9.5 and then to 9.6. However if you want to go to the latest Major versions you can do it directly based on the extensions that you are using in 9.4.x. Please look at the table on https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.PostgreSQL.html#USER_UpgradeDBInstance.PostgreSQL.MajorVersionto figure if your instance will qualify to direct upgrade to PostgreSQL 11 or 10.Hope this helps.Regards,JigneshCommentShareJignesh-AWSanswered 4 years ago0Ahh, thank you Jignesh!CommentSharebryanusanswered 4 years ago"


Question: Quotas on Dynamically Generated Step Function State Machines

"Based on this post, I was mulling over dynamically creating step functions state machines based on an in-house Domain Specific Language.  The quotas page says 'Maximum number of registered state machines' is 10,000.  Does the term 'registered' mean that there are any other class of state machines that would not be subject to this quota?  I'm trying to understand if there is any deeper meaning to the term registered in the context of state machine quotas.Thank you!FollowComment"

Answer: "1No. There is only a single type state machine, regardless of how you created it. This is the maximum number of state machines that you can creates in a region per account.CommentShareEXPERTUrianswered 9 months ago"


Question: Best approach for limiting Amazon Cognito concurrent logins

"I have a partner who has implemented Amazon Cognito User Pools, together with Amazon API Gateway and Lambda authoriser, for controlling access to a public-facing serverless application. They have had a security audit, and it has been highlighted that a single user can sign in to the application from multiple devices, using the same credentials via the Cognito hosted UI. From the partner's security policy perspective, for this particular application, it is desirable that only one session can be valid at any given moment in time.I don't see that Amazon Cognito has a "built-in" mechanism to enforce maximum number of concurrent sessions (in other words, every valid authentication attempt results in a token being issued and being valid until expiry). Therefore, what is the recommended approach for implementing such a requirement with as little additional infrastructure as possible?One approach seems to be to invoke a global sign out on the client-side to "log out" all existing sessions, but this would rely on the client code enforcing this at login time (something the security team are less comfortable with). Alternatively, could this logic also be enforced in Cognito Lambda Trigger code (post-authentication) so that it is not dependent on client behaviour?Any common approaches you have seen customers and partners adopt to meet this requirement would be useful to further this conversation.Many thanks.FollowComment"

Answer: "1Accepted AnswerHi Alan - token based authentication model (like what Cognito is doing) is meant to be stateless and there is no concept of session tracking like in legacy session-based authentication which tracks sessions with cookies. in other words, there is no way to know that user has signed in already without storing this information and doing your own session management solution. In addition to this, token is self-contained and even after sign-out or revoking tokens, they are still valid until expired (since majority of services will verify token without calling the issuer, token will be verified by just checking the signature and expiration).The short answer is that, if you want to enforce single-session per user then you need to fall-back to session-based authentication and maintain a server-side managed session. One way to do that with Cognito is to store some information that user has an active session (for example in Cognito Post-Auth trigger store some mapping in DynamoDB that user XYZ has an active session that will expire at time ABC, or store this information in Cache layer with expiration period that match token expiration, don't store the token itself or any sensitive data). Then in Pre-Auth trigger you can check if username has an active session and fail the authentication attempt. You need then to think of how to invalidate this session if user sign-out or would like to switch to another device before active session expiry.CommentShareEXPERTMahmoud Matoukanswered 2 years ago"


Question: Scalabiliy of the shared disk size on a cluster

"I created the HPC cluster using parallel cluster 2.10. I would like to run cluster for long time and host my customers' simulations on it. My main requirement is that the HPC cluster is scalable, and the pricing is proportional to the amount of resources used.While this is the fact in case of compute nodes and they are added and removed whenever they are needed, I am not quite sure if the size of the shared EBS resources can be changed. I am confused, since the documentation of the parallel script says one cannot change volume_size after the cluster is created. On the other hand in the AWS console->EC2->EBS->Volumes there is an option to resize volumes. I am just wondering if this would work for the cluster. If not, what is the suggested solution to improve the cluster disk size scalability?FollowComment"

Answer: "0Hi @mfolusiak,"update not supported" policy for the volume_size parameter means that ParallelCluster is not able to perform all the required operations to update the size of the volume in the head node.Updating the file system after a resize operation requires commands specific to your operating system.You can anyway follow the general instructions to modify your volume size from AWS Console and manually change the size in the head node: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/requesting-ebs-volume-modifications.html#modify-ebs-volumeLet us know if it helps.CommentShareenrico-awsanswered 2 years ago"


Question: AWS Deeplens USB not detected due to certificate expired

"Deeplens v1.1 - not able to be detected via USB connected in "registration" port.The browser consoles shows error on certificate expired, and can bee verified in here:❯ curl https://camera-amdc.net/pingcurl: (60) SSL certificate problem: certificate has expiredMore details here: https://curl.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentioned above.❯ curl -k https://camera-amdc.net/ping{  "status_code": "1"}I am wondering if anyone has a good workaround on this.Ps. I did manage to register the device via 1.0 method.FollowCommentstarchx 8 months agoThe cert has expired.... :(    Signature Algorithm: sha256WithRSAEncryption        Issuer: C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA        Validity            Not Before: Feb 29 00:00:00 2020 GMT            Not After : Mar  4 12:00:00 2022 GMT        Subject: C=US, ST=Washington, L=Seattle, O=Amazon.com Inc., CN=www.camera-amdc.netShare"


Question: How to reduce "Data Processed by NAT Gateways" charges?

"Hello, Need help to understand what "Data Processed by NAT Gateways"? Currently bill amount is too high due to this charge and hence need help to reduce that cost. Can this be reduced by moving natgateway in same subnet (AZ) that of ec2 which is sending data to natgateway? If yes, how much approx. % of saving I can achieve in the billing.FollowComment"

Answer: "1Hello Sushant,First, determine the major sources of traffic through your NAT gateway. Then, consider the following strategies for reducing data transfer and processing charges.Determine whether the instances sending the most traffic are in the same Availability Zone as the NAT gateway. If they're not, create new NAT gateways in the same Availability Zone as the resource to reduce cross-AZ data transfer charges.Determine whether the majority of your NAT gateway charges are from traffic to Amazon Simple Storage Service (S3) or Amazon DynamoDB in the same Region. If they are, set up a gateway VPC endpoint. Route traffic to and from the AWS resource through the gateway VPC endpoint, rather than through the NAT gateway. There's no data processing or hourly charges for using gateway VPC endpoints.If most traffic through your NAT gateway is to AWS services that support interface VPC endpoints, then create an interface VPC endpoint for the services. See pricing details for interface VPC endpoints to determine the potential cost savings.If most of your internet traffic is destined to non-AWS resources, consider using an internet gateway for instances generating the highest traffic. Unlike NAT gateways, internet gateways give your instances direct internet access at no cost. Security groups and network access control lists can be configured to prevent unauthorized access to instances, depending on your security policies. For connectivity through internet gateways, instances must be in a public subnet and have a public IP or Elastic IP address associated with its network interface.Note: You can set up alarms to monitor use of your NAT gateway in the future using Amazon CloudWatch.ReferenceCommentShareEXPERTTushar_Janswered 8 months agosushant deshpande 8 months agoThanks Tushar for the quick response. Could you please let me know how much saving (approx.) can be achieved if I deploy new Natgateway in same AZ that of ec2? Also, what components/charges are included under "Data Processed by NAT Gateways"?ShareTushar_J EXPERT8 months agoSee more info at think like: https://aws.amazon.com/vpc/pricing/ (Check the NAT Gateway Pricing section)Share"