Question: Office365 not reachable from gateway load balancer

"Hello, we have a setup of Gateway Load Balancer fronting a couple of firewall appliances in a central VPC to inspect all the traffic from all the spoke VPCs as well as several on-prem remote locations connected through S2S VPN.We have noticed that some clients are not able to reach Microsoft Office365 endpoint https://www.office.com which resolves to  (13.107.6.156)Also we have checked and our clients are able to reach resources in spoke VPCs though and no issues on that.We have consulted our firewall vendor and they have confirmed that the firewall can see the packets egressing to the internet and not being blocked.In an effort to comprehend the cause of this, we have turned on VPC flow logs, however, we couldn't establish a relation between the clients that are able to reach Office365 and the ones that are not.Our setup is:Remote Offices <....> S2S VPN <....> Transit Gateway <....> Gateway Load Balancer <....> Firewalls <....> InternetOn a side note, we had a similar issue in the past for some random clients in the spoke VPCs but that was resolved by enabling  Transit Gateway Appliance mode. We are not sure though if it's related to the current issue or not as we tried disabling it again but that didn't change anything.Any hint would be appreciated.FollowComment"

Answer: "1Accepted AnswerThanks for providing the outputs.From the traceroute of the non-working machine, there are 17 hops without an entry to reach the final destination [13.107.6.156],  while the working one, there are 19 hops with an entry to the final destination.Clearly there are more than 17 hops to reach [13.107.6.156]. Taking that into consideration and correlating the packet with Sequence Num:2805856178that is seen in the VPN router and the same packet in the firewall [the inner packet under geneve encapsulation], I do see the TTL is 17 which isn't enough to reach the final destination.May I know what's the current default TTL value that is used at the clients?You can check that by running the command below or if you run packets capture in the client itself and look at the IP header.sudo sysctl -a | grep "net.ipv4.ip_default_ttl"Clearly you need to look at the TTL at your network and ensure it's big enough to reach the destination.In some old kernels, it might be set to 64 and you can increase it to 255 by running the command:sudo sysctl -w "net.ipv4.ip_default_ttl=255"In most cases, you should see ICMP - Time exceeded in the capture when the TTL reaches zero.CommentSharemmlanswered 5 months agoEXPERTTushar_Jreviewed 5 months ago1Keep in mind that Gateway Load Balancer is just a pump in the wire, it doesn't contribute to the TTL. The main issue is within your on-prem network as it seems there are a lot of hops until you hit AWS edge. Since you mentioned that you're using an MPLS backbone to serve your remote branches, you can use this global command to disable decrementing the TTL value of the inner packet - which represents the client packet -  across the LSP path, hence making the entire MPLS backbone looks like a single hop. It will hide all the LSRs across the path when you telnet to any destination.no mpls ip propagate-ttlUsually, it doesn't incur any downtime, but it's a good practice to schedule a maintenance window just to be in the safe side and commit the change across all your P and PE routers that make up the entire MPLS backbone.CommentSharemmlanswered 5 months agoedwinerr10 5 months agoThanks a lot!!Share0Hello, I've got some questions for you:Is the connectivity issue persistent with Office365?Is it only seen with Office365? What about other websites?Can you provide outputs of TCP traceroute to Office365 from a working machine and from non-working one?Are you egressing to the internet through the firewalls only or you have Nat Gateways fronting them?This is to understand if some public IPs are somehow blocked in the internet.Use this command:traceroute -T -p443 www.office.comCan you keep one healthy firewall behind Gateway Load Balancer and run packets capture from a non-working client and the firewall at the same time?You can de-register the firewalls from the GWLB target group and keep only one healthy node.CommentSharemmlanswered 5 months ago0On top of user mml's questions, are you doing SNAT on the FWs?As for the Appliance mode, it is recommended to enable it (only for the TGW Attachment towards the inspection VPC not the Spoke VPC attachments)There are few additional best practices when it comes to GWLB deployment, take a look if you haven't already:https://aws.amazon.com/blogs/networking-and-content-delivery/best-practices-for-deploying-gateway-load-balancer/Also are the route tables setup according to this design:https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/using-nat-gateway-and-gwlb-with-ec2.htmlGWLB is just a bump in the wire, it does not alter anything in the traffic.CommentShareEXPERTTushar_Janswered 5 months ago0We've looked at these guides and practices and also validated the route tables entries at every hop.The issue is persistent with Office365 for the non working stations.Office365 is the most important website for us, but we noticed the same issue with some other websites as well.We do have three Nat Gateways (one in each AZ) fronting the firewall appliances in the same central VPC and we tried creating new onesto change the egress public IPs, however that didn't help.I'll provide the outputs and captures shortly.CommentShareedwinerr10answered 5 months ago0Traceroute from non working station:[root@99.103.11.203~]# traceroute -T -p443 www.office.comtraceroute to www.office.com (13.107.6.156), 30 hops max, 60 byte packets 1  * * * 2  * * * 3  * (10.30.200.93) (10.30.200.93)  2.148 ms  * 4  * (10.30.70.150) (10.30.70.150)  3.072 ms  * 5  * * * 6  * 240.1.116.14 (240.1.116.14)  2.666 ms * 7  * 240.1.116.24 (240.1.116.24)  2.687 ms * 8  * 241.0.10.134 (241.0.10.134)  2.746 ms 240.1.112.8 (240.1.112.8)  3.150 ms 9  241.0.10.72 (241.0.10.72)  2.911 ms 241.0.10.134 (241.0.10.134)  2.814 ms 240.1.112.28 (240.1.112.28)  2.872 ms10  242.3.209.17 (242.3.209.17)  3.033 ms 242.3.200.1 (242.3.200.1)  3.391 ms 240.1.108.24 (240.1.108.24)  2.710 ms11  100.95.19.129 (100.95.19.129)  2.999 ms 242.3.209.129 (242.3.209.129)  13.362 ms 242.3.208.1 (242.3.208.1)  2.956 ms12  100.100.16.106 (100.100.16.106)  3.342 ms 100.100.2.32 (100.100.2.32)  16.986 ms 100.95.19.143 (100.95.19.143)  2.803 ms13  100.100.2.42 (100.100.2.42)  9.206 ms 100.95.20.17 (100.95.20.17)  3.501 ms 100.100.2.38 (100.100.2.38)  3.390 ms14  100.100.2.42 (100.100.2.42)  3.697 ms 99.82.178.63 (99.82.178.63)  3.642 ms 100.95.20.113 (100.95.20.113)  3.310 ms15  100.100.2.40 (100.100.2.40)  3.561 ms ae25-0.icr02.dub07.ntwk.msn.net (104.44.239.35)  3.667 ms 99.82.178.23 (99.82.178.23)  25.308 ms16  13.104.176.13 (13.104.176.13)  3.785 ms ae26-0.icr01.dub07.ntwk.msn.net (104.44.239.33)  3.854 ms ae21-0.db3-96c-1a.ntwk.msn.net (104.44.236.62)  3.720 ms17  * ae25-0.icr02.dub07.ntwk.msn.net (104.44.239.35)  3.749 ms ae21-0.db3-96c-1a.ntwk.msn.net (104.44.236.62)  4.201 msTraceroute from a working station:[root@99.103.11.204~]# traceroute -T -p443 www.office.comtraceroute to www.office.com (13.107.6.156), 30 hops max, 60 byte packets 1  * * * 2  * * * 3  * (10.30.200.93) (10.30.200.93)  2.184 ms  * 4  * (10.30.70.150) (10.30.70.150)  3.146 ms  * 5  * * * 6  * 240.1.116.12 (240.1.116.12)  3.028 ms * 7  240.1.116.27 (240.1.116.27)  2.916 ms * * 8  240.1.112.9 (240.1.112.9)  2.791 ms 241.0.10.135 (241.0.10.135)  2.539 ms 240.1.108.9 (240.1.108.9)  2.739 ms 9  241.0.10.137 (241.0.10.137)  2.875 ms 241.0.10.131 (241.0.10.131)  2.574 ms 240.1.112.26 (240.1.112.26)  2.869 ms10  242.3.201.17 (242.3.201.17)  3.795 ms 240.1.112.28 (240.1.112.28)  2.817 ms 240.1.112.31 (240.1.112.31)  2.501 ms11  100.95.19.147 (100.95.19.147)  11.709 ms 242.3.208.17 (242.3.208.17)  9.224 ms 100.95.19.155 (100.95.19.155)  3.633 ms12  100.100.16.46 (100.100.16.46)  3.608 ms 100.100.2.54 (100.100.2.54)  4.259 ms 100.95.19.139 (100.95.19.139)  2.804 ms13  100.95.20.65 (100.95.20.65)  4.296 ms 100.100.2.62 (100.100.2.62)  3.825 ms 100.95.20.81 (100.95.20.81)  3.450 ms14  100.95.20.113 (100.95.20.113)  3.396 ms ae27-0.icr02.dub08.ntwk.msn.net (104.44.239.39)  3.724 ms 99.82.178.23 (99.82.178.23)  4.167 ms15  ae25-0.icr02.dub07.ntwk.msn.net (104.44.239.35)  3.693 ms ae21-0.db3-96c-1b.ntwk.msn.net (104.44.236.70)  6.535 ms ae23-0.db3-96c-1a.ntwk.msn.net (104.44.236.68)  3.950 ms16  ae27-0.icr02.dub08.ntwk.msn.net (104.44.239.39)  3.880 ms 13.104.176.8 (13.104.176.8)  3.605 ms ae25-0.icr02.dub07.ntwk.msn.net (104.44.239.35)  3.934 ms17  ae27-0.icr01.dub08.ntwk.msn.net (104.44.239.37)  3.673 ms * 13.104.176.9 (13.104.176.9)  4.042 ms18  ae21-0.db3-96c-1a.ntwk.msn.net (104.44.236.62)  4.278 ms * *19  * 13.107.6.156 (13.107.6.156)  5.667 ms *tcpdump from on-prem VPN router:[root@99.103.11.204~]# tcpdump -n -v -r router.pcapreading from file router.pcap, link-type EN10MB (Ethernet)20:21:09.541736 IP (tos 0x0, ttl 19, id 13550, offset 0, flags [DF], proto TCP (6), length 60)    10.10.10.244.43212 > 13.107.6.156.https: Flags [S], cksum 0x2933 (incorrect -> 0x559f), seq 2805856178, win 62727, options [mss 1350,sackOK,TS val 3042490422 ecr 0,nop,wscale 7], length 0tcpdump from the firewall:[root@firewall-x11-d23~]# tcpdump -n -v -r firewall.pcapreading from file firewall.pcap, link-type EN10MB (Ethernet)20:21:09.542414 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto UDP (17), length 128)    10.30.200.93.60308 > 10.30.200.227.6081: Geneve, Flags [none], vni 0x0, options [class Unknown (0x108) type 0x1 len 12, class Unknown (0x108) type 0x2 len 12, class Unknown (0x108) type 0x3 len 8]        IP (tos 0x0, ttl 17, id 13550, offset 0, flags [DF], proto TCP (6), length 60)    10.10.10.244.43212 > 13.107.6.156.https: Flags [S], cksum 0x57f3 (correct), seq 2805856178, win 62727, options [mss 1350,sackOK,TS val 3042490422 ecr 0,nop,wscale 7], length 020:21:09.542697 IP (tos 0x0, ttl 254, id 14928, offset 0, flags [none], proto UDP (17), length 128)    10.30.200.227.60308 > 10.30.200.93.6081: Geneve, Flags [none], vni 0x0, options [class Unknown (0x108) type 0x1 len 12, class Unknown (0x108) type 0x2 len 12, class Unknown (0x108) type 0x3 len 8]        IP (tos 0x0, ttl 17, id 13550, offset 0, flags [DF], proto TCP (6), length 60)    10.10.10.244.43212 > 13.107.6.156.https: Flags [S], cksum 0x57f3 (correct), seq 2805856178, win 62727, options [mss 1350,sackOK,TS val 3042490422 ecr 0,nop,wscale 7], length 0CommentShareedwinerr10answered 5 months ago0Spot on!In efforts to simulate the TTL, we created a temporary GRE tunnel over our MPLS backbone that we use to connect our on-prem remote offices to the VPN router to switch the LSP path to a shorter route and it worked. The TTL didn’t expire and Office365 was reachable. However, this is not a permanent solution and we will now explore other options to address this problem.Is it possible to modify the Gateway Load Balancer and Transit Gateway to keep the TTL as is and not decrement it?CommentShareedwinerr10answered 5 months ago"


Question: While loading redshift with Glue job Null records are getting dropped. How to handle this?

Trying to replace values with NULL in redshift table. though glue job. values are not replacing with null.what I am misssing here?FollowCommentGonzalo Herreros a month agoYou mean you are uploading rows to Redshift from Glue and then in the table they have a empty strings instead of NULL values?Share

Answer: "0If you are trying to replace values with NULL in a Redshift table using Glue job, you can use the replace_null() transformation function in Glue. Here's an example of how to do it:from awsglue.transforms import *from awsglue.utils import getResolvedOptionsfrom pyspark.context import SparkContextfrom awsglue.context import GlueContextfrom awsglue.dynamicframe import DynamicFrame## @params: [JOB_NAME]args = getResolvedOptions(sys.argv, ['JOB_NAME'])sc = SparkContext()glueContext = GlueContext(sc)spark = glueContext.spark_session## Create a DynamicFrame using a Glue Catalog tabledynamic_frame = glueContext.create_dynamic_frame.from_catalog(database = "database_name", table_name = "table_name")## Replace values with NULL using replace_null() functiondynamic_frame = ApplyMapping.apply(frame = dynamic_frame, mappings = [("column_name", "string", "column_name", "string"), ("column_with_value_to_replace", "string", "column_with_value_to_replace", "string")])dynamic_frame = Map.apply(frame = dynamic_frame, f = lambda x: {"column_name": x["column_name"], "column_with_value_to_replace": replace_null(x["column_with_value_to_replace"])})## Convert DynamicFrame back to DataFrame and write to Redshiftdata_frame = dynamic_frame.toDF()data_frame.write.format("com.databricks.spark.redshift").option("url", "jdbc:redshift://<redshift_endpoint>:<port>/<database>?user=<user>&password=<password>").option("dbtable", "table_name").option("tempdir", "s3://<s3_bucket_path>/temp").mode("overwrite").save()In the above code, you can see that we use the replace_null() function to replace any value in the "column_with_value_to_replace" column with NULL. You can add more columns as needed in the mappings list. The Map function is used to apply the replace_null() function to each row.Make sure to replace the placeholders in the option function with your own values for the Redshift endpoint, port, database, user, password, and S3 bucket path.If your Glue job is still dropping null records after implementing this, please provide more details on your Glue job and the data you are trying to load.CommentSharehashanswered a month ago"


Question: How to assign same custom domain to my amplify app and the API gateway that it uses

"I have an amplify app and an API gateway that is used by the app.API gateway is associated with a lambda function.I can assign domain to them as follows and it works well:App:   mydomain.comAPI:   api.mydomain.com    (note that this is a subdomain of above)But I want to make them same origin, which means I want to assign domain like this:App:   mydomain.comAPI:   mydomain.com    (exactly same as above)How can I achieve this?Thanks in advance.FollowComment"


Question: How to check if the OS upgrade is complete

"hello.Events related to OS upgrade have been confirmed as shown below.Health EventsHere is a summary of the milestones related to the OS upgrade.You can now initiate OS upgrades at any time on Amazon RDS for affected MariaDB DB instances until August 31, 2022 at 9:01 AM KST.After August 31, 2022 at 9:01 AM KST, Amazon RDS will automatically upgrade the MariaDB DB instance's OS to the latest version within the maintenance window.RDS SettingsEngine Version: MariaDB 10.4.21Class: db.m5.xlargeMinor version auto-upgrade enabled.There was maintenance work, so I applied it right away.Recommendation type applied: Enhanced monitoring offPending maintenance tasks are not checked in the RDS console.How can I check if the upgrade is complete?For RDS Mariadb, how do I check for recommendations?https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Maintenance.html#USER_UpgradeDBInstance.Maintenance.Multi-AZThank you.FollowComment"

Answer: "0HeyI see that you have listed the health Events related to OS upgrade above and I checked those events in the following document https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Maintenance.html#USER_UpgradeDBInstance.OSUpgrades unfortunately, I couldn’t see the schedule for operating system updates for RDS for MariaDB. I would recommend this https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Maintenance.html or https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.MariaDB.html for your use case.You can check the completed upgrade in your console, under configuration tab. You can also check the completed upgrade using the following commands: SELECT VERSION(); , SELECT @@version; , SHOW VARIABLES WHERE variable_name = 'version’; , SHOW VARIABLES WHERE variable_name LIKE '%version%’; , STATUS;Thank youCommentSharePhindianswered a year ago"


Question: Backup Audit Manager not reporting correct status - insufficient data

"I have deployed few controls using Backup Audit Manager to check the compliance of the backups but most of them have control status of insufficient data. Why is that? I only have one control passing compliant status.I checked configuration recorder status, it is recordingI have the following rule which clearly is Daily backup at least once and least retention of 7 days. Still the rule control is failing.{            "ruleName": "daily_backup_rule",            "scheduleExpression": "cron(0 21 ? * * *)",            "startWindowMinutes": 60,            "completionWindowMinutes": 480,            "lifecycle": {                "toDeletedAfterDays": 8            }        }FollowComment"

Answer: "1Control status refers to each control's compliance status. A control can be Compliant, meaning all resources pass that evaluation; Non-compliant, meaning that at least one resource did not pass that evaluation, or Insufficient data, meaning the control found no resources within the evaluation scope to evaluate. Control status refers to each control's compliance status. A control can be Compliant, meaning all resources pass that evaluation; Non-compliant, meaning that at least one resource did not pass that evaluation, or Insufficient data, meaning the control found no resources within the evaluation scope to evaluate. It is also important that you have to turn on resource tracking as this is important to collect data for the specific control. Please turn on resource tracking as below,AWS Backup: backup plansAWS Backup: backup vaultsAWS Backup: recovery pointsAWS Backup: backup selectionAWS Config: resource complianceFor further details on configuring the correct controls required for your environment refer to article below.Choosing your controls - https://docs.aws.amazon.com/aws-backup/latest/devguide/choosing-controls.htmlTurning on resource tracking - https://docs.aws.amazon.com/aws-backup/latest/devguide/turning-on-resource-tracking.htmlCreating frameworks using the AWS Backup console - https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-frameworks-console.htmlViewing framework compliance status - https://docs.aws.amazon.com/aws-backup/latest/devguide/viewing-frameworks.htmlAfter enabling resource tracking if you still do see insufficient data then I request you to raise a case with AWS Support for further deep dive and analysis.For the non-compliant backup plan please verify if the backup plan has any other rule within it and also please check if there are any other backup plan within the same region which is not compliant as per your frame work. You can view the non-compliant backup plan as detailed in the below article,Finding non-compliant resources - https://docs.aws.amazon.com/aws-backup/latest/devguide/finding-non-compliant-resources.htmlIf you would like AWS to perform further analysis then I request you to raise a case with AWS Backup Support as further analysis pertaining to your control and account is required.CommentShareSUPPORT ENGINEERSathyaanswered a year ago"


Question: Lake Formation Data Filter error: Column comparision is currently not supported.

"Following example from https://docs.aws.amazon.com/lake-formation/latest/dg/setup-data-filters.html, I'm trying to to create a new data filter, but receiving error: Expression has EQ operator with column comparisons. Column comparision is currently not supported.Test_table is governed parquet table, user has a full administrative rights.What could be wrong?Here is a screenshot:FollowComment"

Answer: "0Ok, this is a self-answer.Apparently, Row Filter Expression failed due to use of double-quoted string , instead of single quoted.Replacing confidential1="US" with confidential1='US' solved the problem.Unfortunately, error message is not helpful and have to be replaced with a better explanation of the problem.CommentShareStas Khirmananswered 15 days agoGonzalo Herreros 14 days agoIt's true that it's not obvious but if you see the description, it says that you are writing a SQL condition. In SQL '' is a string and "" is the way you escape a column nameShare0HI, as you have correctly pointed out, the error is due to in SQL syntax strings in double quotes "" are treated as column names. Use single quotes should resolve this issue. Please feel free to response or open a support ticket if you have any follow up questions. We are happy to help you out!CommentShareEthan_Hanswered 12 days ago"


Question: "S8+ device broken, setup suite times out and all tests are skipped"

"Dear Amazon Team,During the last 2 days Samsung Galaxy S8+ (T-Mobile) device always fails. Setup Suite times out after ~1 minute and all tests are skipped. Can you please check & fix this device?https://us-west-2.console.aws.amazon.com/devicefarm/home?#/projects/dc2068f7-4b09-417c-9909-b77f559c9641/runs/edd0b8a2-813e-42cc-a219-564bfa3507a4/jobs/00001/suites/00000/tests/00000https://us-west-2.console.aws.amazon.com/devicefarm/home?#/projects/dc2068f7-4b09-417c-9909-b77f559c9641/runs/bfcf56f2-f821-4d69-8be9-90de76ec46a9/jobs/00001/suites/00000/tests/00000Thank you.Regards,DraganFollowComment"

Answer: "0Hello Dragan,Thanks for bringing this to our attention, both those runs where on the same physical device. Our other Galaxy S8+ look to be fine, I've disabled that particular device until it can fixed.Sorry for the inconvenience.ScottCommentShareAWS-User-1182145answered 4 years ago"


Question: application migration to aws

I need to migrate a moodle application from a locaweb server to aws. How do I do ? What information do I need from locaweb to do this migration?FollowComment

Answer: "0Without more information, Application Migration Service is probably your best bet. It will migrate your server to EC2, allow you to test it, and then cutover with minimal downtime. https://aws.amazon.com/application-migration-service/CommentShareburdettganswered a year ago"


Question: Liveness Checking

"New update for the AWS Rekognition shows a new feature which is liveness checking.My question is:Is there any documentation on how to implement this on Spring Boot (Java) and also frontend implementation for Angular/Ionic? There is a code sample here. But my problem is that I am using the the Java V2 SDK (software.amazon.awssdk) and the one on the example is Java V1 (com.amazonaws.services). Correct me if I am wrong, thanks.There are only few regions on which this feature is available, is there any timeline wherein this will be distributed to different regions (Ex. Singapore) ?FollowComment"

Answer: "0You can use our java v2 SDK, APIs are available in v2 package. RefWe will prioritize the addition of a new regions based on customer demand. We recommend monitoring the Regions and Quotas page for notification. We strongly encourage utilizing existing regions until the new regions are supported.CommentShareAWS-User-9962581answered a month ago"


Question: [🚀Launch Announcement] - AWS Gateway Load Balancer launches Target Failover feature

"Hello,ELB team is happy to announce that we just launched a new Target Failover feature that provides an option to define flow handling behavior for AWS Gateway Load Balancer. Using this option, customers can now rebalance existing flows to a healthy target, when the target fails or deregisters. This helps reduce failover time when a target becomes unhealthy, and also allows customers to gracefully patch or upgrade the appliances during maintenance windows.Launch Details:This feature uses the existing ELB API/Console and provides new attributes to specify the flow handling behavior. You can use the existing modify-target-group-attributes API to define flow handling behavior using the two new attributes target_failover.on_unhealthy and target_failover.on_deregistration.This feature does not change the default behavior and existing GWLBs are not affected.The feature is available using API and AWS Console.The feature is available in all commercial, GovCloud, and China regions. It will be deployed in ADC regions at a later date based on demand.Customers should evaluate the effect of enabling this feature on availability and check with their third-party appliance provider documentation.AWS appliance partners should consider taking following actions - (a) Partners should validate whether rebalancing existing flows to healthy target has implications on their appliance as it will start receiving the flow midway, i.e. without getting the TCP SYN. (b) Update public documentation on how this feature will affect their appliance. (c) Partner may use this capability to improve stateful flow handling on their appliances.Launch Materials:Launch Blog - https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-gateway-load-balancer-target-failover-for-existing-flows/Feature Documentation - https://docs.aws.amazon.com/elasticloadbalancing/latest/gateway/target-groups.html#target-failoverAttribute Documentation - https://docs.aws.amazon.com/elasticloadbalancing/latest/gateway/target-groups.html#target-group-attributesThank you!FollowComment"

Answer: 0[Announcement] Does not require an answer.CommentShareEXPERTIsraa-Nanswered 23 days ago


Question: ALB got stuck in 'provisioning' state for hours

Here is the arn: ARN: arn:aws:elasticloadbalancing:eu-central-1:<account>:loadbalancer/app/tf-envmarek-alb/c30c9316a998426b and one other: ARN: arn:aws:elasticloadbalancing:eu-central-1:<account>:loadbalancer/app/test/7113d7e70d4b43aeOne was created with terraform the other was created by manual labor. Both are stuck in 'provisioning' state for long time. Any help is appreciated.FollowComment

Answer: "0I am only replying to this thread as it's on the first page of google and I both ran into and solved this issue.I found that if I tried to create a public-facing ALB in subnets that have no internet gateway(no nat gateway either in my case), it was stuck in provisioning.As soon as I created a internal ALB everything provisioned like normal.CommentSharebamcorpanswered 6 years ago"


Question: Using Java JFrame on Cloud9 X11 DISPLAY error

"When I try to use a GUI on Cloud9 I get the following error: "No X11 DISPLAY variable was set, but this program performed an operation which requires it."Can someone please help me solve this issue.FollowComment"


Question: Writing Data to a Non RDS external DB endpoint

"Hi,This is quite likely a pretty lame question but I have searched everywhere and cannot find any clear answer.Imagine this scenario....I have access and credentials to a particular database endpoint sitting on a server outside of the AWS ecosystem. Not an RDS managed DB.I somehow create some data within the AWS ecosystem (for example.. say, from Textract....) and I want to write that data to my Database above.Is that possible?If so, which service in AWS is best to accomplish this?I have searched high and low and can only find info on writing to an RDS database.Would appreciate any help here.TIA.FollowComment"

Answer: "0Hi Chris,Thank you so much for your reply and answer.At least I know know that it is doable.Are there any registers of Devs etc who I might be able contact to contract out to for some work like this that you can point me to please?CheersCommentShareCustomawareanswered 10 months agoChris_G EXPERT10 months agoHello,We have many partners who can help you implement this.  You can find our partner directory here: https://partners.amazonaws.com/ .  If this is just a one time, smaller implementation, you may want to search public freelancer boards for a developer to assist with your project.Share0Hello,You have many options.  You could run your application on Lightsail, EC2, ECS, Lambda, etc.  All of these services allow you to run a script or use the AWS CLI against an AWS service and connect to your external database to load the data.  It's highly dependent on what your goal is exactly.An example would be to use a Lambda function to call out to a service such as Textract, get the data, and connect to your external database to insert the data.The biggest caveats to sending and receiving data to an external database outside of AWS are latency and data transfer cost.  The latency may be very high which will cause your scripts to take longer to run.  You will also incur data transfer costs for sending data externally instead of within an AWS region.CommentShareEXPERTChris_Ganswered 10 months ago0you can write to external DB endpoints as long as the source and target engine types are supported.CommentShareAWS-User-8174525-subhashanswered 10 months ago0That all "sounds" great but trying to find someone to hire to actually do it as a paid engagement for me has taken over two weeks now and still cannot find anyone.  Have tried Freelancer, Upwork, Linked In. Even contacted some people with very helpful Youtube videos.... No go...The only really interested guy was someone who wanted to write a .Net app on my server... Nope! Not gunna go there. ;-)Seems like everyone is so busy to be interested in a small paid side job. I expected there would be heaps of people all over this amazing tech and be offering their services.... but oddly... that is just not the case.Anyway... will keep looking.Thanx for your replies.CommentShareCustomawareanswered 10 months ago"


Question: Python Cloudlib for S3 - My Python code is very slow to dowload my data files (total 15GB) . How to Fix ?

"Hi,I want to download the .mkv files in my S3 bucket .I tried with a sample S3 bucket with subfolders. It is working very smoothly.But in my production side, my .mkv files are bit large, and the download via python code  is taking very very long time to complete.Whereas, if I use tools like Cybertruck, the entire 15GB file is downloaded in 15 minutes. So , it means , there is nothing wrong with the settings of AWS S3 bucket and its policies.My code is as below.import osimport shutilimport timefrom os import path, makedirsfrom cloudpathlib import CloudPathfrom cloudpathlib import S3ClientdownloadFolder = input('Enter the folder path for saving Downloaded Files:')convertedFolder = input('Enter the folder path for saving Converted Files:')# read the access variable from filecredential = os.path.expanduser(os.getcwd()+os.sep+'credentials.txt')myvars = {}with open(credential, "r") as myfile:    for line in myfile:        line = line.strip()        name, var = line.partition("=")[::2]        myvars[name.strip()] = str(var)# access variablesaccess_key = "{}".format(myvars['access_key'])secret_access_key = "{}".format(myvars['secret_access_key'])bucket_name = "{}".format(myvars['bucket_name'])folder_path = "{}".format(myvars['folder_path'])# Connect to s3 serviceclient = S3Client(aws_access_key_id=access_key, aws_secret_access_key=secret_access_key)# s3 = boto3.client('s3', region, aws_access_key_id=access_key, aws_secret_access_key=secret_access_key)root_dir = CloudPath("s3://"+bucket_name+"/", client=client)#find the number of files in s3 buckettotalFileCount=0for f in root_dir.glob(folder_path+'/*'):        totalFileCount = totalFileCount+1print('Total no. of files')print(totalFileCount)# for every two seconds, print the status of download/convertedmeasure1 = time.time()measure2 = time.time()filesCompleted = 0for f in root_dir.glob(folder_path+'/*'):    filename = f.name    print("file= "+filename)    curFileName = 'store1_' + filename    f.download_to(downloadFolder+os.sep+curFileName)    # convert .mkv to .mp4    newName, ext = os.path.splitext(curFileName)    outFileName = newName + '.mp4'    src_path = downloadFolder + os.sep + curFileName    dst_path = convertedFolder + os.sep + outFileName    shutil.copy(src_path, dst_path)    # For every two seconds print the status    if measure2 - measure1 >= 2:        # Find total no. of files in Downloaded folder        currentlyDownloadedFiles = os.listdir(downloadFolder)        curDownloadCount = len(currentlyDownloadedFiles)        curConvertedFiles = os.listdir(convertedFolder)        curConvertedCount = len(curConvertedFiles)        print("Status ==> Downloaded: " + str(curDownloadCount) + "/" + str(totalFileCount) + "  Converted: " + str(            curConvertedCount) + "/" + str(totalFileCount))        measure1 = measure2        measure2 = time.time()    else:        measure2 = time.time()# client.set_as_default_client()# S3Client.get_default_client()#continue printing status until the Downloads and Converting files are fully completewhile (curDownloadCount < totalFileCount or  curConvertedCount < totalFileCount):    currentlyDownloadedFiles = os.listdir(downloadFolder)    curDownloadCount = len(currentlyDownloadedFiles)    curConvertedFiles = os.listdir(convertedFolder)    curConvertedCount=len(curConvertedFiles)    # For every two seconds print the status    if measure2 - measure1 >= 2:        # Find total no. of files in Downloaded folder        currentlyDownloadedFiles = os.listdir(downloadFolder)        curDownloadCount = len(currentlyDownloadedFiles)        curConvertedFiles = os.listdir(convertedFolder)        curConvertedCount = len(curConvertedFiles)        print("Status ==> Downloaded: " + str(curDownloadCount) + "/" + str(totalFileCount) + "  Converted: " + str(            curConvertedCount) + "/" + str(totalFileCount))        measure1 = measure2        measure2 = time.time()    else:        measure2 = time.time()Please let me know where I am wrong.Thanks,SabarisriFollowComment"

Answer: "0Are you trying to download to your pc or a local drive?  You can use the s3 client download_fileobj or the one using the file name and pair that with the config object to process multiple parts at the same time.  I have large files so my chunk size is large, but you get the idea.  You can make them much smaller, but the maximum number of parts is 10,000, so be sure you don't exceed that.  Hope this helps.  Source is the bucket, key is the path and file name in S3.  (I'm downloading to my PC, so I use half the processes I can use.)    mb = 1024 ** 2    config = TransferConfig(multipart_threshold=1000 * mb, max_concurrency=int(psutil.cpu_count() / 2),                            multipart_chunksize=1000 * mb, use_threads=True)    try:        with open(destination, 'wb') as data:            s3.download_fileobj(source, key, data, Config=config)CommentSharejschwar313answered 9 months ago"


Question: "SES: DKIM configuration successful, but Identity status still "pending""

"Hi,I have added a domain into AWS SES a while ago, and I've entered the three CNAME records into our domain registry as requested by AWS. I have then received the email with the subject "DKIM setup SUCCESS for <domain>", and the domain was shown as verified in AWS SES. Now, the domain is shown in status "pending" again, even though the CNAME records still exist. I've looked up the three CNAME records again and again, I've checked that no typo was made and not a single character was missing, everything seems to be configured correctly. But AWS SES still shows the domain in status "pending".I've been using the host command to verify that the CNAME record exists. For example, in the AWS console, it says that xyz._domainkey.example.com should point to xyz.dkim.amazonses.com. So I ran the command:host xyz._domainkey.example.comand the output is: xyz._domainkey.example.com is an alias for xyz.dkim.amazonses.com.What could be the reason that it's still not working? Is there anything else I can do to troubleshoot this further?I'm not sure if these two events are related, but I remember that I've tried to add an additional verified domain, which was a subdomain of the already existing verified domain. I've received an error message (I don't recall which one, unfortunately). I could be wrong, but I think that the issue with the status "pending" appeared shortly after this failed attempt to add an additional verified domain.I am not using AWS Route 53 for the domain, in case that matters.Thanks for any advice.FollowCommentflyoverGreg 2 months agoWe just experienced same thing. Unclear whether this is a phishing attempt or if AWS has a mass email running amok. Received 8 emails each for 2 domains with the same subject line.The email continues: "You can now send DKIM-signed emails from any address within this domain through both Amazon SES and Amazon Pinpoint."Strange for these reasons:I've never sought to use SES or Pinpointthe emails were received by our non-AWS mail host, but its MX record resides on Route 53.Q: is this from AWS? if so, it's weird behavior that requires me to research. If not, AWS has been compromisedShare"


Question: SCV dispatched error CAN_NOT_LOG_IN for eventType SETUP_CONNECTOR SSO failed and iframeRetriesExhasuted

"Hi ,We have service cloud voice with amazon connect telephony integration in salesforce . We tried to add the user to the amazon Contact center , user got added successfully both in salesforce and AWS. But , when we tried to login via omnichannel we got below error in Omni-Channel utility or the Salesforce window -'We can't log you in . Try refreshing your browser , or ask your Salesforce admin for help.'When we checked in browser console , there we got error message as below - SCV dispatched error CAN_NOT_LOG_IN for event Type SETUP_CONNECTOR SSO failed and iframeRetriesExhasuted .Any ideas on what is causing the error ?FollowComment"

Answer: "0Hello,I understand that you have successfully added users in Amazon Connect and in Salesforce. However, when logging through Salesforce omnichannel, you are observing the below error in the browser window: "SCV dispatched error CAN_NOT_LOG_IN for event Type SETUP_CONNECTOR SSO failed and iframeRetriesExhasuted"The above error looks like there seems to be some issues on the Connected App that we configure in the Salesforce to connect with the Amazon Connect. Please refer to the steps once [1] listed in this specific implementation document under "Create a Connected App for Amazon Connect".To further troubleshoot the SCV sourced error you are observing with SSO login[2] , I request you to open a support case with Salesforce team. This is because the Salesforce Service Cloud Voice solution is completely managed by Salesforce and the CCP is also provided by Salesforce as well.References:[1] https://resources.docs.salesforce.com/latest/latest/en-us/sfdc/pdf/support_voice_pt_amazon_connect.pdf[2]. https://help.salesforce.com/s/articleView?id=sf.voice_expert_support.htm&type=5CommentShareSUPPORT ENGINEERAWS-User-6143341answered 4 months ago"


Question: "[BUG] Unable to retrieve attribute for AWS::OpenSearchService::Domain, with error message Internal error occurred, due to throttling"

"Posting https://github.com/aws/aws-cdk/issues/18239 here for increased visibility.Stacks using attributes of Opensearch domains will randomly fail to deploy. The message shown in Cloudformation is similar to "Unable to retrieve Arn attribute for AWS::OpenSearchService::Domain, with error message Internal error occurred".The actual cause as per discussion in that issue is that the DescribeDomain calls are being throttled, and Cloudformation is not handling the throttling sensibly.This is a pernicious bug because of it's unpredictability. In my case, I've deployed my application successfully many times, and have never seen this issue before. I hit this issue whilst upgrading from Elasticsearch 7.10 to Opensearch 1.2; I was making no other changes. I'm stuck unable to rollback cleanly either, as it's not possible to go from Opensearch 1.2 to Elasticsearch 7.10. So I'm having to skip rolling back the cluster, and attempt to roll forward until either it succeeds, or I'm forced to hardcode the domain attributes I should be looking up.According to the CDK issue, the internal tracking code for this issue is V498467686.FollowComment"


Question: BYOIP deprovision during region fail

Suppose we used BYOIP in primary region and if we have to use the same IP's in DR region while primary region down.Is it possible to deprovision the BYOIP subnet from primary region and reprovision in DR region.FollowComment

Answer: "0Hello,Please see this re:Post questionCommentShareEXPERTTushar_Janswered a year ago"


Question: Unable to delete a glacier vault

I have followed all the instructions as per https://docs.aws.amazon.com/amazonglacier/latest/dev/getting-started-delete-archive-cli.html to delete a glacier vaultHowever the vault still appears on the console and I am getting the following errorError deleting vaultVault not empty or recently written to: arn:aws:glacier:ap-southeast-2:XXXXXXXX:vaults/testvaultFollowComment

Answer: "1Accepted AnswerThere should have been no writes to the vault since the last inventory.S3 Glacier prepares an inventory for each vault periodically, every 24 hours. Because the inventory might not reflect the latest information, S3 Glacier ensures the vault is indeed empty by checking if there were any write operations since the last vault inventory.So retry after 24 hours :-)https://docs.aws.amazon.com/amazonglacier/latest/dev/api-vault-delete.htmlhttps://docs.aws.amazon.com/amazonglacier/latest/dev/working-with-vaults.htmlCommentShareJaccoPKanswered a year agoAWS-User-6341691 a year agoIn my case, there are no writes to the vault. I already tried for 3 days, leaving 24 hours in between,  and I keep getting the same errors. ThanksShareAWS-User-6341691 a year agoAlso, my problem is deleting archive. It keeps saying Invalid Vault name even though the vault name is correct. Used the exact same code and aws command than I used with other vaults that worked perfectly. Yet on these two vauts I keep getting the errorShare"


Question: Failed to fetch secret (temporary issue)

"Hello, this past weekend for about an hour or so, there was some cases of failures to fetch a secret which my aws sdk node library uses to access RDS.The error message is like:Failed to fetch secret arn:aws:secretsmanager:ap-northeast-1: ...Could this possibly have been to some kind of temporary issue on aws at that time, or is it possible I have some configuration done wrong. Other than this time period, I havn't noticed the issue. It was on server ap-northeast-1 on 3-13 from around 12:00 - 13:18 UTC.FollowComment"

Answer: "0Hi,today we had the same problem.Reason:I have selected the wrong secret and changed the encryption key ( my plan was to change the encryption key for an other secret )Maybe you could re-check that the current encryption key is the expected one.CommentSharenoxifyanswered 2 years ago"


Question: (resolved) The Meaning of User Icons in AWS re:Post

"Thank you for your assistance.This question relates to the following question. [1][1] What do moderators and AWS icons mean for re:Post users?https://repost.aws/questions/QUAsU27tkQTayra-hPhF1YCQ/what-do-moderators-and-aws-icons-mean-for-re-post-usersSince there was no response to the additional questions in the above case, we have drafted this case.We would appreciate it if you could enlighten us on the following points・Can I take the answer from the expert user as an official answer from AWS?・What does it mean when a user does not see the words "expert" or "support engineer" but only the "aws" icon?・What do users with the word moderator mean?Thank you in advance for your cooperation regarding the above.FollowComment"

Answer: "1Accepted AnswerHi mn87,AWS re:Post is a community-driven knowledge service (Q&A and articles) to help AWS Customers get technical guidance. re:Post community includes AWS customers, AWS partners and AWS employees. AWS employees are shown with the "aws" icon. Users with the word "Expert" are a mix of external users and AWS employees who are SMEs in their areas. "Moderators" keep the content free from spam and ensure Community Guidelines are followed. Please refer to re:Post Terms of Use and Community Guidelines for details. We recommend reaching out to AWS Support or your AWS point of contact for any production workloads related guidance.Let me know if this answers your questions. Thank you for your interest in re:Post community.MonicaCommentShareSUPPORT ENGINEERMonica_Lluisanswered 8 months ago"


Question: "The firewall was turned on, then the SSH connection was blocked, and I disconnected from the server again"

"I opened the firewall, the 22 port of ssh was blocked, I don't know, opened ftp and the connection to the server was broken.Now I can't log in to turn off the firewall, according to the Internet, you can attach its hard disk to another server, and then modify the configuration file, but after I hung up, I found that I couldn't open the hard disk at all, to check and say what needs to be formatted, or there is no file system, to create a file system, and there is a prompt, if there is original data, it will be formatted.I just want the data inside, I want to connect back, I want to mount to other services, and see if I can shut down the server.FollowComment"

Answer: "0Accepted AnswerStop the target EC2 once and detach the root volume using the following method.https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ebs-detaching-volume.htmlThen attach the EBS to a different EC2 and retrieve the data.https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ebs-attaching-volume.htmlThen make the EBS available by following the steps in the following document.https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ebs-using-volumes.htmlIf your EC2 is Linux, follow the procedure in the following document.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-detaching-volume.htmlhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-attaching-volume.htmlhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-using-volumes.htmlCommentShareEXPERTRiku_Kobayashianswered a month agorePost-User-2209798 a month agoStep three I was in trouble. I don't know how to create a file system for a partition, like:NAMEFSTYPELABELUUIDMOUNTPOINTxvdf├─xvdf1  ext4     1.0   cloudimg-rootfs cda0c0a7-e64a-4413-85a5-a0235f6f567f├─xvdf14└─xvdf15 vfat     FAT32 UEFI            54D6-C8B8You can see that xvdf14 does not have a file system, how can I do it?The case only says that if there is no file system, it is created: sudo mkfs -t xfs /dev/xvdfSharerePost-User-2209798 a month agoBut that's for all of it (I mean, if you're using xvdf, then xvdf1 xvdf14 xvdf15 will all create xfs filesystems, but sort of partitions already have filesystems)?I also tried this command, but it showsmkfs.xfs: /dev/xvdf appears to contain a partition table (gpt).mkfs.xfs: Use the -f option to force overwrite.After that I tried adding a file system for that partition separately:sudo mkfs -t xfs /dev/xvdf/xvdf14displayError accessing specified device /dev/xvdf/xvdf14: Not a directoryI don't know how to add a separate file system for a partition, and the tutorial doesn't tell you how to add a separate file system for a partition, or if some subpartitions (like my example above) have a file system, then the large partition does not need a file system?I'm stuck in step three, prompting when I perform mountwrong fs type, bad option, bad superblock on /dev/xvdf, missing codepage or helper program, or other error.ShareRiku_Kobayashi EXPERTa month agoWhen mounting the EBS that contains the data, do not execute commands that set up the file system.As noted in the documentation, the data will be lost.Do not use this command if you're mounting a volume that already has data on it (for example, a volume that was created from a snapshot). Otherwise, you'll format the volume and delete the existing data.If you mount it according to the original file system, it should be fine.mount -t ext4 /dev/xvdf /mnt/tempSharerePost-User-2209798 a month agoI used this command and then prompted：sudo mount -t ext4 /dev/xvdf /mnt/tempmount: /mnt/temp: /dev/xvdf already mounted or mount point busy.when I use:sudo fuser -mv /mnt/tempIt prompted:                     USER        PID ACCESS COMMAND/mnt/temp:           root     kernel mount /                     root          1 .rce. systemd                     root          2 .rc.. kthreadd                     root          3 .rc.. rcu_gp                     root          4 .rc.. rcu_par_gp                     root          5 .rc.. slub_flushwq                     root          6 .rc.. netns                     root          7 .rc.. kworker/0:0-events                     root          8 .rc.. kworker/0:0H-events_highpri                     root          9 .rc.. kworker/u30:0-events_power_efficient                     root         10 .rc.. mm_percpu_wq                     root         11 .rc.. rcu_tasks_rude_kthread                     root         12 .rc.. rcu_tasks_trace_kthread                     root         13 .rc.. ksoftirqd/0                     root         14 .rc.. rcu_sched                     root         15 .rc.. migration/0                     root         16 .rc.. idle_inject/0                     root         18 .rc.. cpuhp/0                     root         20 .rc.. inet_frag_wq                     root         21 .rc.. kauditd                     root         22 .rc.. khungtaskd                     ...SharerePost-User-2209798 a month agoBut when I use:cd /mnt/tempandlsThere is nothingShareShow 2 more comments"


Question: I'm getting charged and don't know how to stop it

"So, I just started yesterday practicing with terraform and aws. Me and a coworker.We were doing an excercise to familiarize with terraform and aws following a guide. We were doing the same (except for deploying in different regions)We did terraform apply, everything works great. Later, I discover that I'm getting charged a large amount of money. He is not, his is a really really small amount. Mine:This is hours later after I did terraform destroy... I have no idea on how to stop this. What is causing this? There is no t2.medium or m4.large in my terraform code... just 2 t2.micro, an VPC, EKS...The NatGateway is no more... but it says there that it's being used and charging me hourly.What 4 services are active? It also says that there are two regions active. I know that eu-west2 london is one, but  I'm really not sure about what the other one is or how to get to know that.I'm pretty much new to this so, I hope someone can help me. I already know it's going to spend the whole night charging me for no reason and feels really bad.Also, if I were to delete my account (not sure how it it), everything should stop 100% right?Edit1:It's going up... Don't know what to do.FollowComment"

Answer: "1Hi,AWS services cost depend on the region, generally it is less expensive in us-east-1.For EKS you pay for the EKS dashboard even if the EC2 instances are down. (go to EKS and see if you still have your cluster)Data transfer fees are there because you have more than 1 node in multiple AZsActive region does not means you have service deployed there, in the cost explorer you can check cost per region.Make sure to run terraform destroy and read the terraform plan to see how many resources were created and how many were destroyed.You can go service per service and clean up manually in AWS console (which I don't recommend because those resources was created using terraform).CommentShareMarwaanswered 10 months agoEXPERTChris_Greviewed 10 months agorePost-User-1866250 10 months agoI'm confused on what was already there and what was created by my terraform... Some stuff had names that I wrote so those were easy but I feel that it created more stuff with no tag or something... I hava already deleted VPC... NatGateways... I'm checking regions and regions and still don't see whats causing it.ShareMarwa 10 months agoI think you should be good, and the forecast cost will be adjusted. Keep an eye on itShare"


Question: My website is very slow

My website (https://bookndoc.com) is very slow.There are 2 minutes of response time on average per pageThere are no errors in the system logs or apache logs. Do you have an idea ?FollowComment

Answer: "1As well as CloudWatch Metrics for your resources, you might want to look at exploring CloudWatch Synthetics and/or RUM to get some visibility into the end user experience of your website.Amazon CloudWatch Synthetics: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries.htmlAmazon CloudWatch RUM: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-RUM.htmlYou can also find some hands-on exploration for both in the Observability workshop: https://catalog.workshops.aws/observability/en-USCommentShareAWS-SAanswered a year ago0Hi.Are you checking the metrics of your website?Is the site always slow? Are there any conditions to be late? As far as I could see, it was fast.You can check CloudWatch metrics and monitor the resource status of your web server to gain insights into what is affecting your website's performance.Alternatively, if you're not having problems with your web server, you can use Chrome's developer tools to analyze whether you're having problems with your network or your browser's rendering.CommentShareEXPERTiwasaanswered a year ago"


Question: Resourceinitializationerror: unable to pull secrets or registry auth: context deadline exceeded

"Hi Team,I'm trying to use AWS Batch service with ECS Fargate. It's basically a python script to fetch the db password stored as secret from AWS SSM Parameter and run an ETL function.I have ensured networking(internet access with NAT Gateway) and the required iam permission(Full Access) to fetch the secrets or ecr image. It is scheduled to run on an hourly basis. Sometimes, it is working fine but some other time it is failing with the below message."Resourceinitializationerror: unable to pull secrets or registry auth: execution resource retrieval failed: unable to retrieve secrets from ssm: service call has been retried 5 time(s): RequestCanceled: request context canceled caused by: context deadline exceeded"This seems to be a strange issue. I'm happy to fix if any changes to be done from my side but i'm little worried on why it is unstable. Can some clarify on this issue please?FollowCommentHenrique Santana 5 months agoSince it is an intermittent issue, it seems to be related to the subnet configuration (NACL?).Is it possible to share the networking configuration that you are using? e.g.: subnet conf, route table, SG, NACL, etc?All this would help to troubleshoot this. "context deadline exceeded" is usually a network issue. Also, if you have a Premium Support plan, I'd encourage you to open a case with them to get more help.Sharearunkumarwiz 5 months ago@Henrique Thanks for the response. We are using 2 private subnets for running AWS Batch fargate container. NACL is opened for all traffic ingress and egress. Route table is configured with Nat Gateway for Internet traffic. Egress of SG is opened to all traffic and ingress is empty. We do not have premium support. I have been running it as a cron schedule for every 2 hours. Success rate is around 70% and it is getting failed with the same error other times. Can you please let me know what else the issue maybe? Will this issue be fixed if i use AWS Secret manager instead of SSM Parameter store?ShareHenrique Santana 5 months ago"context deadline exceeded" errors are likely a network issue. We have this knowledge center article that might help you: https://aws.amazon.com/premiumsupport/knowledge-center/ecs-unable-to-pull-secrets/Let me know if this helps youShare"


Question: Firehose compression cost

Is there an additional cost when we compress data like bzip? It is not clear from the firehose pricing web and I need this information for some realistic cost calculations:https://aws.amazon.com/kinesis/data-firehose/pricing/?nc=sn&loc=3FollowComment

Answer: "1Hi,In documentation there is no explicit additional cost when using compression in Firehose. It is more how compression influences ingestion price, as the more data is compressed => the less amount of data needs to be ingested/stored => the less you pay.Hope it clarifies.CommentShareEXPERTalatechanswered 3 months ago1There are four main components to Kinesis Data Firehose pricing:Ingestion (per-GB / tiered)Format Conversion (per-GB)VPC Delivery (per-GB)Dynamic Partitioning (per-GB)Specifying compression in your KDF configuration will not affect Kinesis pricing, but could lower storage pricing depending on where the data is being pushed.CommentShareDarren Ranswered 3 months ago"


Question: Strategy to validate Elastic Beanstalk environment in CodePipeline

"I have an Elastic Beanstalk environment that's deployed using AWS CDK and AWS CodePipeline. Currently, problems with the Beanstalk deployment aren't necessarily reported back by CloudFormation. For example if there's a bug in the application code that prevents the updated environment from launching successfully, the CloudFormation / pipeline deployment will succeed and then the Beanstalk environment will soon-after transition into an unhealthy state.I'd like CodePipeline to detect this failure and mark the pipeline execution as failed, blocking promotion to subsequent stages. I'm looking for advice on how to do this. I'm imagining two approaches:Add a CodeBuild step to the pipeline after the CDK deployment that uses the AWS CLI to check on the environment statusAdd a custom resource Lambda function that checks on the environment status after the deployment as part of the CDK deployment processMaybe it's also possible to adjust the Beanstalk settings to do this validation automatically, but there seems to be some open issues related to this (https://github.com/aws/elastic-beanstalk-roadmap/issues/162)I'm leaning toward the second option above but would love to get some input on this before getting started.FollowComment"

Answer: "1The second option you mentioned, adding a custom resource Lambda function that checks on the environment status after the deployment as part of the CDK deployment process, would be the best approach to accomplish this task.This approach would allow you to programmatically check the status of the Beanstalk environment after the deployment and return a failure status to the pipeline if the environment is in an unhealthy state. This would allow the pipeline to be marked as failed and block promotion to subsequent stages.You can use the AWS SDK for JavaScript in Node.js, AWS SDK for Python (Boto3), or any other SDK to interact with Elastic Beanstalk and check the environment status.Here's an example of how you might implement this using a Lambda function and the AWS SDK for Python (Boto3):Create a new Lambda function in the same region as your Elastic Beanstalk environment.In the Lambda function, import the Boto3 library and create a new Elastic Beanstalk client.Use the describe_environment_health method to check the status of the environment.If the environment is in an unhealthy state, raise an exception that will be caught by CloudFormation and mark the pipeline execution as failed.In your CDK code, include the Lambda function as a custom resource in your CloudFormation stack.After the CDK deployment, the Lambda function will be invoked and will check the status of the Beanstalk environment.You can also use CloudWatch Event Rules to schedule your Lambda function to check the environment status periodically and raise an exception if the environment is in an unhealthy state.This approach would provide a more automated solution that would make sure that the pipeline execution is marked as failed whenever there's a problem with the Beanstalk deployment, and that itCommentShareAhmad Ul Islamanswered 4 months agoAWS-User-5344994 4 months agoAwesome, thanks for your input!Share"


Question: ERROR: External function my_proc_name cannot be accessed via Lake Formation

"I have a procedure that suddenly stopped working, it resides in a redshift spectrum schema with  lake formation. I tried to give the IAM role attached to this schema all the privileges that I could thought of, but I am still getting the same error: 'ERROR: External function my_proc_name cannot be accessed via Lake Formation.'MY question: Does procedures even allowed to run in redshift spectrums with lake formation?Any ideas? Thanks!FollowComment"


Question: Unable to Delete objects from versioned bucket using Lifecycle Rule

"Hi,I have been trying to setup a lifecycle rule to delete all the objects in my versioned bucket.My motive is to delete the complete bucket.DetailsThe Bucket is versionedBucket is using around 120TB of storage all objects are older than 2 years the glacier transition was 1 year agoLifecycle rule implemented (Currently i have implemented the following lifecycle rule but there is no change in the bucket size)The above lifecycle was implemented 4 weeks ago.I cant even see the objects in the bucket it takes forever to loadCan someone please help me identify what am i doing wrong ?NOTE I want to delete the complete bucket but untill the bucket is empty AWS doesnt allow me to delete the bucketFollowComment"

Answer: "2Accepted AnswerYou have versioning enabled, but the lifecycle policy is only deleting the latest version objects. You should consider modifying your lifecycle policy to also delete the non-current (older) versions of the objects so that those will be deleted as well.CommentShareEXPERTShlomo Dubrowinanswered a month agoShithanshu Mishra a month agoHi Sholomo Dubrowin,Thank you for the responseSo i have to setup a Lifecycle policy withExpire current versions of objectsPermanently delete noncurrent versions of objectsDelete expired object delete markers or incomplete multipart uploadsNoncurrent versions actionsDay 0Objects become noncurrentDay 10 newest noncurrent versions are retainedAll other noncurrent versions are permanently deletedDelete expired object delete markers or incomplete multipart uploadsExpired object delete markersIncomplete multipart uploadsDelete after 1 daysSorry i am unable to share image in commentsDoes the above lifecycle looks good or should i make some more changes ?ShareShlomo Dubrowin EXPERTa month agoYes, that looks like it should do the trick. It may take a couple of days for the lifecycle to actually do the delete. It depends on what time the lifecycle runs and when the new policy is installed. But you should see a decrease in the number of objects in a couple of days.I see you shared CloudWatch metrics with the object counts, are you aware of the S3 Storage Lens, which is free with the default settings? Storage Lens can also show Multipart Upload metrics and noncurrent version metrics along with others.https://aws.amazon.com/blogs/aws/s3-storage-lens/ShareShithanshu Mishra 20 days agoHi Sholomo Dubrowin,Thank you for the answer i was able to delete the objects using your feedback.Share"


Question: Are there any additional costs for cross-Region data transfers through AWS Direct Connect?

"We have Direct Connect service in two different AWS Regions. If we trombone traffic from the first Region to the second Region using Direct Connect through our data center, will we get billed for cross-Region network costs?FollowComment"

Answer: "0Accepted AnswerNo, the data transfer you described wouldn't be billed as cross-Regional. The transfer would be billed applicable egress data charges based on the source AWS Region and Direct Connect location.For more information, see AWS Direct Connect pricingCommentShareEXPERTSpencerAtAWSanswered 3 years ago"


Question: Gamelift architecture design and prices

I'm familiarizing myself with the realtime architecture: https://docs.aws.amazon.com/gamelift/latest/developerguide/realtime-architecture.html and also looking at the prices https://aws.amazon.com/gamelift/pricing/ and got some related questions pls.Is there any drawback with using a Lambda for Client Service(for auth and inventory)? When would you use EC2 instance for it and how could this be scaled if necessary?What is an instance from the pricing page in case of the above architecture? Is it the Realtime Server (in the fleet) ?Thanks!FollowComment

Answer: "0Accepted AnswerHello! Before actually answering your question, I would recommend you to check out another Amazon Game Service product: GameSparks [1] -- it is a managed solution that seems to fit your use case very well. It could help you quickly get the boilerplates  (inventory, auth, achievements, etc.) out of the way, so you can focus more effort on your actual game development. If you decide to go with GameSparks in long term, it is also scalable out-of-the-box.IMO the biggest drawback of using a lambda is that it can be quite expensive if you have frequent calls and/or expensive computations. With lambda, you are charged per request and duration of the request; e.g. each time your player logs in, or each time when your player opens its inventory or conduct a transaction, you have to invoke lambda to do a database lookup. All of those lambda invocations will cost you. On top of that, you have to setup Provisioned Concurrency [2] to overcome Lambda cold start problem, which will further increase the operational cost. With a dedicated EC2 instance, you might be able to achieve a lower cost as you only pay for duration of the instance uptime. You can use AutoScalingGroups to scale up and down the EC2 instances. With the "Multi Instance Type and Purchase Options" feature [3], you have lots of options to scale instances while keep price low and availability high.Instance is where the realtime servers are executed on. The realtime servers are NodeJS processes running your JavaScript that is listening to different ports (8000, 8001, etc.) on an instance. An instance can have multiple Realtime servers (depends on your concurrency settings), and a fleet can have multiple instances (depends on your scaling settings).[1] https://docs.gamesparks.com/getting-started/[2] https://aws.amazon.com/blogs/compute/new-for-aws-lambda-predictable-start-up-times-with-provisioned-concurrency/[3] https://aws.amazon.com/blogs/aws/new-ec2-auto-scaling-groups-with-multiple-instance-types-purchase-options/JamesCommentSharerePost-User-1212771answered 3 years ago0Thanks a lot for the golden info @REDACTEDUSERGamesparks indeed has many great features, but looking at its pricing i think this is not for me (a prototype or small project of a just starting developer). At the bottom of this page there is a 'Per month' fee: https://gamesparks.com/pricing/ If i understand this correctly, this is the base cost. So i think as starter, im gonna go with AWS Cognito for auth and work out some social features myself.I have a follow-up question pls. Is there a way to see resource usage data, especially memory, on a given instance in a Fleet in Gamelift? I want to be able to fine tune provisioning based on resource usage by Realtime scripts on game servers.So maybe there is plenty of unused CPU left, but since all the memory is used up, Gamelift spins up another instance (based on scale config ofc). Or vice-versa. And maybe choosing another EC2 type would be more efficient with the given Realtime scripts.The only place i found a description about memory usage monitoring is this EC2 related one: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/mon-scripts.html But here i supposed to install something to be able to get the data and i think i won't be able to do that if i use Realtime servers. Am i missing some information? How would you do this kind of monitoring?Thanks!Edit: ok, looks like there is a workaround. I can get CPUUtilization of a given EC2 instance. So i can check this when there are more than 1 instances running and if the CPU usage is not 100%(probably the threshold is a bit lower than this) on the first instance, then the scale out most probably happened due to insufficient memory. Still nothing concrete, but at least i have a hunch.Maybe i should ask this topic in a separate question. Coz im also wondering if i have one, almost fully utilized instance(let's say i can catch this point somehow) and if i check the number of the game sessions (reference here) and divide the instance's max memory with this number, then i can get the memory used for one session... Probably im already too deep down the rabbit hole. :) Not sure these insights are really going to help. But im curious anyway.CommentSharerePost-User-0631075answered 3 years ago"


Question: getting failedinvocations in aws eventbridge

"I have programmatically defined a eventbridge rule to send an event when a crawler completes.response = event_client.put_rule(Name="newmyrule",EventPattern='{"detail-type": ["Glue Crawler State Change"],"source": ["aws.glue"],"detail": {"crawlerName":["'+crawler_name+'"],"state": ["Succeeded"]}}')print("put_rule="+str(response))put_target_response = event_client.put_targets(Rule='newmyrule',Targets=[{'Id': 'mylambdafn','Arn': 'arn:aws:lambda:us-west-1:xxxxxxxxxxxxx:function:mylambdafn'}])enable_rule_response = event_client.enable_rule(Name='newmyrule')I have also defined the crawler through boto3.create_crawler_response =glue.create_crawler(Name=crawler_name,Role='arn:aws:iam::xxxxxxxxxx:role/ravi-glue-access',DatabaseName='noah-ingest',#TablePrefix="",Targets={'S3Targets': [{'Path': s3_target}]},SchemaChangePolicy={'UpdateBehavior': 'UPDATE_IN_DATABASE','DeleteBehavior': 'DELETE_FROM_DATABASE'})It looks similar to rules defined through the console but results in failedinvocations. How do I fix this.thanks,Ravi.FollowComment"

Answer: "1I suspect your lambda doesn't have the appropriate permissions that would allow eventbridge to trigger it.If you're using boto3 to set this up, you probably need to use add_permission() (https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/lambda.html#Lambda.Client.add_permission) something likeresponse = lambda.add_permission(  functionName = '_insertFunctionNameHere_',  statementId = 'AllowExecutionFromEventbridge',  action='lambda:invokeFunction',  principal='events.amazonaws.com',  sourceArn='_insertARNofEventBridgeRule_')replacing the values beginning _ appropriately.See https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-troubleshooting.html#eb-lam-function-not-invoked for more infoCommentShareSimon Hanmeranswered 3 months ago0Try out the code below. Replace xxxxx with youractual aws account ID. Also provide correct Role and Target values. If you still encounter any issues, try and check the IAM roles and permissions for your lambda function and Glue crawler.Hope it helps.import boto3import jsonCreate an EventBridge clientevent_client = boto3.client('events')Define the crawler namecrawler_name = 'my-crawler'Define the event patternevent_pattern = {"source": ["aws.glue"],"detail-type": ["Glue Crawler State Change"],"detail": {"crawlerName": [crawler_name],"state": ["Succeeded"]}}Define the targettarget = {"Arn": "arn:aws:lambda:us-west-1:xxxxxxxxxxxxx:function:mylambdafn","Id": "mylambdafn"}Define the rule namerule_name = "my-crawler-completed-rule"Create the rulecreate_rule_response = event_client.put_rule(Name=rule_name,EventPattern=json.dumps(event_pattern))Add the target to the ruleput_targets_response = event_client.put_targets(Rule=rule_name,Targets=[target])Enable the ruleenable_rule_response = event_client.enable_rule(Name=rule_name)Define the Glue crawlerglue = boto3.client('glue')create_crawler_response = glue.create_crawler(Name=crawler_name,Role='arn:aws:iam::xxxxxxxxxx:role/ravi-glue-access',DatabaseName='noah-ingest',Targets={'S3Targets': [{'Path': s3_target}]},SchemaChangePolicy={'UpdateBehavior': 'UPDATE_IN_DATABASE','DeleteBehavior': 'DELETE_FROM_DATABASE'})print("EventBridge rule created successfully")CommentShareKenneth Mbuguaanswered 3 months ago"


Question: Instance Launch failure through Cloud Formation Template

"Hello Team,I'm trying to launch an instance through CF template. However, I'm getting below error while launching:"Value of property SubnetId must be of type String"Steps Followed:Created a VPC CF template and defined "Outputs" in the template section as below:Outputs:PublicSubnet1:Description: Public Subnet 1 IDExport:Name: !Sub ${AWS::StackName}-PublicSubnet1Value: !Ref PublicSubnet1Created an EC2 launch template and in "Resources" section , defined Subnet properties as follows:Properties:SubnetId:- Fn::ImportValue: !Sub ${ExportVpcStackName}-PublicSubnet1Can anyone please advise what the reason for failure?Thanks,AbhishekFollowComment"

Answer: "0Here is the example from the documentation:Resources:  WebServerInstance:    Type: 'AWS::EC2::Instance'    Properties:      InstanceType: t2.micro      ImageId: ami-a1b23456      NetworkInterfaces:        - GroupSet:            - Fn::ImportValue:               'Fn::Sub': '${NetworkStackNameParameter}-SecurityGroupID'          AssociatePublicIpAddress: 'true'          DeviceIndex: '0'          DeleteOnTermination: 'true'          SubnetId: Fn::ImportValue             'Fn::Sub': '${NetworkStackNameParameter}-SubnetID'It looks like you are presenting an array, '-', as the value to SubnetId.CommentShareEXPERTkentradanswered 2 months ago"


Question: IoT thing shadow and Greengrass component

"Is it possible to work with IoT thing shadow from Greengrass component without any extra configs and connections?We can subscribe to IoT core topicts by using IPC client as described in https://github.com/aws/aws-iot-device-sdk-python-v2/blob/463d72ea1ecb501322c467b103f1a0ee3f45f969/samples/ipc_greengrass.pyipc_client = awsiot.greengrasscoreipc.connect() - makes all authentication stuff.But interaction with shadows requires additional configuration: certificates, endpoint etc.- https://github.com/aws/aws-iot-device-sdk-python-v2/blob/463d72ea1ecb501322c467b103f1a0ee3f45f969/samples/shadow.pyAfter that IotShadowClient provides all needed methods to subscribe and publish to shadow topics.Does IotShadowClient support work through IPC when it is used in component without establishing a dedicated connection to AWS IoT custom endpoint?What is the best way in general to communicate GGv2 component and IoT shadow?FollowComment"

Answer: "0Hi lacteolus,The device SDK provides clients and APIs for accessing the AWS IoT cloud data plane services. It also provides a client for talking with the Greengrass v2 IPC.The IoTShadowClient in the device SDK is a client for talking directly with the AWS IoT Device Shadow Service in the cloud.It maintains its own connection - hence the need for the device certificate information. This client does not work through the Greengrass IPC.At this time, there is no equivalent to the local shadow service / sync that Greengrass v1 provides.In order to talk to the cloud shadow service, you do not need to use the IoT shadow client.  A V2 component can talk with IoT Shadow via the Greengrass managed MQTT connection.The following access control policy allows your component to subscribe and publish to the shadow MQTT topics      "accessControl": {        "aws.greengrass.ipc.mqttproxy": {          "shadow-mqtt-example": {            "policyDescription": "Allows access to shadow.",            "operations": [              "*"            ],            "resources": [              "$aws/things/+/shadow/#"            ]          }        }      }Your python component can follow the MQTT pub/sub example here: https://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-iot-core-mqtt.htmlYou can subscribe to $aws/things/thingName/shadow/update/accepted to get any remote shadow updatesand publish state to $aws/things/thingName/shadow/updateIn this case, thingName is the name of the thing you want to update.You can use the environment variable $AWS_IOT_THING_NAME to use the thing name of the core deviceSee https://docs.aws.amazon.com/iot/latest/developerguide/device-shadow-mqtt.html for more detail about using the shadow MQTT topics.Edited by: rob-aws on Mar 8, 2021 11:05 AMCommentShareRobanswered 2 years ago0Hi rob-aws,Thanks for info. So it means that we need to implement something similar to IoTShadowClient but using IPC and subscriptions to all needed shadow topics (update, delta, get etc.).I looked at https://github.com/aws/aws-iot-device-sdk-python-v2/blob/main/samples/shadow.py example and it seemed to be convenient - it has special classes for different shadow requests and methods for publishing and subscribing to named and classis shadow topice etc.CommentSharelacteolusanswered 2 years ago"


Question: Build Scalable APIs For Large Data Visualization With React Frontend

"We have Microsoft SQL DB and we are taking backup of data in CSV format from MSSQL db and uploading to S3 bucket. I tried to query data using Athena and AWS API Gateway to build API. Athena looks do not scale for our problem since using boto3 we are only able to fetch maximum 1000 rows at a time. We have 100, 000-1,000,000 rows in table. Since we faced this issue I checked Dynamo DB and Dynamo db has a limit of 1mb data.Can we use redshift to query data from s3 directly (I believe if we copy data to redshift from s3 it will insert the data again and in turn duplicate the data. I cannot use merge/update existing data in the redshift due to cannot identify these data with a uique key)?Is there any way to load data on client side quickly within 2-3 second?FollowComment"

Answer: "0Redshift can query data from S3 by using Redshift Spectrum, but it's likely to hit the same issue when transferring the result to the client because of the network overhead.It might be worth reconsidering if you really need such a large dataset in the frontend. Transferring a large dataset to the frontend may lead to lower user experience because of longer page response and more memory consumption in the client. Also, in most cases users do not need to visualize that much rows at once.So, one option is to aggregate or extract the specific data which gives the insight to the user.Another option is to introduce incremental rendering like some BI applications and websites do. The frontend will fetch and display minimal data at the first render. As a user scrolls the screen, the frontend will incrementally fetch and render the paginated result. This will minimize the initial data transfer and page response. If the user needs the full dataset, it can be implemented as a data export button.CommentShareYota_Hanswered 2 months ago"


Question: "New account has subnets, security groups, and VPCs in 17 regions."

I recently created a new AWS account.On the EC2 Global View page(https://us-east-1.console.aws.amazon.com/ec2globalview/home)It lists :55 subnets in 17 regions17 security groups in 17 regions17 VPCs in 17 regionsAre these all some type of defaults for a new account?Or has my account already been hacked?FollowComment

Answer: "3This is normal and expected.  Original regions are enabled by default.  See the docs for more:The original AWS Regions (the Regions that existed before we added the ability to enable and disable Regions) are all enabled by default and can't be disabled.You can (and should) use Service Control Policies to limit regions services can be enabled in.CommentSharethat_mikeanswered a year ago3Your Amazon Web Services account has a default VPC in each AWS Region. The default VPC includes a default public subnet in each Availability Zone and an internet gateway that is attached to your VPC. The VPC also includes a default security group. For more details, please refer to following link: https://docs.aws.amazon.com/appstream2/latest/developerguide/default-vpc-with-public-subnet.htmlEach Region in your AWS account is provided a default VPC. You can use the default VPC instead of creating and configuring your own VPC. A default VPC is suitable for getting started quickly and for launching public instances such as a blog or simple website. You can modify the components of your default VPC as needed.Additional resources:https://docs.aws.amazon.com/vpc/latest/userguide/default-vpc.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/deleted-default-vpc/CommentShareIrfan_Sanswered a year ago"


Question: Change of already paid invoice

"Hello, I changed the name of the city in the settings since it changed the name and now I need to download the invoice for January and February with the changed name of the city. How can I do that?FollowComment"

Answer: "0HiPlease open a support ticket to rebuild your invoice, https://aws.amazon.com/premiumsupport/knowledge-center/change-pdf-billing-address/Thank YouCommentShareGKanswered 3 months ago"


Question: Workdocs Synchronization

"We use workdocs on 5 computers and we have the following problem:We create a file on the computer and it is automatically synchronized in the workdocs cloud almost instantly.Another user from another computer will need access to this file, but his sync takes too long causing him to open an old version of the file.The same problem happens on all company computers in different browsing environments.How can we solve this synchronization delay?FollowComment"

Answer: 0WorkDocs replication is asynchronous by nature. This means that both the upload and download processes may take a variable amount of time. There's no way to force the synchronisation of files to happen at a particular time.It sounds like you're looking for near real-time visibility of files across multiple computers then you might look at Storage Gateway if the users are all located together.CommentShareEXPERTBrettski-AWSanswered 3 months ago


Question: WAF AWSManagedRulesATPRuleSet paramter VolumetricIpHigh tuning

"Hello,I'm testing WAF AWSManagedRulesATPRuleSet  rule https://docs.aws.amazon.com/waf/latest/developerguide/waf-atp-rg-using.htmlIt works, but I cannot tune any specific parameters like  VolumetricIpHigh  https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-atp.htmlAs per my observations, any login failure get blocked after 20 failed attempts, but after ~20min this blocking is resolved and suspicious IP can attack again.Question: Is it possible to tune timeout for blocked IP in WAF managed rule AWSManagedRulesATPRuleSet for paramter   VolumetricIpHighFollowComment"

Answer: 0Hi !Thanks for reaching out to AWS Re:Post .I can confirm that it is not possible to tune timeout for blocked IP in WAF managed rule AWSManagedRulesATPRuleSet for parameter VolumetricIpHigh.CommentShareSUPPORT ENGINEERAnsh_C answered a year ago


Question: alice.it and tin.it are bouncing SES IP

"The following italian providers are bouncing SES IP ADDRESSalice.it and tin.itwith the message:{"notificationType":"Bounce","bounce":{"bounceType":"Transient","bounceSubType":"General","bouncedRecipients":[{"emailAddress":"XXXXXX@alice.it","action":"failed","status":"5.3.0","diagnosticCode":"smtp;550 mail not accepted from blacklisted IP address [54.240.11.71]"}],"timestamp":  xxxxxxxx........and that specific ip is listed on sorbs. See attached fileEdited by: accasoftware on May 20, 2019 3:16 AMEdited by: accasoftware on May 20, 2019 3:44 AMFollowComment"

Answer: "0Hello,Different blacklists have different impacts on the successful delivery of a message. Major email providers including Gmail, Hotmail, AOL, and Yahoo seem to recognize a very small number of highly regarded blacklists, such as those offered by Spamhaus. In our experience, other blacklists tend to have a low impact, although some mail systems emphasize certain blacklists over others.Our systems look for signs of abuse. If we detect sending patterns or other characteristics that could lead to an IP address being blacklisted, we send a notification to the sender. If the situation is severe, or if the sender doesn't fix the issue after we send the notification, we'll pause the sender's ability to send email until they resolve the issue. Enforcing our sending policies in this way helps reduce the chances that our IP addresses end up on blacklists.To work towards getting this delisted you should first, confirm that the message was truly blocked because of an IP blacklist. If your email was rejected because the sending IP address was blacklisted, you'll receive a bounce notification that mentions the blacklist provider by name, as in the following example:554 5.7.1 Service unavailable; Client host http://192.0.2.0  blocked using blacklistName; See: http://www.example.com/query/ip/192.0.2.0If you received a bounce notification, but it didn't contain information similar to the message shown in the preceding example, then the email provider most likely rejected your message for a reason unrelated to blacklisting.If you can confirm that an email provider is blocking your email because the sending IP address is on a blacklist, there are a few things you can do:Contact the postmaster of the domain that rejected your message to request an exception from their spam filtering policy. When you contact the postmaster, provide the bounce codes you received, the headers of the email you're trying to send, a measurement of the impact the blacklist is having on the delivery of your email, and information about why you believe that your email is being improperly blocked. In some cases postmasters may place rules in place to block on a single RBL listing, which is not a standard process among the industry. In your discussion with the postmaster we recommend requesting that they do not block for just a single RBL listing.  If the email provider doesn't respond, or is unwilling to change their policies, consider using a dedicated IP address. Dedicated IP addresses are addresses that only you can use. By implementing good sending practices, you can keep your engagement rates high, and your rates of bounces, complaints, and spamtrap hits low. Good sending practices can help ensure that your addresses don't end up on blacklists.  Finally, if you do have example bounce messages for emails that were blocked to a blacklist please reply to this or via the message. We will attempt to de-list these IPs on a best effort and case-by-case basis, please be aware that not all blacklists are created equal and that delisting from some RBLs is not possible. If you have further questions or concerns please review our Blacklists FAQ: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/blacklists.html  or reply to this for additional information.Regards,GauravCommentShareAWS-User-7751712answered 4 years ago0The problem is partially resolvedCommentShareaccasoftwareanswered 4 years ago0Tin.it continues to bounce SES IP ADDRESS because SES IP are blacklisted.Typical bounce message:{"notificationType":"Bounce","bounce":{"bounceType":"Transient","bounceSubType":"General","bouncedRecipients":[{"emailAddress":"XXXXXX@tin.it","action":"failed","status":"5.3.0","diagnosticCode":"smtp;550 mail not accepted from blacklisted IP address ,"timestamp": xxxxxxxx........Ip affected:54.240.11.12954.240.11.454.240.11.12254.240.11.17354.240.11.7754.240.11.12454.240.10.7254.240.11.7154.240.11.1654.240.11.132On tin.it web support page I found the blacklist used by tin:spamhaussymantecpsblsenderscoreEdited by: accasoftware on Jun 3, 2019 2:07 AMEdited by: accasoftware on Jun 3, 2019 2:22 AMEdited by: accasoftware on Jun 3, 2019 2:24 AMCommentShareaccasoftwareanswered 4 years ago0Hello,I have checked all the IP addresses listed and none of them is on Spamhaus.Quoting from our FAQ -Q4. Can Amazon SES have its IP addresses removed from a blacklist?We actively monitor blacklists that could impact delivery across the entire Amazon SES service, or that could impact the ability to send email to recipients who use major email providers, such as Gmail, Yahoo, AOL, and Hotmail. The blacklists offered by Spamhaus fall into this category. When one of our IP addresses appears on a list that meets either of these criteria, we take immediate action to have that address removed from the blacklist as quickly as possible.We don't monitor blacklists that are unlikely to impact delivery across the entire Amazon SES service, or that don't have a measurable impact on delivery to major email providers. The blacklists offered by SORBS fall into this category. When one of our IP addresses appears on a blacklist in this category, we'll ask the provider to remove our IP addresses on a case-by-case basis. Different blacklist providers have different policies for removing blacklisted IP addresses, so we can't guarantee that an address can be removed within a certain period of time, or provide estimates of how long it will take to have an address removed.Regards,Gaurav @ AWSCommentShareAWS-User-7751712answered 4 years ago0I don't know why and if you did something but from 06/03/2019 around 08:30 AM (time near your post) I'm not receiving bounce from the IPs mentioned above. Now I'm receiving from the following IPs:54.240.11.7354.240.11.7854.240.10.1854.240.11.7954.240.11.3254.240.10.2754.240.11.7054.240.10.7054.240.11.17454.240.11.8054.240.11.13154.240.11.12354.240.11.7554.240.11.121Thanks in advance if you can do something.CommentShareaccasoftwareanswered 4 years ago0Hello,The new list of IP's that you have provided are listed on SORBS and none of them is on Spamhaus.Quoting from our FAQ -Q4. Can Amazon SES have its IP addresses removed from a blacklist?We actively monitor blacklists that could impact delivery across the entire Amazon SES service, or that could impact the ability to send email to recipients who use major email providers, such as Gmail, Yahoo, AOL, and Hotmail. The blacklists offered by Spamhaus fall into this category. When one of our IP addresses appears on a list that meets either of these criteria, we take immediate action to have that address removed from the blacklist as quickly as possible.We don't monitor blacklists that are unlikely to impact delivery across the entire Amazon SES service, or that don't have a measurable impact on delivery to major email providers. The blacklists offered by SORBS fall into this category. When one of our IP addresses appears on a blacklist in this category, we'll ask the provider to remove our IP addresses on a case-by-case basis. Different blacklist providers have different policies for removing blacklisted IP addresses, so we can't guarantee that an address can be removed within a certain period of time, or provide estimates of how long it will take to have an address removed.Regards,Gaurav @ AWSCommentShareAWS-User-7751712answered 4 years ago0My SES quota:Sending Quota:send 1305300 emails per 24 hour periodQuota Used:17% as of 2019-06-10 11:50 UTC+2Max Send Rate:90 emails/secondAccount status:HEALTHY Bounce Rate 0.48%HEALTHY Complaint Rate 0.02%Problems with tin.it and ses ip blacklisted (mentioned above) impact for 2.71% of my communications.How can I resolve them?Is the only way possible the dedicated ip?Edited by: accasoftware on Jun 10, 2019 3:02 AMCommentShareaccasoftwareanswered 4 years ago"


Question: Custom SMS sender Lambda trigger

"I am trying to send a verification message via SMS using a Custom SMS sender in AWS. I want to include a sender ID in the message. However, I am facing issues with the Custom SMS sender and the Lambda trigger is not getting invoked.I followed the instructions in the following AWS documentation to set up a Lambda trigger for my Custom SMS sender.https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-custom-sms-sender.htmlI have double-checked my configurations as mentioned in the documentation, but unfortunately, I am still unable to trigger the Lambda function.I have configured the custom SMS trigger sources to be triggered by user signups in AWS Cognito.How can I resolve this issue and successfully send the verification message with the sender ID?FollowCommentvtjean a month agoCould you review your cloudwatch metrics and logs in regards to the Custom SMS? Maybe the IAM Role isn't configured correctly.Share"


Question: Import Bot Error in Lex V2

"Hi,While Importing a Lex V2 Bot in Lex Console, I’m getting the following error message.  Any clarification on what is exactly wrong?ErrorError creating bot [BOT-NAME] from import file“View details” only says:There was an error importing the bot. Make sure that the imported bot and contents of the zip file are correct, then try your request again.FollowCommentJeremy 8 months agoHi @user, we are attempting the same, only via the API with StartImport (not using the AWS Console). And we get the same non-descript error. Any chance you were attempting this via API, and/or found a solution?Shareuser 4 months agoHi @Jeremy, No, I was importing via Lex console and were unable to resolve it.Share"


Question: print statements in Greengrass v2 lambda not logged

It looks like even the simplest print statements in python 3.7 in Lambda functions for Greengrass v2 do not get logged anywhere. I've checked in /greengrass/v2/logs/<componentName>.log and /greengrass/v2/work/<componentName>/logs/0/ and don't see them. Is there some sort of config I need to add to make print statements go to the log files?FollowComment

Answer: "0Hi,This will be due to Python buffering the output. Please see: https://docs.aws.amazon.com/greengrass/v2/developerguide/troubleshooting.html#python-component-no-log-output.Cheers,Michael DombrowskiCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0I suppose not, as the first LoC is print("up and running", flush=True). Is there anywhere else that stdout would be redirected to?Edited by: kdixson on Apr 26, 2021 6:56 PMCommentSharekdixsonanswered 2 years ago0The output will be in the component's logfile, located at <root>/logs/<component name>.log.Are you certain that your lambda is actually being run? If it is running is it in container mode? If yes, you may need to increase the memory limit which is only 16MB by default and will often cause the lambda to be killed.Please provide the code, or a minimal example which replicates the issue.Cheers,Michael DombrowskiCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Here is my code: https://gist.github.com/Lard4/28c86ae0670ef21da911b4520444c7f0It's curious because if you comment out line 42, the topic will publish successfully, but nothing will get logged. In fact, the log file doesn't even exist in /greengrass/v2/logs.If you leave 42 uncommented, something happens (I suppose some sort of exception gets thrown) and the lambda doesn't report a status and after 60 seconds, greengrass kills and retries the lambda. No print statements or exceptions get logged in the lambda's log. However, you can see the exception where greengrass gets no timely status report and kills the lambda. (see the greengrass.log here: https://gist.github.com/Lard4/8a7842c1f138243eacfc789033bd2e4c)CommentSharekdixsonanswered 2 years ago0Please remove the file and stream options which are referring to sys.stdout. Just use a normal print or log statement.Are you running in container mode? As I mentioned before, it is possible that it is running out of memory and being killed.It is not possible for the component's log file to not exist; the log file is created just as soon as the component is deployed to the system.Please provide the contents of <root>/configs/effectiveConfig.yaml file.Cheers,Michael DombrowskiCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0I've tried it both in a container and not in a container. Both don't log anything. Here is my effectiveConfig.yaml: https://gist.github.com/Lard4/d3d7ef24fdce17dcd3c63686f3b86908Note that the lambda under investigation is called DataIngestionLambdaEdited by: kdixson on Apr 27, 2021 11:06 AMCommentSharekdixsonanswered 2 years ago0I just removed the sys.stdout from the print statements, and no log file is being created.CommentSharekdixsonanswered 2 years ago0Please attach the entirety of the logs directory to this forum post so that I can review all the logs.Cheers,Michael DombrowskiCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0I ended up uninstalling greengrass and reinstalling, this fixed my issuesCommentSharekdixsonanswered 2 years ago"


Question: How can I fix the AWS Inspector v2 error "Two state changes cannot be made at the same time."?

"I cannot enable AWS Inspector v2 - I'm receiving the error message "Two state changes cannot be made at the same time. Wait till current status change completes.".  It's been like this for a couple of weeks.How I got here:I originally enabled inspector V2 and it generated a ton of findings for old ECR images that I have already patched.I turned off inspector V2 and went back to classic.I figure out the various rules/suppressions I wanted to implement in V2.I tried to re-enable inspector V2 and I've been getting the above error message.This is happening in two different accounts that I have.  Any ideas would be appreciated.  We don't currently have a paid support plan, so I don't have a way to file a technical ticket to address this.Thanks,BruceFollowComment"

Answer: "0I had the same issue - I fixed it by using the aws cli. This seems to be a bug in aws console. You are able to enable inspector but if it gets stuck in a disabling state there is no way to disable from the UI because you cannot access inspector in order to disable it...The command line allows you to send a disable command to inspector even when the state is disabling.aws inspector2 enable --region us-east-2 --account-ids 111111111111 --resource-types EC2{    "accounts": [],    "failedAccounts": [        {            "accountId": "111111111111",            "errorCode": "DISABLE_IN_PROGRESS",            "errorMessage": "Two state changes cannot be made at the same time. Wait till current statu>            "resourceStatus": {                "ec2": "DISABLED",                "ecr": "DISABLED"            },            "status": "DISABLE_FAILED"        }    ]}aws inspector2 disable --region us-east-2 --account-ids 1111111111 --resource-types EC2{    "accounts": [        {            "accountId": "1111111111",            "resourceStatus": {                "ec2": "DISABLED",                "ecr": "DISABLED"            },            "status": "DISABLING"        }    ],    "failedAccounts": []}aws inspector2 enable --region us-east-2 --account-ids 1111111111 --resource-types EC2{    "accounts": [        {            "accountId": "1111111111",            "resourceStatus": {                "ec2": "ENABLING",                "ecr": "DISABLED"            },            "status": "ENABLING"        }    ],    "failedAccounts": []}aws inspector2 batch-get-account-status --region us-east-2 --account-ids 1111111111{    "accounts": [        {            "accountId": "1111111111",            "resourceState": {                "ec2": {                    "status": "ENABLING"                },                "ecr": {                    "status": "DISABLED"                }            },            "state": {                "status": "ENABLED"            }        }    ],    "failedAccounts": []}CommentSharedjmarcusanswered 9 months ago"