Question: Error when creating Jupyter Notebook in AWS Glue

I receive the error: "Failed to start notebook server" when creating a Jupyter notebook in AWS GlueFollowComment

Answer: "0I have seen that type of error before and it has been caused by a missing permission. Make sure that you have setup everything specified in the 'Granting permissions for the IAM Role' step of the following documentation: https://docs.aws.amazon.com/glue/latest/ug/notebook-getting-started.htmlIf I recall correctly, when I had this issue it was because my role was missing the correct sts:AssumeRole permissionCommentShareGareth_Eanswered 9 months ago"


Question: Would it possible to stream from CCTV to KVS to IVS?

Would it be possible to stream videos from CCTV using Kinesis Video Streams and connect it Interactive Video Service (or Elemental). Where my customer wants to integrate cameras (AUTODOME IP 7000 HD (CPP4)) with their mobile applications (i.e. live or on demand videos).FollowComment

Answer: "0Accepted AnswerKinesis Video Streams (KVS) supports two types of video streams - the original version using its own API for ingest and delivery (not a standard protocol such as RTP, RTSP, RTMP, etc) or WebRTC. You can't mix these protocols (e.g. KVS API in, WebRTC out). A quick look at the camera specification doesn't list KVS or WebRTC as a supported protocol, so you would need something to convert the video, either using the KVS Producer SDK (for the KVS API) or WebRTC.KVS does not currently support RTMPS output which is the only ingest protocol currently supported by IVS. Therefore, you would need an intermediate 'transmuxer' to convert the output of KVS to RTMPS. You could use MediaLive (it supports HLS input which can be provided by KVS) and RTMPS output.CommentShareEXPERTLeeAtk@AWSanswered 3 years ago"


Question: Non module Node js Lambda layer redefines Global console object console.info and console.log functions - not getting initialized

"I would like to override the node js console global object console.info and console.log functions to manipulate the message before it is sent to the original console global object console.info or console.log functions.To do this, I created a lambda layer called console-monkey-patch that consists of a single js file with no modules or module dependencies.The zip file structure looks like:nodejsconsole-monkey-patch.jsThis is the contents of the console.monkey-patch.js file (simplified to just test that the layer gets initialized)console.info ('CONSOLE MONKEY PATCH LAYER LOADED');var maxMessageLength = parseInt(process.env.MAX_MESSAGE_LENGTH || '200', 10);function truncateMessage(message, maxLength) {  return message.slice(0, maxLength);}var originalLog = console.log;var originalInfo = console.info;console.log = function (...args){  originalLog.call(console, 'Monkey Console.log function called');  const formatArg = 'abc'; //util.format(...args);  const truncateArg = truncateMessage(formatArg, maxMessageLength);  originalLog.apply(console, [truncateArg]);};console.info = function (...args){  originalLog.call(console, 'Monkey Console.info function called');  const formatArg = 'abc'; //util.format(...args);  const truncateArg = truncateMessage(formatArg, maxMessageLength);  originalInfo.apply(console, [truncateArg]);};console.info1 = function (...args){  originalLog.call(console, 'Monkey Console.info1 function called');  args = args.map((arg) => (typeof arg === 'string' ? truncateMessage(arg, maxMessageLength) : arg));  originalInfo.apply(console, args);};I define it as a nodejs 18.x for x86I created a nodejs 18.x  for x86 lambda that applies this layer.The lambda looks like:exports.handler = async (event) => {    // This is a 300-character message    // Log the message    console.info("Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec condimentum dolor sed urna iaculis, ut iaculis nibh fermentum. Nullam efficitur enim massa, nec interdum odio tincidunt in. Quisque ultrices. XXX");    // The response object must include 'statusCode' and 'body'    return {        statusCode: 200,        body: "Log message has been printed successfully."    };};When I run this lambda I get this output:Response{  "statusCode": 200,  "body": "Log message has been printed successfully."}Function LogsLOGSName: cloudwatch_lambda_agentState: SubscribedTypes: [Platform]EXTENSIONName: cloudwatch_lambda_agentState: ReadyEvents: [INVOKE, SHUTDOWN]START RequestId: 943a3524-7e72-4336-b96c-68072f4e90eb Version: $LATEST2023-05-23T22:26:18.620Z943a3524-7e72-4336-b96c-68072f4e90ebINFOLorem ipsum dolor sit amet, consectetur adipiscing elit. Donec condimentum dolor sed urna iaculis, ut iaculis nibh fermentum. Nullam efficitur enim massa, nec interdum odio tincidunt in. Quisque ultrices. XXXEND RequestId: 943a3524-7e72-4336-b96c-68072f4e90ebREPORT RequestId: 943a3524-7e72-4336-b96c-68072f4e90ebDuration: 111.20 msBilled Duration: 112 msMemory Size: 128 MBMax Memory Used: 82 MBInit Duration: 263.82 msXRAY TraceId: 1-646d3d8a-27dea5ec5dd9588523eff589SegmentId: 0eb3305f7b248af3Sampled: trueThe console.info message at the beginning of the layer js file is not printed, and the console.info message printed by the lambda handler is not changed to 'abc' as I would expect if the layer was initialized and the global console functions replaced by those defined in the layer.One restriction is that this console global object override has to be able to work without modifying or re-deploying  the lambdas that it is applied tothanks in advance for any suggestions.FollowComment"


Question: AWS Backup - using tags - transitioning and lifecycle help

"Most of my other post was answered but stuck on one concept.  I have a few Dynmo tables that will always be appended so have PITR and will have a daily tag to backup with.  However, if have tables that change with the month.  So after the month, that data will not change.   So if I have a tag call backup_monthly, I can make a rule to say backup daily, transition to cold storage after a few days.But, if I keep that tag of backup_monthly, no data changes, will just that process trying to sync cause that to be a new backup since the old is in cold storage?I don't want to have to change tags monthly, etc. but rather just set it and forget it, knowing daily backups are warm and always updating, january is warm and backing up, come Feb, Jan will transition to cold and Feb will be warm until March.Thanks allFollowComment"

Answer: "0I'm not sure If I did understand your questions but what I understood was that you're looking for a lifecycle management option for your backups performed by AWS backups that get processed daily/monthly.AWS has recently added a new feature in AWS backup (Advanced features) for Amazon DynamoDB backups.To know more about Advanced DynamoDB backup:https://docs.aws.amazon.com/aws-backup/latest/devguide/advanced-ddb-backup.html?icmpid=docs_console_unmappedCopying tags onto backupshttps://docs.aws.amazon.com/aws-backup/latest/devguide/tags-on-backups.htmlI hope it fulfills your requirement.CommentShareSwwapnilanswered a year ago0Hi,As noted above, we have added support for DynamoDB for lifecycle transition to cold storage.We also have enhanced tag based selection, where you can select only DDB service & only tables with a specific tags.You can create tag based filters with boolean expressions.In the backup plan ensure you have the the rules for the daily/weekly/monthly, and in the life cycle rule, ensure to point to AWS backup, when you want it to move blocks to Cold storage.Keep in mind though, that blocks that are needed for your warm backups from the golden image of the table, will remain in hot, to enable you to restore that PITR.Hope this helpsCommentSharerpergaminanswered a year ago"


Question: AWS Codebuild is stuck in the queue phase on US-EAST-1

Is anyone facing issues with AWS Codebuild getting stuck in the queue phase?AWS Codebuild is stuck in the queue and never kicks off build in US-EAST-1.I have the same exact codebuild replicated in the US-EAST-2 region and it runs fine there. To be clear: the actual build does not kick off. This is not a buildspec.yml issue.I'm building using Amazon Linux 2 ARM64. I presume that there's issues in US-EAST-1 with ARM64 builds.Any advice to get over this hurdle?I logged tickets with support but so far nothing.FollowComment

Answer: "0Hello,Currently, there are no ongoing Codebuild issues in us-east-1. To troubleshoot this issue, we require details that are non-public information and require that a support case is opened. Your course of action is best and I recommend you select the right severity levels and the support engineer should be able to look into your account data promptly to identify the issue.CommentShareUgochukwu_Ianswered a year ago"


Question: How to set up cross-account deploymetn fromCodeCommit repo to EC2 instance in another account

"Hi there,Thanks for reading. I was asked to set up a cross-account deployment process. We have CodeComint repo in one account and we want to deploy any changes to EC2 instance in another account. It is a Drupal website that we are hosting in the EC2 instance with S3 bucket for the media files and RDS instance for the DB. I amnot sure how to approach it and how the whole process should look like. I will appreciate any tips. Thanks.FollowComment"

Answer: "0Hi, JakubYou run Code Pipeline on Account A triggered by Code Commit in Account A.By specifying CodeDeploy for account B in that deployment configuration, the CodeDeploy agent configured for account B will run on the EC2 instance for account B.You can achieve cross-account access by setting your IAM role correctly.The following link will be helpful.https://ecnedaced-seirots.github.io/post/a/aws-crossaccount-pipeline-1/CommentShareEXPERTiwasaanswered a year ago"


Question: MySQL binary Logging must use ROW format error

"I'm trying for first time to use DMS to migrate and keep in sync a database while I migrate our site to aws but I keep getting :Last Error Failed in resolving configuration. Task error notification received from subtask 0, thread 0 [reptask/replicationtask.c:2859] [1020418] Error Code [10002] : MySQL binary Logging must use ROW format; Errors in MySQL server binary logging configuration. Follow all prerequisites for 'MySQL as a source in DMS' from https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.MySQL.html or'MySQL as a target in DMS' from https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.MySQL.html ; Failed while preparing stream component 'st_0_ZJFFAMOOBGXIX26POQR3LG6TVKDJFXFVACA4QCQ'.; Cannot initialize subtask; Stream component 'st_0_ZJFFAMOOBGXIX26POQR3LG6TVKDJFXFVACA4QCQ' terminated [reptask/replicationtask.c:2866] [1020418] Stop Reason FATAL_ERROR Error Level FATALI did follow all steps and source database it's already in ROW formattask:arn:aws:dms:us-east-1:254218654658:task:RNPUCUQVEMS4Q46SV6FX2GCTW36VFJ6ZELIUTJIFollowCommentPiyush Jain 2 months agoi am also facing same issue can you help me out on thisShare"

Answer: 0I was missing some stuffCommentSharechiflianswered 2 years agoajit 7 months agoHow did you resolve this error ? I'm also getting this error when trying to migrate data and replicate changes from RDS(mysql) to Redshift. I have set all the parameters according to https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.MySQL.html and rebooted my RDS instance (It is a read replica btw). Thanks in advance.Share


Question: "Unable to reach EC2 console, Stockholm"

Is it only me who can't reach EC2 Console in Stockholm?All I see is the header and a white page.BRFollowComment

Answer: "0It's back to normal again, and EC2 console in region Stockholm is accessible again.CommentShareAWS-User-6812756answered a year ago"


Question: CfnParameter giving me unresolved tokens error

"I have this code as part of my cdk typescriptconst stage = new CfnParameter(this, 'stageName');const api = new apigateway.RestApi(this, 'typescriptapi', {description: 'example api gateway with typescript',deployOptions: {stageName: stage.valueAsString,},.......**and running this command **cdk deploy TypescriptcdkStack --parameters stageName='UAT'it gives me error, what am I missing, I am using CDK 2.18.0 (build 75c90fa)throw new Error(`ID components may not include unresolved tokens: ${unresolvedTokens.join(',')}`);Error: Resolution error: ID components may not include unresolved tokens: DeploymentStage.${Token[TOKEN.200]}.FollowComment"

Answer: "0Hi there,Values of CfnParameter cannot be resolved at synthesis, but only at deployment, so you won't be retrieving the values during the process of compiling. If you want to get the value at synthesis, you can use CDK Runtime context. Specifically, you can set the values of context via:Through the --context option to the cdk command. (These values are always strings.)In the project's cdk.context.json file.In the context key of the project's cdk.json file.In the context key of your ~/.cdk.json file.In your AWS CDK app using the construct.node.setContext() method.Then, you can get a context value using the construct.node.tryGetContext method.CommentShareSUPPORT ENGINEERZhiyuan_Lanswered a year ago"


Question: Can not access account

I keep getting told that my account doesn't exist when logging in despite having used it a couple of days prior. I hadn't changed anything besides my router recently and cannot find anyway to see if my original account can be accessed.FollowComment

Answer: 0I would try this hereCommentSharejthornes-awsanswered 10 months ago


Question: Can we configure separate binary logging (binlog) on Aurora MySQL's Read Replica instance?

"A customer has enabled binlog and expecting to get binlogs from read replica instance of Aurora - MySQL Cluster.  Here are the steps being followed:Enabled binlogs via cluster parameter group and set the format to ROW.Restarted the cluster to ensure changes take effectLogging into writer node showsmysql> show master status     -> ; +----------------------------+----------+--------------+------------------+-------------------+ | File                       | Position | Binlog_Do_DB | Binlog_Ignore_DB | Executed_Gtid_Set | +----------------------------+----------+--------------+------------------+-------------------+ | mysql-bin-changelog.000002 |      120 |              |                  |                   | +----------------------------+----------+--------------+------------------+-------------------+ 1 row in set (0.01 sec) However, the reader node does not return any valuemysql> show master status; Empty set (0.01 sec)On both reader and writer, the bin_log_format is shown as ROWMySQL [(none)]> SHOW VARIABLES LIKE 'binlog_format'; +---------------+-------+ | Variable_name | Value | +---------------+-------+ | binlog_format | ROW   | +---------------+-------+ 1 row in set (0.061 sec) Backup retention value is also set to a non-zero value.My understanding here is you can pull binlog only from the writer node in Aurora. The replica nodes use redo logs and share the storage layer with the writer. The customer's expectations seems incorrect. Can I be doubly sure here?FollowComment"

Answer: "0Accepted AnswerYes, that is correct. You can only pull binary logs from the Writer Instance. Also, Amazon RDS normally purges a binary log as soon as possible, but the binary log must still be available on the instance to be accessed by mysqlbinlog. To specify the number of hours for RDS to retain binary logs, use the mysql.rds_set_configuration stored procedure and specify a period with enough time for for replication to occur.How do I enable binary logging for Amazon Aurora for MySQL?: https://aws.amazon.com/premiumsupport/knowledge-center/enable-binary-logging-aurora/CommentShareVijayKanswered 4 years ago"


Question: Kubernetes version vs. Amazon EKS platform version

"According to:https://docs.aws.amazon.com/eks/latest/userguide/platform-versions.htmlFor an 1.24 EKS Cluster with eks.3 platform version, the kubernetes version (control plane) should be 1.24.7, however all our clusters (created using AWS CDK) are reporting 1.24.8 as kubernetes version (v1.24.8-eks-ffeb93d to be more precise). I re-read that platform-versions.html multiple times and cannot interpret it in such a way that what we're observing is expected behaviour. Would anyone be able to confirm if that's just bad wording/documentation and if yes, what would be a way to get possible kubernetes version(s) for a given EKS platform version (i.e. 1.24/eks.3).Many thanks,damjanFollowComment"

Answer: "0The kubernetes version in EKS clusters may not always match the exact version specified in the platform-versions.html. The actual version depends on the specific EKS cluster and its resources, as well as the AWS region in which the cluster was created. The kubernetes version reported in your EKS cluster (v1.24.8-eks-ffeb93d) is not unexpected and is likely the result of a recent update made by AWS to their EKS platform. The best way to find the possible kubernetes versions for a given EKS platform version (e.g. 1.24/eks.3) is to refer to the AWS documentation and the EKS release notes, or to reach out to AWS support for clarification.CommentShareDivyam Chauhananswered 4 months ago0That's exactly what the problem is :) - nowhere in their documentation they mention kubernetes version 1.24.8. For kubernetes 1.24, all platform versions (eks.1, eks.2 and eks.3) should be running kubernetes version 1.24.7 (for control plane) and yet our 1.24/eks.3 clusters are running v1.24.8Would be nice if that was documented/made clear on that page.CommentSharedamjananswered 4 months ago"


Question: Memory limits detection by java process (Fargate)

"I'm trying to take advantage of the feature that allows java process to detect what is the memory limit set for a given container run. (Container Awareness)I'm using java version 8u192b12 that allows to use the following VM options without the need of (-XX:+UseContainerSupport)-XX:InitialRAMPercentage=50.0 -XX:MaxRAMPercentage=90.0 That should set the max memory allocation for a java process to 90% of what the container is allowed to take.Here's my test classimport java.lang.management.ManagementFactory;import java.lang.management.MemoryMXBean;import java.lang.management.RuntimeMXBean;public class Check {    public static void main(String[] args) {        MemoryMXBean memoryBean = ManagementFactory.getMemoryMXBean();        System.out.println("heap: " + memoryBean.getHeapMemoryUsage());        System.exit(0);    }}with java -XX:InitialRAMPercentage=50.0 -XX:MaxRAMPercentage=90.0  MyClassThis works as expected locally when I run my container with docker:docker run -m=256M imgheap init = 134217728(131072K),... max = 243269632(237568K)docker run -m=512M imgheap  init = 268435456(262144K), ...max = 484442112(473088K)but when I execute the same using Fargate(Platform 1.3) with task mem limit of 512MBI get:heap: init = 1971322880(1925120K) ...max = 3546284032(3463168K)with 1GBheap: init = 1971322880(1925120K) max = 3546284032(3463168K)Is AWS ECS Farget using that docker -m switch for memory restriction or something custom?I'm using Docker version 18.09.0 locally.Edited by: kubakuba on Jan 22, 2019 2:58 AMEdited by: kubakuba on Feb 27, 2019 3:54 AMFollowComment"

Answer: "1Thx for posting - you likely already have solved it but for other googlers that might reach this post I'll go with my similar problem and solution.My jvm based service was allocated to much heap memory: 6.3GI have these jvm args: -XX:+UseContainerSupport -XX:MaxRAMPercentage=80.0Using the amazoncorretto:8u232 to my understanding a modern java 8 with back-ported docker features so this documentation should hold: https://www.eclipse.org/openj9/docs/xxusecontainersupportFor me the solution was to add the Memory setting on both the task and the container for example this cloudformation snippet - based on https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-taskdefinition.html:    "Resources": {        "Task": {            "Properties": {                "RequiresCompatibilities": ["FARGATE"],                "NetworkMode": "awsvpc",                "ExecutionRoleArn": "<some role>",                "Cpu": 1024,                "Memory": 2048,                "ContainerDefinitions": [                    {                        "Memory": 1792,                        "Essential": true,                        "Image": { "Fn::Join" : [ ":", [ "<service-docker-image>", { "Ref": "ImageTag" } ] ] },                        ...                    },                     {                        "Memory": 256,                        "Essential": true,                        "Image": { "Fn::Join" : [ ":", [ "<service-docker-nginx-proxy>", { "Ref": "ImageTag" } ] ] },                        ...and with this the java service logs memory consumption:heap memory usage: init = 29360128(28672K) used = 1081712776(1056360K) committed = 1162170368(1134932K) max = 1636040704(1597696K)Roughly 1.6G for the heap which sounds sound.Edited by: pellekrogholt on Jan 3, 2020 4:07 AMEdited by: pellekrogholt on Jan 3, 2020 4:07 AMCommentSharepellekrogholtanswered 3 years ago"


Question: Cloud9 - EXTREMELY High CPU Usage

"Lately Cloud9 has been using an insane amount of CPU, to the point nothing will load. The node process (vfs-worker) will randomly start using 100-200% CPU and not stop until I killall node or reboot. This is on a Fresh Ubuntu install with a fresh Cloud9 install. I've switched servers 3 times, started fresh every time and still having the issue. Currently I'm on a 6 core VPS with 16gb of RAM and NVMe drives with nothing else running - the machine has no speed issues until I pull up Cloud9 and then this happens.top output currently (this is typical of the issue):top - 05:25:53 up 8 min,  0 users,  load average: 1.58, 1.50, 0.75Tasks: 140 total,   3 running, 137 sleeping,   0 stopped,   0 zombie%Cpu(s):  3.6 us,  6.8 sy,  0.0 ni, 68.5 id,  0.0 wa,  0.0 hi,  0.1 si, 21.1 stMiB Mem :  16008.7 total,  14915.5 free,    949.0 used,    144.2 buff/cacheMiB Swap:      0.0 total,      0.0 free,      0.0 used.  14816.9 avail Mem     PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND                                                                                591 root      20   0 1682708 839164  31552 R 178.0   5.1   8:07.95 node                                                                                1111 root      20   0  690472  53432  31496 S   7.7   0.3   0:09.81 node                                                                                548 root      20   0   13808   9044   7476 S   6.7   0.1   0:09.18 sshd                                                                                1147 root      20   0   11848   3756   3256 R   0.7   0.0   0:00.88 top                                                                                11 root      20   0       0      0      0 R   0.3   0.0   0:10.31 rcu_sched                                                                                112 root      20   0       0      0      0 I   0.3   0.0   0:01.13 kworker/u12:1-events_power_efficient                                                                                1 root      20   0  166912  10904   8388 S   0.0   0.1   0:04.07 systemd                                                                                2 root      20   0       0      0      0 S   0.0   0.0   0:00.15 kthreadd                                                                                3 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 rcu_gp                                                                                4 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 rcu_par_gp                                                                                6 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kworker/0:0H-events_highpri                                                                                7 root      20   0       0      0      0 I   0.0   0.0   0:00.03 kworker/0:1-events                                                                                8 root      20   0       0      0      0 I   0.0   0.0   0:00.99 kworker/u12:0-events_unbound                                                                                9 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 mm_percpu_wq                                                                                10 root      20   0       0      0      0 S   0.0   0.0   0:00.07 ksoftirqd/0                                                                                12 root      rt   0       0      0      0 S   0.0   0.0   0:00.15 migration/0                                                                                13 root     -51   0       0      0      0 S   0.0   0.0   0:00.00 idle_inject/0                                                                                This is the command hogging CPU:root         591  120  3.4 1443908 567652 ?      Rl   05:17  15:42 vfs-worker {"pingInterval":5000,"nodePath":"/root/.c9/node_modules","tmuxBin":"/root/.c9/bin/tmux","root":"/","debug":false,"connectionTimeout":60000,"metapath":"/.c9/metadata","envmetapath":"/.c9/metadata/environment","projectDir":"/","defaultEnv":{"HGUSER":"root","EDITOR":"","PORT":"8080","C9_PORT":"8080","IP":"127.0.0.1","C9_HOSTNAME":"154.12.230.222","C9_USER":"root","C9_PROJECT":"Box","C9_PID":"bfcfdc59308b461990aeb16d918ce011"},"useVfsLoaderCache":false,"environmentId":"bfcfdc59308b461990aeb16d918ce011","bytesPerSecond":3145728,"extendApi":{"collab":{"file":"c9.ide.collab/server/collab-server.js","user":{"userId":"301735008956","name":"root"},"project":{"workspaceId":"bfcfdc59308b461990aeb16d918ce011","name":"Box","type":"ssh"},"environment":{"id":"bfcfdc59308b461990aeb16d918ce011","name":"Box","type":"ssh","ideTemplateName":"Cloud9 Amazon Linux"},"readonly":false,"session":{},"nodePath":"/root/.c9/node_modules"},"ping":{"file":"c9.vfs.client/ping-service.js"},"store":{"file":"c9.vfs.client/store-service.js"}}}FollowComment"

Answer: "0Dear Customer,Generally speaking, CPU usage percentages higher than 100% are normal for multi-core machines, meaning that the issue might be caused by other factors.To investigate your question, we require details that are non-public information. Please open a support case with AWS using the following link.Thank youCommentSharertarcranswered 8 months ago"


Question: "Instance unavailable, does not respond"

"Dear all,While uploading an image on a wordpress website hosted on a Debian EC2 instance (i-0145c3de03e838a63), the page froze.The instance:become unreachable via SSHno response to ping (ICMP enabled in Security Group inboud rules)nothing on logs to specifyscreenshot of instance simply shows login screen (but again, not reachable via SSH)no positive results after stopping and starting the instance (sevaral times stopped and started)Hard Drive space is at 22% usage (just to exclude possible over-usage of root partition)I have upgrade instance type to exclude possible other factors.I am now at a dead end as I have no idea how to recover this. Any help is highly appreciated :-)UPDATE: If I create a NEW instance (I am planning a full restore), the original instance starts working....... Makes no sense to me....... Can someone explain this please?JonathanEdited by: DRA-U on Sep 25, 2019 2:42 PMEdited by: DRA-U on Sep 25, 2019 2:51 PMFollowComment"

Answer: 0my mistakeCommentShareDRA-Uanswered 4 years ago


Question: AWS Transfer Authentication Failure

"I created a SFTP server in AWS Transfer family connected to an S3 bucket with the service managing the users.  Created 3 users and it was all working fine.  I created a fourth user (with the same IAM role attached as the working users) and it did not work and received an SSH AUTH FAILURE when trying to connect.  So I added the public key to the user again (assuming I had screwed up).  The two keys both show the same fingerprint in the AWS transfer console so I didn't screw up.  But still does not work.  However, when I checked the fingerprint of the key locally using 'ssh-keygen -l -f <keyname>'   I get a totally different fingerprint to the one shown against the keys for that user.So I removed the key from one of the working users and added the exact same public key back in.  That user no longer works but the public key has not changed.What am I doing wrong here?FollowComment"

Answer: "0I found out why the keys were causing a problem and it turned out to be a copy and paste error.  I was opening the public key file in an editor, selecting all, doing a copy and then pasting into the web console.    If is use the command line tool xclip to copy the contents of the file and paste that into the web console the keys work fine.I knew I was doing something stupid.CommentShareAWS-User-0962411answered a year ago"


Question: Where to get correct pricing?

"I'm seeing conflicting pricing information from AWS re: EC2 services, e.g.https://aws.amazon.com/ec2/instance-types/t2/vshttps://aws.amazon.com/blogs/aws/low-cost-burstable-ec2-instances/Could you please point me at a page that has the exact correct current pricing for all EC2 instance types?Thanks!FollowComment"

Answer: "2Accepted AnswerAs a general rule, links documentation and service landing pages provide the most up to date information on AWS services and pricing. The link you pointed to before (https://aws.amazon.com/ec2/instance-types/t2/) has the most accurate information on pricing/ for T2 instances. The blog post linked is from 2014, and we have since reduced our pricing and introduced the t2.nano instances and new T families (you may want to check out our T3 instances since they are slightly cheaper: https://aws.amazon.com/ec2/instance-types/t3/).I also recommend trying out the AWS Pricing calculator (https://calculator.aws/#/), which should also provide you an estimate and most up to date information on our pricing.CommentShareKarl_Canswered 5 months agoEXPERTkentradreviewed 5 months agoHooHost 5 months agoSweet, thanks!Share"


Question: "AWS SFTP Error "Too many open files in this session, maximum 100""

"Since this monday we are experiencing a problem when we try to upload a large amount of files. (49 files to be exact). After around 20 files the upload fails.s-262d99d7572942eca.server.transfer.eu-central-1.amazonaws.com/aws/transfer/s-262d99d7572942eca asdf.f7955cc50d0d1bc42022-05-09T23:02:59.165+02:00 asdf.f7955cc50d0d1bc4 CONNECTED SourceIP=77.0.176.252 User=asdf HomeDir=/beresa-test-komola/asdf Client=SSH-2.0-ssh2js0.4.10 Role=arn:aws:iam::747969442112:role/beresa-test UserPolicy="{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"AllowListingOfUserFolder\",\n \"Action\": [\n \"s3:ListBucket\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": [\n \"arn:aws:s3:::beresa-test-komola\"\n ],\n \"Condition\": {\n \"StringLike\": {\n \"s3:prefix\": [\n \"asdf/*\",\n \"asdf\"\n ]\n }\n }\n },\n {\n \"Sid\": \"HomeDirObjectAccess\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"s3:PutObject\",\n \"s3:GetObject\",\n \"s3:DeleteObject\",\n \"s3:GetObjectVersion\"\n ],\n \"Resource\": \"arn:aws:s3:::beresa-test-komola/asdf*\"\n }\n ]\n}" Kex=ecdh-sha2-nistp256 Ciphers=aes128-ctr,aes128-ctr2022-05-09T23:02:59.583+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/10_x_a_10.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:03.394+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/10_x_a_10.jpg BytesIn=42266252022-05-09T23:03:04.005+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/11_x_a_1.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:07.215+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/11_x_a_1.jpg BytesIn=42266252022-05-09T23:03:07.757+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/12_x_a_37.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:10.902+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/12_x_a_37.jpg BytesIn=42266252022-05-09T23:03:11.433+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/13_x_a_13.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:14.579+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/13_x_a_13.jpg BytesIn=42266252022-05-09T23:03:14.942+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/14_x_a_43.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:18.016+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/14_x_a_43.jpg BytesIn=42266252022-05-09T23:03:18.403+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/15_x_a_34.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:21.463+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/15_x_a_34.jpg BytesIn=42266252022-05-09T23:03:21.906+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/16_x_a_44.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:25.025+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/16_x_a_44.jpg BytesIn=41992662022-05-09T23:03:25.431+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/17_x_a_2.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:28.497+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/17_x_a_2.jpg BytesIn=41992662022-05-09T23:03:28.857+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/18_x_a_5.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:31.947+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/18_x_a_5.jpg BytesIn=41992662022-05-09T23:03:32.374+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/19_x_a_8.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:35.504+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/19_x_a_8.jpg BytesIn=41992662022-05-09T23:03:35.986+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/1_x_a_16.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:39.104+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/1_x_a_16.jpg BytesIn=42266252022-05-09T23:03:39.691+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/20_x_a_11.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:42.816+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/20_x_a_11.jpg BytesIn=41992662022-05-09T23:03:43.224+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/21_x_a_14.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:46.274+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/21_x_a_14.jpg BytesIn=41992662022-05-09T23:03:46.649+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/22_x_a_17.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:49.757+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/22_x_a_17.jpg BytesIn=41992662022-05-09T23:03:50.141+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/23_x_a_20.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:53.307+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/23_x_a_20.jpg BytesIn=41992662022-05-09T23:03:53.849+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/24_x_a_23.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:03:56.933+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/24_x_a_23.jpg BytesIn=41992662022-05-09T23:03:57.358+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/25_x_a_26.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:04:00.585+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/25_x_a_26.jpg BytesIn=41992662022-05-09T23:04:00.942+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/26_x_a_29.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:04:04.174+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/26_x_a_29.jpg BytesIn=41992662022-05-09T23:04:04.603+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/27_x_a_32.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:04:07.771+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/27_x_a_32.jpg BytesIn=41992662022-05-09T23:04:08.179+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/28_x_a_35.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:04:11.279+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/28_x_a_35.jpg BytesIn=41992662022-05-09T23:04:11.716+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/29_x_a_38.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:04:14.853+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/29_x_a_38.jpg BytesIn=41992662022-05-09T23:04:15.316+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/2_x_a_7.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:04:18.435+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/2_x_a_7.jpg BytesIn=42266252022-05-09T23:04:18.906+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/30_x_a_41.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:04:22.140+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/30_x_a_41.jpg BytesIn=41992662022-05-09T23:04:22.565+02:00 asdf.f7955cc50d0d1bc4 OPEN Path=/beresa-test-komola/asdf/x/bla/31_x_a_18.jpg Mode=CREATE|TRUNCATE|WRITE2022-05-09T23:04:25.752+02:00 asdf.f7955cc50d0d1bc4 CLOSE Path=/beresa-test-komola/asdf/x/bla/31_x_a_18.jpg BytesIn=41591292022-05-09T23:04:26.141+02:00 asdf.f7955cc50d0d1bc4 ERROR Message="Too many open files in this session, maximum 100" Operation=OPEN Path=/beresa-test-komola/asdf/x/bla/32_x_a_3.jpg Mode=CREATE|TRUNCATE|WRITEAs you can see in the logs we are closing each path after opening it - we are uploading one file after the other. What could cause this as we are not even trying to write 100 files during the scp session?FollowComment"

Answer: 0Accepted AnswerThe SFTP server is limiting the number of files that can remain open within the span of a single session. Although the message indicates files this count includes directory listings as well. Depending on your client software and how it is used it is possible to leave a listing operation in a directory improperly closed resulting in a "file handle" leak. This is fixable by identifying the problem code path on the client side and closing the open directory handle. The limitation of 100 open file handles is a new enforcement policy that was introduced this week.CommentShareAlexanswered a year agoAWS-User-1923487 a year agoit was indeed open directory handles which were not closed. It would be helpful if that would actually be logged though.Share


Question: Auditing Infrastructure Changes made via AWS Console

"Our environment manages most of the infrastructure component changes via code. Additionally, certain administrators have access to make infrastructure changes to applicable resources directly via console (although direct changes are not encouraged or frequently made). Our auditors are indicating that as administrators have access to make direct infrastructure changes via console, they cannot rely on the population of infrastructure changes made via code (obtained from Git), and also want us to evidence that no direct infrastructure changes were made by administrators directly from the console. I wanted to understand the following:How can we obtain population of direct infrastructure changes made from the console? We are thinking of obtaining the cloudtrail logs, but is there any other efficient way to obtain this population?Also, does it make sense to restrict administrator access to prevent from making any direct infrastructure changes? What is the industry standard in terms of restricting administrator access?Are there any other ways to evidence that no direct infrastructure changes were made outside of code changes?FollowComment"

Answer: "0Hello! I'll do my best to answer each of your questions below:Accessing CloudTrail logs is a great way to do this, and by filtering certain attributes you can find this info relatively quickly. CloudTrail logs include a "readOnly" attribute as well as a "userIdentity" attribute. The "readOnly" attribute determines whether changes (creates, updates, deletes, etc) were attempted on AWS resources, and the "userIdentity" includes info like the IAM Principal and username of the requester. By filtering logs with these attributes, you can see all actions where readOnly is false (meaning that some change was made to your account, infrastructure, or resources) for a particular user. You can see the details of these attributes in the CloudTrail records contents documentation.It's a best practice to restrict all AWS access to least privilege permissions. Administrators often require broader permissions so that they can make critical changes to your AWS environment, but it's ultimately up to your organization to determine what permissions your administrators need. With that said, AWS provides managed permissions sets for certain job functions to help you get started in scoping your permissions. I'd recommend exploring these to see if any are a better fit for your administrators, and then you can add custom policies to further restrict/allow actions based on your organization's specific needs.CloudTrail logs may be the only sure way to demonstrate that there have been no infrastructure changes. If you're managing your workload with infrastructure as code, you could potentially use CloudFormation's drift detection feature to support that the infrastructure hasn't changed. Depending on the scope of the audit, this may not be sufficient. I would still recommend the CloudTrail logs for this.CommentSharedmarshnnanswered 7 months ago"


Question: no show free tier suscripción

"Hello, I subscribe to a free account but in the free tier information, I do not see any related subscriptionFollowComment"

Answer: "0The free usage limit can be viewed on the billing dashboard.You can also check the usage status on the "Top AWS Free Tier services table".https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/tracking-free-tier-usage.html#free-tier-tableIf you're eligible for the AWS Free Tier and you use an AWS Free Tier offering, you can track your usage with the Top AWS Free Tier Services by Usage table on the dashboard of the AWS Billing console. The dashboard shows your account's top five AWS Free Tier service measurements.To see more details about your AWS Free Tier usage, including all of your active Free Tier services, choose View all in the Top AWS Free Tier Services by Usage table. The detailed table includes additional information about your forecasted usage for each Free Tier service measurement.The Top AWS Free Tier Service by Usage table is grouped by service limit. A service might have multiple lines, enabling you to track each AWS Free Tier limit closely. For example, each month you get 2,000 Amazon S3 Put operations and 5 GB of Amazon S3 storage. The AWS Free Tier usage table has two > > lines, one for S3 - Puts and one for S3 - Storage.The following conditions might limit whether you see the Free Tier table data:You use an AWS service that doesn't offer a AWS Free Tier.Your AWS Free Tier has expired.You access AWS through an AWS Organizations member account.You use an AWS service in the AWS GovCloud (US-West) or AWS GovCloud (US-East) Regions.CommentShareEXPERTRiku_Kobayashianswered 11 days ago"


Question: does AWS DMS migration within the same instance?

"I'm trying to migrate instance aurora PostgreSQL none partition table to same aurora PostgreSQL instance partitioned table(source, target endpoint instance is same). none partition table size is too big!I'm thinking of DMS to minimize downtime when moving data to partitioning tables. is it possible?FollowComment"

Answer: 2yes it is possible to use same server as source and target endpoint as long as the table name is different or in a different schema with same name.CommentShareAWS-User-8174525-subhashanswered 9 months agoEXPERTChris_Greviewed 9 months ago


Question: CloudFormation ECS TaskDefinition: correct type/processing for Parameter for EntryPoint in YAML Template

"I want to be able to accept an optional Parameter for the EntryPoint of a AWS::ECS::TaskDefinition -> ContainerDefinitions[], in a YAML CloudFormation template.  This is a little tricky, since ECS wants a comma-separated list for this, e.g. /bin/bash,-c,echo hello, but in the CloudFormation template, it appears to be an array of string.What is the best type to define for a EntryPoint Parameter in this case?  The error I'm currently trying to avoid is:Resource handler returned message: "Model validation failed (#/ContainerDefinitions/0/EntryPoint/0: expected type: String, found: JSONArray I've defined the parameter currently as: CommaDelimitedList:  EntryPoint:    Type: CommaDelimitedList    Description: "Task entrypoint (Optional - image default is script /start)"... which is yielding a JSONArray?, but I think I need an array of strings, which I'm not getting from:      ContainerDefinitions:                EntryPoint:            - !If              - EntryPointProvided              - !Ref EntryPoint              - !Ref 'AWS::NoValue'What is the best type to use and the most direct processing to get to the type required in the template and by ECS?  Or a current fix for the JSONArray would be fine.  Thanks!FollowComment"

Answer: "1Accepted AnswerI believe you want to try something like below to avoid the error you are seeing. This will treat the result of the If function as the input for the EntryPoint property as opposed to an list of strings within a outer list.Note that the ‘-‘ preceding the if function has been removed.      ContainerDefinitions:                EntryPoint: !If              - EntryPointProvided              - !Ref EntryPoint              - !Ref 'AWS::NoValue'CommentShareShane A Farraranswered a year agojavabrett a year agoSpot on, perfect answer thanks Shane - clearly I missed that I was wrapping the dereference with that extra -.  With this fix I am now able to pass arrays via comma-separated strings for both EntryPoint and Command via template parameters, which is awesome.Share"


Question: Audio Sync Issues

I'm having an issue with audio sync with DCV on G4dn instances.I'm getting anywhere from 1-10 tenths of a second behind. I'm using the instances for video editing so having the audio lag behind frames makes it very difficult on audio-intensive projects.Any help would be much appreciated!FollowComment

Answer: "0Hi Jay,Thanks for reaching out! Let's discuss your issue offline over a call.Cheers,ReyCommentShareAWS-Reyanswered 2 years ago0how this issue resolved?CommentSharejagxanswered 2 years ago0In recent DCV versions the native DCV Client has an option "Sync Audio and Video" in the upper left pull-down.CommentShareKarstenNISPanswered 2 years ago"


Question: S3 intelligent tier re-archiving clarification

"We have objects in intelligent tiering storage class. The bucket had an intelligent tiering configuration to move objects to Archive Access and Deep Archive access. We removed this configuration, but not before objects were moved to these tiers. For objects in Archive  and Deep Archive access, we have issued restore object requests.I would expect that archiving  behavior for restored objects would follow whatever the bucket's current config specifies, and in the absence of an intelligent configuration, I would expect the default behavior of objects being moved only to the Archive Instant Access tier.However, the documentation on restoring objects is unclear:When you restore from the S3 Intelligent-Tiering Archive Access or Deep Archive Access tiers, the object transitions back into the S3 Intelligent-Tiering Frequent Access tier. The object automatically transitions into the Archive Access tier after a minimum of 90 consecutive days of no access. It moves into the Deep Archive Access tier after a minimum of 180 consecutive days of no access ...This reads like objects restored from these tiers will always go back to archive or deep archive if not accessed, regardless if the bucket is only configured to move objects to Archive Instant Access. Is this actually the case? Or do restored objects obey the bucket's current config like one would expect?FollowComment"

Answer: 1Accepted AnswerThere are two different processes that need to be considered. The first of these is for objects that have already been transitioned to longer-term storage classes; for those objects when restored the storage class they transition back to as per our https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-initiate-restore-object.html documentation will be theS3 Intelligent-Tiering Frequent Access tier.If you had not removed the Life Cycle policy then the police for those objects would then be applied and they would then transition to the longer-termed storage classes. However as that policy has since been updated any transitions which match the current storage tier of the restored objects will then take affect.CommentShareSUPPORT ENGINEERDavin_Ganswered a year ago


Question: Searching for free demos

Are there any demos of Amazon Polly out there that showcase its voice and tonality for chatting and script reading?FollowComment

Answer: "1Hi,You can exploit Polly Free tier https://aws.amazon.com/polly/pricing/ and test voice and tones in AWS Console.You can listen voices as described here: https://docs.aws.amazon.com/polly/latest/dg/listening-voices.htmlHope it helps ;)CommentShareEXPERTalatechanswered 2 months ago"


Question: Can lambda function return additional custom information/message when "allowProvisioning" : "false"?

"If the Lambda function doesn't return "allowProvisioning" : "true" in the response,the provisioning request fails with ACCESS_DENIED.Is it possible to add additional custom information for the user when "allowProvisioning" : "false" in the response ?e.g. information why provisionig failedFollowComment"

Answer: "0Great feedback but currently this is not possible as documented hereDepending on your use case, you could use the following approach:Create a provisioning template where the IoT policy can be passed as a parameter and reference this policy name parameter in PolicyNameIf the pre-provision hook lambda denies provisioning, return "allowProvisioning" : "true" but pass a policy name in the parameterOverrides section that denies connectivity to AWS IoT. The Thing and certs will be created but the attached policy will deny any connection attempt.Use the DeviceConfiguration section of the template to return info about the reason why the provisioning failed.Hope that helps and if my answer was useful, please consider up-voting or accepting my answer. Thx!CommentShareEXPERTJan_Banswered 8 months ago"


Question: "My EC2 Status Checks fails, why this happens?"

"Hi, I deployed a web server on ec2 machine(ubuntu 18.04), t2.micro(instace type). web and database server is running under Docker. But last night ec2 status check was failed.Then i reboot the instance and look at the syslogs,I found below logs:-Network configuration changed, trying to establish connection.Synchronized to time server 91.189.91.157:123 (ntp.ubuntu.com).ERROR Health ping failed with error - EC2RoleRequestError: no EC2 instance role found.caused by: EC2MetadataError: failed to make EC2Metadata requestcaused by:  <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"#011"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">   <title>404 - Not Found</title>
404 - Not Found
   ```**Can anyone suggest me whats wrong with my ec2-machine?**FollowComment"

Answer:
"0I am finding the same log entries.  This began when normal status checks began failing with this notation on EC2 status:  Instance reachability check failed at February 12, 2020 at 9:31:00 PM UTC-8 (38 days, 17 hours and 52 minutes ago)Here is a recent syslog entry that shows the sequence:Mar 22 23:59:18 ip-172-31-17-50 amazon-ssm-agent.amazon-ssm-agent[1782]: 2020-03-22 23:59:18 INFO Backing off health check to every 1200 seconds for 3600 seconds.Mar 22 23:59:18 ip-172-31-17-50 amazon-ssm-agent.amazon-ssm-agent[1782]: 2020-03-22 23:59:18 ERROR Health ping failed with error - EC2RoleRequestError: no EC2 instance role foundMar 22 23:59:18 ip-172-31-17-50 amazon-ssm-agent.amazon-ssm-agent[1782]: caused by: EC2MetadataError: failed to make EC2Metadata requestMar 22 23:59:18 ip-172-31-17-50 amazon-ssm-agent.amazon-ssm-agent[1782]: caused by: <?xml version="1.0" encoding="iso-8859-1"?>Mar 22 23:59:18 ip-172-31-17-50 amazon-ssm-agent.amazon-ssm-agent[1782]: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"Mar 22 23:59:18 ip-172-31-17-50 amazon-ssm-agent.amazon-ssm-agent[1782]: #011"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">Mar 22 23:59:18 ip-172-31-17-50 amazon-ssm-agent.amazon-ssm-agent[1782]: Mar 22 23:59:18 ip-172-31-17-50 amazon-ssm-agent.amazon-ssm-agent[1782]:  Mar 22 23:59:18 ip-172-31-17-50 amazon-ssm-agent.amazon-ssm-agent[1782]:   <title>404 - Not Found</title>Mar 22 23:59:18 ip-172-31-17-50 amazon-ssm-agent.amazon-ssm-agent[1782]:  Mar 22 23:59:18 ip-172-31-17-50 amazon-ssm-agent.amazon-ssm-agent[1782]:  Mar 22 23:59:18 ip-172-31-17-50 amazon-ssm-agent.amazon-ssm-agent[1782]:
404 - Not Found
Mar 22 23:59:18 ip-172-31-17-50 amazon-ssm-agent.amazon-ssm-agent[1782]:  Mar 22 23:59:18 ip-172-31-17-50 amazon-ssm-agent.amazon-ssm-agent[1782]: AFAICT, the instance was running normally before this time.  It was initially turned up Wed Jan 29 06:17:35 UTC 2020What did AWS change at that time to cause this error, which took down my server?DVHirst865CommentSharedvhirst865answered 3 years ago0Sadly I don't have an answer for you but I wanted to note that the EC2RoleRequestError may well be a red-herring.On a fresh Ubuntu 20.04 instance running on a T4g.micro, the syslog contains the same error you're seeing on the first (and every) boot:Oct  5 15:19:28 ip-172-31-10-32 systemd[1]: Started Service for snap application amazon-ssm-agent.amazon-ssm-agent.Oct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]: 2020/10/05 15:19:28 Failed to load instance info from vault. RegistrationKey does not exist.Oct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]: Error occurred fetching the seelog config file path:  open /etc/amazon/ssm/seelog.xml: no such file or directoryOct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]: Initializing new seelog loggerOct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]: New Seelog Logger Creation CompleteOct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]: 2020-10-05 15:19:28 ERROR Error adding the directory to watcher: no such file or directoryOct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]: 2020-10-05 15:19:28 INFO Agent is in hibernate mode. Reducing logging. Logging will be reduced to one log per backoff periodOct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]: 2020-10-05 15:19:28 INFO Entering SSM Agent hibernate - EC2RoleRequestError: no EC2 instance role foundOct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]: caused by: EC2MetadataError: failed to make EC2Metadata requestOct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]: #011status code: 404, request id:Oct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]: caused by: <?xml version="1.0" encoding="iso-8859-1"?>Oct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"Oct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]: #011#011 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">Oct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]: Oct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]:  Oct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]:   <title>404 - Not Found</title>Oct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]:  Oct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]:  Oct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]:
404 - Not Found
Oct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]:  Oct  5 15:19:28 ip-172-31-10-32 amazon-ssm-agent.amazon-ssm-agent[1757]: It also continues to appear after updating all packages to their latest versions.This doesn't seem to actually prevent the metrics working though, although I have noticed that the disk activity metrics are empty.(I found these logs after I went digging to figure out why startup was taking so long)Presumably something inside AWS is broken (or somehow incompatible with Ubuntu) but unless your alerts are disk-related (or maybe using the enhanced monitoring?), I don't think this is the cause.Edited by: davidje13 on Oct 5, 2020 8:33 AMCommentSharedavidje13answered 3 years ago"


Question: How to take backup of sql server on Another windows machine

"Hi All,We have multiple sql servers installed on windows on prem environment, now plan is migrate those to AWS RDS.. We are planning to us below method.Native import/Export using S3 and the restoreand 2) DMSNow my question is aroung Native import/export .Question:-We dont have access to those sql server database servers, now if we try to take back up then its always storing on local machine where SQL Server is installed.Now if we have to take backup of all these databases on remote server (Jump server) and then upload to s3 , then how we will be able to achieve this.FollowComment"

Answer: "0As I understand, you want to migrate Microsoft Sql database from on-prem to AWS RDS and you are not sure about the next steps to be followed after uploading the backups to S3 bucket.Once the upload is done successfully, the next step is to Restore the databases in Amazon RDS for Sql Server. There are certain steps to be followed in order to achieve that. I suggest you to please refer this documentation. It has step-by-step information that will help you in restoring the backup database from S3 to RDS.This, link might also be helpful to you. If you face any problems or need further assistance while migrating your databases then it would be better to reach out to any DMS engineer of AWS Premium Support.CommentShareSUPPORT ENGINEERChaituanswered 9 months agorePost-User-9615162 9 months agoNopes, We know how to restore from S3 file, our question is regarding how to take backup of any sql server from remote machine, if we dont have access to database machine, server in that case how you will take the backup..ShareChaitu SUPPORT ENGINEER9 months agoI think what you are saying is possible with the help of Microsoft SQL Server Management Studio. I have found an online source that has a similar use case as that of yours: https://stackoverflow.com/questions/3942207/how-can-i-backup-a-remote-sql-server-database-to-a-local-drivePlease check if this works for you or not.Share"


Question: AWS IoT MQTT for TI CC3235SF

"Hi, I'm refering to below site:https://docs.aws.amazon.com/freertos/latest/userguide/getting_started_ti.htmlI'm getting warnings in build related to include paths. (30 warnings, unable to attach screenshot)I'm getting below error in terminal when build and no data on test MQTT:Device came up in Station mode[WLAN EVENT] STA Connected to the AP: TP-Link_BB81 , BSSID: e8:48:b8:61:bb:81[NETAPP EVENT] IP acquired by the device1 2535 [Tmr Svc] Write certificate...2 5349 [Tmr Svc] [ERROR] Failed to destroy object. PKCS11_PAL_DestroyObject failed.3 5349 [Tmr Svc] Write certificate...4 5632 [Tmr Svc] Security alert threshold = 155 5633 [Tmr Svc] Current number of alertDevice disconnected from the AP on application's requests = 06 5650 [Tmr Svc] Running Demos.7 5654 [iot_thread] [INFO ][DEMO][5654] ---------STARTING DEMO---------8 5662 [iot_thread] [INFO ][INIT][5661] SDK successfully initialized.Device came up in Station mode[WLAN EVENT] STA Connected to the AP: TP-Link_BB81 , BSSID: e8:48:b8:61:bb:81[NETAPP EVENT] IP acquired by the deviceDevice has connected to TP-Link_BB81Device IP Address is 192.168.0.1059 9126 [iot_thread] [INFO ][DEMO][9126] Successfully initialized the demo. Network type for the demo: 110 9127 [iot_thread] [INFO] Creating a TLS connection to a2m3gcrxudnep8-ats.iot.ap-south-1.amazonaws.com:8883.11 9691 [iot_thread] [INFO] Creating an MQTT connection to a2m3gcrxudnep8-ats.iot.ap-south-1.amazonaws.com.12 9725 [pthread] [SimpleLinkSockEventHandler EVENT]: Unexpected Event: 2, Socket: 0 Reason: 0.13 9734 [iot_thread] ERROR: -452 Socket receive failed.14 9734 [iot_thread] [ERROR] Failed to receive data over network. bytesReceived=-115 9735 [iot_thread] [ERROR] A single byte was not read from the transport: transportStatus=-1.16 9735 [iot_thread] [ERROR] CONNACK recv failed with status = MQTTRecvFailed.17 9735 [iot_thread] [ERROR] MQTT connection failed with status = MQTTRecvFailed.18 9735 [iot_thread] [ERROR] Failed to establish MQTT connection: Server=a2m3gcrxudnep8-ats.iot.ap-south-1.amazonaws.com, MQTTStatus=MQTTRecvFailed19 9785 [iot_thread] [INFO] Demo failed at iteration 1.20 9786 [iot_thread] [INFO] Short delay before starting the next iteration....21 14786 [iot_thread] [INFO] Creating a TLS connection to a2m3gcrxudnep8-ats.iot.ap-south-1.amazonaws.com:8883.22 15206 [iot_thread] [INFO] Creating an MQTT connection to a2m3gcrxudnep8-ats.iot.ap-south-1.amazonaws.com.23 15236 [pthread] [SimpleLinkSockEventHandler EVENT]: Unexpected Event: 2, Socket: 1 Reason: 0.24 15245 [iot_thread] ERROR: -452 Socket receive failed.25 15246 [iot_thread] [ERROR] Failed to receive data over network. bytesReceived=-126 15246 [iot_thread] [ERROR] A single byte was not read from the transport: transportStatus=-1.27 15246 [iot_thread] [ERROR] CONNACK recv failed with status = MQTTRecvFailed.28 15246 [iot_thread] [ERROR] MQTT connection failed with status = MQTTRecvFailed.29 15246 [iot_thread] [ERROR] Failed to establish MQTT connection: Server=a2m3gcrxudnep8-ats.iot.ap-south-1.amazonaws.com, MQTTStatus=MQTTRecvFailed30 15297 [iot_thread] [INFO] Demo failed at iteration 2.31 15297 [iot_thread] [INFO] Short delay before starting the next iteration....32 20298 [iot_thread] [INFO] Creating a TLS connection to a2m3gcrxudnep8-ats.iot.ap-south-1.amazonaws.com:8883.33 20808 [iot_thread] [INFO] Creating an MQTT connection to a2m3gcrxudnep8-ats.iot.ap-south-1.amazonaws.com.34 20839 [pthread] [SimpleLinkSockEventHandler EVENT]: Unexpected Event: 2, Socket: 2 Reason: 0.35 20848 [iot_thread] ERROR: -452 Socket receive failed.36 20849 [iot_thread] [ERROR] Failed to receive data over network. bytesReceived=-137 20849 [iot_thread] [ERROR] A single byte was not read from the transport: transportStatus=-1.38 20849 [iot_thread] [ERROR] CONNACK recv failed with status = MQTTRecvFailed.39 20849 [iot_thread] [ERROR] MQTT connection failed with status = MQTTRecvFailed.40 20850 [iot_thread] [ERROR] Failed to establish MQTT connection: Server=a2m3gcrxudnep8-ats.iot.ap-south-1.amazonaws.com, MQTTStatus=MQTTRecvFailed41 20900 [iot_thread] [INFO] Demo failed at iteration 3.42 20900 [iot_thread] [INFO] Short delay before starting the next iteration....43 25901 [iot_thread] [INFO] Demo run failed with 3 failed loops out of total 3 loops. RequiredSuccessCounts=2.44 25901 [iot_thread] [INFO ][DEMO][25901] memory_metrics::freertos_heap::before::bytes::7444845 25901 [iot_thread] [INFO ][DEMO][25901] memory_metrics::freertos_heap::after::bytes::6004046 25902 [iot_thread] [INFO ][DEMO][25902] memory_metrics::demo_task_stack::before::bytes::273647 25902 [iot_thread] [INFO ][DEMO][25902] memory_metrics::demo_task_stack::after::bytes::150448 26903 [iot_thread] [ERROR][DEMO][26903] Error running demo.Device disconnected from the AP on application's request49 26915 [iot_thread] Wi-Fi Disconnected.50 26920 [iot_thread] [INFO ][INIT][26920] SDK cleanup done.51 26920 [iot_thread] [INFO ][DEMO][26920] -------DEMO FINISHED-------Please guide in solving issue faced.FollowComment"

Answer: "0I've noticed in the logs that you followed the First Steps and changed IoT endpoint. Double check that you also added the Thing name clientcredentialIOT_THING_NAME and that you generated the demos/includes/aws_clientcredential_keys.h files with you device certs and private key.If this looks ok, try to connect with your device certificate from your laptop with MQTT client of your choice, for example mosquitto_pubTest if you can establish an TLS connection:openssl s_client -connect YOURIOTENDPOINT.iot.aws-region.amazonaws.com:8883 -CAfile AWSCAROOT.pem -cert YOURDEVCECERT.pem -key YOURDEVICEKEY.pemif this works try to publish an MQTT message:mosquitto_pub -t YOURTOPIC -m '{"msg":"Hello"}' --key YOURDEVICEKEY.pem --cert YOURDEVCECERT.pem --cafile AWSCAROOT.pem -h YOURIOTENDPOINT.iot.aws-region.amazonaws.com -p 8883 -d -i YOURCLIENTIDIf you don't have the AWS CA AWSCAROOT.crt, you can download it here:curl https://www.amazontrust.com/repository/AmazonRootCA1.pem > ca.pemIf this works, the AWS IoT is configured correctly. To further diagnose the problem, enable DEBUG logging on AWS IoT by following the steps in Configure AWS IoT logging and follow this guide to diagnose your connectivity problem Diagnosing Connectivity IssuesCommentShareEXPERTJan_Banswered a year ago"


Question: Facebook display=popup

"I've got a cognito user pool set up with facebook federated identity provider.And everything works perfectly, from a technical angle.However, my users think it looks ugly.Here's why:Cognito redirects the users to https://www.facebook.com/v2.9/dialog/oauth to do their sign-in.However, that link loads up their whole facebook menu bar complete with friend requests and notifications in the background.Fortunately, facebook provides an alternate link for signin, which is https://www.facebook.com/v2.9/dialog/oauth?display=popup (it's mostly the same, just has display=popup at the end).  That link provides a proper authentication screen without all the background stuff, and it's even more compact, which is more suitable for the size of my website window.Unfortunately, I can't see how to configure Cognito to including this display=popup parameter in the URL it sends users to.Is there a way to do this that I'm missing?If not, could it be added as a feature?  (I imagine it'd be pretty straightforward.)FollowComment"

Answer: "0Can we get an option to set display=popup on facebook login?CommentSharethetaanswered 4 years ago0Currently, Cognito does not support this. We will take this up as a feature request but we can't provide an ETA for this.CommentShareSUPPORT ENGINEERAbhilash_Kanswered 4 years ago0Thanks for the reply.  I hope it can get implemented.CommentSharethetaanswered 4 years ago0is this feature implemented? If yes , can you please provide way to get it?CommentSharesuryakirananswered 2 years ago"


Question: Amazon Rekognition Train Results Query/ Feature Request

"Amazon Rekognition Model metrics are available for only test dataset, not train dataset. I think having access to training results ,not only testing results, can be of immense use to everyone using Rekognition. Even if we do not know or are unable to change model architecture(AWS internal team is responsible for this), one very simple but useful information to be gained from comparing train and test results could be( if the train F1 score > test score by a lot) ascertaining whether train and test distributions are vastly different or not. Of course many other things can also be inferred from this information. Hence, I sincerely believe gaining access to this sort of train metrics information will be useful to everyone and enhance user experience. Can anyone here associated with AWS internal team/working inform me why this is not a feature.FollowComment"

Answer: 0Accepted AnswerHelloThis is a valid use case and the feature is on our long term roadmap. I have also passed on your feedback to the team.CommentShareaws-kuvnishanswered a year ago


Question: AWS Code Deploy stage failing for serverless NodeJS lambda deployment. Error with AppSpec.yml file

"I have recently created a Code Pipeline. It starts with Source from Git hub repo [work perfectly fine]. Then the next stage is code build [works perfectly fine as well]. But it fails in the code deployment stage, the code build creates an artifact as a zip file and uploads it to the S3 bucket, the code deploy picks it from the same location but somehow it is not able to find or not able to parse the appspec.yml.The IAM roles and permission required are perfectly fine for the pipeline when I run code deployment manually from the console by copy-pasting the content from appspec.yml it works perfectly fine.Following is my folder structuresrc   handler   service   modelspackage.jsonserverless.ymlbuildspec.ymlappspec.ymlThe contents of buildspec artifact sectionartifacts:  files:    - src/**/*    - appspec.yml    - package.json    - package-lock.json    - node_modules/**/**P.S I am not using Webpack or anything as of now*The contents of appspec.yml are as belowversion: 0.0Resources:  - apis-dev-hello:      Type: AWS::Lambda::Function      Properties:        Name: apis-dev-hello        Alias: api-dev-hello        CurrentVersion: 2        TargetVersion: 2FollowCommentMarkusL 20 days agoHi RD!Would you be able to share a complete but minimal reproducible version of the problem via a Git repository?Regards, MarkusShare"


Question: Does it make sense to use AWS Microsot Managed AD for use it as a Secondary Domain Controller of an on-premise controller?

"If yes, do you know a good guide to do it?Thank you.FollowComment"

Answer: 0This may be useful if you are migrating from on-premise.https://docs.aws.amazon.com/directoryservice/latest/admin-guide/usecase5.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months agoEXPERTkentradreviewed 2 months ago


Question: Available free space on the FSx volume

"Dear Team,We have Amazon FSx service, utilizing this as a datastore on VMC in AWS. The datastore is currently reflecting the free space available on the SSD tier. But we use this datastore for archiving purposes and hence all the data is tiered to the capacity storage. Hence, rather than the free space on the SSD tier (or file system in other words), we would like to know the free space avaialable on the capacity tier (or volume in other words). I know we can get this information from the running the command "volume show-space" on the SVM but how do we get this information in a email every few hours so that we don't have to login to the SVM every now and then to check the available capacity.Thanks in advance for your help.Regards,KarthikFollowComment"

Answer: "0The following architecture shows how to dynamically increase space.   It also shows how to use SNS to send an Email.https://docs.aws.amazon.com/fsx/latest/WindowsGuide/managing-storage-capacity.html#automate-storage-capacity-increaseIn short, this architecture sets a cloud watch alarm on low space.    Then you can set that alarm to notify an SNS Topic, which can subscribe too via email.Update:   Since you are using Amazon FSx for NetApp ONTAP the metrics will be slightly different and the details of those can be found.https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/alarm-low-primary-storage.htmlCommentShareRobert Loveanswered a month agoIthark a month agoHi Robert,Thanks for your reply.We are using Amazon FSx for NetApp ONTAP and not Amazon FSx for Windows File Server and hence I belive this doesn't apply to us, am I correct in my assumption?Also, we need the email alert for the storage capacity of the capacity tier and not for the performance tier (SSD). In the cloud watch metric, I couldn't find a single metric which provides us with the informaton about the capacity tier volume statistics.Regards,KarthikShareRobert Love a month agoUpdated the original answer with the metrics you have to use for the Alarms so you can have that alarm send a SNS message.Share0There is no logical limit to the amount of data you can store in capacity pool storage for your Amazon FSx for NetApp ONTAP file system. Instead, the physical limit is determined by the size of your SSD tier, because all file metadata is always stored on the SSD tier (see How SSD is used for more information). Meanwhile, volumes are logical data containers--your volume storage capacity sets the limit of logical data you can store in your volume. For example, if you have a 1 GiB volume, with 200 MiB of data stored on the SSD tier and 500 MiB on the capacity pool tier, the used capacity of the volume is 700 MiB / 1024 MiB. The FSx for ONTAP docs has a diagram that illustrates this (see the storage tiers).You can use FSx for ONTAP CloudWatch metrics in order to monitor the utilization of your file system and its volumes.CommentSharedcinglis-awsanswered a month ago"


Question: "Using aws secure tunnel to access the device via ssh, running cat greengrass log froze the session"

"Established a secure tunnel to my greengrass core device. I can reach to the device without problem. I can list /greengrass/v2/logs, and then when I run cat greengrass.log, the session is frozen. Even with CTRL-C, I can not get out of that session. I could not run another ssh session as well.The localproxy is configured with default setting:{"tunneling": {"proxy": {"default_bind_address": "localhost","message": {"data_length_size": "2","data_frame_max_size": "65538","max_payload_size": "64512","max_size": "65536"},"tcp": {"connection_retry_count": "5","connection_retry_delay_ms": "1000","read_buffer_size": "131076"},"websocket": {"ping_period_ms": "5000","retry_delay_ms": "2500","connect_retry_count": "-1","reconnect_on_data_error": "true","subprotocol": "aws.iot.securetunneling-1.0","max_frame_size": "131076","write_buffer_size": "131076","read_buffer_size": "131076"},"region_endpoint_overrides": {"cn-north-1": "data.tunneling.iot.cn-north-1.amazonaws.com.cn","cn-northwest-1": "data.tunneling.iot.cn-northwest-1.amazonaws.com.cn"}}}}I noticed that the response is slow from the device when I type before I ran cat. i understand there is a bandwidth limit for secure tunnel, but it should not freeze.FollowCommentochoanel 8 months agoHey AWS-User-7353088,In order for us to check a bit more what might be wrong could you please tell usWhat version of the localproxy are you using?What version of aws.greengrass.SecureTunneling component you are using?What OS/Architecture are you running it on the source and destination devices?What was the size of your greengrass.log file when you try to cat it?Are there any logs on the localproxy that display any sort of error?What command are you using to run local proxy? (but with the access token redacted)What error did you get when you tried to open another ssh session?Share"


Question: Latest DMS Engine Version

"I am trying to find the latest DMS engine version number.Here is what I have found:"When you launch a new replication instance, it runs the latest AWS DMS engine version unless you specify otherwise."But this does not mention what the latest version number is.Using a PostgreSQL database as an AWS DMS source says:PostgreSQL source version 14.x - Use Aws DMS version 3.4.7 and above.This, at least specifies that there is a version 3.4.7, but it doesn't say that is the latest number.Today I created a DMS Replication instance with DMS endpoints.  The replication instance shows engine version 3.4.6 and I did not specify the engine version.  But it seems like there must be a version 3.4.7 because that is required when your source db is PostgreSQL version 14.x.Where can I find the current, latest DMS engine version number?FollowComment"

Answer: "1Accepted AnswerIn the AWS Console, navigate to the ****DMS ****(Database Migration Service) section using the search bar.From the left side navigation menu , select Replication Instances.Select the link to the replication instance that you want to know the version of.The Summary section will display the version of the DMS instanceunder Engine Version heading.this link provides the most current information:https://docs.aws.amazon.com/dms/latest/userguide/CHAP_ReleaseNotes.htmlCommentSharecedhoodanswered 4 months agoFletcher Chambers 4 months agoThat does show the version that is currently being used by the replication instance.  How do I know what the latest possible version is?  Does AWS publish the latest possible version number anywhere?ShareFletcher Chambers 4 months agoThe text of your link is what I am looking for.  Thank you!However, the link itself just comes back to this question.Share0Ideally it should launch latest version of DMS instance if you dont provide version. I hope you are using some automation tool which might be defaulting to 3.4.6.If you manually input the version to 3.4.7 it should launch the required one.if you use manual console way to launch a replication instance it should launch with version 3.4.7 (latest)CommentShareAWS-User-8174525-subhashanswered 4 months agoFletcher Chambers 4 months agoI am using HashiCorp terraform aws_dms_replication_instance and not specifying an engine_version.  I have tried searching to see if HashiCorp is defaulting a version number but can't find any.  I would assume there is no default because AWS says if you don't specify a version number you get the latest.Share0Hi , if you use CFN, this works fine in Resources section:CdcReplicationInstance:     Type: AWS::DMS::ReplicationInstance    DeletionPolicy: Delete    Properties:        ReplicationInstanceClass: !Ref CdcInstanceType      EngineVersion: !Ref CdcEngineVersion      #Same as Subnet1      AvailabilityZone: !Select        - 0        - !GetAZs ""      ReplicationSubnetGroupIdentifier: !Ref CdcDmsSubnetGroupwhere CdcEngineVersion is in Parameter section:CdcEngineVersion:    Description: 'dms cdc engine version'    Default: '3.4.7'    Type: StringCommentShareDidier_AWSanswered 4 months agoFletcher Chambers 4 months agoSo you are specifying an engine version number.  But is that the latest number?  How do you know if that is the latest engine version number?Share-1Hi, If you use CloudFormation, use this:![screenshot(/media/postImages/original/IMUwG5XsnzRYq4t-hlioznMg)I use this all the time and it works fine to reach the version of engine that you wantCommentShareDidier_AWSanswered 4 months ago"


Question: Error with awscli sync command

"I use very often the 'aws s3 sync s3://xxxx/ local-dir/' command, without any problem, but today a problem surfaced.A file is downloaded each time I run the command, and in a wrong position. Just to be shure that it is not a problem with my local computer, I'm running this on AWS CloudShell.[cloudshell-user@ip-10-0-96-146 ~]$ aws --versionaws-cli/2.1.28 Python/3.8.8 Linux/4.14.225-168.357.amzn2.x86_64 exec-env/CloudShell exe/x86_64.amzn.2 prompt/offSo here is my problem (sorry I cannot share here exact details of the pathnames).$ mkdir X$ aws s3 sync s3://my-bucket/ X/After the download a single file, say 'ghost.abc' shows up in 'X/' both in its correct position, say 'X/ghost-town/ghost.abc' and as 'X/ghost.abc'If I repeat the command, each time I get the very same message, and the file is donwloaded again and again.$ aws s3 sync s3://my-bucket/ X/download: s3://my-bucket//ghost.abc to X/ghost.abc$ aws s3 sync s3://my-bucket/ X/download: s3://my-bucket//ghost.abc to X/ghost.abcI have no way to make this bug reproducible, because in 'my-bucket' there are hundreds of files with similar names, but this problem surfaced only recently for a single file. Moreover other buckets sync nicely.Please also note the '//' in the download message: the correct URI of the file is 's3://my-bucket/ghost-town/ghost.abc', its like as if the prefix is lost...I just got another glimpse to the problem. With '$ aws s3 ls s3://proface' the file does not show up, but$ aws s3 ls s3://my-bucket --recursive | grep ghost.abc2021-06-16 21:26:38       4053 /ghost.abc2021-06-16 21:28:03       4053 ghost-town/ghost.abcNote again the spurious slash... Bucket versioning is not enabled.The problem is quite annoying: how can I investigate this further?FollowComment"

Answer: "0Maybe I've nailed down the problem: in my bucket there is an empty prefixaws s3 ls s3://my-bucketPRE /PRE ghost-town/...in which the spurious copy of the file is stored. So actually awscli is confused because there is no way to map the remote file correctly to the local filesystem.Edited by: stefano-m on Jun 29, 2021 8:25 AMEdited by: stefano-m on Jun 29, 2021 8:32 AMCommentSharestefano-manswered 2 years ago"


Question: Change in contact info for AWS

How do I remove a past employee's name and email address from receiving your emails and replace with a new name and email address?FollowComment

Answer: "0Hi,I guess you're looking for this information: https://repost.aws/knowledge-center/change-email-addressKind regards,RobinCommentShareMODERATORrobinkawsanswered a month ago"


Question: How to Add transform classes to MSK connect

We added our own Jar with transformation classes to MSK Connect plugin zip file.We then specified the name of the connector in a transform property .Unfortunately we are getting 'Class not found' error.We verified and jar & class exist in ZIP & plugin configuration is correct.Is it possible to add our custom transform classes to MSK connect (plugin.path?) ?FollowComment

Answer: 0When renaming the package of the transformation class to 'org.apache.kafka.connect.transforms.<classname>' .CommentShareMatanCanswered a year ago


Question: cognito signup confirmation emails provide link that indicates it is invalid... what causes this to happen?

"I recreated this issue by checking the user pool to verify a user with specific email address does not exists.  I have signup link on login screen that uses amplify to do the signup for new account.  The settings for a new account require email and  verification is set to be sent by email.  New user uses sign up on site then after I checked user pool, the user shows added and UNCONFIRMED .  The new user goes to their email and they have an email verification with a link to verify the email address... when they click on the link they get this message back indicating the link was invalid.But if you check the user in the user pool.. it now shows as CONFIRMED.  Why is the user's link showing it is invalid... this is confusing to the new user who just signed up...  What causes this?  We do not have custom signup  flow  - nor any lambda triggers - we are relying on the automated service to do the work.FollowComment"


Question: How to add managed stateful rule groups to network firewall with CloudFormation ?

"Via the console, we can add managed stateful rule groups : how to achieve the same thing using a cloud formation template ?For example :PriorityName1AbusedLegitMalwareDomainsStrictOrder2BotNetCommandAndControlDomainsStrictOrder3AbusedLegitBotNetCommandAndControlDomainsStrictOrder4ThreatSignaturesBotnetStrictOrder5ThreatSignaturesBotnetWebStrictOrderThe objective is also to have a strict order of priorities as indicated, as an example, in the table above.Thank you in advance for your answers.FollowComment"

Answer: "0Hello,Please follow the below link to add managed stateful rule groups to network firewall with CloudFormation:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-rulegroup.html#aws-resource-networkfirewall-rulegroup--examplesCommentShareSUPPORT ENGINEERrePost-User-5821105answered 8 months agoST Team 8 months agoThank you for your answer, but it does not answer my question. The question is about the stateful rule groups managed by AWS, not the rules you create yourself.Share0Hello,You can use AWS::NetworkFirewall::FirewallPolicy to add managed rule groups to your Network Firewall policies. Sub-Property StatefulRuleGroupReference can be used to set Priority for each managed rule group specified in property ResourceArn. To get the ARN of the AWS managed rule group, use list-rule-groups AWS CLI. See example for reference.CommentShareSUPPORT ENGINEERSreshtha_Kanswered 7 months ago"


Question: Want to use amazon_transcribe streaming service with flask.

"Hi Team,I want to use amazon_transcribe python api. I have successfully integrated the api to my flask app. Here comes a small problem, the sample code provided in the amazon_transcribe documentation uses sounddevice library to take input from microphone but servers don't have microphone so I want to use microphone from client side i.e javascript. Can I get any sample code which takes microphone input from javascript and use the python amazon_transcribe for transcriptions. It will be good if I get javascript implementation of amazon transcription streaming library which takes input from client side and provides transcriptions.FollowComment"

Answer: "0Hi Team,I found a solution for this. I didn't find python solution but I did find nodejs solution. I integrated the nodejs code in my flask application.https://github.com/amazon-archives/amazon-transcribe-websocket-staticthis link has the nodejs code.CommentSharesaviour_oasisanswered a year ago"


Question: Web server down. Error code 521

"My web server is not responding. When accessing the website, the web server is noted as down. That is, Error code 521 appearsFollowComment"

Answer: "0If I access the EC2 website directly without Cloudflare in between, will the page appear?Was the website accessible in the first place?If you were able to access the site, check to see if the web server in EC2 (for example, Apache) is running.If you are not able to access it, please check if communication from Cloudflare is allowed in the EC2 security group, etc.IP addresses from Cloudflare are listed at.https://www.cloudflare.com/ips/For additional troubleshooting, please check the following sites.https://community.cloudflare.com/t/521-web-server-is-down-web/398712If this answer has led to a resolution, please approve the answer for the betterment of the community.CommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: Horrible PearsonVUE Experience

"Sat for an AWS cloud practitioner exam last night with PearsonVue and got terminated for "leaning in". I felt that it was horribly unjustified. The first time I did it, I got a warning for leaning in. I responded the proctor with okay I'll make sure of that. From then, I paid a little more attention to the camera to make sure that I am in frame. When I was checking my answers, he suddenly terminated me saying that I have repeated the offence.Firstly. Laptop screens are small and the text in the UI aren't huge either. There weren't any buttons to zoom in to the text so is it not natural to bring your face closer and squint your eyes? Not teaching how to conduct the exam but if suspect someone of cheating, do a live scan as per PearsonVue's T&Cs and not be terminated abruptly.As per PearsonVue's T&Cs:You may be subject to additional potential inspections, including the following:A proctor may ask you to show your ears if you have hair that covers your ears, for the purpose of verifying that no Bluetooth devices are present.A proctor may ask you to roll up your sleeves to verify that you have no writing on your arms.A proctor may ask you to empty your pockets for the purpose of ensuring nothing is in them.*** A proctor may ask you to complete a full 360-degree room scan either during check-in or during your exam.**Otherwise, I believe all the candidates should be given the due respect for the hours spent studying and the money used to pay for this examination. I have the case number and the name of the proctor ready should AWS choose to investigate this matter. Send me proof and tell me which part I'm leaning in too much if possible instead of accusing. Fun fact, I too have a colleague who took the same exam at a different time, got the same proctor and also abruptly terminated for a different reason.Also for PearsonVue: I propose doing multi-devices set up or something to prevent unnecessary misunderstandings.Anyways I just thought this should be brought up to attention as AWS is still well-loved by many and would love to have someone directly from AWS to contact regarding my case since the call center of PearsonVue didn't do a good job as well.Cheers,DesmondFollowComment"

Answer: "0Thank you for sharing your experience. While we understand that you had a frustrating experience, based on what you shared, the proctor was following the guidelines for our exams. If you need to lean into your screen for any portion of an exam, I encourage you to apply for an accommodation for ZoomText. You can find more about requesting accommodations in your AWS Certification portal (aws.training/certification).If you would like us to investigate your case further, please submit a ticket at https://aws.amazon.com/contact-us/aws-training/CommentShareKimWD-AWSanswered a year ago0Recently had the same experience for the AWS SAP C02 exam. I thought that taking the exam online would be a great option, but I was wrong. Unfortunately, the Pearson proctors are unreasonable, inattentive to questions or concerns, and mostly outsourced, non-native English speakers.I would advise anyone taking an AWS certification to go to a testing center rather than roll the dice with the online offering.CommentSharerePost-User-9378125answered 3 months ago"


Question: S3 Object delete

I am using S3 Lifecycle policy to delete objects which are greater than 7 days but my folders are also being deleted along with the objects. Isn't there any way where my objects only are deleted and not folders. I know that S3 follows a flat file structure but there must be a way. Can someone help me in this ?FollowComment

Answer: "2Accepted AnswerAdding to Indranil's answer, the S3 console fakes folders for our pleasure (and confusion at times).  If there's an object whose name ends in "/" then the S3 console will display it as a folder but to the underlying S3 service it's just another object.  Similarly if you create a folder (e.g. "folder1") from within the S3 console then it will create a 0-size object with a "/" suffix on its name, e.g. "folder1/".So to answer your question "isn't there any way", yes sort of.  You can follow the same idiom as the S3 console and keep 0-sized objects named "folder1/", "folder2/" etc that will appear as folders in the console even when all other objects with those prefixes have been deleted.  They will however appear as objects when you query the S3 API.  Then add a filter to your Lifecycle rule, ticking "Specify minimum object size" and only delete objects > 0 bytes.  I expect your 0-sized objects will remain.CommentShareEXPERTskinsmananswered a year agoAWS-User-8470889 a year agoThanks, it worked.Share1S3 is an object store and not a file system. So it doesn't have the notion of folders. Instead it uses what are known as prefixes, which may make it appear like you are using folders, but prefixes are just part of the key. If there isn't any object that is using a particular prefix, then that prefix has no valid reason to exist. If you need the prefix, it can be recreated the moment you create a new object that uses the prefix.CommentShareEXPERTIndranil Banerjee AWSanswered a year agorePost-User-3337950 a year agoSo, there isn't any where my folders are not impacted by lifecycle policy ?Shareskinsman EXPERTa year agoYes, if you use "Specify minimum object size" as in my answer a few days ago - did that not help?Share"


Question: Private IP VPN CIDR Block(transit gateway) and Customer Gateway on the same Subnet

"Can someone Please explain why does the Customer Gateway IP Address have to be assigned from the CIDR Block in the Transit GW. I think this is a typo in the document.https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-site-to-site-vpn-private-ip-vpns/In Step 4:The IP address to configure in the Customer gateway should be from the Transit Gateway CIDR block we defined in Step 2, and the BGP ASN the one from your on-premises environment.FollowComment"

Answer: "0A response would be highly appreciated, This is a new feature from AWS and any insight on the documentation would be highly appreciated. I have posted various questions regarding private VPN over the direct connect but I am yet to hear from someone who has successfully implemented this feature.CommentShareTarunanswered 8 months ago0Hi Tarun,You are correct. Please note information provided in the blogs is subject to change depending on when it was published so its best to cross check with the actual documentation of the service.I suggest to refer below note from the documentation: https://docs.aws.amazon.com/vpn/latest/s2svpn/private-ip-dx.htmlIf the Answer is helpful, kindly Mark the answer as 'accepted' answer, so it will help others in similar situation, Thank you.CommentShareEXPERTTushar_Janswered 8 months agoSUPPORT ENGINEERMonica_Lluisreviewed 8 months ago0Hello!We updated the blog post in October 2022 removing that typo: the customer gateway IP to configure does not need to be inside the range of the Transit Gateway CIDR block configure. What you need to make sure, as pointed out by Tushar, is that this IP does not overlap with the TGW CIDR block (as well as any CIDR block in AWS or your on-premises location).CommentSharePablo_Sanswered 5 months ago"


Question: Does WAF support ALB with the new gRPC feature?

We've released gRPC support for ALB. Does WAF integrate with that out of the box?Thanks!FollowComment

Answer: "0Accepted AnswerThe gPRC setting is set on the target group on ALB, and it utilizes HTTP/2 for transport, so simply put - Yes.You can certainly attach a WAF policy to your ALB, but as for the nature of the actual payload in gRPC I believe there is a risk of triggering false positives (when WAF will match a signature to some pattern in the request as it comes in).CommentShareTzoori Tamamanswered 3 years ago"


Question: How should a custom SageMaker algorithm determine if checkpoints are enabled?

"Per the SageMaker Environment Variables doc, algorithms should save model artifacts to the folder prescribed by SM_MODEL_DIR.The SageMaker Containers doc describes additional environment variables, including SM_OUTPUT_DATA_DIR to write non-model training artifacts....But how should the algorithm determine if checkpointing has been requested?The Using Checkpoints in Amazon SageMaker doc only specifies a default local path to save them to, and I can't see any environment variables that would indicate whether or not to checkpoint. I've seen one piece of code checking for the existence of that default local path, but not convinced anybody's actually checked to see whether it works (is present when checkpointing is requested and absent when not).It's good to parameterize Checkpointing to avoid wasting EBS space (and precious seconds of IO) in jobs when it's not needed; and by the conventions for other I/O like model and data folders I would assume SageMaker to have a specific mechanism to pass this instruction, rather than just defining an algo hyperparameter?FollowComment"

Answer: "0Accepted AnswerHi,For custom Sagemaker containers or  deep learning frameworks, I tend to do this..and it worksThis example is for pytorch I have triedentry point file:# 1. Define a custom argument, say checkpointdir parser.add_argument("--checkpointdir", help="The checkpoint dir", type=str,                     default=None)# 2. You can additional params for checkpoint frequency etc# 3. Code for checkpointingif checkpointdir is not None:   #TODO: save mode Sagemaker estimator in Jupyter notebook, for. e.g.# 1. Define local and remote variables for checkpointscheckpoint_s3 = "s3://{}/{}t/".format(bucket, "checkpoints")localcheckpoint_dir="/opt/ml/checkpoints/"hyperparameters = {    "batchsize": "8",    "epochs" : "1000",    "learning_rate":.0001,    "weight_decay":5e-5,    "momentum":.9,    "patience": 20,    "log-level" : "INFO",    "commit_id":commit_id,    "model" :"FasterRcnnFactory",    "accumulation_steps": 8,# 2.  define hp for checkpoint dir    "checkpointdir": localcheckpoint_dir}# In the Sagemaker estimator fit, specify the local and remote pathfrom sagemaker.pytorch import PyTorchestimator = PyTorch(     entry_point='experiment_train.py',                    source_dir = 'src',                    dependencies =['src/datasets', 'src/evaluators', 'src/models'],                    role=role,                    framework_version ="1.0.0",                    py_version='py3',                    git_config= git_config,                    image_name= docker_repo,                    train_instance_count=1,                    train_instance_type=instance_type,# 3. The entrypoint file will pick up the checkpoint location from here                    hyperparameters =hyperparameters,                    output_path=s3_output_path,                    metric_definitions=metric_definitions,                    train_use_spot_instances = use_spot,                    train_max_run =  train_max_run_secs,                    train_max_wait = max_wait_time_secs,                       base_job_name ="object-detection",# 4. Sagemaker knows that the checkpoints will need to be periodically copied from the localcheckpoint_dir to s3 pointed to by checkpoint_s3                    checkpoint_s3_uri=checkpoint_s3,                    checkpoint_local_path=localcheckpoint_dir)CommentShareEXPERTAparna_Eanswered 3 years ago"